Commit graph

1,426,898 commits

Author SHA1 Message Date
Connor Belli
f631011e36 HID: hid-asus: Implement fn lock for Asus ProArt P16
This patch implements support for the fn lock key on the 2025 Asus
ProArt P16. The implementation for this is based on how fn lock is
implemented in the hid-lenovo driver.

Signed-off-by: Connor Belli <connorbelli2003@gmail.com>
Signed-off-by: Jiri Kosina <jkosina@suse.com>
2026-01-10 10:16:06 +01:00
Oliver Neukum
3756a272d2 HID: hid-pl: handle probe errors
Errors in init must be reported back or we'll
follow a NULL pointer the first time FF is used.

Fixes: 20eb127906 ("hid: force feedback driver for PantherLord USB/PS2 2in1 Adapter")
Cc: stable@vger.kernel.org
Signed-off-by: Oliver Neukum <oneukum@suse.com>
Signed-off-by: Jiri Kosina <jkosina@suse.com>
2026-01-10 10:08:41 +01:00
Tomasz Pakuła
e01a029654 HID: pidff: Do not set out of range trigger button
Some games (mainly observed with Kylotonn's WRC Serises) set trigger
button to a random value, or always the same one, out of range.
I observed 307 and other values but, for example, my Moza R9 only
exposes 128 buttons AND it's trigger button field is 8-bit. This causes
errors to appear in dmesg.

Only set the trigger button and trigger interval in the trigger button
is in range of the field.

Signed-off-by: Tomasz Pakuła <tomasz.pakula.oficjalny@gmail.com>
Signed-off-by: Jiri Kosina <jkosina@suse.com>
2026-01-10 10:06:48 +01:00
Brian Howard
822bc5b374 HID: multitouch: add quirks for Lenovo Yoga Book 9i
The Lenovo Yoga Book 9i is a dual-screen laptop, with a single composite
USB device providing both touch and tablet interfaces for both screens.
All inputs report through a single device, differentiated solely by report
numbers. As there is no way for udev to differentiate the inputs based on
USB vendor/product ID or interface numbers, custom naming is required to
match against for downstream configuration. A firmware bug also results
in an erroneous InRange message report being received after the stylus
leaves proximity, blocking later touch events. Add required quirks for
Gen 8 to Gen 10 models, including a new quirk providing for custom input
device naming and dropping erroneous InRange reports.

Signed-off-by: Brian Howard <blhoward2@gmail.com>
Tested-by: Brian Howard <blhoward2@gmail.com>
Tested-by: Kris Fredrick <linux.baguette800@slmail.me>
Reported-by: Andrei Shumailov <gentoo1993@gmail.com>
Closes: https://bugzilla.kernel.org/show_bug.cgi?id=220386
Signed-off-by: Jiri Kosina <jkosina@suse.com>
2026-01-10 10:04:59 +01:00
Haotian Zhang
e6807641ac HID: playstation: Add missing check for input_ff_create_memless
The ps_gamepad_create() function calls input_ff_create_memless()
without verifying its return value,  which can lead to incorrect
behavior or potential crashes when FF effects are triggered.

Add a check for the return value of input_ff_create_memless().

Fixes: 51151098d7 ("HID: playstation: add DualSense classic rumble support.")
Signed-off-by: Haotian Zhang <vulab@iscas.ac.cn>
Signed-off-by: Jiri Kosina <jkosina@suse.com>
2026-01-10 10:00:23 +01:00
Joey Bednar
7273acfd0a HID: apple: Add "SONiX KN85 Keyboard" to the list of non-apple keyboards
The SoNiX KN85 keyboard identifies as the "Apple, Inc. Aluminium
Keyboard" and is not recognized as a non-apple keyboard. Adding "SoNiX
KN85 Keyboard" to the list of non-apple keyboards fixes the function
keys.

Signed-off-by: Joey Bednar <linux@joeybednar.com>
Signed-off-by: Jiri Kosina <jkosina@suse.com>
2026-01-10 09:54:43 +01:00
Nguyen Dinh Dang Duong
b3b1c68fb7 HID: rapoo: Add support for side buttons on RAPOO 0x2015 mouse
This patch adds support for handling the side buttons
on the RAPOO 0x2015 wireless mouse. These buttons were
previously not generating input events due to missing
driver logic.

The new code handles raw HID input report with Report
ID 1 and maps the side buttons to KEY_BACK and KEY_FORWARD
using the input subsystem.

Tested on a RAPOO mouse with USB ID 24AE:2015.

Signed-off-by: Nguyen Dinh Dang Duong <dangduong31205@gmail.com>
Signed-off-by: Jiri Kosina <jkosina@suse.com>
2026-01-10 09:52:37 +01:00
Sean Christopherson
3611ca7c12 selftests: kvm: Verify TILELOADD actually #NM faults when XFD[18]=1
Rework the AMX test's #NM handling to use kvm_asm_safe() to verify an #NM
actually occurs.  As is, a completely missing #NM could go unnoticed.

Signed-off-by: Sean Christopherson <seanjc@google.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2026-01-10 07:17:30 +01:00
Paolo Bonzini
0383a8edef selftests: kvm: try getting XFD and XSAVE state out of sync
The host is allowed to set FPU state that includes a disabled
xstate component.  Check that this does not cause bad effects.

Cc: stable@vger.kernel.org
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2026-01-10 07:17:30 +01:00
Paolo Bonzini
a1025dcd37 selftests: kvm: replace numbered sync points with actions
Rework the guest=>host syncs in the AMX test to use named actions instead
of arbitrary, incrementing numbers.  The "stage" of the test has no real
meaning, what matters is what action the test wants the host to perform.
The incrementing numbers are somewhat helpful for triaging failures, but
fully debugging failures almost always requires a much deeper dive into
the test (and KVM).

Using named actions not only makes it easier to extend the test without
having to shift all sync point numbers, it makes the code easier to read.

[Commit message by Sean Christopherson]

Cc: stable@vger.kernel.org
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2026-01-10 07:17:29 +01:00
Sean Christopherson
b45f721775 x86/fpu: Clear XSTATE_BV[i] in guest XSAVE state whenever XFD[i]=1
When loading guest XSAVE state via KVM_SET_XSAVE, and when updating XFD in
response to a guest WRMSR, clear XFD-disabled features in the saved (or to
be restored) XSTATE_BV to ensure KVM doesn't attempt to load state for
features that are disabled via the guest's XFD.  Because the kernel
executes XRSTOR with the guest's XFD, saving XSTATE_BV[i]=1 with XFD[i]=1
will cause XRSTOR to #NM and panic the kernel.

E.g. if fpu_update_guest_xfd() sets XFD without clearing XSTATE_BV:

  ------------[ cut here ]------------
  WARNING: arch/x86/kernel/traps.c:1524 at exc_device_not_available+0x101/0x110, CPU#29: amx_test/848
  Modules linked in: kvm_intel kvm irqbypass
  CPU: 29 UID: 1000 PID: 848 Comm: amx_test Not tainted 6.19.0-rc2-ffa07f7fd437-x86_amx_nm_xfd_non_init-vm #171 NONE
  Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 0.0.0 02/06/2015
  RIP: 0010:exc_device_not_available+0x101/0x110
  Call Trace:
   <TASK>
   asm_exc_device_not_available+0x1a/0x20
  RIP: 0010:restore_fpregs_from_fpstate+0x36/0x90
   switch_fpu_return+0x4a/0xb0
   kvm_arch_vcpu_ioctl_run+0x1245/0x1e40 [kvm]
   kvm_vcpu_ioctl+0x2c3/0x8f0 [kvm]
   __x64_sys_ioctl+0x8f/0xd0
   do_syscall_64+0x62/0x940
   entry_SYSCALL_64_after_hwframe+0x4b/0x53
   </TASK>
  ---[ end trace 0000000000000000 ]---

This can happen if the guest executes WRMSR(MSR_IA32_XFD) to set XFD[18] = 1,
and a host IRQ triggers kernel_fpu_begin() prior to the vmexit handler's
call to fpu_update_guest_xfd().

and if userspace stuffs XSTATE_BV[i]=1 via KVM_SET_XSAVE:

