| Age | Commit message (Collapse) | Author |
|---|
|
Computing the effects of a TLB invalidation involves looking at
the size of the mapping cached by the TLB. For S1 mappings such as
VNCR, this is deducted from the combination of the base granule size
and the mapping level.
However, this implies that the S1 MMU is *on*. When the MMU is off,
we indicate this with the level being set to a "creative" value of
-127 (S1_MMU_DISABLED).
This ends-up being misinterpreted by pgshift_level_to_ttl() as it
doesn't handle negative levels at all (the level is immediately cast
to a u8 and only the bottom two bits considered), leading to an
invalidation size of 0. Not helpful.
Tidy-up pgshift_level_to_ttl() to handle these negative levels, and
ttl_to_size() to always return SZ_1G when no valid TTL is present.
This allows the removal of open-coded checks for similar situations.
Note that the check for a negative value not explicitely checking for
S1_MMU_DISABLED is deliberate, so that actual negative levels introduced
with LVA2 and D128 can take the same path if we ever support them.
Fixes: 7270cc9157f47 ("KVM: arm64: nv: Handle VNCR_EL2 invalidation from MMU notifiers")
Reported-by: Hyunwoo Kim <imv4bel@gmail.com>
Link: https://lore.kernel.org/r/ameGoxbn2wzBq2kL@v4bel
Signed-off-by: Marc Zyngier <maz@kernel.org>
Cc: stable@vger.kernel.org
Link: https://patch.msgid.link/20260806091026.620700-3-maz@kernel.org
Signed-off-by: Oliver Upton <oupton@kernel.org>
|
|
The global VNCR mapping counter is used to decide whether an L1
provided VNCR page is mapped in L0 on any CPU at the point of
dealing with a TLB invalidation. It is incremented when a mapping
is made in the fixmap, and decremented when unmapped.
As it turns out, this tracking has several flaws:
- we are trying to invalidate TLBs, and the mapping is only an
opportunistic consequence of the TLB. Checking this counter to
decide whether a TLB needs to be invalidated may result in missed
invalidations.
- an L1 vcpu invalidating its own TLB (a very likely case) will not
succeed in invalidating the VNCR pseudo TLB because that page is
not mapped in L0 at this stage.
Given that this tracking fails at delivering the minimum guarantees
that are required and is only a performance optimisation, remove it
completely.
Fixes: 4ffa72ad8f37e ("KVM: arm64: nv: Add S1 TLB invalidation primitive for VNCR_EL2")
Reviewed-by: Yuan Yao <yaoyuan@linux.alibaba.com>
Signed-off-by: Marc Zyngier <maz@kernel.org>
Cc: stable@vger.kernel.org
Acked-by: Lorenzo Stoakes (ARM) <ljs@kernel.org>
Link: https://patch.msgid.link/20260806091026.620700-2-maz@kernel.org
Signed-off-by: Oliver Upton <oupton@kernel.org>
|
|
The ZBB-optimized strnlen loop loads one word ahead before checking the
aligned boundary:
REG_L t1, SZREG(t0) // load next word
addi t0, t0, SZREG // advance
orc.b t1, t1
bgeu t0, t4, 4f // boundary check AFTER load
where t4 = (s + count) & -SZREG. When s is aligned and count is a
multiple of SZREG, t4 equals s + count and the loop loads a full word
starting at exactly s + count. If s + count falls on a page boundary
with the next page unmapped, this faults.
Fix by computing the aligned boundary from the last valid byte
(s + count - 1) instead of s + count. This makes the loop stop at the
word containing the last valid byte rather than potentially loading the
word after it. The count == 0 case is already handled by the beqz
early exit.
Also add a pre-loop guard (bgeu t0, t4) for the case where all valid
bytes fit within the first word. With the adjusted boundary, t4 can
equal t0, and entering the loop with stale register state from the
first-word processing would produce incorrect results.
The final minu clamp ensures the result is still correct when the last
loaded word extends past s + count - 1 within the same aligned word.
Fixes: 5ba15d419fab ("riscv: lib: add strnlen() implementation")
Signed-off-by: Michael Neuling <mikey@neuling.org>
Assisted-by: Claude Opus4.6 High Thinking
Link: https://patch.msgid.link/20260413010738.1622423-1-mikey@neuling.org
Signed-off-by: Paul Walmsley <pjw@kernel.org>
|
|
https://git.kernel.org/pub/scm/linux/kernel/git/bmc/linux into soc/dt
aspeed: First batch of ARM devicetree changes for 7.3
No significant changes this time around. Instead, several cleanups
for Meta's San Miguel platform, along with some changes enabling
dt-check-style.
* tag 'aspeed-arm-7.3-devicetree-0' of https://git.kernel.org/pub/scm/linux/kernel/git/bmc/linux:
ARM: dts: aspeed: Correct indentation
ARM: dts: aspeed: sanmiguel: fix PDB HSC shunt resistor
ARM: dts: aspeed: sanmiguel: Fix PWRGD_RMC_N active-low hog configuration
ARM: dts: aspeed: sanmiguel: Fix FIO IOEXP interrupt pin
Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
|
|
https://git.kernel.org/pub/scm/linux/kernel/git/bmc/linux into soc/dt
nuvoton: First batch of arm64 devicetree changes for 7.3
Similar to the 7.3 ARM PR for Nuvoton we have a couple of arm64 tidy-ups
from Tomer.
* tag 'nuvoton-arm64-7.3-devicetree-0' of https://git.kernel.org/pub/scm/linux/kernel/git/bmc/linux:
arm64: dts: nuvoton: npcm845: Reorder timer0 and PECI nodes
arm64: dts: nuvoton: npcm845: Drop redundant timer clock-names
Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
|
|
https://git.kernel.org/pub/scm/linux/kernel/git/bmc/linux into soc/dt
nuvoton: First batch of ARM devicetree changes for 7.3
This time around we have a couple of cleanups from Tomer that make way for
improvements in the bindings.
* tag 'nuvoton-arm-7.3-devicetree-0' of https://git.kernel.org/pub/scm/linux/kernel/git/bmc/linux:
arm: dts: nuvoton: npcm7xx: Drop redundant FIU clock-names
arm: dts: nuvoton: npcm7xx: Drop bogus FIU memory reg-names
Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
|
|
https://git.kernel.org/pub/scm/linux/kernel/git/sunxi/linux into soc/dt
Allwinner device tree changes for 7.3
Some changes for old chips/devices and some for recent ones.
- A10 PMU interrupt number fixed
- A100/A133 gained LRADC
- enabled overlay support for sun8i-h2-plus pi boards
- A523 family gained consumer IR receiver
- H728-based X96QPRO+ gained SPDIF audio output
- PinePhone's mpu6050 mount orientation fixed
- style fixes
New board added:
- Baijie Helper A133
- NetCube Systems OpenNMC (dobermann)
* tag 'sunxi-dt-for-7.3' of https://git.kernel.org/pub/scm/linux/kernel/git/sunxi/linux:
arm64: dts: allwinner: Correct white-space style
ARM: dts: allwinner: Correct white-space style
arm64: dts: allwinner: a523: Enable SPDIF on X96QPRO+
arm64: dts: allwinner: a523: Add SPDIF output PH pin mux option
arm64: dts: allwinner: sun50i-a64-pinephone: Fix mpu6050 mount matrix
arm64: dts: allwinner: a523: enable IR on the Avaota A1
arm64: dts: allwinner: a523: enable IR receiver on the X96Q Pro+
arm64: dts: allwinner: a523: add IR receiver nodes
media: dt-bindings: allwinner,sun4i-a10-ir: add A523 compatible
ARM: dts: allwinner: a10: Fix PMU interrupt
ARM: dts: allwinner: enable overlay support for sun8i-h2-plus pi boards
ARM: dts: allwinner: add support for NetCube Systems OpenNMC (dobermann)
riscv: dts: allwinner: d1s-t113: Add uart4 pinctrl required by NetCube Systems OpenNMC
dt-bindings: arm: sunxi: Add NetCube Systems OpenNMC (dobermann)
ARM: dts: allwinner: sun8i-h3: Correct indentation
arm64: dts: allwinner: A133: add support for Baijie Helper A133 board
arm64: dts: allwinner: a100: Add LRADC node
dt-bindings: input: sun4i-lradc-keys: Add A100/A133 compatible
dt-bindings: arm: sunxi: Add Baijie HelperBoard A133 compatible
dt-bindings: vendor-prefixes: Add Shenzhen Baijie Technology Co., Ltd.
Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
|
|
git://git.kernel.org/pub/scm/linux/kernel/git/khilman/linux-omap into soc/dt
ARM: dts: OMAP updates for v7.3
- DT support for PRU-ICSS on AM3/4/5
- minor fixes & cleanups
* tag 'omap-for-v7.3/dt-signed' of git://git.kernel.org/pub/scm/linux/kernel/git/khilman/linux-omap:
ARM: dts: ti/omap: embt2ws: use mulit-led for RGB LED
ARM: dts: ti: omap: Correct indentation
ARM: dts: ti: Fix typos in comments
ARM: dts: ti: Add specific compatibles for SCM conf nodes
arm: dts: ti: Add device tree support for PRU-ICSS on AM335x
arm: dts: ti: Add device tree support for PRU-ICSS on AM437x
arm: dts: ti: Add device tree support for PRU-ICSS on AM57xx
ARM: dts: ti: var-som-om44: Add USB Ethernet controller node
Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
|
|
https://git.kernel.org/pub/scm/linux/kernel/git/spacemit/linux into soc/dt
RISC-V SpacemiT DT changes for 7.3
For K3 SoC
- Enable SD card support
- Enable QSPI
- Fix reset delay of ETH PHY
- Fix PHY ID of ETH
- Symbolic PDAM ID
- Add SPI controller support
- Add USB and PHY support
- Add I2S nodes
For K1 SoC
- Symbolic PDAM ID
- Enable cpufreq support
- Fix max CPU core voltage
For boards of K3
- Pico-ITX
- Enable ALDPS on RTL8211F PHY
- Disable 125MHz clock on RTL8211F PHY
- Enable NOR flash
- Add EEPROM support
- CoM260
- Add EEPROM support
For boards of K1
- Milk-V Jupiter
- Enable CPU DVFS
- Banana Pi BPI-CM6
- Add initial support
- OrangePi R2S
- Enable PCIe
* tag 'spacemit-dt-for-7.3-1' of https://git.kernel.org/pub/scm/linux/kernel/git/spacemit/linux: (33 commits)
riscv: dts: spacemit: Add cpu scaling for Milk-V Jupiter
riscv: dts: spacemit: k1-bananapi-cm6: fix maximum CPU core voltage
riscv: dts: spacemit: k1-orangepi-r2s: fix maximum CPU core voltage
riscv: dts: spacemit: k1-musepi-pro: fix maximum CPU core voltage
riscv: dts: spacemit: k1-orangepi-rv2: fix maximum CPU core voltage
riscv: dts: spacemit: k1-milkv-jupiter: fix maximum CPU core voltage
riscv: dts: spacemit: k1-bananapi-f3: fix maximum CPU core voltage
riscv: dts: spacemit: Make dtschema recognize the etherent PHY correctly on K3 com260 board
riscv: dts: spacemit: Make dtschema recognize the etherent PHY correctly on K3 pico-itx board
riscv: dts: spacemit: k3: add i2s0-i2s5 nodes
riscv: dts: spacemit: k3: add USB controller and USB phy support
riscv: dts: spacemit: enable PCIe on OrangePi R2S
riscv: dts: spacemit: k3-com260-ifx: add eeprom on i2c1
riscv: dts: spacemit: k3-com260: add eeprom on i2c2
riscv: dts: spacemit: add SPI controllers for K3
riscv: dts: spacemit: add K3 PDMA request numbers
riscv: dts: spacemit: Fix phy id check for the phy on com260 board
riscv: dts: spacemit: Fix phy id check for the phy on pico-itx board
riscv: dts: spacemit: Add enough deassert time for the PHY on com260 board
riscv: dts: spacemit: Add enough deassert time for the PHY on PICO ITX
...
Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
|
|
https://git.kernel.org/pub/scm/linux/kernel/git/mmind/linux-rockchip into soc/dt
New boards: Graperain G3568, HINLINK H28K, LCKFB Taishan Pi 3M,
Orange Pi 5 Pro, Vicharak Axon, Vicharak Vaaman2, Youyeetoo YY3588
New peripherals: eDP support on RK3576
And of course a number of board-fixes, style-fixes and some newly
enabled board-components.
* tag 'v7.3-rockchip-dts64-1' of https://git.kernel.org/pub/scm/linux/kernel/git/mmind/linux-rockchip: (39 commits)
arm64: dts: rockchip: Fix rk3566-bigtreetech-cb2 touchscreen property
arm64: dts: rockchip: fix label of sys_led for nanopi-r4s
arm64: dts: rockchip: Fix the rk3566-radxa-cm3 Wifi compatible
arm64: dts: rockchip: Fix Gru WLAN sideband interrupt
arm64: dts: rockchip: Add Vicharak Vaaman2 board
dt-bindings: arm: rockchip: Add Vicharak Vaaman2
arm64: dts: rockchip: add Vicharak Axon board
dt-bindings: arm: rockchip: add Vicharak Axon board
arm64: dts: rockchip: Add LCKFB Taishan Pi 3M
dt-bindings: arm: rockchip: Add LCKFB Taishan Pi 3M
arm64: dts: rockchip: Add Orange Pi 5 Pro board support
arm64: dts: rockchip: refactor items from Orange Pi 5/b to prep for Pro
arm64: dts: rockchip: rename PLDO regulator labels to match schematic on rk3588s-orangepi-5
dt-bindings: arm: rockchip: Add Orange Pi 5 Pro
arm64: dts: rockchip: Add devicetree for the Graperain G3568 v2
dt-bindings: arm: rockchip: Add Graperain G3568 series
dt-bindings: vendor-prefixes: Add graperain
Revert "arm64: dts: rockchip: Further describe the WiFi for the Pinephone Pro"
arm64: dts: rockchip: fix HDMI-RX signal detect GPIO on yy3588
arm64: dts: rockchip: Enable USB device mode on rk3588s-roc-pc
...
Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
|
|
When inspecting the credentials of another task, objective credentials
(->real_cred, accessed with __task_cred()) must always be used.
Accessing ->cred on a non-current task is forbidden unless that task is
being created or destroyed; a task is allowed to change its own ->cred
pointer with no synchronization, and changing ->cred should only affect the
current syscall.
smack_file_send_sigiotask() was accessing both sets of credentials: First
tsk->cred, then __task_cred(tsk).
Fix it, always access the objective credentials here.
I have tested that this bug can lead to a KASAN-reported UAF of struct cred
in smack_file_send_sigiotask(), and that this fix prevents the race.
