Various small fixes for multi-socket devices, redundant error prints, a
Kconfig dependency as well as a patch to remove FUSE data as an entropy
source.
-----BEGIN PGP SIGNATURE-----
iQIzBAABCgAdFiEEiOrDCAFJzPfAjcif3SOs138+s6EFAmpvcScACgkQ3SOs138+
s6HPdA/9GJuNIlC5yerd/tZUdgTRUCRLe8XlbfAX9vw3wYcxCEoqu082sr1O9HWV
5y70TKrsxrBE5ugibvL3LOSTQ8jCSnvDuyfBFG0ZwJ7u4EtvW70VG4g6ZUkP+DVy
aPdgJZ1Zft4/d3RsmdfZj+MYDyCQvHP9UYCMEBEJLOj8jAK3PuSQy7KrRDzcovBQ
xSlijqYtenrFZzzt0NdshH+rrGtLHrzJXB5itMi//zRLoDCz7AGDSwKJ2NWm+fXU
o6bn1OZRC9TtNocOfKTKzrsUPGjfezhtG8+SKFscOZO6Wqjvth7TwFJ03HNynq2I
5A28x4tNYmuU0+kv5YrvLgZ6PHLbL+gmid4G6GwZtggOJEewvOBih6sNHesVUyAT
QlCol2PonGi9SHMn5N+dU22UZipZe4JF/uoxWRKFzGXPIjkPnvRJVQpKYqmO1Tyw
c3f+TGF4JMGP/z/w3vxT0WgYqQ8ZHwhQdDOwfVX3q/w7Nurn6esBMtO5M0f+As4+
IQxh+/KZ4p8Y250q8M6IWVBy9X+8gCoGcQzw3NIPAhvj3nor+8LG8TecmxzdZcbR
shBuN6OUXTBGvXHMiaEX1QGED1Am/u1Sb1W43HWayh9XOXQZmLE8kOAkMwiSlvzv
u/4euYCvnOYtw/RpSz+a/aUSrZfVs3/5taBc2AssZ3E8WBmEr70=
=2BEF
-----END PGP SIGNATURE-----
gpgsig -----BEGIN PGP SIGNATURE-----
iQIzBAABCgAdFiEEo6/YBQwIrVS28WGKmmx57+YAGNkFAmpyQmoACgkQmmx57+YA
GNnu/BAAnxdcYeZcENwvkDr7aFtxnmEhdIWly5N2zSMFRRFXVgdVqUiSeKcpiNk8
VV7/ye94Q4sp3oj/DluXJkK3/Ma57rMG/WeXHShtFRalQUc12v7OfD0BgGAieNYW
Vqg2ZgR25FcMhXDE2+g4LrkinWMQC/o/csyVaLQXxWDQL4EqSzAcqQ5yRn3JL3x5
Qs4Zd5aZbcRcpDFzXt1tefAKO2LSXrQM/pOuUo4Yf5ZcnfehAILmQYAR066TV2u3
plOLabOeXNSsYjHhUobLY6OIy5817OWRXgh+khRVAXjf90HX4Y+I68RjlgC/QCWQ
A9XwdxLM1CDDs95m166nTechcI05DysRXdvqTEfRpnNxk08gc6zXYrcvSzWd/kcn
HxdPmsWgZ5Hk4/ikmJPBx8U7UvDwnoBWFSaP1Hv4ZmIk60tLH4JdXRUGivewZnIB
J9g0AbY2IzHI4wJdLrNvgd8xcufr/3SvgX34hT2n1UOnmlbC8uYrzNx9TN8HiZIQ
CFQZzYc8FFWlzE24y0rvGOgQa+Jbj6Vq5+9q3UEslcOZfkEGZYjN+TkL4HLruuL4
8tRRA94fWCa+aE7QZ3l/8OnFsYjHcR46ufjyS0BLxfvx/usaIXyJuaW/tMP2dcbX
2FKi4ZsANBXt+oIz3C5NZu+bexDo3J13PzjYJNyGsH+9Xq32v7Q=
=+3bz
-----END PGP SIGNATURE-----
Merge tag 'tegra-for-7.3-soc' of git://git.kernel.org/pub/scm/linux/kernel/git/tegra/linux into soc/drivers
soc/tegra: Changes for v7.3-rc1
Various small fixes for multi-socket devices, redundant error prints, a
Kconfig dependency as well as a patch to remove FUSE data as an entropy
source.
* tag 'tegra-for-7.3-soc' of git://git.kernel.org/pub/scm/linux/kernel/git/tegra/linux:
soc/tegra: Add PM dependency to SOC_TEGRA_PMC Kconfig
soc/tegra: fuse: Use device-specific instance in suspend/resume
soc/tegra: fuse: Do not use fuse data as entropy source
soc/tegra: cbb: Remove redundant dev_err()
soc/tegra: pmc: Don't register sys-off handler for multi-socket devices
Signed-off-by: Arnd Bergmann <arnd@arndb.de>
kconfiglint reports:
K006: config SOC_TEGRA_PMC selects PM_GENERIC_DOMAINS which depends on PM,
but SOC_TEGRA_PMC does not depend on PM
SOC_TEGRA_PMC is an internal bool symbol (no prompt) that is selected by
ARCH_TEGRA_*_SOC options to enable the Power Management Controller driver.
It was originally introduced in commit 5e7d4c6529 ("soc/tegra: Implement
Tegra186 PMC support") as a bare `bool` with no
selects of its own.
Over time, additional selects were added:
- Commit 5098e2b95e ("soc/tegra: pmc: Select GENERIC_PINCONF") added
select GENERIC_PINCONF
- Commit 28dbe82310 ("soc/tegra: pmc: Select IRQ_DOMAIN_HIERARCHY") added
select IRQ_DOMAIN_HIERARCHY
- Commit f880ee9e96 ("soc/tegra: pmc: Add core power domain") added select PM_OPP and select PM_GENERIC_DOMAINS to
support core power domain voltage scaling
PM_GENERIC_DOMAINS is defined in kernel/power/Kconfig as:
config PM_GENERIC_DOMAINS
bool
depends on PM
When commit f880ee9e96 ("soc/tegra: pmc: Add core power domain") added
the select, it did not add a corresponding `depends on PM` to
SOC_TEGRA_PMC. This was not a functional problem because all callers of
SOC_TEGRA_PMC are inside `if ARCH_TEGRA` blocks, and both the ARM32
definition (arch/arm/mach-tegra/Kconfig) and the ARM64 definition
(arch/arm64/Kconfig.platforms) of ARCH_TEGRA select PM. Thus PM is always
enabled when SOC_TEGRA_PMC is selected in practice.
However, the dependency chain is implicit rather than explicit. Add
`depends on PM` to SOC_TEGRA_PMC to make the requirement explicit and
prevent a theoretical misconfiguration if SOC_TEGRA_PMC were ever selected
outside the ARCH_TEGRA context.
Assisted-by: Claude:claude-opus-4-6 kconfiglint
Signed-off-by: Sasha Levin <sashal@kernel.org>
Signed-off-by: Thierry Reding <treding@nvidia.com>
Avoid using the default fuse instance in suspend/resume callbacks, as it
always runs the suspend/resume callbacks for the default instance rather
than the device’s own.
Get the correct fuse instance by using `dev_get_drvdata()`.
Signed-off-by: Kartik Rajput <kkartik@nvidia.com>
Signed-off-by: Thierry Reding <treding@nvidia.com>
Fuse values are static and device-unique but not secret. Using them as an
entropy source weakens the overall randomness pool because the data is
constant and externally observable over the device’s lifetime.
Stop feeding fuse data into the kernel’s randomness subsystem.