  ------------[ cut here ]------------
  WARNING: arch/x86/kernel/traps.c:1524 at exc_device_not_available+0x101/0x110, CPU#14: amx_test/867
  Modules linked in: kvm_intel kvm irqbypass
  CPU: 14 UID: 1000 PID: 867 Comm: amx_test Not tainted 6.19.0-rc2-2dace9faccd6-x86_amx_nm_xfd_non_init-vm #168 NONE
  Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 0.0.0 02/06/2015
  RIP: 0010:exc_device_not_available+0x101/0x110
  Call Trace:
   <TASK>
   asm_exc_device_not_available+0x1a/0x20
  RIP: 0010:restore_fpregs_from_fpstate+0x36/0x90
   fpu_swap_kvm_fpstate+0x6b/0x120
   kvm_load_guest_fpu+0x30/0x80 [kvm]
   kvm_arch_vcpu_ioctl_run+0x85/0x1e40 [kvm]
   kvm_vcpu_ioctl+0x2c3/0x8f0 [kvm]
   __x64_sys_ioctl+0x8f/0xd0
   do_syscall_64+0x62/0x940
   entry_SYSCALL_64_after_hwframe+0x4b/0x53
   </TASK>
  ---[ end trace 0000000000000000 ]---

The new behavior is consistent with the AMX architecture.  Per Intel's SDM,
XSAVE saves XSTATE_BV as '0' for components that are disabled via XFD
(and non-compacted XSAVE saves the initial configuration of the state
component):

  If XSAVE, XSAVEC, XSAVEOPT, or XSAVES is saving the state component i,
  the instruction does not generate #NM when XCR0[i] = IA32_XFD[i] = 1;
  instead, it operates as if XINUSE[i] = 0 (and the state component was
  in its initial state): it saves bit i of XSTATE_BV field of the XSAVE
  header as 0; in addition, XSAVE saves the initial configuration of the
  state component (the other instructions do not save state component i).

Alternatively, KVM could always do XRSTOR with XFD=0, e.g. by using
a constant XFD based on the set of enabled features when XSAVEing for
a struct fpu_guest.  However, having XSTATE_BV[i]=1 for XFD-disabled
features can only happen in the above interrupt case, or in similar
scenarios involving preemption on preemptible kernels, because
fpu_swap_kvm_fpstate()'s call to save_fpregs_to_fpstate() saves the
outgoing FPU state with the current XFD; and that is (on all but the
first WRMSR to XFD) the guest XFD.

Therefore, XFD can only go out of sync with XSTATE_BV in the above
interrupt case, or in similar scenarios involving preemption on
preemptible kernels, and it we can consider it (de facto) part of KVM
ABI that KVM_GET_XSAVE returns XSTATE_BV[i]=0 for XFD-disabled features.

Reported-by: Paolo Bonzini <pbonzini@redhat.com>
Cc: stable@vger.kernel.org
Fixes: 820a6ee944 ("kvm: x86: Add emulation for IA32_XFD", 2022-01-14)
Signed-off-by: Sean Christopherson <seanjc@google.com>
[Move clearing of XSTATE_BV from fpu_copy_uabi_to_guest_fpstate
 to kvm_vcpu_ioctl_x86_set_xsave. - Paolo]
Reviewed-by: Binbin Wu <binbin.wu@linux.intel.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2026-01-10 07:17:16 +01:00
Linus Torvalds
b6151c4e60 Change since last update:
- Don't bother with s_stack_depth increasing to band-aid
    regressions in some composefs mount setups (EROFS + ovl^2)
 -----BEGIN PGP SIGNATURE-----
 
 iQJFBAABCgAvFiEEQ0A6bDUS9Y+83NPFUXZn5Zlu5qoFAmlh3l4RHHhpYW5nQGtl
 cm5lbC5vcmcACgkQUXZn5Zlu5qry/A/+M2JIV6Cu9IW2MZ/8X+mlTK0NOP/fKq1z
 tbtcTvkIXP31L+/ANOPRRlyYC+mNLFvUbig2nbKChkriQxX7Sw/oy9qCOKLUCwmN
 bV1Hv6kbAAAI/+G2DOSUw8pgvrgbT/7cj3EYQHslwdkkgSI/6IjZggU/KjrtAK32
 xlXe2bNR6ATfsUIP8URLdqLEwp2U/mzEbJTa5FhrWYmsDyFWSYbe9g3GHKjO1v/V
 gH/RYl1GETNccuGWQBQOagSWx4tUQZgvhnabPTwT31UyNnAR6+uRDS94zBeLzbku
 6f0MiK69ZsbB7ToelKw0Vj5nWCAFnAIOnMKM0TDY7uuOXlhUx8YOvcrD7/9b0mZ1
 YVq14vKEhZKVj5s9dPu78nq+64UkHwBIhbs95ssu+P1HymyzGtCxaWkVsKkMQRzs
 vK0uoTqfdBgttF7e4mQZEn9KA0VyWIwoGmNlCyABKfuRfvqK/SxX1NFYfl8Zhn++
 b7ifrjuzLG+c0kf4VBWeauIjga+m7NBEqGgCfqulZp9CnWrmiA/8RsevUZLUAhFf
 nGkhBX3IlrZFfsD/gzyh1NWtLlLkmFaZe65pR3cJSJi3+Dl+1pqa0R6fNZAH0WKZ
 B7+VlLPyi3NtHACXWEV5Oqv8qh2G28Yz/54afMzYI7hetUsApVUKbler49qNZEaG
 BbV+G77l7fY=
 =irvd
 -----END PGP SIGNATURE-----

Merge tag 'erofs-for-6.19-rc5-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/xiang/erofs

Pull erofs fix from Gao Xiang:

 - Don't increase s_stack_depth which caused regressions in some
   composefs mount setups (EROFS + ovl^2)

   Instead just allow one extra unaccounted fs stacking level for
   straightforward cases.

* tag 'erofs-for-6.19-rc5-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/xiang/erofs:
  erofs: don't bother with s_stack_depth increasing for now
2026-01-09 19:34:50 -10:00
Gao Xiang
072a7c7cdb erofs: don't bother with s_stack_depth increasing for now
Previously, commit d53cd891f0 ("erofs: limit the level of fs stacking
for file-backed mounts") bumped `s_stack_depth` by one to avoid kernel
stack overflow when stacking an unlimited number of EROFS on top of
each other.

This fix breaks composefs mounts, which need EROFS+ovl^2 sometimes
(and such setups are already used in production for quite a long time).

One way to fix this regression is to bump FILESYSTEM_MAX_STACK_DEPTH
from 2 to 3, but proving that this is safe in general is a high bar.

After a long discussion on GitHub issues [1] about possible solutions,
one conclusion is that there is no need to support nesting file-backed
EROFS mounts on stacked filesystems, because there is always the option
to use loopback devices as a fallback.

As a quick fix for the composefs regression for this cycle, instead of
bumping `s_stack_depth` for file backed EROFS mounts, we disallow
nesting file-backed EROFS over EROFS and over filesystems with
`s_stack_depth` > 0.

This works for all known file-backed mount use cases (composefs,
containerd, and Android APEX for some Android vendors), and the fix is
self-contained.

Essentially, we are allowing one extra unaccounted fs stacking level of
EROFS below stacking filesystems, but EROFS can only be used in the read
path (i.e. overlayfs lower layers), which typically has much lower stack
usage than the write path.

We can consider increasing FILESYSTEM_MAX_STACK_DEPTH later, after more
stack usage analysis or using alternative approaches, such as splitting
the `s_stack_depth` limitation according to different combinations of
stacking.

Fixes: d53cd891f0 ("erofs: limit the level of fs stacking for file-backed mounts")
Reported-and-tested-by: Dusty Mabe <dusty@dustymabe.com>
Reported-by: Timothée Ravier <tim@siosm.fr>
Closes: https://github.com/coreos/fedora-coreos-tracker/issues/2087 [1]
Reported-by: "Alekséi Naidénov" <an@digitaltide.io>
Closes: https://lore.kernel.org/r/CAFHtUiYv4+=+JP_-JjARWjo6OwcvBj1wtYN=z0QXwCpec9sXtg@mail.gmail.com
Acked-by: Amir Goldstein <amir73il@gmail.com>
Acked-by: Alexander Larsson <alexl@redhat.com>
Reviewed-and-tested-by: Sheng Yong <shengyong1@xiaomi.com>
Reviewed-by: Zhiguo Niu <zhiguo.niu@unisoc.com>
Reviewed-by: Chao Yu <chao@kernel.org>
Cc: Christian Brauner <brauner@kernel.org>
Cc: Miklos Szeredi <mszeredi@redhat.com>
Signed-off-by: Gao Xiang <hsiangkao@linux.alibaba.com>
2026-01-10 13:01:15 +08:00
Alice Ryhl
ccf9e07011 rust: sync: Inline various lock related methods
While debugging a different issue [1], the following relocation was
noticed in the rust_binder.ko file:

	R_AARCH64_CALL26	_RNvXNtNtNtCsdfZWD8DztAw_6kernel4sync4lock8spinlockNtB2_15SpinLockBackendNtB4_7Backend6unlock

This relocation (and a similar one for lock) occurred many times
throughout the module. That is not really useful because all this
function does is call spin_unlock(), so what we actually want here is
that a call to spin_unlock() dirctly is generated in favor of this
wrapper method.

