Commit graph

1,447,411 commits

Author SHA1 Message Date
Michal Luczaj
64c2f93fc3 bpf, sockmap: Take state lock for af_unix iter
When a BPF iterator program updates a sockmap, there is a race condition in
unix_stream_bpf_update_proto() where the `peer` pointer can become stale[1]
during a state transition TCP_ESTABLISHED -> TCP_CLOSE.

        CPU0 bpf                          CPU1 close
        --------                          ----------
// unix_stream_bpf_update_proto()
sk_pair = unix_peer(sk)
if (unlikely(!sk_pair))
   return -EINVAL;
                                     // unix_release_sock()
                                     skpair = unix_peer(sk);
                                     unix_peer(sk) = NULL;
                                     sock_put(skpair)
sock_hold(sk_pair) // UaF

More practically, this fix guarantees that the iterator program is
consistently provided with a unix socket that remains stable during
iterator execution.

[1]:
BUG: KASAN: slab-use-after-free in unix_stream_bpf_update_proto+0x155/0x490
Write of size 4 at addr ffff8881178c9a00 by task test_progs/2231
Call Trace:
 dump_stack_lvl+0x5d/0x80
 print_report+0x170/0x4f3
 kasan_report+0xe4/0x1c0
 kasan_check_range+0x125/0x200
 unix_stream_bpf_update_proto+0x155/0x490
 sock_map_link+0x71c/0xec0
 sock_map_update_common+0xbc/0x600
 sock_map_update_elem+0x19a/0x1f0
 bpf_prog_bbbf56096cdd4f01_selective_dump_unix+0x20c/0x217
 bpf_iter_run_prog+0x21e/0xae0
 bpf_iter_unix_seq_show+0x1e0/0x2a0
 bpf_seq_read+0x42c/0x10d0
 vfs_read+0x171/0xb20
 ksys_read+0xff/0x200
 do_syscall_64+0xf7/0x5e0
 entry_SYSCALL_64_after_hwframe+0x76/0x7e

Allocated by task 2236:
 kasan_save_stack+0x30/0x50
 kasan_save_track+0x14/0x30
 __kasan_slab_alloc+0x63/0x80
 kmem_cache_alloc_noprof+0x1d5/0x680
 sk_prot_alloc+0x59/0x210
 sk_alloc+0x34/0x470
 unix_create1+0x86/0x8a0
 unix_stream_connect+0x318/0x15b0
 __sys_connect+0xfd/0x130
 __x64_sys_connect+0x72/0xd0
 do_syscall_64+0xf7/0x5e0
 entry_SYSCALL_64_after_hwframe+0x76/0x7e

Freed by task 2236:
 kasan_save_stack+0x30/0x50
 kasan_save_track+0x14/0x30
 kasan_save_free_info+0x3b/0x70
 __kasan_slab_free+0x47/0x70
 kmem_cache_free+0x11c/0x590
 __sk_destruct+0x432/0x6e0
 unix_release_sock+0x9b3/0xf60
 unix_release+0x8a/0xf0
 __sock_release+0xb0/0x270
 sock_close+0x18/0x20
 __fput+0x36e/0xac0
 fput_close_sync+0xe5/0x1a0
 __x64_sys_close+0x7d/0xd0
 do_syscall_64+0xf7/0x5e0
 entry_SYSCALL_64_after_hwframe+0x76/0x7e

Fixes: 2c860a43dd ("bpf: af_unix: Implement BPF iterator for UNIX domain socket.")
Suggested-by: Kuniyuki Iwashima <kuniyu@google.com>
Signed-off-by: Michal Luczaj <mhal@rbox.co>
Signed-off-by: Martin KaFai Lau <martin.lau@kernel.org>
Reviewed-by: Kuniyuki Iwashima <kuniyu@google.com>
Link: https://patch.msgid.link/20260414-unix-proto-update-null-ptr-deref-v4-5-2af6fe97918e@rbox.co
2026-04-15 17:23:14 -07:00
Michal Luczaj
dca38b7734 bpf, sockmap: Fix af_unix null-ptr-deref in proto update
unix_stream_connect() sets sk_state (`WRITE_ONCE(sk->sk_state,
TCP_ESTABLISHED)`) _before_ it assigns a peer (`unix_peer(sk) = newsk`).
sk_state == TCP_ESTABLISHED makes sock_map_sk_state_allowed() believe that
socket is properly set up, which would include having a defined peer. IOW,
there's a window when unix_stream_bpf_update_proto() can be called on
socket which still has unix_peer(sk) == NULL.

         CPU0 bpf                            CPU1 connect
         --------                            ------------

                                WRITE_ONCE(sk->sk_state, TCP_ESTABLISHED)
sock_map_sk_state_allowed(sk)
...
sk_pair = unix_peer(sk)
sock_hold(sk_pair)
                                sock_hold(newsk)
                                smp_mb__after_atomic()
                                unix_peer(sk) = newsk

BUG: kernel NULL pointer dereference, address: 0000000000000080
RIP: 0010:unix_stream_bpf_update_proto+0xa0/0x1b0
Call Trace:
  sock_map_link+0x564/0x8b0
  sock_map_update_common+0x6e/0x340
  sock_map_update_elem_sys+0x17d/0x240
  __sys_bpf+0x26db/0x3250
  __x64_sys_bpf+0x21/0x30
  do_syscall_64+0x6b/0x3a0
  entry_SYSCALL_64_after_hwframe+0x76/0x7e

Initial idea was to move peer assignment _before_ the sk_state update[1],
but that involved an additional memory barrier, and changing the hot path
was rejected.
Then a NULL check during proto update in unix_stream_bpf_update_proto() was
considered[2], but the follow-up discussion[3] focused on the root cause,
i.e. sockmap update taking a wrong lock. Or, more specifically, missing
unix_state_lock()[4].
In the end it was concluded that teaching sockmap about the af_unix locking
would be unnecessarily complex[5].
Complexity aside, since BPF_PROG_TYPE_SCHED_CLS and BPF_PROG_TYPE_SCHED_ACT
are allowed to update sockmaps, sock_map_update_elem() taking the unix
lock, as it is currently implemented in unix_state_lock():
spin_lock(&unix_sk(s)->lock), would be problematic. unix_state_lock() taken
in a process context, followed by a softirq-context TC BPF program
attempting to take the same spinlock -- deadlock[6].
This way we circled back to the peer check idea[2].

[1]: https://lore.kernel.org/netdev/ba5c50aa-1df4-40c2-ab33-a72022c5a32e@rbox.co/
[2]: https://lore.kernel.org/netdev/20240610174906.32921-1-kuniyu@amazon.com/
[3]: https://lore.kernel.org/netdev/7603c0e6-cd5b-452b-b710-73b64bd9de26@linux.dev/
[4]: https://lore.kernel.org/netdev/CAAVpQUA+8GL_j63CaKb8hbxoL21izD58yr1NvhOhU=j+35+3og@mail.gmail.com/
[5]: https://lore.kernel.org/bpf/CAAVpQUAHijOMext28Gi10dSLuMzGYh+jK61Ujn+fZ-wvcODR2A@mail.gmail.com/
[6]: https://lore.kernel.org/bpf/dd043c69-4d03-46fe-8325-8f97101435cf@linux.dev/

Summary of scenarios where af_unix/stream connect() may race a sockmap
update:

1. connect() vs. bpf(BPF_MAP_UPDATE_ELEM), i.e. sock_map_update_elem_sys()

   Implemented NULL check is sufficient. Once assigned, socket peer won't
   be released until socket fd is released. And that's not an issue because
   sock_map_update_elem_sys() bumps fd refcnf.

2. connect() vs BPF program doing update

   Update restricted per verifier.c:may_update_sockmap() to

      BPF_PROG_TYPE_TRACING/BPF_TRACE_ITER
      BPF_PROG_TYPE_SOCK_OPS (bpf_sock_map_update() only)
      BPF_PROG_TYPE_SOCKET_FILTER
      BPF_PROG_TYPE_SCHED_CLS
      BPF_PROG_TYPE_SCHED_ACT
      BPF_PROG_TYPE_XDP
      BPF_PROG_TYPE_SK_REUSEPORT
      BPF_PROG_TYPE_FLOW_DISSECTOR
      BPF_PROG_TYPE_SK_LOOKUP

   Plus one more race to consider:

            CPU0 bpf                            CPU1 connect
            --------                            ------------

                                   WRITE_ONCE(sk->sk_state, TCP_ESTABLISHED)
   sock_map_sk_state_allowed(sk)
                                   sock_hold(newsk)
                                   smp_mb__after_atomic()
                                   unix_peer(sk) = newsk
   sk_pair = unix_peer(sk)
   if (unlikely(!sk_pair))
      return -EINVAL;

                                                 CPU1 close
                                                 ----------

                                   skpair = unix_peer(sk);
                                   unix_peer(sk) = NULL;
                                   sock_put(skpair)
   // use after free?
   sock_hold(sk_pair)

   2.1 BPF program invoking helper function bpf_sock_map_update() ->
       BPF_CALL_4(bpf_sock_map_update(), ...)

       Helper limited to BPF_PROG_TYPE_SOCK_OPS. Nevertheless, a unix sock
       might be accessible via bpf_map_lookup_elem(). Which implies sk
       already having psock, which in turn implies sk already having
       sk_pair. Since sk_psock_destroy() is queued as RCU work, sk_pair
       won't go away while BPF executes the update.

   2.2 BPF program invoking helper function bpf_map_update_elem() ->
       sock_map_update_elem()

       2.2.1 Unix sock accessible to BPF prog only via sockmap lookup in
             BPF_PROG_TYPE_SOCKET_FILTER, BPF_PROG_TYPE_SCHED_CLS,
             BPF_PROG_TYPE_SCHED_ACT, BPF_PROG_TYPE_XDP,
             BPF_PROG_TYPE_SK_REUSEPORT, BPF_PROG_TYPE_FLOW_DISSECTOR,
             BPF_PROG_TYPE_SK_LOOKUP.

             Pretty much the same as case 2.1.

       2.2.2 Unix sock accessible to BPF program directly:
             BPF_PROG_TYPE_TRACING, narrowed down to BPF_TRACE_ITER.

             Sockmap iterator (sock_map_seq_ops) is safe: unix sock
             residing in a sockmap means that the sock already went through
             the proto update step.

             Unix sock iterator (bpf_iter_unix_seq_ops), on the other hand,
             gives access to socks that may still be unconnected. Which
             means iterator prog can race sockmap/proto update against
             connect().

             BUG: KASAN: null-ptr-deref in unix_stream_bpf_update_proto+0x253/0x4d0
             Write of size 4 at addr 0000000000000080 by task test_progs/3140
             Call Trace:
              dump_stack_lvl+0x5d/0x80
              kasan_report+0xe4/0x1c0
              kasan_check_range+0x125/0x200
              unix_stream_bpf_update_proto+0x253/0x4d0
              sock_map_link+0x71c/0xec0
              sock_map_update_common+0xbc/0x600
              sock_map_update_elem+0x19a/0x1f0
              bpf_prog_bbbf56096cdd4f01_selective_dump_unix+0x20c/0x217
              bpf_iter_run_prog+0x21e/0xae0
              bpf_iter_unix_seq_show+0x1e0/0x2a0
              bpf_seq_read+0x42c/0x10d0
              vfs_read+0x171/0xb20
              ksys_read+0xff/0x200
              do_syscall_64+0xf7/0x5e0
              entry_SYSCALL_64_after_hwframe+0x76/0x7e

             While the introduced NULL check prevents null-ptr-deref in the
             BPF program path as well, it is insufficient to guard against
             a poorly timed close() leading to a use-after-free. This will
             be addressed in a subsequent patch.

Fixes: c63829182c ("af_unix: Implement ->psock_update_sk_prot()")
Closes: https://lore.kernel.org/netdev/ba5c50aa-1df4-40c2-ab33-a72022c5a32e@rbox.co/
Reported-by: Michal Luczaj <mhal@rbox.co>
Reported-by: 钱一铭 <yimingqian591@gmail.com>
Suggested-by: Kuniyuki Iwashima <kuniyu@google.com>
Suggested-by: Martin KaFai Lau <martin.lau@linux.dev>
Signed-off-by: Michal Luczaj <mhal@rbox.co>
Signed-off-by: Martin KaFai Lau <martin.lau@kernel.org>
Reviewed-by: Kuniyuki Iwashima <kuniyu@google.com>
Link: https://patch.msgid.link/20260414-unix-proto-update-null-ptr-deref-v4-4-2af6fe97918e@rbox.co
2026-04-15 17:22:58 -07:00
Michal Luczaj
997b8483d4 selftests/bpf: Extend bpf_iter_unix to attempt deadlocking
Updating a sockmap from a unix iterator prog may lead to a deadlock.
Piggyback on the original selftest.

Signed-off-by: Michal Luczaj <mhal@rbox.co>
Signed-off-by: Martin KaFai Lau <martin.lau@kernel.org>
Reviewed-by: Jiayuan Chen <jiayuan.chen@linux.dev>
Reviewed-by: Kuniyuki Iwashima <kuniyu@google.com>
Link: https://patch.msgid.link/20260414-unix-proto-update-null-ptr-deref-v4-3-2af6fe97918e@rbox.co
2026-04-15 17:22:55 -07:00
Michal Luczaj
4d328dd695 bpf, sockmap: Fix af_unix iter deadlock
bpf_iter_unix_seq_show() may deadlock when lock_sock_fast() takes the fast
path and the iter prog attempts to update a sockmap. Which ends up spinning
at sock_map_update_elem()'s bh_lock_sock():

WARNING: possible recursive locking detected
test_progs/1393 is trying to acquire lock:
ffff88811ec25f58 (slock-AF_UNIX){+...}-{3:3}, at: sock_map_update_elem+0xdb/0x1f0

but task is already holding lock:
ffff88811ec25f58 (slock-AF_UNIX){+...}-{3:3}, at: __lock_sock_fast+0x37/0xe0

other info that might help us debug this:
 Possible unsafe locking scenario:

       CPU0
       ----
  lock(slock-AF_UNIX);
  lock(slock-AF_UNIX);

 *** DEADLOCK ***

 May be due to missing lock nesting notation

4 locks held by test_progs/1393:
 #0: ffff88814b59c790 (&p->lock){+.+.}-{4:4}, at: bpf_seq_read+0x59/0x10d0
 #1: ffff88811ec25fd8 (sk_lock-AF_UNIX){+.+.}-{0:0}, at: bpf_seq_read+0x42c/0x10d0
 #2: ffff88811ec25f58 (slock-AF_UNIX){+...}-{3:3}, at: __lock_sock_fast+0x37/0xe0
 #3: ffffffff85a6a7c0 (rcu_read_lock){....}-{1:3}, at: bpf_iter_run_prog+0x51d/0xb00

Call Trace:
 dump_stack_lvl+0x5d/0x80
 print_deadlock_bug.cold+0xc0/0xce
 __lock_acquire+0x130f/0x2590
 lock_acquire+0x14e/0x2b0
 _raw_spin_lock+0x30/0x40
 sock_map_update_elem+0xdb/0x1f0
 bpf_prog_2d0075e5d9b721cd_dump_unix+0x55/0x4f4
 bpf_iter_run_prog+0x5b9/0xb00
 bpf_iter_unix_seq_show+0x1f7/0x2e0
 bpf_seq_read+0x42c/0x10d0
 vfs_read+0x171/0xb20
 ksys_read+0xff/0x200
 do_syscall_64+0x6b/0x3a0
 entry_SYSCALL_64_after_hwframe+0x76/0x7e

Fixes: 2c860a43dd ("bpf: af_unix: Implement BPF iterator for UNIX domain socket.")
Suggested-by: Kuniyuki Iwashima <kuniyu@google.com>
Suggested-by: Martin KaFai Lau <martin.lau@linux.dev>
Signed-off-by: Michal Luczaj <mhal@rbox.co>
Signed-off-by: Martin KaFai Lau <martin.lau@kernel.org>
Reviewed-by: Jiayuan Chen <jiayuan.chen@linux.dev>
Reviewed-by: Kuniyuki Iwashima <kuniyu@google.com>
Link: https://patch.msgid.link/20260414-unix-proto-update-null-ptr-deref-v4-2-2af6fe97918e@rbox.co
2026-04-15 17:22:47 -07:00
Michal Luczaj
a25566084e bpf, sockmap: Annotate af_unix sock:: Sk_state data-races
sock_map_sk_state_allowed() and sock_map_redirect_allowed() read af_unix
socket sk_state locklessly.

Use READ_ONCE(). Note that for sock_map_redirect_allowed() change affects
not only af_unix, but all non-TCP sockets (UDP, af_vsock).

Suggested-by: Kuniyuki Iwashima <kuniyu@google.com>
Suggested-by: Martin KaFai Lau <martin.lau@linux.dev>
Signed-off-by: Michal Luczaj <mhal@rbox.co>
Signed-off-by: Martin KaFai Lau <martin.lau@kernel.org>
Reviewed-by: Jiayuan Chen <jiayuan.chen@linux.dev>
Reviewed-by: Kuniyuki Iwashima <kuniyu@google.com>
Link: https://patch.msgid.link/20260414-unix-proto-update-null-ptr-deref-v4-1-2af6fe97918e@rbox.co
2026-04-15 17:22:42 -07:00
Linus Torvalds
fdbfee9fc5 Runtime Verification updates for 7.1:
- Refactor da_monitor header to share handlers across monitor types
 
   No functional changes, only less code duplication.
 
 - Add Hybrid Automata model class
 
   Add a new model class that extends deterministic automata by adding
   constraints on transitions and states. Those constraints can take into
   account wall-clock time and as such allow RV monitor to make
   assertions on real time. Add documentation and code generation
   scripts.
 
 - Add stall monitor as hybrid automaton example
 
   Add a monitor that triggers a violation when a task is stalling as an
   example of automaton working with real time variables.
 
 - Convert the opid monitor to a hybrid automaton
 
   The opid monitor can be heavily simplified if written as a hybrid
   automaton: instead of tracking preempt and interrupt enable/disable
   events, it can just run constraints on the preemption/interrupt
   states when events like wakeup and need_resched verify.
 
 - Add support for per-object monitors in DA/HA
 
   Allow writing deterministic and hybrid automata monitors for generic
   objects (e.g. any struct), by exploiting a hash table where objects
   are saved. This allows to track more than just tasks in RV. For
   instance it will be used to track deadline entities in deadline
   monitors.
 
 - Add deadline tracepoints and move some deadline utilities
 
   Prepare the ground for deadline monitors by defining events and
   exporting helpers.
 
 - Add nomiss deadline monitor
 
   Add first example of deadline monitor asserting all entities complete
   before their deadline.
 
 - Improve rvgen error handling
 
   Introduce AutomataError exception class and better handle expected
   exceptions while showing a backtrace for unexpected ones.
 
 - Improve python code quality in rvgen
 
   Refactor the rvgen generation scripts to align with python best
   practices: use f-strings instead of %, use len() instead of __len__(),
   remove semicolons, use context managers for file operations, fix
   whitespace violations, extract magic strings into constants, remove
   unused imports and methods.
 
 - Fix small bugs in rvgen
 
   The generator scripts presented some corner case bugs: logical error in
   validating what a correct dot file looks like, fix an isinstance()
   check, enforce a dot file has an initial state, fix type annotations
   and typos in comments.
 
 - rvgen refactoring
 
   Refactor automata.py to use iterator-based parsing and handle required
   arguments directly in argparse.
 
