summaryrefslogtreecommitdiff
AgeCommit message (Collapse)Author
2025-12-05Merge tag 'trace-v6.19' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace Pull tracing updates from Steven Rostedt: - Extend tracing option mask to 64 bits The trace options were defined by a 32 bit variable. This limits the tracing instances to have a total of 32 different options. As that limit has been hit, and more options are being added, increase the option mask to a 64 bit number, doubling the number of options available. As this is required for the kprobe topic branches as well as the tracing topic branch, a separate branch was created and merged into both. - Make trace_user_fault_read() available for the rest of tracing The function trace_user_fault_read() is used by trace_marker file read to allow reading user space to be done fast and without locking or allocations. Make this available so that the system call trace events can use it too. - Have system call trace events read user space values Now that the system call trace events callbacks are called in a faultable context, take advantage of this and read the user space buffers for various system calls. For example, show the path name of the openat system call instead of just showing the pointer to that path name in user space. Also show the contents of the buffer of the write system call. Several system call trace events are updated to make tracing into a light weight strace tool for all applications in the system. - Update perf system call tracing to do the same - And a config and syscall_user_buf_size file to control the size of the buffer Limit the amount of data that can be read from user space. The default size is 63 bytes but that can be expanded to 165 bytes. - Allow the persistent ring buffer to print system calls normally The persistent ring buffer prints trace events by their type and ignores the print_fmt. This is because the print_fmt may change from kernel to kernel. As the system call output is fixed by the system call ABI itself, there's no reason to limit that. This makes reading the system call events in the persistent ring buffer much nicer and easier to understand. - Add options to show text offset to function profiler The function profiler that counts the number of times a function is hit currently lists all functions by its name and offset. But this becomes ambiguous when there are several functions with the same name. Add a tracing option that changes the output to be that of '_text+offset' instead. Now a user space tool can use this information to map the '_text+offset' to the unique function it is counting. - Report bad dynamic event command If a bad command is passed to the dynamic_events file, report it properly in the error log. - Clean up tracer options Clean up the tracer option code a bit, by removing some useless code and also using switch statements instead of a series of if statements. - Have tracing options be instance specific Tracers can have their own options (function tracer, irqsoff tracer, function graph tracer, etc). But now that the same tracer can be enabled in multiple trace instances, their options are still global. The API is per instance, thus changing one affects other instances. This isn't even consistent, as the option take affect differently depending on when an tracer started in an instance. Make the options for instances only affect the instance it is changed under. - Optimize pid_list lock contention Whenever the pid_list is read, it uses a spin lock. This happens at every sched switch. Taking the lock at sched switch can be removed by instead using a seqlock counter. - Clean up the trace trigger structures The trigger code uses two different structures to implement a single tigger. This was due to trying to reuse code for the two different types of triggers (always on trigger, and count limited trigger). But by adding a single field to one structure, the other structure could be absorbed into the first structure making he code easier to understand. - Create a bulk garbage collector for trace triggers If user space has triggers for several hundreds of events and then removes them, it can take several seconds to complete. This is because each removal calls tracepoint_synchronize_unregister() that can take hundreds of milliseconds to complete. Instead, create a helper thread that will do the clean up. When a trigger is removed, it will create the kthread if it isn't already created, and then add the trigger to a llist. The kthread will take the items off the llist, call tracepoint_synchronize_unregister(), and then remove the items it took off. It will then check if there's more items to free before sleeping. This makes user space removing all these triggers to finish in less than a second. - Allow function tracing of some of the tracing infrastructure code Because the tracing code can cause recursion issues if it is traced by the function tracer the entire tracing directory disables function tracing. But not all of tracing causes issues if it is traced. Namely, the event tracing code. Add a config that enables some of the tracing code to be traced to help in debugging it. Note, when this is enabled, it does add noise to general function tracing, especially if events are enabled as well (which is a common case). - Add boot-time backup instance for persistent buffer The persistent ring buffer is used mostly for kernel crash analysis in the field. One issue is that if there's a crash, the data in the persistent ring buffer must be read before tracing can begin using it. This slows down the boot process. Once tracing starts in the persistent ring buffer, the old data must be freed and the addresses no longer match and old events can't be in the buffer with new events. Create a way to create a backup buffer that copies the persistent ring buffer at boot up. Then after a crash, the always on tracer can begin immediately as well as the normal boot process while the crash analysis tooling uses the backup buffer. After the backup buffer is finished being read, it can be removed. - Enable function graph args and return address options at the same time Currently the when reading of arguments in the function graph tracer is enabled, the option to record the parent function in the entry event can not be enabled. Update the code so that it can. - Add new struct_offset() helper macro Add a new macro that takes a pointer to a structure and a name of one of its members and it will return the offset of that member. This allows the ring buffer code to simplify the following: From: size = struct_size(entry, buf, cnt - sizeof(entry->id)); To: size = struct_offset(entry, id) + cnt; There should be other simplifications that this macro can help out with as well * tag 'trace-v6.19' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace: (42 commits) overflow: Introduce struct_offset() to get offset of member function_graph: Enable funcgraph-args and funcgraph-retaddr to work simultaneously tracing: Add boot-time backup of persistent ring buffer ftrace: Allow tracing of some of the tracing code tracing: Use strim() in trigger_process_regex() instead of skip_spaces() tracing: Add bulk garbage collection of freeing event_trigger_data tracing: Remove unneeded event_mutex lock in event_trigger_regex_release() tracing: Merge struct event_trigger_ops into struct event_command tracing: Remove get_trigger_ops() and add count_func() from trigger ops tracing: Show the tracer options in boot-time created instance ftrace: Avoid redundant initialization in register_ftrace_direct tracing: Remove unused variable in tracing_trace_options_show() fgraph: Make fgraph_no_sleep_time signed tracing: Convert function graph set_flags() to use a switch() statement tracing: Have function graph tracer option sleep-time be per instance tracing: Move graph-time out of function graph options tracing: Have function graph tracer option funcgraph-irqs be per instance trace/pid_list: optimize pid_list->lock contention tracing: Have function graph tracer define options per instance tracing: Have function tracer define options per instance ...
2025-12-05Merge tag 'tracepoints-v6.19' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace Pull unused tracepoints update from Steven Rostedt: "Detect unused tracepoints. If a tracepoint is defined but never used (TRACE_EVENT() created but no trace_<tracepoint>() called), it can take up to or more than 5K of memory each. This can add up as there are around a hundred unused tracepoints with various configs. That is 500K of wasted memory. Add a make build parameter of "UT=1" to have the build warn if an unused tracepoint is detected in the build. This allows detection of unused tracepoints to be upstream so that outreachy and the mentoring project can have new developers look for fixing them, without having these warnings suddenly show up when someone upgrades their kernel. When all known unused tracepoints are removed, then the "UT=1" build parameter can be removed and unused tracepoints will always warn. This will catch new unused tracepoints after the current ones have been removed. Summary: - Separate out elf functions from sorttable.c Move out the ELF parsing functions from sorttable.c so that the tracing tooling can use it. - Add a tracepoint verifier tool to the build process If "UT=1" is added to the kernel command line, any unused tracepoints will trigger a warning at build time. - Do not warn about unused tracepoints for tracepoints that are exported There are sever cases where a tracepoint is created by the kernel and used by modules. Since there's no easy way to detect if these are truly unused since the users are in modules, if a tracepoint is exported, assume it will eventually be used by a module. Note, there's not many exported tracepoints so this should not be a problem to ignore them. - Have building of modules also detect unused tracepoints Do not only check the main vmlinux for unused tracepoints, also check modules. If a module is defining a tracepoint it should be using it. - Add the tracepoint-update program to the ignore file The new tracepoint-update program needs to be ignored by git" * tag 'tracepoints-v6.19' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace: scripts: add tracepoint-update to the list of ignores files tracing: Add warnings for unused tracepoints for modules tracing: Allow tracepoint-update.c to work with modules tracepoint: Do not warn for unused event that is exported tracing: Add a tracepoint verification check at build time sorttable: Move ELF parsing into scripts/elf-parse.[ch]