Signed-off-by: Kartik Rajput <kkartik@nvidia.com>
Signed-off-by: Thierry Reding <treding@nvidia.com>
This adds a fix for a missing error check in mtk-socinfo, and
also a missing MODULE_DEVICE_TABLE() in the mtk-dvfsrc driver.
Besides from that, this also reworks how the MMSYS tables are
specified with the macro, separating the component's hardware
instance from the actual type, resolving a prerequirement for
the restructuring of mediatek-drm.
-----BEGIN PGP SIGNATURE-----
iLoEABYKAGIWIQQn3Xxr56ypAcSHzXSaNgTPrZeEeAUCamsBiRsUgAAAAAAEAA5t
YW51MiwyLjUrMS4xMiwyLDIoHGFuZ2Vsb2dpb2FjY2hpbm8uZGVscmVnbm9AY29s
bGFib3JhLmNvbQAKCRCaNgTPrZeEeFUuAQCcdpIBGxycSOIoG5uxijcx8w7uhmf9
FJMPm4LiDF5LgwD/bn2CqDMCrkNQysoErQkhVlOczLbKJSQ69QGFuSGLlwo=
=TyOH
-----END PGP SIGNATURE-----
gpgsig -----BEGIN PGP SIGNATURE-----
iQIzBAABCgAdFiEEo6/YBQwIrVS28WGKmmx57+YAGNkFAmprF7wACgkQmmx57+YA
GNnb0BAAg54DnXer5nJLPZyqfKbgscGZbVLFW2X9k/Cx1utJpVW4ozxRCUTK4sb4
15t+wUOSsdzj1ZIYCccZR3QtqBxbPRnLECHeP/tEqf0+4Qu0jOaYXIstIVsrInkr
zDtXFReq0D+2V8Nf46gw7zi65q2xZUbNSeJTUgy3s5miOaB0w1/as6c97SJzzZgU
DqLEmo/gi74+k3PfYcgLiJJXJSYba8qtGUorrJbXvil+wWPbcDIpokpt7V/ktGjE
jVBdtHNR0IhpMZUjK/4CUi2EgQHpnGeSLN0je3O9PfdUVcIvauwd2Fy5RUSfOk8x
Hs877b4OcJry+fAS1Hw+/v2f1nlMyMcfuPll+8GHkP11c511M55o3zbYR0RKlrtz
DT12QiSTHyLir+4fdTyh808hBJw8B2CPt59AtHbTT1YNAFfqOmo/5EmYlCOIiFNk
WRYz7lQRLY2ElOgUQAtmAS4LiPg7aen0bICIggFdK68abdUfon7oSanxkYxEL1By
0+/fQMbOlotlJar5cyi5l1/bKshs8IIm/+aLXFsqtIBZHbKXo6Z9NXM3HDXOj1oK
II+sfmw8GxfmGVQbLUCns3J4IlVUqndw10Bad8u2djLruWeL9AgfkRQZqOTEi1B2
4BL6aB4H9Co0amwb1mPUFh7atfLgqaQkf623Lis6i+hqR5+4cGc=
=Ew69
-----END PGP SIGNATURE-----
Merge tag 'mtk-soc-for-v7.3' of https://git.kernel.org/pub/scm/linux/kernel/git/mediatek/linux into soc/drivers
MediaTek SoC driver updates
This adds a fix for a missing error check in mtk-socinfo, and
also a missing MODULE_DEVICE_TABLE() in the mtk-dvfsrc driver.
Besides from that, this also reworks how the MMSYS tables are
specified with the macro, separating the component's hardware
instance from the actual type, resolving a prerequirement for
the restructuring of mediatek-drm.
* tag 'mtk-soc-for-v7.3' of https://git.kernel.org/pub/scm/linux/kernel/git/mediatek/linux:
soc: mediatek: add missing MODULE_DEVICE_TABLE()
soc: mediatek: mtk-mmsys: Use MMSYS_ROUTE() in default routing table
soc: mediatek: mtk-mmsys: Rework routes to specify component ID
soc: mediatek: mtk-socinfo Add error handling in devm_kasprintf()
Signed-off-by: Arnd Bergmann <arnd@arndb.de>
The driver has an OF match table wired to .of_match_table, but does
not export the table with MODULE_DEVICE_TABLE().
Add the missing MODULE_DEVICE_TABLE(of, ...) entry so module alias
information is generated for OF based module autoloading.
This is a source-level fix. It does not claim dynamic hardware
reproduction; the evidence is the driver-owned match table, its use by
the platform driver, and the missing module alias publication.
Signed-off-by: Pengpeng Hou <pengpeng@iscas.ac.cn>
Signed-off-by: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com>
All of the mtk_mmsys_routes tables for all SoCs were converted to
use the MMSYS_ROUTE() macro but the default one used for MT2701,
MT2712 and SoCs from that generation was not: convert this one as
well.
This brings no functional change.
Signed-off-by: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com>
In preparation for a refactoring of multimedia related MediaTek
drivers, including mmsys, mutex and mediatek-drm, rework all of
the MMSYS routes to specify a hardware component instance number
(or "SubID") alongside the hardware component type.
This also is one step of preparation towards the removal of the
catch-all mtk_ddp_comp_id enumeration and towards the migration
from a predefined-coupling static hardware component IDSubID
mapping (carrying around a very long enumeration and also some
multiple big arrays in mediatek-drm) to a more flexible map of
Component ID (Type) decoupled from Component SubID (HW Instance)
as then, anyway, techniques to handle components are always the
same on a type basis.