Thus, mark these methods inline.

[boqun: Reword the commit message a bit]

Link: https://lore.kernel.org/p/20251111-binder-fix-list-remove-v1-0-8ed14a0da63d@google.com
Signed-off-by: Alice Ryhl <aliceryhl@google.com>
Reviewed-by: Gary Guo <gary@garyguo.net>
Reviewed-by: Daniel Almeida <daniel.almeida@collabora.com>
Signed-off-by: Boqun Feng <boqun.feng@gmail.com>
Link: https://patch.msgid.link/20251218-inline-lock-unlock-v2-1-fbadac8bd61b@google.com
2026-01-10 10:53:46 +08:00
Eric Dumazet
7470a7a63d macvlan: fix possible UAF in macvlan_forward_source()
Add RCU protection on (struct macvlan_source_entry)->vlan.

Whenever macvlan_hash_del_source() is called, we must clear
entry->vlan pointer before RCU grace period starts.

This allows macvlan_forward_source() to skip over
entries queued for freeing.

Note that macvlan_dev are already RCU protected, as they
are embedded in a standard netdev (netdev_priv(ndev)).

Fixes: 79cf79abce ("macvlan: add source mode")
Reported-by: syzbot+7182fbe91e58602ec1fe@syzkaller.appspotmail.com
https: //lore.kernel.org/netdev/695fb1e8.050a0220.1c677c.039f.GAE@google.com/T/#u
Signed-off-by: Eric Dumazet <edumazet@google.com>
Link: https://patch.msgid.link/20260108133651.1130486-1-edumazet@google.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-01-09 18:16:06 -08:00
Eric Dumazet
eb74c19fe1 net: update netdev_lock_{type,name}
Add missing entries in netdev_lock_type[] and netdev_lock_name[] :

CAN, MCTP, RAWIP, CAIF, IP6GRE, 6LOWPAN, NETLINK, VSOCKMON,
IEEE802154_MONITOR.

Also add a WARN_ONCE() in netdev_lock_pos() to help future bug hunting
next time a protocol is added without updating these arrays.

Fixes: 1a33e10e4a ("net: partially revert dynamic lockdep key changes")
Signed-off-by: Eric Dumazet <edumazet@google.com>
Link: https://patch.msgid.link/20260108093244.830280-1-edumazet@google.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-01-09 18:14:32 -08:00
Eric Dumazet
81c734dae2 ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv()
Blamed commit did not take care of VLAN encapsulations
as spotted by syzbot [1].

Use skb_vlan_inet_prepare() instead of pskb_inet_may_pull().

[1]
 BUG: KMSAN: uninit-value in __INET_ECN_decapsulate include/net/inet_ecn.h:253 [inline]
 BUG: KMSAN: uninit-value in INET_ECN_decapsulate include/net/inet_ecn.h:275 [inline]
 BUG: KMSAN: uninit-value in IP6_ECN_decapsulate+0x7a8/0x1fa0 include/net/inet_ecn.h:321
  __INET_ECN_decapsulate include/net/inet_ecn.h:253 [inline]
  INET_ECN_decapsulate include/net/inet_ecn.h:275 [inline]
  IP6_ECN_decapsulate+0x7a8/0x1fa0 include/net/inet_ecn.h:321
  ip6ip6_dscp_ecn_decapsulate+0x16f/0x1b0 net/ipv6/ip6_tunnel.c:729
  __ip6_tnl_rcv+0xed9/0x1b50 net/ipv6/ip6_tunnel.c:860
  ip6_tnl_rcv+0xc3/0x100 net/ipv6/ip6_tunnel.c:903
 gre_rcv+0x1529/0x1b90 net/ipv6/ip6_gre.c:-1
  ip6_protocol_deliver_rcu+0x1c89/0x2c60 net/ipv6/ip6_input.c:438
  ip6_input_finish+0x1f4/0x4a0 net/ipv6/ip6_input.c:489
  NF_HOOK include/linux/netfilter.h:318 [inline]
  ip6_input+0x9c/0x330 net/ipv6/ip6_input.c:500
  ip6_mc_input+0x7ca/0xc10 net/ipv6/ip6_input.c:590
  dst_input include/net/dst.h:474 [inline]
  ip6_rcv_finish+0x958/0x990 net/ipv6/ip6_input.c:79
  NF_HOOK include/linux/netfilter.h:318 [inline]
  ipv6_rcv+0xf1/0x3c0 net/ipv6/ip6_input.c:311
  __netif_receive_skb_one_core net/core/dev.c:6139 [inline]
  __netif_receive_skb+0x1df/0xac0 net/core/dev.c:6252
  netif_receive_skb_internal net/core/dev.c:6338 [inline]
  netif_receive_skb+0x57/0x630 net/core/dev.c:6397
  tun_rx_batched+0x1df/0x980 drivers/net/tun.c:1485
  tun_get_user+0x5c0e/0x6c60 drivers/net/tun.c:1953
  tun_chr_write_iter+0x3e9/0x5c0 drivers/net/tun.c:1999
  new_sync_write fs/read_write.c:593 [inline]
  vfs_write+0xbe2/0x15d0 fs/read_write.c:686
  ksys_write fs/read_write.c:738 [inline]
  __do_sys_write fs/read_write.c:749 [inline]
  __se_sys_write fs/read_write.c:746 [inline]
  __x64_sys_write+0x1fb/0x4d0 fs/read_write.c:746
  x64_sys_call+0x30ab/0x3e70 arch/x86/include/generated/asm/syscalls_64.h:2
  do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
  do_syscall_64+0xd3/0xf80 arch/x86/entry/syscall_64.c:94
 entry_SYSCALL_64_after_hwframe+0x77/0x7f

Uninit was created at:
  slab_post_alloc_hook mm/slub.c:4960 [inline]
  slab_alloc_node mm/slub.c:5263 [inline]
  kmem_cache_alloc_node_noprof+0x9e7/0x17a0 mm/slub.c:5315
  kmalloc_reserve+0x13c/0x4b0 net/core/skbuff.c:586
  __alloc_skb+0x805/0x1040 net/core/skbuff.c:690
  alloc_skb include/linux/skbuff.h:1383 [inline]
  alloc_skb_with_frags+0xc5/0xa60 net/core/skbuff.c:6712
  sock_alloc_send_pskb+0xacc/0xc60 net/core/sock.c:2995
  tun_alloc_skb drivers/net/tun.c:1461 [inline]
  tun_get_user+0x1142/0x6c60 drivers/net/tun.c:1794
  tun_chr_write_iter+0x3e9/0x5c0 drivers/net/tun.c:1999
  new_sync_write fs/read_write.c:593 [inline]
  vfs_write+0xbe2/0x15d0 fs/read_write.c:686
  ksys_write fs/read_write.c:738 [inline]
  __do_sys_write fs/read_write.c:749 [inline]
  __se_sys_write fs/read_write.c:746 [inline]
  __x64_sys_write+0x1fb/0x4d0 fs/read_write.c:746
  x64_sys_call+0x30ab/0x3e70 arch/x86/include/generated/asm/syscalls_64.h:2
  do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
  do_syscall_64+0xd3/0xf80 arch/x86/entry/syscall_64.c:94
 entry_SYSCALL_64_after_hwframe+0x77/0x7f

CPU: 0 UID: 0 PID: 6465 Comm: syz.0.17 Not tainted syzkaller #0 PREEMPT(none)
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025

Fixes: 8d975c15c0 ("ip6_tunnel: make sure to pull inner header in __ip6_tnl_rcv()")
Reported-by: syzbot+d4dda070f833dc5dc89a@syzkaller.appspotmail.com
Closes: https://lore.kernel.org/netdev/695e88b2.050a0220.1c677c.036d.GAE@google.com/T/#u
Signed-off-by: Eric Dumazet <edumazet@google.com>
Link: https://patch.msgid.link/20260107163109.4188620-1-edumazet@google.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-01-09 18:14:08 -08:00
Vladimir Zapolskiy
2940a49ab7 arm: dts: lpc32xx: add interrupts property to Motor Control PWM
Motor Control PWM shares an interrupt line with TIMER4 on MIC interrupt
controller, the interrupt serves as period (timer limit), pulse-width (match)
and capture event interrupt.