2025-12-05Merge tag 'trace-tools-v6.19' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace Pull rtla trace tooling updates from Steven Rostedt: - Officially add Tomas Glozar as a maintainer to RTLA tool - Add for_each_monitored_cpu() helper In multiple places, RTLA tools iterate over the list of CPUs running tracer threads. Use single helper instead of repeating the for/if combination. - Remove unused variable option_index in argument parsing RTLA tools use getopt_long() for argument parsing. For its last argument, an unused variable "option_index" is passed. Remove the variable and pass NULL to getopt_long() to shorten the naturally long parsing functions, and make them more readable. - Fix unassigned nr_cpus after code consolidation In recent code consolidation, timerlat tool cleanup, previously implemented separately for each tool, was moved to a common function timerlat_free(). The cleanup relies on nr_cpus being set. This was not done in the new function, leaving the variable uninitialized. Initialize the variable properly, and remove silencing of compiler warning for uninitialized variables. - Stop tracing on user latency in BPF mode Despite the name, rtla-timerlat's -T/--thread option sets timerlat's stop_tracing_total_us option, which also stops tracing on return-from-user latency, not only on thread latency. Implement the same behavior also in BPF sample collection stop tracing handler to avoid a discrepancy and restore correspondence of behavior with the equivalent option of cyclictest. - Fix threshold actions always triggering A bug in threshold action logic caused the action to execute even if tracing did not stop because of threshold. Fix the logic to stop correctly. - Fix few minor issues in tests Extend tests that were shown to need it to 5s, fix osnoise test calling timerlat by mistake, and use new, more reliable output checking in timerlat's "top stop at failed action" test. - Do not print usage on argument parsing error RTLA prints the entire usage message on encountering errors in argument parsing, like a malformed CPU list. The usage message has gotten too long. Instead of printing it, use newly added fatal() helper function to simply exit with the error message, excluding the usage. - Fix unintuitive -C/--cgroup interface "-C cgroup" and "--cgroup cgroup" are invalid syntax, despite that being a common way to specify an option with argument. Moreover, using them fails silently and no cgroup is set. Create new helper function to unify the handling of all such options and allow all of: -Xsomething -X=something -X something as well as the equivalent for the long option. - Fix -a overriding -t argument filename Fix a bug where -a following -t custom_file.txt overrides the custom filename with the default timerlat_trace.txt. - Stop tracing correctly on multiple events at once In some race scenarios, RTLA BPF sample collection might send multiple stop tracing events via the BPF ringbuffer at once. Compare the number of events for != 0 instead of == 1 to cover for this scenario and stop tracing properly. * tag 'trace-tools-v6.19' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace: rtla/timerlat: Exit top main loop on any non-zero wait_retval rtla/tests: Don't rely on matching ^1ALL rtla: Fix -a overriding -t argument rtla: Fix -C/--cgroup interface tools/rtla: Replace osnoise_hist_usage("...") with fatal("...") tools/rtla: Replace osnoise_top_usage("...") with fatal("...") tools/rtla: Replace timerlat_hist_usage("...") with fatal("...") tools/rtla: Replace timerlat_top_usage("...") with fatal("...") tools/rtla: Add fatal() and replace error handling pattern rtla/tests: Fix osnoise test calling timerlat rtla/tests: Extend action tests to 5s tools/rtla: Fix --on-threshold always triggering rtla/timerlat_bpf: Stop tracing on user latency tools/rtla: Fix unassigned nr_cpus tools/rtla: Remove unused optional option_index tools/rtla: Add for_each_monitored_cpu() helper MAINTAINERS: Add Tomas Glozar as a maintainer to RTLA tool
2025-12-05io_uring/poll: unify poll waitqueue entry and list removalJens Axboe
For some cases, the order in which the waitq entry list and head writing happens is important, for others it doesn't really matter. But it's somewhat confusing to have them spread out over the file. Abstract out the nicely documented code in io_pollfree_wake() and move it into a helper, and use that helper consistently rather than having other call sites manually do the same thing. While at it, correct a comment function name as well. Signed-off-by: Jens Axboe <axboe@kernel.dk>
2025-12-05Merge tag 'hardening-v6.19-rc1' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/kees/linux Pull hardening updates from Kees Cook: - string: Add missing kernel-doc return descriptions (Kriish Sharma) - Update some mis-typed allocations These correct some accidentally wrong types used in allocations (that didn't affect the resulting size) that never got picked up from the batch I sent a few months ago. - Enable GCC diagnostic context for value-tracking warnings This results in better GCC diagnostics for the value range tracking, so we can get better visibility into where those values are coming from when we get out-of-bounds warnings at compile time. * tag 'hardening-v6.19-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/kees/linux: kbuild: Enable GCC diagnostic context for value-tracking warnings string: Add missing kernel-doc return descriptions media: iris: Cast iris_hfi_gen2_get_instance() allocation type drm/plane: Remove const qualifier from plane->modifiers allocation type comedi: Adjust range_table_list allocation type
2025-12-05Merge tag 'pstore-v6.19-rc1' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/kees/linux Pull pstore update from Kees Cook: - pstore/ram: Update module parameters from platform data (Tzung-Bi Shih) * tag 'pstore-v6.19-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/kees/linux: pstore/ram: Update module parameters from platform data
2025-12-05Merge tag 'configfs-for-v6.19' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/a.hindborg/linux Pull configfs updates from Andreas Hindborg: "Two commits changing constness of the configfs vtable pointers. We plan to follow up with changes at call sites down the road" * tag 'configfs-for-v6.19' of git://git.kernel.org/pub/scm/linux/kernel/git/a.hindborg/linux: configfs: Constify ct_item_ops in struct config_item_type configfs: Constify ct_group_ops in struct config_item_type
2025-12-05io_uring/kbuf: use WRITE_ONCE() for userspace-shared buffer ring fieldsJoanne Koong
buf->addr and buf->len reside in memory shared with userspace. They should be written with WRITE_ONCE() to guarantee atomic stores and prevent tearing or other unsafe compiler optimizations. Signed-off-by: Joanne Koong <joannelkoong@gmail.com> Cc: Caleb Sander Mateos <csander@purestorage.com> Signed-off-by: Jens Axboe <axboe@kernel.dk>
2025-12-05Merge tag 'samsung-dt-6.19' of ↵Arnd Bergmann
https://git.kernel.org/pub/scm/linux/kernel/git/krzk/linux into soc/dt Samsung DTS ARM changes for v6.19 Fix WiFi on Exynos4210 and Exynos4412 boards with Broadcom chip after system suspend and resume, by using cap-power-off-card to power off the WiFi during suspend. * tag 'samsung-dt-6.19' of https://git.kernel.org/pub/scm/linux/kernel/git/krzk/linux: ARM: dts: samsung: exynos4412-midas: turn off SDIO WLAN chip during system suspend ARM: dts: samsung: exynos4210-trats: turn off SDIO WLAN chip during system suspend ARM: dts: samsung: exynos4210-i9100: turn off SDIO WLAN chip during system suspend ARM: dts: samsung: universal_c210: turn off SDIO WLAN chip during system suspend Signed-off-by: Arnd Bergmann <arnd@arndb.de>
2025-12-05Merge tag 'samsung-drivers-6.19-2-late' of ↵Arnd Bergmann
https://git.kernel.org/pub/scm/linux/kernel/git/krzk/linux into soc/drivers-late Samsung SoC drivers for v6.19, part two Two fixes for Exynos PMU (Power Management Unit) driver: 1. Silence lockdep warning being actually a false positive, but quite disturbing during testing. Issue was introduced in v6.18. 2. Drop device refcount when requesting device regmap with exynos_get_pmu_regmap_by_phandle(). Issue was introduced much earlier (around v6.9), with code being rewritten in between. * tag 'samsung-drivers-6.19-2-late' of https://git.kernel.org/pub/scm/linux/kernel/git/krzk/linux: soc: samsung: exynos-pmu: fix device leak on regmap lookup soc: samsung: exynos-pmu: Fix structure initialization Signed-off-by: Arnd Bergmann <arnd@arndb.de>
2025-12-05ARM: omap1: avoid symbol clashes in fiq handlerArnd Bergmann
The ams-delta-fiq-handler.S file has a number of symbols with fairly generic names, including one named 'exit' that causes a compiler warning in some configuration options: vmlinux.o: error: exit() function name creates ambiguity with -ffunction-sections Change all these symbols to use a .L prefix to make them local to the fiq handler. Reviewed-by: Janusz Krzysztofik <jmkrzyszt@gmail.com> Link: https://lore.kernel.org/r/20251204095355.1032786-1-arnd@kernel.org Signed-off-by: Arnd Bergmann <arnd@arndb.de>
2025-12-05vfs: use UAPI types for new struct delegation definitionThomas Weißschuh
Using libc types and headers from the UAPI headers is problematic as it introduces a dependency on a full C toolchain. Use the fixed-width integer types provided by the UAPI headers instead. Fixes: 1602bad16d7d ("vfs: expose delegation support to userland") Fixes: 4be9e04ebf75 ("vfs: add needed headers for new struct delegation definition") Signed-off-by: Thomas Weißschuh <thomas.weissschuh@linutronix.de> Link: https://patch.msgid.link/20251203-uapi-fcntl-v1-1-490c67bf3425@linutronix.de Acked-by: Arnd Bergmann <arnd@arndb.de> Acked-by: Jeff Layton <jlayton@kernel.org> Signed-off-by: Christian Brauner <brauner@kernel.org>
2025-12-05mqueue: correct the type of ro to intEdward Adam Davis