Cc: stable@vger.kernel.org
Signed-off-by: Jann Horn <jannh@google.com>
Signed-off-by: Casey Schaufler <casey@schaufler-ca.com>
|
|
https://git.kernel.org/pub/scm/linux/kernel/git/amlogic/linux into soc/dt
Amlogic ARM64 DT for v7.3:
- Amlogic AXG fixups for PCIe and NAND
- Overall indentation and whitespace fixups
- Amlogic A9 Pinctrl & GPIO IRQ nodes
- Clock measure nodes for Amlogic T7 & A1
* tag 'amlogic-arm64-dt-for-v7.3' of https://git.kernel.org/pub/scm/linux/kernel/git/amlogic/linux:
arm64: dts: amlogic: meson-axg-s400: enable mipi_pcie_analog_dphy for PCIe
arm64: dts: amlogic: meson-axg: Disable pcie_phy node by default
arm64: dts: amlogic: meson-axg: Add missing nand_rb0 pin to nand_all_pins
arm64: dts: amlogic: meson-axg: Disable nfc node by default
arm64: dts: amlogic: Correct indentation and whitespace
arm64: dts: amlogic: add some device nodes for A9
arm64: dts: amlogic: t7: Add clk measure support
arm64: dts: meson: a1: Add clk measure support
Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
|
|
https://git.kernel.org/pub/scm/linux/kernel/git/qcom/linux into soc/dt
Qualcomm Arm64 DeviceTree updates for v7.3
Introduce DeviceTree support for the Shikra SoC, its GCC and RPM clock
controllers, CQM, CQS, and IQS SoM platforms, and their evaluation boards.
Document the Hawi and Maili SoCs.
Add the Eliza CQS SoM and EVK platforms, the QCS8550 RB5 Gen 2, Vicharak
Axon Mini, HONOR MagicBook Art 14, Microsoft Surface Pro 12, Xiaomi 12 Lite,
Motorola Edge 30, Sony Xperia M2, and Motorola Moto G2 device trees.
Extend Eliza support with USB, SD card, touchscreen, PMIC, interconnect,
thermal, CPU and LLCC bandwidth-monitor, QUPv3, and ADSP GPR descriptions.
Expand Glymur support with GPU, camera and EVA clock controllers, LPASS
audio, CoreSight, PCIe, USB, IMEM and PIL memory regions, power domains,
thermal cooling, and CRD peripherals. Add SoCCP, PMIC regulator, TRNG, and
CPU-capacity descriptions.
Add display, IPA, camera, USB, audio, crypto, TRNG, CoreSight, and thermal
support to the Kaanapali, Milos, Hamoa, and related platforms. Add embedded
controller support for Hamoa and Glymur boards.
Improve networking-platform descriptions with IPQ PCIe port, PHY, clock,
PWM, regulator, and interrupt updates. Update CTCU, display, Iris, audio,
camera, PCIe, USB-C, power-domain, memory-region, and thermal descriptions
across established Qualcomm platforms.
Correct bindings and DeviceTree validation for Qualcomm compatible strings,
legacy fallback compatibles, node naming and formatting, address ranges,
clock specifiers, reserved memory, regulators, GPIOs, and peripheral wiring.
* tag 'qcom-arm64-for-7.3' of https://git.kernel.org/pub/scm/linux/kernel/git/qcom/linux: (244 commits)
arm64: dts: qcom: eliza: Describe the ADSP GPR node
arm64: dts: qcom: eliza-evk: Add support for USB and SD card
dt-bindings: arm: qcom-soc: Allow WSA88xx speaker compatible
dt-bindings: arm: qcom-soc: Validate nodes with fallbacks
dt-bindings: arm: qcom-soc: Document more of existing legacy style compatibles
dt-bindings: arm: qcom-soc: Include Eliza, Kaanapali and others in SoC names
arm64: dts: qcom: eliza: Enable cpufreq cooling devices
arm64: dts: qcom: glymur: add SoCCP DT node
arm64: dts: qcom: glymur: fix SoCCP memory mappings
arm64: dts: qcom: mahua: Add QREF regulator supplies to TCSR
arm64: dts: qcom: glymur: Add QREF regulator supplies to TCSR
arm64: dts: qcom: glymur: Add CX power domain to GCC
arm64: dts: qcom: glymur: Drop fake PCIe phy 3B
arm64: dts: qcom: glymur: add TRNG node
arm64: dts: qcom: glymur: enable ETR and CTCU devices
arm64: dts: qcom: glymur: Add PCIe port compatibles and ports
arm64: dts: qcom: smb2370: Disable SMB2370_2 by default
arm64: dts: qcom: eliza-mtp: Enable touchscreen
arm64: dts: qcom: purwa-iot-som: enable video
arm64: dts: qcom: purwa: Override Iris clocks and operating points
...
Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
|
|
https://git.kernel.org/pub/scm/linux/kernel/git/frank.li/linux into soc/dt
arm64: dts: NXP device tree updates for v7.3
New boards and SOM support:
- Variscite DART-MX8M-MINI, DART-MX8M-PLUS, VAR-SOM-MX8 QuadMax
(with Sonata and Symphony carrier boards)
- TQMa8MPxS (i.MX8MP) with LVDS overlays, TQMa9596LA on MBa95xxCA; TQMa91xx
on MBa93xxCA
- imx8mm-verdin: Toradex DSI displays (7"/10.1"), HDMI adapter, NAU8822 BTL
audio, Cortex-M4F remoteproc and UART overlay
i.MX8:
- PCIe: add power supply properties to Root Port nodes.