 - Allow epoll in rtapp-sleep monitor
 
   The epoll_wait call is now rt-friendly so it should be allowed in the
   sleep monitor as a valid sleep method.
 -----BEGIN PGP SIGNATURE-----
 
 iIoEABYKADIWIQRRSw7ePDh/lE+zeZMp5XQQmuv6qgUCad4kUxQccm9zdGVkdEBn
 b29kbWlzLm9yZwAKCRAp5XQQmuv6qiJgAPsGJ0TCTubdn2x6fpwLDKUcSsNsYrok
 m8gLHeK0rmkKNQD/ajUW+RBsOufXAsnSzUoUcl7sw1TSiQJ085U+0+ZeDgM=
 =WZqk
 -----END PGP SIGNATURE-----

Merge tag 'trace-rv-v7.1' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace

Pull runtime verification updates from Steven Rostedt:

 - Refactor da_monitor header to share handlers across monitor types

   No functional changes, only less code duplication.

 - Add Hybrid Automata model class

   Add a new model class that extends deterministic automata by adding
   constraints on transitions and states. Those constraints can take
   into account wall-clock time and as such allow RV monitor to make
   assertions on real time. Add documentation and code generation
   scripts.

 - Add stall monitor as hybrid automaton example

   Add a monitor that triggers a violation when a task is stalling as an
   example of automaton working with real time variables.

 - Convert the opid monitor to a hybrid automaton

   The opid monitor can be heavily simplified if written as a hybrid
   automaton: instead of tracking preempt and interrupt enable/disable
   events, it can just run constraints on the preemption/interrupt
   states when events like wakeup and need_resched verify.

 - Add support for per-object monitors in DA/HA

   Allow writing deterministic and hybrid automata monitors for generic
   objects (e.g. any struct), by exploiting a hash table where objects
   are saved. This allows to track more than just tasks in RV. For
   instance it will be used to track deadline entities in deadline
   monitors.

 - Add deadline tracepoints and move some deadline utilities

   Prepare the ground for deadline monitors by defining events and
   exporting helpers.

 - Add nomiss deadline monitor

   Add first example of deadline monitor asserting all entities complete
   before their deadline.

 - Improve rvgen error handling

   Introduce AutomataError exception class and better handle expected
   exceptions while showing a backtrace for unexpected ones.

 - Improve python code quality in rvgen

   Refactor the rvgen generation scripts to align with python best
   practices: use f-strings instead of %, use len() instead of
   __len__(), remove semicolons, use context managers for file
   operations, fix whitespace violations, extract magic strings into
   constants, remove unused imports and methods.

 - Fix small bugs in rvgen

   The generator scripts presented some corner case bugs: logical error
   in validating what a correct dot file looks like, fix an isinstance()
   check, enforce a dot file has an initial state, fix type annotations
   and typos in comments.

 - rvgen refactoring

   Refactor automata.py to use iterator-based parsing and handle
   required arguments directly in argparse.

 - Allow epoll in rtapp-sleep monitor

   The epoll_wait call is now rt-friendly so it should be allowed in the
   sleep monitor as a valid sleep method.

* tag 'trace-rv-v7.1' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace: (32 commits)
  rv: Allow epoll in rtapp-sleep monitor
  rv/rvgen: fix _fill_states() return type annotation
  rv/rvgen: fix unbound loop variable warning
  rv/rvgen: enforce presence of initial state
  rv/rvgen: extract node marker string to class constant
  rv/rvgen: fix isinstance check in Variable.expand()
  rv/rvgen: make monitor arguments required in rvgen
  rv/rvgen: remove unused __get_main_name method
  rv/rvgen: remove unused sys import from dot2c
  rv/rvgen: refactor automata.py to use iterator-based parsing
  rv/rvgen: use class constant for init marker
  rv/rvgen: fix DOT file validation logic error
  rv/rvgen: fix PEP 8 whitespace violations
  rv/rvgen: fix typos in automata and generator docstring and comments
  rv/rvgen: use context managers for file operations
  rv/rvgen: remove unnecessary semicolons
  rv/rvgen: replace __len__() calls with len()
  rv/rvgen: replace % string formatting with f-strings
  rv/rvgen: remove bare except clauses in generator
  rv/rvgen: introduce AutomataError exception class
  ...
2026-04-15 17:15:18 -07:00
Linus Torvalds
5ed19574eb ktest updates for v7.1:
- Fix undef warning when WARNINGS_FILE is unset
 
   The check_buildlog() references WARNINGS_FILE even when it's not set. Perl
   triggers a warning in this case. Check if the WARNINGS_FILE is defined
   before checking if the file it represents exists.
 
 - Fix how LOG_FILE is resolved
 
   LOG_FILE is expanded immediately after the config file is parsed. If
   LOG_FILE depends on variables from the tests it will use stale values
   instead of using the test variables. Have LOG_FILE also resolve test
   variables.
 
 - Treat a undefined self reference variable as empty
 
   Variables can recursively include itself for appending. Currently, if the
   references itself and it is not defined, it leaves the variable in the
   define: "VAR = ${VAR} foo" keeps the ${VAR} around. Have it removed
   instead.
 
 - Fix clearing of variables per tests
 
   If a variable has a defined default, a test can not clear it by assigning
   the variable to empty. Fix this by clearing the variable for a test when
   the test config has that variable assigned to nothing.
 
 - Fix run_command() to catch stderr in the shell command parsing
 
   Switch to Perl list form open to use "sh -c" wrapper to run shell commands
   to have the log file catch shell parsing errors.
 
 - Fix console output during reboot cycle
 
   The POWER_CYCLE callback during reboot() can miss output from the next
   boot making ktest miss the boot string it was waiting for.
 
 - Add PRE_KTEST_DIE for PRE_KTEST failures
 
   If the command for PRE_KTEST fails, ktest does not fail (this was by
   design as this command was used to add patches that may or may not apply).
   Add PRE_KTEST_DIE value to force ktest to fail if PRE_KTEST fails.
 
 - Run POST_KTEST hooks on failure and cancellation
 
   PRE_KTEST always runs before a ktest test, have POST_KTEST always run
   after a test even if the test fails or is cancelled to do the teardown of
   PRE_KTEST.
 
 -- Add a --dry-run mode
 
   Add --dry-run to parse the config, print the results and exit without
   running any of the tests.
 
 -- Store failures from the dodie() path as well
 
   The STORE_FAILURES saves the logs on failure, but there's failure paths
   that miss storing. Perform STORE_FAILURES in dodie() to capture these
   failures too.
 -----BEGIN PGP SIGNATURE-----
 
 iIoEABYKADIWIQRRSw7ePDh/lE+zeZMp5XQQmuv6qgUCad4fRRQccm9zdGVkdEBn
 b29kbWlzLm9yZwAKCRAp5XQQmuv6qrXQAQDoofo6x7qfV0/5XZ6CbhuowktU070Z
 35btop9+X1MYtAD/exkiotwrC34tQndU8bChjTTRlC48WCUBmMikBEohvQM=
 =lljo
 -----END PGP SIGNATURE-----

Merge tag 'ktest-v7.1' of git://git.kernel.org/pub/scm/linux/kernel/git/rostedt/linux-ktest

Pull ktest updates from Steven Rostedt:

 - Fix undef warning when WARNINGS_FILE is unset

   The check_buildlog() references WARNINGS_FILE even when it's not set.
   Perl triggers a warning in this case. Check if the WARNINGS_FILE is
   defined before checking if the file it represents exists.

 - Fix how LOG_FILE is resolved

   LOG_FILE is expanded immediately after the config file is parsed. If
   LOG_FILE depends on variables from the tests it will use stale values
   instead of using the test variables. Have LOG_FILE also resolve test
   variables.

 - Treat a undefined self reference variable as empty

   Variables can recursively include itself for appending. Currently, if
   the references itself and it is not defined, it leaves the variable
   in the define: "VAR = ${VAR} foo" keeps the ${VAR} around. Have it
   removed instead.

 - Fix clearing of variables per tests

   If a variable has a defined default, a test can not clear it by
   assigning the variable to empty. Fix this by clearing the variable
   for a test when the test config has that variable assigned to
   nothing.

 - Fix run_command() to catch stderr in the shell command parsing

   Switch to Perl list form open to use "sh -c" wrapper to run shell
   commands to have the log file catch shell parsing errors.

 - Fix console output during reboot cycle

   The POWER_CYCLE callback during reboot() can miss output from the
   next boot making ktest miss the boot string it was waiting for.

 - Add PRE_KTEST_DIE for PRE_KTEST failures

   If the command for PRE_KTEST fails, ktest does not fail (this was by
   design as this command was used to add patches that may or may not
   apply). Add PRE_KTEST_DIE value to force ktest to fail if PRE_KTEST
   fails.

 - Run POST_KTEST hooks on failure and cancellation

   PRE_KTEST always runs before a ktest test, have POST_KTEST always run
   after a test even if the test fails or is cancelled to do the
   teardown of PRE_KTEST.

 - Add a --dry-run mode

   Add --dry-run to parse the config, print the results and exit without
   running any of the tests.

 - Store failures from the dodie() path as well

   The STORE_FAILURES saves the logs on failure, but there's failure
   paths that miss storing. Perform STORE_FAILURES in dodie() to capture
   these failures too.

* tag 'ktest-v7.1' of git://git.kernel.org/pub/scm/linux/kernel/git/rostedt/linux-ktest:
  ktest: Store failure logs also in fatal paths
  ktest: Add a --dry-run mode
  ktest: Run POST_KTEST hooks on failure and cancellation
  ktest: Add PRE_KTEST_DIE for PRE_KTEST failures
  ktest: Stop dropping console output during power-cycle reboot
  ktest: Run commands through list-form shell open
  ktest: Honor empty per-test option overrides
  ktest: Treat undefined self-reference as empty
  ktest: Resolve LOG_FILE in test option context
  ktest: Avoid undef warning when WARNINGS_FILE is unset
2026-04-15 17:11:22 -07:00
Alexei Starovoitov
9d8e92e15f Merge branch 'bpf-copy-bpf-token-from-main-program-to-subprograms'
Eduard Zingerman says:

====================
bpf: copy BPF token from main program to subprograms

bpf_jit_subprogs() omits aux->token when it creates a struct
bpf_prog_aux instances for a subprograms.
This means that for programs loaded via BPF token (i.e., from a
non-init user namespace), subprograms fail the bpf_token_capable()
check in bpf_prog_kallsyms_add() and don't appear in /proc/kallsyms.
Which in-turn makes it impossible to freplace such subprograms.

Changelog:
v3 -> v4:
- check sysctl_set calls for errors (sashiko).
v2 -> v3:
- mark selftest as serial (sashiko).
v1 -> v2:
- target bpf-next tree (fixups.c) instead of bpf tree (verifier.c).

v1: https://lore.kernel.org/bpf/20260414-subprog-token-fix-v1-0-5b1a38e01546@gmail.com/T/
v2: https://lore.kernel.org/bpf/20260414-subprog-token-fix-v2-0-59146c31f6f1@gmail.com/T/
v3: https://lore.kernel.org/bpf/20260415-subprog-token-fix-v3-0-6fefe1d51646@gmail.com/T/
====================

Link: https://patch.msgid.link/20260415-subprog-token-fix-v4-0-9bd000e8b068@gmail.com
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
2026-04-15 16:46:55 -07:00
Eduard Zingerman
969fb456ff selftests/bpf: verify kallsyms entries for token-loaded subprograms
Add a test that loads an XDP program with a global subprogram using a
BPF token from a user namespace, then verifies that both the main
program and the subprogram appear in /proc/kallsyms.

This exercises the bpf_prog_kallsyms_add() path for subprograms and
would have caught the missing aux->token copy in bpf_jit_subprogs().

load_kallsyms_local() filters out kallsyms with zero addresses.
For a process with limited capabilities to read kallsym addresses the
following sysctl variables have to be set to zero:
- /proc/sys/kernel/perf_event_paranoid
- /proc/sys/kernel/kptr_restrict
Set these variables using sysctl_set() utility function extracted from
unpriv_bpf_disabled.c to a separate c/header.
Since the test modifies global system state, mark it as serial.

Signed-off-by: Eduard Zingerman <eddyz87@gmail.com>
Link: https://lore.kernel.org/r/20260415-subprog-token-fix-v4-2-9bd000e8b068@gmail.com
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
2026-04-15 16:46:47 -07:00
Eduard Zingerman
0251e40c48 bpf: copy BPF token from main program to subprograms
bpf_jit_subprogs() copies various fields from the main program's aux to
each subprogram's aux, but omits the BPF token. This causes
bpf_prog_kallsyms_add() to fail for subprograms loaded via BPF token,
as bpf_token_capable() falls back to capable() in init_user_ns when
token is NULL.

Copy prog->aux->token to func[i]->aux->token so that subprograms
inherit the same capability delegation as the main program.

Fixes: d79a354975 ("bpf: Consistently use BPF token throughout BPF verifier logic")
Signed-off-by: Tao Chen <ctao@meta.com>
Signed-off-by: Eduard Zingerman <eddyz87@gmail.com>
Link: https://lore.kernel.org/r/20260415-subprog-token-fix-v4-1-9bd000e8b068@gmail.com
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
2026-04-15 16:46:47 -07:00
Linus Torvalds
b7f84966b6 tracefs updates for 7.1:
- Simplify error handling with guards()
 
   Use guards() to simplify the handling of releasing locks in exit paths.
 
 - Use dentry name snapshots instead of allocation
 
   Instead of allocating a temp buffer to store the dentry name to use in
   mkdir() and rmdir() use take_dentry_name_snapshot().
 
 - Fix default permissions not being applied at boot
 
   The default permissions for tracefs was 0700 to only allow root having
   access. But after a change to fix other mount options the update to
   permissions ignored the defined default and used the system default of
   0755. This is a regression and is fixed.
 -----BEGIN PGP SIGNATURE-----
 
 iIoEABYKADIWIQRRSw7ePDh/lE+zeZMp5XQQmuv6qgUCad+WtRQccm9zdGVkdEBn
 b29kbWlzLm9yZwAKCRAp5XQQmuv6qhjnAP9KUNAxjREVhPo9kaS2I50NlzgUJde2
 jcitFX7dfK684wEA7me2gcGvu9nJ8vlI4umNW5n5YeKA2UIKoeC5+IJrKgM=
 =idXt
 -----END PGP SIGNATURE-----

Merge tag 'tracefs-v7.1-v2' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace

Pull tracefs updates from Steven Rostedt:

 - Simplify error handling with guards()

   Use guards() to simplify the handling of releasing locks in exit
   paths.

 - Use dentry name snapshots instead of allocation

   Instead of allocating a temp buffer to store the dentry name to use
   in mkdir() and rmdir() use take_dentry_name_snapshot().

 - Fix default permissions not being applied at boot

   The default permissions for tracefs was 0700 to only allow root
   having access. But after a change to fix other mount options the
   update to permissions ignored the defined default and used the system
   default of 0755. This is a regression and is fixed.

* tag 'tracefs-v7.1-v2' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace:
  tracefs: Removed unused 'ret' variable in eventfs_iterate()
  tracefs: Fix default permissions not being applied on initial mount
  tracefs: Use dentry name snapshots instead of heap allocation
  eventfs: Simplify code using guard()s
2026-04-15 16:27:32 -07:00
Linus Torvalds
e4bf304f00 ring-buffer updates for 7.1:
- Add remote buffers for pKVM
 
   pKVM has a hypervisor component that is used to protect the guest from the
   host kernel. This hypervisor is a black box to the kernel as the kernel is
   to user space. The remote buffers are used to have a memory mapping
   between the hypervisor and the kernel where kernel may send commands to
   enable tracing within the hypervisor. Then the kernel will read this
   memory mapping just like user space can read the memory mapped ring buffer
   of the kernel tracing system.
 
   Since the hypervisor only has a single context, it doesn't need to worry
   about races between normal context, interrupt context and NMIs like the
   kernel does. The ring buffer it uses doesn't need to be as complex. The
   remote buffers are a simple version of the ring buffer that works in a
   single context. They are still per-CPU and use sub buffers. The data
   layout is the same as the kernel's ring buffer to share the same parsing.
 
   Currently, only ARM64 implements pKVM, but there's work to implement it
   also in x86. The remote buffer code is separated out from the ARM
   implementation so that it can be used in the future by x86.
 
   The ARM64 updates for pKVM is in the ARM/KVM tree and it merged in the
   remote buffers of this tree.
 
 - Merge commit f35dbac694 ("ring-buffer: Fix to update per-subbuf entries of persistent ring buffer")`
 
   A fix was merged upstream that some new changes depended on. The upstream
   commit was merged into the ring buffer branch to fulfil the dependency.
 
 - Make the backup instance non reusable
 
   The backup instance is a copy of the persistent ring buffer so that the
   persistent ring buffer could start recording again without using the data
   from the previous boot. The backup isn't for normal tracing. It is made
   read-only, and after it is consumed, it is automatically removed.
 
 - Have backup copy persistent instance before it starts recording
 
   To allow the persistent ring buffer to start recording from the kernel
   command line commands, move the copy of the backup instance to before the
   the command line options start recording.
 
 - Report header_page overwrite field as "char" and not "int'
 
   The rust parser of the header_page file was triggering a warning when it
   defined the overwrite variable as "int" but it was only a single byte in
   size.
 
 - Fix memory barriers for the trace_buffer CPU mask
 
   When a CPU comes online, the bit is set to allow readers to know that the
   CPU buffer is allocated. The bit is set after the allocation is done, and
   a smp_wmb() is performed after the allocation and before the setting of
   the bit. But instead of adding a smp_rmb() to all readers, since once a
   buffer is created for a CPU it is not deleted if that CPU goes offline, so
   this allocation is almost always done at boot up before any readers exist.
 
   If for the unlikely case where a CPU comes online for the first time after
   the system boot has finished, send an IPI to all CPUs to force the
   smp_rmb() for each CPU.
 
 - Show clock function being used in debugging ring buffer data
 
   When the ring buffer checks are enabled and the ring buffer detects an
   inconsistency in the times of the invents, print out the clock being used
   when the error occurred. There was a very hard to hit bug that would
   happen every so often and it ended up being only triggered when the jiffies
   clock was being used. If the bug showed the clock being used, it would
   have been much easier to find the problem (which was an internal function
   was being traced which caused the clock accounting to go off).
 -----BEGIN PGP SIGNATURE-----
 
 iIoEABYKADIWIQRRSw7ePDh/lE+zeZMp5XQQmuv6qgUCad9S9xQccm9zdGVkdEBn
 b29kbWlzLm9yZwAKCRAp5XQQmuv6qpO8AQDwq2GKeups4aMfOjsUAXX9pIGWI9O1
 eerhmazgi1LJLQEAtKRNSddOj/7nOJ5hLillJH4uAQOnJBkAWtjlTSUnLg8=
 =HXkO
 -----END PGP SIGNATURE-----

Merge tag 'trace-ringbuffer-v7.1' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace

Pull ring-buffer updates from Steven Rostedt:

 - Add remote buffers for pKVM

   pKVM has a hypervisor component that is used to protect the guest
   from the host kernel. This hypervisor is a black box to the kernel as
   the kernel is to user space. The remote buffers are used to have a
   memory mapping between the hypervisor and the kernel where kernel may
   send commands to enable tracing within the hypervisor. Then the
   kernel will read this memory mapping just like user space can read
   the memory mapped ring buffer of the kernel tracing system.