The ro variable, being of type bool, caused the -EROFS return value from mnt_want_write() to be implicitly converted to 1. This prevented the file from being correctly acquired, thus triggering the issue reported by syzbot [1]. Changing the type of ro to int allows the system to correctly identify the reason for the file open failure. [1] KASAN: null-ptr-deref in range [0x0000000000000040-0x0000000000000047] Call Trace: do_mq_open+0x5a0/0x770 ipc/mqueue.c:932 __do_sys_mq_open ipc/mqueue.c:945 [inline] __se_sys_mq_open ipc/mqueue.c:938 [inline] __x64_sys_mq_open+0x16a/0x1c0 ipc/mqueue.c:938 Fixes: f2573685bd0c ("ipc: convert do_mq_open() to FD_ADD()") Reported-by: syzbot+40f42779048f7476e2e0@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=40f42779048f7476e2e0 Tested-by: syzbot+40f42779048f7476e2e0@syzkaller.appspotmail.com Signed-off-by: Edward Adam Davis <eadavis@qq.com> Link: https://patch.msgid.link/tencent_369728EA76ED36CD98793A6D942C956C4C0A@qq.com Reviewed-by: Jan Kara <jack@suse.cz> Signed-off-by: Christian Brauner <brauner@kernel.org>
2025-12-05Revert "net/socket: convert sock_map_fd() to FD_ADD()"Christian Brauner
This reverts commit 245f0d1c622b0183ce4f44b3e39aeacf78fae594. When allocating a file sock_alloc_file() consumes the socket reference unconditionally which isn't correctly handled in the conversion. This can be fixed by massaging this appropriately but this is best left for next cycle. Reported-by: Xin Long <lucien.xin@gmail.com> Link: https://lore.kernel.org/CADvbK_ewub4ZZK-tZg8GBQbDFHWhd9a48C+AFXZ93pMsssCrUg@mail.gmail.com Signed-off-by: Christian Brauner <brauner@kernel.org>
2025-12-059p: fix new mount API cache option handlingEric Sandeen
After commit 4eb3117888a92, 9p needs to be able to accept numerical cache= mount options as well as the string "shortcuts" because the option is printed numerically in /proc/mounts rather than by string. This was missed in the mount API conversion, which used an enum for the shortcuts and therefore could not handle a numeric equivalent as an argument to the cache option. Fix this by removing the enum and reverting to the slightly more open-coded option handling for Opt_cache, with the reinstated get_cache_mode() helper. Signed-off-by: Eric Sandeen <sandeen@redhat.com> Message-ID: <48cdeec9-5bb9-4c7a-a203-39bb8e0ef443@redhat.com> Tested-by: Remi Pommarel <repk@triplefau.lt> Signed-off-by: Dominique Martinet <asmadeus@codewreck.org>
2025-12-059p: fix cache/debug options printing in v9fs_show_optionsEric Sandeen
commit 4eb3117888a92 changed the cache= option to accept either string shortcuts or bitfield values. It also changed /proc/mounts to emit the option as the hexadecimal numeric value rather than the shortcut string. However, by printing "cache=%x" without the leading 0x, shortcuts such as "cache=loose" will emit "cache=f" and 'f' is not a string that is parseable by kstrtoint(), so remounting may fail if a remount with "cache=f" is attempted. debug=%x has had the same problem since options have been displayed in c4fac9100456 ("9p: Implement show_options") Fix these by adding the 0x prefix to the hexadecimal value shown in /proc/mounts. Fixes: 4eb3117888a92 ("fs/9p: Rework cache modes and add new options to Documentation") Signed-off-by: Eric Sandeen <sandeen@redhat.com> Message-ID: <54b93378-dcf1-4b04-922d-c8b4393da299@redhat.com> [Dominique: use %#x at Al Viro's suggestion, also handle debug] Tested-by: Remi Pommarel <repk@triplefau.lt> Signed-off-by: Dominique Martinet <asmadeus@codewreck.org>
2025-12-05fbdev: ssd1307fb: fix potential page leak in ssd1307fb_probe()Abdun Nihaal
The page allocated for vmem using __get_free_pages() is not freed on the error paths after it. Fix that by adding a corresponding __free_pages() call to the error path. Fixes: facd94bc458a ("fbdev: ssd1307fb: Allocate page aligned video memory.") Signed-off-by: Abdun Nihaal <nihaal@cse.iitm.ac.in> Signed-off-by: Helge Deller <deller@gmx.de>
2025-12-05drivers/xen: use min() instead of min_t()David Laight
min_t(unsigned int, a, b) casts an 'unsigned long' to 'unsigned int'. Use min(a, b) instead as it promotes any 'unsigned int' to 'unsigned long' and so cannot discard significant bits. In this case the 'unsigned long' value is small enough that the result is ok. Detected by an extra check added to min_t(). Signed-off-by: David Laight <david.laight.linux@gmail.com> Reviewed-by: Juergen Gross <jgross@suse.com> Message-ID: <20251119224140.8616-30-david.laight.linux@gmail.com> Signed-off-by: Juergen Gross <jgross@suse.com>
2025-12-05tpm2-sessions: Open code tpm_buf_append_hmac_session()Jarkko Sakkinen
Open code 'tpm_buf_append_hmac_session_opt' to the call site, as it only masks a call sequence and does otherwise nothing particularly useful. Signed-off-by: Jarkko Sakkinen <jarkko.sakkinen@opinsys.com> Reviewed-by: Jonathan McDowell <noodles@meta.com>
2025-12-05tpm2-sessions: Remove 'attributes' parameter from tpm_buf_append_authJarkko Sakkinen
Remove 'attributes' parameter from 'tpm_buf_append_auth', as it is not used by the function. Fixes: 27184f8905ba ("tpm: Opt-in in disable PCR integrity protection") Signed-off-by: Jarkko Sakkinen <jarkko.sakkinen@opinsys.com> Reviewed-by: Jonathan McDowell <noodles@meta.com>
2025-12-05tpm2-sessions: Fix tpm2_read_public range checksJarkko Sakkinen
tpm2_read_public() has some rudimentary range checks but the function does not ensure that the response buffer has enough bytes for the full TPMT_HA payload. Re-implement the function with necessary checks and validation, and return name and name size for all handle types back to the caller. Cc: stable@vger.kernel.org # v6.10+ Fixes: d0a25bb961e6 ("tpm: Add HMAC session name/handle append") Signed-off-by: Jarkko Sakkinen <jarkko@kernel.org> Reviewed-by: Jonathan McDowell <noodles@meta.com>
2025-12-05tpm2-sessions: Fix out of range indexing in name_sizeJarkko Sakkinen
'name_size' does not have any range checks, and it just directly indexes with TPM_ALG_ID, which could lead into memory corruption at worst. Address the issue by only processing known values and returning -EINVAL for unrecognized values. Make also 'tpm_buf_append_name' and 'tpm_buf_fill_hmac_session' fallible so that errors are detected before causing any spurious TPM traffic. End also the authorization session on failure in both of the functions, as the session state would be then by definition corrupted. Cc: stable@vger.kernel.org # v6.10+ Fixes: 1085b8276bb4 ("tpm: Add the rest of the session HMAC API") Reviewed-by: Jonathan McDowell <noodles@meta.com> Signed-off-by: Jarkko Sakkinen <jarkko@kernel.org>
2025-12-04Merge tag 'caps-pr-20251204' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/sergeh/linux Pull capabilities update from Serge Hallyn: "Ryan Foster had sent a patch to add testing of the rootid_owns_currentns() function. That patch pointed out that this function was not as clear as it should be. Fix it: - Clarify the intent of the function in the name - Split the function so that the base functionality is easier to test from a kunit test" * tag 'caps-pr-20251204' of git://git.kernel.org/pub/scm/linux/kernel/git/sergeh/linux: Clarify the rootid_owns_currentns
2025-12-04Merge tag 'nvme-6.19-2025-12-04' of git://git.infradead.org/nvme into block-6.19Jens Axboe
Pull NVMe updates from Keith: "- Subsystem usage cleanups (Max) - Endpoint device fixes (Shin'ichiro) - Debug statements (Gerd) - FC fabrics cleanups and fixes (Daniel) - Consistent alloc API usages (Israel) - Code comment updates (Chu) - Authentication retry fix (Justin)" * tag 'nvme-6.19-2025-12-04' of git://git.infradead.org/nvme: nvme-fabrics: add ENOKEY to no retry criteria for authentication failures nvme-auth: use kvfree() for memory allocated with kvcalloc() nvmet-tcp: use kvcalloc for commands array nvmet-rdma: use kvcalloc for commands and responses arrays nvme: fix typo error in nvme target nvmet-fc: use pr_* print macros instead of dev_* nvmet-fcloop: remove unused lsdir member. nvmet-fcloop: check all request and response have been processed nvme-fc: check all request and response have been processed nvme-fc: don't hold rport lock when putting ctrl nvme-pci: add debug message on fail to read CSTS nvme-pci: print error message on failure in nvme_probe nvmet: pci-epf: fix DMA channel debug print nvmet: pci-epf: move DMA initialization to EPC init callback nvmet: remove redundant subsysnqn field from ctrl nvmet: add sanity checks when freeing subsystem
2025-12-04Merge tag 'drm-next-2025-12-05' of https://gitlab.freedesktop.org/drm/kernelLinus Torvalds
Pull more drm updates from Dave Airlie: "There was some additional intel code for color operations we wanted to land. However I discovered I missed a pull for the xe vfio driver which I had sorted into 6.20 in my brain, until Thomas mentioned it. This contains the xe vfio code, a bunch of xe fixes that were waiting and the i915 color management support. I'd like to include it as part of keeping the two main vendors on the same page and giving a good cross-driver experience for userspace when it starts using it. vfio: - add a vfio_pci variant driver for Intel xe/i915 display: - add plane color management support xe: - Add scope-based cleanup helper for runtime PM - vfio xe driver prerequisites and exports - fix vfio link error - Fix a memory leak - Fix a 64-bit division - vf migration fix - LRC pause fix" * tag 'drm-next-2025-12-05' of https://gitlab.freedesktop.org/drm/kernel: (25 commits) drm/i915/color: Enable Plane Color Pipelines drm/i915/color: Add 3D LUT to color pipeline drm/i915/color: Add registers for 3D LUT drm/i915/color: Program Plane Post CSC Registers drm/i915/color: Program Pre-CSC registers drm/i915/color: Add framework to program PRE/POST CSC LUT drm/i915: Add register definitions for Plane Post CSC drm/i915: Add register definitions for Plane Degamma drm/i915/color: Add plane CTM callback for D12 and beyond drm/i915/color: Preserve sign bit when int_bits is Zero drm/i915/color: Add framework to program CSC drm/i915/color: Create a transfer function color pipeline drm/i915/color: Add helper to create intel colorop drm/i915: Add intel_color_op drm/i915/display: Add identifiers for driver specific blocks drm/xe/pf: fix VFIO link error drm/xe: Protect against unset LRC when pausing submissions drm/xe/vf: Start re-emission from first unsignaled job during VF migration drm/xe/pf: Use div_u64 when calculating GGTT profile drm/xe: Fix memory leak when handling pagefault vma ...
