dumb-buffer:
- prevent overflows in dumb-buffer creation
dma-buf:
- fix UAF in dma_buf_fd() tracepoint
gem:
- fix for the fix for the fix for the change handle ioctl
i915:
- Fix potential UAF in TTM object purge
- Use polling when irqs are unavailable
- Fix HDR pre-CSC LUT programming loop
- Block DC states on vblank enable when Panel Replay supported
- Use DC_OFF wake reference to block DC6 on vblank enable
xe:
- Restore IDLEDLY regiter on engine reset
amdgpu:
- GEM_OP warning fix
- GEM_OP locking fix
- Userq fixes
- DCN 2.1 refclk fix
- SI fix
- HMM fixes
amdkfd:
- svm_range_set_attr locking fix
- CRIU restore fix
- KFD debugger fix
amdxdna:
- require IOMMU on AIE2
hyperv:
- improve protocol validation
ivpu:
- test write offset in debugfs
rocket:
- fix UAF in bo creation
-----BEGIN PGP SIGNATURE-----
iQIzBAABCgAdFiEEEKbZHaGwW9KfbeusDHTzWXnEhr4FAmoaG2kACgkQDHTzWXnE
hr4euhAAl3u8saUVPRr3QObFBUdCi8X8ngZKd0o9L82TEqNz6iC8TFxwyVPr+0Mh
gEi2nvskopDRTb9So8LUAuevuT1r5KZRKH0w3FdR/bSCuO3hxrei0v3lM/L7D7Gn
ULQS1bP3kp4N1Bikt3UP5JSeJDhlpuwMqoapnA4Zz3WRnxVg6aFEYSc7Xb7dOWpS
2k5cJHd0IBxgF3/faw9vOM5DklwZqUAbIBxdziFA7Oepg0OxkypXpBPSioNhEW7f
hj8rlIDRXbLp33RXoL9UyJkXRIkFhjiAhmVcqTgO+nN7w8M2TKBsH/wkWly4d+aS
PveE+15zdRo0Tzw2DbTDYRCMyeBRpeik4s332ILSGse0MMt4RFz3wpB0fB/DriOz
BvHBOnUQerZfPk/dGarC8PxqoE70SZaPrMlvEkBmZpcY3OzIUEwV7Pd+r8W9PWjH
g6ECgPkvCyskJJPugrLYVqQkwjSIF5s+LmKwVfgvuqfyRenXPqrdPwSwEeZb43iC
NXGP8Au8QVsQKNdP6LzASclq3GcxYTfRK/v+wAgaSTpdvOkWhLBtyjPcO3aGWDgM
Ve8YFAPSobetEe5B9esBpliXQKj17juSxdJkut6B63RJ6fPk6r2Mza3lGmhHQs0R
FiyryFtQpzA5iETaiLe4TsaRZzWxzSHZEfV9GediQTRn8gQKEe0=
=tlSw
-----END PGP SIGNATURE-----
Merge tag 'drm-fixes-2026-05-30' of https://gitlab.freedesktop.org/drm/kernel
Pull drm fixes from Dave Airlie:
"Regular pull, doesn't seem too insane or AI owned, couple of UAF fixes
and another repair for an earlier fix, mostly amdgpu and i915 display
with xe/i915 accel, and misc core/driver fixes.
It might be a bit bigger than usual at this stage, but I'm not seeing
anything too scary here.
dumb-buffer:
- prevent overflows in dumb-buffer creation
dma-buf:
- fix UAF in dma_buf_fd() tracepoint
gem:
- fix for the fix for the fix for the change handle ioctl
i915:
- Fix potential UAF in TTM object purge
- Use polling when irqs are unavailable
- Fix HDR pre-CSC LUT programming loop
- Block DC states on vblank enable when Panel Replay supported
- Use DC_OFF wake reference to block DC6 on vblank enable
xe:
- Restore IDLEDLY regiter on engine reset
amdgpu:
- GEM_OP warning fix
- GEM_OP locking fix
- Userq fixes
- DCN 2.1 refclk fix
- SI fix
- HMM fixes
amdkfd:
- svm_range_set_attr locking fix
- CRIU restore fix
- KFD debugger fix
amdxdna:
- require IOMMU on AIE2
hyperv:
- improve protocol validation
ivpu:
- test write offset in debugfs
rocket:
- fix UAF in bo creation"
* tag 'drm-fixes-2026-05-30' of https://gitlab.freedesktop.org/drm/kernel: (33 commits)
drm/gem: fix race between change_handle and handle_delete
drm: prevent integer overflows in dumb buffer creation helpers
dma-buf: fix UAF in dma_buf_fd() tracepoint
drm/amdgpu: fix calling VM invalidation in amdgpu_hmm_invalidate_gfx
drm/amdgpu: fix amdgpu_hmm_range_get_pages
drm/amdgpu/userq: use array instead of list for userq_vas
drm/amdgpu/userq: move mqd_destroy to later stage to keep core obj valid
drm/amdkfd: fix a vulnerability of integer overflow in kfd debugger
drm/amdgpu/userq: remove amdgpu_userq_create/destroy_object wrapper
drm/amd/pm/si: Disregard vblank time when no displays are connected
drm/amdkfd: Check for pdd drm file first in CRIU restore path
drm/amdgpu: fix potential overflow in fs_info.debugfs_name
drm/amdgpu/userq: make sure queue is valid in the hang_detect_work
drm/amdgpu/userq: reserve root bo without interruption
drm/amdgpu/userq: add amdgpu_bo_unpin when amdgpu_ttm_alloc_gart fails
drm/amdgpu: simplify return value in amdgpu_userq_get_doorbell_index
drm/amdkfd: fix NULL pointer bug in svm_range_set_attr
drm/amd/display: Write REFCLK to 48MHz on DCN21
drm/amdgpu/userq: Fix the mutex_init cleanup for fence_drv_lock
drm/amdgpu/userq: Fix doorbell object cleanup of queue
...
One substantive fix here, fixing corruption of the maximum frequency for
spi-mem operations which caused users to remember what should have been
a temporarily modified maximum frequency as the standard going forward,
potentially causing instability when the modification raised rather than
lowered the frequency.
We also have a trivial patch which just documents the correct way to
describe the Qualcomm IPQ5210 SNAND controller in the DT, there are no
code changes.
-----BEGIN PGP SIGNATURE-----
iQEzBAABCgAdFiEEreZoqmdXGLWf4p/qJNaLcl1Uh9AFAmoZyKAACgkQJNaLcl1U
h9BkSQf+OPY/DuHr46oL4AH36df3FkihkFmaTlipyP2io7HiTgYG67wdXtVfh4H2
w8D9GT+ukrCGgWkJK+Qgf3IbX19BkL/1kyeDATBJErMd/XHQqn6u38+Lhe3EAqzP
L4S/pWHmtC/pKynPbsUUkunAYeUa3DK6ZHteZyCe/R+fTKizXOH5Lh74Dcm/pa+V
b8Aut8Igq32K5KXDkk+TzACkiGDaFs+M7QDfNGI9WN3zBrzxWtS/9ktF5/cN5gBG
dzjcLb+XJoZnJHwMa7geS7cVvKpPMbqX8fYwip+hhaPfyugP9EvdPibcAhUltGw3
TNFYV4HpFeGuf7yIoEIzapvVdvvbjA==
=iELF
-----END PGP SIGNATURE-----
Merge tag 'spi-fix-v7.1-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/spi
Pull spi fixes from Mark Brown:
"One substantive fix here, fixing corruption of the maximum frequency
for spi-mem operations which caused users to remember what should have
been a temporarily modified maximum frequency as the standard going
forward, potentially causing instability when the modification raised
rather than lowered the frequency.
We also have a trivial patch which just documents the correct way to
describe the Qualcomm IPQ5210 SNAND controller in the DT, there are no
code changes"
* tag 'spi-fix-v7.1-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/spi:
spi: spi-mem: avoid mutating op template in spi_mem_supports_op()
spi: dt-bindings: spi-qpic-snand: Add ipq5210 compatible
'perf annotate' checks that evlist->nr_br_cntr has been incremented to
determine whether to show branch counter information.
However, this data is not populated until after the check when events
are processed.
Therefore, this counter will always be less than zero and the Branch
Count column is never shown. Do this check after events have been
processed and branch counter data is updated.
Reviewed-by: Dapeng Mi <dapeng1.mi@linux.intel.com>
Signed-off-by: Thomas Falcon <thomas.falcon@intel.com>
Acked-by: Ian Rogers <irogers@google.com>
Cc: Adrian Hunter <adrian.hunter@intel.com>
Cc: Alexander Shishkin <alexander.shishkin@linux.intel.com>
Cc: Ingo Molnar <mingo@redhat.com>
Cc: James Clark <james.clark@linaro.org>
Cc: Jiri Olsa <jolsa@kernel.org>
Cc: Mark Rutland <mark.rutland@arm.com>
Cc: Namhyung Kim <namhyung@kernel.org>
Cc: Peter Zijlstra <peterz@infradead.org>
Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
When displaying branch counter (br_cntr) information, a "+" suffix
represents that event occurrences may have been lost due to branch
counter saturation. However, this indicator was missing in perf script.
Add it back.
Before:
# Branch counter abbr list:
# cpu_core/event=0xc4,umask=0x20/ppp = A
# cpu_core/instructions/ = B
# cpu_core/MEM_INST_RETIRED.ALL_LOADS/ = C
# cpu_core/MEM_LOAD_RETIRED.L2_MISS/ = D
# '-' No event occurs
# '+' Event occurrences may be lost due to branch counter saturated
...
datasym+190:
00005567f9951676 jz 0x5567f995162dr_cntr: BBBC # PRED 1 cycles [1]
...
After:
...
datasym+190:
00005567f9951676 jz 0x5567f995162dr_cntr: BBB+C # PRED 1 cycles [1]
...