- imx8mp-evk add typec and usb3_phy1 tuning; imx8mq-evk add typec;
- imx8mp-evk add flexcan2 overlay and CAN2/MICFIL board mux; imx8mp-frdm
fix HDMI DDC pinctrl
- imx8mp-var-som-symphony: add second Ethernet, CAN, PWM1, ECSPI2,
capacitive touchscreen, HDMI, PCIe, USB, TPM, external RTC, input
keys, header UARTs
- imx8mq-evk: add DCSS node, uart3/bluetooth node
- imx8qm: add SCU power key, lsio mu8/mu8b, spdif1, lpuart4 nodes;
fix LPCG clock indices for ASRC0; add Variscite Symphony board support
- imx8ulp: add I3C2, eDMA channel properties, LPUART6 (BT) and LPUART7,
gpio-keys power button; correct SRAM node address/size; update rpmsg
resource table address; rename 9x9-evk model string
- imx8mp: enable MU2 for DSP communication (imx8mp-ab2)
i.MX9:
- PCIe: add Root Port nodes with correct outbound address space for
imx94/imx943/imx95; add dma/intr/aer/pme interrupts for imx95 PCIe;
remove 'supports-clkreq' from imx943-evk PCIe1
- imx95: switch USB3 controller to flattened model; add CM7/CM33S nodes
for imx943/imx952/imx95-19x19-evk; add imx94 DMA channels (xspi);
enable NETC block control and in-band SFP status (imx95-var-dart);
add wm8904 DMICDAT1; add lpuart5 alias (imx95-toradex-smarc)
- imx93: add LVDS Display Bridge support with DY1212W-4856 panel overlay
for imx93-11x11-evk; add LVDS overlays for imx93-tqma9352 boards;
update TMU compatible string; fix memory node for imx93-kontron
- imx91: add WM8524 and PDM microphone sound cards, CAN overlay, audio
board muxes (imx91-9x9-qsb); move ELE reserved memory into 512MB
range; USB phy adjustments (imx91-tqma9131)
Layerscape / S32G:
- ls1028a/ls1046a/ls1088a/ls208xa/lx2160a/lx2162a: describe Lynx 10G
SerDes blocks; refactor lx2160a PCIe and SerDes into separate dtsi
files; transition to device-specific SerDes compatible strings
- s32g: add GPR syscon region; describe GPIO and EIRQ in SIUL2 pinctrl
Cleanup and warning fixes:
- correct imx8/s32g3 indentation
- imx8mp: add missing #sound-dai-cells to xcvr
* tag 'imx-dt64-7.3' of https://git.kernel.org/pub/scm/linux/kernel/git/frank.li/linux: (131 commits)
arm64: dts: imx95: Add dma, intr, aer and pme interrupts for PCIe
arm64: dts: imx94-xspi: add the DMA channels
arm64: dts: freescale: imx8mm-verdin: Add Cortex-M4F UART_4 overlay
arm64: dts: freescale: imx8mm-verdin: Add Cortex-M4F remoteproc
arm64: dts: freescale: imx8mm-verdin: Add Toradex Capacitive Touch Display 7" DSI
arm64: dts: freescale: imx8mm-verdin: Add Toradex Capacitive Touch Display 10.1" DSI
arm64: dts: freescale: imx8mm-verdin: Add Toradex DSI to LVDS adapter with 10.1" display
arm64: dts: freescale: imx8mm-verdin: Add DSI to HDMI adapter overlay
arm64: dts: freescale: imx8mm-verdin: Add NAU8822 Bridge Tied Load
arm64: dts: imx95-var-dart-sonata: enable in-band status for SFP
arm64: dts: imx8ulp-evk: Update rpmsg resource table address
arm64: dts: imx943-evk: Add CM7 and CM33S nodes
arm64: dts: imx952-evk: Add CM7 node and related memory nodes
arm64: dts: imx95-19x19-evk: Add CM7 node and related memory nodes
arm64: dts: imx8qm-var-som-symphony: enable expansion header UART
arm64: dts: imx8ulp-9x9-evk: Rename model string to reflect die size
arm64: dts: imx8ulp-evk: Change the values of some PCRs of ENET
arm64: dts: imx8ulp-evk: Enable LPUART7
arm64: dts: imx8ulp-evk: Enable LPUART6 for Bluetooth
arm64: dts: imx8ulp-evk: Add gpio-keys node for power button
...
Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
|
|
into soc/dt
ARM64: DT: HiSilicon ARM64 DT updates for v7.3
- Correct indentation
- Drop unused clock-names and reset-names to fix warnings
* tag 'hisi-arm64-dt-for-7.3' of https://github.com/hisilicon/linux-hisi:
arm64: dts: hisilicon: Correct indentation
arm64: dts: hisilicon: hi3798cv200: Drop unused clock-names and reset-names
Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
|
|
Move the event_define_fields() call in event_create_dir() before the
eventfs directory creation. Previously, a failure after directory
creation wouldn't clean up eventfs_inode because the error path didn't
call eventfs_remove_dir(). This eliminates the need to clean up the
eventfs directories if event_define_fields() fails.
Link: https://patch.msgid.link/20260715135231.338535-3-ashelat@redhat.com
Signed-off-by: Anubhav Shelat <ashelat@redhat.com>
Signed-off-by: Steven Rostedt <rostedt@goodmis.org>
|
|
The recent "sticky mixer" sanity check in USB-audio driver caused a
regression on SteelSeries Arctis Nova 5 (1038:2232); because the
firmware doesn't handle GET_CUR requests, some mixers are effectively
disabled, leading to the too low / soft volumes:
usb 5-1.1: 9:0: sticky mixer values (-19712/0/256 => 0), disabling
usb 5-1.1: 10:0: sticky mixer values (-21248/0/256 => 0), disabling
Restore the functionality by ignoring GET_CUR errors intentionally
with MIXER_GET_CUR_BROKEN quirk.
Fixes: 86aa1ea1f15c ("ALSA: usb-audio: Do not expose sticky mixers")
Reported-by: Gert Burger <gertburger@gmail.com>
Closes: https://lore.kernel.org/CAEQ1D3kdA3mkQx7ei9Kq0gwky0qroJqCLKrkvgfkqgTbeu086A@mail.gmail.com
Link: https://bbs.archlinux.org/viewtopic.php?id=314220
Link: https://patch.msgid.link/20260808152258.1948767-1-tiwai@suse.de
Signed-off-by: Takashi Iwai <tiwai@suse.de>
|
|
The recent fix for UAF in ump_to_endpoint() caused another UAF because
it tries to dereference the UMP endpoint object, but this might be
executed at a delayed context where the endpoint has been already
released.
Add private_free to clear the associated data for avoiding the further
dereference for delayed releases.
Fixes: 4a05b2d1b464 ("ALSA: usb-audio: fix use-after-free in ump_to_endpoint()")
Reported-by: syzbot+565b1138cfbe549d4422@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=565b1138cfbe549d4422
Cc: <stable@vger.kernel.org>
Link: https://patch.msgid.link/20260808152009.1947835-1-tiwai@suse.de
Signed-off-by: Takashi Iwai <tiwai@suse.de>
|
|
drivers/parisc/eisa_eeprom.c is a standalone module (it has MODULE_LICENSE()
and module_init()) but is missing the MODULE_DESCRIPTION() macro, so modpost
emits a warning about it. Add the missing description.
Signed-off-by: Jean Delu <jeandelu@tutamail.com>
Signed-off-by: Helge Deller <deller@gmx.de>
|
|
Drop the extra comma in "scoped_guard()" to cleanup the code.
Link: https://patch.msgid.link/20260730150411.88667-5-leon.hwang@linux.dev
Acked-by: Jiri Olsa <jolsa@kernel.org>
Signed-off-by: Leon Hwang <leon.hwang@linux.dev>
Signed-off-by: Steven Rostedt <rostedt@goodmis.org>
|
|
Fix accessing the __rcu pointer direct_functions with RCU protection.
Cc: stable@vger.kernel.org
Link: https://patch.msgid.link/20260730150411.88667-4-leon.hwang@linux.dev
Fixes: e93672f770d7 ("ftrace: Add update_ftrace_direct_mod function")
Acked-by: Jiri Olsa <jolsa@kernel.org>
Signed-off-by: Leon Hwang <leon.hwang@linux.dev>
Signed-off-by: Steven Rostedt <rostedt@goodmis.org>
|
|
Fix accessing the __rcu pointer direct_functions with RCU protection.
Cc: stable@vger.kernel.org
Link: https://patch.msgid.link/20260730150411.88667-3-leon.hwang@linux.dev
Fixes: 8d2c1233f371 ("ftrace: Add update_ftrace_direct_del function")
Acked-by: Jiri Olsa <jolsa@kernel.org>
Signed-off-by: Leon Hwang <leon.hwang@linux.dev>
Signed-off-by: Steven Rostedt <rostedt@goodmis.org>
|
|
Fix accessing the __rcu pointer direct_functions with RCU protection.
