This contains one driver fix for the current cycle.
- interconnect: qcom: sm8450: Fix NULL pointer dereference in icc_link_nodes()
Signed-off-by: Georgi Djakov <djakov@kernel.org>
-----BEGIN PGP SIGNATURE-----
iQIzBAABCgAdFiEExQ4tCsdmOu34XfMFgNDMCsbYFmMFAmnCqX8ACgkQgNDMCsbY
FmP7/hAAgyciZSmTF38nkOxsQokFogqVZ8YVygD0mG9CK2JL3cESaDVTPRg88fgX
gAYqtnNDxNzdvTY2ZFk5JX60aym/PPn2eGHPRLSqrOTeVsCIi/SMAT8TxQ4tqCuY
RofCKrktUEXpJy3gsP7Q4mLm/yCtKELLhxq8vc0ko9/35A+GgqWJtzyWOkW/3qnW
XLORjLPwLJx5/hc+TqtQbGJzYfh9OhfJYXZU01auWeArlFp8Y3LLR/LJx9aySfkq
g9IdGX7h6HHrEpOhMoZYNnUWGauMb4qMo7B5r9Cgr5KnW56Hk6sOBdvIszu283EM
K3gxna2hLcua9JbgVLm1XUlLgu5fXb1K/+oh89qiSPSAwUK2f6dMD83uVS3FsGxG
HvryvOyg748L8u8qnulctdmRY++yg1yfH5lTdfoYInkml1YVQ+kJZZ0la2jJoCpJ
wkvpZP0LBlHeejGMyJ/q2r7aMcJLLO8UJi96YZtU1FU824jIxXwmokm3l9JtPcAR
0Fg0DE3dULGPULJ89b4nwPKVFUN34GqcfqmMMZmXCJtubPV4yy+PvE6KS7PlzG4o
eWxMU7eTFh8tTlG2EiRZoAC36CCwOsKDV82BESn6Qkvd/pVQ+NubrmbhBRAaCMXP
1Wp3eUXK05JoCo9gOql2hJH34/tPQfmq9W14oZfDPeo87+Gz2TY=
=3arT
-----END PGP SIGNATURE-----
Merge tag 'icc-7.0-rc6' of ssh://gitolite.kernel.org/pub/scm/linux/kernel/git/djakov/icc into char-misc-linus
interconnect fix for v7.0-rc
This contains one driver fix for the current cycle.
- interconnect: qcom: sm8450: Fix NULL pointer dereference in icc_link_nodes()
Signed-off-by: Georgi Djakov <djakov@kernel.org>
* tag 'icc-7.0-rc6' of ssh://gitolite.kernel.org/pub/scm/linux/kernel/git/djakov/icc:
interconnect: qcom: sm8450: Fix NULL pointer dereference in icc_link_nodes()
Includes merge of v7.0-rc4 to pull in a fix and a merge of
ib-iio-thermal-qcom-pmic5 immutable branch (provided from the IIO tree so
thermal could also pick this up and add thermal specific remainder
of the series on top.
New device support
------------------
adi,ad4030
- Add support for ADA4316 and ADAQ4224 ADCs with PGAs.
adi,ad4080
- Add support for AD4082, AD4085 and AD4088 ADCs.
adi,ad8366
- Add ADRF5702 and ADRF5703 digital step attenuators.
adi,adxl372
- Add support for the ADXL371 accelerometer after refactors to allow multiple
device variants to be supported by the driver. In particular a silicon
issue means the hardware FIFO doesn't work on the ADXL371
bosch,bma255/bmg160
- Add support for BMX055 gyroscope and magnetometer (effectively separate
devices from point of view of interface).
lltc,ltc2309
- Add support for LTC2305 2 channel 12-bit ADC.
lltc,ltc2532
- Add support for 4 variants of the LTC2654 quad DAC.
maxim,ds4424
- Add IDs for DS4402 and DS4404 parts. Initially patch is ID only but additional
features also added that are device dependent.
qcom,spmi-adc-gen3
- New driver supporting this generation of Qualcomm's SoC ADC.
st,vl53l1
- New driver for this Time Of Flight (TOF) sensor.
ti,ina2xx
- Support the INA236 digital power monitor.
vishay,vcnl4000
- Add support for CM36686 ambient light and proximity sensor.
- Add support for CM36672P proximity sensors.
ID only additions.
amlogic,meson-adc
- Support the Meson S4.
Features
--------
iio-backend framework
- Add capability discovery so front end drivers can know what features are
available from the backend and adjust how they operate.
adi,ad4030
- Add SPI offload support requiring a non trivial PWM setup.
adi,ad7380
- Add support for multiple SPI lanes to improve throughput.
adi,ad7768-1
- Support SPI offload and always use continuous mode, enabling more
filter options.
adi,ad8366
- Device tree bindings and support.
aspeed,adc
- Handle battery channel.
maxim,ds4424
- Add external resistor controlled scale and per-variant limits.
- Handle per variant range limits.
- Move it to regmap.
motorola,cpcap-adc
- Support for the ADC found on the Motorola Mot board. Effectively some board
specific configuration handled in the driver.
vishay,vcnl4000
- Support explicit power supply regulators.
tyhx,hx9023s
- Allow device tree specification of firmware file name.
Cleanup and minor fixes
-----------------------
treewide
- Remove a bunch of unused structure elements.
- Replaces standard fixed width integers with kernel types.
- Replace some other error values that were returned on allocation failure
with -ENOMEM
iio-core
- Replace a few custom devm implementations for devm_add_action_or_reset()
iio-trigger
- Use put_device() to cleanup on error.
iio-backend
- Use __free(fwmode_handle) to simplify some code.
hw-consumer
- Use separate allocation for scan mask bitmap to simplify code.
acpi-als
- Switch from ACPI driver to platform driver.
adi,ad4030
- Use BIT() to replace values that are always a power of 2 to slightly
improve readability.
adi,ad4062
- Add a missing check for error form iio_get_current_scan_type()
adi,ad5933
- Use div64_ul() rather than do_div() as remainder was not used.
adi,ad7191
- Documentation fixes related to clocks
adi,ad7816
- Use sysfs_emit()
adi,ad8366
- General driver modernization
adi,adf4350
- Change a TOOD to NOTE in a comment to avoid anyone from walking into
a tricky to improve corner case.
adi,admv1013
- Avoid a null pointer dereference if device_property_read_string() fails.
adi,admv4420
- Return error code rather than -1..
adi,adxl345
- Add separate scaling for events from that of raw channels.
amlogic,meson-adc
- Don't bother keeping nvmem cell access around when only used in probe.
atmel,at91-sama5d
- Don't bother keeping nvmem cell access around when only used in probe.
bosch,bmc150
- Use sysfs_emit() in a few places.
honeywell,hsc030pa
- Improve handling of return values from i2c_transfer.
liteon,ltr501
- Return error values rather than -1 replaced by -EINVAL at higher
levels of the callstack.
maxim,ds4424
- A bunch of general minor improvements prior to adding new features.
maxim,max11410
- Make some const string arrays static.
maxim,max5522
- Use devm_regulator_get_enable_read_voltage() at probe to cache the
voltage rather than keeping the regulator around to access and query
later.
vishay,vcnl4000
- Various code improvements.
sharp,gp2ap020a00f
- General driver modernization.
silabs,si7210
- Use devm_regulator_get_enable_read_voltage() at probe to cache the
voltage rather than keeping the regulator around to access and query
later.
st,lsm6dsx
- Add SMOCF00 ACPI ID seen on products by SHIFT.
st,st_sensors
- Fix up various kernel-doc issues.