Reviewed-by: Dapeng Mi <dapeng1.mi@linux.intel.com>
Signed-off-by: Dapeng Mi <dapeng1.mi@linux.intel.com>
Signed-off-by: Thomas Falcon <thomas.falcon@intel.com>
Acked-by: Ian Rogers <irogers@google.com>
Cc: Adrian Hunter <adrian.hunter@intel.com>
Cc: Alexander Shishkin <alexander.shishkin@linux.intel.com>
Cc: Ingo Molnar <mingo@redhat.com>
Cc: James Clark <james.clark@linaro.org>
Cc: Jiri Olsa <jolsa@kernel.org>
Cc: Mark Rutland <mark.rutland@arm.com>
Cc: Namhyung Kim <namhyung@kernel.org>
Cc: Peter Zijlstra <peterz@infradead.org>
Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
Opening an SPE event shows a warning that doesn't concern the user:
$ perf record -e arm_spe
Unknown/empty format name: discard
Perf only wants to know if the discard bit is set for configuring the
event, not in response to anything the user has done. Fix it by adding
another helper that returns if a config bit exists without warning.
We should probably keep the warning in evsel__get_config_val() to avoid
having every caller having to do it, and most format bits should never
be missing.
Add a test for the new helper. Rename the parent test function to be
more generic rather than adding a new one as it requires a lot of
boilerplate.
Reviewed-by: Ian Rogers <irogers@google.com>
Reviewed-by: Leo Yan <leo.yan@arm.com>
Signed-off-by: James Clark <james.clark@linaro.org>
Cc: Adrian Hunter <adrian.hunter@intel.com>
Cc: Alexander Shishkin <alexander.shishkin@linux.intel.com>
Cc: Ingo Molnar <mingo@redhat.com>
Cc: Jiri Olsa <jolsa@kernel.org>
Cc: John Garry <john.g.garry@oracle.com>
Cc: Leo Yan <leo.yan@linux.dev>
Cc: Mark Rutland <mark.rutland@arm.com>
Cc: Mike Leach <mike.leach@linaro.org>
Cc: Namhyung Kim <namhyung@kernel.org>
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: Will Deacon <will@kernel.org>
Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
perf_exe() passes len to readlink() and then unconditionally writes a
trailing NUL at buf[n]. If readlink() returns len, the write lands one
byte past the buffer.
Read at most len - 1 bytes and keep the existing NUL termination. Also
guard the fallback path for tiny buffers so copying "perf" cannot
overflow.
Reviewed-by: Ian Rogers <irogers@google.com>
Signed-off-by: Miguel Martín Gil <miguel.martin.gil.uni@gmail.com>
Cc: Ingo Molnar <mingo@redhat.com>
Cc: Namhyung Kim <namhyung@kernel.org>
Cc: Peter Zijlstra <peterz@infradead.org>
Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
Add IOMMU Translation Lookaside Buffer (TLB) and interrupt cache metrics
to perf jevents for Intel platforms. This enhances I/O performance
observability, allowing fleet-wide monitoring of IOMMU overhead.
These metrics are supported on platforms that expose the required uncore
IIO IOMMU events (such as Emerald Rapids and Granite Rapids).
The Intel implementation dynamically detects event availability at
generation time.
It requires at least the TLB events to expose the metric group, while
the interrupt cache events are optional. This allows platforms like
Emerald Rapids, which lack IOMMU interrupt cache events, to still expose
the IOMMU TLB metrics.
The following metrics are added:
- iotlb_total_hit: Total IOTLB hits (4K, 2M, 1G pages).
- iotlb_total_miss: Total IOTLB misses.
- iotlb_miss_rate: IOTLB miss rate.
- iotlb_interrupt_cache_hit: Interrupt cache hits.
- iotlb_interrupt_cache_miss: Interrupt cache misses (calculated as
lookup - hit, clamped to zero).
- iotlb_interrupt_cache_lookup: Interrupt cache lookups.
- iotlb_interrupt_cache_miss_rate: Interrupt cache miss rate.
Tested:
# perf stat -M \
iotlb_total_hit,iotlb_total_miss,iotlb_miss_rate \
--per-socket --metric-only -a -j -- sleep 10
{"socket" : "S0", "counters" : 10,
"hits iotlb_total_hit" : "3579249.0",
"% iotlb_miss_rate" : "0.0",
"misses iotlb_total_miss" : "3.0"}
{"socket" : "S1", "counters" : 10,
"hits iotlb_total_hit" : "0.0",
"% iotlb_miss_rate" : "0.0",
"misses iotlb_total_miss" : "0.0"}
Reviewed-by: Ian Rogers <irogers@google.com>
Signed-off-by: Chun-Tse Shao <ctshao@google.com>
Assisted-by: Gemini:gemini-3.1-pro-preview
Cc: Adrian Hunter <adrian.hunter@intel.com>
Cc: Alexander Shishkin <alexander.shishkin@linux.intel.com>
Cc: Dapeng Mi <dapeng1.mi@intel.com>
Cc: Ingo Molnar <mingo@redhat.com>
Cc: James Clark <james.clark@linaro.org>
Cc: Jiri Olsa <jolsa@kernel.org>
Cc: Mark Rutland <mark.rutland@arm.com>
Cc: Namhyung Kim <namhyung@kernel.org>
Cc: Perry Taylor <perry.taylor@intel.com>
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: Sandipan Das <sandipan.das@amd.com>
Link: https://lore.kernel.org/r/20260528234455.434027-3-ctshao@google.com
Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
Add IOMMU Translation Lookaside Buffer (TLB) and interrupt cache metrics
to perf jevents for AMD platforms. This enhances I/O performance
observability, allowing fleet-wide monitoring of IOMMU overhead.
These metrics are supported on Zen 2 and newer processors (Rome, Milan,
Genoa, Turin) and are implemented using the standard `amd_iommu` PMU
events. The implementation uses the existing `_zen_model` helper to
ensure these are only generated for Zen 2+. Note that the pde events on
AMD cover both 2M and 1G pages, so 1G pages are implicitly included in
the total hits/misses metrics (sum of pte and pde events).
The following metrics are added:
- iotlb_total_hit: Total IOTLB hits (4K, 2M, 1G pages).
- iotlb_total_miss: Total IOTLB misses.
- iotlb_miss_rate: IOTLB miss rate.
- iotlb_interrupt_cache_hit: Interrupt cache hits.
- iotlb_interrupt_cache_miss: Interrupt cache misses.
- iotlb_interrupt_cache_lookup: Interrupt cache lookups.
- iotlb_interrupt_cache_miss_rate: Interrupt cache miss rate.
Tested:
# perf stat -M \
iotlb_total_hit,iotlb_total_miss,iotlb_miss_rate \
--per-socket --metric-only -a -j -- sleep 10
{"socket" : "S0", "counters" : 10,
"hits iotlb_total_hit" : "3579249.0",
"% iotlb_miss_rate" : "0.0",
"misses iotlb_total_miss" : "3.0"}
{"socket" : "S1", "counters" : 10,
"hits iotlb_total_hit" : "0.0",
"% iotlb_miss_rate" : "0.0",
"misses iotlb_total_miss" : "0.0"}
Reviewed-by: Ian Rogers <irogers@google.com>
Reviewed-by: Sandipan Das <sandipan.das@amd.com>
Signed-off-by: Chun-Tse Shao <ctshao@google.com>
Assisted-by: Gemini:gemini-3.1-pro-preview
Cc: Adrian Hunter <adrian.hunter@intel.com>
Cc: Alexander Shishkin <alexander.shishkin@linux.intel.com>
Cc: Dapeng Mi <dapeng1.mi@intel.com>
Cc: Ingo Molnar <mingo@redhat.com>
Cc: James Clark <james.clark@linaro.org>
Cc: Jiri Olsa <jolsa@kernel.org>
Cc: Mark Rutland <mark.rutland@arm.com>
Cc: Namhyung Kim <namhyung@kernel.org>
Cc: Perry Taylor <perry.taylor@intel.com>
Cc: Peter Zijlstra <peterz@infradead.org>
Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
The updated events and metrics were published in:
efa15280e05cdba6c2cc
Reviewed-by: Dapeng Mi <dapeng1.mi@linux.intel.com>
Signed-off-by: Ian Rogers <irogers@google.com>
Cc: Adrian Hunter <adrian.hunter@intel.com>
Cc: Alexander Shishkin <alexander.shishkin@linux.intel.com>
Cc: Andreas Färber <afaerber@suse.de>
Cc: Ingo Molnar <mingo@redhat.com>
Cc: James Clark <james.clark@linaro.org>
Cc: Jiri Olsa <jolsa@kernel.org>
Cc: Manivannan Sadhasivam <mani@kernel.org>
Cc: Namhyung Kim <namhyung@kernel.org>
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: Thomas Falcon <thomas.falcon@intel.com>
Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
The updated events and metrics were published in:
0718b7855542fe96774f
Reviewed-by: Dapeng Mi <dapeng1.mi@linux.intel.com>
Signed-off-by: Ian Rogers <irogers@google.com>
Cc: Adrian Hunter <adrian.hunter@intel.com>
Cc: Alexander Shishkin <alexander.shishkin@linux.intel.com>
Cc: Andreas Färber <afaerber@suse.de>
Cc: Ingo Molnar <mingo@redhat.com>
Cc: James Clark <james.clark@linaro.org>
Cc: Jiri Olsa <jolsa@kernel.org>
Cc: Manivannan Sadhasivam <mani@kernel.org>
Cc: Namhyung Kim <namhyung@kernel.org>
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: Thomas Falcon <thomas.falcon@intel.com>
Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
The updated events and metrics were published in:
f5593317a6
Reviewed-by: Dapeng Mi <dapeng1.mi@linux.intel.com>
Signed-off-by: Ian Rogers <irogers@google.com>
Cc: Adrian Hunter <adrian.hunter@intel.com>
Cc: Alexander Shishkin <alexander.shishkin@linux.intel.com>
Cc: Andreas Färber <afaerber@suse.de>
Cc: Ingo Molnar <mingo@redhat.com>
Cc: James Clark <james.clark@linaro.org>
Cc: Jiri Olsa <jolsa@kernel.org>
Cc: Manivannan Sadhasivam <mani@kernel.org>
Cc: Namhyung Kim <namhyung@kernel.org>
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: Thomas Falcon <thomas.falcon@intel.com>
Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
The updated events and metrics were published in:
419a6600ad
Reviewed-by: Dapeng Mi <dapeng1.mi@linux.intel.com>
Signed-off-by: Ian Rogers <irogers@google.com>