Cc: stable@vger.kernel.org
Link: https://patch.msgid.link/20260730150411.88667-2-leon.hwang@linux.dev
Fixes: d05cb470663a ("ftrace: Fix modification of direct_function hash while in use")
Acked-by: Jiri Olsa <jolsa@kernel.org>
Suggested-by: Steven Rostedt <rostedt@goodmis.org>
Signed-off-by: Leon Hwang <leon.hwang@linux.dev>
Signed-off-by: Steven Rostedt <rostedt@goodmis.org>
|
|
git://git.kernel.org/pub/scm/linux/kernel/git/deller/linux-fbdev
Pull fbdev fixes from Helge Deller:
"A few patches for the core fbdev layer which stabilize or fix
potential issues with text font rendering after screen rotation or
after user initiated font changes and locking fixes for sysfb during
modifications of the graphics mode database"
* tag 'fbdev-for-7.2-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/deller/linux-fbdev:
fbdev: bitblit: bound-check glyph index in bit_cursor()
fbdev: Fix out-of-bounds access when rotating console after font resize
fbdev: core: Fix pointer desynchronization in fb_io_read()
fbdev: serialize mode sysfs access with lock_fb_info()
fbdev: clear fb_info->mode before deleting a videomode
fbdev: bound mode sysfs output to the sysfs buffer
|
|
When an eventfs inode is freed, it sets ei->is_freed and then uses its
ei->list to add it to the srcu link list as the list field is a union with
the rcu list head. As the ei->list is used to iterate over an SRCU
protected list without taking the eventfs_mutex, there's nothing stopping
the iteration over that list to see the ei->rcu instead of the ei->list
and it will read a corrupt target.
To fix this, change the union of the rcu list head with the children list.
On freeing the eventfs inode, set the is_free and execute a smp_wmb()
before adding the eventfs inode to the SRCU list.
On iteration of the ei->children list, at the start, execute a smp_rmb()
and then read the is_freed of the ei to see if the children list is still
valid. If is_freed is set, then the ei_child read is not valid and the
loop should exit immediately.
Cc: stable@vger.kernel.org
Link: https://patch.msgid.link/20260808094215.4252430d@robin
Fixes: 704f960dbee2f ("eventfs: Read ei->entries before ei->children in eventfs_iterate()")
Reported-by: Sashiko <sashiko-bot@kernel.org>
Closes: https://sashiko.dev/#/patchset/20260806022719.375354-1-shuangpeng.kernel%40gmail.com
Reviewed-by: Masami Hiramatsu (Google) <mhiramat@kernel.org>
Signed-off-by: Steven Rostedt <rostedt@goodmis.org>
|
|
eventfs_remove_rec() recursively removes the child at the current loop
position. After the recursive call returns, list_for_each_entry() advances
by reading list.next from the removed child.
If free_ei() drops the final reference, release_ei() reuses the list/rcu
union to queue an SRCU callback. The child may be freed before that read.
The eventfs_mutex serializes list updates, but it does not keep the removed
child alive or prevent the SRCU callback from running.
Use list_for_each_entry_safe() to save the next sibling before recursively
removing the current child.
Cc: stable@vger.kernel.org
Fixes: 43aa6f97c2d0 ("eventfs: Get rid of dentry pointers without refcounts")
Link: https://patch.msgid.link/20260806022719.375354-1-shuangpeng.kernel@gmail.com
Signed-off-by: Shuangpeng Bai <shuangpeng.kernel@gmail.com>
Acked-by: Masami Hiramatsu (Google) <mhiramat@kernel.org>
Signed-off-by: Steven Rostedt <rostedt@goodmis.org>
|
|
git://git.kernel.org/pub/scm/linux/kernel/git/driver-core/driver-core
Pull driver core fixes from Danilo Krummrich:
- Fix Rust build failure on s390 by gating ioremap() / iounmap()
helpers and the io::mem module on CONFIG_HAS_IOMEM; gate affected
doctests as well.
- Add missing kernel-doc for show_const / store_const union members in
struct device_attribute.
* tag 'driver-core-7.2-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/driver-core/driver-core:
rust: io: gate ioremap doctests on CONFIG_HAS_IOMEM
rust: io: gate ioremap/iounmap on CONFIG_HAS_IOMEM
driver core: add missing kernel-doc for union members
|
|
git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input
Pull input updates from Dmitry Torokhov:
- Fixes for information leaks and OOB accesses across several drivers,
including evdev, focaltech, edt-ft5x06, iforce, and cs40l50-vibra
- Improvements to the synaptics-rmi4 driver to properly handle F54
worker errors and prevent buffer overflows
- Input validation fixes in the hynitron_cstxxx touchscreen driver to
prevent issues with invalid finger IDs and touch counts
- Fixes for use-after-free and initialization bugs in the byd mouse and
psxpad-spi drivers
- New quirks for the atkbd driver to make keyboard work on HONOR and
Xiaomi laptops
- Support for the ZENAIM LEVERLESS controller in the xpad driver.
* tag 'input-for-v7.2-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input:
Input: evdev - sanitize event type index when fetching event masks
Input: synaptics-rmi4 - propagate F54 worker errors to V4L2 queue
Input: synaptics-rmi4 - block s_input when F54 queue is busy
Input: synaptics-rmi4 - bound the F54 report size to the allocated buffer
Input: synaptics-rmi4 - zero report size on F54 work error
Input: synaptics-rmi4 - fix F55 transmitter electrode count typo
Input: hynitron_cstxxx - validate touch count and finger IDs
Input: evdev - fix information leak in evdev_pass_values()
fixp-arith: convert comments to kernel-doc format
Input: focaltech - fix array out-of-bounds in focaltech_process_rel_packet
Input: atkbd - skip deactivate for HONOR ZQC-P
Input: atkbd - skip deactivate for Xiaomi Book Pro 14's internal keyboard
Input: iforce - validate input packet lengths
Input: psxpad-spi - set driver data before use
Input: cs40l50-vibra - validate custom data from user space
Input: xpad - add support for ZENAIM LEVERLESS
Input: edt-ft5x06 - ignore contacts with an out-of-range slot id
Input: byd - synchronize timer deletion before freeing private data
|
|
git://git.kernel.org/pub/scm/linux/kernel/git/powerpc/linux
Pull powerpc fixes from Madhavan Srinivasan:
- A couple of fixes for a memory leak and a underflow case
Thanks to George Wilson and R Nageswara Sastry
* tag 'powerpc-7.2-4' of git://git.kernel.org/pub/scm/linux/kernel/git/powerpc/linux:
powerpc/pseries: lparcfg - fix kbuf[] underflow
powerpc/pseries: pci - logic bug
powerpc/pseries: papr-phy-attest - validate cmd.length, plug mem leak
|
|
When a CPU is taken offline or enters deep idle states, hypervisor CSR
state is lost. The kvm_former_vcpu fast-path optimization caches the
last VCPU that ran on each CPU to avoid expensive CSR restoration when
the same VCPU is re-scheduled on the same CPU. However, if this cache
is not cleared when CSR state is lost, the next VCPU entry will
incorrectly skip CSR restoration, leading to corrupt hypervisor state.
Add kvm_riscv_clear_former_vcpu() to invalidate the per-CPU cache and
call it from kvm_arch_disable_virtualization_cpu() to ensure proper CSR
restoration after CPU offline or system suspend events.