- Avoid kmalloc of a single use buffer and instead reused existing
buffer_data.
taos,tsl2772
- Fix some kernel-doc warnings due to missing :
ti,ads7950
- Use iio_push_to_buffers_with_ts_unaligned() as first few elements of
array are not the data that is pushed.
- Move from array of chip_info structures to individual named ones. This
is part of slowly replacing use of a code pattern that we don't want
replicated in new drivers.
vti,sca3000
- General driver modernization included use of devm and guard().
Various other more minor stuff not called out explicitly.
Includes things like typo fixes, use of dev_err_probe() and local
variables to avoid repeated dereferencing of the same member as well as
increasing use of guard() to simplify release of locks.
Another slow improvement to code quality is both standardizing on
header order and ensure all appropriate headers are included.
-----BEGIN PGP SIGNATURE-----
iQJFBAABCgAvFiEEbilms4eEBlKRJoGxVIU0mcT0FogFAmnINKERHGppYzIzQGtl
cm5lbC5vcmcACgkQVIU0mcT0FognJg//a2J1qP+D8gf3nfBdrTyLaS7DCQZib60V
0wHrSewlT49fM2P1A4Y//cNV+wekb84EAmZLduxaRLkgHC8ZAeGxWy6DY2q0SFww
AN20+6toP3M1J7eIRW7ENB7aqwAczu/SzU+6fGcwxGicbjorDE1iQHiR38eXuKqi
l8kjV4YO4PICHkQWU7D0y2D7Nvp/BgBwDmtRzzfVdtIMYcyaOH5fvDFByfaQiTW6
rftwvzFH3lgV2pMOMUDwa0e071DQhMLxjleFwAW5jbvMqXf/15379tVXhFA6BhMi
T1wlB10w1xl0QBbmYJrDOIpaFT4BdET+pQyrlB74sDrVbFF2ip8a1e4ux0fCPZIZ
qmBAjzTTtE36PFWVdak8PCasEuyKGEpsSMfSOpmZZEaXFTAjKISuKLZrCuHgmkIl
BY+Vswq5trkLF3GLLc8me+4L3hG4ujx40OZEk42G2B10kAJXyvG5bHGeJ0Jy/B3O
CaMweZJeDBloZyXwrgNx5n+wIeKm7g6SqcL+85XMSN9x+jh4FcBDoHTFXAq5kqlv
u4hWg2fjoyu+O/CRHRBLIfg5CBd+8oNlf8kbSa1wx1VY4IHSO9z5Xj/se+VSTew3
haCR/wvVG4Rs33krGyYnjMhoOGOnFZkiHoI85ATqsb+ZRzZdFWG+5mb5wN5Hgt5V
I6KAnuZNsrI=
=/WQe
-----END PGP SIGNATURE-----
Merge tag 'iio-for-7.1a' of ssh://gitolite.kernel.org/pub/scm/linux/kernel/git/jic23/iio into char-misc-next
Jonathan writes:
IIO: New devices support, features and cleanup for 7.1
Includes merge of v7.0-rc4 to pull in a fix and a merge of
ib-iio-thermal-qcom-pmic5 immutable branch (provided from the IIO tree so
thermal could also pick this up and add thermal specific remainder
of the series on top.
New device support
------------------
adi,ad4030
- Add support for ADA4316 and ADAQ4224 ADCs with PGAs.
adi,ad4080
- Add support for AD4082, AD4085 and AD4088 ADCs.
adi,ad8366
- Add ADRF5702 and ADRF5703 digital step attenuators.
adi,adxl372
- Add support for the ADXL371 accelerometer after refactors to allow multiple
device variants to be supported by the driver. In particular a silicon
issue means the hardware FIFO doesn't work on the ADXL371
bosch,bma255/bmg160
- Add support for BMX055 gyroscope and magnetometer (effectively separate
devices from point of view of interface).
lltc,ltc2309
- Add support for LTC2305 2 channel 12-bit ADC.
lltc,ltc2532
- Add support for 4 variants of the LTC2654 quad DAC.
maxim,ds4424
- Add IDs for DS4402 and DS4404 parts. Initially patch is ID only but additional
features also added that are device dependent.
qcom,spmi-adc-gen3
- New driver supporting this generation of Qualcomm's SoC ADC.
st,vl53l1
- New driver for this Time Of Flight (TOF) sensor.
ti,ina2xx
- Support the INA236 digital power monitor.
vishay,vcnl4000
- Add support for CM36686 ambient light and proximity sensor.
- Add support for CM36672P proximity sensors.
ID only additions.
amlogic,meson-adc
- Support the Meson S4.
Features
--------
iio-backend framework
- Add capability discovery so front end drivers can know what features are
available from the backend and adjust how they operate.
adi,ad4030
- Add SPI offload support requiring a non trivial PWM setup.
adi,ad7380
- Add support for multiple SPI lanes to improve throughput.
adi,ad7768-1
- Support SPI offload and always use continuous mode, enabling more
filter options.
adi,ad8366
- Device tree bindings and support.
aspeed,adc
- Handle battery channel.
maxim,ds4424
- Add external resistor controlled scale and per-variant limits.
- Handle per variant range limits.
- Move it to regmap.
motorola,cpcap-adc
- Support for the ADC found on the Motorola Mot board. Effectively some board
specific configuration handled in the driver.
vishay,vcnl4000
- Support explicit power supply regulators.
tyhx,hx9023s
- Allow device tree specification of firmware file name.
Cleanup and minor fixes
-----------------------
treewide
- Remove a bunch of unused structure elements.
- Replaces standard fixed width integers with kernel types.
- Replace some other error values that were returned on allocation failure
with -ENOMEM
iio-core
- Replace a few custom devm implementations for devm_add_action_or_reset()
iio-trigger
- Use put_device() to cleanup on error.
iio-backend
- Use __free(fwmode_handle) to simplify some code.
hw-consumer
- Use separate allocation for scan mask bitmap to simplify code.
acpi-als
- Switch from ACPI driver to platform driver.
adi,ad4030
- Use BIT() to replace values that are always a power of 2 to slightly
improve readability.
adi,ad4062
- Add a missing check for error form iio_get_current_scan_type()
adi,ad5933
- Use div64_ul() rather than do_div() as remainder was not used.
adi,ad7191
- Documentation fixes related to clocks
adi,ad7816
- Use sysfs_emit()
adi,ad8366
- General driver modernization
adi,adf4350
- Change a TOOD to NOTE in a comment to avoid anyone from walking into
a tricky to improve corner case.
adi,admv1013
- Avoid a null pointer dereference if device_property_read_string() fails.
adi,admv4420
- Return error code rather than -1..
adi,adxl345
- Add separate scaling for events from that of raw channels.
amlogic,meson-adc
- Don't bother keeping nvmem cell access around when only used in probe.
atmel,at91-sama5d
- Don't bother keeping nvmem cell access around when only used in probe.
bosch,bmc150
- Use sysfs_emit() in a few places.
honeywell,hsc030pa
- Improve handling of return values from i2c_transfer.
liteon,ltr501
- Return error values rather than -1 replaced by -EINVAL at higher
levels of the callstack.
maxim,ds4424
- A bunch of general minor improvements prior to adding new features.
maxim,max11410
- Make some const string arrays static.
maxim,max5522
- Use devm_regulator_get_enable_read_voltage() at probe to cache the
voltage rather than keeping the regulator around to access and query
later.
vishay,vcnl4000
- Various code improvements.
sharp,gp2ap020a00f
- General driver modernization.
silabs,si7210
- Use devm_regulator_get_enable_read_voltage() at probe to cache the
voltage rather than keeping the regulator around to access and query
later.
st,lsm6dsx
- Add SMOCF00 ACPI ID seen on products by SHIFT.
st,st_sensors
- Fix up various kernel-doc issues.