Cc: Adrian Hunter <adrian.hunter@intel.com>
Cc: Alexander Shishkin <alexander.shishkin@linux.intel.com>
Cc: Andreas Färber <afaerber@suse.de>
Cc: Ingo Molnar <mingo@redhat.com>
Cc: James Clark <james.clark@linaro.org>
Cc: Jiri Olsa <jolsa@kernel.org>
Cc: Manivannan Sadhasivam <mani@kernel.org>
Cc: Namhyung Kim <namhyung@kernel.org>
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: Thomas Falcon <thomas.falcon@intel.com>
Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
The updated events and metrics were published in:
fae822a0f9
Reviewed-by: Dapeng Mi <dapeng1.mi@linux.intel.com>
Signed-off-by: Ian Rogers <irogers@google.com>
Cc: Adrian Hunter <adrian.hunter@intel.com>
Cc: Alexander Shishkin <alexander.shishkin@linux.intel.com>
Cc: Andreas Färber <afaerber@suse.de>
Cc: Ingo Molnar <mingo@redhat.com>
Cc: James Clark <james.clark@linaro.org>
Cc: Jiri Olsa <jolsa@kernel.org>
Cc: Manivannan Sadhasivam <mani@kernel.org>
Cc: Namhyung Kim <namhyung@kernel.org>
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: Thomas Falcon <thomas.falcon@intel.com>
Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
The updated events and metrics were published in:
5b93c8c750
Reviewed-by: Dapeng Mi <dapeng1.mi@linux.intel.com>
Signed-off-by: Ian Rogers <irogers@google.com>
Cc: Adrian Hunter <adrian.hunter@intel.com>
Cc: Alexander Shishkin <alexander.shishkin@linux.intel.com>
Cc: Andreas Färber <afaerber@suse.de>
Cc: Ingo Molnar <mingo@redhat.com>
Cc: James Clark <james.clark@linaro.org>
Cc: Jiri Olsa <jolsa@kernel.org>
Cc: Manivannan Sadhasivam <mani@kernel.org>
Cc: Namhyung Kim <namhyung@kernel.org>
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: Thomas Falcon <thomas.falcon@intel.com>
Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
The updated events and metrics were published in:
50159a7712
Reviewed-by: Dapeng Mi <dapeng1.mi@linux.intel.com>
Signed-off-by: Ian Rogers <irogers@google.com>
Cc: Adrian Hunter <adrian.hunter@intel.com>
Cc: Alexander Shishkin <alexander.shishkin@linux.intel.com>
Cc: Andreas Färber <afaerber@suse.de>
Cc: Ingo Molnar <mingo@redhat.com>
Cc: James Clark <james.clark@linaro.org>
Cc: Jiri Olsa <jolsa@kernel.org>
Cc: Manivannan Sadhasivam <mani@kernel.org>
Cc: Namhyung Kim <namhyung@kernel.org>
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: Thomas Falcon <thomas.falcon@intel.com>
Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
The updated events and metrics were published in:
526f1bf0ad
Reviewed-by: Dapeng Mi <dapeng1.mi@linux.intel.com>
Signed-off-by: Ian Rogers <irogers@google.com>
Cc: Adrian Hunter <adrian.hunter@intel.com>
Cc: Alexander Shishkin <alexander.shishkin@linux.intel.com>
Cc: Andreas Färber <afaerber@suse.de>
Cc: Ingo Molnar <mingo@redhat.com>
Cc: James Clark <james.clark@linaro.org>
Cc: Jiri Olsa <jolsa@kernel.org>
Cc: Manivannan Sadhasivam <mani@kernel.org>
Cc: Namhyung Kim <namhyung@kernel.org>
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: Thomas Falcon <thomas.falcon@intel.com>
Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
The updated events and metrics were published in:
6de6be144be7f5e6092c9c1a1baa516055edb3c3
Reviewed-by: Dapeng Mi <dapeng1.mi@linux.intel.com>
Signed-off-by: Ian Rogers <irogers@google.com>
Cc: Adrian Hunter <adrian.hunter@intel.com>
Cc: Alexander Shishkin <alexander.shishkin@linux.intel.com>
Cc: Andreas Färber <afaerber@suse.de>
Cc: Ingo Molnar <mingo@redhat.com>
Cc: James Clark <james.clark@linaro.org>
Cc: Jiri Olsa <jolsa@kernel.org>
Cc: Manivannan Sadhasivam <mani@kernel.org>
Cc: Namhyung Kim <namhyung@kernel.org>
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: Thomas Falcon <thomas.falcon@intel.com>
Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
The updated events were published in:
90c505bcd9
Reviewed-by: Dapeng Mi <dapeng1.mi@linux.intel.com>
Signed-off-by: Ian Rogers <irogers@google.com>
Cc: Adrian Hunter <adrian.hunter@intel.com>
Cc: Alexander Shishkin <alexander.shishkin@linux.intel.com>
Cc: Andreas Färber <afaerber@suse.de>
Cc: Ingo Molnar <mingo@redhat.com>
Cc: James Clark <james.clark@linaro.org>
Cc: Jiri Olsa <jolsa@kernel.org>
Cc: Manivannan Sadhasivam <mani@kernel.org>
Cc: Namhyung Kim <namhyung@kernel.org>
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: Thomas Falcon <thomas.falcon@intel.com>
Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
Some other fixing in an API user turned up the fact that we weren't
correctly applying cache only mode to volatile registers in
regmap_update_bits(), causing us to try to access hardware that was
powered off or otherwise not in a state to accept I/O. This fix returns
an error instead, avoiding more serious consequences.
-----BEGIN PGP SIGNATURE-----
iQEzBAABCgAdFiEEreZoqmdXGLWf4p/qJNaLcl1Uh9AFAmoZyXsACgkQJNaLcl1U
h9DJZgf/aOLHE/EBIBcq9QBczGj5Js2/diVO4YCR0WGISbYv4tRfhwkO5SMyPFZ0
Zk7c9rfzEqauQW3tpsPUhg/B5gK6HOZ/gIAZA7+CjmLCDxg2EBxclFFnl7UKWt8d
Xs5YdokBL4ZrlVBtgL3YerQ4dCSiDr6FLZYAnFWy5FLXkNbwqvxhUzc7LzAnY/Z3
pLw/LOnSc1LwXhf10gCKI8OoHdQSPu0pNr9ZYG1smD1J/K9V9Pgbdq0oLrGquwB1
F8mIFdncblhW4ChbWDUxhF26htKpv4qwdjWKdkHlNDXAYPrS70Ea2PqVP1XwEWdK
WxouWVBIpOOqGt0OCYooADmHADJ6VQ==
=9bVn
-----END PGP SIGNATURE-----
Merge tag 'regmap-fix-v7.1-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/regmap
Pull regmap fix from Mark Brown:
"Some other fixing in an API user turned up the fact that we weren't
correctly applying cache only mode to volatile registers in
regmap_update_bits(), causing us to try to access hardware that was
powered off or otherwise not in a state to accept I/O. This fix
returns an error instead, avoiding more serious consequences"
* tag 'regmap-fix-v7.1-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/regmap:
regmap: reject volatile update_bits() in cache-only mode
For non-SRQ QPs, the responder reads WQE fields directly from the
shared queue buffer mapped into userspace. This allows a malicious
user to modify fields like num_sge or sge entries while the kernel
is processing the WQE, leading to out-of-bounds reads in
rxe_resp_check_length() and copy_data().
Introduce get_recv_wqe() that validates num_sge and copies the WQE
to a kernel-local buffer before processing, matching the approach
already used for SRQ WQEs in get_srq_wqe(). The srq_wqe buffer is
reused since SRQ and non-SRQ paths are mutually exclusive per QP.
Fixes: 8700e3e7c4 ("Soft RoCE driver")
Link: https://patch.msgid.link/r/20260518215040.1598586-3-tristan@talencesecurity.com
Signed-off-by: Tristan Madani <tristan@talencesecurity.com>
Reviewed-by: Zhu Yanjun <yanjun.zhu@linux.dev>
Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
get_srq_wqe() reads wqe->dma.num_sge from the shared receive queue
buffer, which is mapped into userspace. It validates num_sge against
max_sge, but then re-reads the same field to calculate the memcpy
size. A concurrent userspace thread can modify num_sge between
validation and use, causing a heap buffer overflow when copying the
WQE into qp->resp.srq_wqe.
Read num_sge into a local variable and use it for both the bounds
check and the size calculation.
Fixes: 8700e3e7c4 ("Soft RoCE driver")
Link: https://patch.msgid.link/r/20260518215040.1598586-2-tristan@talencesecurity.com
Signed-off-by: Tristan Madani <tristan@talencesecurity.com>
Reviewed-by: Zhu Yanjun <yanjun.zhu@linux.dev>
Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
When a device requires DMA bounce buffering inside a Confidential
Computing guest, __ib_umem_get_va() cannot work. The DMA mapping layer
redirects all mappings through swiotlb bounce buffers, so the device
receives DMA addresses pointing to bounce buffer memory rather than the
user's pages. Since RDMA devices access registered memory directly without
CPU involvement, there is no opportunity for swiotlb to synchronize
between the bounce buffer and the original pages.
The registration would already fail later on, since the umem mapping is
requested with DMA_ATTR_REQUIRE_COHERENT and gets rejected under
is_swiotlb_force_bounce() with -EIO. Fail early with -EOPNOTSUPP instead,
so the user gets a specific error code to react to.
Link: https://patch.msgid.link/r/20260517141311.2409230-3-jiri@resnulli.us
Signed-off-by: Jiri Pirko <jiri@nvidia.com>
Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
In CoCo guests, guest memory is encrypted and untrusted (T=0) devices
cannot DMA to it directly; such transfers must go through unencrypted
bounce buffers. RDMA registers user pages for direct device access,
bypassing the DMA layer and thus any bouncing, so registered memory does
not work in this configuration.
Until trusted (T=1) device detection is available, conservatively flag
every device attached to a CoCo guest. Expose the condition to userspace
as IB_UVERBS_DEVICE_CC_DMA_BOUNCE in device_cap_flags_ex so applications
can avoid memory registration and fall back to copying buffers through
send/recv.