2025-12-04Merge tag 'tpmdd-next-6.19-rc1-v4' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/jarkko/linux-tpmdd Pull tpm updates from Jarkko Sakkinen: "This contains changes to unify TPM return code translation between trusted_tpm2 and TPM driver itself. Other than that the changes are either bug fixes or minor imrovements" * tag 'tpmdd-next-6.19-rc1-v4' of git://git.kernel.org/pub/scm/linux/kernel/git/jarkko/linux-tpmdd: KEYS: trusted: Use tpm_ret_to_err() in trusted_tpm2 tpm: Use -EPERM as fallback error code in tpm_ret_to_err tpm: Cap the number of PCR banks tpm: Remove tpm_find_get_ops tpm: add WQ_PERCPU to alloc_workqueue users tpm_crb: add missing loc parameter to kerneldoc tpm_crb: Fix a spelling mistake selftests: tpm2: Fix ill defined assertions
2025-12-04Merge tag 'ata-6.19-rc1' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/libata/linux Pull ata updates from Niklas Cassel: - Add DT binding for the Eswin EIC7700 SoC SATA Controller (Yulin Lu) - Allow 'iommus' property in the Synopsys DWC AHCI SATA controller DT binding (Rob Herring) - Replace deprecated strcpy with strscpy in the pata_it821x driver (Thorsten Blum) - Add Iomega Clik! PCMCIA ATA/ATAPI Adapter PCMCIA ID to the pata_pcmcia driver (René Rebe) - Add ATA_QUIRK_NOLPM quirk for two Silicon Motion SSDs with broken LPM support (me) - Add flag WQ_PERCPU to the workqueue in the libata-sff helper library to explicitly request the use of the per-CPU behavior (Marco Crivellari) * tag 'ata-6.19-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/libata/linux: ata: libata-core: Disable LPM on Silicon Motion MD619{H,G}XCLDE3TC ata: pata_pcmcia: Add Iomega Clik! PCMCIA ATA/ATAPI Adapter ata: libata-sff: add WQ_PERCPU to alloc_workqueue users dt-bindings: ata: snps,dwc-ahci: Allow 'iommus' property ata: pata_it821x: Replace deprecated strcpy with strscpy in it821x_display_disk dt-bindings: ata: eswin: Document for EIC7700 SoC ahci
2025-12-04Merge tag 'for_linus' of git://git.kernel.org/pub/scm/linux/kernel/git/mst/vhostLinus Torvalds
Pull virtio updates from Michael Tsirkin: "Just a bunch of fixes and cleanups, mostly very simple. Several features were merged through net-next this time around" * tag 'for_linus' of git://git.kernel.org/pub/scm/linux/kernel/git/mst/vhost: virtio_pci: drop kernel.h vhost: switch to arrays of feature bits vhost/test: add test specific macro for features virtio: clean up features qword/dword terms vduse: add WQ_PERCPU to alloc_workqueue users virtio_balloon: add WQ_PERCPU to alloc_workqueue users vdpa/pds: use %pe for ERR_PTR() in event handler registration vhost: Fix kthread worker cgroup failure handling virtio: vdpa: Fix reference count leak in octep_sriov_enable() vdpa/mlx5: Fix incorrect error code reporting in query_virtqueues virtio: fix map ops comment virtio: fix virtqueue_set_affinity() docs virtio: standardize Returns documentation style virtio: fix grammar in virtio_map_ops docs virtio: fix grammar in virtio_queue_info docs virtio: fix whitespace in virtio_config_ops virtio: fix typo in virtio_device_ready() comment virtio: fix kernel-doc for mapping/free_coherent functions virtio_vdpa: fix misleading return in void function
2025-12-04Merge tag 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/rdma/rdmaLinus Torvalds
Pull rdma updates from Jason Gunthorpe: "This has another new RDMA driver 'bng_en' for latest generation Broadcom NICs. There might be one more new driver still to come. Otherwise it is a fairly quite cycle. Summary: - Minor driver bug fixes and updates to cxgb4, rxe, rdmavt, bnxt_re, mlx5 - Many bug fix patches for irdma - WQ_PERCPU annotations and system_dfl_wq changes - Improved mlx5 support for "other eswitches" and multiple PFs - 1600Gbps link speed reporting support. Four Digits Now! - New driver bng_en for latest generation Broadcom NICs - Bonding support for hns - Adjust mlx5's hmm based ODP to work with the very large address space created by the new 5 level paging default on x86 - Lockdep fixups in rxe and siw" * tag 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/rdma/rdma: (65 commits) RDMA/rxe: reclassify sockets in order to avoid false positives from lockdep RDMA/siw: reclassify sockets in order to avoid false positives from lockdep RDMA/bng_re: Remove prefetch instruction RDMA/core: Reduce cond_resched() frequency in __ib_umem_release RDMA/irdma: Fix SRQ shadow area address initialization RDMA/irdma: Remove doorbell elision logic RDMA/irdma: Do not set IBK_LOCAL_DMA_LKEY for GEN3+ RDMA/irdma: Do not directly rely on IB_PD_UNSAFE_GLOBAL_RKEY RDMA/irdma: Add missing mutex destroy RDMA/irdma: Fix SIGBUS in AEQ destroy RDMA/irdma: Add a missing kfree of struct irdma_pci_f for GEN2 RDMA/irdma: Fix data race in irdma_free_pble RDMA/irdma: Fix data race in irdma_sc_ccq_arm RDMA/mlx5: Add support for 1600_8x lane speed RDMA/core: Add new IB rate for XDR (8x) support IB/mlx5: Reduce IMR KSM size when 5-level paging is enabled RDMA/bnxt_re: Pass correct flag for dma mr creation RDMA/bnxt_re: Fix the inline size for GenP7 devices RDMA/hns: Support reset recovery for bond RDMA/hns: Support link state reporting for bond ...
2025-12-04Merge tag 'for-linus-iommufd' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/jgg/iommufd Pull iommufd updates from Jason Gunthorpe: "This is a pretty consequential cycle for iommufd, though this pull is not too big. It is based on a shared branch with VFIO that introduces VFIO_DEVICE_FEATURE_DMA_BUF a DMABUF exporter for VFIO device's MMIO PCI BARs. This was a large multiple series journey over the last year and a half. Based on that work IOMMUFD gains support for VFIO DMABUF's in its existing IOMMU_IOAS_MAP_FILE, which closes the last major gap to support PCI peer to peer transfers within VMs. In Joerg's iommu tree we have the "generic page table" work which aims to consolidate all the duplicated page table code in every iommu driver into a single algorithm. This will be used by iommufd to implement unique page table operations to start adding new features and improve performance. In here: - Expand IOMMU_IOAS_MAP_FILE to accept a DMABUF exported from VFIO. This is the first step to broader DMABUF support in iommufd, right now it only works with VFIO. This closes the last functional gap with classic VFIO type 1 to safely support PCI peer to peer DMA by mapping the VFIO device's MMIO into the IOMMU. - Relax SMMUv3 restrictions on nesting domains to better support qemu's sequence to have an identity mapping before the vSID is established" * tag 'for-linus-iommufd' of git://git.kernel.org/pub/scm/linux/kernel/git/jgg/iommufd: iommu/arm-smmu-v3-iommufd: Allow attaching nested domain for GBPA cases iommufd/selftest: Add some tests for the dmabuf flow iommufd: Accept a DMABUF through IOMMU_IOAS_MAP_FILE iommufd: Have iopt_map_file_pages convert the fd to a file iommufd: Have pfn_reader process DMABUF iopt_pages iommufd: Allow MMIO pages in a batch iommufd: Allow a DMABUF to be revoked iommufd: Do not map/unmap revoked DMABUFs iommufd: Add DMABUF to iopt_pages vfio/pci: Add vfio_pci_dma_buf_iommufd_map()
2025-12-04Merge tag 'vfio-v6.19-rc1' of https://github.com/awilliam/linux-vfioLinus Torvalds
Pull VFIO updates from Alex Williamson: - Move libvfio selftest artifacts in preparation of more tightly coupled integration with KVM selftests (David Matlack) - Fix comment typo in mtty driver (Chu Guangqing) - Support for new hardware revision in the hisi_acc vfio-pci variant driver where the migration registers can now be accessed via the PF. When enabled for this support, the full BAR can be exposed to the user (Longfang Liu) - Fix vfio cdev support for VF token passing, using the correct size for the kernel structure, thereby actually allowing userspace to provide a non-zero UUID token. Also set the match token callback for the hisi_acc, fixing VF token support for this this vfio-pci variant driver (Raghavendra Rao Ananta) - Introduce internal callbacks on vfio devices to simplify and consolidate duplicate code for generating VFIO_DEVICE_GET_REGION_INFO data, removing various ioctl intercepts with a more structured solution (Jason Gunthorpe) - Introduce dma-buf support for vfio-pci devices, allowing MMIO regions to be exposed through dma-buf objects with lifecycle managed through move operations. This enables low-level interactions such as a vfio-pci based SPDK drivers interacting directly with dma-buf capable RDMA devices to enable peer-to-peer operations. IOMMUFD is also now able to build upon this support to fill a long standing feature gap versus the legacy vfio type1 IOMMU backend with an implementation of P2P support for VM use cases that better manages the lifecycle of the P2P mapping (Leon Romanovsky, Jason Gunthorpe, Vivek Kasireddy) - Convert eventfd triggering for error and request signals to use RCU mechanisms in order to avoid a 3-way lockdep reported deadlock issue (Alex Williamson) - Fix a 32-bit overflow introduced via dma-buf support manifesting with large DMA buffers (Alex Mastro) - Convert nvgrace-gpu vfio-pci variant driver to insert mappings on fault rather than at mmap time. This conversion serves both to make use of huge PFNMAPs but also to both avoid corrected RAS events during reset by now being subject to vfio-pci-core's use of unmap_mapping_range(), and to enable a device readiness test after reset (Ankit Agrawal) - Refactoring of vfio selftests to support multi-device tests and split code to provide better separation between IOMMU and device objects. This work also enables a new test suite addition to measure parallel device initialization latency (David Matlack) * tag 'vfio-v6.19-rc1' of https://github.com/awilliam/linux-vfio: (65 commits) vfio: selftests: Add vfio_pci_device_init_perf_test vfio: selftests: Eliminate INVALID_IOVA vfio: selftests: Split libvfio.h into separate header files vfio: selftests: Move vfio_selftests_*() helpers into libvfio.c vfio: selftests: Rename vfio_util.h to libvfio.h vfio: selftests: Stop passing device for IOMMU operations vfio: selftests: Move IOVA allocator into iova_allocator.c vfio: selftests: Move IOMMU library code into iommu.c vfio: selftests: Rename struct vfio_dma_region to dma_region vfio: selftests: Upgrade driver logging to dev_err() vfio: selftests: Prefix logs with device BDF where relevant vfio: selftests: Eliminate overly chatty logging vfio: selftests: Support multiple devices in the same container/iommufd vfio: selftests: Introduce struct iommu vfio: selftests: Rename struct vfio_iommu_mode to iommu_mode vfio: selftests: Allow passing multiple BDFs on the command line vfio: selftests: Split run.sh into separate scripts vfio: selftests: Move run.sh into scripts directory vfio/nvgrace-gpu: wait for the GPU mem to be ready vfio/nvgrace-gpu: Inform devmem unmapped after reset ...