   Since the hypervisor only has a single context, it doesn't need to
   worry about races between normal context, interrupt context and NMIs
   like the kernel does. The ring buffer it uses doesn't need to be as
   complex. The remote buffers are a simple version of the ring buffer
   that works in a single context. They are still per-CPU and use sub
   buffers. The data layout is the same as the kernel's ring buffer to
   share the same parsing.

   Currently, only ARM64 implements pKVM, but there's work to implement
   it also in x86. The remote buffer code is separated out from the ARM
   implementation so that it can be used in the future by x86.

   The ARM64 updates for pKVM is in the ARM/KVM tree and it merged in
   the remote buffers of this tree.

 - Make the backup instance non reusable

   The backup instance is a copy of the persistent ring buffer so that
   the persistent ring buffer could start recording again without using
   the data from the previous boot. The backup isn't for normal tracing.
   It is made read-only, and after it is consumed, it is automatically
   removed.

 - Have backup copy persistent instance before it starts recording

   To allow the persistent ring buffer to start recording from the
   kernel command line commands, move the copy of the backup instance to
   before the the command line options start recording.

 - Report header_page overwrite field as "char" and not "int'

   The rust parser of the header_page file was triggering a warning when
   it defined the overwrite variable as "int" but it was only a single
   byte in size.

 - Fix memory barriers for the trace_buffer CPU mask

   When a CPU comes online, the bit is set to allow readers to know that
   the CPU buffer is allocated. The bit is set after the allocation is
   done, and a smp_wmb() is performed after the allocation and before
   the setting of the bit. But instead of adding a smp_rmb() to all
   readers, since once a buffer is created for a CPU it is not deleted
   if that CPU goes offline, so this allocation is almost always done at
   boot up before any readers exist.

   If for the unlikely case where a CPU comes online for the first time
   after the system boot has finished, send an IPI to all CPUs to force
   the smp_rmb() for each CPU.

 - Show clock function being used in debugging ring buffer data

   When the ring buffer checks are enabled and the ring buffer detects
   an inconsistency in the times of the invents, print out the clock
   being used when the error occurred. There was a very hard to hit bug
   that would happen every so often and it ended up being only triggered
   when the jiffies clock was being used. If the bug showed the clock
   being used, it would have been much easier to find the problem (which
   was an internal function was being traced which caused the clock
   accounting to go off).

* tag 'trace-ringbuffer-v7.1' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace: (26 commits)
  ring-buffer: Prevent off-by-one array access in ring_buffer_desc_page()
  ring-buffer: Report header_page overwrite as char
  tracing: Allow backup to save persistent ring buffer before it starts
  tracing/Documentation: Add a section about backup instance
  tracing: Remove the backup instance automatically after read
  tracing: Make the backup instance non-reusable
  ring-buffer: Enforce read ordering of trace_buffer cpumask and buffers
  ring-buffer: Show what clock function is used on timestamp errors
  tracing: Check for undefined symbols in simple_ring_buffer
  tracing: load/unload page callbacks for simple_ring_buffer
  Documentation: tracing: Add tracing remotes
  tracing: selftests: Add trace remote tests
  tracing: Add a trace remote module for testing
  tracing: Introduce simple_ring_buffer
  ring-buffer: Export buffer_data_page and macros
  tracing: Add helpers to create trace remote events
  tracing: Add events/ root files to trace remotes
  tracing: Add events to trace remotes
  tracing: Add init callback to trace remotes
  tracing: Add non-consuming read to trace remotes
  ...
2026-04-15 15:59:46 -07:00
Linus Torvalds
1521829632 ftrace updates for 7.1:
- Speed up ftrace_lookup_symbols() for single lookups
 
   The kallsyms lookup in ftrace_lookup_symbols() does a linear search over
   each symbol. This is fine when it must match multiple strings, but when
   there's only a single string being searched for, using a binary search is
   much more efficient. When a single string is passed in to search, use the
   binary search method.
 -----BEGIN PGP SIGNATURE-----
 
 iIoEABYKADIWIQRRSw7ePDh/lE+zeZMp5XQQmuv6qgUCad4RehQccm9zdGVkdEBn
 b29kbWlzLm9yZwAKCRAp5XQQmuv6quZeAQD0rsWOGF0D970asst2WtCOoQF5G2ao
 l0ED7QZFoB1qcAEA7ZAuV9+zJwFOvhAekifuDEArPwpadlcUC4dU7tJU1w0=
 =cMjY
 -----END PGP SIGNATURE-----

Merge tag 'ftrace-v7.1' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace

Pull ftrace update from Steven Rostedt:

 - Speed up ftrace_lookup_symbols() for single lookups

   The kallsyms lookup in ftrace_lookup_symbols() does a linear search
   over each symbol. This is fine when it must match multiple strings,
   but when there's only a single string being searched for, using a
   binary search is much more efficient. When a single string is passed
   in to search, use the binary search method.

* tag 'ftrace-v7.1' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace:
  ftrace: Use kallsyms binary search for single-symbol lookup
2026-04-15 15:57:11 -07:00
Stefan Metzmacher
c09fb907a2 MAINTAINERS: change git.samba.org to https
This is the preferred way to access the server.

Cc: Steve French <smfrench@gmail.com>
Cc: Namjae Jeon <linkinjeon@kernel.org>
Cc: linux-cifs@vger.kernel.org
Cc: samba-technical@lists.samba.org
Signed-off-by: Stefan Metzmacher <metze@samba.org>
Signed-off-by: Steve French <stfrench@microsoft.com>
2026-04-15 17:56:23 -05:00
Dudu Lu
6b83b03c07 smb: client: fix integer underflow in receive_encrypted_read()
In receive_encrypted_read(), the length of data to read from the socket
is computed as:

  len = le32_to_cpu(tr_hdr->OriginalMessageSize) -
        server->vals->read_rsp_size;

OriginalMessageSize comes from the server's transform header and is
untrusted. If a malicious server sends a value smaller than
read_rsp_size, the unsigned subtraction wraps to a very large value
(~4GB). This value is then passed to netfs_alloc_folioq_buffer() and
cifs_read_iter_from_socket(), causing either a massive allocation
attempt that fails with -ENOMEM (DoS), or under extreme memory
pressure, potential heap corruption.

Fix by adding a check that OriginalMessageSize is at least
read_rsp_size before the subtraction. On failure, jump to
discard_data to drain the remaining PDU from the socket, preventing
desync of subsequent reads on the connection.

Signed-off-by: Dudu Lu <phx0fer@gmail.com>
Reviewed-by: Enzo Matsumiya <ematsumiya@suse.de>
Signed-off-by: Steve French <stfrench@microsoft.com>
2026-04-15 17:27:58 -05:00
Linus Torvalds
aec2f682d4 This update includes the following changes:
API:
 
 - Replace crypto_get_default_rng with crypto_stdrng_get_bytes.
 - Remove simd skcipher support.
 - Allow algorithm types to be disabled when CRYPTO_SELFTESTS is off.
 
 Algorithms:
 
 - Remove CPU-based des/3des acceleration.
 - Add test vectors for authenc(hmac(md5),cbc(aes)).
 - Add test vectors for authenc(hmac(md5),cbc(des)).
 - Add test vectors for authenc(hmac(md5),rfc3686(ctr(aes))).
 - Add test vectors for authenc(hmac(sha1),rfc3686(ctr(aes))).
 - Add test vectors for authenc(hmac(sha224),rfc3686(ctr(aes))).
 - Add test vectors for authenc(hmac(sha256),rfc3686(ctr(aes))).
 - Add test vectors for authenc(hmac(sha384),rfc3686(ctr(aes))).
 - Add test vectors for authenc(hmac(sha512),rfc3686(ctr(aes))).
 - Replace spin lock with mutex in jitterentropy.
 
 Drivers:
 
 - Add authenc algorithms to safexcel.
 - Add support for zstd in qat.
 - Add wireless mode support for QAT GEN6.
 - Add anti-rollback support for QAT GEN6.
 - Add support for ctr(aes), gcm(aes), and ccm(aes) in dthev2.
 -----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCgAdFiEEn51F/lCuNhUwmDeSxycdCkmxi6cFAmne7qgACgkQxycdCkmx
 i6cm0w/9HNFzIWuZWh4Q8k1d/SX32/2p40EMvlw9QFO8wt0gsMtbk6NN5G3sIfhL
 36+rT8Vo5yg9MahTqAspXKjP+QTev5D7/nsDa/FzOSA1JxyvBbgV7X33k8EZjcgT
 +ffuh0WbaWlutYw07o2h4cNPz1Yp4M0hp2IdzvY0Y3q9D05eiwis1SQzUVPmTs6K
 I6OP+4JjJbqubOgJxsltEoeCH9ZP0fObRWmAiVm6rwk9uX4CY32nzi3QOttXQ0su
 4F/useoRwWQ1t7FTy8/fcVtFpL/G8hAFSQ4un5ODhDWL7taV5sZPXQBwXUuoVQM6
 aNjZlaju/MB7gnAOrBvSsniohAAqRUNR8O7P8QW6mDrFmDhUZ3ZILmCKW+VwF5SG
 a4fV94XgBVOnKIqD01cc++8mb6keX/88KJW79AEWLeJ9YZ9BuyFphr9OEBFAIHqx
 xG+iEg4uoVxwC52//oGt/yZaZKK3C1y/Zey5bOjfErKq3ATXGIvawaAzdvB9mh6Q
 iAnl71JpR4mrs++fAyUCKM+dfvdmQYDq6HJayMdg+IHAIeIvyMnPjsGigdVJvE65
 RpBKW4aclfiYaDwX9Jf703mHR1uuKGP1GKpz8U+JXN4Ax2JPg0maC1N3wFkDypYO
 HUNKgEk/173f1HTjU0JjbqvqJh+rKQ3ZbHpLxZrYtnSMukDwRO0=
 =KoAB
 -----END PGP SIGNATURE-----

Merge tag 'v7.1-p1' of git://git.kernel.org/pub/scm/linux/kernel/git/herbert/crypto-2.6

Pull crypto update from Herbert Xu:
 "API:
   - Replace crypto_get_default_rng with crypto_stdrng_get_bytes
   - Remove simd skcipher support
   - Allow algorithm types to be disabled when CRYPTO_SELFTESTS is off

  Algorithms:
   - Remove CPU-based des/3des acceleration
   - Add test vectors for authenc(hmac(md5),cbc({aes,des})) and
     authenc(hmac({md5,sha1,sha224,sha256,sha384,sha512}),rfc3686(ctr(aes)))
   - Replace spin lock with mutex in jitterentropy

  Drivers:
   - Add authenc algorithms to safexcel
   - Add support for zstd in qat
   - Add wireless mode support for QAT GEN6
   - Add anti-rollback support for QAT GEN6
   - Add support for ctr(aes), gcm(aes), and ccm(aes) in dthev2"

* tag 'v7.1-p1' of git://git.kernel.org/pub/scm/linux/kernel/git/herbert/crypto-2.6: (129 commits)
  crypto: af_alg - use sock_kmemdup in alg_setkey_by_key_serial
  crypto: vmx - remove CRYPTO_DEV_VMX from Kconfig
  crypto: omap - convert reqctx buffer to fixed-size array
  crypto: atmel-sha204a - add Thorsten Blum as maintainer
  crypto: atmel-ecc - add Thorsten Blum as maintainer
  crypto: qat - fix IRQ cleanup on 6xxx probe failure
  crypto: geniv - Remove unused spinlock from struct aead_geniv_ctx
  crypto: qce - simplify qce_xts_swapiv()
  crypto: hisilicon - Fix dma_unmap_single() direction
  crypto: talitos - rename first/last to first_desc/last_desc
  crypto: talitos - fix SEC1 32k ahash request limitation
  crypto: jitterentropy - replace long-held spinlock with mutex
  crypto: hisilicon - remove unused and non-public APIs for qm and sec
  crypto: hisilicon/qm - drop redundant variable initialization
  crypto: hisilicon/qm - remove else after return
  crypto: hisilicon/qm - add const qualifier to info_name in struct qm_cmd_dump_item
  crypto: hisilicon - fix the format string type error
  crypto: ccree - fix a memory leak in cc_mac_digest()
  crypto: qat - add support for zstd
  crypto: qat - use swab32 macro
  ...
2026-04-15 15:22:26 -07:00
Linus Torvalds
8801e23b5b ipe/stable-7.1 PR 20260413
-----BEGIN PGP SIGNATURE-----
 
 iIcEABYIAC8WIQQzmBmZPBN6m/hUJmnyomI6a/yO7QUCad11eBEcd3VmYW5Aa2Vy
 bmVsLm9yZwAKCRDyomI6a/yO7Z+bAP9QiGgEDwThfZB2Zk/FtJZkCq68M9phlOOv
 V75Gyu593wD/bF4dMbgmzwm0QMUZCwV6gvUMsMfgVQB7PJeWjXrcaAs=
 =795o
 -----END PGP SIGNATURE-----

Merge tag 'ipe-pr-20260413' of git://git.kernel.org/pub/scm/linux/kernel/git/wufan/ipe

Pull IPE update from Fan Wu:
 "A single commit from Evan Ducas that fixes several spelling and
  grammar mistakes in the IPE documentation. There are no functional
  changes"

* tag 'ipe-pr-20260413' of git://git.kernel.org/pub/scm/linux/kernel/git/wufan/ipe:
  docs: security: ipe: fix typos and grammar
2026-04-15 15:19:45 -07:00
Linus Torvalds
83964553e8 xen: branch for v7.1-rc1
-----BEGIN PGP SIGNATURE-----
 
 iJEEABYKADkWIQRTLbB6QfY48x44uB6AXGG7T9hjvgUCads37xsUgAAAAAAEAA5t
 YW51MiwyLjUrMS4xMiwyLDIACgkQgFxhu0/YY75fRAEAj/0nnnnaJr3sMKccUggc
 JXvkGAiskxmnEbqR2TSCr2QA/jOnI6Thp/c2DMtljRuLu2NWl89ztGYbTfKfDiwM
 mAEJ
 =FcRV
 -----END PGP SIGNATURE-----

Merge tag 'for-linus-7.1-rc1-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/xen/tip

Pull xen updates from Juergen Gross:

 - fix an error path in drivers/xen/manage.c

 - fix the Xen console driver solving a boot hangup when the console
   backend isn't yet running

 - comment fix in the Xen swiotlb driver

 - hardening for Xen on Arm adding a more thorough validation

 - cleanup of the Xen grant table code hiding suspend/resume code for
   the case if CONFIG_HIBERNATE_CALLBACKS isn't defined

* tag 'for-linus-7.1-rc1-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/xen/tip:
  xen/grant-table: guard gnttab_suspend/resume with CONFIG_HIBERNATE_CALLBACKS
  hvc/xen: Check console connection flag
  xen/swiotlb: fix stale reference to swiotlb_unmap_page()
  xen/manage: unwind partial shutdown watcher setup on error
  ARM: xen: validate hypervisor compatible before parsing its version
2026-04-15 15:16:39 -07:00
Linus Torvalds
a5f998094f Device Mapper patches for 7.1
dm-vdo:
 - Make dm-vdo able to format the device itself, like other dm targets,
   instead of needing a userspace formating program.
 - Add some sanity checks and code cleanup.
 
 dm-cache:
 - Fix crashes and hangs when operating in passthrough mode (which have
   been around, unnoticed, since 4.12), as well as a late arriving fix for
   an error path bug in the passthrough fix.
 - Fix a corner case memory leak.
 
 dm-verity:
 - Another set of minor bugfixes and code cleanups to the forward error
   correction code.
 
 dm-mirror
 - Fix minor initialization bug
 - Fix overflow crash on a large devices with small region sizes
 
 dm-crypt
 - Reimplement elephant diffuser using AES library and minor cleanups
 
 dm-core:
 - Claude found a buffer overflow in /dev/mapper/contrl ioctl handling
 - make dm_mod.wait_for correctly wait for partitions
 - minor code fixes and cleanups
 -----BEGIN PGP SIGNATURE-----
 
 iHUEABYKAB0WIQQV50u+RKUL/8+ysMD7XX+I2MXV2AUCad1IDQAKCRD7XX+I2MXV
 2McAAP9WcMCgiKq0IZPTZCONxcGoEAyNfDcsozhjHVxJXrwDyQEAsrEWd+yhQKZq
 X/pfsQ+3/Qk28gqxV/5pI+scOVGIbQg=
 =RVLi
 -----END PGP SIGNATURE-----

Merge tag 'for-7.1/dm-changes' of git://git.kernel.org/pub/scm/linux/kernel/git/device-mapper/linux-dm

Pull device mapper updates from Benjamin Marzinski:
 "There are fixes for some corner case crashes in dm-cache and
  dm-mirror, new setup functionality for dm-vdo, and miscellaneous minor
  fixes and cleanups, especially to dm-verity.

  dm-vdo:
   - Make dm-vdo able to format the device itself, like other dm
     targets, instead of needing a userspace formating program
   - Add some sanity checks and code cleanup

  dm-cache:
   - Fix crashes and hangs when operating in passthrough mode (which
     have been around, unnoticed, since 4.12), as well as a late
     arriving fix for an error path bug in the passthrough fix
   - Fix a corner case memory leak

  dm-verity:
   - Another set of minor bugfixes and code cleanups to the forward
     error correction code

  dm-mirror
   - Fix minor initialization bug
   - Fix overflow crash on a large devices with small region sizes

  dm-crypt
   - Reimplement elephant diffuser using AES library and minor cleanups

  dm-core:
   - Claude found a buffer overflow in /dev/mapper/contrl ioctl handling
   - make dm_mod.wait_for correctly wait for partitions
   - minor code fixes and cleanups"

* tag 'for-7.1/dm-changes' of git://git.kernel.org/pub/scm/linux/kernel/git/device-mapper/linux-dm: (62 commits)
  dm cache: fix missing return in invalidate_committed's error path
  dm: fix a buffer overflow in ioctl processing
  dm-crypt: Make crypt_iv_operations::post return void
  dm vdo: Fix spelling mistake "postive" -> "positive"
  dm: provide helper to set stacked limits
  dm-integrity: always set the io hints
  dm-integrity: fix mismatched queue limits
  dm-bufio: use kzalloc_flex
  dm vdo: save the formatted metadata to disk
  dm vdo: add formatting logic and initialization
  dm vdo: add synchronous metadata I/O submission helper
  dm vdo: add geometry block structure
  dm vdo: add geometry block encoding
  dm vdo: add upfront validation for logical size
  dm vdo: add formatting parameters to table line
  dm vdo: add super block initialization to encodings.c
  dm vdo: add geometry block initialization to encodings.c
  dm-crypt: Make crypt_iv_operations::wipe return void
  dm-crypt: Reimplement elephant diffuser using AES library
  dm-verity-fec: warn even when there were no errors
  ...
2026-04-15 15:11:05 -07:00
David Carlier
6597ff1d8d drm/nouveau: fix nvkm_device leak on aperture removal failure
When aperture_remove_conflicting_pci_devices() fails during probe, the
error path returns directly without unwinding the nvkm_device that was
just allocated by nvkm_device_pci_new(). This leaks both the device
wrapper and the pci_enable_device() reference taken inside it.

Jump to the existing fail_nvkm label so nvkm_device_del() runs and
balances both. The leak was introduced when the intermediate
nvkm_device_del() between detection and aperture removal was dropped
in favor of creating the pci device once.