Signed-off-by: Vladimir Zapolskiy <vz@mleia.com>
2026-01-10 03:47:36 +02:00
Vladimir Zapolskiy
71630e581a arm: dts: lpc32xx: add clocks property to Motor Control PWM device tree node
Motor Control PWM depends on its own supply clock, the clock gate control
is present in TIMCLK_CTRL1 register.

Fixes: b7d41c937e ("ARM: LPC32xx: Add the motor PWM to base dts file")
Signed-off-by: Vladimir Zapolskiy <vz@mleia.com>
2026-01-10 03:47:36 +02:00
Linus Torvalds
cb2076b091 block-6.19-20260109
-----BEGIN PGP SIGNATURE-----
 
 iQJEBAABCAAuFiEEwPw5LcreJtl1+l5K99NY+ylx4KYFAmlhS3UQHGF4Ym9lQGtl
 cm5lbC5kawAKCRD301j7KXHgpqN1EACZI7gCMHL+CI5utvaQVPoZbyDf3jED73KO
 NwDyLKl/frGW2njbM/hcSSH0SITGYnrN0+KGr9JFIIu/AMnl+0prl74DrPjUsQ3x
 b9FwHYcjgQxPEIR39KxqSGAJTrxNxGFyS0OaTg91OMKg8Ze57WlkDRtRIJBpsTB4
 I2OUrMC34fVvjSTzefErB/eNsY3xAO8aFpWbBGD2h/GpH0f3SgGTAu7JH6Hj1Zfw
 kFWyMMSc/JkGB7wSOLxDB2IepS7PkLwlRaU6rHV3xzI1DXs24oUT8E20VU8JMedf
 WLQpzNSfqKws6KQa9LIywMo/bwA4dh3FogUJ6MflJKZoGCiMQnps4f18L6EI+w9L
 NpDCWkNgNwd6siDbTBZebd8YlqkWJYJ7NPwTl9dBdczX4DWsfej0exC2UPgN3B7R
 MQNKuP/+oC7y92igMAXIgFRQIwriVNFCsW/Q3oZSDTJSmaDc7CvONNaLnRom0sen
 1uPt/8w7bz8PkUlVUt6SFl0+KaCXX3mFUnEDiY7+du7nSUeyo1BEL6tm46q7gybC
 lRjyDWp5mz/a/JL3tmiOtavVbnyZ1iy03Nd5HfULUhsARJAQKbE+hAvBEhZGq2F2
 A4FKJgzRd7u5dBcaGLNf8H6UVml600ZX9GPkjH35tVXkqB6z87mQTfJmT6ViLKLU
 vM8AfGWbLQ==
 =DaMl
 -----END PGP SIGNATURE-----

Merge tag 'block-6.19-20260109' of git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux

Pull block fixes from Jens Axboe:

 - Kill unlikely checks for blk-rq-qos. These checks are really
   all-or-nothing, either the branch is taken all the time, or it's not.
   Depending on the configuration, either one of those cases may be
   true. Just remove the annotation

 - Fix for merging bios with different app tags set

 - Fix for a recently introduced slowdown due to RCU synchronization

 - Fix for a status change on loop while it's in use, and then a later
   fix for that fix

 - Fix for the async partition scanning in ublk

* tag 'block-6.19-20260109' of git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux:
  ublk: fix use-after-free in ublk_partition_scan_work
  blk-mq: avoid stall during boot due to synchronize_rcu_expedited
  loop: add missing bd_abort_claiming in loop_set_status
  block: don't merge bios with different app_tags
  blk-rq-qos: Remove unlikely() hints from QoS checks
  loop: don't change loop device under exclusive opener in loop_set_status
2026-01-09 15:42:46 -10:00
Rob Herring (Arm)
72dc44679b dt-bindings: net: rockchip-dwmac: Allow "dma-coherent"
The GMAC is coherent on RK3576, so allow the "dma-coherent" property.

Signed-off-by: Rob Herring (Arm) <robh@kernel.org>
Reviewed-by: Heiko Stuebner <heiko@sntech.de>
Link: https://patch.msgid.link/20260108225318.1325114-2-robh@kernel.org
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-01-09 17:38:17 -08:00
Eric Dumazet
b25a0b4a21 net: bridge: annotate data-races around fdb->{updated,used}
fdb->updated and fdb->used are read and written locklessly.

Add READ_ONCE()/WRITE_ONCE() annotations.

Fixes: 31cbc39b63 ("net: bridge: add option to allow activity notifications for any fdb entries")
Reported-by: syzbot+bfab43087ad57222ce96@syzkaller.appspotmail.com
Closes: https://lore.kernel.org/netdev/695e3d74.050a0220.1c677c.035f.GAE@google.com/
Signed-off-by: Eric Dumazet <edumazet@google.com>
Acked-by: Nikolay Aleksandrov <razor@blackwall.org>
Reviewed-by: Ido Schimmel <idosch@nvidia.com>
Link: https://patch.msgid.link/20260108093806.834459-1-edumazet@google.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-01-09 17:36:21 -08:00
Jakub Kicinski
68ec2b9fc5 selftests: forwarding: update PTP tcpdump patterns
Recent version of tcpdump (tcpdump-4.99.6-1.fc43.x86_64) seems to have
removed the spurious space after msg type in PTP info, e.g.:

 before:  PTPv2, majorSdoId: 0x0, msg type : sync msg, length: 44
 after:   PTPv2, majorSdoId: 0x0, msg type: sync msg, length: 44

Update our patterns to match both.

Reviewed-by: Alexander Sverdlin <alexander.sverdlin@gmail.com>
Link: https://patch.msgid.link/20260107145320.1837464-1-kuba@kernel.org
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-01-09 17:35:23 -08:00
Jakub Kicinski
a0ac0ff382 selftests: drv-net: gro: increase the rcvbuf size
The gro.py test (testing software GRO) is slightly flaky when
running against fbnic. We see one flake per roughly 20 runs in NIPA,
mostly in ipip.large, and always including some EAGAIN:

  # Shouldn't coalesce if exceed IP max pkt size: Test succeeded
  # Expected {65475 899 }, Total 2 packets
  # Received {65475 899 }, Total 2 packets.
  # Expected {64576 900 900 }, Total 3 packets
  # Received {64576 /home/virtme/testing/wt-24/tools/testing/selftests/drivers/net/gro: could not receive: Resource temporarily unavailable

The test sends 2 large frames (64k + change). Looks like the default
packet socket rcvbuf (~200kB) may not be large enough to hold them.
Bump the rcvbuf to 1MB.

Add a debug print showing socket statistics to make debugging this
issue easier in the future. Without the rcvbuf increase we see:

  # Shouldn't coalesce if exceed IP max pkt size: Test succeeded
  # Expected {65475 899 }, Total 2 packets
  # Received {65475 899 }, Total 2 packets.
  # Expected {64576 900 900 }, Total 3 packets
  # Received {64576 Socket stats: packets=7, drops=3
                    ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
  # /home/virtme/testing/wt-24/tools/testing/selftests/drivers/net/gro: could not receive: Resource temporarily unavailable

Reviewed-by: Willem de Bruijn <willemb@google.com>
Link: https://patch.msgid.link/20260107232557.2147760-1-kuba@kernel.org
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-01-09 17:34:30 -08:00
Jakub Kicinski
96ea4fa60c selftests: tls: avoid flakiness in data_steal
We see the following failure a few times a week:

  #  RUN           global.data_steal ...
  # tls.c:3280:data_steal:Expected recv(cfd, buf2, sizeof(buf2), MSG_DONTWAIT) (10000) == -1 (-1)
  # data_steal: Test failed
  #          FAIL  global.data_steal
  not ok 8 global.data_steal

The 10000 bytes read suggests that the child process did a recv()
of half of the data using the TLS ULP and we're now getting the
remaining half. The intent of the test is to get the child to
enter _TCP_ recvmsg handler, so it needs to enter the syscall before
parent installed the TLS recvmsg with setsockopt(SOL_TLS).

Instead of the 10msec sleep send 1 byte of data and wait for the
child to consume it.