2025-12-04crypto/ccp: Fix CONFIG_PCI=n buildDan Williams
It turns out that the PCI driver for ccp is unconditionally built into the kernel in the CONFIG_PCI=y case. This means that the new SEV-TIO support needs an explicit dependency on PCI to avoid build errors when CONFIG_CRYPTO_DEV_SP_PSP=y and CONFIG_PCI=n. Reported-by: kernel test robot <lkp@intel.com> Closes: http://lore.kernel.org/202512030743.6pVPA4sx-lkp@intel.com Cc: Alexey Kardashevskiy <aik@amd.com> Cc: Tom Lendacky <thomas.lendacky@amd.com> Cc: John Allen <john.allen@amd.com> Acked-by: Alexey Kardashevskiy <aik@amd.com> Link: https://patch.msgid.link/20251203031948.2471431-1-dan.j.williams@intel.com Signed-off-by: Dan Williams <dan.j.williams@intel.com>
2025-12-04Merge tag 'iommu-updates-v6.19' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/iommu/linux Pull iommu updates from Joerg Roedel: - Introduction of the generic IO page-table framework with support for Intel and AMD IOMMU formats from Jason. This has good potential for unifying more IO page-table implementations and making future enhancements more easy. But this also needed quite some fixes during development. All known issues have been fixed, but my feeling is that there is a higher potential than usual that more might be needed. - Intel VT-d updates: - Use right invalidation hint in qi_desc_iotlb() - Reduce the scope of INTEL_IOMMU_FLOPPY_WA - ARM-SMMU updates: - Qualcomm device-tree binding updates for Kaanapali and Glymur SoCs and a new clock for the TBU. - Fix error handling if level 1 CD table allocation fails. - Permit more than the architectural maximum number of SMRs for funky Qualcomm mis-implementations of SMMUv2. - Mediatek driver: - MT8189 iommu support - Move ARM IO-pgtable selftests to kunit - Device leak fixes for a couple of drivers - Random smaller fixes and improvements * tag 'iommu-updates-v6.19' of git://git.kernel.org/pub/scm/linux/kernel/git/iommu/linux: (81 commits) iommupt/vtd: Support mgaw's less than a 4 level walk for first stage iommupt/vtd: Allow VT-d to have a larger table top than the vasz requires powerpc/pseries/svm: Make mem_encrypt.h self contained genpt: Make GENERIC_PT invisible iommupt: Avoid a compiler bug with sw_bit iommu/arm-smmu-qcom: Enable use of all SMR groups when running bare-metal iommupt: Fix unlikely flows in increase_top() iommu/amd: Propagate the error code returned by __modify_irte_ga() in modify_irte_ga() MAINTAINERS: Update my email address iommu/arm-smmu-v3: Fix error check in arm_smmu_alloc_cd_tables dt-bindings: iommu: qcom_iommu: Allow 'tbu' clock iommu/vt-d: Restore previous domain::aperture_end calculation iommu/vt-d: Fix unused invalidation hint in qi_desc_iotlb iommu/vt-d: Set INTEL_IOMMU_FLOPPY_WA depend on BLK_DEV_FD iommu/tegra: fix device leak on probe_device() iommu/sun50i: fix device leak on of_xlate() iommu/omap: simplify probe_device() error handling iommu/omap: fix device leaks on probe_device() iommu/mediatek-v1: add missing larb count sanity check iommu/mediatek-v1: fix device leaks on probe() ...
2025-12-04Merge tag 'cxl-for-6.19' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/cxl/cxl Pull compute express link (CXL) updates from Dave Jiang: "The additions of note are adding CXL region remove support for locked CXL decoders, adding unit testing support for XOR address translation, and adding unit testing support for extended linear cache. Misc: - Remove incorrect page-allocator quirk section in documentation - Remove unused devm_cxl_port_enumerate_dports() function - Fix typo in cdat.c code comment - Replace use of system_wq with system_percpu_wq - Add locked CXL decoder support for region removal - Return when generic target updated - Rename region_res_match_cxl_range() to spa_maps_hpa() - Clarify comment in spa_maps_hpa() Enable unit testing for XOR address translation of SPA to DPA and vice versa: - Refactor address translation funcs for testing in cxl_region - Make the XOR calculations available for testing - Add cxl_translate module for address translation testing in cxl_test Extended Linear Cache changes: - Add extended linear cache size sysfs attribute - Adjust failure emission of extended linear cache detection in cxl_acpi - Added extended linear cache unit testing support in cxl_test Preparation refactor patches for PRM translation support: - Simplify cxl_rd_ops allocation and handling - Group xor arithmetric setup code in a single block - Remove local variable @inc in cxl_port_setup_targets()" * tag 'cxl-for-6.19' of git://git.kernel.org/pub/scm/linux/kernel/git/cxl/cxl: (22 commits) cxl/test: Assign overflow_err_count from log->nr_overflow cxl/test: Remove ret_limit race condition in mock_get_event() cxl/test: remove unused mock function for cxl_rcd_component_reg_phys() cxl/test: Add support for acpi extended linear cache cxl/test: Add cxl_test CFMWS support for extended linear cache cxl/test: Standardize CXL auto region size cxl/region: Remove local variable @inc in cxl_port_setup_targets() cxl/acpi: Group xor arithmetric setup code in a single block cxl: Simplify cxl_rd_ops allocation and handling cxl: Clarify comment in spa_maps_hpa() cxl: Rename region_res_match_cxl_range() to spa_maps_hpa() acpi/hmat: Return when generic target is updated cxl: Add handling of locked CXL decoder cxl/region: Add support to indicate region has extended linear cache cxl: Adjust extended linear cache failure emission in cxl_acpi cxl/test: Add cxl_translate module for address translation testing cxl/acpi: Make the XOR calculations available for testing cxl/region: Refactor address translation funcs for testing cxl/pci: replace use of system_wq with system_percpu_wq cxl: fix typos in cdat.c comments ...
2025-12-04virt: Fix Kconfig warning when selecting TSM without VIRT_DRIVERSNathan Chancellor
After commit 3225f52cde56 ("PCI/TSM: Establish Secure Sessions and Link Encryption"), there is a Kconfig warning when selecting CONFIG_TSM without CONFIG_VIRT_DRIVERS: WARNING: unmet direct dependencies detected for TSM Depends on [n]: VIRT_DRIVERS [=n] Selected by [y]: - PCI_TSM [=y] && PCI [=y] CONFIG_TSM is defined in drivers/virt/coco/Kconfig but this Kconfig is only sourced when CONFIG_VIRT_DRIVERS is enabled. Since this symbol is hidden with no dependencies, it should be available without a symbol that just enables a menu. Move the sourcing of drivers/virt/coco/Kconfig outside of CONFIG_VIRT_DRIVERS and wrap the other source statements in drivers/virt/coco/Kconfig with CONFIG_VIRT_DRIVERS to ensure users do not get any additional prompts while ensuring CONFIG_TSM is always available to select. This complements commit 110c155e8a68 ("drivers/virt: Drop VIRT_DRIVERS build dependency"), which addressed the build issue that this Kconfig warning was pointing out. Fixes: 3225f52cde56 ("PCI/TSM: Establish Secure Sessions and Link Encryption") Reported-by: kernel test robot <lkp@intel.com> Closes: https://lore.kernel.org/oe-kbuild-all/202511140712.NubhamPy-lkp@intel.com/ Signed-off-by: Nathan Chancellor <nathan@kernel.org> Link: https://patch.msgid.link/20251203-fix-pci-tsm-select-tsm-warning-v1-1-c3959c1cb110@kernel.org Signed-off-by: Dan Williams <dan.j.williams@intel.com>
2025-12-04Merge tag 'pci-v6.19-changes' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/pci/pci Pull PCI updates from Bjorn Helgaas: "Enumeration: - Enable host bridge emulation for PCI_DOMAINS_GENERIC platforms (Dan Williams) - Switch vmd from custom domain number allocator to the common allocator to prevent a potential race with new non-VMD buses (Dan Williams) - Enable Precision Time Measurement (PTM) only if device advertises support for a relevant role, to prevent invalid PTM Requests that cause ACS violations that are reported as AER Uncorrectable Non-Fatal errors (Mika Westerberg) Resource management: - Prevent resource tree corruption when BAR resize fails (Ilpo Järvinen) - Restore BARs to the original size if a BAR resize fails (Ilpo Järvinen) - Remove BAR release from BAR resize attempts by the xe, i915, and amdgpu drivers so the PCI core can restore BARs if the resize fails (Ilpo Järvinen) - Move Resizable BAR code to rebar.c (Ilpo Järvinen) - Add pci_rebar_size_supported() and use it in i915 and xe (Ilpo Järvinen) - Add pci_rebar_get_max_size() and use it in xe and amdgpu (Ilpo Järvinen) Power management and error handling: - For drivers using PCI legacy suspend, save config state at suspend so that state (not any earlier state from enumeration, probe, or error recovery) will be restored when resuming (Lukas Wunner) - For devices with no driver or a driver that lacks power management, save config state at hibernate so that state (not any earlier state from enumeration, probe, or error recovery) will be restored when resuming (Lukas Wunner) - Save device config space on device addition, before driver binding, so error recovery works more reliably (Lukas Wunner) - Drop pci_save_state() from several drivers that no longer need it since the PCI core always does it and pci_restore_state() no longer