- Avoid kmalloc of a single use buffer and instead reused existing
buffer_data.
taos,tsl2772
- Fix some kernel-doc warnings due to missing :
ti,ads7950
- Use iio_push_to_buffers_with_ts_unaligned() as first few elements of
array are not the data that is pushed.
- Move from array of chip_info structures to individual named ones. This
is part of slowly replacing use of a code pattern that we don't want
replicated in new drivers.
vti,sca3000
- General driver modernization included use of devm and guard().
Various other more minor stuff not called out explicitly.
Includes things like typo fixes, use of dev_err_probe() and local
variables to avoid repeated dereferencing of the same member as well as
increasing use of guard() to simplify release of locks.
Another slow improvement to code quality is both standardizing on
header order and ensure all appropriate headers are included.
* tag 'iio-for-7.1a' of ssh://gitolite.kernel.org/pub/scm/linux/kernel/git/jic23/iio: (217 commits)
Docs: iio: ad7191 Correct clock configuration
iio: amplifiers: ad8366: add support for adrf5702/3
dt-bindings: iio: amplifiers: ad8366: add adrf5702/3 support
iio: adc: meson-saradc: add support for Meson S4
dt-bindings: iio: adc: amlogic,meson-saradc: add S4 compatible
iio: imu: st_lsm6dsx: Add ACPI ID for SHIFT13mi gyroscope
iio: proximity: add driver for ST VL53L1X ToF sensor
dt-bindings: iio: proximity: add ST VL53L1X ToF sensor
iio: adc: max11410: make vref register name arrays static const
iio: accel: bmc150-accel-core: use sysfs_emit() in show functions
iio: frequency: adf4350: replace TODO with NOTE in adf4350_set_freq()
iio: adc: ltc2309: add support for ltc2305
iio: adc: ltc2309: explicitly assign hex values to channel enums
dt-bindings: adc: ltc2497: add support for ltc2305
iio: accel: adxl380: fix typo in PART_ID register macro
iio: dac: ds4424: add Rfs-based scale and per-variant limits
dt-bindings: iio: dac: maxim,ds4424: add maxim,rfs-ohms property
iio: dac: ds4424: convert to regmap
iio: dac: ds4424: support per-variant output range limits
iio: dac: ds4424: add DS4402/DS4404 device IDs
...
Use the new snp_prepare() to initialize SNP from the ccp driver instead of at
boot time. This means that SNP is not enabled unless it is really going to be
used (i.e. kvm_amd loads the ccp driver automatically).
Signed-off-by: Tycho Andersen (AMD) <tycho@kernel.org>
Signed-off-by: Borislav Petkov (AMD) <bp@alien8.de>
Reviewed-by: Tom Lendacky <thomas.lendacky@amd.com>
Link: https://patch.msgid.link/20260324161301.1353976-5-tycho@kernel.org
After SNP_SHUTDOWN, two things should be done:
1. clear the RMP table
2. disable MFDM to prevent the FW_WARN in k8_check_syscfg_dram_mod_en() in
the event of a kexec
Create and export to the CCP driver a function that does them.
Also change the MFDM helper to allow for disabling the bit, since the SNP x86
shutdown path needs to disable MFDM.
The comment for k8_check_syscfg_dram_mod_en() notes, the "BIOS" is supposed
clear it, or the kernel in the case of module unload and shutdown followed by
kexec.
Signed-off-by: Tycho Andersen (AMD) <tycho@kernel.org>
Signed-off-by: Borislav Petkov (AMD) <bp@alien8.de>
Reviewed-by: Tom Lendacky <thomas.lendacky@amd.com>
Link: https://patch.msgid.link/20260324161301.1353976-4-tycho@kernel.org
Commit ab949d5196 ("ALSA: hda - Fix deadlock of controller device
lock at unbinding") added a temporary device_unlock()/device_lock()
pair around probe-work cancellation to avoid a deadlock between
controller unbind and codec probe.
That deadlock depended on the driver core taking both a device lock and
its parent lock during bind and unbind. Since commit 8c97a46af0
("driver core: hold dev's parent lock when needed") and follow-up
fixes, the parent lock is only taken when bus->need_parent_lock is set.
The HDA bus does not set that flag, so codec binding no longer locks
the controller device as the codec's parent.
Keep cancel_delayed_work_sync(), since the async probe/remove race
still needs to be serialized, but drop the stale unlock/relock
workaround and its outdated FIXME comment. Keeping it around only
opens an unnecessary unlocked window inside azx_remove().
Signed-off-by: Cássio Gabriel <cassiogabrielcontato@gmail.com>
Link: https://patch.msgid.link/20260328-hda-intel-drop-obsolete-probe-workaround-v1-1-bc43aeafc98b@gmail.com
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Use macros to make the AF16Rig quirk table smaller.
Add a disabled block containing the theoretical quirks for the other
clock sources that the AF16Rig has. It's disabled because I cannot test
it.