Reviewed-by: Sabrina Dubroca <sd@queasysnail.net>
Link: https://patch.msgid.link/20260106200205.1593915-1-kuba@kernel.org
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-01-09 17:33:28 -08:00
Linus Torvalds
68ad2095ca io_uring-6.19-20260109
-----BEGIN PGP SIGNATURE-----
 
 iQJEBAABCAAuFiEEwPw5LcreJtl1+l5K99NY+ylx4KYFAmlhS1wQHGF4Ym9lQGtl
 cm5lbC5kawAKCRD301j7KXHgphGvD/9NR0RzWZdM0DwfbK4kyzfmQPCSs1kkqQF4
 LECsSc3B7OrJ/4yX27CiWNRlGdHWpmrOc8mtlAiUv+eArpoBmatjfn1UZACN0u/t
 CC0/ZXeYA6NQ8vnbnQZk+guHE7r9K66EFPFvMcEWmGGQ/CUBUKt1gkDkB1gD8qBp
 pdI/A+tZujCQA3XuyCE+qc5GJX+cFXqEx06GRDGQ+UnnAsJmSrtbUtZrEZsladMj
 16dclDfOX2X0bu9+P42rSkV2IrjwddNntDsLyF933uaayAJX9HbTTWxxw/mWr2Bt
 Be0Xh1+FniVAQFFM7qFQRqrWqecKrnh6RKg9lufWiuB4d5rq7eJT1xGb+IXX6xlr
 j/Lwbi8UkjpJmG1xnyWtk9oDQK4h+7p5MvCgCSqLrp1rY8nYT1CeCEzt1OJjeVWj
 cqm2hhkEUcioCz4gTHU8PBRxhfd4PRr/GBwZJ4jBFBeFTip1vy9kAn94Afrk/VLH
 HAreWZtsNsTDTF9cUSXyKDHYR9uGSi8NpZSEEV8dUaAKYpYBNSIutX5uqT9NBs8y
 3TJ0NrhlpVJIGwa5XtwKli62CXNsibQlNbnsd092+zvkiAAiYUiLNRaQnt3MGctk
 4eBp0sWTUkHxxKO3njUIDXZPB5g9jZvJxpjqK+V0CYzVdeimw2qs8fBQJvnYPtNw
 k3C0E2aJKQ==
 =ObKS
 -----END PGP SIGNATURE-----

Merge tag 'io_uring-6.19-20260109' of git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux

Pull io_uring fixes from Jens Axboe:
 "A single fix for a regression introduced in 6.15, where a failure to
  wake up idle io-wq workers at ring exit will wait for the timeout to
  expire.

  This isn't normally noticeable, as the exit is async.

  But if a parent task created a thread that sets up a ring and uses
  requests that cause io-wq threads to be created, and the parent task
  then waits for the thread to exit, then it can take 5 seconds for that
  pthread_join() to succeed as the child thread is waiting for its
  children to exit.

  On top of that, just a basic cleanup as well"

* tag 'io_uring-6.19-20260109' of git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux:
  io_uring/io-wq: remove io_wq_for_each_worker() return value
  io_uring/io-wq: fix incorrect io_wq_for_each_worker() termination logic
2026-01-09 15:21:15 -10:00
Linus Torvalds
e28ddd0b7a arm64 fixes:
- Do not return false if !preemptible() in current_in_efi(). EFI
    runtime services can now run with preemption enabled
 
  - Fix uninitialised variable in the arm MPAM driver, reported by sparse
 
  - Fix partial kasan_reset_tag() use in change_memory_common() when
    calculating page indices or comparing ranges
 
  - Save/restore TCR2_EL1 during suspend/resume, otherwise the E0POE bit
    is lost
 -----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCgAdFiEE5RElWfyWxS+3PLO2a9axLQDIXvEFAmlhSCwACgkQa9axLQDI
 XvFj5w/+MUtRj+UL2p2Z2BsQvU6eheiKvvoVYr6kRURlYE1YahXh1lmp8S7t2St5
 VYi41VUyT+udAmzIyQvM9GHB1co4d0BPOJcrmU+lKNM5uz/obQ6+Gf8RrHBh6XDM
 ZuoEaWB1cRlLQF3NNUNO8IHHW2PwU88jxriZSbq0jnsqFudu1n70XxSH6FH+ilb7
 MSkjP1NwaqiA+lTLAL6vCWL0XFA+qgXKMKfUPgW2QwVOM0irPAvmAciXHSwUJe69
 W3Fj5UApJVAlwCNkXh6phzwqzorCMshXebVi/Kjxoo8XA/FJ6ezIzjLIsfxTzkgp
 GrBW2sAH0xb5BQDsDsihcikKUZBF9Rpf7HtsVaaGcV5yJabo4Yz/cIyKzs9KLfI0
 INl9Scno21FK2wqH1dZn+hbLUoRewbtw5+j3HK99Y9b0vNGccHU1g0uS6Kf8Bda3
 if8adLIozRz3tcNQn9EWFAlkUYHH8XOKS0kaKTt1VVZWhRRBBTnnFqlDYxQ7Q3WH
 t1S1a568UYi6Op0kAHNm5Gl2w0xF3oMQMHnI/hNn94q63m6S/rpvjyoT4Cmg0f0F
 xW1Olxlqeve/4Siv5pBrl9SdwQT/0yZsCEqHi1NffDGooQOosXiWYR1xx+PsFRqf
 qNvBsREqWkCg/KygtFeDSajrDjOKiN+vsleMR/absogBzvHF8vc=
 =GVR8
 -----END PGP SIGNATURE-----

Merge tag 'arm64-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux

Pull arm64 fixes from Catalin Marinas:

 - Do not return false if !preemptible() in current_in_efi(). EFI
   runtime services can now run with preemption enabled

 - Fix uninitialised variable in the arm MPAM driver, reported by sparse

 - Fix partial kasan_reset_tag() use in change_memory_common() when
   calculating page indices or comparing ranges

 - Save/restore TCR2_EL1 during suspend/resume, otherwise the E0POE bit
   is lost

* tag 'arm64-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux:
  arm64: Fix cleared E0POE bit after cpu_suspend()/resume()
  arm64: mm: Fix incomplete tag reset in change_memory_common()
  arm_mpam: Stop using uninitialized variables in __ris_msmon_read()
  arm64/efi: Don't fail check current_in_efi() if preemptible
2026-01-09 15:17:48 -10:00
Linus Torvalds
e55feea3a0 soc: fixes for 6.19
The main code change is a revert of the Raspberry Pi RP1 overlay
 support that was decided to not be ready.
 
 The other fixes are all for devicetree sources:
 
  - ethernet configuration on ixp42x-actiontec-mi424wr is
    board revision specific
 
  - validation warning fixes for imx27/imx51/imx6, hikey960 and k3
 
  - Minor corrections across imx8 boards, addressing all types of
    issues with interrups, dma, ethernet and clock settings, all
    simple one-line changes.
 -----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCgAdFiEEo6/YBQwIrVS28WGKmmx57+YAGNkFAmlhOYAACgkQmmx57+YA
 GNlViQ/8CrVllBec/x8Mp7hqTTvRxYSkxnbkPcgqgOLgMyNwg0gZZeA06+EAEJK/
 Pqx/Ht86w61A9yZo2OH/p5w6GjmT17J7a0DHYSKjCuW0Dc52ZB+Xqpng2bI92YmL
 MjdG4XZ0wJDHCJ2Vt8fHPb06szZAzRyTrDQ4iK1r2/vbOep+4lvXzcS70uKlWYHY
 ipIknMork833I5lV434WRhXIg7P/wDfv6U/lXH969pngf2fbxUQipwzHxWZ5OjeE
 s1E8ESdJ7QyBhNeMJXIgeNc0jcHV/8jmyxz7D7rkcULpPeo+dNI/l65n6G9j91V/
 vt7SarnQbkoWj5Z3skwb7coMJ4P8iVBruqxT9z5yotTDgy8rR4vivwuPqiB0Kahm
 gWc00OfdyX9LxBGSdiwq1Ms+tHv2gMrfVkxzI7ppQzRlG+tokD5ZBElM6+cUdMIL
 vUoEolm42GIG8FX/QwFLCBqjrZ0b2pI41Bh8UIEBNV4w8qvcJ9BrOGBWKGI4R1uq
 vdYSS+jvqdOEsW9q9iWz2EdCSjLHoIf43ljWdYzDt3T9xw+g92b7/8h7drJwf17w
 O4nA3G7WFn57lP3YlLmZ/xeR59Zg5i/fC0Za4j5kyu96karn4ySTinxJfOPcqKMb
 mhYxs1N0cdp1r/wsXDEAxOCOQS0Yij0oQc16BfDamrsNq13BdjY=
 =2kPF
 -----END PGP SIGNATURE-----

Merge tag 'soc-fixes-6.19' of git://git.kernel.org/pub/scm/linux/kernel/git/soc/soc

Pull SoC fixes from Arnd Bergmann:
 "The main code change is a revert of the Raspberry Pi RP1 overlay
  support that was decided to not be ready.

