mirror of
https://github.com/torvalds/linux.git
synced 2026-10-12 13:27:02 +02:00
484ddb357c
1462685 Commits
| Author | SHA1 | Message | Date | |
|---|---|---|---|---|
Arnd Bergmann
|
484ddb357c |
Amlogic drivers for v7.3:
- Clock measure debugfs fixup - Clock measure support for Amlogic A1 & T7 -----BEGIN PGP SIGNATURE----- iQIzBAABCgAdFiEEPVPGJshWBf4d9CyLd9zb2sjISdEFAmppuGgACgkQd9zb2sjI SdHMxxAAuWIZcX7X4r5NEuX0FIv9segRbi9RvWln3mi23d6tP2WI6b1Um54iYloa NtFY9lFtWDDEIwqh+5cSuqV2GtkPHccf8DuFQPScJrcqG/YuBEKiGam2/gPqkUn9 cYeWaaHzPhgRp14oJ4FRq+aazKb1HncSUBiCXl7H4iv1tWYfdFqtEh/06e0OiNGc p/MCs61/6RRjP2ofrxn/+dlrk/aX3GMeIBHqIxObCaTbsa6rA4z/lZqfr+V+UApk C7gIEcr1D2TBrCx6Y/MiiOwNyurHFVKbSb62XAjxOLRqoAHnI1GECweO6J0wcz/n Z/evQMmzgxcOsoQO9DweRJ8WAZiKsjBt7FkM6uyDBsb7XjIfqHIvqAQMnXfQnZmJ QdMoadmuJ4N2WHu/w65BrICEJj0gHuN3Cc51oRMwp8Z6D53yBXqwGuZ0ruLoBB3G niTzguF91H8/ExxFrNjT8X3Xsn61Yduz+cA1/zAjnWIDjwS80a/kJHneqwFB8y2k CxfUcLaEejgiTcZOiRRRI/zHqS+hMpbvJw3OVZsrDkAXoabjDzT6c+i/7Yp91IUj a3xf0Ri3IAZRkMEGDvZw4jYeZ5brMCMgTpGGPNXjHkCiQw8AKLI3bEN2oOdFUQid dvHFCoHL96DqCjQQgdWT2iyXSKdkq9CI667NKRaJjxjIKdONxmI= =fKAj -----END PGP SIGNATURE----- gpgsig -----BEGIN PGP SIGNATURE----- iQIzBAABCgAdFiEEo6/YBQwIrVS28WGKmmx57+YAGNkFAmpyQg0ACgkQmmx57+YA GNmaGg//Wtu6r9JQek5bWH5ZYXBcJi2mZXH0lHm6/mylqOpVaLZ3Ivguey20gNhg AqMeh3QlhrfaG4yxzR246j4WnVAi080CVU9rt8Z8oK0ox3U18mmGcL+u4vzr0blZ 751htm7fZ4LXaJjp5ahBfbFuUpQyi9hFihPfjY1ZBUtkc7KgigjrRPYi/41I2Sx6 r7yW9A3XpAlA/qhhOt6eAC8iidhimp6U4j+HQxa9ynFJk1E0hI+mI4MktbnpXl2x Z2kR6axrgJpgIMIIz6ywLyvZxUNDnQLPGhyRf3BK+m7A9BmY+Ej/FLmKPnII/yIp XBngV9ES6Kd3MDuTlGhh7O/IfZETatDjVw8XQfReGK2dK8K/XTswRU4DVFqdQbRB nEjKdOHCpi/AYpKGbREHfCd3b+EGwHfLkH93lmy1aWDF6wPzfZkR1+UNsBETPUjL qt5D1PcL9tNbZriXl3HFixFQlsyKP5My1h+0jmFSbCJQI7mSnM3B1NDajSSYN0ny MBaibHcsAApH/ZEQE/e8r+E9wNabHOLlen3owHtwuRlSvA5tMeGy2dzu3q8KZPC+ lUhsI3Sa8l2cMTvLzoJVtuH2A8oQfJL+bEYeSrEV4U1pIny7a1jkkbaQWhEEWsNL ws0Wfs/u4sdSCJinZgy3aLHhOyQ+v5Mfp4aHWSeskWtPhahAaBY= =wjNR -----END PGP SIGNATURE----- Merge tag 'amlogic-drivers-for-v7.3' of https://git.kernel.org/pub/scm/linux/kernel/git/amlogic/linux into soc/drivers Amlogic drivers for v7.3: - Clock measure debugfs fixup - Clock measure support for Amlogic A1 & T7 * tag 'amlogic-drivers-for-v7.3' of https://git.kernel.org/pub/scm/linux/kernel/git/amlogic/linux: soc: amlogic: meson-clk-measure: remove debugfs tree soc: amlogic: clk-measure: Add A1 and T7 support dt-bindings: soc: amlogic: clk-measure: Add A1 and T7 compatible Signed-off-by: Arnd Bergmann <arnd@arndb.de> |