Fixes: 0da18c2dd1 ("ALSA: usb-audio: Add quirks for Arturia AF16Rig")
Tested-By: Phil Willoughby <willerz@gmail.com>
Signed-off-by: Phil Willoughby <willerz@gmail.com>
Link: https://patch.msgid.link/20260328160326.23665-1-willerz@gmail.com
Signed-off-by: Takashi Iwai <tiwai@suse.de>
-----BEGIN PGP SIGNATURE-----
iQIzBAABCgAdFiEE8rQSAMVO+zA4DBdWxWXV+ddtWDsFAmnIO1oACgkQxWXV+ddt
WDuLDQ//eWEAvqyA7ch+aLNm0QVHqsdH3NdVFjqw/3NsZfC9A3txTpQmmWpfqIUl
Yqb3AVIdRqwdytinn3xX17SxkJxzCWExcQ8LckoiJ2ODhLoi/vWGnaK8sUBzUDsm
2etvLGbDmhEEpkTMtIFkbY8fhprqthGCQgRHNrn/cZ+AzwohaboinvACysQJSLlH
Nqv0YxnAxsaGIaGD7wigjZ7a2BDoSZ/Q82+RvacrOkyqEThSOqzLmfl++fmHfxQo
UDzVOt9RSUnZ5LU4MYjF3H5otLczqKqRuoQC66ulIkvCml07jaKxfUVJyjkQ3dzZ
//UiylTXnC6XK/x1ayRrM73dKkXoN9mBmvH4b2FnOQJ3D3oyiCuytEF8s4nCrE+P
Zml+OTvIvWMj7Xy2U7cTMWuQGeggZ1m4nxCRScZBEnububUzt13izODwE7C8Cx1y
5FvfFIkiyeBrI03bWUO48H38lwWsfIKj6KnEk1SUeZIARClnZfM4NGZ7MbxjcntG
SunXzuQAywOZCkpskUDWMASLSH6CEGG4zgHPmbzw1NSCE5ZCHFZYXG7znv4w3CTW
TTeowG9r9cgdVBnMUTIToNWuD0jSMLmUfEPWvcwZF9ptfXdoABsPEQZTrKTLeiq7
TVdunKWzU12ZLr2sl4iku8U4H4aNQFoAwV3XqKnG8VXmzN41+Zw=
=I6JH
-----END PGP SIGNATURE-----
Merge tag 'for-7.0-rc5-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/kdave/linux
Pull btrfs fixes from David Sterba:
"A few more fixes. There's one that stands out in size as it fixes an
edge case in fsync.
- fix issue on fsync where file with zero size appears as a non-zero
after log replay
- in zlib compression, handle a crash when data alignment causes
folio reference issues
- fix possible crash with enabled tracepoints on a overlayfs mount
- handle device stats update error
- on zoned filesystems, fix kobject leak on sub-block groups
- fix super block offset in an error message in validation"
* tag 'for-7.0-rc5-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/kdave/linux:
btrfs: fix lost error when running device stats on multiple devices fs
btrfs: tracepoints: get correct superblock from dentry in event btrfs_sync_file()
btrfs: zlib: handle page aligned compressed size correctly
btrfs: fix leak of kobject name for sub-group space_info
btrfs: fix zero size inode with non-zero size after log replay
btrfs: fix super block offset in error message in btrfs_validate_super()
Conceptually, `static_assert` is also a build-time assertion that occurs
earlier in the pipeline. Consolidate the implementation so that we can use
this as the canonical place to add more useful build-time assertions.
Reviewed-by: Yury Norov <ynorov@nvidia.com>
Signed-off-by: Gary Guo <gary@garyguo.net>
Reviewed-by: Alice Ryhl <aliceryhl@google.com>
Reviewed-by: Danilo Krummrich <dakr@kernel.org>
Link: https://patch.msgid.link/20260319121653.2975748-2-gary@kernel.org
[ Used kernel vertical style. - Miguel ]
Signed-off-by: Miguel Ojeda <ojeda@kernel.org>
There's a 3-patch series of DAMON fixes from Josh Law and SeongJae Park.
The rest are singletons - please see the changelogs for details.
-----BEGIN PGP SIGNATURE-----
iHUEABYKAB0WIQTTMBEPP41GrTpTJgfdBJ7gKXxAjgUCacgT5AAKCRDdBJ7gKXxA
jgYVAQDLam92lD7fD0IwdOFE36zlOcJNK4WjHSEf2y9fFFnUWQD/QPnVX+q7fR5t
ZE8ZKhVkMa2w6A2VISdt9Msqm++5RQg=
=oCV1
-----END PGP SIGNATURE-----
Merge tag 'mm-hotfixes-stable-2026-03-28-10-45' of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm
Pull misc fixes from Andrew Morton:
"10 hotfixes. 8 are cc:stable. 9 are for MM.
There's a 3-patch series of DAMON fixes from Josh Law and SeongJae
Park. The rest are singletons - please see the changelogs for details"
* tag 'mm-hotfixes-stable-2026-03-28-10-45' of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm:
mm/mseal: update VMA end correctly on merge
bug: avoid format attribute warning for clang as well
mm/pagewalk: fix race between concurrent split and refault
mm/memory: fix PMD/PUD checks in follow_pfnmap_start()
mm/damon/sysfs: check contexts->nr in repeat_call_fn
mm/damon/sysfs: check contexts->nr before accessing contexts_arr[0]
mm/damon/sysfs: fix param_ctx leak on damon_sysfs_new_test_ctx() failure
mm/swap: fix swap cache memcg accounting
MAINTAINERS, mailmap: update email address for Harry Yoo
mm/huge_memory: fix folio isn't locked in softleaf_to_folio()
In preparation for delayed SNP initialization, create a function snp_prepare()
that does the necessary architecture setup. Export this function for the ccp
module to allow it to do the setup as necessary.
Introduce a cpu_read_lock/unlock() wrapper around the MFDM and SNP enable.
While CPU hotplug is not supported, this makes sure that the bit setting
happens on the same set of CPUs in both cases.
This improvement was suggested by Sashiko:
https://sashiko.dev/#/patchset/20260324161301.1353976-1-tycho%40kernel.org
Also move {mfd,snp}_enable() out of the __init section, since these will be
called later.
Signed-off-by: Tycho Andersen (AMD) <tycho@kernel.org>
Signed-off-by: Borislav Petkov (AMD) <bp@alien8.de>
Reviewed-by: Tom Lendacky <thomas.lendacky@amd.com>
Link: https://patch.msgid.link/20260326161110.1764303-3-tycho@kernel.org
In preparation for delayed SNP initialization and disablement on shutdown,
create a function, clear_rmp(), that clears the RMP bookkeeping area and the
RMP entries.
Signed-off-by: Tom Lendacky <thomas.lendacky@amd.com>
Signed-off-by: Tycho Andersen (AMD) <tycho@kernel.org>
Signed-off-by: Borislav Petkov (AMD) <bp@alien8.de>
Link: https://patch.msgid.link/20260324161301.1353976-2-tycho@kernel.org
As stated on the website: "This wiki has been archived and the content
is no longer updated." No need to reference it.
Signed-off-by: Wolfram Sang <wsa+renesas@sang-engineering.com>
Change 2d8b7f9bf8 ("tracing: Have show_event_trigger/filter format a bit more in columns")
added space padding to align the output.
However it used ("%*.s", len, "") which requests the default precision.
It doesn't matter here whether the userspace default (0) or kernel
default (no precision) is used, but the format should be "%*s".
Cc: Mathieu Desnoyers <mathieu.desnoyers@efficios.com>
Cc: Rasmus Villemoes <linux@rasmusvillemoes.dk>
Cc: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
Cc: Sergey Senozhatsky <senozhatsky@chromium.org>
Cc: Andrew Morton <akpm@linux-foundation.org>
Link: https://patch.msgid.link/20260326201824.3919-1-david.laight.linux@gmail.com
Signed-off-by: David Laight <david.laight.linux@gmail.com>
Acked-by: Masami Hiramatsu (Google) <mhiramat@kernel.org>
Reviewed-by: Petr Mladek <pmladek@suse.com>
Reviewed-by: Aaron Tomlin <atomlin@atomlin.com>
Signed-off-by: Steven Rostedt (Google) <rostedt@goodmis.org>
Replace trace_foo() with the new trace_call__foo() at sites already
guarded by trace_foo_enabled(), avoiding a redundant
static_branch_unlikely() re-evaluation inside the tracepoint.
trace_call__foo() calls the tracepoint callbacks directly without
utilizing the static branch again.