  The other fixes are all for devicetree sources:

   - ethernet configuration on ixp42x-actiontec-mi424wr is board
     revision specific

   - validation warning fixes for imx27/imx51/imx6, hikey960 and k3

   - Minor corrections across imx8 boards, addressing all types of
     issues with interrups, dma, ethernet and clock settings, all simple
     one-line changes"

* tag 'soc-fixes-6.19' of git://git.kernel.org/pub/scm/linux/kernel/git/soc/soc: (25 commits)
  arm64: dts: hisilicon: hikey960: Drop "snps,gctl-reset-quirk" and "snps,tx_de_emphasis*" properties
  Documentation/process: maintainer-soc: Mark 'make' as commands
  Documentation/process: maintainer-soc: Be more explicit about defconfig
  arm64: dts: mba8mx: Fix Ethernet PHY IRQ support
  arm64: dts: imx8qm-ss-dma: correct the dma channels of lpuart
  arm64: dts: imx8mp: Fix LAN8740Ai PHY reference clock on DH electronics i.MX8M Plus DHCOM
  arm64: dts: freescale: tx8p-ml81: fix eqos nvmem-cells
  arm64: dts: freescale: moduline-display: fix compatible
  dt-bindings: arm: fsl: moduline-display: fix compatible
  ARM: dts: imx6q-ba16: fix RTC interrupt level
  arm64: dts: freescale: imx95-toradex-smarc: fix SMARC_SDIO_WP label position
  arm64: dts: freescale: imx95-toradex-smarc: use edge trigger for ethphy1 interrupt
  arm64: dts: add off-on-delay-us for usdhc2 regulator
  arm64: dts: imx8qm-mek: correct the light sensor interrupt type to low level
  ARM: dts: nxp: imx: Fix mc13xxx LED node names
  arm64: dts: imx95: correct I3C2 pclk to IMX95_CLK_BUSWAKEUP
  MAINTAINERS: Fix a linusw mail address
  arm64: dts: broadcom: rp1: drop RP1 overlay
  arm64: dts: broadcom: bcm2712: fix RP1 endpoint PCI topology
  misc: rp1: drop overlay support
  ...
2026-01-09 15:11:45 -10:00
Linus Torvalds
4621c338d3 A bunch of libceph fixes split evenly between memory safety and
implementation correctness issues (all marked for stable) and a change
 in maintainers for CephFS: Slava and Alex have formally taken over
 Xiubo's role.
 -----BEGIN PGP SIGNATURE-----
 
 iQFHBAABCAAxFiEEydHwtzie9C7TfviiSn/eOAIR84sFAmlhPnYTHGlkcnlvbW92
 QGdtYWlsLmNvbQAKCRBKf944AhHzi+xRB/4wW8+zp9w+AzK023uL93A9iU4yPM+/
 XYRSIhnR0VWdGTwQsSiQmuwT9RVW5ElH1o0Zzt9BBM9XW8BTIyDnCcdd4yYT+fRc
 ZCG5JUXF0rRgSXYWTpHfEUg5H0wAFCruhhv51vfAuxe5+AFh+7J2/Ct2SraIMt7r
 brShR7vqxUgaBp4TINdsEZBSNBhEIUkPbulZxDDq4+uFN5Cl1ZgESm4QOdxqZFJ8
 lkvPRRjh7rpSIUfULSyH6UVvS/FsSjXrL1rhszlGbgwc297ox+UTk+dOfko8gdmL
 /l92y6Si5CdCxEwLGHvW4lW7qWj9ba9g8v9DCy1BL6dE+CbY1HSjgtJB
 =bROV
 -----END PGP SIGNATURE-----

Merge tag 'ceph-for-6.19-rc5' of https://github.com/ceph/ceph-client

Pull ceph fixes from Ilya Dryomov:
 "A bunch of libceph fixes split evenly between memory safety and
  implementation correctness issues (all marked for stable) and a change
  in maintainers for CephFS: Slava and Alex have formally taken over
  Xiubo's role"

* tag 'ceph-for-6.19-rc5' of https://github.com/ceph/ceph-client:
  libceph: make calc_target() set t->paused, not just clear it
  libceph: reset sparse-read state in osd_fault()
  libceph: return the handler error from mon_handle_auth_done()
  libceph: make free_choose_arg_map() resilient to partial allocation
  ceph: update co-maintainers list in MAINTAINERS
  libceph: replace overzealous BUG_ON in osdmap_apply_incremental()
  libceph: prevent potential out-of-bounds reads in handle_auth_done()
2026-01-09 15:05:19 -10:00
Alison Schofield
49d1063479 cxl/acpi: Restore HBIW check before dereferencing platform_data
Commit 4fe516d2ad ("cxl/acpi: Make the XOR calculations available
for testing") split xormap handling code to create a reusable helper
function but inadvertently dropped the check of HBIW values before
dereferencing cxlrd->platform_data. When HBIW is 1 or 3, no xormaps
are needed and platform_data may be NULL, leading to a potential NULL
pointer dereference.

Affects platform configs using XOR Arithmetic with HBIWs of 1 or 3,
when performing DPA->HPA address translation for CXL events. Those
events would be any of poison ops, general media, or dram.

Restore the early return check for HBIW values of 1 and 3 before
dereferencing platform_data.

Fixes: 4fe516d2ad ("cxl/acpi: Make the XOR calculations available for testing")
Signed-off-by: Alison Schofield <alison.schofield@intel.com>
Reviewed-by: Dave Jiang <dave.jiang@intel.com>
Link: https://patch.msgid.link/20260109194946.431083-1-alison.schofield@intel.com
Signed-off-by: Dave Jiang <dave.jiang@intel.com>
2026-01-09 17:12:03 -07:00
Andy Shevchenko
e254b75897 driver core: make bus_find_device_by_acpi_dev() stub prototype aligned
Currently the bus_find_device_by_acpi_dev() stub for !CONFIG_ACPI case
takes a const void * parameter instead of const struct acpi_device *.
As long as it's a pointer, we may named it as we want to with the help
of a forward declaration. Hence move the declaration out of the
ifdeffery and use the same prototype in both cases. This adds a bit of
an additional type checking at a compilation time.

Signed-off-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
Link: https://patch.msgid.link/20251229144325.1252197-1-andriy.shevchenko@linux.intel.com
[ Fix minor typo in the commit message. - Danilo ]
Signed-off-by: Danilo Krummrich <dakr@kernel.org>
2026-01-10 01:03:53 +01:00
Varun R Mallya
5714ca8cba libbpf: Fix OOB read in btf_dump_get_bitfield_value
When dumping bitfield data, btf_dump_get_bitfield_value() reads data
based on the underlying type's size (t->size). However, it does not
verify that the provided data buffer (data_sz) is large enough to
contain these bytes.

If btf_dump__dump_type_data() is called with a buffer smaller than
the type's size, this leads to an out-of-bounds read. This was
confirmed by AddressSanitizer in the linked issue.

Fix this by ensuring we do not read past the provided data_sz limit.

Fixes: a1d3cc3c5e ("libbpf: Avoid use of __int128 in typed dump display")
Reported-by: Harrison Green <harrisonmichaelgreen@gmail.com>
Suggested-by: Alan Maguire <alan.maguire@oracle.com>
Signed-off-by: Varun R Mallya <varunrmallya@gmail.com>
Signed-off-by: Andrii Nakryiko <andrii@kernel.org>
Link: https://lore.kernel.org/bpf/20260106233527.163487-1-varunrmallya@gmail.com

Closes: https://github.com/libbpf/libbpf/issues/928
2026-01-09 15:54:31 -08:00
Xiaochen Shen
86063a2568 selftests/resctrl: Fix non-contiguous CBM check for Hygon
The resctrl selftest currently fails on Hygon CPUs that always supports
non-contiguous CBM, printing the error:

  "# Hardware and kernel differ on non-contiguous CBM support!"

This occurs because the arch_supports_noncont_cat() function lacks
vendor detection for Hygon CPUs, preventing proper identification of
their non-contiguous CBM capability.

Fix this by adding Hygon vendor ID detection to
arch_supports_noncont_cat().

Link: https://lore.kernel.org/r/20251217030456.3834956-5-shenxiaochen@open-hieco.net
Signed-off-by: Xiaochen Shen <shenxiaochen@open-hieco.net>
Reviewed-by: Reinette Chatre <reinette.chatre@intel.com>
Reviewed-by: Fenghua Yu <fenghuay@nvidia.com>
Signed-off-by: Shuah Khan <skhan@linuxfoundation.org>
2026-01-09 16:49:01 -07:00
Xiaochen Shen
367f931e64 selftests/resctrl: Add CPU vendor detection for Hygon
The resctrl selftest currently fails on Hygon CPUs that support Platform
QoS features, printing the error:

  "# Can not get vendor info..."