Fixes: c0bfe34330 ("drm/nouveau: create pci device once")
Cc: stable@vger.kernel.org
Signed-off-by: David Carlier <devnexen@gmail.com>
Link: https://patch.msgid.link/20260411062938.22925-1-devnexen@gmail.com
Signed-off-by: Danilo Krummrich <dakr@kernel.org>
2026-04-16 00:10:05 +02:00
Linus Torvalds
f1d26d72f0 IOMMU Updates for Linux v7.1:
Including:
 
 	- Core:
 	  - Support for RISC-V IO-page-table format in generic iommupt
 	    code
 
 	- ARM-SMMU Updates:
 
 	  - Introduction of an "invalidation array" for SMMUv3, which enables
 	    future scalability work and optimisations for devices with a large
 	    number of SMMUv3 instances.
 
 	  - Update the conditions under which the SMMUv3 driver works around
 	    hardware errata for invalidation on MMU-700 implementations.
 
 	  - Fix broken command filtering for the host view of NVIDIA's "cmdqv"
 	    SMMUv3 extension.
 
 	  - MMU-500 device-tree binding additions for Qualcomm Eliza & Hawi SoCs.
 
 	- Intel VT-d:
 
 	  - Support for dirty tracking on domains attached to PASID
 	  - Removal of unnecessary read*()/write*() wrappers
 	  - Improvements to the invalidation paths
 
 	- AMD Vi:
 
 	  - Race-condition fixed in debugfs code
 	  - Make log buffer allocation NUMA aware
 
 	- RISC-V:
 
 	  - IO-TLB flushing improvements
 	  - Minor fixes
 -----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCgAdFiEEr9jSbILcajRFYWYyK/BELZcBGuMFAmneJdAACgkQK/BELZcB
 GuO3TQ//cWG59NaY32ByWMJTug+DnlmunPG4xlUrD0JQCJXIcHrzKruhet4NifJL
 lE86+vN+s6I9EQgabmiDJPRZkZR20irDFMvuhfhVp8hprwxoan/fW7b4WY8Es0DM
 Q/AUioacyULBuKIl5XeEU1kAvKbgj2mlaWERTVKknh0jyItWwkEDvfR7G3eYIKDV
 dNhVjuow1byKnjrhE4Rslqz7HDalJVkDiADAdfbkV5+/HxqBJ19r84STW2YPkYLE
 ARIdwv3AI+NZfk9O0sBavMBs5v2nyNqr1j6kEiKd8hoFYOXY2Da1pWRSflTgFWil
 dYlXQZNGsznghBuc3VsqW75CMbSFtpWPx0LcQ0ClZUE11zxh+pfc1BekzvwHzunZ
 CTOcWastVkYHlvZTi3zHz68puy1omblN3r5juQhKOjQL+8N9BtRL4FObwj9XH8R0
 5Q9Fm2uWYr/1GCNZg0OvJNtQllxw8BTx/ssvof6sbq6P7OeT4cgErtqA9aQTdKuT
 6EvsW74GIllTNk2yuNHvQTpNWcW9iW7cEgwPaN/S5cXPZHZXhLjimOUGJkPmP3NY
 k2gcPAMkXi8MqC/gAr0kCDfxZPp5V8XWXI0lHd9qjxMvjZbLQlf0y6LArfA0hmQk
 oMzMJQuF81CK3+6fY4fXePOR5y0r+eWSCKYSr0HeXIH8eUvsrsY=
 =T6YT
 -----END PGP SIGNATURE-----

Merge tag 'iommu-updates-v7.1' of git://git.kernel.org/pub/scm/linux/kernel/git/iommu/linux

Pull iommu updates from Joerg Roedel:
 "Core:

   - Support for RISC-V IO-page-table format in generic iommupt code

  ARM-SMMU Updates:

   - Introduction of an "invalidation array" for SMMUv3, which enables
     future scalability work and optimisations for devices with a large
     number of SMMUv3 instances

   - Update the conditions under which the SMMUv3 driver works around
     hardware errata for invalidation on MMU-700 implementations

   - Fix broken command filtering for the host view of NVIDIA's "cmdqv"
     SMMUv3 extension

   - MMU-500 device-tree binding additions for Qualcomm Eliza & Hawi
     SoCs

  Intel VT-d:

   - Support for dirty tracking on domains attached to PASID

   - Removal of unnecessary read*()/write*() wrappers

   - Improvements to the invalidation paths

  AMD Vi:

   - Race-condition fixed in debugfs code

   - Make log buffer allocation NUMA aware

  RISC-V:

   - IO-TLB flushing improvements

   - Minor fixes"

* tag 'iommu-updates-v7.1' of git://git.kernel.org/pub/scm/linux/kernel/git/iommu/linux: (48 commits)
  iommu/vt-d: Restore IOMMU_CAP_CACHE_COHERENCY
  dt-bindings: arm-smmu: qcom: Add compatible for Hawi SoC
  iommu/amd: Invalidate IRT cache for DMA aliases
  iommu/riscv: Remove overflows on the invalidation path
  iommu/amd: Fix clone_alias() to use the original device's devid
  iommu/vt-d: Remove the remaining pages along the invalidation path
  iommu/vt-d: Pass size_order to qi_desc_piotlb() not npages
  iommu/vt-d: Split piotlb invalidation into range and all
  iommu/vt-d: Remove dmar_writel() and dmar_writeq()
  iommu/vt-d: Remove dmar_readl() and dmar_readq()
  iommufd/selftest: Test dirty tracking on PASID
  iommu/vt-d: Support dirty tracking on PASID
  iommu/vt-d: Rename device_set_dirty_tracking() and pass dmar_domain pointer
  iommu/vt-d: Block PASID attachment to nested domain with dirty tracking
  iommu/dma: Always allow DMA-FQ when iommupt provides the iommu_domain
  iommu/riscv: Fix signedness bug
  iommu/amd: Fix illegal cap/mmio access in IOMMU debugfs
  iommu/amd: Fix illegal device-id access in IOMMU debugfs
  iommu/tegra241-cmdqv: Update uAPI to clarify HYP_OWN requirement
  iommu/tegra241-cmdqv: Set supports_cmd op in tegra241_vcmdq_hw_init()
  ...
2026-04-15 15:05:51 -07:00
Linus Torvalds
5a69195686 ata changes for 7.1-rc1
- Misc code cleanups related to tag checking and tag command completion
    (Damien)
 
  - Remove Baikal bt1-ahci DT binding since the upstreaming for this SoC is
    not going to be finalized (Andy)
 
  - Only call the libata port error handler from the SCSI error handler if
    there were command timeouts or if EH was scheduled for the port
    (Damien)
 
  - Refactor ata_scsiop_maint_in() to more clearly show that there is only
    one service action implemented for the MAINTENANCE IN command (me)
 
  - Clean up the handling of sysfs attributes exposed by libata (Heiner)
 
  - Let libahci_platform use a flexible array member for platform PHYs to
    avoid multiple allocations (Rosen)
 
  - Do not retry reset if the device has been removed/hot-unplugged (Igor)
 
  - Add missing newlines to error prints in pata_arasan_cf driver (Haoyu)
 
  - Use the correct SCSI host byte when completing deferred ATA
    PASS-THROUGH commands, to avoid the SCSI mid-layer from failing the
    commands instead of requeuing (Igor)
 -----BEGIN PGP SIGNATURE-----
 
 iHUEABYKAB0WIQRN+ES/c4tHlMch3DzJZDGjmcZNcgUCad0KbAAKCRDJZDGjmcZN
 coW9AP9NSpDWYW8ptoA+2R+wj2AHwiusSVEooIwAFGyDjquftAD+If03044dsO7Z
 AlBlxq88iEjQNVB3JhfeR5Plx83ZXgs=
 =zswk
 -----END PGP SIGNATURE-----

Merge tag 'ata-7.1-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/libata/linux

Pull ata updates from Niklas Cassel:

 - Misc code cleanups related to tag checking and tag command completion
   (Damien)

 - Remove Baikal bt1-ahci DT binding since the upstreaming for this SoC
   is not going to be finalized (Andy)

 - Only call the libata port error handler from the SCSI error handler
   if there were command timeouts or if EH was scheduled for the port
   (Damien)

 - Refactor ata_scsiop_maint_in() to more clearly show that there is
   only one service action implemented for the MAINTENANCE IN command
   (me)

 - Clean up the handling of sysfs attributes exposed by libata (Heiner)

 - Let libahci_platform use a flexible array member for platform PHYs to
   avoid multiple allocations (Rosen)

 - Do not retry reset if the device has been removed/hot-unplugged
   (Igor)

 - Add missing newlines to error prints in pata_arasan_cf driver (Haoyu)

 - Use the correct SCSI host byte when completing deferred ATA
   PASS-THROUGH commands, to avoid the SCSI mid-layer from failing the
   commands instead of requeuing (Igor)

* tag 'ata-7.1-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/libata/linux:
  ata: libata-scsi: fix requeue of deferred ATA PASS-THROUGH commands
  ata: pata_arasan_cf: fix missing newline in dev_err() messages
  ata: libata-transport: remove static variable ata_scsi_transport_template
  ata: libata-transport: split struct ata_internal
  ata: libata-transport: use static struct ata_transport_internal to simplify match functions
  ata: libata-transport: inline ata_attach|release_transport
  ata: libata-transport: instantiate struct ata_internal statically
  ata: libata-eh: Do not retry reset if the device is gone
  ata: libahci_platform: use flex array for platform PHYs
  ata: libata-transport: remove redundant dynamic sysfs attributes
  ata: libata-scsi: refactor ata_scsiop_maint_in()
  ata: libata-eh: avoid unnecessary calls to ata_scsi_port_error_handler()
  ata: ahci-dwc: Remove not-going-to-be-supported code for Baikal SoC
  ata: libata-scsi: rename and improve ata_qc_done()
  ata: libata-scsi: make ata_scsi_simulate() static
  ata: libata-scsi: simplify ata_scsi_requeue_deferred_qc()
  ata: libata-sata: simplify ata_sas_queuecmd()
  ata: libata-core: improve tag checks in ata_qc_issue()
2026-04-15 15:03:01 -07:00
Linus Torvalds
40286d6379 pci-v7.1-changes
-----BEGIN PGP SIGNATURE-----
 
 iQJIBAABCgAyFiEEgMe7l+5h9hnxdsnuWYigwDrT+vwFAmnfwfMUHGJoZWxnYWFz
 QGdvb2dsZS5jb20ACgkQWYigwDrT+vxwIRAAlN1h5er8aFDbjON5YMXBZqlQmzaC
 bjlUHgwm7HkdErTFozyuqhE8QUO1kCm4uMQzeyJdfY9nRWqMDOuKYxMD5j0exk+o
 4tbbJg6Xx4dq7Qrawy9PhxyQm/PDAcvs+FRRlGala+qq9o3fxPDOAZVDE/1C8qFQ
 Jd7GGd7NZn/NN4xrqST4RQHjO8fwaMwmksWCStsb79kfesQWP6kLADGfIMcWxNUB
 2s+oTnK6Hw0tkBv56n6i8mbb0EzS3/RN1daTevGAta1rmfUVVtWGRZ4paMvv0Owi
 Rl5+O5Jz6/c1qiXZbUqu5CRQPIy7Dr3JPvURcZX6qbsV8PzWXZr0Wi+geWefGOnp
 55y+3OT0vdBGAuXLJhrcU7Clzq9D/TZOt8oTI8IFArUfDlmrAIdozPn7gr+VGre5
 QuKymSk3XWtyIbe4o8UeZ4f9g0y6ZY1XvtvB7K1tze+OOmqlkfq966+z8aZuGOKx
 ZvAU/NIat5H02EgB4dEVOP8R5vPZlXGT0RLGl1JWRypPWyZDbVVA3z927qRQG5md
 IsVq8WaIrB1zyl9g37lZeEaYwP/qCIQsHkMGPYcP4wdOQEV9AQqi5pmjMXnWyQJD
 PR1nvmTKW7USRCJ+pz8xPhZh0cj3ENaddORTD3I/0CGVV0y452bU/5rr4T+K04bK
 PCJBpxTIDuWDwXc=
 =FFRz
 -----END PGP SIGNATURE-----

Merge tag 'pci-v7.1-changes' of git://git.kernel.org/pub/scm/linux/kernel/git/pci/pci

Pull pci updates from Bjorn Helgaas:
 "Enumeration:

   - Allow TLP Processing Hints to be enabled for RCiEPs (George Abraham
     P)

   - Enable AtomicOps only if we know the Root Port supports them (Gerd
     Bayer)

   - Don't enable AtomicOps for RCiEPs since none of them need Atomic
     Ops and we can't tell whether the Root Complex would support them
     (Gerd Bayer)

   - Leave Precision Time Measurement disabled until a driver enables it
     to avoid PCIe errors (Mika Westerberg)

   - Make pci_set_vga_state() fail if bridge doesn't support VGA
     routing, i.e., PCI_BRIDGE_CTL_VGA is not writable, and return
     errors to vga_get() callers including userspace via
     /dev/vga_arbiter (Simon Richter)

   - Validate max-link-speed from DT in j721e, brcmstb, mediatek-gen3,
     rzg3s drivers (where the actual controller constraints are known),
     and remove validation from the generic OF DT accessor (Hans Zhang)

   - Remove pc110pad driver (no longer useful after 486 CPU support
     removed) and no_pci_devices() (pc110pad was the last user) (Dmitry
     Torokhov, Heiner Kallweit)

  Resource management:

   - Prevent assigning space to unimplemented bridge windows; previously
     we mistakenly assumed prefetchable window existed and assigned
     space and put a BAR there (Ahmed Naseef)

   - Avoid shrinking bridge windows to fit in the initial Root Port
     window; fixes one problem with devices with large BARs connected
     via switches, e.g., Thunderbolt (Ilpo Järvinen)

   - Pass full extent of empty space, not just the aligned space, to
     resource_alignf callback so free space before the requested
     alignment can be used (Ilpo Järvinen)

   - Place small resources before larger ones for better utilization of
     address space (Ilpo Järvinen)

   - Fix alignment calculation for resource size larger than align,
     e.g., bridge windows larger than the 1MB required alignment (Ilpo
     Järvinen)

  Reset:

   - Update slot handling so all ARI functions are treated as being in
     the same slot. They're all reset by Secondary Bus Reset, but
     previously drivers of ARI functions that appeared to be on a
     non-zero device weren't notified and fatal hardware errors could
     result (Keith Busch)

   - Make sysfs reset_subordinate hotplug safe to avoid spurious hotplug
     events (Keith Busch)

   - Hide Secondary Bus Reset ('bus') from sysfs reset_methods if masked
     by CXL because it has no effect (Vidya Sagar)

   - Avoid FLR for AMD NPU device, where it causes the device to hang
     (Lizhi Hou)

  Error handling:

   - Clear only error bits in PCIe Device Status to avoid accidentally
     clearing Emergency Power Reduction Detected (Shuai Xue)

   - Check for AER errors even in devices without drivers (Lukas Wunner)

   - Initialize ratelimit info so DPC and EDR paths log AER error
     information (Kuppuswamy Sathyanarayanan)

  Power control:

   - Add UPD720201/UPD720202 USB 3.0 xHCI Host Controller .compatible so
     generic pwrctrl driver can control it (Neil Armstrong)

  Hotplug:

   - Set LED_HW_PLUGGABLE for NPEM hotplug-capable ports so LED core
     doesn't complain when setting brightness fails because the endpoint
     is gone (Richard Cheng)

  Peer-to-peer DMA:

   - Allow wildcards in list of host bridges that support peer-to-peer
     DMA between hierarchy domains and add all Google SoCs (Jacob
     Moroni)

  Endpoint framework:

   - Advertise dynamic inbound mapping support in pci-epf-test and
     update host pci_endpoint_test to skip doorbell testing if not
     advertised by endpoint (Koichiro Den)

   - Return 0, not remaining timeout, when MHI eDMA ops complete so
     mhi_ep_ring_add_element() doesn't interpret non-zero as failure
     (Daniel Hodges)

   - Remove vntb and ntb duplicate resource teardown that leads to oops
     when .allow_link() fails or .drop_link() is called (Koichiro Den)

   - Disable vntb delayed work before clearing BAR mappings and
     doorbells to avoid oops caused by doing the work after resources
     have been torn down (Koichiro Den)

   - Add a way to describe reserved subregions within BARs, e.g.,
     platform-owned fixed register windows, and use it for the RK3588
     BAR4 DMA ctrl window (Koichiro Den)

   - Add BAR_DISABLED for BARs that will never be available to an EPF
     driver, and change some BAR_RESERVED annotations to BAR_DISABLED
     (Niklas Cassel)

   - Add NTB .get_dma_dev() callback for cases where DMA API requires a
     different device, e.g., vNTB devices (Koichiro Den)

   - Add reserved region types for MSI-X Table and PBA so Endpoint
     controllers can them as describe hardware-owned regions in a
     BAR_RESERVED BAR (Manikanta Maddireddy)

   - Make Tegra194/234 BAR0 programmable and remove 1MB size limit
     (Manikanta Maddireddy)

   - Expose Tegra BAR2 (MSI-X) and BAR4 (DMA) as 64-bit BAR_RESERVED
     (Manikanta Maddireddy)

   - Add Tegra194 and Tegra234 device table entries to pci_endpoint_test
     (Manikanta Maddireddy)

   - Skip the BAR subrange selftest if there are not enough inbound
     window resources to run the test (Christian Bruel)

  New native PCIe controller drivers:

   - Add DT binding and driver for Andes QiLai SoC PCIe host controller
     (Randolph Lin)

   - Add DT binding and driver for ESWIN PCIe Root Complex (Senchuan
     Zhang)

  Baikal T-1 PCIe controller driver:

   - Remove driver since it never quite became usable (Andy Shevchenko)

  Cadence PCIe controller driver:

   - Implement byte/word config reads with dword (32-bit) reads because
     some Cadence controllers don't support sub-dword accesses (Aksh
     Garg)

  CIX Sky1 PCIe controller driver:

   - Add 'power-domains' to DT binding for SCMI power domain (Gary Yang)

  Freescale i.MX6 PCIe controller driver:

   - Add i.MX94 and i.MX943 to fsl,imx6q-pcie-ep DT binding (Richard
     Zhu)

   - Delay instead of polling for L2/L3 Ready after PME_Turn_off when
     suspending i.MX6SX because LTSSM registers are inaccessible
     (Richard Zhu)

   - Separate PERST# assertion (for resetting endpoints) from core reset
     (for resetting the RC itself) to prepare for new DTs with PERST#
     GPIO in per-Root Port nodes (Sherry Sun)

   - Retain Root Port MSI capability on i.MX7D, i.MX8MM, and i.MX8MQ so
     MSI from downstream devices will work (Richard Zhu)

   - Fix i.MX95 reference clock source selection when internal refclk is
     used (Franz Schnyder)

  Freescale Layerscape PCIe controller driver:

   - Allow building as a removable module (Sascha Hauer)

  MediaTek PCIe Gen3 controller driver:

   - Use dev_err_probe() to simplify error paths and make deferred probe
     messages visible in /sys/kernel/debug/devices_deferred (Chen-Yu
     Tsai)

   - Power off device if setup fails (Chen-Yu Tsai)

   - Integrate new pwrctrl API to enable power control for WiFi/BT
     adapters on mainboard or in PCIe or M.2 slots (Chen-Yu Tsai)

  NVIDIA Tegra194 PCIe controller driver:

   - Poll less aggressively and non-atomically for PME_TO_Ack during
     transition to L2 (Vidya Sagar)

   - Disable LTSSM after transition to Detect on surprise link down to
     stop toggling between Polling and Detect (Manikanta Maddireddy)

   - Don't force the device into the D0 state before L2 when suspending
     or shutting down the controller (Vidya Sagar)

   - Disable PERST# IRQ only in Endpoint mode because it's not
     registered in Root Port mode (Manikanta Maddireddy)

   - Handle 'nvidia,refclk-select' as optional (Vidya Sagar)

   - Disable direct speed change in Endpoint mode so link speed change
     is controlled by the host (Vidya Sagar)

   - Set LTR values before link up to avoid bogus LTR messages with 0
     latency (Vidya Sagar)

   - Allow system suspend when the Endpoint link is down (Vidya Sagar)

   - Use DWC IP core version, not Tegra custom values, to avoid DWC core
     version check warnings (Manikanta Maddireddy)

   - Apply ECRC workaround to devices based on DesignWare 5.00a as well
     as 4.90a (Manikanta Maddireddy)

   - Disable PM Substate L1.2 in Endpoint mode to work around Tegra234
     erratum (Vidya Sagar)

   - Delay post-PERST# cleanup until core is powered on to avoid CBB
     timeout (Manikanta Maddireddy)

   - Assert CLKREQ# so switches that forward it to their downstream side
     can bring up those links successfully (Vidya Sagar)

   - Calibrate pipe to UPHY for Endpoint mode to reset stale PLL state
     from any previous bad link state (Vidya Sagar)

   - Remove IRQF_ONESHOT flag from Endpoint interrupt registration so
     DMA driver and Endpoint controller driver can share the interrupt
     line (Vidya Sagar)

   - Enable DMA interrupt to support DMA in both Root Port and Endpoint
     modes (Vidya Sagar)

   - Enable hardware link retraining after link goes down in Endpoint
     mode (Vidya Sagar)

   - Add DT binding and driver support for core clock monitoring (Vidya
     Sagar)

  Qualcomm PCIe controller driver:

   - Advertise 'Hot-Plug Capable' and set 'No Command Completed Support'
     since Qcom Root Ports support hotplug events like DL_Up/Down and
     can accept writes to Slot Control without delays between writes
     (Krishna Chaitanya Chundru)

  Renesas R-Car PCIe controller driver:

   - Mark Endpoint BAR0 and BAR2 as Resizable (Koichiro Den)

   - Reduce EPC BAR alignment requirement to 4K (Koichiro Den)

  Renesas RZ/G3S PCIe controller driver:

   - Add RZ/G3E to DT binding and to driver (John Madieu)

   - Assert (not deassert) resets in probe error path (John Madieu)

   - Assert resets in suspend path in reverse order they were deasserted
     during probe (John Madieu)

   - Rework inbound window algorithm to prevent mapping more than
     intended region and enforce alignment on size, to prepare for
     RZ/G3E support (John Madieu)

  Rockchip DesignWare PCIe controller driver:

   - Add tracepoints for PCIe controller LTSSM transitions and link rate
     changes (Shawn Lin)

   - Trace LTSSM events collected by the dw-rockchip debug FIFO (Shawn
     Lin)

  SOPHGO PCIe controller driver:

   - Disable ASPM L0s and L1 on Sophgo 2042 PCIe Root Ports that
     advertise support for them (Yao Zi)

  Synopsys DesignWare PCIe controller driver:

   - Continue with system suspend even if an Endpoint doesn't respond
     with PME_TO_Ack message (Manivannan Sadhasivam)

   - Set Endpoint MSI-X Table Size in the correct function of a
     multi-function device when configuring MSI-X, not in Function 0
     (Aksh Garg)

   - Set Max Link Width and Max Link Speed for all functions of a
     multi-function device, not just Function 0 (Aksh Garg)

   - Expose PCIe event counters in groups 5-7 in debugfs (Hans Zhang)

  Miscellaneous:

   - Warn only once about invalid ACS kernel parameter format (Richard
     Cheng)

   - Suppress FW_BUG warning when writing sysfs 'numa_node' with the
     current value (Li RongQing)

   - Drop redundant 'depends on PCI' from Kconfig (Julian Braha)"

* tag 'pci-v7.1-changes' of git://git.kernel.org/pub/scm/linux/kernel/git/pci/pci: (165 commits)
  PCI/P2PDMA: Add Google SoCs to the P2P DMA host bridge list
  PCI/P2PDMA: Allow wildcard Device IDs in host bridge list
  PCI: sg2042: Avoid L0s and L1 on Sophgo 2042 PCIe Root Ports
  PCI: cadence: Add flags for disabling ASPM capability for broken Root Ports
  PCI: tegra194: Add core monitor clock support
  dt-bindings: PCI: tegra194: Add monitor clock support
  PCI: tegra194: Enable hardware hot reset mode in Endpoint mode
  PCI: tegra194: Enable DMA interrupt
  PCI: tegra194: Remove IRQF_ONESHOT flag during Endpoint interrupt registration
  PCI: tegra194: Calibrate pipe to UPHY for Endpoint mode
  PCI: tegra194: Assert CLKREQ# explicitly by default
  PCI: tegra194: Fix CBB timeout caused by DBI access before core power-on
  PCI: tegra194: Disable L1.2 capability of Tegra234 EP
  PCI: dwc: Apply ECRC workaround to DesignWare 5.00a as well
  PCI: tegra194: Use DWC IP core version
  PCI: tegra194: Free up Endpoint resources during remove()
  PCI: tegra194: Allow system suspend when the Endpoint link is not up
  PCI: tegra194: Set LTR message request before PCIe link up in Endpoint mode
  PCI: tegra194: Disable direct speed change for Endpoint mode
  PCI: tegra194: Use devm_gpiod_get_optional() to parse "nvidia,refclk-select"
  ...
2026-04-15 14:41:21 -07:00
Linus Torvalds
46576fa329 hwmon updates for 7.1
* New drivers:
 
   - Add support for Lenovo Yoga/Legion fan monitoring (yogafan)
 
   - Add support for LattePanda Sigma EC
 
   - Add support for Infineon XDP720 eFuse
 
   - Add support for Microchip MCP998X
 
 * New device support:
 
   - Add support for TI INA234
 
   - Add support for Infineon XDPE1A2G5B/7B
 
   - Add support for Renesas RAA228942 and RAA228943 (isl68137)
 
   - Add support for Delta Q54SN120A1 and Q54SW120A7 (pmbus)
 
   - Add support for TI TMP110 and TMP113 (tmp102)
 
   - Add support for Sony APS-379 (pmbus)
 
   - Add support for ITE IT8689E (it87)
 
   - Add support for ASUS ROG STRIX Z790-H, X470-F, and CROSSHAIR X670E (asus-ec-sensors)
 
   - Add support for GPD Win 5 (gpd-fan)
 
 * Modernization and Cleanups:
 
   - Convert asus_atk0110 and acpi_power_meter ACPI drivers to platform drivers
 
   - Remove i2c_match_id() usage in many PMBus drivers
 
   - Use guard() for mutex protection in pmbus_core
 
   - Replace sprintf() with sysfs_emit() in ads7871, emc1403, max6650,
     ads7828, max31722, and tc74
 
   - Various markup and documentation improvements for yogafan and ltc4282
 
 * Bug fixes:
 
   - Fix use-after-free and missing usb_kill_urb on disconnect in powerz driver
 
   - Avoid cacheline sharing for DMA buffer in powerz driver
 
   - Fix integer overflow in power calculation on 32-bit in isl28022 driver
 
   - Fix bugs in pt5161l_read_block_data()
 
   - Propagate SPI errors and fix incorrect error codes in ads7871 driver
 
   - Fix i2c_smbus_write_byte_data wrapper argument type in max31785 driver
 
 * Device tree bindings:
 
   - Convert npcm750-pwm-fan to DT schema
 
   - Add bindings for Infineon XDP720, Microchip MCP998X, Sony APS-379,
     Renesas RAA228942/3, Delta Q54SN120A1/7, XDPE1A2G5B/7B,
     Aosong AHT10/20, DHT20, and TI INA234
 
   - Adapt moortec,mr75203 bindings for T-Head TH1520
 
 ----------------------------------------------------------------
 (Commits list will be generated by git request-pull or similar tool)
 -----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCAAdFiEEiHPvMQj9QTOCiqgVyx8mb86fmYEFAmncEakACgkQyx8mb86f
 mYFEYw/7BtjCrbSmrs178gjuICFbOOCBvyeEP/NqA3q2LLrf4KqdCncrP+FRlAYn
 3/Bhm1vM7hEvF5SwnYWxw874Sl7Ys6OfxgT0ipGKYEobcx3fYJKgfjiiIDfPXqbm
 Ewjd9WMkrsDmaNQj/ZHazFBd9Rjj169a4MtvbNyXe1ipaVjoNoojoCg/R6di8Y9S
 T4EMg/ok6i7jUGfY/KrtnRqAjsM447vNjSfaoDW0jvW//fgYxslzIvL/IMyYkaK/
 GViKuIgcAx96i95+uhNQl1K8DJqFkYt99fuZrteq8lE+VWBmjAXS2vYgIpvmNbt1
 PH30cqXId+EO6GIecyt2TDAW6xyJiU6H7ln5ethIKFX856QOuFhT3qhfqPFRSjx4
 EVwGYTxTlkmrDv6Z1nPdsBe3KmZ2GiG11bsq6O4SRGHqumKO1rEiEjuAsKvGnGMy
 JMV3GuuY5ngt7S6Pp5Hs/W1DFMJrGvFWyCMwUikmzG0YwfmYLjsBGOX5wpS1vw9s
 pQKdjV4eimy8UwdF++8sx/RytTmRM0CcNMZUHFPMZMymTZD68dXPlzhs/Mv/CQdU
 goFflxGP8bixr82Zbgzz/0l9jqUEH0IGDv1ojrMp3X8EXCFPNNPwJuvDuyWCd0P5
 WG5ydk0G0lH0aKC4izhZ0IkQVPo4Wlns1zNTF0pXmPrMY2fjupk=
 =ApnM
 -----END PGP SIGNATURE-----

Merge tag 'hwmon-for-v7.1' of git://git.kernel.org/pub/scm/linux/kernel/git/groeck/linux-staging

Pull hwmon updates from Guenter Roeck:
 "New drivers:
   - Lenovo Yoga/Legion fan monitoring (yogafan)
   - LattePanda Sigma EC
   - Infineon XDP720 eFuse
   - Microchip MCP998X

  New device support:
   - TI INA234
   - Infineon XDPE1A2G5B/7B
   - Renesas RAA228942 and RAA228943 (isl68137)
   - Delta Q54SN120A1 and Q54SW120A7 (pmbus)
   - TI TMP110 and TMP113 (tmp102)
   - Sony APS-379 (pmbus)
   - ITE IT8689E (it87)
   - ASUS ROG STRIX Z790-H, X470-F, and CROSSHAIR X670E (asus-ec-sensors)
   - GPD Win 5 (gpd-fan)

  Modernization and Cleanups:
   - Convert asus_atk0110 and acpi_power_meter ACPI drivers to platform
     drivers
   - Remove i2c_match_id() usage in many PMBus drivers
   - Use guard() for mutex protection in pmbus_core
   - Replace sprintf() with sysfs_emit() in ads7871, emc1403, max6650,
     ads7828, max31722, and tc74
   - Various markup and documentation improvements for yogafan and
     ltc4282

  Bug fixes:
   - Fix use-after-free and missing usb_kill_urb on disconnect in powerz
     driver
   - Avoid cacheline sharing for DMA buffer in powerz driver
   - Fix integer overflow in power calculation on 32-bit in isl28022
     driver
   - Fix bugs in pt5161l_read_block_data()
   - Propagate SPI errors and fix incorrect error codes in ads7871
     driver
   - Fix i2c_smbus_write_byte_data wrapper argument type in max31785
     driver

  Device tree bindings:
   - Convert npcm750-pwm-fan to DT schema
   - Add bindings for Infineon XDP720, Microchip MCP998X, Sony APS-379,
     Renesas RAA228942/3, Delta Q54SN120A1/7, XDPE1A2G5B/7B, Aosong
     AHT10/20, DHT20, and TI INA234
   - Adapt moortec,mr75203 bindings for T-Head TH1520"

* tag 'hwmon-for-v7.1' of git://git.kernel.org/pub/scm/linux/kernel/git/groeck/linux-staging: (82 commits)
  hwmon: (ina233) Don't check for specific errors when parsing properties
  hwmon: (isl28022) Don't check for specific errors when parsing properties
  hwmon: (pmbus/tps25990) Don't check for specific errors when parsing properties
  hwmon: (nct6683) Add customer ID for ASRock B650I Lightning WiFi
  hwmon:(pmbus/xdp720) Add support for efuse xdp720
  dt-bindings: hwmon/pmbus: Add Infineon XDP720
  hwmon: add support for MCP998X
  dt-bindings: hwmon: add support for MCP998X
  hwmon: (powerz) Avoid cacheline sharing for DMA buffer
  hwmon: (isl28022) Fix integer overflow in power calculation on 32-bit
  hwmon: (pt5161l) Fix bugs in pt5161l_read_block_data()
  hwmon: (powerz) Fix missing usb_kill_urb() on signal interrupt
  hwmon: (powerz) Fix use-after-free on USB disconnect
  hwmon: pmbus: Add support for Sony APS-379
  dt-bindings: trivial-devices: Add sony,aps-379
  hwmon: (yogafan) various markup improvements
  hwmon: (sparx5) Make it selectable for ARCH_LAN969X
  hwmon: (tmp102) add support for update interval
  hwmon: (yogafan) fix markup warning
  hwmon: (yogafan) Add support for Lenovo Yoga/Legion fan monitoring
  ...
2026-04-15 14:37:32 -07:00
Linus Torvalds
405f6584d7 spi: Updates for v7.1
A busy release for SPI, almost all of it in a couple of larger fix and
 cleanup serieses for patterns that affected many drivers.  We do have
 a couple of core API additions as well, relatively application specific
 but they enable some new use cases.
 
  - A packed command operation for spi-mem devices.
  - Improvements to the ancillary device support to enable some IIO use
    cases from Antoniu Miclaus.
  - Fixes for a registration ordering issue pattern caused by the
    handover between allocation and registration of controllers in
    concert with devm from Johan Hovold.
  - Improvements to handling of clock allocation from Pei Xiao.
  - Cleanups in the fsl-lpspi driver from Marc Kleine-Budde.
  - Support for Renesas RZ/G3E and RZ/G3L.
 -----BEGIN PGP SIGNATURE-----
 
 iQEzBAABCgAdFiEEreZoqmdXGLWf4p/qJNaLcl1Uh9AFAmnc9CMACgkQJNaLcl1U
 h9B/BQf8DMXPDqx1YT1CFOzaHQ8N75g/IpDcGEE0tVigRm7dXRMYOooMDNND2TpV
 9XN20UxJ2rE0E719pMWegKI+c1QDCuKDInS9t79rqSLG8bEy94kjlaaMS8yKwobO
 2zKqBXNF44XFRRapY/5dHaESOyst7UxUNfVUqb2LAdp+lkWAENC/SBckzZ/nAxHc
 O8V1NsKML5axFH0uNTiNKcuDxM1UdHW+mifEKlKrk2S/MgMfl4mvfa4Ogkft/jg3
 xID1mgvqOixeXqGlQue74IsIHDw4LmAIkSACnZYyPt/13W4kgIHx735C9ptkOs+q
 4sRlM0zgmwZl57+fXOf7Ta2s5efZBA==
 =NKfH
 -----END PGP SIGNATURE-----

Merge tag 'spi-v7.1' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/spi

Pull spi updates from Mark Brown:
 "A busy release for SPI, almost all of it in a couple of larger fix and
  cleanup series for patterns that affected many drivers. We do have a
  couple of core API additions as well, relatively application specific
  but they enable some new use cases.

   - A packed command operation for spi-mem devices

   - Improvements to the ancillary device support to enable some IIO use
     cases from Antoniu Miclaus

   - Fixes for a registration ordering issue pattern caused by the
     handover between allocation and registration of controllers in
     concert with devm from Johan Hovold

   - Improvements to handling of clock allocation from Pei Xiao

   - Cleanups in the fsl-lpspi driver from Marc Kleine-Budde

   - Support for Renesas RZ/G3E and RZ/G3L"

* tag 'spi-v7.1' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/spi: (115 commits)
  spi: sn-f-ospi: fix incorrect return code for invalid num-cs
  spi: spi-mem: Add a packed command operation
  spi: cadence-qspi: Revert the filtering of certain opcodes in ODTR
  spi: mtk-snfi: unregister ECC engine on probe failure and remove() callback
  spi: s3c64xx: fix NULL-deref on driver unbind
  spi: zynq-qspi: fix controller deregistration
  spi: zynqmp-gqspi: fix controller deregistration
  spi: uniphier: fix controller deregistration
  spi: ti-qspi: fix controller deregistration
  spi: tegra20-sflash: fix controller deregistration
  spi: tegra114: fix controller deregistration
  spi: syncuacer: fix controller deregistration
  spi: sun6i: fix controller deregistration
  spi: sun4i: fix controller deregistration
  spi: st-ssc4: fix controller deregistration
  spi: sprd: fix controller deregistration
  spi: slave-mt27xx: fix controller deregistration
  spi: sifive: fix controller deregistration
  spi: sh-msiof: fix controller deregistration
  spi: sh-hspi: fix controller deregistration
  ...
2026-04-15 14:34:11 -07:00
Linus Torvalds
44f7a37953 regulator: Updates for v7.1
This has been a very quiet update for the regulator API, the bulk of the
 diffstat is DT binding conversions and the most promient series in the
 changelog is Johan Hovold cleaning up some leaks of OF nodes.  For some
 reason we have had several different people sending improvements to
 better describe the parent supplies for existing regulators, these look
 to be independent efforts.
 
 The only new hardware support is for some Motorola custom varints of
 cpcap.
 -----BEGIN PGP SIGNATURE-----
 
 iQEzBAABCgAdFiEEreZoqmdXGLWf4p/qJNaLcl1Uh9AFAmndBTsACgkQJNaLcl1U
 h9ADHggAhMn3Y2euauiXuf+XBzrO6VlnNSnsX2PLLWFS2vAd4set/y9PHAy5EuhM
 HVoKoyTC7DymWDI+2oNCfp71yekQK5zkM25BDyuQUQws9z6DI4k+XhMTF+A/C5eG
 mq0LTxmBwia1YCuT+++vE3Q4+k8TuftbnIUf/pd8Ogt13zeoVVKiXGtHbZVD6bv8
 Uj3sBludwExM2VhAfqOxsWdcR/8jThbP2k3QMY4AP16C6aVhGFneXGTxiAxJcKfb
 XntfMIy4z9hwdUxacc8WkxetZ0OzifVSnUsk2YN5E1UuvDpHtwFm83jPI6YUCA3V
 7lA8FD62NoY8kMERfKN+DdgXUL47jA==
 =K0DF
 -----END PGP SIGNATURE-----

Merge tag 'regulator-v7.1' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/regulator

Pull regulator updates from Mark Brown:
 "This has been a very quiet update for the regulator API, the bulk of
  the diffstat is DT binding conversions and the most promient series in
  the changelog is Johan Hovold cleaning up some leaks of OF nodes. For
  some reason we have had several different people sending improvements
  to better describe the parent supplies for existing regulators, these
  look to be independent efforts.