Link: https://patch.msgid.link/r/20260517141311.2409230-2-jiri@resnulli.us
Signed-off-by: Jiri Pirko <jiri@nvidia.com>
Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
Add an optional mlx5 driver-namespace UMEM attribute on QP
create so userspace can supply the doorbell record umem
explicitly, symmetric to the CQ side. Resolve it inside
mlx5_ib_db_map_user() and use it as a private DBR page when
present; otherwise take the existing UHW share-or-pin path
that preserves per-page DBR sharing across CQ/QP/SRQ in the
same process.
Add mlx5's first UVERBS_OBJECT_QP UAPI definition chain to
attach the new attr.
Link: https://patch.msgid.link/r/20260529134312.2836341-17-jiri@resnulli.us
Signed-off-by: Jiri Pirko <jiri@nvidia.com>
Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
Add an optional mlx5 driver-namespace UMEM attribute on CQ
create so userspace can supply the doorbell record buffer
explicitly. mlx5_ib_db_map_user() resolves the attribute (or
falls back to the legacy UHW VA) into a struct
ib_uverbs_buffer_desc and runs a unified lookup-then-pin:
VA-typed descriptors share a per-page umem across CQ/QP/SRQ
in the same process, FD-typed descriptors are pinned per call.
Link: https://patch.msgid.link/r/20260529134312.2836341-16-jiri@resnulli.us
Signed-off-by: Jiri Pirko <jiri@nvidia.com>
Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
ib_umem_is_contiguous() is defined under #ifdef
CONFIG_INFINIBAND_USER_MEM, but the #else branch lacks a stub.
Add the missing inline to fix potential broken build.
Fixes: c897c2c8b8 ("RDMA/core: Add umem "is_contiguous" and "start_dma_addr" helpers")
Link: https://patch.msgid.link/r/20260529134312.2836341-15-jiri@resnulli.us
Signed-off-by: Jiri Pirko <jiri@nvidia.com>
Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
Use the per-attribute UMEM helpers to pin QP buffer umems on
demand. The QP-type predicate selects between the BUF and RQ_BUF
attrs; raw-packet SQ uses its own dedicated SQ_BUF attr.
Link: https://patch.msgid.link/r/20260529134312.2836341-14-jiri@resnulli.us
Signed-off-by: Jiri Pirko <jiri@nvidia.com>
Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
Apply the per-attribute UMEM model to the QP create method. Add
three optional UMEM attributes that drivers pick from based on
how their user ABI lays out the QP rings:
- CREATE_QP_BUF_UMEM is a single user buffer that backs both
the SQ and RQ of one QP. This is the common case where
userspace pins one contiguous WQE region for the QP.
- CREATE_QP_SQ_BUF_UMEM and CREATE_QP_RQ_BUF_UMEM are a pair
of user buffers backing the SQ and RQ independently, used
when the two rings live in physically distinct user
allocations and must be pinned and addressed separately.
Existing drivers would map their current umems as follows:
- mlx5: BUF for normal QPs (one ucmd->buf_addr covers SQ+RQ);
for IB_QPT_RAW_PACKET and IB_QP_CREATE_SOURCE_QPN, the RQ
side comes from ucmd->buf_addr (RQ-sized) via RQ_BUF and
the SQ from ucmd->sq_buf_addr via SQ_BUF.
- mlx4: BUF, single ucmd.buf_addr covering SQ+RQ.
- hns: BUF, single ucmd.buf_addr covering SQ + ext-SGE + RQ.
- erdma: BUF, single ureq.qbuf_va sliced by the kernel into
SQ at offset 0 and RQ at rq_offset.
- bnxt_re: SQ_BUF (ureq->qpsva) + RQ_BUF (ureq->qprva, the
RQ side is skipped when the QP uses an SRQ).
- vmw_pvrdma: SQ_BUF (sbuf_addr) + RQ_BUF (rbuf_addr, the RQ
side is skipped when the QP uses an SRQ).
- qedr: SQ_BUF (sq_addr) + RQ_BUF (rq_addr) for whichever
side the QP type actually has (no SQ for XRC_TGT/GSI; no
RQ for XRC_INI/XRC_TGT/SRQ).
- ionic: SQ_BUF (req.sq.addr) + RQ_BUF (req.rq.addr); both
are skipped when the rings are placed in CMB instead of
host memory.
- mana: raw-packet QP uses SQ_BUF (sq_buf_addr) only; the RC
path uses multiple per-queue user buffers (ucmd.queue_buf[])
that do not fit the SQ/RQ pair semantics of these attrs and
stays on the legacy UHW path.
- efa, irdma, hfi1, ocrdma, mthca, cxgb4 and usnic do not pin
a QP WQE buffer via umem; none of these attributes apply.
Link: https://patch.msgid.link/r/20260529134312.2836341-13-jiri@resnulli.us
Signed-off-by: Jiri Pirko <jiri@nvidia.com>
Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
Now that all drivers use helper to get umem and manage the lifetime,
legacy umem field in struct ib_cq is no longer needed. Remove it
along with ib_umem_get_cq_tmp() helper that populated it and both
error and destroy paths.
Link: https://patch.msgid.link/r/20260529134312.2836341-12-jiri@resnulli.us
Signed-off-by: Jiri Pirko <jiri@nvidia.com>
Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
Pin the user CQ buffer with ib_umem_get_cq_buf() and take
ownership of the umem in the driver; fall back to
ib_umem_get_va() for the legacy UHW VA path. Apply the same
ownership pattern to the resize path.
Link: https://patch.msgid.link/r/20260529134312.2836341-11-jiri@resnulli.us
Signed-off-by: Jiri Pirko <jiri@nvidia.com>
Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
Pin the user CQ buffer with ib_umem_get_cq_buf_or_va() and take
ownership of the umem in the driver. Apply the same ownership
pattern to the resize path.
Link: https://patch.msgid.link/r/20260529134312.2836341-10-jiri@resnulli.us
Signed-off-by: Jiri Pirko <jiri@nvidia.com>
Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
Pin the user CQ buffer with ib_umem_get_cq_buf_or_va() and take
ownership of the umem in the driver. Apply the same ownership
pattern to the resize path.
Link: https://patch.msgid.link/r/20260529134312.2836341-9-jiri@resnulli.us
Signed-off-by: Jiri Pirko <jiri@nvidia.com>
Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
Pin the user CQ buffer with ib_umem_get_cq_buf() and take
ownership of the umem in the driver. Fall back to the
existing kernel-DMA path on NULL.
Link: https://patch.msgid.link/r/20260529134312.2836341-8-jiri@resnulli.us
Signed-off-by: Jiri Pirko <jiri@nvidia.com>
Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
Add UVERBS_ATTR_CREATE_CQ_BUF_UMEM and two driver-facing
wrappers, ib_umem_get_cq_buf() and ib_umem_get_cq_buf_or_va(),
that pin a CQ buffer umem from it. The wrappers reuse the
existing legacy CQ buffer-attr filler.
Link: https://patch.msgid.link/r/20260529134312.2836341-7-jiri@resnulli.us
Signed-off-by: Jiri Pirko <jiri@nvidia.com>
Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
Extract the UVERBS_ATTR_CREATE_CQ_BUFFER_* parser from the CQ
create handler into uverbs_create_cq_get_buffer_desc(), and wrap
it in ib_umem_get_cq_tmp(), the umem-producing helper the cq_create
handler now calls.
ib_umem_get_cq_tmp() is temporary; subsequent patches replace it
with driver-owned ib_umem_get_cq_buf*() wrappers built on the
same parser, and remove it once all CQ drivers have switched.
Link: https://patch.msgid.link/r/20260529134312.2836341-6-jiri@resnulli.us
Signed-off-by: Jiri Pirko <jiri@nvidia.com>
Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
ib_umem_get_va() is now redundant: ib_umem_get_attr_or_va() with
attrs=NULL and attr_id=0 covers the exact same path. Make it a static
inline wrapper instead of a separately exported symbol.
Link: https://patch.msgid.link/r/20260529134312.2836341-5-jiri@resnulli.us
Signed-off-by: Jiri Pirko <jiri@nvidia.com>
Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
Introduce a per-attribute UVERBS_ATTR_UMEM model so each uverbs
command's umem set is explicit in its UAPI definition. Add
driver-facing wrapper helpers that pin a umem on demand from an
attribute or a VA addr; the driver owns the returned umem and
releases it from its destroy/error paths.
Link: https://patch.msgid.link/r/20260529134312.2836341-4-jiri@resnulli.us
Signed-off-by: Jiri Pirko <jiri@nvidia.com>
Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
The follow-up patch is going to introduce ib_umem_get_desc(),
the canonical desc-to-umem helper, which needs to pin a userspace VA
without going through the exported ib_umem_get_va() helper so later on
ib_umem_get_va() would use the ib_umem_get_desc() flow too.
Move the existing ib_umem_get_va() to a static __ib_umem_get_va()
and have ib_umem_get_va() as a thin wrapper that calls it.
Link: https://patch.msgid.link/r/20260529134312.2836341-3-jiri@resnulli.us
Signed-off-by: Jiri Pirko <jiri@nvidia.com>
Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
The new umem getter family being introduced in follow-up patches
need a fitting name for the central all-source helper that resolves
attributes, legacy fillers and a UHW VA fallback.
Rename the existing VA-pinning helper ib_umem_get() to ib_umem_get_va()
so the name is freed up. The new name is consistent with names of rest
of the helpers that are about to be introduced.
Link: https://patch.msgid.link/r/20260529134312.2836341-2-jiri@resnulli.us
Signed-off-by: Jiri Pirko <jiri@nvidia.com>
Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
When reconstructing a temporary IRQ state from the historical/old IOAPIC
redirection table configuration in ioapic_write_indirect(), the code
previously assigned 'irq.dest_id' from 'old_dest_id', but incorrectly
queried the live/new 'e->fields.dest_mode' to populate 'irq.dest_mode'.
Mixing the old destination ID with the new destination mode creates an
inconsistent, hybrid IRQ state. This discrepancy leads to an incorrect
vCPU bitmap calculation via kvm_bitmap_or_dest_vcpus(), causing subsequent
interrupt routing updates (such as RTC interrupt handling) to target the
wrong set of virtual processors if both fields were modified simultaneously.
Fix this by using 'old_dest_mode' consistently alongside 'old_dest_id' to
ensure the historical IRQ structure is reconstructed accurately.