Signed-off-by: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com>
1. Fix very old leak of OF node in PMU driver.
2. Few cleanups and new bindings for ExynosAutov920 HSI0 syscon.
-----BEGIN PGP SIGNATURE-----
iQJEBAABCgAuFiEE3dJiKD0RGyM7briowTdm5oaLg9cFAmpnqlgQHGtyemtAa2Vy
bmVsLm9yZwAKCRDBN2bmhouD1+MtD/9M66W36D7KaI9tnHLxVO+2h+VZV73Q9+jI
Siy6LaytoSX9Zz3jYYeLT8AFCm2ykbydGfIWOBw8lWKrc5tSlQhE/zFrl8fcigr6
7xvHbHPoUa/cv8yxDn0v0JPQtnbKyRz6+vNuYPSTGFsLCqavMEPlq3PGNz43j5rG
6TgbpE2HC1K0fhuYMkootj/O4QLVN0RbUbAjYmdbxY35/z5pPq/5lAvOZU9GdI9d
l+rICXNJy9ZMPw9u5HR8IEDiV9dH+Znwk7jkGxIzyDpSxi4FW9jrfui124aqFDCU
qc97cBzYZ1mf7FK1zkfT3KRZ/TaAxl49kxbOB4WzOxDDtZ866ciSN2OGtvMmFlzd
5jnHj7b7hnm5L1U59GPDZD940qNFydK/2cgS1x4bc0aPsT324NxV/m0TuzIro91Z
xwbllGGfHmEC5Rl1WthrrXZPBTkM23KJAdvA9d4M/yPv6tEMJsAkqwKcoiV+wPeQ
hhtuyH2bCw+UZZ7rxN0gAuT8hdj1bexuminZilixCBAZkNymV9njiueipNEL9Hb0
2bfTKE84plPjjQ8ijgoAZ/Sefv/6at51gEwYjWZnX66huzkp3w8pXj2MhkG7lgmv
DC5hWpOU/kFNCamePeQUeJ9hwbdPCy13NDkjmuh0s6Ouzy9DpuIxCmE4U8cID5MQ
x+Rh4YbWPQ==
=xeyD
-----END PGP SIGNATURE-----
gpgsig -----BEGIN PGP SIGNATURE-----
iQIzBAABCgAdFiEEo6/YBQwIrVS28WGKmmx57+YAGNkFAmpqFiQACgkQmmx57+YA
GNlYKw/+KxY6PubRpNhKHivaGqFBFgD+GlPaJNRMkFgXYIiUz6CDwnFK0v9XozOr
UfwrfIDGBvdq0XrNJmiRPW68A4PhGV9MP7Tq3iwEFr/hjRCgjylGNe92znzTIHat
oJtB96EdAPd+Dgr5vuZ923yA9t3zGf1Ns5YqlLos7xGWDBzXuAKmQVbf7j7exLg5
FwjabWAwHsf3le13WYsEY4TleqHMYuspLnsIVSQXJwiX4Ex67ndKcwQdIECY7eYs
y7790ofY67mBa2y+JRiybCMCk6KbgBxtbDb1jL/GJ8zde4mpoX7hdJ8u6hMIdOMJ
5lpHL0m31nuKyzIsBAAKcdKJviNL09d8yy+RzU1/DT84kVxz6eFsxfj+NR6inHKE
ZsBZS7oJRoRpMxCLxvnE44PVFCnCuv517CqvDfvEyCMx2pKmUl3C2O1CgE5mIK2n
FqgbuTy4rQLw7pKR3HF+qEyhyHYiuARWftVuXPWf8NHCPNSb37x50HjC4FYJPcOq
rP9fKAlqxHd4CQ0WlUx1J0mmp5USmYj9xbc2aUS/g1bJ1GaWfSuT/a7wZuI57769
HIc2Mqv9G+3LaEd2UNCods7QXW3zZTK80qm8WyEm4PddSX/9K6R/gzCzl0CwMfCe
/qFewzZTL9SJ4F3MRiefc897g7+JMtrg5+xNbZyIInUGJQsR3sA=
=rMXV
-----END PGP SIGNATURE-----
Merge tag 'samsung-drivers-7.3' of https://git.kernel.org/pub/scm/linux/kernel/git/krzk/linux into soc/drivers
Samsung SoC drivers for v7.3
1. Fix very old leak of OF node in PMU driver.
2. Few cleanups and new bindings for ExynosAutov920 HSI0 syscon.
* tag 'samsung-drivers-7.3' of https://git.kernel.org/pub/scm/linux/kernel/git/krzk/linux:
dt-bindings: samsung: exynos-pmu: Narrow allowed reboot modes
dt-bindings: samsung: exynos-pmu: Restrict children with unevaluatedProperties
dt-bindings: soc: samsung: exynos-sysreg: Add hsi0 for ExynosAutov920
soc: samsung: exynos-pmu: fix of_node refcount leak in exynos_get_pmu_regmap()
Signed-off-by: Arnd Bergmann <arnd@arndb.de>
1. Few improvements: STM32 OMM, Tegra MC and JZ4780-nemc.
2. Refactor Tegra MC interconnect code to better represent actual
hardware in multi-socket NUMA cases.
-----BEGIN PGP SIGNATURE-----
iQJEBAABCgAuFiEE3dJiKD0RGyM7briowTdm5oaLg9cFAmpnrDcQHGtyemtAa2Vy
bmVsLm9yZwAKCRDBN2bmhouD1xaMD/wPkFz7Vj8UDRDbMVjdk0VoYmawxFc83r0P
kwdrp7OxSwH7Js+HANgs8zYFYbIRSVFkkHyAi5aekTaXBzXohwdtiW4t3qHynmtX
wBvAF4xZLxLsII+OZU8wbTJw6ZWJscM6AloW1TZPVOiOJ6m7kKBztMkl7US/hwKR
3hbCMT5zXRz/MCniq1cH3hT3KUQLopcT6vclJrz+kaHfoQN6T6TE23teaciKOYUB
tvjQk1eWZ7gRUdqnvflZHTuSyx+VvVxrukIy8d7IljEGEsWDSoQmxfrNTCwRZwrB
OIqVj6+ZhygJKpb/LdxCNjvZqUCiaCr6vlMMhkQ08HHS+EW3tmqkCJuwkoODr2G0
l+EhL24rBJeIQGstRhNV43q4YstCZB5u0ZO7ixxFxdZ74PYDFFLlbxJZ/wyPLaYf
jala4+STTOyuy13eCf90OUPosgPWFGJyb2ouJlZJuquJv4XBzNF/ukguEMDLS0S8
JDOL9WIHIwNd7d2bDwbTS3zL5qvwhFpa2Z2LfjARnLXiZjClzhIR+HCe+lmLSSvr
4sANn7m1ouwKBtBO+WqLgf7tvEY+v5TVwNCHiIsI6t4yxetCp/HUN+1sHiD4hOs0
40IMvl3wM89ET0fLo1VWoN5lC06n0bdREsgstL2AFHcRAnHBaFcldtR3jW8AsyFh
hXvNH/iFdw==
=s70S
-----END PGP SIGNATURE-----
gpgsig -----BEGIN PGP SIGNATURE-----
iQIzBAABCgAdFiEEo6/YBQwIrVS28WGKmmx57+YAGNkFAmpqFI4ACgkQmmx57+YA
GNmmRw//WkrjLuFY7GzUoqxrYJe4glU14C956miHhS45Nio+NUN2Aa8ArymsPyl4
vukxkI9Ej6oQGZI5m8CLHDPP7W7yUJ+z3JzCly1QuxkGD7wSUd6/ih7WfWWAPDfD
xUbuk3/h0wal6apCpCUaWEczfn68FTr33fVd24S4VdwA18nYnabXDI/0XXgItg7F
956KUPt7FxOm6XmQB6xrCW4ry2hm2gwo+isMxjDGoIQXaQWPhi6A2ahvpm8ECFvI
bQx8vJZKHz6P9erhPLMxtkTcghaVg2i8aUqQR7cOtGYLkL45XlyNoyRH3FaL34Mg
7neHNg4H/tynyWFt9WEARdpsunJySeUuYpZ5+po5DUXuMUlz0vS2FeOsJ05ocnpR
KRSblMjflHtwYJ4NbCSf8c10TF8bp8Os8JN7wGG7fI9cXbM3/Ih+bWRF275VQuIX
Ko6qCvv4UzcndseAb1NFIYnrKHhaNGb1TmP7bQA59BB43DSrjaUTug99+UVd2HXa
bnMrtxIsu8pRB7mmaiCMtqyoeH+dt8vb/7JGyf6x4Xyqgnme0kAQatMGwqKLXM3y
G06IJqTsbO++xlrkZy0hHriRTFQRC2wIKYd6jqoZ8XZg7k8KvVQYjLoLcDyIqhBc
2vuNtFSBOPiLPLPkA4aYJVwQsuTyfuQBH2LNBy4pOkoU0g+IxyE=
=YFm3
-----END PGP SIGNATURE-----
Merge tag 'memory-controller-drv-7.3' of https://git.kernel.org/pub/scm/linux/kernel/git/krzk/linux-mem-ctrl into soc/drivers
Memory controller drivers for v7.3
1. Few improvements: STM32 OMM, Tegra MC and JZ4780-nemc.
2. Refactor Tegra MC interconnect code to better represent actual
hardware in multi-socket NUMA cases.