Fixes: 1323a5cfe52c ("KVM: riscv: Skip CSR restore if VCPU is reloaded on the same core")
Signed-off-by: Yong-Xuan Wang <yongxuan.wang@sifive.com>
Reviewed-by: Nutty Liu <nutty.liu@hotmail.com>
Reviewed-by: Anup Patel <anup@brainfault.org>
Link: https://lore.kernel.org/r/20260721-kvm-cpu-pm-v4-1-146bf942547d@sifive.com
Signed-off-by: Anup Patel <anup@brainfault.org>
|
|
SBI PMU EVENT_GET_INFO stores guest-controlled num_events * sizeof(*einfo)
in a 32-bit integer. On RV64, num_events = 0x10000001 makes 0x100000010
truncate to 16. KVM then allocates one entry but loops over the original
num_events, causing out-of-bounds reads and writes. A nested guest
triggered:
BUG: KASAN: slab-out-of-bounds in kvm_riscv_vcpu_pmu_event_info+0xa4/0x142
Read of size 4 at addr ff600000074d46b0 by task init/1
Call Trace:
[<ffffffff8006471c>] kvm_riscv_vcpu_pmu_event_info+0xa4/0x142
[<ffffffff800690c0>] kvm_sbi_ext_pmu_handler+0xca/0x268
[<ffffffff8006779e>] kvm_riscv_vcpu_sbi_ecall+0xec/0x1e6
[<ffffffff8006008c>] kvm_riscv_vcpu_exit+0x48c/0x540
[<ffffffff8005ea0a>] kvm_arch_vcpu_ioctl_run+0x37e/0xc80
Allocated by task 1:
__kmalloc_noprof+0x19e/0x4b0
kvm_riscv_vcpu_pmu_event_info+0x72/0x142
kvm_sbi_ext_pmu_handler+0xca/0x268
kvm_riscv_vcpu_sbi_ecall+0xec/0x1e6
kvm_riscv_vcpu_exit+0x48c/0x540
kvm_arch_vcpu_ioctl_run+0x37e/0xc80
The buggy address is located 0 bytes to the right of
allocated 16-byte region [ff600000074d46a0, ff600000074d46b0)
Store the shared-memory size in size_t and reject multiplication overflow.
Allocate the guest-driven array with GFP_KERNEL_ACCOUNT so it is charged
to kmemcg, and use __GFP_NOWARN to suppress allocation failure warnings.
Use kvcalloc() to allow vmalloc fallback and an unsigned long loop index
to match num_events.
Reported-by: Naveed Khan <naveed@digiscrypt.com>
Closes: https://lore.kernel.org/kvm/178345245327.72065.13249716450708539854@digiscrypt.com/
Fixes: e309fd113b9f ("RISC-V: KVM: Implement get event info function")
Cc: stable@vger.kernel.org
Signed-off-by: Guidong Han <2045gemini@gmail.com>
Reviewed-by: Anup Patel <anup@brainfault.org>
Link: https://lore.kernel.org/r/20260730092533.1369531-1-2045gemini@gmail.com
Signed-off-by: Anup Patel <anup@brainfault.org>
|
|
renesas_i3c_daa() derives the number of newly assigned dynamic addresses
from cmd->rx_count, which the response ISR sets to the number of address
slots ENTDAA left unassigned. It starts out as zero, which already means
"every address was assigned", so a timed out transfer leaves that value
in place and it gets used as a result.
On a bus with no target connected the ENTDAA times out and the driver
registers RENESAS_I3C_MAX_DEVS devices that are not there, each costing
the core two seconds on a GETPID that can only time out:
i3c i3c-0: Failed to add I3C device at address 9, error -110
...
i3c i3c-0: Failed to add I3C device at address 16, error -110
Start from maxdevs instead: no address is assigned before ENTDAA runs,
and the existing rx_count >= maxdevs check then reports an empty bus.
Fixes: d028219a9f14 ("i3c: master: Add basic driver for the Renesas I3C controller")
Signed-off-by: Tommaso Merciai <tommaso.merciai.xr@bp.renesas.com>
Reviewed-by: Claudiu Beznea <claudiu.beznea.uj@bp.renesas.com>
Tested-by: Claudiu Beznea <claudiu.beznea.uj@bp.renesas.com> # on RZ/G3S
Reviewed-by: Frank Li <Frank.Li@nxp.com>
Link: https://patch.msgid.link/20260731070150.2519825-1-tommaso.merciai.xr@bp.renesas.com
Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
|
|
Implement ->set_speed() so the I3C core can switch open-drain timing for
the first broadcast address per spec: I3C_OPEN_DRAIN_SLOW_SPEED programs
tHIGH_INIT (200 ns) before RSTDAA, and I3C_OPEN_DRAIN_NORMAL_SPEED restores
normal OD timing afterward. Cache the normal OD register value during bus
init and use a separate od_hcnt for the slow path so SDR extended timing
remains derived from the normal PP hcnt.
For AMD_I3C_OD_PP_TIMING, cache AMD_I3C_OD_TIMING as the normal OD
baseline and stop rewriting OD timing in send_ccc_cmd()/runtime resume so
I3C_OPEN_DRAIN_SLOW_SPEED is preserved through RSTDAA.
Use PM_RUNTIME_ACQUIRE_AUTOSUSPEND() in set_speed(). Compute od_hcnt with
DIV_ROUND_UP_ULL() for 32-bit safety and clamp it to U8_MAX to match the
8-bit I3C_OD_HCNT field.
Fixes I2C devices with spike filters not being detected on mixed buses.
Signed-off-by: Tze Yee Ng <tze.yee.ng@altera.com>
Reviewed-by: Frank Li <Frank.Li@nxp.com>
Link: https://patch.msgid.link/d789219ca0418898a1ef2bf9295b4f96ca7b4209.1785484707.git.tze.yee.ng@altera.com
Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
|
|
Set master->ibi_wakeup during probe when the associated system device
advertises wakeup capability, allowing the I3C core to mark IBI-capable
I3C devices as wakeup capable.
Tweak the comment for i3c_hci_sysdev() to mention the new usage.
Signed-off-by: Adrian Hunter <adrian.hunter@intel.com>
Reviewed-by: Frank Li <Frank.Li@nxp.com>
Link: https://patch.msgid.link/20260807145638.168865-15-adrian.hunter@intel.com
Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
|
|
The MIPI I3C HCI driver needs to identify the underlying system device
used for DMA mapping and PM operations. The logic for determining that
device is currently embedded in the DMA implementation.
Factor this code out into i3c_hci_sysdev() so it can be shared by other
parts of the driver and keep the device-selection logic in one place.
The explanatory comment moves with the code, reworked as kernel-doc now
that it documents a function rather than an inline block.
Signed-off-by: Adrian Hunter <adrian.hunter@intel.com>
Reviewed-by: Frank Li <Frank.Li@nxp.com>
Acked-by: Mukesh Savaliya <mukesh.savaliya@oss.qualcomm.com>
Link: https://patch.msgid.link/20260807145638.168865-14-adrian.hunter@intel.com
Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
|
|
Keep the PCI wakeup state aligned with the wakeup requirements of the
devices served by the controller(s).
The PCI function is the wakeup source for HCI instances exposed beneath
it. However, wakeup is only needed when at least one attached I3C device
is enabled as a wakeup source.
During suspend, check whether any HCI instance has a wakeup-enabled I3C
device and enable wakeup for the PCI function only in that case.
Otherwise leave PCI wakeup disabled.
Note, the suspend callback is used for both system and runtime suspend.
Although this change may update the PCI wakeup state during runtime
suspend, it does so only when the required wakeup state changes.
Moreover, PCI wakeup-capable devices already have PME wakeup armed for
runtime suspend, so changing the wakeup-enabled state does not affect
runtime PM wakeup behavior.
Note also, since the PCI wakeup state is derived from the wakeup
configuration of the attached I3C devices, the PCI device power/wakeup
sysfs attribute no longer provides independent wakeup control.