||
|
Arnd Bergmann
|
aa469c0c55 |
MediaTek SoC driver updates
This adds a fix for a missing error check in mtk-socinfo, and also a missing MODULE_DEVICE_TABLE() in the mtk-dvfsrc driver. Besides from that, this also reworks how the MMSYS tables are specified with the macro, separating the component's hardware instance from the actual type, resolving a prerequirement for the restructuring of mediatek-drm. -----BEGIN PGP SIGNATURE----- iLoEABYKAGIWIQQn3Xxr56ypAcSHzXSaNgTPrZeEeAUCamsBiRsUgAAAAAAEAA5t YW51MiwyLjUrMS4xMiwyLDIoHGFuZ2Vsb2dpb2FjY2hpbm8uZGVscmVnbm9AY29s bGFib3JhLmNvbQAKCRCaNgTPrZeEeFUuAQCcdpIBGxycSOIoG5uxijcx8w7uhmf9 FJMPm4LiDF5LgwD/bn2CqDMCrkNQysoErQkhVlOczLbKJSQ69QGFuSGLlwo= =TyOH -----END PGP SIGNATURE----- gpgsig -----BEGIN PGP SIGNATURE----- iQIzBAABCgAdFiEEo6/YBQwIrVS28WGKmmx57+YAGNkFAmprF7wACgkQmmx57+YA GNnb0BAAg54DnXer5nJLPZyqfKbgscGZbVLFW2X9k/Cx1utJpVW4ozxRCUTK4sb4 15t+wUOSsdzj1ZIYCccZR3QtqBxbPRnLECHeP/tEqf0+4Qu0jOaYXIstIVsrInkr zDtXFReq0D+2V8Nf46gw7zi65q2xZUbNSeJTUgy3s5miOaB0w1/as6c97SJzzZgU DqLEmo/gi74+k3PfYcgLiJJXJSYba8qtGUorrJbXvil+wWPbcDIpokpt7V/ktGjE jVBdtHNR0IhpMZUjK/4CUi2EgQHpnGeSLN0je3O9PfdUVcIvauwd2Fy5RUSfOk8x Hs877b4OcJry+fAS1Hw+/v2f1nlMyMcfuPll+8GHkP11c511M55o3zbYR0RKlrtz DT12QiSTHyLir+4fdTyh808hBJw8B2CPt59AtHbTT1YNAFfqOmo/5EmYlCOIiFNk WRYz7lQRLY2ElOgUQAtmAS4LiPg7aen0bICIggFdK68abdUfon7oSanxkYxEL1By 0+/fQMbOlotlJar5cyi5l1/bKshs8IIm/+aLXFsqtIBZHbKXo6Z9NXM3HDXOj1oK II+sfmw8GxfmGVQbLUCns3J4IlVUqndw10Bad8u2djLruWeL9AgfkRQZqOTEi1B2 4BL6aB4H9Co0amwb1mPUFh7atfLgqaQkf623Lis6i+hqR5+4cGc= =Ew69 -----END PGP SIGNATURE----- Merge tag 'mtk-soc-for-v7.3' of https://git.kernel.org/pub/scm/linux/kernel/git/mediatek/linux into soc/drivers MediaTek SoC driver updates This adds a fix for a missing error check in mtk-socinfo, and also a missing MODULE_DEVICE_TABLE() in the mtk-dvfsrc driver. Besides from that, this also reworks how the MMSYS tables are specified with the macro, separating the component's hardware instance from the actual type, resolving a prerequirement for the restructuring of mediatek-drm. * tag 'mtk-soc-for-v7.3' of https://git.kernel.org/pub/scm/linux/kernel/git/mediatek/linux: soc: mediatek: add missing MODULE_DEVICE_TABLE() soc: mediatek: mtk-mmsys: Use MMSYS_ROUTE() in default routing table soc: mediatek: mtk-mmsys: Rework routes to specify component ID soc: mediatek: mtk-socinfo Add error handling in devm_kasprintf() Signed-off-by: Arnd Bergmann <arnd@arndb.de> |