* tag 'memory-controller-drv-7.3' of https://git.kernel.org/pub/scm/linux/kernel/git/krzk/linux-mem-ctrl:
memory: jz4780-nemc: Use dev_err_probe() for clock error
memory: tegra: Guard against NULL mc_regs in IRQ handler
memory: tegra: add multi-socket support to the memory interconnect
memory: stm32_omm: initialize ret in stm32_omm_set_amcr
Signed-off-by: Arnd Bergmann <arnd@arndb.de>
A collection of SCMI core and transport fixes addressing resource
lifetimes, teardown races and error handling. Most of these issues
are reported by Sashiko as existing issues while reviewing new feature
additions to SCMI.
The changes:
- publish channel state before mailbox and SMC callbacks can run,
- quiesce notification work before tearing down transport channels,
- fix partial channel setup and mailbox allocation cleanup,
- make IDR iteration and shared-channel teardown safe,
- correct SCMI device, OF node, handle, bus ID and SystemPower lifetimes;,
- harden requested-device registration and removal against races and
partial failures,
- reject out-of-range DT protocol IDs, and
- simplify notification allocations using flexible arrays.
-----BEGIN PGP SIGNATURE-----
iQIzBAABCAAdFiEEunHlEgbzHrJD3ZPhAEG6vDF+4pgFAmpjMg8ACgkQAEG6vDF+
4pg3Kw/+N09f4Zd1c8xwQi5NEfwv8uEKRE73VSAL18aNn89mGj6J1cGOs1NWHJ0b
bKDOuhoJWYynHDGbaZGFVLhh3l2Jj2yE+Hr9sq2nOHktA7HFqSVV5ea8RuRD/XHt
3rNIX6UBLSEp7N40ehkwD506zr3eRcfwtUwS8taEvl0NWNKrPJ+TpMxN3LBGWzBq
oXaD7642Mb9rDyApuwOGWlHitDPU1qQv5JrLLWP8/Nx4PQlb1TX6171FXvrMdjdx
qKUiUBZM9Q9w4gaKgnIEcq0KCBWdxa5ZKPupZTUzt60NEpkemjYcmjxoJFDIArGC
013Z/dXhynkigaEjfvWPhoNaoLx1Q3NTk5ChljaKLizI6sE0N02wuax8rHIuKSnL
fhbyNcpmsEgiVwnX4zw6l44AakWHx8qkE3avtx0yks+joAWt8ERzIHCd+uWF1z15
b18humBSxcs3DmmejH8JMMCTpL7OxI3PHtdntttXWpvM43/pZnO6vF23Nfo0KQ3q
ZrOD15W4qQ8M9nGKmpaa6f6tDPoWuULLcMhMHZo3FLdOYa5lnGtAs1Rj7MvJ5I0b
u8/t4P2hoCskSVN973P51ZA3r1NI9ZK+uZ3Krq9TFEvgI5ZZQTfDoz6Zc4q9/ERV
80k8/wRP8vCjBM2mQ+WVlWG1gJEq487t6bBPfQVeHmS+/BI0g+s=
=w04g
-----END PGP SIGNATURE-----
gpgsig -----BEGIN PGP SIGNATURE-----
iQIzBAABCgAdFiEEo6/YBQwIrVS28WGKmmx57+YAGNkFAmpjjIsACgkQmmx57+YA
GNmWgQ//e5oKyKC8Ac6vcjbRbwb6joIX0u0N8slFoKi3rano2Hb0e0TOLSywjCq8
w2G/n5tBjZKfp9RSqSWY0lZHjZhyyokosiSldtr8rX6v0LLQurHIPHakFHI0uW1h
1iquU37P+TJ8C/EcBHcG/3jrvMGPO2PFln7+XVNE2eG2Q79E26NcU9sNoLJeBTlt
AZrwpJ9jnUnay+zbc5jtqxqN50cam5I+lNNu+sZmDd67rN+wOUX68yn8vE6Buk+5
li1Ni0W6sKTbMchx+G56ibqnvTcLnouD5wvSNcgJOVycYsykzMB6pSKgqnUGqBTu
uHtvRJ1/Nzp+iQqdiGnzGw4x4bB7tackKIQtOww2wUYuE9KY+OCmnieS3hPpg/Od
kRBHrxaZ6fyfb++Mw+Ze5gwFEwhQDI0UgGAqu7DsSAuWefcCdPTo4ia9G+HGS1ID
80SNS/GdUmtLdCfsVIqOtvOY2TKwgfsqBWgimyF2apl3nQgbAUkjUlLTUTIFbhXo
em2oi6yLQVvte3HGc5r9NbmBnO3KRYIXYRU+t73bOBYeAKNdIPsA357dcrx/5MnN
eGli+DrKk/oC1zrvl9OjpAcD83enZ76EPHKRav8zGAnYQ1sLS+GweJsbSg9Yj4Dq
XbJGb8LM7mCFefrDvZKOVSWy5DMazHiofguPBOSgEnqASdp+Ydo=
=JO1v
-----END PGP SIGNATURE-----
Merge tag 'scmi-updates-7.3' of https://git.kernel.org/pub/scm/linux/kernel/git/sudeep.holla/linux into soc/drivers
Arm SCMI updates/fixes for v7.3
A collection of SCMI core and transport fixes addressing resource
lifetimes, teardown races and error handling. Most of these issues
are reported by Sashiko as existing issues while reviewing new feature
additions to SCMI.
The changes:
- publish channel state before mailbox and SMC callbacks can run,
- quiesce notification work before tearing down transport channels,
- fix partial channel setup and mailbox allocation cleanup,
- make IDR iteration and shared-channel teardown safe,
- correct SCMI device, OF node, handle, bus ID and SystemPower lifetimes;,
- harden requested-device registration and removal against races and
partial failures,
- reject out-of-range DT protocol IDs, and
- simplify notification allocations using flexible arrays.
* tag 'scmi-updates-7.3' of https://git.kernel.org/pub/scm/linux/kernel/git/sudeep.holla/linux: (25 commits)
firmware: arm_scmi: Unrequest devices if driver registration fails
firmware: arm_scmi: Roll back partial protocol table registration
firmware: arm_scmi: Fix requested device removal race
firmware: arm_scmi: Fix transport device teardown lookup
firmware: arm_scmi: Fix SCMI device destroy lifetimes
firmware: arm_scmi: Unwind P2A receiver mailbox setup failure
firmware: arm_scmi: Unwind TX receiver mailbox setup failure
firmware: arm_scmi: Fix OF node reference handling
firmware: arm_scmi: Clear SystemPower flag on create failure
firmware: arm_scmi: Drop handle on protocol bind failures
firmware: arm_scmi: Protect device request lookup with RCU
firmware: arm_scmi: Use channel ID for transport teardown
firmware: arm_scmi: Reject out of range DT protocol IDs
firmware: arm_scmi: Avoid IDR updates while cleaning channels
firmware: arm_scmi: Free transport channel on IDR failure
firmware: arm_scmi: Clean up channels on setup failure
firmware: arm_scmi: Quiesce notifications before teardown
firmware: arm_scmi: Unregister device notifier before IDR teardown
firmware: arm_scmi: Publish channel state before callbacks
firmware: arm_scmi: Simplify notification allocations
...
Signed-off-by: Arnd Bergmann <arnd@arndb.de>
The driver has an OF match table wired to .of_match_table, but does
not export the table with MODULE_DEVICE_TABLE().
Add the missing MODULE_DEVICE_TABLE(of, ...) entry so module alias
information is generated for OF based module autoloading.
This is a source-level fix. It does not claim dynamic hardware
reproduction; the evidence is the driver-owned match table, its use by
the platform driver, and the missing module alias publication.
Signed-off-by: Pengpeng Hou <pengpeng@iscas.ac.cn>
Message-ID: <20260704122324.80274-1-pengpeng@iscas.ac.cn>
Signed-off-by: Linus Walleij <linusw@kernel.org>
The driver has an OF match table wired to .of_match_table, but does
not export the table with MODULE_DEVICE_TABLE().