Fixes: c96001c570 ("KVM: X86: Use APIC_DEST_* macros properly in kvm_lapic_irq.dest_mode")
Signed-off-by: Li RongQing <lirongqing@baidu.com>
Link: https://patch.msgid.link/20260528031624.1929-1-lirongqing@baidu.com
Signed-off-by: Sean Christopherson <seanjc@google.com>
this out is because the IPsec and Bluetooth PRs did not make it
yesterday. I don't want to have to send you all of this + whatever
comes next week, for rc7. The fixes under "Previous releases -
regressions" are for real user-reported regressions from v7.0.
Previous releases - regressions:
- Revert "ipv6: preserve insertion order for same-scope addresses"
- xfrm: move policy_bydst RCU sync, a fix which added a sync RCU
on netns exit got backported to stable and was causing serious
accumulation of dying netns's for real workloads
- pcs-mtk-lynxi: fix bpi-r3 serdes configuration
Previous releases - always broken:
- usual grab bag of race, locking and leak fixes for Bluetooth
- handful of page handling fixes for IPsec
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
-----BEGIN PGP SIGNATURE-----
iQIzBAABCgAdFiEE6jPA+I1ugmIBA4hXMUZtbf5SIrsFAmoZ+wAACgkQMUZtbf5S
IrtXJQ/9Gwf702wvkRaeLdqrwQ/qLsvDfx5s+3ALIE0Xsm4z9g7V0XKrZ0cfiI1h
aWGX8HugXEQuy9QvlFt09tgGEd76159g2WdlsBbh1raqiJRUw4GJKXYvwCmBZxsT
o8bwfVTQ8CVmUTCKhYrpzJKroT6jR8dKHIrkRn5ZyBOBPMOhK8rnDs1OdseW5haI
b/EkQrzzvTxd7/dJETIJszMQh/nbS5XIlKpQ+f7dfzR1gtO2GOJ24VWqrimonRTo
qvMwyt+ca2axv7Af796I8mz7X9rqLjWVWzY2uSpd7Y5zITyQwHNbeNvxzr2Ivi4g
2BcIi+ZHeeRbgQ9EL+rzapTnnIPIw0APPXnp5NnnNDj0RRG3G6PzulW9SmcdsmGD
o6E7axSZPQT/KnCw1/N7uMfB9cPzgb1i0h8rbE6tCvtkDtJwECtey7Dc7RU9zLqP
e0jWDv99+MyEqGPcu2LAg2IWLfsuQiV4priy4mM1NgOTQVgS1yw7+x0GiTqiClJ0
GcOCTOdvYKlmzhLzsLo4I+AcKZq2uJi8wNXMUEP5pmuYByVeF5j+MmoFpQspzx+L
gdUh9IctAjd47oX/uNaRtocOriU+JJEApToE9WekMb0XYd5Qx1jnt3WqB9ZFuDf4
smjUirtAWYcT3d4SXR4wGzB5WEa8TITH07A7sa8noozzNmQRu1E=
=ttPc
-----END PGP SIGNATURE-----
Merge tag 'net-7.1-rc6-2' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net
Pull more networking fixes from Jakub Kicinski:
"Quick follow up, nothing super urgent here. Main reason I'm sending
this out is because the IPsec and Bluetooth PRs did not make it
yesterday. I don't want to have to send you all of this + whatever
comes next week, for rc7. The fixes under "Previous releases -
regressions" are for real user-reported regressions from v7.0.
Previous releases - regressions:
- Revert "ipv6: preserve insertion order for same-scope addresses"
- xfrm: move policy_bydst RCU sync, a fix which added a sync RCU on
netns exit got backported to stable and was causing serious
accumulation of dying netns's for real workloads
- pcs-mtk-lynxi: fix bpi-r3 serdes configuration
Previous releases - always broken:
- usual grab bag of race, locking and leak fixes for Bluetooth
- handful of page handling fixes for IPsec"
* tag 'net-7.1-rc6-2' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net: (36 commits)
wireguard: send: append trailer after expanding head
Revert "ipv6: preserve insertion order for same-scope addresses"
net: skbuff: fix pskb_carve leaking zcopy pages
ipv6: fix possible infinite loop in fib6_select_path()
ipv6: fix possible infinite loop in rt6_fill_node()
bpf: sockmap: fix tail fragment offset in bpf_msg_push_data
vsock/virtio: bind uarg before filling zerocopy skb
Revert "esp: fix page frag reference leak on skb_to_sgvec failure"
net: pcs: pcs-mtk-lynxi: fix bpi-r3 serdes configuration
sctp: fix race between sctp_wait_for_connect and peeloff
net: mana: Skip redundant detach on already-detached port
net: mana: Add NULL guards in teardown path to prevent panic on attach failure
Bluetooth: hci_sync: Reset device counters in hci_dev_close_sync()
Bluetooth: hci_sync: Set HCI_CMD_DRAIN_WORKQUEUE during device close
Bluetooth: hci_core: Rework hci_dev_do_reset() to use hci_sync functions
Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock
Bluetooth: ISO: fix UAF in iso_recv_frame
Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp
Bluetooth: l2cap: clear chan->ident on ECRED reconfiguration success
Bluetooth: hci_qca: Use 100 ms SSR delay for rampatch and NVM loading
...
Store buffer ID in tee_shm->sec_world_id and remove internal tracking
structures to align with other TEE drivers
-----BEGIN PGP SIGNATURE-----
iQJOBAABCgA4FiEE0qerISgy2SKkqO79Wr/6JGat8H4FAmoZY4waHGplbnMud2lr
bGFuZGVyQGxpbmFyby5vcmcACgkQWr/6JGat8H42Cg//fPRFZ8igbCvGZMmfkUrc
jLJfplUW3sLPONEC5/j3mzgrtK5bCkGqh2PYCfbtVYfW67fuGzA2BJXDSrPtIaiH
tkwXL1vzTGZHHGfUpV8fHEsQM75jSyeXumptY/aIr9FkaLsaOIxz+YRbyzMAuOYn
aP3wPy3ORCgbhd51mJ+aQvbu0xC7C/JJuWGfv+UmdVFaGLUYIzLp8pzJ3LESnHQq
R8lqDUfLxu2NXmGRSZkxNQYRx9yxosmxraVSEpQYjlihz0urwQrXI55NFiHT2VRx
mks6k/ykCKHDCszYnbWIrDtuhQ7AN09iNePfkXK/6SWoAyI5vGqaotRlqyFKSIde
2AD/eQJm9jtBaGASjI2lOzlCRlbzNh9KFihPlVHCA669ho30hPAvX8ZxpgEKdj1x
JLwgrqikow9VW6wGtF5uyUyWgsRuK/adQb1s5FrL+130rAW0t0MkvDBbx3EJKBvx
yLqnmdHKIs45U8nrGA5ke9FyLuGk4Wf99r2cXoG4ZQGzIQ76irR4CFpK2LIKQMHl
WQwBCLdh/2KmB1F8dKfHFQwaFVNvhE+fuGpaetnVOBMoA0QjmTHYI0m9Ll9ZUBnU
6iKsMw1QukPaToEy6XAuAW59F1txiUB/n6Wenhgsr0UhhWRFaD4uqEx7EzwnbQnB
YKFqRKZX4KMQgtihgrRKU3s=
=D25u
-----END PGP SIGNATURE-----
gpgsig -----BEGIN PGP SIGNATURE-----
iQIzBAABCgAdFiEEo6/YBQwIrVS28WGKmmx57+YAGNkFAmoaEfQACgkQmmx57+YA
GNlNuw/8DcwlczkJeD4yaOHGoHiR/91QhxZEnsbJ47xyf6Mz4NTPRqhUob2Hm2NE
1F2gBEe8hX+ywYkaQBozopRVXSeiAtz9yhfNUxaFK9/B4QK5QDQPj2rTqreUtshy
qMyb0Y+dCzuKxM1Zt1vVKr2NnCbZ6vGfrzsrLOS2HLWfIGAPoN7vur1ffgTipsBW
XxbVGj9mLVBiBBGOAiZFJMuLsqKasQS+RbuRmA3E1sZ+GT9ilLkj14dUvoK3pLU6
4OQZH3JfkHJDoziHz/qJdgRhr7gVWdiWhhLv8WnG40xjcnFAbeLoNeHUgG9JjaBM
7yOnRsQyChRVYDHNMko//7Thi2p5pL2lqSTBcllP4quP7jeM209fi2zOKzqbty0Q
N4PcMpJUctGailBYYnOBT3Cma+jKY7wQ08z3illC1yVaWtHkn4VwQmnKuS0da7+X
NkQU5tvQ8lb1OUSqEE3klvSGM/sUk/g95vjGbnx3ftkwDeN1YJjmzd1ft+WdzWrj
FD0ia88OHyKkXGA+/5NW92mOW36Kd2OMtKy84MMbuUGYXVY4ExMz3jTw9XztJ07s
rwdY2LNVPan2bqZXkhJjBW++LMpAC/JQfsSnOtv2KPAE2X7wHi4UM61WWgv0IOxc
yu6v7asMca4Ie15IV0u7684xiaRNH9OzP2hYY43vrS4QpmhTwoE=
=pc2V
-----END PGP SIGNATURE-----
Merge tag 'amdtee-for-v7.2' of git://git.kernel.org/pub/scm/linux/kernel/git/jenswi/linux-tee into soc/drivers
AMD-TEE update for 7.2
Store buffer ID in tee_shm->sec_world_id and remove internal tracking
structures to align with other TEE drivers
* tag 'amdtee-for-v7.2' of git://git.kernel.org/pub/scm/linux/kernel/git/jenswi/linux-tee:
tee: amdtee: store buffer ID in tee_shm->sec_world_id
Signed-off-by: Arnd Bergmann <arnd@arndb.de>
1. The FF-A core is moved onto the driver model by reverting the earlier
rootfs initcall change and registering the core as a platform driver with
a synthetic arm-ffa platform device. Enumerated FF-A devices are now
parented below the FF-A core device, and probing is deferred until pKVM
has completed its FF-A proxy initialisation.
2. The platform-driver conversion is also adjusted so systems without FF-A
support treat early unsupported transport/version discovery as a quiet
probe miss rather than a failed matched probe.