invalidates the saved state (Lukas Wunner) - Document use of pci_save_state() by drivers to capture the state they want restored during error recovery (Lukas Wunner) Power control: - Add a struct pci_ops.assert_perst() function pointer to assert/deassert PCIe PERST# and implement it for the qcom driver (Krishna Chaitanya Chundru) - Add DT binding and pwrctrl driver for the Toshiba TC9563 PCIe switch, which must be held in reset after poweron so the pwrctrl driver can configure the switch via I2C before bringing up the links (Krishna Chaitanya Chundru) Endpoint framework: - Convert the endpoint doorbell test to use a threaded IRQ to fix a 'sleeping while atomic' issue (Bhanu Seshu Kumar Valluri) - Add endpoint VNTB MSI doorbell support to reduce latency between host and endpoint (Frank Li) New native PCIe controller drivers: - Add CIX Sky1 host controller DT binding and driver (Hans Zhang) - Add NXP S32G host controller DT binding and driver (Vincent Guittot) - Add Renesas RZ/G3S host controller DT binding and driver (Claudiu Beznea) - Add SpacemiT K1 host controller DT binding and driver (Alex Elder) Amlogic Meson PCIe controller driver: - Update DT binding to name DBI region 'dbi', not 'elbi', and update driver to support both (Manivannan Sadhasivam) Apple PCIe controller driver: - Move struct pci_host_bridge allocation from pci_host_common_init() to callers, which significantly simplifies pcie-apple (Marc Zyngier) Broadcom STB PCIe controller driver: - Disable advertising ASPM L0s support correctly (Jim Quinlan) - Add a panic/die handler to print diagnostic info in case PCIe caused an unrecoverable abort (Jim Quinlan) Cadence PCIe controller driver: - Add module support for Cadence platform host and endpoint controller driver (Manikandan K Pillai) - Split headers into 'legacy' (LGA) and 'high perf' (HPA) to prepare for new CIX Sky1 driver (Manikandan K Pillai) MediaTek PCIe controller driver: - Convert DT binding to YAML schema (Christian Marangi) - Add Airoha AN7583 DT compatible and driver support (Christian Marangi) Qualcomm PCIe controller driver: - Add Qualcomm Kaanapali to SM8550 DT binding (Qiang Yu) - Add required 'power-domains' and 'resets' to qcom sa8775p, sc7280, sc8280xp, sm8150, sm8250, sm8350, sm8450, sm8550, x1e80100 DT schemas (Krzysztof Kozlowski) - Look up OPP using both frequency and data rate (not just frequency) so RPMh votes can account for both (Krishna Chaitanya Chundru) Rockchip DesignWare PCIe controller driver: - Add Rockchip RK3528 compatible strings in DT binding (Yao Zi) STMicroelectronics STM32MP25 PCIe controller driver: - Fix a race between link training and endpoint register initialization (Christian Bruel) - Align endpoint allocations to match the ATU requirements (Christian Bruel) Synopsys DesignWare PCIe controller driver: - Clear L1 PM Substate Capability 'Supported' bits unless glue driver says it's supported, which prevents users from enabling non-working L1SS. Currently only qcom and tegra194 support L1SS (Bjorn Helgaas) - Remove now-superfluous L1SS disable code from tegra194 (Bjorn Helgaas) - Configure L1SS support in dw-rockchip when DT says 'supports-clkreq' (Shawn Lin) TI Keystone PCIe controller driver: - Fail the probe instead of silently succeeding if ks_pcie_of_data didn't specify Root Complex or Endpoint mode (Siddharth Vadapalli) - Make keystone buildable as a loadable module, except on ARM32 where hook_fault_code() is __init (Siddharth Vadapalli)" * tag 'pci-v6.19-changes' of git://git.kernel.org/pub/scm/linux/kernel/git/pci/pci: (100 commits) MAINTAINERS: Add Manivannan Sadhasivam as PCI/pwrctrl maintainer MAINTAINERS: Add CIX Sky1 PCIe controller driver maintainer PCI: sky1: Add PCIe host support for CIX Sky1 dt-bindings: PCI: Add CIX Sky1 PCIe Root Complex bindings PCI: cadence: Add support for High Perf Architecture (HPA) controller MAINTAINERS: Add NXP S32G PCIe controller driver maintainer PCI: s32g: Add NXP S32G PCIe controller driver (RC) PCI: dwc: Add register and bitfield definitions dt-bindings: PCI: s32g: Add NXP S32G PCIe controller PCI: Add Renesas RZ/G3S host controller driver PCI: host-generic: Move bridge allocation outside of pci_host_common_init() dt-bindings: PCI: Add Renesas RZ/G3S PCIe controller binding PCI: Validate pci_rebar_size_supported() input Documentation: PCI: Amend error recovery doc with pci_save_state() rules treewide: Drop pci_save_state() after pci_restore_state() PCI/ERR: Ensure error recoverability at all times PCI/PM: Stop needlessly clearing state_saved on enumeration and thaw PCI/PM: Reinstate clearing state_saved in legacy and !PM codepaths PCI: dw-rockchip: Configure L1SS support PCI: tegra194: Remove unnecessary L1SS disable code ...
2025-12-04Merge tag 'efi-next-for-v6.19' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/efi/efi Pull EFI updates from Ard Biesheuvel: "The usual trickle of EFI contributions: - Parse SMBIOS tables in memory directly on Macbooks that do not implement the EFI SMBIOS protocol - Obtain EDID information from the primary display while running in the EFI stub, and expose it via bootparams on x86 (generic method is in the works, and will likely land during the next cycle) - Bring CPER handling for ARM systems up to data with the latest EFI spec changes - Various cosmetic changes" * tag 'efi-next-for-v6.19' of git://git.kernel.org/pub/scm/linux/kernel/git/efi/efi: docs: efi: add CPER functions to driver-api efi/cper: align ARM CPER type with UEFI 2.9A/2.10 specs efi/cper: Add a new helper function to print bitmasks efi/cper: Adjust infopfx size to accept an extra space RAS: Report all ARM processor CPER information to userspace efi/libstub: x86: Store EDID in boot_params efi/libstub: gop: Add support for reading EDID efi/libstub: gop: Initialize screen_info in helper function efi/libstub: gop: Find GOP handle instead of GOP data efi: Fix trailing whitespace in header file efi/memattr: Convert efi_memattr_init() return type to void efi: stmm: fix kernel-doc "bad line" warnings efi/riscv: Remove the useless failure return message print efistub/x86: Add fallback for SMBIOS record lookup
2025-12-05Merge tag 'topic/drm-intel-plane-color-pipeline-2025-12-04' of ↵Dave Airlie
https://gitlab.freedesktop.org/drm/i915/kernel into drm-next drm/i915 topic pull request for v6.19: Features and functionality: - Add plane color management support (Uma, Chaitanya) Signed-off-by: Dave Airlie <airlied@redhat.com> From: Jani Nikula <jani.nikula@intel.com> Link: https://patch.msgid.link/e7129c6afd6208719d2f5124da86e810505e7a7b@intel.com
2025-12-05Merge tag 'drm-xe-next-fixes-2025-12-04' of ↵Dave Airlie
https://gitlab.freedesktop.org/drm/xe/kernel into drm-next Driver Changes: - Fix a memory leak (Mika) - Fix a 64-bit division (Michal Wajdeczko) - vf migration fix (Matt Brost) - LRC pause Fix (Tomasz lis) Signed-off-by: Dave Airlie <airlied@redhat.com> From: Thomas Hellstrom <thomas.hellstrom@linux.intel.com> Link: https://patch.msgid.link/aTIGiHJnnMtqbDOO@fedora
2025-12-05Merge tag 'topic/xe-vfio-2025-12-04' of ↵Dave Airlie
https://gitlab.freedesktop.org/drm/xe/kernel into drm-next Driver Changes: - fix VFIO link error for built-in xe module (Arnd Bergmann) Signed-off-by: Dave Airlie <airlied@redhat.com> From: Thomas Hellstrom <thomas.hellstrom@linux.intel.com> Link: https://patch.msgid.link/aTIA9in2Bo_fA9TN@fedora
2025-12-05Merge tag 'topic/xe-vfio-2025-12-01' of ↵Dave Airlie
https://gitlab.freedesktop.org/drm/xe/kernel into drm-next Cross-subsystem Changes: - Add device specific vfio_pci driver variant for intel graphics (Michal Winiarski) Driver Changes: - Add scope-based cleanup helper for runtime PM (Matt Roper) - Additional xe driver prerequisites and exports (Michal Winiarski) Signed-off-by: Dave Airlie <airlied@redhat.com> From: Thomas Hellstrom <thomas.hellstrom@linux.intel.com> Link: https://patch.msgid.link/aS1bNpqeem6PIHrA@fedora
2025-12-04Merge tag 'for-v6.19' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/sre/linux-power-supply Pull power supply and reset updates from Sebastian Reichel: "Power-supply core: - documentation fixes power-supply drivers: - add BD71828 charger driver - add Richtek RT9756 driver - max77705: add adaptive input current support - max77705: add support for multiple devices - misc small fixes reset drivers: - add spacemit-p1 poweroff/reboot driver" * tag 'for-v6.19' of git://git.kernel.org/pub/scm/linux/kernel/git/sre/linux-power-supply: Revert "power: supply: qcom_battmgr: support disabling charge control" Documentation: power: rt9756: Document exported sysfs entries power: supply: rt9756: Add Richtek RT9756 smart cap divider charger dt-bindings: power: supply: Add Richtek RT9756 smart cap divider charger driver: reset: spacemit-p1: add driver for poweroff/reboot power: supply: apm_power: only unset own apm_get_power_status power: supply: use ktime_divns() to avoid 64-bit division docs: power: clean up power_supply_class.rst power: supply: qcom_battmgr: support disabling charge control power: supply: qcom_battmgr: clamp charge control thresholds power: supply: wm831x: Check wm831x_set_bits() return value power: supply: rt9467: Prevent using uninitialized local variable in rt9467_set_value_from_ranges() power: supply: rt9467: Return error on failure in rt9467_set_value_from_ranges() power: supply: max17040: Check iio_read_channel_processed() return code power: supply: cw2015: Check devm_delayed_work_autocancel() return code power: supply: rt5033_charger: Fix device node reference leaks power: supply: max77705: Fix potential IRQ chip conflict when probing two devices power: supply: max77705_charger: implement aicl feature MAINTAINERS: Add entry for BD71828 charger power: supply: Add bd718(15/28/78) charger driver