||
|
Pengpeng Hou
|
ec76205786
|
soc: mediatek: add missing MODULE_DEVICE_TABLE()
The driver has an OF match table wired to .of_match_table, but does not export the table with MODULE_DEVICE_TABLE(). Add the missing MODULE_DEVICE_TABLE(of, ...) entry so module alias information is generated for OF based module autoloading. This is a source-level fix. It does not claim dynamic hardware reproduction; the evidence is the driver-owned match table, its use by the platform driver, and the missing module alias publication. Signed-off-by: Pengpeng Hou <pengpeng@iscas.ac.cn> Signed-off-by: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com> |
||
|
AngeloGioacchino Del Regno
|
dd63310b94
|
soc: mediatek: mtk-mmsys: Use MMSYS_ROUTE() in default routing table
All of the mtk_mmsys_routes tables for all SoCs were converted to use the MMSYS_ROUTE() macro but the default one used for MT2701, MT2712 and SoCs from that generation was not: convert this one as well. This brings no functional change. Signed-off-by: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com> |
||
|
AngeloGioacchino Del Regno
|
2fa28edca0
|
soc: mediatek: mtk-mmsys: Rework routes to specify component ID
In preparation for a refactoring of multimedia related MediaTek drivers, including mmsys, mutex and mediatek-drm, rework all of the MMSYS routes to specify a hardware component instance number (or "SubID") alongside the hardware component type. This also is one step of preparation towards the removal of the catch-all mtk_ddp_comp_id enumeration and towards the migration from a predefined-coupling static hardware component IDSubID mapping (carrying around a very long enumeration and also some multiple big arrays in mediatek-drm) to a more flexible map of Component ID (Type) decoupled from Component SubID (HW Instance) as then, anyway, techniques to handle components are always the same on a type basis. Signed-off-by: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com> |
||
|
Arnd Bergmann
|
ce9af94e6d |
Samsung SoC drivers for v7.3