Add the missing MODULE_DEVICE_TABLE(of, ...) entry so module alias
information is generated for OF based module autoloading.
This is a source-level fix. It does not claim dynamic hardware
reproduction; the evidence is the driver-owned match table, its use by
the platform driver, and the missing module alias publication.
Signed-off-by: Pengpeng Hou <pengpeng@iscas.ac.cn>
Message-ID: <20260704121851.63805-1-pengpeng@iscas.ac.cn>
Signed-off-by: Linus Walleij <linusw@kernel.org>
scmi_driver_register() requests protocol devices before registering the
driver. If driver_register() fails, those requests remain in the global
IDR and retain pointers to the module's ID table. Once the failed module
load releases that storage, later request matching or SCMI device creation
can dereference the stale pointers.
Unrequest the complete protocol table before returning the registration
failure. At this point table registration succeeded, so every entry is
owned by the current registration attempt.
Fixes: d3cd7c525f ("firmware: arm_scmi: Refactor protocol device creation")
Reported-by: Sashiko <sashiko-bot@kernel.org>
Link: https://patch.msgid.link/20260722173521.2184378-2-sudeep.holla@kernel.org
Signed-off-by: Sudeep Holla <sudeep.holla@kernel.org>
scmi_protocol_table_register() can leave earlier requests registered when
a later entry in the same ID table fails. Each request retains a pointer
to the driver's ID table, so a failed module load can leave a dangling
pointer after the module storage is released.
Unrequest only the successfully registered prefix, in reverse order,
before returning the failure. Leave the failed entry and the remaining
entries untouched because matching requests can be owned by another
driver.
Fixes: 2858f6e5f0 ("firmware: arm_scmi: Add multiple protocols registration support")
Reported-by: Sashiko <sashiko-bot@kernel.org>
Link: https://patch.msgid.link/20260722173521.2184378-1-sudeep.holla@kernel.org
Signed-off-by: Sudeep Holla <sudeep.holla@kernel.org>
scmi_protocol_device_unrequest() drops scmi_requested_devices_mtx while
notifying listeners but continues to retain the per-protocol list head.
When two SCMI drivers for the same protocol unregister concurrently, one
thread can remove the final request and free the list head while the other
is running its notifier. The latter then dereferences the freed list head
after reacquiring the mutex and can free it a second time.
Complete the list and IDR updates, including freeing an empty list head,
before dropping the mutex. Keep the blocking notifier outside the critical
section and retain only the detached request across the callback.
Fixes: d3cd7c525f ("firmware: arm_scmi: Refactor protocol device creation")
Reported-by: Sashiko <sashiko-bot@kernel.org>
Link: https://patch.msgid.link/20260722095250.2011630-1-sudeep.holla@kernel.org
Signed-off-by: Sudeep Holla <sudeep.holla@kernel.org>
The kernel does not permit a device to register multiple sys-off
handlers for non-default priority levels. Hence, for multi-socket Tegra
devices, registering the sys-off handler in the Tegra PMC driver (which
uses the low priority level) more than once fails.
The Tegra PMC sys-off handler is supported for all current generations
of the Tegra SoC, however, it is only used as a low priority handler if
everything else fails. For example, on Tegra264 the EFI reboot handler
is called to restart the device. Therefore, for multi-socket devices,
skip the registering of the sys-off handler to because this is not
critical.
Signed-off-by: Jon Hunter <jonathanh@nvidia.com>
Signed-off-by: Thierry Reding <treding@nvidia.com>
SCMI transport devices are deliberately excluded from normal SCMI bus
matching so protocol drivers cannot bind to the internal transport
children. However, scmi_device_destroy() uses the same protocol/name
lookup to find devices that must be unregistered during channel teardown.
Split the match helper so driver matching still skips transport devices,
while explicit child lookup can find them for teardown. Use a shared
transport-device name prefix macro for both matching and name generation.
Since transport-device names are derived from direction and protocol ID,
reject duplicate protocol channel setup before creating or finding a
transport device. This prevents malformed firmware with duplicate
protocol child nodes from reusing an existing transport device and then
destroying it when the duplicate IDR insertion fails.
Fixes: 9593804c44 ("firmware: arm_scmi: Exclude transport devices from bus matching")
Reported-by: Sashiko <sashiko-bot@kernel.org>
Link: https://patch.msgid.link/20260714-scmi_core_fixes-v6-16-3afe499d46e3@kernel.org
Signed-off-by: Sudeep Holla <sudeep.holla@kernel.org>
scmi_child_dev_find() drops the reference returned by
device_find_child() before returning the scmi_device pointer. A
concurrent unregister can then release the device while the destroy path
is still using the returned pointer.
Make the lookup helper return the device_find_child() reference and keep
it until scmi_device_destroy() has finished unregistering the child.
Also split device_unregister() in __scmi_device_destroy() so the SCMI bus
ID is not made reusable until after device_del() has removed the old
scmi_dev.N name from sysfs. This avoids a new SCMI device reusing the
same ID while the old device is still registered.
The final device release callback is also a possible cleanup path when
SCMI children are deleted by driver core recursion rather than
__scmi_device_destroy(). Release the SCMI bus ID from a common helper
used by destroy, register-failure and final-release paths, and clear
scmi_dev->id after freeing it so the final release cannot free the same
ID again.
Fixes: 9ca67840c0 ("firmware: arm_scmi: Balance device refcount when destroying devices")
Reported-by: Sashiko <sashiko-bot@kernel.org>
Link: https://patch.msgid.link/20260714-scmi_core_fixes-v6-15-3afe499d46e3@kernel.org
Signed-off-by: Sudeep Holla <sudeep.holla@kernel.org>
mailbox_chan_setup() can request an additional P2A receiver channel after
successfully acquiring the primary P2A channel. If that later request
fails, the function returns immediately and leaves the primary channel
allocated.
Unwind the primary mailbox channel before returning the error so probe
deferral or other setup failures do not leave the channel busy for later
probe attempts.
Fixes: fa8b28ba22 ("firmware: arm_scmi: Add support for platform to agent channel completion")
Reported-by: Sashiko <sashiko-bot@kernel.org>
Link: https://patch.msgid.link/20260714-scmi_core_fixes-v6-14-3afe499d46e3@kernel.org
Signed-off-by: Sudeep Holla <sudeep.holla@kernel.org>
mailbox_chan_setup() can request an additional unidirectional TX
receiver channel after successfully acquiring the primary channel. If
that second request fails, the function returns immediately and leaves
the primary channel allocated.
Unwind the primary mailbox channel before returning the error so probe
deferral or other setup failures do not leave the channel busy for later
probe attempts.
Fixes: 9f68ff79ec ("firmware: arm_scmi: Add support for unidirectional mailbox channels")
Reported-by: Sashiko <sashiko-bot@kernel.org>
Link: https://patch.msgid.link/20260714-scmi_core_fixes-v6-13-3afe499d46e3@kernel.org
Signed-off-by: Sudeep Holla <sudeep.holla@kernel.org>
SCMI devices store the DT node in dev.of_node through
device_set_node(), but that helper only assigns the fwnode and
of_node pointers without taking an OF node reference.
Take a reference when assigning the node and release it from the
SCMI device release path. With the device owning that reference,
remove the separate channel-side get/put pair from the core driver.