3. The register-based partition discovery path now honors the descriptor
size reported by FFA_PARTITION_INFO_GET_REGS. This keeps parsing aligned
for newer FF-A descriptor layouts while still copying only the fields the
driver understands.
4. Also included is an Arm SMCCC fix for the optional SOC_ID name call: the
name query now uses the SMC64 function ID required for returning eight
characters per register.
-----BEGIN PGP SIGNATURE-----
iQIzBAABCAAdFiEEunHlEgbzHrJD3ZPhAEG6vDF+4pgFAmoXBagACgkQAEG6vDF+
4pg5Kg/+MOto5ThmWsJ42dMf/u96JDu+U5zdqnzt0wECS8wLMDyTT/t7KLz8KDQO
7fBm1S7apWN/HsS4RaIIEJZx0Rb5qbg7X4rQXEvIw1m/YjjF5ktp0AgGC3kb1SzY
SHntcPW2YGaDtdkoXhAy5laLl0nkjoVsdiv5QYdl7NE7XvaTmMs128P58P3UZlmu
ubU3ua2+nyDyQewK6I4yIjAx530lvuGJPiOB2/2t4QTnMzhtMOPlBzSEvqDK/+fm
2XvqZcWJuSnHmKqXtRmEhf3qKYxzLeoRQ45vE3BUE6DB2rvA6GRzitWItzmxwqU9
W2HD1wqe09bWROYVgw/fSB1fMlf2rbXFP4MHp7rr3XcZdaS7paP/c9eoMkUknON2
QdFKG8pnwICeuWfsU59wLjzOo7ebcRjRPpLj9LwKTj6k4ixee/i0E2ldUhViG75Z
FUtiQtbf3ArBBEIhVNrlhl7Z1AkMUVAOvDJpvz4ELcvndTcSYE03uZG7BcJ1f79H
t6KC001TeGuXAEzcbJnCiWTMufHvuWfbz6vSiE0iaJ8jpLruJHz0u3nN4Ywii/7q
T+WM1oAdiS+bDvdWTD+LQiAOypMcrTUNJp9eNAMWAspg9Ih+r3pqqUXOzHuwlgPt
8l/S6cK1NDBlmANZ3Pvw65vjWUTY1Cc1yejDJjAe3kXO5CNovxM=
=oqtn
-----END PGP SIGNATURE-----
gpgsig -----BEGIN PGP SIGNATURE-----
iQIzBAABCgAdFiEEo6/YBQwIrVS28WGKmmx57+YAGNkFAmoaEKoACgkQmmx57+YA
GNlE0g//VzWrRkCRjjHaapPL5lPcmsDMt3DMeGeDg8780ektIQm60TUhTT1GAAB7
ixnXrimBGItglKQct/CAm09bZGrhnfPvUndkA9Orj6YNrF506AAA9tRgBTWdtIOp
60x63+cGHcO4+FXDklX4Ux6CiGnSRS8RFGxYVHfFhGNmwDN/fresDRFOuGlf+ey5
4Op2xzgmgjZMstLZ0ecz7A3XPl+brxXvLIlatmn+fQ4VI928oTbEJK8MZcx7U9gW
yecdiP4K8xR82o+EA8aIUaLcisRrkD7vcQeaRkHGU8rF0ncHOEULVPjGQyEbxkJj
fPudSBvAFehG7ARHfmqfKxofIglJ/lsVnGpWnBr5tcpUW4nURk0W75+rpsTO+GcH
M5u1+nJb4c+l8ajNRb+8oKUL3SjDsjwdCIo8y4Bqjzmcxuwn72JLphhSfAS9fKwg
SOTeaJlCC5qbo4kMCiVEqg5skm8y0h0qd3NhGHG/3TUZXtVcqZroI3vXOaowpKz4
H0WWeIUNQy31x5sOnUulmiARoFbBAEJrBdjlfcLsEMFIX0O5BSOhRcZnXUIsGURM
u9Ul0V9jnMYEM+BZ+ImIEVypT/uHo4/eX/s/RdSC0xhT54UJDSgooQzbl4zEpQ6K
2TaomWgZL+O95MwxHXTVz4I8DplFUkI7kBT89Hj9gW5FTJ/wRdc=
=J4Bj
-----END PGP SIGNATURE-----
Merge tag 'ffa-updates-7.2' of git://git.kernel.org/pub/scm/linux/kernel/git/sudeep.holla/linux into soc/drivers
Arm FF-A + SMCCC updates for v7.2
1. The FF-A core is moved onto the driver model by reverting the earlier
rootfs initcall change and registering the core as a platform driver with
a synthetic arm-ffa platform device. Enumerated FF-A devices are now
parented below the FF-A core device, and probing is deferred until pKVM
has completed its FF-A proxy initialisation.
2. The platform-driver conversion is also adjusted so systems without FF-A
support treat early unsupported transport/version discovery as a quiet
probe miss rather than a failed matched probe.
3. The register-based partition discovery path now honors the descriptor
size reported by FFA_PARTITION_INFO_GET_REGS. This keeps parsing aligned
for newer FF-A descriptor layouts while still copying only the fields the
driver understands.
4. Also included is an Arm SMCCC fix for the optional SOC_ID name call: the
name query now uses the SMC64 function ID required for returning eight
characters per register.
* tag 'ffa-updates-7.2' of git://git.kernel.org/pub/scm/linux/kernel/git/sudeep.holla/linux:
firmware: arm_ffa: Treat missing FF-A feature on a platform as a probe miss
firmware: smccc: Fix Arm SMCCC SOC_ID name call
firmware: arm_ffa: Honor partition info descriptor size
firmware: arm_ffa: Defer probe until pKVM is initialized
firmware: arm_ffa: Set the core device as FF-A device parent
firmware: arm_ffa: Register core as a platform driver
Revert "firmware: arm_ffa: Change initcall level of ffa_init() to rootfs_initcall"
firmware: arm_ffa: Fix sched-recv callback partition lookup
firmware: arm_ffa: Snapshot notifier callbacks under lock
firmware: arm_ffa: Align RxTx buffer size before mapping
firmware: arm_ffa: Validate framework notification message layout
firmware: arm_ffa: Keep framework RX release under lock
firmware: arm_ffa: Bound PARTITION_INFO_GET_REGS copies
firmware: arm_ffa: Unregister bus notifier on teardown for FF-A v1.0
firmware: arm_ffa: Fix per-vcpu self notifications handling in workqueue
firmware: arm_ffa: Avoid collapsing NPI work from different CPUs
firmware: arm_ffa: Skip free_pages on RX buffer alloc failure
firmware: arm_ffa: Check for NULL FF-A ID table while driver registration
Signed-off-by: Arnd Bergmann <arnd@arndb.de>
- Account for recently implemented -Wattribute-alias in clang by
disabling it in the same places it is disabled for GCC.
Signed-off-by: Nathan Chancellor <nathan@kernel.org>
-----BEGIN PGP SIGNATURE-----
iHUEABYKAB0WIQR74yXHMTGczQHYypIdayaRccAalgUCahnrhQAKCRAdayaRccAa
loxRAP0dhAttt5Nzj1QVvVshp5gUdELM+zXD1qyXAY9Z81V3rgD8C867ax5pGAgO
kV2PwaBK5P6FJ8joUz4m3qB20FXXYQs=
=drMM
-----END PGP SIGNATURE-----
Merge tag 'clang-fixes-7.1-2' of git://git.kernel.org/pub/scm/linux/kernel/git/nathan/linux
Pull clang build fix from Nathan Chancellor:
"A small fix to disable -Wattribute-alias for clang in the few places
it is already disabled for GCC, now that tip of tree clang has
implemented -Wattribute-alias as GCC has"
* tag 'clang-fixes-7.1-2' of git://git.kernel.org/pub/scm/linux/kernel/git/nathan/linux:
Disable -Wattribute-alias for clang-23 and newer
This reverts
dc8aa31a7a ("x86/fpu: Refine and simplify the magic number check during signal return").
The aforementioned commit broke applications that construct signal frames in
userspace (such as CRIU and gVisor) if the frame's xstate size is smaller than
the kernel's fpstate->user_size.
Furthermore, this introduces a critical issue for checkpoint/restore tools
like CRIU. If a process is checkpointed while inside a signal handler, its
stack contains a signal frame formatted according to the source host's xstate
capabilities.
If that process is later restored on a destination host with larger xstate
capabilities (e.g., a newer CPU with more features enabled, resulting in
a larger fpstate->user_size), the kernel will look for FP_XSTATE_MAGIC2 at the
destination host's larger user_size offset instead of the offset encoded in
the frame's fx_sw->xstate_size.
This causes the magic2 check to fail, forcing sigreturn to silently fall back
to "FX-only" mode. Upon return from the signal handler, the process's extended
state is reset to initial values instead of being restored, leading to silent
data corruption.
The aforementioned commit cited
d877550eaf ("x86/fpu: Stop relying on userspace for info to fault in xsave buffer")
as justification to stop relying on userspace for the magic number check.
However, these two changes are fundamentally different. The last one only
changed how much memory the kernel ensures is paged-in before running XRSTOR
to prevent an infinite loop. It did not change the signal frame format or how
the layout is validated.
Reverting this change restores the use of fx_sw->xstate_size for
locating magic2 and restores the necessary sanity checks, ensuring that
the signal frame remains self-describing and portable.
[ bp: Massage commit message. ]
Fixes: dc8aa31a7a ("x86/fpu: Refine and simplify the magic number check during signal return")
Signed-off-by: Andrei Vagin <avagin@google.com>
Signed-off-by: Borislav Petkov (AMD) <bp@alien8.de>
Acked-by: Chang S. Bae <chang.seok.bae@intel.com>
Cc: stable@vger.kernel.org
Link: https://lore.kernel.org/all/20260429000623.3356606-1-avagin@google.com
1. Improve SCMI clock handling with a protocol-level determine_rate operation,
simplified per-clock rate properties, dynamic rate allocation, bounded
iterator support, lazy full-rate discovery, and hardened parent/rate
enumeration.
2. Fix several SCMI bounds and payload validation issues, including clock rate
discovery OOB handling, power domain name lookup, Powercap domain state
access, BASE_ERROR_EVENT and SENSOR_UPDATE payload sizing, and sensor config
width handling.