Cc: Huang Rui <ray.huang@amd.com>
Cc: Mario Limonciello <mario.limonciello@amd.com>
Cc: Perry Yuan <perry.yuan@amd.com>
Cc: "Rafael J. Wysocki" <rafael@kernel.org>
Cc: Viresh Kumar <viresh.kumar@linaro.org>
Cc: Srinivas Pandruvada <srinivas.pandruvada@linux.intel.com>
Cc: Len Brown <lenb@kernel.org>
Link: https://patch.msgid.link/20260323160052.17528-7-vineeth@bitbyteword.org
Suggested-by: Steven Rostedt <rostedt@goodmis.org>
Suggested-by: Peter Zijlstra <peterz@infradead.org>
Signed-off-by: Vineeth Pillai (Google) <vineeth@bitbyteword.org>
Assisted-by: Claude:claude-sonnet-4-6
Acked-by: Rafael J. Wysocki (Intel) <rafael@kernel.org> # cpufreq core
Reviewed-by: Gautham R. Shenoy <gautham.shenoy@amd.com>
Signed-off-by: Steven Rostedt (Google) <rostedt@goodmis.org>
Now that the SPE and BRBE nVHE world-switch routines operate on the
host_debug_state directly, tweak the BRBE code to do the same for
consistency.
This is purely cosmetic.
Cc: Marc Zyngier <maz@kernel.org>
Cc: Oliver Upton <oupton@kernel.org>
Cc: James Clark <james.clark@linaro.org>
Cc: Leo Yan <leo.yan@arm.com>
Cc: Suzuki K Poulose <suzuki.poulose@arm.com>
Cc: Fuad Tabba <tabba@google.com>
Cc: Alexandru Elisei <alexandru.elisei@arm.com>
Signed-off-by: Will Deacon <will@kernel.org>
Tested-by: Fuad Tabba <tabba@google.com>
Reviewed-by: Fuad Tabba <tabba@google.com>
Link: https://patch.msgid.link/20260327130047.21065-4-will@kernel.org
Signed-off-by: Marc Zyngier <maz@kernel.org>
The nVHE world-switch code relies on zeroing PMSCR_EL1 to disable
profiling data generation in guest context when SPE is in use by the
host.
Unfortunately, this may leave PMBLIMITR_EL1.E set and consequently we
can end up running in guest/hypervisor context with the Profiling Buffer
enabled. The current "known issues" document for Rev M.a of the Arm ARM
states that this can lead to speculative, out-of-context translations:
| 2.18 D23136:
|
| When the Profiling Buffer is enabled, profiling is not stopped, and
| Discard mode is not enabled, the Statistical Profiling Unit might
| cause speculative translations for the owning translation regime,
| including when the owning translation regime is out-of-context.
In a similar fashion to TRBE, ensure that the Profiling Buffer is
disabled during the nVHE world switch before we start messing with the
stage-2 MMU and trap configuration.
Cc: Marc Zyngier <maz@kernel.org>
Cc: Oliver Upton <oupton@kernel.org>
Cc: James Clark <james.clark@linaro.org>
Cc: Leo Yan <leo.yan@arm.com>
Cc: Suzuki K Poulose <suzuki.poulose@arm.com>
Cc: Fuad Tabba <tabba@google.com>
Cc: Alexandru Elisei <alexandru.elisei@arm.com>
Reviewed-by: Alexandru Elisei <alexandru.elisei@arm.com>
Reviewed-by: Fuad Tabba <tabba@google.com>
Tested-by: Alexandru Elisei <alexandru.elisei@arm.com>
Tested-by: Fuad Tabba <tabba@google.com>
Fixes: f85279b4bd ("arm64: KVM: Save/restore the host SPE state when entering/leaving a VM")
Signed-off-by: Will Deacon <will@kernel.org>
Link: https://patch.msgid.link/20260327130047.21065-3-will@kernel.org
Signed-off-by: Marc Zyngier <maz@kernel.org>
The nVHE world-switch code relies on zeroing TRFCR_EL1 to disable trace
generation in guest context when self-hosted TRBE is in use by the host.
Per D3.2.1 ("Controls to prohibit trace at Exception levels"), clearing
TRFCR_EL1 means that trace generation is prohibited at EL1 and EL0 but
per R_YCHKJ the Trace Buffer Unit will still be enabled if
TRBLIMITR_EL1.E is set. R_SJFRQ goes on to state that, when enabled, the
Trace Buffer Unit can perform address translation for the "owning
exception level" even when it is out of context.
Consequently, we can end up in a state where TRBE performs speculative
page-table walks for a host VA/IPA in guest/hypervisor context depending
on the value of MDCR_EL2.E2TB, which changes over world-switch. The
potential result appears to be a heady mixture of SErrors, data
corruption and hardware lockups.
Extend the TRBE world-switch code to clear TRBLIMITR_EL1.E after
draining the buffer, restoring the register on return to the host. This
unfortunately means we need to tackle CPU errata #2064142 and #2038923
which add additional synchronisation requirements around manipulations
of the limit register. Hopefully this doesn't need to be fast.
Cc: Marc Zyngier <maz@kernel.org>
Cc: Oliver Upton <oupton@kernel.org>
Cc: James Clark <james.clark@linaro.org>
Cc: Leo Yan <leo.yan@arm.com>
Cc: Suzuki K Poulose <suzuki.poulose@arm.com>
Cc: Fuad Tabba <tabba@google.com>
Cc: Alexandru Elisei <alexandru.elisei@arm.com>
Tested-by: Leo Yan <leo.yan@arm.com>
Tested-by: Fuad Tabba <tabba@google.com>
Reviewed-by: Suzuki K Poulose <suzuki.poulose@arm.com>
Reviewed-by: Fuad Tabba <tabba@google.com>
Fixes: a1319260bf ("arm64: KVM: Enable access to TRBE support for host")
Signed-off-by: Will Deacon <will@kernel.org>
Link: https://patch.msgid.link/20260327130047.21065-2-will@kernel.org
Signed-off-by: Marc Zyngier <maz@kernel.org>
- Fix potential deadlock in osnoise and hotplug
The interface_lock can be called by a osnoise thread and the CPU shutdown
logic of osnoise can wait for this thread to finish. But cpus_read_lock()
can also be taken while holding the interface_lock. This produces a
circular lock dependency and can cause a deadlock.
Swap the ordering of cpus_read_lock() and the interface_lock to have
interface_lock taken within the cpus_read_lock() context to prevent this
circular dependency.
- Fix freeing of event triggers in early boot up
If the same trigger is added on the kernel command line, the second
one will fail to be applied and the trigger created will be freed.
This calls into the deferred logic and creates a kernel thread to do
the freeing. But the command line logic is called before kernel
threads can be created and this leads to a NULL pointer dereference.
Delay freeing event triggers until late init.