Fixes: 96da4a99ce ("firmware: arm_scmi: Set fwnode for the scmi_device")
Link: https://patch.msgid.link/20260714-scmi_core_fixes-v6-12-3afe499d46e3@kernel.org
Signed-off-by: Sudeep Holla <sudeep.holla@kernel.org>
__scmi_device_create() reserves the singleton SystemPower protocol device
before registering the SCMI device. If any later step fails, a stale
reservation can make a later retry reject SystemPower device creation
permanently, for example after probe deferral.
A plain global boolean is not enough to track the reservation. A delayed
final release of an older SystemPower device could clear the boolean after
a newer device has already claimed it, breaking the singleton guarantee for
the active device.
Track the reservation with the scmi_device pointer itself. Claim it with
cmpxchg(NULL, scmi_dev) after allocating the device object, and release it
with cmpxchg(scmi_dev, NULL) from the common cleanup helper. This lets the
create-failure, explicit destroy and final release paths clear only the
reservation owned by the device being cleaned up.
Fixes: 2c3e674465 ("firmware: arm_scmi: Refactor device create/destroy helpers")
Reported-by: Sashiko <sashiko-bot@kernel.org>
Link: https://patch.msgid.link/20260714-scmi_core_fixes-v6-11-3afe499d46e3@kernel.org
Signed-off-by: Sudeep Holla <sudeep.holla@kernel.org>
The SCMI bus notifier acquires an SCMI handle when the driver core emits
BUS_NOTIFY_BIND_DRIVER, before invoking the protocol driver probe
callback. The protocol probe path only checks whether sdev->handle is
set.
If device_link_add() fails after the handle has been acquired, the
protocol device can still bind with a valid handle but without the
dependency link to the SCMI parent. A concurrent parent unbind can then
miss the child and tear down the SCMI instance while the child still
holds a handle into it.
If the protocol driver probe later fails, for example with
-EPROBE_DEFER, the driver core emits BUS_NOTIFY_DRIVER_NOT_BOUND rather
than BUS_NOTIFY_UNBOUND_DRIVER. The SCMI notifier only released the
handle on BUS_NOTIFY_UNBOUND_DRIVER, so each failed protocol-device bind
leaked the SCMI instance users refcount and left sdev->handle set after
the failed probe.
Make the link helper report failure and drop the acquired handle if the
link cannot be created. Also handle BUS_NOTIFY_DRIVER_NOT_BOUND in the
same cleanup path used for unbind so failed probes balance the earlier
BUS_NOTIFY_BIND_DRIVER acquisition.
Fixes: 971fc0665f ("firmware: arm_scmi: Move handle get/set helpers")
Reported-by: Sashiko <sashiko-bot@kernel.org>
Link: https://patch.msgid.link/20260714-scmi_core_fixes-v6-10-3afe499d46e3@kernel.org
Signed-off-by: Sudeep Holla <sudeep.holla@kernel.org>
The SCMI device request notifier looks up protocol OF nodes from the
active_protocols IDR. The IDR lookup can run concurrently with protocol
activation while probe is still registering protocols and creating their
SCMI devices.
Wrap the lookup in an RCU read-side critical section as required by the
IDR API for lockless readers.
Fixes: 53b8c25df7 ("firmware: arm_scmi: Add common notifier helpers")
Reported-by: Sashiko <sashiko-bot@kernel.org>
Link: https://patch.msgid.link/20260714-scmi_core_fixes-v6-9-3afe499d46e3@kernel.org
Signed-off-by: Sudeep Holla <sudeep.holla@kernel.org>
SCMI protocols can share the BASE transport channel when firmware does
not describe a dedicated channel for the protocol. In that case multiple
IDR entries can point at the same scmi_chan_info, whose owning transport
device was created with cinfo->id.
scmi_chan_destroy() used the IDR iterator key when destroying the
transport device. If an alias entry is visited before the owning channel
entry, the lookup can miss the device because the iterator key does not
match the protocol ID used when the transport device was created. The
code then clears cinfo->dev, so the later owning entry skips teardown and
leaks the transport device.
Destroy the transport device using cinfo->id, which is the protocol ID
that owns the channel and was used when creating the transport device.
Fixes: 05a2801d8b ("firmware: arm_scmi: Use dedicated devices to initialize channels")
Reported-by: Sashiko <sashiko-bot@kernel.org>
Link: https://patch.msgid.link/20260714-scmi_core_fixes-v6-8-3afe499d46e3@kernel.org
Signed-off-by: Sudeep Holla <sudeep.holla@kernel.org>
SCMI protocol IDs carried in message headers are limited by
MSG_PROTOCOL_ID_MASK. The DT parsing paths noticed protocol IDs
outside that range, but only logged an error and then kept processing
the invalid value.
That lets a malformed 32-bit DT reg value reach helpers which take a u8
protocol ID, where it can be truncated and/or treated as a different
protocol.
For channel setup, two different out-of-range values can also be used as
distinct IDR keys while aliasing the generated SCMI protocol identity.
Skip DT protocol nodes whose reg value does not fit the SCMI protocol ID
field before setting up channels or creating protocol devices.
Fixes: 05a2801d8b ("firmware: arm_scmi: Use dedicated devices to initialize channels")
Reported-by: Sashiko <sashiko-bot@kernel.org>
Link: https://patch.msgid.link/20260714-scmi_core_fixes-v6-7-3afe499d46e3@kernel.org
Signed-off-by: Sudeep Holla <sudeep.holla@kernel.org>
scmi_cleanup_channels() walks the TX/RX channel IDRs with
idr_for_each() to free transport resources and destroy the dedicated
transport devices before calling idr_destroy().
The destroy callback removed each entry from the same IDR being walked.
That is not needed for this cleanup path, and it is unsafe because
idr_for_each() has not advanced its radix-tree iterator while the
callback is running. Removing the current entry from the callback can
invalidate the iterator state. The callback also cannot be protected by
rcu_read_lock(), because scmi_device_destroy() may sleep.
Leave IDR teardown to the following idr_destroy() call and keep the
callback limited to device destruction.
Fixes: 05a2801d8b ("firmware: arm_scmi: Use dedicated devices to initialize channels")
Reported-by: Sashiko <sashiko-bot@kernel.org>
Link: https://patch.msgid.link/20260714-scmi_core_fixes-v6-6-3afe499d46e3@kernel.org
Signed-off-by: Sudeep Holla <sudeep.holla@kernel.org>
If transport channel setup succeeds but the following IDR insertion fails,
the error path destroys the transport device and frees the channel info
without invoking the transport cleanup callback.
Call chan_free() before destroying the device so transport specific
resources such as IRQs, mailbox channels and mapped shared memory are
released consistently with the normal teardown path.
Fixes: 05a2801d8b ("firmware: arm_scmi: Use dedicated devices to initialize channels")
Reported-by: Sashiko <sashiko-bot@kernel.org>
Link: https://patch.msgid.link/20260714-scmi_core_fixes-v6-5-3afe499d46e3@kernel.org
Signed-off-by: Sudeep Holla <sudeep.holla@kernel.org>
scmi_channels_setup() can fail after the common BASE channel or earlier
protocol channels have already been registered in the TX/RX IDRs.
Route this failure through the existing channel cleanup label so the
transport channels, transport devices and IDR state created before the
failure are released before the probe error path frees the SCMI instance
ID.
Fixes: 05a2801d8b ("firmware: arm_scmi: Use dedicated devices to initialize channels")
Reported-by: Sashiko <sashiko-bot@kernel.org>
Link: https://patch.msgid.link/20260714-scmi_core_fixes-v6-4-3afe499d46e3@kernel.org
Signed-off-by: Sudeep Holla <sudeep.holla@kernel.org>
scmi_notification_exit() clears and releases the notification instance,
but transport callbacks can still deliver incoming notifications until
the TX/RX channels are freed. During remove, an RX interrupt in that
window can enter scmi_notify() while notification state is being torn
down and then dereference freed memory. The same ordering exists on the
probe error path after notification initialization.