3. Rework SCMI transport probing for virtio and OP-TEE using per-instance
transport handles and a generic transport supplier, removing the need to
register SCMI core drivers from transport probe paths.
4. Add i.MX SCMI MISC reset reason support and print i.MX95 boot/shutdown
reasons via the System Manager interface.
5. Clean up SCMI core internals, including base-info naming, quirk parsing and
table iteration, and list iteration.
6. Fix SCPI clock provider removal so child clock providers are unregistered
using the same DT nodes used at registration time.
-----BEGIN PGP SIGNATURE-----
iQIzBAABCAAdFiEEunHlEgbzHrJD3ZPhAEG6vDF+4pgFAmoXAwkACgkQAEG6vDF+
4piLrBAAzNS5ccs/3KAMvaFW5g3amS+FmHv4m1tzM+YmQOKjdVtysohzdHsTD0Ox
C6No2+jFJUrtAZnENc32lTTpnHqg8QVWTujP88L17EHH0TlCQDOJb8IR7mVKFkva
pk7Ll7dKeVTEU0lXlrK33MaVUyYAT6QFKw0jhbDCtGnmvZDbKG7Ez4ph/WODywBe
PtKRZK0hUQNm6wyEOVep4in36P3p8vR+xn6wFR37ndbXkyvJULC45af8SceoaClH
2doWr7nTh7rJL9ythaZ5qBodOV2IGCcAEsnxRqKdw++CBxYEApiFgCc9cT203yPw
IoHx+/XEwt/a2K8LjJmYnai2ds5mYUMJp2uJO6FaVoeIfU/VQE8DeI1Ri2w/dS9d
O+xoNf8Tu5phbJg3RCDXsotzNSdruqSxI4AgKl+g6XeFZJH4N2SNKrmw2trr+jpX
FN2SJBcogXsxrza/inIUaZ8qKxz2249kHgIbwKAjXdQrnxDPhPGa8ng//rh20jN6
wNISU6dfVtgVV7bP3M2oedAmiFdt8ltxnFXOJf+bRNEJwwDcsmNKa9LuJOEJAc1r
cvfuX6q64Ho+ZZDqnlZsoa7Ho0LNJsg080Y/dGKRR6Llebw0y1kaIxrbiQ6sjqkH
295U0fQOuIeUB7hA+Fb4o0IsXz5wXJE2Ri7qUU1PcqLfBAyNRbU=
=dgQR
-----END PGP SIGNATURE-----
gpgsig -----BEGIN PGP SIGNATURE-----
iQIzBAABCgAdFiEEo6/YBQwIrVS28WGKmmx57+YAGNkFAmoaDYAACgkQmmx57+YA
GNnRLBAAnLjHzohhPXs1LwoTjTTpGZOllBAn3MRejiF8Y/QMhWw2CcWeahlfH5uF
307HXNYZbhV7hFvDHwUeTOywJxLKuBBez5GHp+XqN1sPhZsh0/+fVSSnBDERV6ix
ZYra48jAx5yBuRP6gFlKMam0LqplToYZMRMXXmSAmF4/ljkX7SJNwH6ZkzTwqrc4
KOHcfGE67+N+D9jY8q7OHXnkCJ+M3bOQSc93bOu6l3uHHieEjBGpnUx3lKl1lKdn
3DpOhz1+lfFQOC1B1eul2cY+mPjliE6wnFOh2/7+z8+9FP1h3NXxfWRz2e9CdouP
ATYjMhlrF8gDsUO1q8os/04T5iVhpZvclc3nO5sVY7DIiic7vjLiuNunVLPW0NHZ
41vhLaUXYyU9OTbb/IHjlT6P+K6zzkPzV7uGdCzs9Yrv8T56jp88LQ9AtDXGB48t
PQwjpeiPZa0xsDRh8HtU17yjd5JacHObPJwrmGZMWSU+Q7GE2cYaTuU2Axeiy+Fw
uZndAm2Eka6KHLzkbac2eXLKtgc7/mafKykhTBdGCwis9glN9TfUM/160GwINKih
r8CjArp9wr3wc3ari/vTaEcSkFoFlRl6l7IKeUnUX6FQv9HYwn7FO2ZwzICT9Ms1
0niUuBk8Kei+NQhKHv+ncriT7SxtHdTPkGcntp722FvsECVSlfI=
=HwlH
-----END PGP SIGNATURE-----
Merge tag 'scmi-updates-7.2' of git://git.kernel.org/pub/scm/linux/kernel/git/sudeep.holla/linux into soc/drivers
Arm SCMI updates for v7.2
1. Improve SCMI clock handling with a protocol-level determine_rate operation,
simplified per-clock rate properties, dynamic rate allocation, bounded
iterator support, lazy full-rate discovery, and hardened parent/rate
enumeration.
2. Fix several SCMI bounds and payload validation issues, including clock rate
discovery OOB handling, power domain name lookup, Powercap domain state
access, BASE_ERROR_EVENT and SENSOR_UPDATE payload sizing, and sensor config
width handling.
3. Rework SCMI transport probing for virtio and OP-TEE using per-instance
transport handles and a generic transport supplier, removing the need to
register SCMI core drivers from transport probe paths.
4. Add i.MX SCMI MISC reset reason support and print i.MX95 boot/shutdown
reasons via the System Manager interface.
5. Clean up SCMI core internals, including base-info naming, quirk parsing and
table iteration, and list iteration.
6. Fix SCPI clock provider removal so child clock providers are unregistered
using the same DT nodes used at registration time.
* tag 'scmi-updates-7.2' of git://git.kernel.org/pub/scm/linux/kernel/git/sudeep.holla/linux: (31 commits)
firmware: arm_scmi: optee: Rework transport probe sequence
firmware: arm_scmi: virtio: Rework transport probe sequence
firmware: arm_scmi: Add a generic transport supplier
firmware: arm_scmi: Add transport instance handles
firmware: arm_scmi: Fix OOB in scmi_power_name_get()
firmware: arm_scmi: Validate Powercap domains before state access
firmware: arm_scmi: Validate SENSOR_UPDATE payload size
firmware: arm_scmi: Validate BASE_ERROR_EVENT payload size
firmware: arm_scmi: Read sensor config as 32-bit value
clk: scpi: Unregister child clock providers on remove
firmware: arm_scmi: Introduce all_rates_get clock operation
firmware: arm_scmi: Fix OOB in scmi_clock_describe_rates_get_lazy()
firmware: arm_scmi: Use bound iterators to minimize discovered rates
firmware: arm_scmi: Use proper iter_response_bound_cleanup() name
firmware: arm_scmi: Fix bound iterators returning too many items
firmware: arm_scmi: Add bound iterators support
firmware: arm_scmi: Refactor iterators internal allocation
firmware: arm_scmi: Harden clock parents discovery
firmware: arm_scmi: Make clock rates allocation dynamic
firmware: arm_scmi: Drop unused clock rate interfaces
...
Signed-off-by: Arnd Bergmann <arnd@arndb.de>
Enable QSEECOM and with that access to UEFI variables on the Surface Pro
12in laptop.
Refactor the Geni Serial-Engine helper code to allow the serial engine
drivers (such as I2C) to operate on targets where power and performance
is controlled through an SCMI server instead of individual resources in
Linux.
Extend the LLCC driver to support reading its data from a System Cache
Table (SCT) in memory instead of being hard coded per platform in the
driver. Also add support for the Eliza platform.
Add support for the Hawi platform to pd-mapper.
Switch the SMEM driver to track partitions using xarray to handle the
ever growing number of hosts better.
Extend the socinfo driver with knowledge about the Nord, SM7750,
IPQ9650, and Shikra SoCs, as well as PMAU0102, PMC1020H, PMIV0102, and
PMIV0104 PMICs.
Define UBWC 3.1 and add a couple of convenient helpers in the UBWC
library for MDSS and Adreno.
Fix a memory leak in the WCNSS firmware download mechanism.
-----BEGIN PGP SIGNATURE-----
iQJCBAABCgAsFiEEBd4DzF816k8JZtUlCx85Pw2ZrcUFAmoVuSUOHGJqb3JuQGty
eW8uc2UACgkQCx85Pw2ZrcUJoBAAxf+8fFvYZif2gk1wzA01IINQgB5/2gYu9oSW
Ex4YrHF2wV3BlzRjDnoQ9yC9mYyQeAwqy0pHPIEhJrh5pTc7sJLH5P+iXwe0JU2e
GD6WtxRlSswIhDcmoJokSWNkyQxGu540Mh140/Bd0Pb0tMelh76wmzcpY31tzDOa
APmtPCXWOdMGYAJSA5DMUMlKEENBNuD7yg0sYtoNz4+XVv4nsjMviEspyNN/fWHg
UvL7IJPFwiKynsYrohTgFS5spXOR79aR1xPVsujoUVhzV/W0NFXiDgGLZa41QBAJ
lfqmxQiNCZ6I3n2R4X1OULXy9vLZalLiXQzMOJhvPbjXjW1R6jy40f5+W9SZnNSH
Q33nbkpJWG81gN5GeqwdPi1+gDDIMyw4A3+RaqRPJBYkYzG1NU2YD5ZNFpMrfRta
BT0Nzs8wdmMQgHDGXhjuzMC1hrm9b8QOT12GUnm2hcL7DIJsJC2mtLmlrvnQSm8y
3iPDrEhok2GzSXOKs1EkRfennjLG2MM54Bv7WosNJjrQi2FWkwU2OeNavDxkHo4G
JTWwOPFoRysHqmqLr9aIvQGV9lQ2W+57CqnjrbVeMNclJNUm0usZX/i3zX9jCG7R
SGwdslqlE/PqJWjUN8S/+LECI54axJXlp3KE6+m+nkEsOQcYIxwU/PfZiG1vyJu1
0Y22gro=
=mOpO
-----END PGP SIGNATURE-----
gpgsig -----BEGIN PGP SIGNATURE-----
iQIzBAABCgAdFiEEo6/YBQwIrVS28WGKmmx57+YAGNkFAmoaDQQACgkQmmx57+YA
GNm/KxAAumqFwdnLIK37ui8u3FG1he/Pal9RwXR0dJkLTAYmCK5vd/e/GEjTL0BG
W2Zv+Gt1kvm0BZ10b7AaQNKx5jnE7AsglOTHXXW8pVmZW7w1Fz8CP96SiZz2iKb0
Fqpuq8utUg7fxYzYZuPGMWNQVSf0dliZrygp8iTHop/2iaJzL/dOQHBtXSXvuJVW
FhCYtaDIBXpLzbFpe8z+QMM5bYmgiIF8zqdmOSe92LYVVWv1WNzflu8+fGDCxv9z
EhsLdkM62xCR2a5YE0Tx0/44hw6sGh7ffnfkkIrEJvIBtkjxoERc0TRGXcvTeUnp
bX4H1d/kanzvUu+0KrP+fxiCQL1DmiUi8SOEFx0YUSrBSp0HtIdgVyLxM6Q0UYdc
JP95xqb/SfvVGRf3FFrP8NlIwM7n8NGpV8PqUnQ0K+NVUnsQWPJPZ+lkyCjX6G3b
pXR/eSe4OBu3xjUAB2x7r0YQbEjlB1FeVQEA5lRdlW5QSzty/kLgUm/z+4rLQSq1
Zmw9rL28SnlOsoESF0/EAgNUTFfG+cA1wERwa9BdQbb3CzWxKU6QsAInL6ZEp1xI
eTtGI+ia9yUv4pzMOiuv00seQQ2A45Qww6xkgsM2n0wbP1Bza9Rrkc1w9exK36ho
JZkQ773gwyEYyRfHoobYyFRYtMve4JOWCjGjL5F3Gtw3YddABXU=
=ryJr
-----END PGP SIGNATURE-----
Merge tag 'qcom-drivers-for-7.2' of https://git.kernel.org/pub/scm/linux/kernel/git/qcom/linux into soc/drivers
Qualcomm driver updates for v7.2
Enable QSEECOM and with that access to UEFI variables on the Surface Pro
12in laptop.