-----BEGIN PGP SIGNATURE-----
iIoEABYKADIWIQRRSw7ePDh/lE+zeZMp5XQQmuv6qgUCacf2GBQccm9zdGVkdEBn
b29kbWlzLm9yZwAKCRAp5XQQmuv6qooZAQDQgsnrkwkUHc2WjhAAsZunjWhqRQOp
SIdOO95pDvQwewEAjjP6kG5UEppL8eNF9WmV8EMz9pjYo7i2/Wy59H6xnwQ=
=6Rs0
-----END PGP SIGNATURE-----
Merge tag 'trace-v7.0-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace
Pull tracing fixes from Steven Rostedt:
- Fix potential deadlock in osnoise and hotplug
The interface_lock can be called by a osnoise thread and the CPU
shutdown logic of osnoise can wait for this thread to finish. But
cpus_read_lock() can also be taken while holding the interface_lock.
This produces a circular lock dependency and can cause a deadlock.
Swap the ordering of cpus_read_lock() and the interface_lock to have
interface_lock taken within the cpus_read_lock() context to prevent
this circular dependency.
- Fix freeing of event triggers in early boot up
If the same trigger is added on the kernel command line, the second
one will fail to be applied and the trigger created will be freed.
This calls into the deferred logic and creates a kernel thread to do
the freeing. But the command line logic is called before kernel
threads can be created and this leads to a NULL pointer dereference.
Delay freeing event triggers until late init.
* tag 'trace-v7.0-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace:
tracing: Drain deferred trigger frees if kthread creation fails
tracing: Fix potential deadlock in cpu hotplug with osnoise
- Add array_index_nospec() to syscall dispatch table lookup to prevent
limited speculative out-of-bounds access with user-controlled syscall
number
- Mark array_index_mask_nospec() __always_inline since GCC may emit an
out-of-line call instead of the inline data dependency sequence the
mitigation relies on
- Clear r12 on kernel entry to prevent potential speculative use of user
value in system_call, ext/io/mcck interrupt handlers
-----BEGIN PGP SIGNATURE-----
iQEzBAABCgAdFiEE3QHqV+H2a8xAv27vjYWKoQLXFBgFAmnHIWsACgkQjYWKoQLX
FBgwnwgAhPc5rPBk6rG9BAnertIUC+f7NhXkepryLJctPTldaUvycx6aR+o9wizd
7LEiur6duGAg7enWpaRa9FVthOk5tytbkGfU/MijJBoZovX5mZX7U0Ky4WcN+D7B
nFo+CfhWt+jNC6DVZzqhQVrdCxES42olnadLbTbhq5t975lJFgCwJOCcciupawWt
9Lx/YVHym9xlX4iE+sbc0yWGgicGn7JsPsHjfn5ci4WGgF2uhmF3FFfhVSzYJDZK
b8TaodVBebzwREy0s0RKmbQAuT/R01sL16yAayHCL6smerAbNPN62oREEIDz2IS+
fAC/4R7/+nsYQcVpGA/DxztbzK69Uw==
=V6om
-----END PGP SIGNATURE-----
Merge tag 's390-7.0-6' of git://git.kernel.org/pub/scm/linux/kernel/git/s390/linux
Pull s390 fixes from Vasily Gorbik:
- Add array_index_nospec() to syscall dispatch table lookup to prevent
limited speculative out-of-bounds access with user-controlled syscall
number
- Mark array_index_mask_nospec() __always_inline since GCC may emit an
out-of-line call instead of the inline data dependency sequence the
mitigation relies on
- Clear r12 on kernel entry to prevent potential speculative use of
user value in system_call, ext/io/mcck interrupt handlers
* tag 's390-7.0-6' of git://git.kernel.org/pub/scm/linux/kernel/git/s390/linux:
s390/entry: Scrub r12 register on kernel entry
s390/syscalls: Add spectre boundary for syscall dispatch table
s390/barrier: Make array_index_mask_nospec() __always_inline
Update kcpuid's CSV to version 3.0, as generated by x86-cpuid-db.
Summary of the v2.5 changes:
- Reduce the verbosity of leaf and bitfields descriptions, as formerly
requested by Boris.
- Leaf 0x8000000a: Add Page Modification Logging (PML) bit.
Summary of the v3.0 changes:
- Leaf 0x23: Introduce subleaf 2, Auto Counter Reload (ACR)
- Leaf 0x23: Introduce subleaf 4/5, PEBS capabilities and counters
- Leaf 0x1c: Return LBR depth as a bitmask instead of individual bits
- Leaf 0x0a: Use more descriptive PMU bitfield names
- Leaf 0x0a: Add various missing PMU events
- Leaf 0x06: Add missing IA32_HWP_CTL flag
- Leaf 0x0f: Add missing non-CPU (IO) Intel RDT bits
Thanks to Dave Hansen for reporting multiple missing bits.
Signed-off-by: Ahmed S. Darwish <darwi@linutronix.de>
Signed-off-by: Borislav Petkov (AMD) <bp@alien8.de>
Link: https://gitlab.com/x86-cpuid.org/x86-cpuid-db/-/blob/v2.5/CHANGELOG.rst
Link: https://gitlab.com/x86-cpuid.org/x86-cpuid-db/-/blob/v3.0/CHANGELOG.rst
- Add pin configuration support for RZ/T2H and RZ/N2H,
- Fix save/restore of registers for ports with variable pincfg per pin
on RZ/G3E, RZ/V2H(P), RZ/V2N, and RZ/Five,
- Drop a superfluous blank line.
-----BEGIN PGP SIGNATURE-----
iHUEABYKAB0WIQQ9qaHoIs/1I4cXmEiKwlD9ZEnxcAUCacZV5AAKCRCKwlD9ZEnx
cIV9AQDLvTixEFxKC+rtfYF9pLjvYVx+4GS4Fw8vGa96XrpWFQEA4gudqo3LcOZF
lvM+i6XxQN5x7Uot4vVjgyVePY7kuAk=
=neS4
-----END PGP SIGNATURE-----
Merge tag 'renesas-pinctrl-for-v7.1-tag1' of git://git.kernel.org/pub/scm/linux/kernel/git/geert/renesas-drivers into devel
pinctrl: renesas: Updates for v7.1
- Add pin configuration support for RZ/T2H and RZ/N2H,
- Fix save/restore of registers for ports with variable pincfg per pin
on RZ/G3E, RZ/V2H(P), RZ/V2N, and RZ/Five,
- Drop a superfluous blank line.
Signed-off-by: Linus Walleij <linusw@kernel.org>
The function tracing_alloc_snapshot() is only used between trace.c and
trace_snapshot.c. When snapshot isn't configured, it's not used at all.
The stub function was defined as a global with no users and no prototype
causing build issues.
Remove the function when snapshot isn't configured as nothing is calling
it.
Also remove the EXPORT_SYMBOL_GPL() that was associated with it as it's
not used outside of the tracing subsystem which also includes any modules.
Cc: Masami Hiramatsu <mhiramat@kernel.org>
Cc: Mathieu Desnoyers <mathieu.desnoyers@efficios.com>
Link: https://patch.msgid.link/20260328101946.2c4ef4a5@robin
Reported-by: Mark Brown <broonie@kernel.org>
Closes: https://lore.kernel.org/all/acb-IuZ4vDkwwQLW@sirena.co.uk/
Fixes: bade44fe54 (tracing: Move snapshot code out of trace.c and into trace_snapshot.c)
Signed-off-by: Steven Rostedt (Google) <rostedt@goodmis.org>
We've added the definitions of the missing GPI and GPO verbs for
reading in the previous commit, but the counter-part for setting
values is missing.