  The only new hardware support is for some Motorola custom varints of
  cpcap"

* tag 'regulator-v7.1' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/regulator: (35 commits)
  regulator: max77620: drop redundant OF node initialisation
  regulator: bq257xx: Make OTG enable GPIO really optional
  regulator: bq257xx: Remove reference to the parent MFD's dev
  regulator: bd9571mwv: fix OF node reference imbalance
  regulator: act8945a: fix OF node reference imbalance
  regulator: s2dos05: fix OF node reference imbalance
  regulator: mt6357: fix OF node reference imbalance
  regulator: max77650: fix OF node reference imbalance
  regulator: rk808: fix OF node reference imbalance
  regulator: bq257xx: fix OF node reference imbalance
  regulator: dt-bindings: qcom,qca6390-pmu: Document WCN6755 PMU
  regulator: dt-bindings: regulator-max77620: convert to DT schema
  regulator: mt6315: Add regulator supplies
  regulator: dt-bindings: mt6315: Add regulator supplies
  regulator: devres: Use enum regulator_get_type in internal functions
  regulator: dt-bindings: mps,mp8859: convert to DT schema
  regulator: da9121: Allow caching BUCK registers
  regulator: dt-bindings: dlg,da9121: Add dlg,no-gpio-control
  regulator: cros-ec: Add regulator supply
  regulator: dt-bindings: cros-ec: Add regulator supply
  ...
2026-04-15 14:32:12 -07:00
Linus Torvalds
8e258317dd regmap: Updates for v7.1
This has been quite a busy release for regmap, the user visible changes
 are quite minor but there's some quite good work on internal code
 improvements.
 
  - Cleanup helper for __free()ing regmap_fields.
  - Support non-devm I3C regmaps.
  - A bunch of cleanup work, mostly from Andy Shevchenko.
  - Fix for bootstrapping issues with hardware initialised regmaps, which
    was the main inspiration for some of the cleanups.
 -----BEGIN PGP SIGNATURE-----
 
 iQEzBAABCgAdFiEEreZoqmdXGLWf4p/qJNaLcl1Uh9AFAmnc3gIACgkQJNaLcl1U
 h9Ay2Af/XhDtVKTtE0H60Z1OESswXFKw/pLyOBBfMqME3OcXksCWZhybr0uB2boD
 nz5EQWvitIfGrR03C4CwVwHF/aCcBYLb6Zo8X9hTMq7Zjlvno2jVM/mmmpQnEZFh
 vrzJIAu8+ZqlxtjtNPJ2FsoTTosA4Y58jmVKHLhLtcPExEQyXWkokM50lZAFgY3i
 R8FdkRI5rHQM+gnKVupT0eI+rBqQxkyp3wtJ42d/2FMduiEbptuZuGppLM79oIlm
 ICMLvPC4ZuXQ7rsUccSqSi06XD5JKpICY2Re7pq+L3cToitkiuWqObOWxLKXswJP
 eU/EaqIKnZJgxKoRuNx44bp7LTOo2g==
 =DnAo
 -----END PGP SIGNATURE-----

Merge tag 'regmap-v7.1' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/regmap

Pull regmap updates from Mark Brown:
 "This has been quite a busy release for regmap, the user visible
  changes are quite minor but there's some quite good work on internal
  code improvements:

   - Cleanup helper for __free()ing regmap_fields

   - Support non-devm I3C regmaps

   - A bunch of cleanup work, mostly from Andy Shevchenko

   - Fix for bootstrapping issues with hardware initialised regmaps,
     which was the main inspiration for some of the cleanups"

* tag 'regmap-v7.1' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/regmap:
  regmap: i3c: Add non-devm regmap_init_i3c() helper
  regmap: debugfs: fix race condition in dummy name allocation
  regmap: Synchronize cache for the page selector
  regmap: Simplify devres handling
  regcache: Move HW readback after cache initialisation
  regcache: Allocate and free reg_defaults on the same level
  regcache: Move count check and cache_bypass assignment to the caller
  regcache: Factor out regcache_hw_exit() helper
  regcache: Amend printf() specifiers when printing registers
  regcache: Define iterator inside for-loop and align their types
  regmap: define cleanup helper for regmap_field
  regmap: sort header includes
  regcache: Split regcache_count_cacheable_registers() helper
  regcache: Remove duplicate check in regcache_hw_init()
2026-04-15 14:27:51 -07:00
Linus Torvalds
e41a25c53f pmdomain core:
- Extend statistics for domain idle states with s2idle data
  - Show latency/residency for domain idle states in debugfs
 
 pmdomain providers:
  - imx: Add support for optional subnodes for imx93-blk-ctrl
  - marvell: Add audio power island for Marvell PXA1908
  - mediatek: Add legacy support for the MT7622 audio power domain
  - mediatek: Add nvmem provider functionality to the mtk-mfg-pmdomain
  - mediatek: Add support for the MT8189 power domains
  - qcom: Add support for the Eliza and Hawi power domains
  - sunxi: Add support for the Allwinner A733 power domains
  - ti: Handle wakeup constraints for out-of-band wakeups for ti_sci
 -----BEGIN PGP SIGNATURE-----
 
 iQJLBAABCgA1FiEEugLDXPmKSktSkQsV/iaEJXNYjCkFAmneGAwXHHVsZi5oYW5z
 c29uQGxpbmFyby5vcmcACgkQ/iaEJXNYjCmvhA/+Ij0e/heV7ceZHLT9VmV54zgz
 RsxqSDzeWfnah/VqWmtHhJIFDCC92n3RK4g0XnFWRbf4LRKtPuev4rmwMaPG8yXC
 lLct/6GhGMUvKHrR+4vIQerJhp7ioW0RnxkVSaxBX0QECW4VdSWXNy0O67bHP+E9
 Tq4kQH9MLesjCf9wtFku1R3clRb6xOWzJMxOSE1H+PDYedgfMYMrqWyhdAjcnXhr
 9meMatQvl6Z5abTGqRjg0rJo+/Ys2Ac8ca5Y/91tOnRp0La7ylG4RTDxRjZbzwjH
 0fLJDkvV3QV5dlNx/96OWJTtKTD+VnMsZEeO2SSz1bSjHDVEJW+4HbudjuxBdmdP
 mh0jMBTg/FkLSNnXsorxAwGnICnWtX/iYAfnKxqGNnKm6u2wRVGNpirt/RQ7h/E0
 OZKL3DNxszT6KWfeXtLtjcoB+i3XEXuK11xcFam9TUGWEvwcRBEsTToV9W6c92MG
 EmbpGFL1geLuaCCzjBXcJghjzD+Q5o3IcVvwgs8/L9vWnFynj/zIH2L3nj8CUMsy
 XSDCuJamhGiak9ThjDTbHL1ybVjOWMKPZea4BRLnXnlwEKBv+BJpzt9Yap0lNB7s
 J7rIIJWJrvWAqBaOXqgoKK0NnmRC+1/o4fo0zmeaBtUXtCdA2oUSq/aNgx0lScP7
 zTpBZl/F7caUSJFvoH8=
 =obaW
 -----END PGP SIGNATURE-----

Merge tag 'pmdomain-v7.1' of git://git.kernel.org/pub/scm/linux/kernel/git/ulfh/linux-pm

Pull pmdomain updates from Ulf Hansson:
 "pmdomain core:
   - Extend statistics for domain idle states with s2idle data
   - Show latency/residency for domain idle states in debugfs

  pmdomain providers:
   - imx: Add support for optional subnodes for imx93-blk-ctrl
   - marvell: Add audio power island for Marvell PXA1908
   - mediatek:
      - Add legacy support for the MT7622 audio power domain
      - Add nvmem provider functionality to the mtk-mfg-pmdomain
      - Add support for the MT8189 power domains
   - qcom: Add support for the Eliza and Hawi power domains
   - sunxi: Add support for the Allwinner A733 power domains
   - ti: Handle wakeup constraints for out-of-band wakeups for ti_sci"

* tag 'pmdomain-v7.1' of git://git.kernel.org/pub/scm/linux/kernel/git/ulfh/linux-pm: (32 commits)
  pmdomain: qcom: rpmhpd: Add power domains for Hawi SoC
  dt-bindings: power: qcom,rpmhpd: Add RPMh power domain for Hawi SoC
  pmdomain: qcom: cpr: add COMPILE_TEST support
  PM: domains: De-constify fields in struct dev_pm_domain_attach_data
  pmdomain: qcom: cpr: simplify main allocation
  pmdomain: bcm: bcm2835-power: Replace open-coded polling with readl_poll_timeout_atomic()
  pmdomain: sunxi: Add support for A733 to Allwinner PCK600 driver
  pmdomain: qcom: rpmhpd: Add Eliza RPMh Power Domains
  pmdomain: arm: Add print after a successful probe for SCMI power domains
  pmdomain: rockchip: quiet regulator error on -EPROBE_DEFER
  pmdomain: mediatek: Add power domain driver for MT8189 SoC
  pmdomain: mediatek: Add bus protect control flow for MT8189
  pmdomain: core: Extend statistics for domain idle states with s2idle data
  pmdomain: core: Show latency/residency for domain idle states in debugfs
  pmdomain: core: Restructure domain idle states data for genpd in debugfs
  pmdomain: qcom: rpmpd: drop stray semicolon
  pmdomain: imx: scu-pd: Fix device_node reference leak during ->probe()
  pmdomain: ti: omap_prm: Fix a reference leak on device node
  pmdomain: mediatek: scpsys: Add MT7622 Audio power domain to legacy driver
  pmdomain: mediatek: Simplify with scoped for each OF child loop
  ...
2026-04-15 14:22:42 -07:00
Linus Torvalds
4ddd4f0651 MMC core:
- Add NXP vendor and IW61x device IDs for WiFi chips over SDIO
  - Add quirk for incorrect manufacturing date
  - Add support for manufacturing date beyond 2025
  - Optimize support for secure erase/trim for some Kingston eMMCs
  - Remove support for the legacy "enable-sdio-wakeup" DT property
  - Use single block writes in the retry path
 
 MMC host:
  - dw_mmc: A great amount of cleanups/simplifications to improve the code
  - dw_mmc: Add clk_phase_map support
  - dw_mmc: Remove mshc DT alias support
  - dw_mmc-rockchip: Fix runtime PM support for internal phase
  - dw_mmc-rockchip: Add support for the RV1103B variant
  - loongson2: Add support for the Loongson-2K0300 SD/SDIO/eMMC controller
  - mtk-sd: Add support for the MT8189 variant
  - renesas_sdhi_core: Add support for selecting an optional mux
  - rtsx_pci_sdmmc: Simplify voltage switch handling
  - sdhci: Stop advertising the driver in dmesg
  - sdhci-esdhc-imx: Add 1-bit bus width support
  - sdhci-esdhc-imx: Add support for the NXP S32N79 variant
  - sdhci-msm: Add support for the IPQ5210 and IPQ9650 variants
  - sdhci-msm: Add support for wrapped keys
  - sdhci-msm: Enable ICE for CQE-capable controllers with non-CQE cards
  - sdhci-of-arasan: Add support for the Axiado AX3000 variant
  - sdhci-of-aspeed: Add support for the AST2700 variant
  - sdhci-of-bst: Add driver for the Black Sesame Technologies C1200 controller
  - sdhci-of-dwcmshc: Add support for the Canaan K230 variant
  - sdhci-of-dwcmshc: Add support for the HPE GSC variant
  - sdhci-of-dwcmshc: Prevent clock glitches to avoid malfunction
  - sdhci-of-k1: Add support for the K3 variant
 
 mux core/consumers:
  - core: Add helper functions for getting optional and selected mux-state
  - i2c-omap: Convert to devm_mux_state_get_optional_selected()
  - phy-renesas: Convert to devm_mux_state_get_optional_selected()
  - phy-can-transceiver: Convert to devm_mux_state_get_optional()
 -----BEGIN PGP SIGNATURE-----
 
 iQJLBAABCgA1FiEEugLDXPmKSktSkQsV/iaEJXNYjCkFAmnc2TYXHHVsZi5oYW5z
 c29uQGxpbmFyby5vcmcACgkQ/iaEJXNYjCmLrQ//UxW6FyEvfP/AQww+W9yi+8K5
 1IJRgYK65a0YxT74M3dzVSOekEXuVa0ZeU8muL/Za9iEATFrfRTfmEdDba7zTRw8
 UFfvuC9pEHKtJzj85CagOXeQ185K9QmeFdxJSnWT06DQzKqIQsmmos0876/r8tUl
 ZRy63sPAXLZcBHU13D1xKXN3cIw39n6yyaE9zEnquE1Q2kU3iABXI3qfK+fEtUCf
 byOSAIpGrGfmEJsRvf9ZgbLnjp+KBBwn3aaLFUEcFKUx+GKoUps6OyqKj1uHJ/zk
 4IkyiFAQ0SpCuEn5uLwwwpXDa42/lg775noTjczSVmWq6PKtPcnN5nZNpBKjeW8P
 HYD87sjqCNlhDq3Ay1R8N8Mv15BFU7pkSwDSRkyx8dZ6Zktu2QQXtnzE0RKINMJx
 KyIHk9Ls3ZTKMJ7RxwP6Mork0TxCF0s8a7HwM5IlJa1ckMc8Epnkz9EqGbqX6X5H
 PJsqKaipcg52A8PJIts+WckdUwQRyWyBQD7Qq8qr+8CcHWFFcf8cbOcpgxPyedsw
 IYQmyLuuFZuo/YytWrnGMmjMLGQp41Zj0XibEVUNlMqAfsUGUTmy4FcejUhOi7Oz
 leXAYV8NRcskebYTqtyK1UCFK28OYDboTZ8rs8mPejqRSp+SwGAWINk2q9zD8ClX
 v5uwUdRL1wNQqnbA2Hg=
 =CAAu
 -----END PGP SIGNATURE-----

Merge tag 'mmc-v7.1' of git://git.kernel.org/pub/scm/linux/kernel/git/ulfh/mmc

Pull MMC updates from Ulf Hansson:
 "MMC core:
   - Add NXP vendor and IW61x device IDs for WiFi chips over SDIO
   - Add quirk for incorrect manufacturing date
   - Add support for manufacturing date beyond 2025
   - Optimize support for secure erase/trim for some Kingston eMMCs
   - Remove support for the legacy "enable-sdio-wakeup" DT property
   - Use single block writes in the retry path

  MMC host:
   - dw_mmc:
      - A great amount of cleanups/simplifications to improve the code
      - Add clk_phase_map support
      - Remove mshc DT alias support
   - dw_mmc-rockchip:
      - Fix runtime PM support for internal phase
      - Add support for the RV1103B variant
   - loongson2:
      - Add support for the Loongson-2K0300 SD/SDIO/eMMC controller
   - mtk-sd:
      - Add support for the MT8189 variant
   - renesas_sdhi_core:
      - Add support for selecting an optional mux
   - rtsx_pci_sdmmc:
      - Simplify voltage switch handling
   - sdhci:
      - Stop advertising the driver in dmesg
   - sdhci-esdhc-imx:
      - Add 1-bit bus width support
      - Add support for the NXP S32N79 variant
   - sdhci-msm:
      - Add support for the IPQ5210 and IPQ9650 variants
      - Add support for wrapped keys
      - Enable ICE for CQE-capable controllers with non-CQE cards
   - sdhci-of-arasan:
      - Add support for the Axiado AX3000 variant
   - sdhci-of-aspeed:
      - Add support for the AST2700 variant
   - sdhci-of-bst:
      - Add driver for the Black Sesame Technologies C1200 controller
   - sdhci-of-dwcmshc:
      - Add support for the Canaan K230 variant
      - Add support for the HPE GSC variant
      - Prevent clock glitches to avoid malfunction
   - sdhci-of-k1:
      - Add support for the K3 variant

  mux core/consumers:
   - core:
      - Add helper functions for getting optional and selected mux-state
   - i2c-omap:
      - Convert to devm_mux_state_get_optional_selected()
   - phy-renesas:
      - Convert to devm_mux_state_get_optional_selected()
   - phy-can-transceiver:
      - Convert to devm_mux_state_get_optional()"

* tag 'mmc-v7.1' of git://git.kernel.org/pub/scm/linux/kernel/git/ulfh/mmc: (131 commits)
  mmc: sdhci-msm: Fix the wrapped key handling
  mmc: sdhci-of-dwcmshc: Disable clock before DLL configuration
  mmc: core: Simplify with scoped for each OF child loop
  mmc: core: Optimize size of struct mmc_queue_req
  mmc: vub300: clean up module init
  mmc: vub300: rename probe error labels
  mmc: dw_mmc: Remove dw_mci_start_request wrapper and rename core function
  mmc: dw_mmc: Inline dw_mci_queue_request() into dw_mci_request()
  mmc: block: Use MQRQ_XFER_SINGLE_BLOCK for both read and write recovery
  mmc: mmc_test: Replace hard-coded values with macros and consolidate test parameters
  mmc: block: Convert to use DEFINE_SIMPLE_DEV_PM_OPS()
  mmc: core: Replace the hard-coded shift value 9 with SECTOR_SHIFT
  mmc: sdhci-dwcmshc: Refactor Rockchip platform data for controller revisions
  mmc: core: Switch to use pm_ptr() for mmc_host_class_dev_pm_ops
  mmc: core: Remove legacy 'enable-sdio-wakeup' DT property support
  mmc: mmc_test: use kzalloc_flex
  mmc: mtk-sd: disable new_tx/rx and modify related settings for mt8189
  dt-bindings: mmc: hisilicon,hi3660-dw-mshc: Convert to DT schema
  dt-bindings: mmc: sdhci-msm: add IPQ9650 compatible
  mmc: block: use single block write in retry
  ...
2026-04-15 14:15:25 -07:00
Linus Torvalds
b9962335d4 pwm: Changes for v7.1-rc1
Just two minor fixes, a device tree binding addition to support a few
 more SoCs (without the need for driver adaptions), a driver include
 cleanup and the addition of the #linux-pwm irc channel to MAINTAINERS.
 -----BEGIN PGP SIGNATURE-----
 
 iQEzBAABCgAdFiEEP4GsaTp6HlmJrf7Tj4D7WH0S/k4FAmncplIACgkQj4D7WH0S
 /k6WnQf+PtJRECp1UNnzLLZAiqEw2u24LrUQzeC0vSI0V72eZstnr7DCcpNyQGfs
 edqw+UfpJGxxrwQTRNCjGkmi7xB3KY8dzElcfoGJRAyxha3qScY2env8Q1nxabB4
 y7eGOGyenhQOoEZhAGYM4Se5VvX5Ch/LuqLrPqszTWPJQOkUI7EAoSSj2i8T2uiT
 LjYT97GRpsf5u8clGPNHIl2hkoGeq38TdKNwBUMXoMdbj0UEsLfsSyNW0rV2dGE9
 J0mieqHhCfgx09wjdTa8WLvVyK0Yd2vwyfyOSeRs1BrqLlVk6N3+nnj/BENQ7mXm
 9z/qPlEfWB2u9TbBoakxkDON+CQ7Mg==
 =MdZa
 -----END PGP SIGNATURE-----

Merge tag 'pwm/for-7.1-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/ukleinek/linux

Pull pwm updates from Uwe Kleine-König:
 "Just two minor fixes, a device tree binding addition to support a few
  more SoCs (without the need for driver adaptions), a driver include
  cleanup and the addition of the #linux-pwm irc channel to MAINTAINERS"

* tag 'pwm/for-7.1-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/ukleinek/linux:
  pwm: th1520: fix `CLIPPY=1` warning
  pwm: jz4740: Drop unused include
  MAINTAINERS: Add #linux-pwm irc channel to pwm entry
  dt-bindings: pwm: amlogic: Document A4 A5 and T7 PWM
  pwm: imx-tpm: Count the number of enabled channels in probe
2026-04-15 14:13:31 -07:00
Linus Torvalds
5af6e08ae7 chrome-platform: Updates for v7.1
* Improvements
 
   - Reduce transmission size by dropping unnecessary data in
     cros_ec_lightbar.
   - Convert chromeos_privacy_screen, chromeos_tbmc, and wilco_ec/event
     from ACPI drivers to platform drivers.
 