2025-12-04Merge tag 'devicetree-for-6.19' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/robh/linux Pull devicetree updates from Rob Herring: "DT bindings: - Convert lattice,ice40-fpga-mgr, apm,xgene-storm-dma, brcm,sr-thermal, amazon,al-thermal, brcm,ocotp, mt8173-mdp, Actions Owl SPS, Marvell AP80x System Controller, Marvell CP110 System Controller, cznic,moxtet, and apm,xgene-slimpro-mbox to DT schema format - Add i.MX95 fsl,irqsteer, MT8365 Mali Bifrost GPU, Anvo ANV32C81W EEPROM, and Microchip pic64gx PLIC - Add missing LGE, AMD Seattle, and APM X-Gene SoC platform compatibles - Updates to brcm,bcm2836-l1-intc, brcm,bcm2835-hvs, and bcm2711-hdmi bindings to fix warnings on BCM2712 platforms - Drop obsolete db8500-thermal.txt - Treewide clean-up of extra blank lines and inconsistent quoting - Ensure all .dtbo targets are applied to a base .dtb - Speed up dt_binding_check by skipping running validation on empty examples DT core: - Add of_machine_device_match() and of_machine_get_match_data() helpers and convert users treewide - Fix bounds checking of address properties in FDT code. Rework the code to have a single implementation of the bounds checks. - Rework of_irq_init() to ignore any implicit interrupt-parent (i.e. in a parent node) on nodes without an interrupt. This matches the spec description and fixes some RISC-V platforms. - Avoid a spurious message on overlay removal - Skip DT kunit tests on RISCV+ACPI" * tag 'devicetree-for-6.19' of git://git.kernel.org/pub/scm/linux/kernel/git/robh/linux: (55 commits) dt-bindings: kbuild: Skip validating empty examples dt-bindings: interrupt-controller: brcm,bcm2836-l1-intc: Drop interrupt-controller requirement dt-bindings: display: Fix brcm,bcm2835-hvs bindings for BCM2712 dt-bindings: display: bcm2711-hdmi: Add interrupt details for BCM2712 of: Skip devicetree kunit tests when RISCV+ACPI doesn't populate root node soc: tegra: Simplify with of_machine_device_match() soc: qcom: ubwc: Simplify with of_machine_get_match_data() powercap: dtpm: Simplify with of_machine_get_match_data() platform: surface: Simplify with of_machine_get_match_data() irqchip/atmel-aic: Simplify with of_machine_get_match_data() firmware: qcom: scm: Simplify with of_machine_device_match() cpuidle: big_little: Simplify with of_machine_device_match() cpufreq: sun50i: Simplify with of_machine_device_match() cpufreq: mediatek: Simplify with of_machine_get_match_data() cpufreq: dt-platdev: Simplify with of_machine_get_match_data() of: Add wrappers to match root node with OF device ID tables dt-bindings: eeprom: at25: Add Anvo ANV32C81W of/reserved_mem: Simplify the logic of __reserved_mem_alloc_size() of/reserved_mem: Simplify the logic of fdt_scan_reserved_mem_reg_nodes() of/reserved_mem: Simplify the logic of __reserved_mem_reserve_reg() ...
2025-12-04Merge tag 'hid-for-linus-2025120201' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/hid/hid Pull HID updates from Jiri Kosina: - Proper mapping of HID_GD_Z to ABS_DISTANCE for stylus/pen types of devices (Ping Cheng) - Power management/hibernation improvements in intel-ish (Zhang Lixu) - Improved support for several Logitech devices, e.g. G Pro X Superlight 2, new iteration of Lighspeed receiver, G13, G510 (Nathan Rossi, Mavroudis Chatzilazaridis, Leo L Schwab, Hans de Goede) - Support for UcLogic XP-PEN Artist 24 Pro (Joshua Goins) - WinWing Orion2 throttle support improvement (Ivan Gorinov) - other assorted small fixes and device ID additions * tag 'hid-for-linus-2025120201' of git://git.kernel.org/pub/scm/linux/kernel/git/hid/hid: (37 commits) drivers: hid: renegotiate resolution multipliers with device after reset HID: evision: Fix Report Descriptor for Evision Wireless Receiver 320f:226f HID: logitech-dj: Fix probe failure when used with KVM HID: logitech-dj: Remove duplicate error logging HID: logitech-dj: Add support for G Pro X Superlight 2 receiver selftests/hid-tablet: add ABS_DISTANCE test for stylus/pen HID: input: map HID_GD_Z to ABS_DISTANCE for stylus/pen HID: bpf: fix typo in HID usage table HID: bpf: add the Huion Kamvas 27 Pro HID: bpf: add heuristics to the Huion Inspiroy 2S eraser button HID: bpf: Add support for XP-Pen Deco02 HID: bpf: Add support for the XP-Pen Deco 01 V3 HID: bpf: Add support for the Waltop Batteryless Tablet HID: bpf: Add fixup for Logitech SpaceNavigator variants HID: bpf: support for Huion Kamvas 16 Gen 3 HID: bpf: add support for Huion Kamvas 13 (Gen 3) (model GS1333) HID: bpf: Add support for the Inspiroy 2M Documentation: hid-alps: Format DataByte* subsection headings Documentation: hid-alps: Fix packet format section headings HID: nintendo: add WQ_PERCPU to alloc_workqueue users ...
2025-12-04perf stat: Improve handling of termination by signalIan Rogers
When interrupting perf stat in repeat mode with a signal the signal is passed to the child process but the repeat doesn't terminate: ``` $ perf stat -v --null --repeat 10 sleep 1 Control descriptor is not initialized [ perf stat: executing run #1 ... ] [ perf stat: executing run #2 ... ] ^Csleep: Interrupt [ perf stat: executing run #3 ... ] [ perf stat: executing run #4 ... ] [ perf stat: executing run #5 ... ] [ perf stat: executing run #6 ... ] [ perf stat: executing run #7 ... ] [ perf stat: executing run #8 ... ] [ perf stat: executing run #9 ... ] [ perf stat: executing run #10 ... ] Performance counter stats for 'sleep 1' (10 runs): 0.9500 +- 0.0512 seconds time elapsed ( +- 5.39% ) 0.01user 0.02system 0:09.53elapsed 0%CPU (0avgtext+0avgdata 18940maxresident)k 29944inputs+0outputs (0major+2629minor)pagefaults 0swaps ``` Terminate the repeated run and give a reasonable exit value: ``` $ perf stat -v --null --repeat 10 sleep 1 Control descriptor is not initialized [ perf stat: executing run #1 ... ] [ perf stat: executing run #2 ... ] [ perf stat: executing run #3 ... ] ^Csleep: Interrupt Performance counter stats for 'sleep 1' (10 runs): 0.680 +- 0.321 seconds time elapsed ( +- 47.16% ) Command exited with non-zero status 130 0.00user 0.01system 0:02.05elapsed 0%CPU (0avgtext+0avgdata 70688maxresident)k 0inputs+0outputs (0major+5002minor)pagefaults 0swaps ``` Note, this also changes the exit value for non-repeat runs when interrupted by a signal. Reported-by: Ingo Molnar <mingo@kernel.org> Closes: https://lore.kernel.org/lkml/aS5wjmbAM9ka3M2g@gmail.com/ Signed-off-by: Ian Rogers <irogers@google.com> Tested-by: Thomas Richter <tmricht@linux.ibm.com> Signed-off-by: Namhyung Kim <namhyung@kernel.org>
2025-12-04perf tests stat: Add test for error for an offline CPUIan Rogers
Add a test that if an offline CPU is requested perf stat will fail. $ perf test -vv "perf stat tests" 101: perf stat tests: --- start --- test child forked, pid 46965 Basic stat command test Basic stat command test [Success] Null stat command test Null stat command test [Success] Offline CPU stat command test (cpu 8) Offline CPU stat command test [Success] stat record and report test stat record and report test [Success] stat record and script test stat record and script test [Success] stat repeat weak groups test stat repeat weak groups test [Success] Topdown event group test Topdown event group test [Success] Topdown weak groups test Topdown weak groups test [Skipped event parsing failed] cputype test cputype test [Success] hybrid test hybrid test [Success] ---- end(0) ---- 101: perf stat tests : Ok Reported-by: Thomas Richter <tmricht@linux.ibm.com> Closes: https://lore.kernel.org/linux-perf-users/94313b82-888b-4f42-9fb0-4585f9e90080@linux.ibm.com/ Signed-off-by: Ian Rogers <irogers@google.com> Signed-off-by: Namhyung Kim <namhyung@kernel.org>
2025-12-04Merge tag 'backlight-next-6.19' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/lee/backlight Pull backlight updates from Lee Jones: "Additions: - Add support for Awinic AW99706 backlight driver Fixes: - Add GPIOLIB dependency to backlight ktd2801 driver - Add devlink to LED Backlight's supplier LEDs to enforce correct removal order and prevent NULL pointer dereferences - Fix kernel-doc warnings in lp855x.h Removals: - Do not include <linux/fb.h> in backlight.h - Fix unused function warnings from suspend/resume ops in aw99706.c by switching to DEFINE_SIMPLE_DEV_PM_OPS and using pm_ptr() Bindings: - Add Awinic AW99706 backlight binding to MAINTAINERS - Add Awinic AW99706 backlight binding documentation" * tag 'backlight-next-6.19' of git://git.kernel.org/pub/scm/linux/kernel/git/lee/backlight: backlight: aw99706: Fix unused function warnings from suspend/resume ops backlight: lp855x: Fix lp855x.h kernel-doc warnings dt-bindings: leds: backlight: Add Awinic AW99706 backlight backlight: aw99706: Add support for Awinic AW99706 backlight backlight: led-bl: Add devlink to supplier LEDs backlight: ktd2801: Depend on GPIOLIB backlight: Do not include <linux/fb.h> in header file