1. Fix very old leak of OF node in PMU driver. 2. Few cleanups and new bindings for ExynosAutov920 HSI0 syscon. -----BEGIN PGP SIGNATURE----- iQJEBAABCgAuFiEE3dJiKD0RGyM7briowTdm5oaLg9cFAmpnqlgQHGtyemtAa2Vy bmVsLm9yZwAKCRDBN2bmhouD1+MtD/9M66W36D7KaI9tnHLxVO+2h+VZV73Q9+jI Siy6LaytoSX9Zz3jYYeLT8AFCm2ykbydGfIWOBw8lWKrc5tSlQhE/zFrl8fcigr6 7xvHbHPoUa/cv8yxDn0v0JPQtnbKyRz6+vNuYPSTGFsLCqavMEPlq3PGNz43j5rG 6TgbpE2HC1K0fhuYMkootj/O4QLVN0RbUbAjYmdbxY35/z5pPq/5lAvOZU9GdI9d l+rICXNJy9ZMPw9u5HR8IEDiV9dH+Znwk7jkGxIzyDpSxi4FW9jrfui124aqFDCU qc97cBzYZ1mf7FK1zkfT3KRZ/TaAxl49kxbOB4WzOxDDtZ866ciSN2OGtvMmFlzd 5jnHj7b7hnm5L1U59GPDZD940qNFydK/2cgS1x4bc0aPsT324NxV/m0TuzIro91Z xwbllGGfHmEC5Rl1WthrrXZPBTkM23KJAdvA9d4M/yPv6tEMJsAkqwKcoiV+wPeQ hhtuyH2bCw+UZZ7rxN0gAuT8hdj1bexuminZilixCBAZkNymV9njiueipNEL9Hb0 2bfTKE84plPjjQ8ijgoAZ/Sefv/6at51gEwYjWZnX66huzkp3w8pXj2MhkG7lgmv DC5hWpOU/kFNCamePeQUeJ9hwbdPCy13NDkjmuh0s6Ouzy9DpuIxCmE4U8cID5MQ x+Rh4YbWPQ== =xeyD -----END PGP SIGNATURE----- gpgsig -----BEGIN PGP SIGNATURE----- iQIzBAABCgAdFiEEo6/YBQwIrVS28WGKmmx57+YAGNkFAmpqFiQACgkQmmx57+YA GNlYKw/+KxY6PubRpNhKHivaGqFBFgD+GlPaJNRMkFgXYIiUz6CDwnFK0v9XozOr UfwrfIDGBvdq0XrNJmiRPW68A4PhGV9MP7Tq3iwEFr/hjRCgjylGNe92znzTIHat oJtB96EdAPd+Dgr5vuZ923yA9t3zGf1Ns5YqlLos7xGWDBzXuAKmQVbf7j7exLg5 FwjabWAwHsf3le13WYsEY4TleqHMYuspLnsIVSQXJwiX4Ex67ndKcwQdIECY7eYs y7790ofY67mBa2y+JRiybCMCk6KbgBxtbDb1jL/GJ8zde4mpoX7hdJ8u6hMIdOMJ 5lpHL0m31nuKyzIsBAAKcdKJviNL09d8yy+RzU1/DT84kVxz6eFsxfj+NR6inHKE ZsBZS7oJRoRpMxCLxvnE44PVFCnCuv517CqvDfvEyCMx2pKmUl3C2O1CgE5mIK2n FqgbuTy4rQLw7pKR3HF+qEyhyHYiuARWftVuXPWf8NHCPNSb37x50HjC4FYJPcOq rP9fKAlqxHd4CQ0WlUx1J0mmp5USmYj9xbc2aUS/g1bJ1GaWfSuT/a7wZuI57769 HIc2Mqv9G+3LaEd2UNCods7QXW3zZTK80qm8WyEm4PddSX/9K6R/gzCzl0CwMfCe /qFewzZTL9SJ4F3MRiefc897g7+JMtrg5+xNbZyIInUGJQsR3sA= =rMXV -----END PGP SIGNATURE----- Merge tag 'samsung-drivers-7.3' of https://git.kernel.org/pub/scm/linux/kernel/git/krzk/linux into soc/drivers Samsung SoC drivers for v7.3 1. Fix very old leak of OF node in PMU driver. 2. Few cleanups and new bindings for ExynosAutov920 HSI0 syscon. * tag 'samsung-drivers-7.3' of https://git.kernel.org/pub/scm/linux/kernel/git/krzk/linux: dt-bindings: samsung: exynos-pmu: Narrow allowed reboot modes dt-bindings: samsung: exynos-pmu: Restrict children with unevaluatedProperties dt-bindings: soc: samsung: exynos-sysreg: Add hsi0 for ExynosAutov920 soc: samsung: exynos-pmu: fix of_node refcount leak in exynos_get_pmu_regmap() Signed-off-by: Arnd Bergmann <arnd@arndb.de> |
||
|
Arnd Bergmann
|
41cbe7ad14 |
Memory controller drivers for v7.3
1. Few improvements: STM32 OMM, Tegra MC and JZ4780-nemc.
2. Refactor Tegra MC interconnect code to better represent actual
hardware in multi-socket NUMA cases.