 * Fixes
 
   - Drop wakeup source on remove() in chromeos_tbmc.
 
 * Cleanups
 
   - Simplify workqueue usage with devm in cros_usbpd_logger.
 -----BEGIN PGP SIGNATURE-----
 
 iIkEABYKADEWIQS0yQeDP3cjLyifNRUrxTEGBto89AUCadxO8xMcdHp1bmdiaUBr
 ZXJuZWwub3JnAAoJECvFMQYG2jz0OVoBAPtLHW2L473NZlD6JLwq3YPu2+6SJcZ1
 5lh7X26mVNTZAQCNsphLzHhGm9aFQQsAaz+MUUwPahuFI3ezqFOiEiCKDg==
 =oxrT
 -----END PGP SIGNATURE-----

Merge tag 'chrome-platform-v7.1' of git://git.kernel.org/pub/scm/linux/kernel/git/chrome-platform/linux

Pull chrome platform updates from Tzung-Bi Shih:
 "Improvements:

   - Reduce transmission size by dropping unnecessary data in
     cros_ec_lightbar

   - Convert chromeos_privacy_screen, chromeos_tbmc, and wilco_ec/event
     from ACPI drivers to platform drivers

  Fixes:

   - Drop wakeup source on remove() in chromeos_tbmc

  Cleanups:

   - Simplify workqueue usage with devm in cros_usbpd_logger"

* tag 'chrome-platform-v7.1' of git://git.kernel.org/pub/scm/linux/kernel/git/chrome-platform/linux:
  platform/chrome: cros_usbpd_logger: Simplify with devm
  platform/chrome: wilco_ec: event: Convert to a platform driver
  platform/chrome: wilco_ec: event: Register ACPI notify handler
  platform/chrome: chromeos_tbmc: Convert to a platform driver
  platform/chrome: chromeos_tbmc: Register ACPI notify handler
  platform/chrome: chromeos_tbmc: Drop wakeup source on remove
  platform/chrome: Convert ChromeOS privacy-screen driver to platform
  platform/chrome: lightbar: Optimize command size
2026-04-15 14:10:40 -07:00
Linus Torvalds
f82b61de0f — Correct the version guard for the futex_numa_mpol test to require
libnuma 2.0.18 instead of 2.0.16, which is the version that actually
   introduced numa_set_mempolicy_home_node() used by the test
 
 — Allow the futex_numa_mpol selftest to build and run on systems without
   libnuma installed with affected test gracefully being skipped instead of
   failing to compile
 
 - Use the proper assertion macros so that individual sub-test failures are
   correctly propagated and the test suite reports failure when something goes
   wrong
 -----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCgAdFiEEzv7L6UO9uDPlPSfHEsHwGGHeVUoFAmnfpRgACgkQEsHwGGHe
 VUp4jRAAjcfKMRy2ms6PYQJUwPgFXkmGg1Ij0zQ7D6VxujMUmrmNcCt9pQiR9tmm
 ZuCWtZRvJ4L+GIl0iNnetl13Um3MtXlQQ+SZgnNhC8InATs0hCJia1sPXztmp1VC
 36JDiHbzpNO/InxhBu3WJ+DZodN7RHuNCbnj11Leot2cmAz9njtANcudxDTG3r/o
 Bqs65KRFbx7WU3zPMujEPOzdyYn8KL3L2bxYKWIAd9n4hfoLcbMB4QaShyh1sGoW
 ymRMf8yV9vac1tjwOCugkkdDleV5S5LW/eItuNEppV/rBw35GGFTs2yUjaU5U2NN
 UaQVKDE6UEgJsrX0wBPLPdf10CJia4SA2oYN7PFkNogVGqM/cSzl2B/CqJbcKnur
 Gj2KUNK2VVrlln1pfhnu8NJYOIgkjGpSarH9XNGM+2CIsXergh23cKhhZVLVE4Wy
 YirLkW3BNIGmnvF9idvjcktVHibHkvHjRzn2bUhP1K4SMf6kRxsRbTE8Cg12Nlpe
 cGOt3/6VNyonbXFw3nXdlHNDKjmT/aUrNXRhxEIPTToD+DBfhp7Lce9ylba5/fPv
 jrqAC0kMkSdBVNmabMQ+n/WzteXLLeFbocPWmba7fDSGvmMSlj5AU9qOURhyquaK
 nPjxqE5lhbcFY0nZ9zRTP7PG9NwOhVCsCZppTyGirvw+Q/eRxHU=
 =LIxt
 -----END PGP SIGNATURE-----

Merge tag 'locking_futex_for_v7.1_rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip

Pull futex selftest updates from Borislav Petkov:

 - Correct the version guard for the futex_numa_mpol test to require
   libnuma 2.0.18 instead of 2.0.16, which is the version that actually
   introduced numa_set_mempolicy_home_node() used by the test

 - Allow the futex_numa_mpol selftest to build and run on systems
   without libnuma installed with affected test gracefully being skipped
   instead of failing to compile

 - Use the proper assertion macros so that individual sub-test failures
   are correctly propagated and the test suite reports failure when
   something goes wrong

* tag 'locking_futex_for_v7.1_rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
  selftests/futex: Bump up libnuma version check
  selftests/futex: Conditionally include libnuma support
  selftests/futex: Fix incorrect result reporting of futex_requeue test item
2026-04-15 13:39:23 -07:00
Dave Airlie
ca8639fbb3 amd-drm-next-7.1-2026-04-03:
amdgpu:
 - Audio regression fix
 - Use drm edid parser for AMD VSDB
 - Misc cleanups
 - VCE cs parse fixes
 - VCN cs parse fixes
 - RAS fixes
 - Clean up and unify vram reservation handling
 - GPU Partition updates
 - system_wq cleanups
 - Add CONFIG_GCOV_PROFILE_AMDGPU kconfig option
 - SMU vram copy updates
 - SMU 15 fixes
 - SMU 13 fixes
 - SMU 14 fixes
 - UserQ fixes
 - Replace pasid idr with an xarray
 - Dither handling fix
 - Enable amdgpu by default for CIK APUs
 - Add IBs to devcoredump
 
 amdkfd:
 - system_wq cleanups
 
 radeon:
 - system_wq cleanups
 
 drm:
 - Add support for AMD VSDB parsing to drm_edid
 -----BEGIN PGP SIGNATURE-----
 
 iHUEABYKAB0WIQQgO5Idg2tXNTSZAr293/aFa7yZ2AUCadAzpAAKCRC93/aFa7yZ
 2E+IAP4q10CVBqoiu0fkE1ZLxgfOiJvbJWvkw76/dJsuDQO2zQEAwqzM4AlhtI/E
 wKWQRSJcp7W23mvSXkA3sQAYtZsHtQc=
 =GPy8
 -----END PGP SIGNATURE-----

Merge tag 'amd-drm-next-7.1-2026-04-03' of https://gitlab.freedesktop.org/agd5f/linux into drm-next

amd-drm-next-7.1-2026-04-03:

amdgpu:
- Audio regression fix
- Use drm edid parser for AMD VSDB
- Misc cleanups
- VCE cs parse fixes
- VCN cs parse fixes
- RAS fixes
- Clean up and unify vram reservation handling
- GPU Partition updates
- system_wq cleanups
- Add CONFIG_GCOV_PROFILE_AMDGPU kconfig option
- SMU vram copy updates
- SMU 15 fixes
- SMU 13 fixes
- SMU 14 fixes
- UserQ fixes
- Replace pasid idr with an xarray
- Dither handling fix
- Enable amdgpu by default for CIK APUs
- Add IBs to devcoredump

amdkfd:
- system_wq cleanups

radeon:
- system_wq cleanups

drm:
- Add support for AMD VSDB parsing to drm_edid

Signed-off-by: Dave Airlie <airlied@redhat.com>

From: Alex Deucher <alexander.deucher@amd.com>
Link: https://patch.msgid.link/20260403214329.2976329-1-alexander.deucher@amd.com
2026-04-16 06:30:24 +10:00
Longxuan Yu
326941b228 io_uring/poll: fix signed comparison in io_poll_get_ownership()
io_poll_get_ownership() uses a signed comparison to check whether
poll_refs has reached the threshold for the slowpath:

    if (unlikely(atomic_read(&req->poll_refs) >= IO_POLL_REF_BIAS))

atomic_read() returns int (signed). When IO_POLL_CANCEL_FLAG
(BIT(31)) is set in poll_refs, the value becomes negative in
signed arithmetic, so the >= 128 comparison always evaluates to
false and the slowpath is never taken.

Fix this by casting the atomic_read() result to unsigned int
before the comparison, so that the cancel flag is treated as a
large positive value and correctly triggers the slowpath.

Fixes: a26a35e901 ("io_uring: make poll refs more robust")
Cc: stable@vger.kernel.org
Reported-by: Yifan Wu <yifanwucs@gmail.com>
Reported-by: Juefei Pu <tomapufckgml@gmail.com>
Co-developed-by: Yuan Tan <yuantan098@gmail.com>
Signed-off-by: Yuan Tan <yuantan098@gmail.com>
Suggested-by: Xin Liu <bird@lzu.edu.cn>
Tested-by: Zhengchuan Liang <zcliangcn@gmail.com>
Signed-off-by: Longxuan Yu <ylong030@ucr.edu>
Signed-off-by: Ren Wei <n05ec@lzu.edu.cn>
Reviewed-by: Pavel Begunkov <asml.silence@gmail.com>
Link: https://patch.msgid.link/3a3508b08bcd7f1bc3beff848ae6e1d73d355043.1775965597.git.ylong030@ucr.edu
Signed-off-by: Jens Axboe <axboe@kernel.dk>
2026-04-15 14:07:47 -06:00
Mukesh Ojha
e9cd85a426 dt-bindings: qcom,pdc: document the Hawi Power Domain Controller
Document the Power Domain Controller on the Qualcomm Hawi SoC.

Reviewed-by: Konrad Dybcio <konrad.dybcio@oss.qualcomm.com>
Signed-off-by: Mukesh Ojha <mukesh.ojha@oss.qualcomm.com>
Link: https://patch.msgid.link/20260401125004.592925-1-mukesh.ojha@oss.qualcomm.com
Signed-off-by: Rob Herring (Arm) <robh@kernel.org>
2026-04-15 15:06:12 -05:00
Linus Torvalds
334fbe734e mm.git review status for linus..mm-stable
Everything:
 
 Total patches:       368
 Reviews/patch:       1.56
 Reviewed rate:       74%
 
 Excluding DAMON:
 
 Total patches:       316
 Reviews/patch:       1.77
 Reviewed rate:       81%
 
 Excluding DAMON and zram:
 
 Total patches:       306
 Reviews/patch:       1.81
 Reviewed rate:       82%
 
 Excluding DAMON, zram and maple_tree:
 
 Total patches:       276
 Reviews/patch:       2.01
 Reviewed rate:       91%
 
 Significant patch series in this merge:
 
 - The 30 patch series "maple_tree: Replace big node with maple copy"
   from Liam Howlett is mainly prepararatory work for ongoing development
   but it does reduce stack usage and is an improvement.
 
 - The 12 patch series "mm, swap: swap table phase III: remove swap_map"
   from Kairui Song offers memory savings by removing the static swap_map.
   It also yields some CPU savings and implements several cleanups.
 
 - The 2 patch series "mm: memfd_luo: preserve file seals" from Pratyush
   Yadav adds file seal preservation to LUO's memfd code.
 
 - The 2 patch series "mm: zswap: add per-memcg stat for incompressible
   pages" from Jiayuan Chen adds additional userspace stats reportng to
   zswap.
 
 - The 4 patch series "arch, mm: consolidate empty_zero_page" from Mike
   Rapoport implements some cleanups for our handling of ZERO_PAGE() and
   zero_pfn.
 
 - The 2 patch series "mm/kmemleak: Improve scan_should_stop()
   implementation" from Zhongqiu Han provides an robustness improvement and
   some cleanups in the kmemleak code.
 
 - The 4 patch series "Improve khugepaged scan logic" from Vernon Yang
   "improves the khugepaged scan logic and reduces CPU consumption by
   prioritizing scanning tasks that access memory frequently".
 
 - The 2 patch series "Make KHO Stateless" from Jason Miu simplifies
   Kexec Handover by "transitioning KHO from an xarray-based metadata
   tracking system with serialization to a radix tree data structure that
   can be passed directly to the next kernel"
 
 - The 3 patch series "mm: vmscan: add PID and cgroup ID to vmscan
   tracepoints" from Thomas Ballasi and Steven Rostedt enhances vmscan's
   tracepointing.
 
 - The 5 patch series "mm: arch/shstk: Common shadow stack mapping helper
   and VM_NOHUGEPAGE" from Catalin Marinas is a cleanup for the shadow
   stack code: remove per-arch code in favour of a generic implementation.
 
 - The 2 patch series "Fix KASAN support for KHO restored vmalloc
   regions" from Pasha Tatashin fixes a WARN() which can be emitted the KHO
   restores a vmalloc area.
 
 - The 4 patch series "mm: Remove stray references to pagevec" from Tal
   Zussman provides several cleanups, mainly udpating references to "struct
   pagevec", which became folio_batch three years ago.
 
 - The 17 patch series "mm: Eliminate fake head pages from vmemmap
   optimization" from Kiryl Shutsemau simplifies the HugeTLB vmemmap
   optimization (HVO) by changing how tail pages encode their relationship
   to the head page.
 
 - The 2 patch series "mm/damon/core: improve DAMOS quota efficiency for
   core layer filters" from SeongJae Park improves two problematic
   behaviors of DAMOS that makes it less efficient when core layer filters
   are used.
 
 - The 3 patch series "mm/damon: strictly respect min_nr_regions" from
   SeongJae Park improves DAMON usability by extending the treatment of the
   min_nr_regions user-settable parameter.
 
 - The 3 patch series "mm/page_alloc: pcp locking cleanup" from Vlastimil
   Babka is a proper fix for a previously hotfixed SMP=n issue.  Code
   simplifications and cleanups ennsed.
 
 - The 16 patch series "mm: cleanups around unmapping / zapping" from
   David Hildenbrand implements "a bunch of cleanups around unmapping and
   zapping.  Mostly simplifications, code movements, documentation and
   renaming of zapping functions".
 
 - The 6 patch series "support batched checking of the young flag for
   MGLRU" from Baolin Wang supports batched checking of the young flag for
   MGLRU.  It's part cleanups; one benchmark shows large performance
   benefits for arm64.
 
 - The 5 patch series "memcg: obj stock and slab stat caching cleanups"
   from Johannes Weiner provides memcg cleanup and robustness improvements.
 
 - The 5 patch series "Allow order zero pages in page reporting" from
   Yuvraj Sakshith enhances page_reporting's free page reporting - it is
   presently and undesirably order-0 pages when reporting free memory.
 
 - The 6 patch series "mm: vma flag tweaks" from Lorenzo Stoakes is
   cleanup work following from the recent conversion of the VMA flags to a
   bitmap.
 
 - The 10 patch series "mm/damon: add optional debugging-purpose sanity
   checks" from SeongJae Park adds some more developer-facing debug checks
   into DAMON core.
 
 - The 2 patch series "mm/damon: test and document power-of-2
   min_region_sz requirement" from SeongJae Park adds an additional DAMON
   kunit test and makes some adjustments to the addr_unit parameter
   handling.
 
 - The 3 patch series "mm/damon/core: make passed_sample_intervals
   comparisons overflow-safe" from SeongJae Park fixes a hard-to-hit time
   overflow issue in DAMON core.
 
 - The 7 patch series "mm/damon: improve/fixup/update ratio calculation,
   test and documentation" from SeongJae Park is a "batch of misc/minor
   improvements and fixups" for DAMON.
 
 - The 4 patch series "mm: move vma_(kernel|mmu)_pagesize() out of
   hugetlb.c" from David Hildenbrand fixes a possible issue with dax-device
   when CONFIG_HUGETLB=n.  Some code movement was required.
 
 - The 6 patch series "zram: recompression cleanups and tweaks" from
   Sergey Senozhatsky provides "a somewhat random mix of fixups,
   recompression cleanups and improvements" in the zram code.
 
 - The 11 patch series "mm/damon: support multiple goal-based quota
   tuning algorithms" from SeongJae Park extend DAMOS quotas goal
   auto-tuning to support multiple tuning algorithms that users can select.
 
 - The 4 patch series "mm: thp: reduce unnecessary
   start_stop_khugepaged()" from Breno Leitao fixes the khugpaged sysfs
   handling so we no longer spam the logs with reams of junk when
   starting/stopping khugepaged.
 
 - The 3 patch series "mm: improve map count checks" from Lorenzo Stoakes
   provides some cleanups and slight fixes in the mremap, mmap and vma
   code.
 
 - The 5 patch series "mm/damon: support addr_unit on default monitoring
   targets for modules" from SeongJae Park extends the use of DAMON core's
   addr_unit tunable.
 
 - The 5 patch series "mm: khugepaged cleanups and mTHP prerequisites"
   from Nico Pache provides cleanups in the khugepaged and is a base for
   Nico's planned khugepaged mTHP support.
 
 - The 15 patch series "mm: memory hot(un)plug and SPARSEMEM cleanups"
   from David Hildenbrand implements code movement and cleanups in the
   memhotplug and sparsemem code.
 
 - The 2 patch series "mm: remove CONFIG_ARCH_ENABLE_MEMORY_HOTREMOVE and
   cleanup CONFIG_MIGRATION" from David Hildenbrand rationalizes some
   memhotplug Kconfig support.
 
 - The 6 patch series "change young flag check functions to return bool"
   from Baolin Wang is "a cleanup patchset to change all young flag check
   functions to return bool".
 
 - The 3 patch series "mm/damon/sysfs: fix memory leak and NULL
   dereference issues" from Josh Law and SeongJae Park fixes a few
   potential DAMON bugs.
 
 - The 25 patch series "mm/vma: convert vm_flags_t to vma_flags_t in vma
   code" from "converts a lot of the existing use of the legacy vm_flags_t
   data type to the new vma_flags_t type which replaces it".  Mainly in the
   vma code.
 
 - The 21 patch series "mm: expand mmap_prepare functionality and usage"
   from Lorenzo Stoakes "expands the mmap_prepare functionality, which is
   intended to replace the deprecated f_op->mmap hook which has been the
   source of bugs and security issues for some time".  Cleanups,
   documentation, extension of mmap_prepare into filesystem drivers.
 