2025-12-04Merge tag 'leds-next-6.19' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/lee/leds Pull LED updates from Lee Jones: "Updates: - Add optional GPIO enable pin support to PWM LED driver Fixes: - Allow LED module 0 to be added to module bank in lp50xx driver - Fix upboard LED driver module alias to ensure proper auto-loading - Update LP5009 to support 3 modules for a total of 9 LEDs - Skip LEDs without color components in cros_ec driver instead of failing probe - Fix GPIO descriptor leaks in netxbig error paths by releasing acquired GPIOs - Allow LED_COLOR_ID_MULTI in qcom-lpg driver for greater flexibility - Enable LP55XX common LED use without FW_LOADER_USER_HELPER - Ensure lp50xx chip is enabled before any I2C communication Cleanups: - Use fwnode_for_each_child_node() instead of fwnode_for_each_available_child_node() in LED drivers - Use device_get_next_child_node() instead of fwnode_get_next_available_child_node() in LED flash drivers - Replace sprintf() with sysfs_emit() in sysfs show functions for improved bounds checking - Replace system_wq() with system_percpu_wq() in the input event trigger - Reorder include files to alphabetic order in the PWM LED driver - Do not enable TRILED in qcom-lpg when configuring PWM - Drop duplicate LEDS_EXPRESSWIRE config from Kconfig Removals: - Remove arcxcnn_bl.txt Device Tree binding documentation Devicetree bindings: - Convert ArcticSand arc2c0608 LED driver binding to DT Schema - Add default-brightness property to common LED binding - Add enable-gpios property to PWM LED binding - Add PM7550 to qcom,spmi-flash-led compatible - Explain standalone PWM usage in qcom-lpg binding" * tag 'leds-next-6.19' of git://git.kernel.org/pub/scm/linux/kernel/git/lee/leds: (21 commits) leds: rgb: leds-qcom-lpg: Don't enable TRILED when configuring PWM dt-bindings: leds: qcom-lpg: Explain standalone PWM usage leds: rgb: leds-qcom-lpg: Allow LED_COLOR_ID_MULTI leds: pwm: Reorder include files to alphabetic order leds: pwm: Add optional GPIO enable pin support dt-bindings: leds: pwm: Add enable-gpios property leds: trigger: Replace use of system_wq() with system_percpu_wq() leds: led-class: Replace sprintf() with sysfs_emit() in sysfs show functions dt-bindings: leds: qcom,spmi-flash-led: Add PM7550 leds: netxbig: Fix GPIO descriptor leak in error paths leds: leds-lp50xx: Enable chip before any communication leds: Drop duplicate LEDS_EXPRESSWIRE config leds: leds-cros_ec: Skip LEDs without color components leds: leds-lp50xx: LP5009 supports 3 modules for a total of 9 LEDs leds: upboard: Fix module alias leds: leds-lp50xx: Allow LED 0 to be added to module bank leds: lp55xx_common: Enable use without FW_LOADER_USER_HELPER dt-bindings: leds: Add default-brightness property to common.yaml leds: flash: Use fwnode_get_next_child_node() instead leds: Use fwnode_for_each_child_node() instead ...
2025-12-04Merge tag 'mfd-next-6.19' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/lee/mfd Pull MFD updates from Lee Jones: "Updates: - Add Core, Regulator, Onkey and Battery Charger support for the NXP PF1550 Power Management IC (PMIC) - Introduce __SMC_KEY macro to fix GCC 15.2.1 errors in macsmc - Add board definitions for TQMxCU1-HPCM and TQMxCU2-HPCM to the tqmx86 driver - Add support for Broadcom BCM2712 SoC to the bcm2835-pm driver - Hook up the qnap-mcu-eeprom sub-device to qnap-mcu Fixes: - Enable compile testing for the Altera SOCFPGA System Manager driver - Fix device reference leak in altr_sysmgr_regmap_lookup_by_phandle() - Reserve the unused second I2C address for DA9063 to prevent userspace interference - Fix resource leak in da9055_device_init() by calling regmap_del_irq_chip() in the error path - Fix potential IRQ chip conflict when probing multiple MAX77620 devices by using devm_kmemdup for regmap_irq_chip - Return -EPROBE_DEFER when a syscon devuice is not found to allow deferred probing - Update email address for the PF1550 PMIC driver in MAINTAINERS - Correct file entry for PF1550 MFD driver in MAINTAINERS from pfd1550.h to pf1550.h - Calculate checksum on the actual number of received bytes in qnap-mcu for error messages - Use -EPROTO instead of -EIO for checksum errors in qnap-mcu - Add proper error handling for command errors (e.g., "@8", "@9") in qnap-mcu - Fix missing irq_domain_remove() in error path of mt63{58,97}_irq_init() Cleanups: - Mark SMC write buffer arguments as const in apple_smc_write(), apple_smc_rw(), and apple_smc_write_atomic() - Simplify the error handling path in da9055_device_init() by removing a redundant mfd_remove_devices() call - Use regmap_reg_range() and a real one-element array for pmic_status_range in rohm-bd718x7 for cleaner initialization - Remove select I2C_K1 from MFD_SPACEMIT_P1 to avoid build failures when I2C_K1's dependencies are disabled - Remove unneeded semicolon from ls2k_bmc_recover_pci_data() - Drop OF dependency for MFD_MAX5970 in Kconfig to allow wider compile testing and non-OF systems - Make OF ID table style consistent in simple-mfd-i2c driver - Update header inclusions in simple-mfd-i2c to follow IWYU (Include What You Use) principle - Move checksum verification logic to a separate function in qnap-mcu - Use chained IRQs for S2MPG10 in the Samsung SEC driver to simplify interrupt handling - Drop a stray semicolon from sec-irq.c Removals: - Remove the unused TI WL1273 FM radio core driver - Remove the unused wl1273-core.h header and tidy up its reference in documentation Device tree bindings: - Add Device Tree binding for the NXP PF1550 PMIC - Add missing GPIO pins and supply properties to the Silergy SY7636A PMIC binding - Add interrupt-controller property to the Maxim MAX77705 binding for sub-device interrupt source determination - Add Device Tree binding for the Renesas R2A11302FT PMIC - Allow the wakeup-source property in the Dialog DA9063 binding - Make interrupt-related properties optional in the TI TPS65910 PMIC binding - Document the Qualcomm PMIV0104 PMIC compatible string - Document the Qualcomm PM7550 PMIC compatible string - Enable power button subnode for TWL603x in the TI TWL binding - Convert the Dialog DA9052/53 I2C binding from .txt to .yaml format, including compatible string fallback and interrupt properties - Document control-scb and sysreg-scb syscons on pic64gx with fallback compatibles - Document sama7g5-sfrbu and sama7d65-sfrbu syscons with fallback to atmel,sama5d2-sfrbu - Fix LEDs node schema in fsl,mc13xxx binding by adding led@ child nodes and missing properties - Add mt7981-topmisc compatible string to the syscon binding" * tag 'mfd-next-6.19' of git://git.kernel.org/pub/scm/linux/kernel/git/lee/mfd: (42 commits) mfd: sec: Drop a stray semicolon mfd: qnap-mcu: Hook up the EEPROM sub-device dt-bindings: mfd: syscon: Add mt7981-topmisc dt-bindings: mfd: fsl,mc13xxx: Fix LEDs node schema mfd: mt6358-irq: Fix missing irq_domain_remove() in error path mfd: mt6397-irq: Fix missing irq_domain_remove() in error path dt-bindings: mfd: Document syscons falling back to atmel,sama5d2-sfrbu dt-bindings: mfd: Document control-scb and sysreg-scb on pic64gx dt-bindings: mfd: Convert dlg,da9052-i2c.txt to yaml format mfd: sec: Use chained IRQs for s2mpg10 mfd: qnap-mcu: Add proper error handling for command errors mfd: qnap-mcu: Move checksum verification to its own function mfd: qnap-mcu: Use EPROTO in stead of EIO on checksum errors mfd: qnap-mcu: Calculate the checksum on the actual number of bytes received mfd: simple-mfd-i2c: Don't use "proxy" headers mfd: simple-mfd-i2c: Make ID table style consistent mfd: Kconfig: Drop OF dependency on MFD_MAX5970 mfd: ls2kbmc: Remove unneeded semicolon from ls2k_bmc_recover_pci_data() dt-bindings: mfd: twl: Enable power button also for TWL603X MAINTAINERS: Adjust file entry in NXP PF1550 PMIC MFD DRIVER ...
2025-12-04io_uring/kbuf: use READ_ONCE() for userspace-mapped memoryCaleb Sander Mateos
The struct io_uring_buf elements in a buffer ring are in a memory region accessible from userspace. A malicious/buggy userspace program could therefore write to them at any time, so they should be accessed with READ_ONCE() in the kernel. Commit 98b6fa62c84f ("io_uring/kbuf: always use READ_ONCE() to read ring provided buffer lengths") already switched the reads of the len field to READ_ONCE(). Do the same for bid and addr. Signed-off-by: Caleb Sander Mateos <csander@purestorage.com> Fixes: c7fb19428d67 ("io_uring: add support for ring mapped supplied buffers") Cc: Joanne Koong <joannelkoong@gmail.com> Signed-off-by: Jens Axboe <axboe@kernel.dk>