Signed-off-by: Adrian Hunter <adrian.hunter@intel.com>
Reviewed-by: Frank Li <Frank.Li@nxp.com>
Link: https://patch.msgid.link/20260807145638.168865-13-adrian.hunter@intel.com
Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
|
|
i3c_device_request_ibi() does not verify that a device advertises IBI
support before attempting to set up IBI handling.
Add a check for I3C_BCR_IBI_REQ_CAP and fail with -EOPNOTSUPP when IBI
support is not reported by the device. This keeps IBI setup consistent
with other IBI-related functionality, such as exposing wakeup capability
only for IBI-capable devices.
Signed-off-by: Adrian Hunter <adrian.hunter@intel.com>
Reviewed-by: Frank Li <Frank.Li@nxp.com>
Link: https://patch.msgid.link/20260807145638.168865-12-adrian.hunter@intel.com
Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
|
|
Add i3c_master_has_wakeup_enabled_devs(), which iterates over the devices
on an I3C bus and reports whether any of them are enabled for system
wakeup and have IBI enabled.
Controller drivers can use this helper to determine whether wakeup
support must remain available while the system is suspended.
Acked-by : Mukesh Savaliya <mukesh.savaliya@oss.qualcomm.com>
Signed-off-by: Adrian Hunter <adrian.hunter@intel.com>
Reviewed-by: Frank Li <Frank.Li@nxp.com>
Link: https://patch.msgid.link/20260807145638.168865-11-adrian.hunter@intel.com
Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
|
|
An I3C device configured as a wakeup source can wake the system by
generating an In-Band Interrupt (IBI).
When an IBI is queued for processing, record a wakeup event for the
device if wakeup is enabled. Use a 100 ms processing interval to give
the I3C device driver time to process the IBI.
Signed-off-by: Adrian Hunter <adrian.hunter@intel.com>
Reviewed-by: Frank Li <Frank.Li@nxp.com>
Link: https://patch.msgid.link/20260807145638.168865-10-adrian.hunter@intel.com
Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
|
|
An I3C controller acts as a bus controller for one or more I3C devices.
If the controller can wake the system in response to an In-Band
Interrupt (IBI), then any device on that bus that is capable of
generating IBIs can potentially be used as a wakeup source.
Add an ibi_wakeup flag to struct i3c_master_controller so controller
drivers can advertise support for IBI-based wakeup.
If set, mark IBI-capable I3C devices as wakeup capable when they are
registered, allowing wakeup management through the standard device
wakeup framework.
Signed-off-by: Adrian Hunter <adrian.hunter@intel.com>
Reviewed-by: Frank Li <Frank.Li@nxp.com>
Acked-by: Mukesh Savaliya <mukesh.savaliya@oss.qualcomm.com>
Link: https://patch.msgid.link/20260807145638.168865-9-adrian.hunter@intel.com
Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
|
|
i3c_device_match() dereferences i3cdev->desc without holding the bus
normal-use lock. Since the descriptor pointer can be replaced
concurrently, the dereference can race with descriptor replacement and
result in a use-after-free.
Protect access to i3cdev->desc with the normal-use lock. While the lock
is held, the descriptor is guaranteed to remain valid, so the NULL check
is also unnecessary and can be removed.
This change depends on "i3c: master: Fix recursive locking during device
registration". Prior to that change, taking the normal-use lock in
i3c_device_match() could recurse on bus->lock during device
registration.
Fixes: 3456baa2110c ("i3c: master: match I3C device through DT and ACPI")
Signed-off-by: Adrian Hunter <adrian.hunter@intel.com>
Reviewed-by: Frank Li <Frank.Li@nxp.com>
Link: https://patch.msgid.link/20260807145638.168865-8-adrian.hunter@intel.com
Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
|
|
i3c_device_uevent() dereferences i3cdev->desc without holding the bus
normal-use lock. Since the descriptor pointer can be replaced
concurrently, including when a uevent is generated from sysfs, this can
result in dereferencing a stale descriptor and lead to a use-after-free.
Use i3c_device_get_info() instead, which protects access to the
descriptor with the normal-use lock.
Commit 6cf7b65f7029 ("i3c: Use i3cdev->desc->info instead of calling
i3c_device_get_info() to avoid deadlock") replaced the accessor with a
direct descriptor dereference because i3c_device_get_info() would
recursively acquire bus->lock during device registration.
This change depends on "i3c: master: Fix recursive locking during device
registration", which moves device registration out from under bus->lock
and removes the possibility of that deadlock. Without that change,
restoring the i3c_device_get_info() call would reintroduce the deadlock.
Fixes: 6cf7b65f7029 ("i3c: Use i3cdev->desc->info instead of calling i3c_device_get_info() to avoid deadlock")
Cc: stable@vger.kernel.org # requires "i3c: master: Fix recursive locking during device registration"
Signed-off-by: Adrian Hunter <adrian.hunter@intel.com>
Acked-by: Mukesh Savaliya <mukesh.savaliya@oss.qualcomm.com>
Reviewed-by: Frank Li <Frank.Li@nxp.com>
Link: https://patch.msgid.link/20260807145638.168865-7-adrian.hunter@intel.com
Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
|
|
i3c_device_get_info() takes the bus normal-use lock before accessing
dev->desc. Under that lock, the descriptor pointer is guaranteed to be
valid for the duration of the access.
Remove the unnecessary NULL check on dev->desc so the code more clearly
reflects the locking rules and expected descriptor lifetime.
Signed-off-by: Adrian Hunter <adrian.hunter@intel.com>
Acked-by: Mukesh Savaliya <mukesh.savaliya@oss.qualcomm.com>
Reviewed-by: Frank Li <Frank.Li@nxp.com>
Link: https://patch.msgid.link/20260807145638.168865-6-adrian.hunter@intel.com
Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
|
|
sysfs attribute callbacks for the master controller device dereference
master->this. However, master->this is freed in
i3c_master_detach_free_devs() before the master device itself is
released.
As a result, sysfs accesses can dereference a freed master->this
pointer, leading to a use-after-free.
Keep master->this alive until i3c_masterdev_release(), which is called
after the master device and its sysfs state are being torn down. Do not
free master->this as part of the normal device detach path.
On the error path in i3c_master_set_info(), reset master->this and
bus.cur_master to NULL before freeing the allocated device.
Fixes: 3a379bbcea0a ("i3c: Add core I3C infrastructure")
Cc: stable@vger.kernel.org
Signed-off-by: Adrian Hunter <adrian.hunter@intel.com>
Reviewed-by: Frank Li <Frank.Li@nxp.com>
Link: https://patch.msgid.link/20260807145638.168865-5-adrian.hunter@intel.com
Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
|
|
i3c_master_search_i3c_dev_duplicate() searches the bus for another I3C
device with the same PID as the reference device. The search can match
master->this, causing the controller itself to be returned as a
duplicate.
Since the controller is not a target device, it cannot be a duplicate of
one. Exclude master->this from matching so that the function only
returns real duplicate target devices.
Fixes: 3a379bbcea0a ("i3c: Add core I3C infrastructure")
Cc: stable@vger.kernel.org
Signed-off-by: Adrian Hunter <adrian.hunter@intel.com>
Reviewed-by: Frank Li <Frank.Li@nxp.com>
Acked-by: Mukesh Savaliya <mukesh.savaliya@oss.qualcomm.com>
Link: https://patch.msgid.link/20260807145638.168865-4-adrian.hunter@intel.com
Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
|
|
i3c_device_get_supported_xfer_mode()
i3c_device_get_supported_xfer_mode() uses dev->desc to obtain the
master controller. However, dev->desc must not be dereferenced unless
bus->lock is held, and this function does not take that lock.