This occurs because vendor detection is missing for Hygon CPUs.

Fix this by extending the CPU vendor detection logic to include
Hygon's vendor ID.

Link: https://lore.kernel.org/r/20251217030456.3834956-4-shenxiaochen@open-hieco.net
Signed-off-by: Xiaochen Shen <shenxiaochen@open-hieco.net>
Reviewed-by: Reinette Chatre <reinette.chatre@intel.com>
Signed-off-by: Shuah Khan <skhan@linuxfoundation.org>
2026-01-09 16:49:01 -07:00
Xiaochen Shen
4f4f01cc33 selftests/resctrl: Define CPU vendor IDs as bits to match usage
The CPU vendor IDs are required to be unique bits because they're used
for vendor_specific bitmask in the struct resctrl_test.
Consider for example their usage in test_vendor_specific_check():
	return get_vendor() & test->vendor_specific

However, the definitions of CPU vendor IDs in file resctrl.h is quite
subtle as a bitmask value:
  #define ARCH_INTEL     1
  #define ARCH_AMD       2

A clearer and more maintainable approach is to define these CPU vendor
IDs using BIT(). This ensures each vendor corresponds to a distinct bit
and makes it obvious when adding new vendor IDs.

Accordingly, update the return types of detect_vendor() and get_vendor()
from 'int' to 'unsigned int' to align with their usage as bitmask values
and to prevent potentially risky type conversions.

Furthermore, introduce a bool flag 'initialized' to simplify the
get_vendor() -> detect_vendor() logic. This ensures the vendor ID is
detected only once and resolves the ambiguity of using the same variable
'vendor' both as a value and as a state.

Link: https://lore.kernel.org/r/20251217030456.3834956-3-shenxiaochen@open-hieco.net
Suggested-by: Reinette Chatre <reinette.chatre@intel.com>
Suggested-by: Fenghua Yu <fenghuay@nvidia.com>
Signed-off-by: Xiaochen Shen <shenxiaochen@open-hieco.net>
Reviewed-by: Reinette Chatre <reinette.chatre@intel.com>
Signed-off-by: Shuah Khan <skhan@linuxfoundation.org>
2026-01-09 16:49:01 -07:00
Xiaochen Shen
671ef08d94 selftests/resctrl: Fix a division by zero error on Hygon
Change to adjust effective L3 cache size with SNC enabled change
introduced the snc_nodes_per_l3_cache() function to detect the Intel
Sub-NUMA Clustering (SNC) feature by comparing #CPUs in node0 with #CPUs
sharing LLC with CPU0. The function was designed to return:
  (1) >1: SNC mode is enabled.
  (2)  1: SNC mode is not enabled or not supported.

However, on certain Hygon CPUs, #CPUs sharing LLC with CPU0 is actually
less than #CPUs in node0. This results in snc_nodes_per_l3_cache()
returning 0 (calculated as cache_cpus / node_cpus).

This leads to a division by zero error in get_cache_size():
  *cache_size /= snc_nodes_per_l3_cache();

Causing the resctrl selftest to fail with:
  "Floating point exception (core dumped)"

Fix the issue by ensuring snc_nodes_per_l3_cache() returns 1 when SNC
mode is not supported on the platform.

Updated commit log to fix commit has issues:
Shuah Khan <skhan@linuxfoundation.org>

Link: https://lore.kernel.org/r/20251217030456.3834956-2-shenxiaochen@open-hieco.net
Fixes: a1cd99e700 ("selftests/resctrl: Adjust effective L3 cache size with SNC enabled")
Signed-off-by: Xiaochen Shen <shenxiaochen@open-hieco.net>
Reviewed-by: Reinette Chatre <reinette.chatre@intel.com>
Reviewed-by: Fenghua Yu <fenghuay@nvidia.com>
Signed-off-by: Shuah Khan <skhan@linuxfoundation.org>
2026-01-09 16:48:11 -07:00
Marc Zyngier
86364832ba KVM: arm64: Don't blindly set set PSTATE.PAN on guest exit
We set PSTATE.PAN to 1 on exiting from a guest if PAN support has
been compiled in and that it exists on the HW. However, this is not
necessarily correct.

In a nVHE configuration, there is no notion of PAN at EL2, so setting
PSTATE.PAN to anything is pointless.

Furthermore, not setting PAN to 0 when CONFIG_ARM64_PAN isn't set
means we run with the *guest's* PSTATE.PAN (which might be set to 1),
and we will explode on the next userspace access. Yes, the architecture
is delightful in that particular corner.

Fix the whole thing by always setting PAN to something when running
VHE (which implies PAN support), and only ignore it when running nVHE.

Reported-by: Mark Rutland <mark.rutland@arm.com>
Signed-off-by: Marc Zyngier <maz@kernel.org>
Link: https://msgid.link/20260107124600.2736328-1-maz@kernel.org
Signed-off-by: Oliver Upton <oupton@kernel.org>
2026-01-09 15:43:14 -08:00
Oliver Upton
9e27085c33 KVM: arm64: nv: Respect stage-2 write permssion when setting stage-1 AF
Naturally, updating the Access Flag in a stage-1 descriptor requires
write permission at stage-2, although this isn't actually enforced in
KVM's software PTW.

Generate a stage-2 permission fault if the stage-1 walk attempts to
update the descriptor and its corresponding stage-2 translation lacks
write permission.

Fixes: bff8aa213d ("KVM: arm64: Implement HW access flag management in stage-1 SW PTW")
Reviewed-by: Marc Zyngier <maz@kernel.org>
Link: https://msgid.link/20260108204230.677172-1-oupton@kernel.org
Signed-off-by: Oliver Upton <oupton@kernel.org>
2026-01-09 15:40:34 -08:00
Dongxu Sun
9cb2c20f06 KVM: arm64: Remove unused vcpu_{clear,set}_wfx_traps()
Function vcpu_{clear,set}_wfx_traps() are unused since
commit 0b5afe0537 ("KVM: arm64: Add early_param to
control WFx trapping").
Remove it.

Reviewed-by: Zenghui Yu <yuzenghui@huawei.com>
Signed-off-by: Dongxu Sun <sundongxu1024@163.com>
Link: https://msgid.link/20260109080226.761107-1-sundongxu1024@163.com
Signed-off-by: Oliver Upton <oupton@kernel.org>
2026-01-09 15:40:18 -08:00
Xin Wang
98466abe4e drm/xe: Allow compressible surfaces to be 1-way coherent
Previously, compressible surfaces were required to be non-coherent
(allocated as WC) because compression and coherency were mutually
exclusive. Starting with Xe3, hardware supports combining compression
with 1-way coherency, allowing compressible surfaces to be allocated as
WB memory. This provides applications with more efficient memory
allocation by avoiding WC allocation overhead that can cause system
stuttering and memory management challenges.

The implementation adds support for compressed+coherent PAT entry for
the xe3_lpg devices and updates the driver logic to handle the new
compression capabilities.

v2: (Matthew Auld)
 - Improved error handling with XE_IOCTL_DBG()
 - Enhanced documentation and comments
 - Fixed xe_bo_needs_ccs_pages() outdated compression assumptions

v3:
 - Improve WB compression support detection by checking PAT table
   instead of version check

v4:
 - Add XE_CACHE_WB_COMPRESSION, which simplifies the logic.

v5:
 - Use U16_MAX for the invalid PAT index. (Matthew Auld)

Bspec: 71582, 59361, 59399
Cc: Matthew Auld <matthew.auld@intel.com>
Cc: Matt Roper <matthew.d.roper@intel.com>
Signed-off-by: Xin Wang <x.wang@intel.com>
Reviewed-by: Matthew Auld <matthew.auld@intel.com>
Link: https://patch.msgid.link/20260109093007.546784-1-x.wang@intel.com
Signed-off-by: Matt Roper <matthew.d.roper@intel.com>
2026-01-09 14:55:58 -08:00
Fushuai Wang
6e39903c73 selftests/tracing: Fix test_multiple_writes stall
When /sys/kernel/tracing/buffer_size_kb is less than 12KB,
the test_multiple_writes test will stall and wait for more
input due to insufficient buffer space.

Check current buffer_size_kb value before the test. If it is
less than 12KB, it temporarily increase the buffer to 12KB,
and restore the original value after the tests are completed.