Refactor the Geni Serial-Engine helper code to allow the serial engine
drivers (such as I2C) to operate on targets where power and performance
is controlled through an SCMI server instead of individual resources in
Linux.
Extend the LLCC driver to support reading its data from a System Cache
Table (SCT) in memory instead of being hard coded per platform in the
driver. Also add support for the Eliza platform.
Add support for the Hawi platform to pd-mapper.
Switch the SMEM driver to track partitions using xarray to handle the
ever growing number of hosts better.
Extend the socinfo driver with knowledge about the Nord, SM7750,
IPQ9650, and Shikra SoCs, as well as PMAU0102, PMC1020H, PMIV0102, and
PMIV0104 PMICs.
Define UBWC 3.1 and add a couple of convenient helpers in the UBWC
library for MDSS and Adreno.
Fix a memory leak in the WCNSS firmware download mechanism.
* tag 'qcom-drivers-for-7.2' of https://git.kernel.org/pub/scm/linux/kernel/git/qcom/linux: (40 commits)
soc: qcom: geni-se: Introduce helper APIs for performance control
soc: qcom: geni-se: Introduce helper API for attaching power domains
soc: qcom: geni-se: Add resources activation/deactivation helpers
soc: qcom: geni-se: Handle core clk in geni_se_clks_off() and geni_se_clks_on()
soc: qcom: geni-se: Introduce helper API for resource initialization
soc: qcom: geni-se: Add geni_icc_set_bw_ab() function
soc: qcom: geni-se: Refactor geni_icc_get() and make qup-memory ICC path optional
soc: qcom: llcc-qcom: Fix NULL vs IS_ERR() bug in qcom_llcc_get_fw_config()
soc: qcom: llcc-qcom: Add support for Eliza
dt-bindings: cache: qcom,llcc: Document Eliza LLCC block
soc: qcom: ubwc: add helper controlling AMSBC enablement
soc: qcom: ubwc: define helper for MDSS and Adreno drivers
soc: qcom: ubwc: define UBWC 3.1
soc: qcom: socinfo: Add SoC ID for Nord SA8797P
dt-bindings: arm: qcom,ids: Add SoC ID for Nord SA8797P
soc: qcom: socinfo: Add SoC ID for SM7750
dt-bindings: arm: qcom,ids: Add SoC ID for SM7750
soc: qcom: socinfo: Add PMIC PMAU0102
soc: qcom: socinfo: Add PMIV0102 & PMIV0104 PMICs
firmware: qcom: scm: Allow QSEECOM on Surface Pro 12in
...
Signed-off-by: Arnd Bergmann <arnd@arndb.de>
This reverts commit 3812a9e842.
The probe ordering fix in the following patch ensures amd_gpio_probe()
completes before i2c-designware probes AMDI0010:02, allowing the
existing amd_gpio_irq_enable() flow to work correctly. The manual IRQ
restoration added by this patch is therefore no longer needed.
Link: https://bugzilla.kernel.org/show_bug.cgi?id=221494
Signed-off-by: Hardik Prakash <hardikprakash.official@gmail.com>
Reviewed-by: Mario Limonciello (AMD) <superm1@kernel.org>
Fixes: 3812a9e842 ("pinctrl-amd: enable IRQ for WACF2200 touchscreen on Lenovo Yoga 7 14AGP11")
Signed-off-by: Linus Walleij <linusw@kernel.org>
Fix probing of Atmel EBI memory controller driver e.g. on at91
sam9x60-curiosity board due to usage of platform_driver_probe() which is
not handling deferred probe. Lack of EBI driver caused dependant NAND
controller to fail to probe, basically failing entire board boot.
-----BEGIN PGP SIGNATURE-----
iQJEBAABCgAuFiEE3dJiKD0RGyM7briowTdm5oaLg9cFAmoZPZ4QHGtyemtAa2Vy
bmVsLm9yZwAKCRDBN2bmhouD1wBTEACWlhnslXLbIma+QXkLDvVG4wi+WvDLMM+q
nQGXDwFa5bkmE9dwlkVeLiDMIhBj+q0WMgH3ctHQCPyde2l8vIvdkuWM+HyGgFTs
eNmQTIFyn09YayZTzWE/5q/fJcIBMeFyfLPDnf562qs+cWu7BxfT8M4jvvdpQ9QH
BJZbBLq4l80+X6Q1AlLP4djklY7CRosV/8Acuo2cIaiIEPVEWaGdFX5EcGSqSvFf
3uMIHw/X+BiHpsZv02NLFOF57El3COEJNrgaiSUM9NtUkPfgvrIIBZgUwhdvG81r
0+3eUKqL1jvZc2K6QLUvNR9lWuCE+5g4jVhgF+mPkXyIKu5Nl1x1JO09Q+IBTkZd
r+rJFn+mBdAFGc0gHufHNyP8QiXntmCn0BVp6paBH0RQUroC3MWaJaYGxyk1fUA4
ohCtRqFUqkDyDebqLrtZAe1R87B382Ia+477h5pRvivEViVrRFm+n3TJl2k54Gcw
eTs/HFv58jn2122Uz2vOmUMVlVQsbrzrm1LpPHoAmkcDkogkRSDaGUK/o3RLvh1l
nzIelNNL3KNpw6R6wHzEJUINS31VgVxc6WadK60py5MmmoGvS1hIXOF6/iBx8Vk6
RAyuW1LNuj6eAhwmBK6h2tQn+Gs/pidymlrassdxzPUwrft7mMuc2CwfL92QAwtN
X3eFiWuayw==
=4VXt
-----END PGP SIGNATURE-----
gpgsig -----BEGIN PGP SIGNATURE-----
iQIzBAABCgAdFiEEo6/YBQwIrVS28WGKmmx57+YAGNkFAmoaB6MACgkQmmx57+YA
GNl5aQ/+LKUsj8Z1+ldO3y8RznLbgD4eszkgT3vjUrGj1VxdBijHL/EWqBtfacoJ
Lat6nNMmFeE8LcDqStm3SwM20N2m5PaXFPcIeDaDL/ZiM+v3YfCTvX4lkzQGJ1B7
dIs89cPyMQX2qwF8+uKRZou80RNAwRWTp/zT0Q7sIxnzsQ6Gz2tybuxEZ2abgdmT
X2F1HY3ex8TXTA+NqfJLubf9eHtbXxI1KqFtjU9+YI83OHFqSPNHLNmKCNH0uHkn
vhGXZgX6RuebtYCw0Fo73cLm3UUj24204pVuujA07OmQmPiZ5Xvp1wMGZtmNkzQU
L1f3Pav+UDopM6IIzbc2d+Y/YSvupS8ADkaYmcsxLo2KTpdRyRrEf3If2AiQGpxG
kTCLKWkXDVg8SQic0W+jHC+8wnm9Ec8Idp08s/4XPlA1vSo8MRSE+TDHBmDGgDhQ
IqvddJE+uT2ZW1yU2Wao7rfQ3KRaWuz7xPYb7ySilAn1i6LtCjysUaDISxRBCiYQ
bQoxXvvWdmqg8aDpsRyhW2mwQN+4vEeq/IH73XoiZH6jzTj9wReHbudKDG1gREFx
X/0tBBwuuJhwNbtOj+DVrJlM1WqPDjb7zw6yzEinf3LzvEYR8BGK+R0w3mWa8Eal
bJCEjHg4mx6LEkFdleFmhLyAL7fVJoxydmpb3HpQ+5r0xk01YhM=
=8TQP
-----END PGP SIGNATURE-----
Merge tag 'memory-controller-drv-fixes-7.1' of https://git.kernel.org/pub/scm/linux/kernel/git/krzk/linux-mem-ctrl into arm/fixes
Memory controller drivers - fixes for v7.1
Fix probing of Atmel EBI memory controller driver e.g. on at91
sam9x60-curiosity board due to usage of platform_driver_probe() which is
not handling deferred probe. Lack of EBI driver caused dependant NAND
controller to fail to probe, basically failing entire board boot.
* tag 'memory-controller-drv-fixes-7.1' of https://git.kernel.org/pub/scm/linux/kernel/git/krzk/linux-mem-ctrl:
memory: atmel-ebi: Allow deferred probing
Signed-off-by: Arnd Bergmann <arnd@arndb.de>