The function only needs access to the master controller associated with
the device's bus. Use dev->bus instead, which is always valid for the
lifetime of the device and does not require dereferencing dev->desc.
Fixes: 256a21743d91 ("i3c: Add HDR API support")
Cc: stable@vger.kernel.org
Signed-off-by: Adrian Hunter <adrian.hunter@intel.com>
Reviewed-by: Frank Li <Frank.Li@nxp.com>
Link: https://patch.msgid.link/20260807145638.168865-3-adrian.hunter@intel.com
Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
|
|
i3c_master_register_new_i3c_devs() registers newly discovered devices
while holding i3c_bus_normaluse_lock(), a down_read(). device_register()
can immediately probe the device, and probe callbacks typically invoke
I3C helpers that take i3c_bus_normaluse_lock() again, leading to a
recursive acquisition of the same rwsem. rwsems do not support recursive
read locking and can deadlock when a writer is waiting. See the
"Recursive read locks" section of Documentation/locking/lockdep-design.rst.
For example, with Intel LPSS I3C, LOCKDEP generates a WARNING like:
# echo intel-lpss-i3c.0 > /sys/bus/platform/drivers/mipi-i3c-hci/unbind
# echo intel-lpss-i3c.0 > /sys/bus/platform/drivers/mipi-i3c-hci/bind
WARNING: possible recursive locking detected
kworker/5:1/94 is trying to acquire lock:
ffff88811c810d78 (&i3cbus->lock){++++}-{4:4}, at: i3c_device_match_id+0x45/0x370
but task is already holding lock:
ffff88811c810d78 (&i3cbus->lock){++++}-{4:4}, at: i3c_master_reg_work_fn+0x21/0x5f0
Fix this by separating device creation from device registration.
Populate desc->dev under the maintenance lock, collect the devices that
still need registration into a local list, then release the lock before
calling device_register(). Finally retake the lock and clean up any
devices that failed to register.
Use the maintenance lock rather than the normal-use lock while adding
device objects. A write-side maintenance lock prevents readers from
observing a partially initialized desc->dev during initial device
population, or desc->dev disappearing if registration fails.
The local list requires a list node, so add a list node member to struct
i3c_device.
Fixes: 3a379bbcea0a ("i3c: Add core I3C infrastructure")
Cc: stable@vger.kernel.org
Signed-off-by: Adrian Hunter <adrian.hunter@intel.com>
Reviewed-by: Frank Li <Frank.Li@nxp.com>
Link: https://patch.msgid.link/20260807145638.168865-2-adrian.hunter@intel.com
Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
|
|
Boot-time tracing currently supports kprobe-events and synthetic-events
under per-event configuration options.
Extend boot-time tracing to support newly added dynamic probe types:
- event probes (eprobe) under the "eprobes" event group
- function probes (fprobe) under the "fprobes" event group
- tracepoint probes (tprobe) under the "tracepoints" or "tprobes"
event group
To support this cleanly, update dyn_event_create() in trace_dynevent.c
so that passing NULL as the type parameter delegates to
create_dyn_event(), allowing generic creation of any registered
dynamic event type from a raw command string.
Update Documentation/trace/boottime-trace.rst accordingly to describe
the new per-event bootconfig options.
Link: https://lore.kernel.org/all/178613905149.259829.18185480460810689421.stgit@devnote2/
Assisted-by: Antigravity:gemini-3.6-flash
Signed-off-by: Masami Hiramatsu (Google) <mhiramat@kernel.org>
Changes in v3:
- Check return values of strscpy() and snprintf() in trace_boot_add_probe_event()
to prevent silent buffer truncation when constructing probe event strings.
Changes in v2:
- Fix raw command detection logic for eprobes, fprobes, and tprobes
by requiring ':' or isspace() after type prefix.
- Consolidate duplicate loop logic into trace_boot_add_probe_event()
helper function.
|
|
Kmemleak doesn't know about runtime_const stuff and figures we're leaking
__futex_queues. So add this little annotation to tell it all is well.
Fixes: b78b0b658252 ("futex: Use runtime constants for __futex_hash() hot path")
Reported-by: kernel test robot <oliver.sang@intel.com>
Closes: https://lore.kernel.org/oe-lkp/202608071053.6db6276e-lkp@intel.com
Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
Link: https://patch.msgid.link/20260807152353.GP687043@noisy.programming.kicks-ass.net
|
|
Kumar Kartikeya Dwivedi says:
====================
Add arena argument support to kfuncs and struct_ops
This is a continuation of patches in [0], with mostly minor changes and
reordering. The motivation is covered in that link. A major change is
moving to two tags (__arena and __arena__nullable) and moving the changes
to JIT to emit more optimized sequences.
Please see commit logs for details.
[0]: https://lore.kernel.org/bpf/20260713024414.3759854-1-tj@kernel.org
Changelog:
----------
v4 -> v5
v4: https://lore.kernel.org/bpf/20260805210427.3218326-1-memxor@gmail.com
* Remove the redundant patch-8 capability comment and duplicate
nullable kfunc test coverage. (Eduard)
* Introduce the final bpf_tramp_arena_base() interface directly with
function-model argument flags, avoiding temporary slot bitmaps and
arena_nullable state; simplify struct_ops pointer validation. (Eduard)
* Simplify kfunc arena nullability classification by using the common
nullable path for both arena suffixes while leaving the function model
to distinguish JIT NULL preservation. (Amery)
* Keep bpf_prog_has_arena_ctx_arg() in bpf_verifier.h from its
introduction so trampoline and verifier users share one inline
definition, avoiding BPF_JIT/BPF_SYSCALL link dependencies.
(Eduard, BPF CI Bot)
* Reject both tracing and extension attachments to struct_ops programs
with arena context arguments, and add fentry, fexit, and freplace
rejection tests. (Eduard, Sashiko)
v3 -> v4
v3: https://lore.kernel.org/bpf/20260803125115.2264733-1-memxor@gmail.com
* Rename __arena_nullable to __arena__nullable and prioritize the
composite suffix over __nullable during argument classification.
(Sashiko, Eduard)
* Resolve instructions before collecting subprograms and kfuncs so kfunc
prototype validation can use associated arena state.
* Move the arena kfunc and JIT-sequence test entry points into
prog_tests/verifier.c. (Eduard)
* Match the generated L0 target and call in nullable JIT assertions.
(Eduard)
* Route arena kfunc validation through the common argument-checking path.
(Amery)
* Reuse btf_func_model argument flags for struct_ops arena arguments
instead of maintaining separate trampoline slot metadata. (Eduard)
* Check the generic-trampoline arena argument invariant at link time and
warn once on violations. (Eduard)
* Reject tracing attachments to struct_ops programs with arena context
arguments whose indirect trampolines convert the pointers. (Sashiko)
v2 -> v3
v2: https://lore.kernel.org/bpf/20260726013105.3689867-1-memxor@gmail.com
* Rebase onto current bpf-next to resolve conflicts.
v1 -> v2
v1: https://lore.kernel.org/bpf/20260715220052.1590783-1-memxor@gmail.com
* Fix documentation to only mention x86 for now. (Sashiko)
* Move arg bitmap from insn_aux_data to kfunc descriptor. (Eduard)
====================
Link: https://patch.msgid.link/20260808003938.3486067-1-memxor@gmail.com
Signed-off-by: Eduard Zingerman <eddyz87@gmail.com>
|