Add the definitions of missing verbs for comprehensiveness.
Link: https://patch.msgid.link/20260328134319.207482-1-tiwai@suse.de
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Replace the nova-core local `DmaObject` with a `CoherentBox` that can
fulfill the same role.
Since `CoherentBox` is more flexible than `DmaObject`, we can use the
native `u64` type for page table entries instead of messing with bytes.
The `dma` module becomes unused with that change, so remove it as well.
Reviewed-by: Gary Guo <gary@garyguo.net>
Reviewed-by: Danilo Krummrich <dakr@kernel.org>
Link: https://patch.msgid.link/20260327-b4-nova-dma-removal-v2-7-616e1d0b5cb3@nvidia.com
Signed-off-by: Alexandre Courbot <acourbot@nvidia.com>
A very common pattern is to create a block of coherent memory with the
content of an already-existing slice of bytes (e.g. a loaded firmware
blob).
`CoherentBox` makes this easier, but still implies a potentially
panicking operation with `copy_from_slice` that requires a `PANIC`
comment.
Add `from_slice_with_attrs` and `from_slice` methods to both `Coherent`
and `CoherentBox` to turn this into a trivial one-step operation.
Reviewed-by: Andreas Hindborg <a.hindborg@kernel.org>
Reviewed-by: Gary Guo <gary@garyguo.net>
Reviewed-by: Danilo Krummrich <dakr@kernel.org>
Link: https://patch.msgid.link/20260327-b4-nova-dma-removal-v2-1-616e1d0b5cb3@nvidia.com
Signed-off-by: Alexandre Courbot <acourbot@nvidia.com>
print_gpio() prints the GPIO capability header and the bidirectional
GPIO state, but it never reports the separate GPI and GPO pins even
though AC_PAR_GPIO_CAP exposes their counts.
The HD-audio specification defines dedicated GPI and GPO verbs
alongside the GPIO ones, so codecs with input-only or output-only
general-purpose pins currently lose that state from
/proc/asound/card*/codec#* altogether.
Add the missing read verb definitions and extend print_gpio() to dump
the GPI and GPO pins, too, while leaving the existing IO[] output
unchanged.
Signed-off-by: Cássio Gabriel <cassiogabrielcontato@gmail.com>
Link: https://patch.msgid.link/20260328-hda-proc-gpi-gpo-v1-1-fabb36564bee@gmail.com
Signed-off-by: Takashi Iwai <tiwai@suse.de>
The comment in exit_itimers() still refers to itimer_delete(),
which was replaced by posix_timer_delete(). Update the comment
accordingly.
Signed-off-by: Zhan Xusheng <zhanxusheng@xiaomi.com>
Signed-off-by: Thomas Gleixner <tglx@kernel.org>
Link: https://patch.msgid.link/20260326142210.98632-1-zhanxusheng@xiaomi.com
Simplify the locking logic in rzg2l_irq_set_type() by using guard(),
eliminating the need for an explicit unlock call.
[ tglx: Remove the pointless cleanup.h include. The spinlock guards come
from spinlock.h ]
Signed-off-by: Biju Das <biju.das.jz@bp.renesas.com>
Signed-off-by: Thomas Gleixner <tglx@kernel.org>
Link: https://patch.msgid.link/20260328103324.134131-3-biju.das.jz@bp.renesas.com
Add CoherentHandle, an opaque DMA allocation type for buffers that are
only ever accessed by hardware. Unlike Coherent<T>, it does not provide
CPU access to the allocated memory.
CoherentHandle implicitly sets DMA_ATTR_NO_KERNEL_MAPPING and stores the
value returned by dma_alloc_attrs() as an opaque handle
(NonNull<c_void>) rather than a typed pointer, since with this flag the
C API returns an opaque cookie (e.g. struct page *), not a CPU pointer
to the allocated memory.
Only the DMA bus address is exposed to drivers; the opaque handle is
used solely to free the allocation on drop.
This commit is for reference only; there is currently no in-tree user.
Signed-off-by: Danilo Krummrich <dakr@kernel.org>
Reviewed-by: Alexandre Courbot <acourbot@nvidia.com>
Link: https://patch.msgid.link/20260321172749.592387-2-dakr@kernel.org
[acourbot: fix conflict in dma.rs.]
Signed-off-by: Alexandre Courbot <acourbot@nvidia.com>
The AF16Rig supports 34 channels at 44.1k/48k, 18 channels at 88.2k/96k
and 10 channels at 176.4k/192k.
This quirks is necessary because the automatic probing process we would
otherwise use fails. The root cause of that is that the AF16Rig clock is
not readable (its descriptor says that it is but the reads fail).
Except as described below, the values in the audio format quirks were
copied from the USB descriptors of the device. The rate information is
from the datasheet of the device. The clock is the internal clock of the
AF16Rig.
Tested-By: Phil Willoughby <willerz@gmail.com>
I have tested all the configurations enabled by this patch.
Cc: Jaroslav Kysela <perex@perex.cz>
Cc: Takashi Iwai <tiwai@suse.com>
Signed-off-by: Phil Willoughby <willerz@gmail.com>
Link: https://patch.msgid.link/20260328112426.14816-1-willerz@gmail.com
Signed-off-by: Takashi Iwai <tiwai@suse.de>
asihpi_ctl_init() builds mixer control names in the fixed 44-byte
hpi_ctl->name buffer with sprintf().
This is not only a defensive cleanup. The current in-tree name tables and
format strings can already exceed 44 bytes. For example,
"Bitstream 0 Internal 0 Monitor Playback Volume"
is 46 characters before the trailing NUL, so the current sprintf() call
writes past the end of hpi_ctl->name.
The generated control name is used as the ALSA control element key, so
blindly truncating it is not sufficient. Switch the formatting to
snprintf() and emit an error if truncation happens, showing the
truncated name while still keeping the write bounded to hpi_ctl->name.
Signed-off-by: Pengpeng Hou <pengpeng@iscas.ac.cn>
Link: https://patch.msgid.link/20260328102808.33969-1-pengpeng@iscas.ac.cn
Signed-off-by: Takashi Iwai <tiwai@suse.de>
When DMA_ATTR_NO_KERNEL_MAPPING is passed to dma_alloc_attrs(), the
returned CPU address is not a pointer to the allocated memory but an
opaque handle (e.g. struct page *).
Coherent<T> (or CoherentAllocation<T> respectively) stores this value as
NonNull<T> and exposes methods that dereference it and even modify its
contents.
Remove the flag from the public attrs module such that drivers cannot
pass it to Coherent<T> (or CoherentAllocation<T> respectively) in the
first place.
Instead DMA_ATTR_NO_KERNEL_MAPPING can be supported with an additional
opaque type (e.g. CoherentHandle) which does not provide access to the
allocated memory.