 - The 13 patch series "mm/huge_memory: refactor zap_huge_pmd()" from
   Lorenzo Stoakes simplifies and cleans up zap_huge_pmd().  Additional
   cleanups around vm_normal_folio_pmd() and the softleaf functionality are
   performed.
 -----BEGIN PGP SIGNATURE-----
 
 iHUEABYIAB0WIQTTMBEPP41GrTpTJgfdBJ7gKXxAjgUCad3HDQAKCRDdBJ7gKXxA
 jrUQAPwNhPk5nPSxnyxjAeQtOBHqgCdnICeEismLajPKd9aYRgEA0s2XAu3tSUYi
 GrBnWImHG3s4ePQxVcPCegWTsOUrXgQ=
 =1Q7o
 -----END PGP SIGNATURE-----

Merge tag 'mm-stable-2026-04-13-21-45' of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm

Pull MM updates from Andrew Morton:

 - "maple_tree: Replace big node with maple copy" (Liam Howlett)

   Mainly prepararatory work for ongoing development but it does reduce
   stack usage and is an improvement.

 - "mm, swap: swap table phase III: remove swap_map" (Kairui Song)

   Offers memory savings by removing the static swap_map. It also yields
   some CPU savings and implements several cleanups.

 - "mm: memfd_luo: preserve file seals" (Pratyush Yadav)

   File seal preservation to LUO's memfd code

 - "mm: zswap: add per-memcg stat for incompressible pages" (Jiayuan
   Chen)

   Additional userspace stats reportng to zswap

 - "arch, mm: consolidate empty_zero_page" (Mike Rapoport)

   Some cleanups for our handling of ZERO_PAGE() and zero_pfn

 - "mm/kmemleak: Improve scan_should_stop() implementation" (Zhongqiu
   Han)

   A robustness improvement and some cleanups in the kmemleak code

 - "Improve khugepaged scan logic" (Vernon Yang)

   Improve khugepaged scan logic and reduce CPU consumption by
   prioritizing scanning tasks that access memory frequently

 - "Make KHO Stateless" (Jason Miu)

   Simplify Kexec Handover by transitioning KHO from an xarray-based
   metadata tracking system with serialization to a radix tree data
   structure that can be passed directly to the next kernel

 - "mm: vmscan: add PID and cgroup ID to vmscan tracepoints" (Thomas
   Ballasi and Steven Rostedt)

   Enhance vmscan's tracepointing

 - "mm: arch/shstk: Common shadow stack mapping helper and
   VM_NOHUGEPAGE" (Catalin Marinas)

   Cleanup for the shadow stack code: remove per-arch code in favour of
   a generic implementation

 - "Fix KASAN support for KHO restored vmalloc regions" (Pasha Tatashin)

   Fix a WARN() which can be emitted the KHO restores a vmalloc area

 - "mm: Remove stray references to pagevec" (Tal Zussman)

   Several cleanups, mainly udpating references to "struct pagevec",
   which became folio_batch three years ago

 - "mm: Eliminate fake head pages from vmemmap optimization" (Kiryl
   Shutsemau)

   Simplify the HugeTLB vmemmap optimization (HVO) by changing how tail
   pages encode their relationship to the head page

 - "mm/damon/core: improve DAMOS quota efficiency for core layer
   filters" (SeongJae Park)

   Improve two problematic behaviors of DAMOS that makes it less
   efficient when core layer filters are used

 - "mm/damon: strictly respect min_nr_regions" (SeongJae Park)

   Improve DAMON usability by extending the treatment of the
   min_nr_regions user-settable parameter

 - "mm/page_alloc: pcp locking cleanup" (Vlastimil Babka)

   The proper fix for a previously hotfixed SMP=n issue. Code
   simplifications and cleanups ensued

 - "mm: cleanups around unmapping / zapping" (David Hildenbrand)

   A bunch of cleanups around unmapping and zapping. Mostly
   simplifications, code movements, documentation and renaming of
   zapping functions

 - "support batched checking of the young flag for MGLRU" (Baolin Wang)

   Batched checking of the young flag for MGLRU. It's part cleanups; one
   benchmark shows large performance benefits for arm64

 - "memcg: obj stock and slab stat caching cleanups" (Johannes Weiner)

   memcg cleanup and robustness improvements

 - "Allow order zero pages in page reporting" (Yuvraj Sakshith)

   Enhance free page reporting - it is presently and undesirably order-0
   pages when reporting free memory.

 - "mm: vma flag tweaks" (Lorenzo Stoakes)

   Cleanup work following from the recent conversion of the VMA flags to
   a bitmap

 - "mm/damon: add optional debugging-purpose sanity checks" (SeongJae
   Park)

   Add some more developer-facing debug checks into DAMON core

 - "mm/damon: test and document power-of-2 min_region_sz requirement"
   (SeongJae Park)

   An additional DAMON kunit test and makes some adjustments to the
   addr_unit parameter handling

 - "mm/damon/core: make passed_sample_intervals comparisons
   overflow-safe" (SeongJae Park)

   Fix a hard-to-hit time overflow issue in DAMON core

 - "mm/damon: improve/fixup/update ratio calculation, test and
   documentation" (SeongJae Park)

   A batch of misc/minor improvements and fixups for DAMON

 - "mm: move vma_(kernel|mmu)_pagesize() out of hugetlb.c" (David
   Hildenbrand)

   Fix a possible issue with dax-device when CONFIG_HUGETLB=n. Some code
   movement was required.

 - "zram: recompression cleanups and tweaks" (Sergey Senozhatsky)

   A somewhat random mix of fixups, recompression cleanups and
   improvements in the zram code

 - "mm/damon: support multiple goal-based quota tuning algorithms"
   (SeongJae Park)

   Extend DAMOS quotas goal auto-tuning to support multiple tuning
   algorithms that users can select

 - "mm: thp: reduce unnecessary start_stop_khugepaged()" (Breno Leitao)

   Fix the khugpaged sysfs handling so we no longer spam the logs with
   reams of junk when starting/stopping khugepaged

 - "mm: improve map count checks" (Lorenzo Stoakes)

   Provide some cleanups and slight fixes in the mremap, mmap and vma
   code

 - "mm/damon: support addr_unit on default monitoring targets for
   modules" (SeongJae Park)

   Extend the use of DAMON core's addr_unit tunable

 - "mm: khugepaged cleanups and mTHP prerequisites" (Nico Pache)

   Cleanups to khugepaged and is a base for Nico's planned khugepaged
   mTHP support

 - "mm: memory hot(un)plug and SPARSEMEM cleanups" (David Hildenbrand)

   Code movement and cleanups in the memhotplug and sparsemem code

 - "mm: remove CONFIG_ARCH_ENABLE_MEMORY_HOTREMOVE and cleanup
   CONFIG_MIGRATION" (David Hildenbrand)

   Rationalize some memhotplug Kconfig support

 - "change young flag check functions to return bool" (Baolin Wang)

   Cleanups to change all young flag check functions to return bool

 - "mm/damon/sysfs: fix memory leak and NULL dereference issues" (Josh
   Law and SeongJae Park)

   Fix a few potential DAMON bugs

 - "mm/vma: convert vm_flags_t to vma_flags_t in vma code" (Lorenzo
   Stoakes)

   Convert a lot of the existing use of the legacy vm_flags_t data type
   to the new vma_flags_t type which replaces it. Mainly in the vma
   code.

 - "mm: expand mmap_prepare functionality and usage" (Lorenzo Stoakes)

   Expand the mmap_prepare functionality, which is intended to replace
   the deprecated f_op->mmap hook which has been the source of bugs and
   security issues for some time. Cleanups, documentation, extension of
   mmap_prepare into filesystem drivers

 - "mm/huge_memory: refactor zap_huge_pmd()" (Lorenzo Stoakes)

   Simplify and clean up zap_huge_pmd(). Additional cleanups around
   vm_normal_folio_pmd() and the softleaf functionality are performed.

* tag 'mm-stable-2026-04-13-21-45' of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm: (369 commits)
  mm: fix deferred split queue races during migration
  mm/khugepaged: fix issue with tracking lock
  mm/huge_memory: add and use has_deposited_pgtable()
  mm/huge_memory: add and use normal_or_softleaf_folio_pmd()
  mm: add softleaf_is_valid_pmd_entry(), pmd_to_softleaf_folio()
  mm/huge_memory: separate out the folio part of zap_huge_pmd()
  mm/huge_memory: use mm instead of tlb->mm
  mm/huge_memory: remove unnecessary sanity checks
  mm/huge_memory: deduplicate zap deposited table call
  mm/huge_memory: remove unnecessary VM_BUG_ON_PAGE()
  mm/huge_memory: add a common exit path to zap_huge_pmd()
  mm/huge_memory: handle buggy PMD entry in zap_huge_pmd()
  mm/huge_memory: have zap_huge_pmd return a boolean, add kdoc
  mm/huge: avoid big else branch in zap_huge_pmd()
  mm/huge_memory: simplify vma_is_specal_huge()
  mm: on remap assert that input range within the proposed VMA
  mm: add mmap_action_map_kernel_pages[_full]()
  uio: replace deprecated mmap hook with mmap_prepare in uio_info
  drivers: hv: vmbus: replace deprecated mmap hook with mmap_prepare
  mm: allow handling of stacked mmap_prepare hooks in more drivers
  ...
2026-04-15 12:59:16 -07:00
Christoph Hellwig
64b437c4a9 zloop: remove irq-safe locking
All of zloop runs in user context, so drop the irq-safe locking.

Signed-off-by: Christoph Hellwig <hch@lst.de>
Reviewed-by: Damien Le Moal <dlemoal@kernel.org>
Reviewed-by: Johannes Thumshirn <johannes.thumshirn@wdc.com>
Link: https://patch.msgid.link/20260414081811.549755-7-hch@lst.de
Signed-off-by: Jens Axboe <axboe@kernel.dk>
2026-04-15 13:58:37 -06:00
Christoph Hellwig
ec5c045f6c zloop: factor out zloop_mark_{full,empty} helpers
Move a few chunks of duplicated code into helpers.

Signed-off-by: Christoph Hellwig <hch@lst.de>
Reviewed-by: Damien Le Moal <dlemoal@kernel.org>
Reviewed-by: Johannes Thumshirn <johannes.thumshirn@wdc.com>
Link: https://patch.msgid.link/20260414081811.549755-6-hch@lst.de
Signed-off-by: Jens Axboe <axboe@kernel.dk>
2026-04-15 13:58:36 -06:00
Christoph Hellwig
5b680d7afc zloop: set RQF_QUIET when completing requests on deleted devices
Reduce the dmesg spam for tests that involve device deletion.

Signed-off-by: Christoph Hellwig <hch@lst.de>
Reviewed-by: Damien Le Moal <dlemoal@kernel.org>
Reviewed-by: Johannes Thumshirn <johannes.thumshirn@wdc.com>
Link: https://patch.msgid.link/20260414081811.549755-5-hch@lst.de
Signed-off-by: Jens Axboe <axboe@kernel.dk>
2026-04-15 13:58:36 -06:00
Christoph Hellwig
6466b211f7 zloop: improve the unaligned write pointer warning
Use the IS_ALIGNED helper and avoid extra conversions, and tell the
user what the unaligned size is.

Signed-off-by: Christoph Hellwig <hch@lst.de>
Reviewed-by: Damien Le Moal <dlemoal@kernel.org>
Reviewed-by: Johannes Thumshirn <johannes.thumshirn@wdc.com>
Link: https://patch.msgid.link/20260414081811.549755-4-hch@lst.de
Signed-off-by: Jens Axboe <axboe@kernel.dk>
2026-04-15 13:58:36 -06:00
Christoph Hellwig
14e0077911 zloop: use vfs_truncate
While vfs_truncate does various extra checks that we don't really need,
it is always better to use a VFS helper rather than open coding the
logic.

Signed-off-by: Christoph Hellwig <hch@lst.de>
Reviewed-by: Damien Le Moal <dlemoal@kernel.org>
Reviewed-by: Johannes Thumshirn <johannes.thumshirn@wdc.com>
Link: https://patch.msgid.link/20260414081811.549755-3-hch@lst.de
Signed-off-by: Jens Axboe <axboe@kernel.dk>
2026-04-15 13:58:36 -06:00
Christoph Hellwig
32be3c01c3 zloop: fix write pointer calculation in zloop_forget_cache
The write pointer is absolute and in sector units, so we need to
convert it to a relative byte address first.

Fixes: c505448748f7 ("zloop: forget write cache on force removal")
Signed-off-by: Christoph Hellwig <hch@lst.de>
Reviewed-by: Damien Le Moal <dlemoal@kernel.org>
Reviewed-by: Johannes Thumshirn <johannes.thumshirn@wdc.com>
Link: https://patch.msgid.link/20260414081811.549755-2-hch@lst.de
Signed-off-by: Jens Axboe <axboe@kernel.dk>
2026-04-15 13:58:36 -06:00
Kaushlendra Kumar
feffac1874 tools/power/x86: Add SOC slider and platform profile support
Add support for reading and writing SOC slider parameters and
platform profile via sysfs in x86_energy_perf_policy.

New command-line options:
  --soc-slider-balance <value>
  --soc-slider-offset <value>
  --platform-profile <name>

These options allow control of the processor thermal SOC
slider balance and offset through the
processor_thermal_soc_slider module, as well as the
platform profile class interface.

When no update flags are set, the tool now also prints
the current SOC slider and platform profile values
alongside existing MSR output.

Signed-off-by: Kaushlendra Kumar <kaushlendra.kumar@intel.com>
Signed-off-by: Len Brown <len.brown@intel.com>
2026-04-15 15:10:27 -04:00
Alexei Starovoitov
d3fdb3db13 Merge branch 'fix-garbage-data-in-task-local-data'
Amery Hung says:

====================
Fix garbage data in task local data

Hi,

The patchset fixes two scenarios where BPF side task local data API may
see garbage data and adds corresponding selftests.
====================

Link: https://patch.msgid.link/20260413190259.358442-1-ameryhung@gmail.com
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
2026-04-15 12:10:21 -07:00
Amery Hung
b4b0233730 selftests/bpf: Test small task local data allocation
Make sure task local data is working correctly for different allocation
sizes. Existing task local data selftests allocate the maximum amount of
data possible but miss the garbage data issue when only small amount of
data is allocated. Therefore, test small data allocations as well.

Signed-off-by: Amery Hung <ameryhung@gmail.com>
Link: https://lore.kernel.org/r/20260413190259.358442-4-ameryhung@gmail.com
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
2026-04-15 12:10:20 -07:00
Amery Hung
615e55a241 selftests/bpf: Fix tld_get_data() returning garbage data
BPF side tld_get_data() currently may return garbage when tld_data_u is
not aligned to page_size. This can happen when small amount of memory
is allocated for tld_data_u. The misalignment is supposed to be allowed
and the BPF side will use tld_data_u->start to reference the tld_data_u
in a page. However, since "start" is within tld_data_u, there is no way
to know the correct "start" in the first place. As a result, BPF
programs will see garbage data. The selftest did not catch this since
it tries to allocate the maximum amount of data possible (i.e., a page)
such that tld_data_u->start is always correct.

Fix it by moving tld_data_u->start to tld_data_map->start. The original
field is now renamed as unused instead of removing it because BPF side
tld_get_data() views off = 0 returned from tld_fetch_key() as
uninitialized.

Signed-off-by: Amery Hung <ameryhung@gmail.com>
Link: https://lore.kernel.org/r/20260413190259.358442-3-ameryhung@gmail.com
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
2026-04-15 12:10:20 -07:00
Amery Hung
36bf7beb9d selftests/bpf: Prevent allocating data larger than a page
Fix a bug in the task local data library that may allocate more than a
a page for tld_data_u. This may happen when users set a too large
TLD_DYN_DATA_SIZE, so check it when creating dynamic TLD fields and fix
the corresponding selftest.

Signed-off-by: Amery Hung <ameryhung@gmail.com>
Link: https://lore.kernel.org/r/20260413190259.358442-2-ameryhung@gmail.com
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
2026-04-15 12:10:20 -07:00
Alexei Starovoitov
b3dde701e7 Merge branch 'bpf-arm64-riscv-remove-redundant-icache-flush-after-pack-allocator-finalize'
Puranjay Mohan says:

====================
bpf, arm64/riscv: Remove redundant icache flush after pack allocator finalize

Changelog:
v1: https://lore.kernel.org/all/20260413123256.3296452-1-puranjay@kernel.org/
Changes in v2:
- Remove "#include <asm/cacheflush.h>" as it is not needed now.
- Add Acked-by: Song Liu <song@kernel.org>

When the BPF prog pack allocator was added for arm64 and riscv, the
existing bpf_flush_icache() calls were retained after
bpf_jit_binary_pack_finalize(). However, the finalize path copies the
JITed code via architecture text patching routines (__text_poke on arm64,
patch_text_nosync on riscv) that already perform a full
flush_icache_range() internally. The subsequent bpf_flush_icache()
repeats the same cache maintenance on the same range.

Remove the redundant flush and the now-unused bpf_flush_icache()
definitions on both architectures.
====================

Link: https://patch.msgid.link/20260413191111.3426023-1-puranjay@kernel.org
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
2026-04-15 12:09:47 -07:00
Puranjay Mohan
46ee1342b8 bpf, riscv: Remove redundant bpf_flush_icache() after pack allocator finalize
bpf_flush_icache() calls flush_icache_range() to clean the data cache
and invalidate the instruction cache for the JITed code region. However,
since commit 48a8f78c50 ("bpf, riscv: use prog pack allocator in the
BPF JIT"), this flush is redundant.

bpf_jit_binary_pack_finalize() copies the JITed instructions to the ROX
region via bpf_arch_text_copy() -> patch_text_nosync(), and
patch_text_nosync() already calls flush_icache_range() on the written
range. The subsequent bpf_flush_icache() repeats the same cache
maintenance on an overlapping range.

Remove the redundant bpf_flush_icache() call and its now-unused
definition.

Fixes: 48a8f78c50 ("bpf, riscv: use prog pack allocator in the BPF JIT")
Acked-by: Song Liu <song@kernel.org>
Signed-off-by: Puranjay Mohan <puranjay@kernel.org>
Reviewed-by: Pu Lehui <pulehui@huawei.com>
Tested-by: Paul Chaignon <paul.chaignon@gmail.com>
Link: https://lore.kernel.org/r/20260413191111.3426023-3-puranjay@kernel.org
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
2026-04-15 12:09:46 -07:00
Puranjay Mohan
42f18ae530 bpf, arm64: Remove redundant bpf_flush_icache() after pack allocator finalize
bpf_flush_icache() calls flush_icache_range() to clean the data cache
and invalidate the instruction cache for the JITed code region. However,
since commit 1dad391dae ("bpf, arm64: use bpf_prog_pack for memory
management"), this flush is redundant.

bpf_jit_binary_pack_finalize() copies the JITed instructions to the ROX
region via bpf_arch_text_copy() -> aarch64_insn_copy() -> __text_poke(),
and __text_poke() already calls flush_icache_range() on the written
range. The subsequent bpf_flush_icache() repeats the same cache
maintenance on an overlapping range, including an unnecessary second
synchronous IPI to all CPUs via kick_all_cpus_sync().

Remove the redundant bpf_flush_icache() call and its now-unused
definition.

Fixes: 1dad391dae ("bpf, arm64: use bpf_prog_pack for memory management")
Acked-by: Song Liu <song@kernel.org>
Signed-off-by: Puranjay Mohan <puranjay@kernel.org>
Acked-by: Breno Leitao <leitao@debian.org>
Link: https://lore.kernel.org/r/20260413191111.3426023-2-puranjay@kernel.org
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
2026-04-15 12:09:46 -07:00