-----BEGIN PGP SIGNATURE-----
iQJEBAABCgAuFiEE3dJiKD0RGyM7briowTdm5oaLg9cFAmpnrDcQHGtyemtAa2Vy
bmVsLm9yZwAKCRDBN2bmhouD1xaMD/wPkFz7Vj8UDRDbMVjdk0VoYmawxFc83r0P
kwdrp7OxSwH7Js+HANgs8zYFYbIRSVFkkHyAi5aekTaXBzXohwdtiW4t3qHynmtX
wBvAF4xZLxLsII+OZU8wbTJw6ZWJscM6AloW1TZPVOiOJ6m7kKBztMkl7US/hwKR
3hbCMT5zXRz/MCniq1cH3hT3KUQLopcT6vclJrz+kaHfoQN6T6TE23teaciKOYUB
tvjQk1eWZ7gRUdqnvflZHTuSyx+VvVxrukIy8d7IljEGEsWDSoQmxfrNTCwRZwrB
OIqVj6+ZhygJKpb/LdxCNjvZqUCiaCr6vlMMhkQ08HHS+EW3tmqkCJuwkoODr2G0
l+EhL24rBJeIQGstRhNV43q4YstCZB5u0ZO7ixxFxdZ74PYDFFLlbxJZ/wyPLaYf
jala4+STTOyuy13eCf90OUPosgPWFGJyb2ouJlZJuquJv4XBzNF/ukguEMDLS0S8
JDOL9WIHIwNd7d2bDwbTS3zL5qvwhFpa2Z2LfjARnLXiZjClzhIR+HCe+lmLSSvr
4sANn7m1ouwKBtBO+WqLgf7tvEY+v5TVwNCHiIsI6t4yxetCp/HUN+1sHiD4hOs0
40IMvl3wM89ET0fLo1VWoN5lC06n0bdREsgstL2AFHcRAnHBaFcldtR3jW8AsyFh
hXvNH/iFdw==
=s70S
-----END PGP SIGNATURE-----
gpgsig -----BEGIN PGP SIGNATURE-----
iQIzBAABCgAdFiEEo6/YBQwIrVS28WGKmmx57+YAGNkFAmpqFI4ACgkQmmx57+YA
GNmmRw//WkrjLuFY7GzUoqxrYJe4glU14C956miHhS45Nio+NUN2Aa8ArymsPyl4
vukxkI9Ej6oQGZI5m8CLHDPP7W7yUJ+z3JzCly1QuxkGD7wSUd6/ih7WfWWAPDfD
xUbuk3/h0wal6apCpCUaWEczfn68FTr33fVd24S4VdwA18nYnabXDI/0XXgItg7F
956KUPt7FxOm6XmQB6xrCW4ry2hm2gwo+isMxjDGoIQXaQWPhi6A2ahvpm8ECFvI
bQx8vJZKHz6P9erhPLMxtkTcghaVg2i8aUqQR7cOtGYLkL45XlyNoyRH3FaL34Mg
7neHNg4H/tynyWFt9WEARdpsunJySeUuYpZ5+po5DUXuMUlz0vS2FeOsJ05ocnpR
KRSblMjflHtwYJ4NbCSf8c10TF8bp8Os8JN7wGG7fI9cXbM3/Ih+bWRF275VQuIX
Ko6qCvv4UzcndseAb1NFIYnrKHhaNGb1TmP7bQA59BB43DSrjaUTug99+UVd2HXa
bnMrtxIsu8pRB7mmaiCMtqyoeH+dt8vb/7JGyf6x4Xyqgnme0kAQatMGwqKLXM3y
G06IJqTsbO++xlrkZy0hHriRTFQRC2wIKYd6jqoZ8XZg7k8KvVQYjLoLcDyIqhBc
2vuNtFSBOPiLPLPkA4aYJVwQsuTyfuQBH2LNBy4pOkoU0g+IxyE=
=YFm3
-----END PGP SIGNATURE-----
Merge tag 'memory-controller-drv-7.3' of https://git.kernel.org/pub/scm/linux/kernel/git/krzk/linux-mem-ctrl into soc/drivers
Memory controller drivers for v7.3
1. Few improvements: STM32 OMM, Tegra MC and JZ4780-nemc.
2. Refactor Tegra MC interconnect code to better represent actual
hardware in multi-socket NUMA cases.