The notification late-init worker has a separate lifetime issue: protocol
event registration queues ni->init_work on the system workqueue, so
destroying ni->notify_wq does not drain that work. If the devres group is
released while init_work is still pending or running, the late-init worker
can dereference the freed notification instance.
Quiesce the notification core before TX/RX channels are torn down, then
clean up the channels before releasing the notification core resources.
Use disable_work_sync() so future late-init queueing is rejected and any
already queued or running late-init work has completed before channel
teardown starts.
Fixes: 1e7cbfaa66 ("firmware: arm_scmi: Free mailbox channels if probe fails")
Reported-by: Sashiko <sashiko-bot@kernel.org>
Link: https://patch.msgid.link/20260714-scmi_core_fixes-v6-3-3afe499d46e3@kernel.org
Signed-off-by: Sudeep Holla <sudeep.holla@kernel.org>
The requested-devices notifier looks up protocol fwnodes from the
active_protocols IDR. During remove, unregister the notifier before
releasing and destroying active_protocols so no notifier callback can race
with the IDR teardown.
Keep the bus notifier registered until after the protocol state is torn
down, matching the existing remove ordering for SCMI bus users.
Fixes: 53b8c25df7 ("firmware: arm_scmi: Add common notifier helpers")
Reported-by: Sashiko <sashiko-bot@kernel.org>
Link: https://patch.msgid.link/20260714-scmi_core_fixes-v6-2-3afe499d46e3@kernel.org
Signed-off-by: Sudeep Holla <sudeep.holla@kernel.org>
Transport setup can enable callbacks before the setup routine returns.
mailbox_chan_setup() registers the mailbox client with
mbox_request_channel(), and the mailbox controller startup path can enable
interrupt delivery before SCMI mailbox channel state has been published.
Similarly, smc_chan_setup() requests the optional A2P completion IRQ before
the SMC transport has made its cinfo pointer visible.
If a pending or spurious callback fires in those windows, the transport RX
callback can dereference a NULL transport cinfo pointer. Publishing only
the transport-private pointer is not sufficient either: an early callback
can enter the SCMI core before scmi_chan_setup() has assigned
cinfo->handle.
The core derives scmi_info from cinfo->handle in the RX path, so a NULL
handle can still fault even when the transport-private cinfo is valid.
Assign cinfo->handle before invoking the transport setup callback. Publish
the mailbox and SMC transport-private channel state before requesting the
mailbox channels or IRQ, and clear the early-published pointers again on
setup failure. Also unwind mailbox setup devres resources on failure so an
optional RX setup error that is ignored by the core does not leave stale
transport state behind.
Fixes: 5c8a47a5a9 ("firmware: arm_scmi: Make scmi core independent of the transport type")
Reported-by: Sashiko <sashiko-bot@kernel.org>
Link: https://patch.msgid.link/20260714-scmi_core_fixes-v6-1-3afe499d46e3@kernel.org
Signed-off-by: Sudeep Holla <sudeep.holla@kernel.org>
Several SCMI notification data structures allocate a descriptor and then
allocate a fixed-size array referenced by that descriptor.
Use flexible array members for per-protocol registered events and
per-event source refcounts so each descriptor and its array can be
allocated together. Annotate the flexible arrays with __counted_by() and
assign the count fields immediately after allocation, before any array
access.
The registered_protocols table has a fixed SCMI_MAX_PROTO size, so embed
it directly in the notification instance instead of allocating it
separately.
Signed-off-by: Rosen Penev <rosenp@gmail.com>
Link: https://patch.msgid.link/20260630204719.334211-1-rosenp@gmail.com
(sudeep.holla: Updated title and improved change description)
Signed-off-by: Sudeep Holla <sudeep.holla@kernel.org>
The TPM character devices expose a sequential command/response
interface, but their open handlers leave FMODE_PREAD and FMODE_PWRITE
enabled.
After a command leaves a response pending, pread(fd, buf, 16, 0x1400)
passes 0x1400 as *off to tpm_common_read(). The transfer length is
bounded by response_length, but the offset is used unchecked when
forming data_buffer + *off. A sufficiently large offset therefore causes
an out-of-bounds heap read through copy_to_user() and, if the copy
succeeds, an out-of-bounds zero-write through the following memset().
Positional I/O does not provide coherent semantics for this interface.
An arbitrary pread offset cannot represent how much of a response has
been consumed sequentially. The write callback always stores a command
at the start of data_buffer, while pwrite() does not update file->f_pos
and can leave the sequential read cursor stale.
Call nonseekable_open() from both open handlers. This removes
FMODE_PREAD and FMODE_PWRITE, causing positional reads and writes to
fail with -ESPIPE before reaching the TPM callbacks, and explicitly
marks the files non-seekable. Normal read() and write() continue to use
the existing sequential f_pos cursor, leaving the response state machine
unchanged.
Tested on Linux 6.12 with KASAN and a swtpm TPM2 device:
- sequential partial reads returned the complete response
- pread() and preadv() with offset 0x1400 returned -ESPIPE
- pwrite() and pwritev() with offset zero returned -ESPIPE
- the pending response remained intact after the rejected operations
- a subsequent normal command/response cycle completed normally
- no KASAN report was produced.
Fixes: 9488585b21 ("tpm: add support for partial reads")
Link: https://lore.kernel.org/all/20260710090217.191289-1-yong010301@gmail.com/
Cc: stable@vger.kernel.org
Signed-off-by: Jaewon Yang <yong010301@gmail.com>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Here are some staging driver fixes for 7.2-rc3 for some reported bugs in
the vme_user and rtl8723bs drivers. These include:
- many rtl8723bs OOB fixes for when connecting to "bad" wifi hosts
- vme_user bugfixes to correctly validate some user-provided data
All of these have been in linux-next for a while with no reported
issues.
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
-----BEGIN PGP SIGNATURE-----
iG0EABECAC0WIQT0tgzFv3jCIUoxPcsxR9QN2y37KQUCalNT5Q8cZ3JlZ0Brcm9h
aC5jb20ACgkQMUfUDdst+ynpAACgja2SsuFbsIOiofjEjyXZnjE55IcAoNkmr/yp
XkMNN2/oQHc1faGW47cm
=jtsV
-----END PGP SIGNATURE-----
Merge tag 'staging-7.2-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/staging
Pull staging driver fixes from Greg KH:
"Here are some staging driver fixes for 7.2-rc3 for some reported bugs
in the vme_user and rtl8723bs drivers. These include:
- many rtl8723bs OOB fixes for when connecting to "bad" wifi hosts
- vme_user bugfixes to correctly validate some user-provided data
All of these have been in linux-next for a while with no reported
issues"
* tag 'staging-7.2-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/staging:
staging: rtl8723bs: fix OOB reads in rtw_get_sec_ie(), rtw_get_wapi_ie(), and rtw_get_wps_attr()
staging: rtl8723bs: fix OOB reads in is_ap_in_tkip() IE loop
staging: rtl8723bs: fix OOB read in OnAssocRsp() IE loop
staging: rtl8723bs: fix OOB write in HT_caps_handler()
staging: rtl8723bs: fix heap buffer overflow in rtw_cfg80211_set_wpa_ie()
staging: rtl8723bs: fix OOB reads in IE loops in issue_assocreq() and join_cmd_hdl()
staging: rtl8723bs: fix OOB read in update_beacon_info() IE loop
staging: rtl8723bs: fix WEP length underflow and OOB read in OnAuth()
staging: vme_user: fix location monitor leak in tsi148 bridge
staging: vme_user: fix location monitor leak in fake bridge
staging: vme_user: bound slave read/write to the kern_buf size
staging: rtl8723bs: don't drop short TX frames in _rtw_pktfile_read()
Here is a set of bugfixes for 7.2-rc3 that resolve a bunch of reported
issues in just the binder and iio codebases. Included in here are:
- binder driver bugfixes for both the rust and c versions for reported
problems
- lots and lots of iio driver bugfixes for lots of reported issues
(including a hid sensor driver bugfix)
Full details are in the shortlog, all of these have been in linux-next
with no reported issues.