Cc: stable@vger.kernel.org
Fixes: ad2907b4e3 ("rust: add dma coherent allocator abstraction")
Signed-off-by: Danilo Krummrich <dakr@kernel.org>
Reviewed-by: Alice Ryhl <aliceryhl@google.com>
Reviewed-by: Alexandre Courbot <acourbot@nvidia.com>
Reviewed-by: Gary Guo <gary@garyguo.net>
Link: https://patch.msgid.link/20260321172749.592387-1-dakr@kernel.org
Signed-off-by: Alexandre Courbot <acourbot@nvidia.com>
Fuzzying/stressing futexes triggered:
WARNING: kernel/futex/core.c:825 at wait_for_owner_exiting+0x7a/0x80, CPU#11: futex_lock_pi_s/524
When futex_lock_pi_atomic() sees the owner is exiting, it returns -EBUSY
and stores a refcounted task pointer in 'exiting'.
After wait_for_owner_exiting() consumes that reference, the local pointer
is never reset to nil. Upon a retry, if futex_lock_pi_atomic() returns a
different error, the bogus pointer is passed to wait_for_owner_exiting().
CPU0 CPU1 CPU2
futex_lock_pi(uaddr)
// acquires the PI futex
exit()
futex_cleanup_begin()
futex_state = EXITING;
futex_lock_pi(uaddr)
futex_lock_pi_atomic()
attach_to_pi_owner()
// observes EXITING
*exiting = owner; // takes ref
return -EBUSY
wait_for_owner_exiting(-EBUSY, owner)
put_task_struct(); // drops ref
// exiting still points to owner
goto retry;
futex_lock_pi_atomic()
lock_pi_update_atomic()
cmpxchg(uaddr)
*uaddr ^= WAITERS // whatever
// value changed
return -EAGAIN;
wait_for_owner_exiting(-EAGAIN, exiting) // stale
WARN_ON_ONCE(exiting)
Fix this by resetting upon retry, essentially aligning it with requeue_pi.
Fixes: 3ef240eaff ("futex: Prevent exit livelock")
Signed-off-by: Davidlohr Bueso <dave@stgolabs.net>
Signed-off-by: Thomas Gleixner <tglx@kernel.org>
Cc: stable@vger.kernel.org
Link: https://patch.msgid.link/20260326001759.4129680-1-dave@stgolabs.net
Boot-time trigger registration can fail before the trigger-data cleanup
kthread exists. Deferring those frees until late init is fine, but the
post-boot fallback must still drain the deferred list if kthread
creation never succeeds.
Otherwise, boot-deferred nodes can accumulate on
trigger_data_free_list, later frees fall back to synchronously freeing
only the current object, and the older queued entries are leaked
forever.
To trigger this, add the following to the kernel command line:
trace_event=sched_switch trace_trigger=sched_switch.traceon,sched_switch.traceon
The second traceon trigger will fail and be freed. This triggers a NULL
pointer dereference and crashes the kernel.
Keep the deferred boot-time behavior, but when kthread creation fails,
drain the whole queued list synchronously. Do the same in the late-init
drain path so queued entries are not stranded there either.
Cc: stable@vger.kernel.org
Link: https://patch.msgid.link/20260324221326.1395799-3-atwellwea@gmail.com
Fixes: 61d445af0a ("tracing: Add bulk garbage collection of freeing event_trigger_data")
Signed-off-by: Wesley Atwell <atwellwea@gmail.com>
Signed-off-by: Steven Rostedt (Google) <rostedt@goodmis.org>
Having fully converted user_mem_abort() to kvm_s2_fault_desc and
co, convert gmem_abort() to it as well. The change is obviously
much simpler.
Tested-by: Fuad Tabba <tabba@google.com>
Reviewed-by: Fuad Tabba <tabba@google.com>
Reviewed-by: Suzuki K Poulose <suzuki.poulose@arm.com>
Signed-off-by: Marc Zyngier <maz@kernel.org>
Instead of passing pointers to adjust_nested_*_perms(), allow
them to return a new set of permissions.
With some careful moving around so that the canonical permissions
are computed before the nested ones are applied, we end-up with
a bit less code, and something a bit more readable.
Tested-by: Fuad Tabba <tabba@google.com>
Reviewed-by: Fuad Tabba <tabba@google.com>
Reviewed-by: Suzuki K Poulose <suzuki.poulose@arm.com>
Signed-off-by: Marc Zyngier <maz@kernel.org>
The 'prot' field is the only one left in kvm_s2_fault. Expose it
directly to the functions needing it, and get rid of kvm_s2_fault.
It has served us well during this refactoring, but it is now no
longer needed.
Tested-by: Fuad Tabba <tabba@google.com>
Reviewed-by: Fuad Tabba <tabba@google.com>
Reviewed-by: Suzuki K Poulose <suzuki.poulose@arm.com>
Signed-off-by: Marc Zyngier <maz@kernel.org>
Attributes computed for devices are computed very late in the fault
handling process, meanning they are mutable for that long.
Introduce both 'device' and 'map_non_cacheable' attributes to the
vma_info structure, allowing that information to be set in stone
earlier, in kvm_s2_fault_pin_pfn().
Tested-by: Fuad Tabba <tabba@google.com>
Reviewed-by: Fuad Tabba <tabba@google.com>
Reviewed-by: Suzuki K Poulose <suzuki.poulose@arm.com>
Signed-off-by: Marc Zyngier <maz@kernel.org>
force_pte is annoyingly limited in what it expresses, and we'd
be better off with a more generic primitive. Introduce max_map_size
instead, which does the trick and can be moved into the vma_info
structure. This firther allows it to reduce the scopes in which
it is mutable.
Tested-by: Fuad Tabba <tabba@google.com>
Reviewed-by: Fuad Tabba <tabba@google.com>
Reviewed-by: Suzuki K Poulose <suzuki.poulose@arm.com>
Signed-off-by: Marc Zyngier <maz@kernel.org>
Continue restricting the visibility/mutability of some attributes
by moving kvm_s2_fault.{pfn,page} to kvm_s2_vma_info.
This is a pretty mechanical change.
Tested-by: Fuad Tabba <tabba@google.com>
Reviewed-by: Fuad Tabba <tabba@google.com>
Reviewed-by: Suzuki K Poulose <suzuki.poulose@arm.com>
Signed-off-by: Marc Zyngier <maz@kernel.org>
The 'writable' field is ambiguous, and indicates multiple things:
- whether the underlying memslot is writable
- whether we are resolving the fault with writable attributes
Add a new field to kvm_s2_fault_vma_info (map_writable) to indicate
the former condition, and have local writable variables to track
the latter.
Tested-by: Fuad Tabba <tabba@google.com>
Reviewed-by: Fuad Tabba <tabba@google.com>
Reviewed-by: Suzuki K Poulose <suzuki.poulose@arm.com>
Signed-off-by: Marc Zyngier <maz@kernel.org>
There are only two spots where we evaluate whether logging is
active. Replace the boolean with calls to the relevant helper.
Tested-by: Fuad Tabba <tabba@google.com>
Reviewed-by: Fuad Tabba <tabba@google.com>
Reviewed-by: Suzuki K Poulose <suzuki.poulose@arm.com>
Signed-off-by: Marc Zyngier <maz@kernel.org>