Link: https://lore.kernel.org/r/20260109033620.25727-1-fushuai.wang@linux.dev
Fixes: 37f4660138 ("selftests/tracing: Add basic test for trace_marker_raw file")
Suggested-by: Steven Rostedt <rostedt@goodmis.org>
Signed-off-by: Fushuai Wang <wangfushuai@baidu.com>
Acked-by: Steven Rostedt (Google) <rostedt@goodmis.org>
Signed-off-by: Shuah Khan <skhan@linuxfoundation.org>
2026-01-09 15:49:32 -07:00
Tony Luck
842e7f97d7 x86/resctrl: Add energy/perf choices to rdt boot option
Legacy resctrl features are enumerated by X86_FEATURE_* flags. These may be
overridden by quirks to disable features in the case of errata.  Users can use
kernel command line options to either disable a feature, or to force enable
a feature that was disabled by a quirk.

A different approach is needed for hardware features that do not have an
X86_FEATURE_* flag.

Update parsing of the "rdt=" boot parameter to call the telemetry driver
directly to handle new "perf" and "energy" options that controls activation of
telemetry monitoring of the named type. By itself a "perf" or "energy" option
controls the forced enabling or disabling (with ! prefix) of all event groups
of the named type. A ":guid" suffix allows for fine grained control per event
group.

  [ bp: s/intel_aet_option/intel_handle_aet_option/g ]

Signed-off-by: Tony Luck <tony.luck@intel.com>
Signed-off-by: Borislav Petkov (AMD) <bp@alien8.de>
Reviewed-by: Reinette Chatre <reinette.chatre@intel.com>
Link: https://lore.kernel.org/20251217172121.12030-1-tony.luck@intel.com
2026-01-09 23:38:32 +01:00
Tony Luck
f4e0cd80d3 x86,fs/resctrl: Handle domain creation/deletion for RDT_RESOURCE_PERF_PKG
The L3 resource has several requirements for domains. There are per-domain
structures that hold the 64-bit values of counters, and elements to keep
track of the overflow and limbo threads.

None of these are needed for the PERF_PKG resource. The hardware counters
are wide enough that they do not wrap around for decades.

Define a new rdt_perf_pkg_mon_domain structure which just consists of the
standard rdt_domain_hdr to keep track of domain id and CPU mask.

Update resctrl_online_mon_domain() for RDT_RESOURCE_PERF_PKG. The only action
needed for this resource is to create and populate domain directories if a
domain is added while resctrl is mounted.

Similarly resctrl_offline_mon_domain() only needs to remove domain directories.

Signed-off-by: Tony Luck <tony.luck@intel.com>
Signed-off-by: Borislav Petkov (AMD) <bp@alien8.de>
Reviewed-by: Reinette Chatre <reinette.chatre@intel.com>
Link: https://lore.kernel.org/20251217172121.12030-1-tony.luck@intel.com
2026-01-09 23:36:41 +01:00
Tony Luck
93d9fd8999 fs/resctrl: Refactor rmdir_mondata_subdir_allrdtgrp()
Clearing a monitor group's mon_data directory is complicated because of the
support for Sub-NUMA Cluster (SNC) mode.

Refactor the SNC case into a helper function to make it easier to add support
for a new telemetry resource.

Suggested-by: Reinette Chatre <reinette.chatre@intel.com>
Signed-off-by: Tony Luck <tony.luck@intel.com>
Signed-off-by: Borislav Petkov (AMD) <bp@alien8.de>
Reviewed-by: Reinette Chatre <reinette.chatre@intel.com>
Link: https://lore.kernel.org/20251217172121.12030-1-tony.luck@intel.com
2026-01-09 23:02:58 +01:00
Tony Luck
0ec1db4cac fs/resctrl: Refactor mkdir_mondata_subdir()
Population of a monitor group's mon_data directory is unreasonably complicated
because of the support for Sub-NUMA Cluster (SNC) mode.

Split out the SNC code into a helper function to make it easier to add support
for a new telemetry resource.

Move all the duplicated code to make and set owner of domain directories into
the mon_add_all_files() helper and rename to _mkdir_mondata_subdir().

Suggested-by: Reinette Chatre <reinette.chatre@intel.com>
Signed-off-by: Tony Luck <tony.luck@intel.com>
Signed-off-by: Borislav Petkov (AMD) <bp@alien8.de>
Reviewed-by: Reinette Chatre <reinette.chatre@intel.com>
Link: https://lore.kernel.org/20251217172121.12030-1-tony.luck@intel.com
2026-01-09 23:02:57 +01:00
Tony Luck
51541f6ca7 x86/resctrl: Read telemetry events
Introduce intel_aet_read_event() to read telemetry events for resource
RDT_RESOURCE_PERF_PKG. There may be multiple aggregators tracking each
package, so scan all of them and add up all counters. Aggregators may return
an invalid data indication if they have received no records for a given RMID.
The user will see "Unavailable" if none of the aggregators on a package
provide valid counts.

Resctrl now uses readq() so depends on X86_64. Update Kconfig.

Signed-off-by: Tony Luck <tony.luck@intel.com>
Signed-off-by: Borislav Petkov (AMD) <bp@alien8.de>
Reviewed-by: Reinette Chatre <reinette.chatre@intel.com>
Link: https://lore.kernel.org/20251217172121.12030-1-tony.luck@intel.com
2026-01-09 23:02:57 +01:00
Tony Luck
7e6df96145 x86/resctrl: Find and enable usable telemetry events
Every event group has a private copy of the data of all telemetry event
aggregators (aka "telemetry regions") tracking its feature type. Included
may be regions that have the same feature type but tracking different GUID
from the event group's.

Traverse the event group's telemetry region data and mark all regions that
are not usable by the event group as unusable by clearing those regions'
MMIO addresses. A region is considered unusable if:
1) GUID does not match the GUID of the event group.
2) Package ID is invalid.
3) The enumerated size of the MMIO region does not match the expected
   value from the XML description file.

Hereafter any telemetry region with an MMIO address is considered valid for
the event group it is associated with.

Enable all the event group's events as long as there is at least one usable
region from where data for its events can be read. Enabling of an event can
fail if the same event has already been enabled as part of another event
group. It should never happen that the same event is described by different
GUID supported by the same system so just WARN (via resctrl_enable_mon_event())
and skip the event.

Note that it is architecturally possible that some telemetry events are only
supported by a subset of the packages in the system. It is not expected that
systems will ever do this. If they do the user will see event files in resctrl
that always return "Unavailable".

Signed-off-by: Tony Luck <tony.luck@intel.com>
Signed-off-by: Borislav Petkov (AMD) <bp@alien8.de>
Reviewed-by: Reinette Chatre <reinette.chatre@intel.com>
Link: https://lore.kernel.org/20251217172121.12030-1-tony.luck@intel.com
2026-01-09 23:02:45 +01:00
Huisong Li
24b09e8491 ACPI: processor: Do not expose global variable acpi_idle_driver
Move the cpuidle driver check from __acpi_processor_start() to
acpi_processor_power_init() which allows variable acpi_idle_driver to
become static.

No intentional functional impact.

Signed-off-by: Huisong Li <lihuisong@huawei.com>
Tested-by: Borislav Petkov (AMD) <bp@alien8.de>
Link: https://patch.msgid.link/20251223100914.2407069-7-lihuisong@huawei.com
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
2026-01-09 22:38:22 +01:00
Huisong Li
d8e43c89cf ACPI: processor: idle: Rearrange declarations in header file
Group all of the declarations of functions that belong to the ACPI
processor idle driver together in one place in processor.h.

While at it, drop the unnecessary extern modifier from the declaraions
of two functions.

Signed-off-by: Huisong Li <lihuisong@huawei.com>
Tested-by: Borislav Petkov (AMD) <bp@alien8.de>
Link: https://patch.msgid.link/20251223100914.2407069-6-lihuisong@huawei.com
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
2026-01-09 22:38:22 +01:00
Rafael J. Wysocki
31612f3642 ACPI: processor: idle: Redefine two functions as void
Notice that acpi_processor_power_init() and acpi_processor_power_exit()
don't need to return any values because their callers don't check them
anyway, so redefine those functions as void.

While at it, rearrange the code in acpi_processor_power_init() to
reduce the indentation level, get rid of a redundant local variable
in that function, and rephrase a code comment in it.

No intentional functional impact.

Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
Reviewed-by: Mario Limonciello (AMD) <superm1@kernel.org>
Tested-by: Borislav Petkov (AMD) <bp@alien8.de>
Link: https://patch.msgid.link/20251223100914.2407069-5-lihuisong@huawei.com
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
2026-01-09 22:38:22 +01:00