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
-----BEGIN PGP SIGNATURE-----
iG0EABECAC0WIQT0tgzFv3jCIUoxPcsxR9QN2y37KQUCalNPWw8cZ3JlZ0Brcm9h
aC5jb20ACgkQMUfUDdst+yltzACdFC2/ouvc1ea1jGFBP1ZN4lKU6gAAn1ak5lRK
30pEMSmJwYteOj8AlpuE
=ZIWT
-----END PGP SIGNATURE-----
Merge tag 'char-misc-7.2-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc
Pull Android/IIO fixes from Greg KH:
"Here is a set of bugfixes for 7.2-rc3 that resolve a bunch of reported
issues in just the binder and iio codebases. Included in here are:
- binder driver bugfixes for both the rust and c versions for
reported problems
- lots and lots of iio driver bugfixes for lots of reported issues
(including a hid sensor driver bugfix)
Full details are in the shortlog, all of these have been in linux-next
with no reported issues"
* tag 'char-misc-7.2-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc: (36 commits)
iio: event: Fix event FIFO reset race
iio: imu: inv_icm42600: fix timestamp clock period by using lower value
iio: light: al3010: fix incorrect scale for the highest gain range
iio: adc: nxp-sar-adc: Fix the delay calculation in nxp_sar_adc_wait_for()
iio: light: tsl2591: return actual error from probe IRQ failure
iio: imu: inv_icm42600: fix timestamping by limiting FIFO reading
iio: imu: st_lsm6dsx: deselect shub page before reading whoami
rust_binder: clear freeze listener on node removal
rust_binder: reject context manager self-transaction
rust_binder: use a u64 stride when cleaning up the offsets array
binder: fix UAF in binder_free_transaction()
binder: fix UAF in binder_thread_release()
rust_binder: synchronize Rust Binder stats with freeze commands
binder: cache secctx size before release zeroes it
rust_binder: fix BINDER_GET_EXTENDED_ERROR
iio: adc: ad7779: add missing 'select IIO_TRIGGERED_BUFFER' to Kconfig
iio: adc: ad4130: add missing `select IIO_TRIGGERED_BUFFER` to Kconfig
iio: adc: ti-ads124s08: Return reset GPIO lookup errors
iio: temperature: Build mlx90635 with CONFIG_MLX90635
iio: light: al3320a: add missing REGMAP_I2C to Kconfig
...
Here are some small tty/serial/vt fixes for 7.2-rc3 that resolve some
reported problems. Included in here are:
- vt spurious modifier issue that showed up in -rc1 (reported a bunch)
- 8250 driver bugfixes
- msm serial driver bugfix
- max310x serial driver bugfix
All of these have been in linux-next with no reported issues
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
-----BEGIN PGP SIGNATURE-----
iG0EABECAC0WIQT0tgzFv3jCIUoxPcsxR9QN2y37KQUCalNRQg8cZ3JlZ0Brcm9h
aC5jb20ACgkQMUfUDdst+ymuIQCdGVJwWd6MdGl+vzAO5GhJA7ndewEAoIbyOkQ2
zriM/Mn6vzKP81QKvGRY
=Gmi1
-----END PGP SIGNATURE-----
Merge tag 'tty-7.2-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/tty
Pull tty/serial fixes from Greg KH:
"Here are some small tty/serial/vt fixes for 7.2-rc3 that resolve some
reported problems. Included in here are:
- vt spurious modifier issue that showed up in -rc1 (reported a
bunch)
- 8250 driver bugfixes
- msm serial driver bugfix
- max310x serial driver bugfix
All of these have been in linux-next with no reported issues"
* tag 'tty-7.2-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/tty:
serial: 8250: Ignore flow control on suspend/resume with no_console_suspend
serial: 8250_mid: Disable DMA for selected platforms
serial: 8250_omap: clear rx_running on zero-length DMA completes
vt: fix spurious modifier in CSI/cursor key sequences
serial: msm: Disable DMA for kernel console UART
serial: max310x: implement gpio_chip::get_direction()
Here are a number of small USB driver fixes for many reported issues.
Included in here are:
- usb serial driver corruption and use-after-free fixes
- usb gadget rndis bugfixes for malicious/buggy host connections
- typec driver fixes for a load of different tiny reported issues
- typec mux driver revert for a broken patch in -rc1
- usb gadget driver fixes for many different reported problems
- new usb device quirks added
- usbip tool fixes and some core usbip fixes as well
- dwc3 driver fixes for minor issues
- xhci driver fixes for reported problems
- lots of other tiny usb driver fixes for many tiny issues
All of these have been in linux-next with no reported issues.
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
-----BEGIN PGP SIGNATURE-----
iG0EABECAC0WIQT0tgzFv3jCIUoxPcsxR9QN2y37KQUCalNSkw8cZ3JlZ0Brcm9h
aC5jb20ACgkQMUfUDdst+ynUlACgtUhZOR/MsYMcNbKJe9vk0iG35+AAnjrhznd4
OJqmb+1vVQ7xDm2fq+gz
=Ky4T
-----END PGP SIGNATURE-----
Merge tag 'usb-7.2-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb
Pull USB fixes from Greg KH:
"Here are a number of small USB driver fixes for many reported issues.
Included in here are:
- usb serial driver corruption and use-after-free fixes
- usb gadget rndis bugfixes for malicious/buggy host connections
- typec driver fixes for a load of different tiny reported issues
- typec mux driver revert for a broken patch in -rc1
- usb gadget driver fixes for many different reported problems
- new usb device quirks added
- usbip tool fixes and some core usbip fixes as well
- dwc3 driver fixes for minor issues
- xhci driver fixes for reported problems
- lots of other tiny usb driver fixes for many tiny issues
All of these have been in linux-next with no reported issues"
* tag 'usb-7.2-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb: (56 commits)
USB: core: ratelimit cabling message
usb: misc: usbio: fix disconnect UAF in client teardown
Revert "usb: typec: mux: avoid duplicated mux switches"
USB: chaoskey: Fix slab-use-after-free in chaoskey_release()
usb: ucsi: huawei_gaokun: move typec_altmode off stack
usb: typec: tcpci_rt1711h: unregister TCPCI port with devres
usb: typec: tcpm: Fix VDM type for Enter Mode commands
usb: typec: ucsi: cancel pending work on system suspend
usb: typec: class: drop PD lookup reference
usb: typec: ps883x: Fix DP+USB3 configuration
usb: xhci: Fix sleep in atomic context in xhci_free_streams()
xhci: sideband: fix ring sg table pages leak
usb: gadget: udc: Fix use-after-free in gadget_match_driver
usb: dwc3: run gadget disconnect from sleepable suspend context
usb: sl811-hcd: disable controller wakeup on remove
usb: typec: anx7411: use devm_pm_runtime_enable()
usb: dwc3: fix dwc3_readl() and dwc3_writel() calls in dwc3_ulpi_setup()
USB: misc: uss720: unregister parport on probe failure
usb: gadget: function: rndis: add length check for header
usb: gadget: function: rndis: add length check to response query
...