* tag 'memory-controller-drv-7.3' of https://git.kernel.org/pub/scm/linux/kernel/git/krzk/linux-mem-ctrl:
memory: jz4780-nemc: Use dev_err_probe() for clock error
memory: tegra: Guard against NULL mc_regs in IRQ handler
memory: tegra: add multi-socket support to the memory interconnect
memory: stm32_omm: initialize ret in stm32_omm_set_amcr
Signed-off-by: Arnd Bergmann <arnd@arndb.de>
|
||
|
Miles Krause
|
96aa6902ff |
memory: jz4780-nemc: Use dev_err_probe() for clock error
Use dev_err_probe() to simplify clock acquisition error handling and avoid logging probe deferral as an error. No functional change. Signed-off-by: Miles Krause <mileskrause5200@gmail.com> Link: https://patch.msgid.link/20260711-jz4780-nemc-dev-err-probe-v1-1-afb6f6a82752@gmail.com Signed-off-by: Krzysztof Kozlowski <krzk@kernel.org> |
||
|
Arnd Bergmann
|
6bbf8038f8 |
Renesas driver updates for v7.3
- Drop duplicate default for ARCH_R8A78000. -----BEGIN PGP SIGNATURE----- iHUEABYKAB0WIQQ9qaHoIs/1I4cXmEiKwlD9ZEnxcAUCaliTpAAKCRCKwlD9ZEnx cOQVAQDt9w4P5hxqrlugb+jfTCSU2bpd+SAswpIoOX9Y9nqzuQD+LiSZwVb5a1m0 MqkIKN+t/vzC2dQ7g2pyMshrr2tECA8= =KYf2 -----END PGP SIGNATURE----- gpgsig -----BEGIN PGP SIGNATURE----- iQIzBAABCgAdFiEEo6/YBQwIrVS28WGKmmx57+YAGNkFAmpjjgcACgkQmmx57+YA GNkdCBAAr3vBzp37smha4jInFaxVSwq5Ou218dgXhs/wFs1dFjX26cYPGPJQ2/6P 0iHJWOmrvh5YKWqUe4447UuMKOsDDZBo1GWag3ZJjTDP58dr6ETi/wZmBmwGlM0s 2FSxxJNMOcM2c5xJj3hsne8EAuY5+jsmchTp/2ZzPNULs1ENGItLBE2U6SUPvyPy lEY1oYqk+UweC6G75YAOfYnNZD7nkzdSoMdKIGK2OxCiBbmPvwXK8O4pQ3hJB/Sz o9V3845Zno7LaD6a3f78xPbTSp+pv9zCIEJMB/U9GkiczyscHcdzG1/5T/ennV1P PJIbKqor278+Vsp3hRsn2sS/yE1kPnqdYK/zBxb5maGYb/1MoZ9zwPe7D/RcSiKp B6V8vrK9VeJVgy82jqUkOdN/9xUMCJiThu62c6u4qZ2fFu5i2OsuCGa8hQSk1L8L pdNv84IH4y/B0iLOZVHfLcpvXt64v7fFB/0hDeqBsEH/31qI5r3KE3QhuOEcZ8tK feft7SZLHi5jSiWjWtc9UfyU9znb7OkR2f+iasj3tGGCQA3nMjQWlVD8K904OgpA 2yuS/66Z0Q61JOM12xBxzVzuBbowKqxfwYhBai6i9y3TkrZJ0HRD7itM+4FbZnS1 TJgP2JkRFXhatStDm+ReUh4pppLcp2Yk4d5ZNCPsXefZD0c10lg= =wdGT -----END PGP SIGNATURE----- Merge tag 'renesas-drivers-for-v7.3-tag1' of https://git.kernel.org/pub/scm/linux/kernel/git/geert/renesas-devel into soc/drivers Renesas driver updates for v7.3 - Drop duplicate default for ARCH_R8A78000. * tag 'renesas-drivers-for-v7.3-tag1' of https://git.kernel.org/pub/scm/linux/kernel/git/geert/renesas-devel: soc: renesas: r8a78000: Drop duplicate "default ARCH_RENESAS" Signed-off-by: Arnd Bergmann <arnd@arndb.de> |
||
|
Arnd Bergmann
|
8a88adb58b |
Narrowing of reboot-mode definitions in the bindings for GRF and PMU.
-----BEGIN PGP SIGNATURE----- iQFEBAABCAAuFiEE7v+35S2Q1vLNA3Lx86Z5yZzRHYEFAmpiktoQHGhlaWtvQHNu dGVjaC5kZQAKCRDzpnnJnNEdgeoWB/0anoxkOWGj0FZJTLJJNDRkM2K4ar55gKTk 6cnMJ7lTFfMxH49bQS29tkVRzrjKml9y5XBxfTGF8bRg1qsyzkCY8Z/oJ01zR0pH 3VVRTFXFADPoQ8lO2wZk8lY7ZqepQcVgpFz+hMSyKn8cChEFLuFNB9Uee53JcHC4 aVn6Bx2qfe9aMOuVQsfp3EfBVo88V61nbo+icU1VgslwvXOddRbSoC1K8drGTSxY 2XClNdmtGdx/GVIj31ae/IefAq5yKqpEGer2cOS9Rqhe7crflL01lpqqZ8PTHEPB fieMO+xWZTfc0RxoCZdCHUEfaneHeOArgi6y/WMr6dQRX9dFScCh =PCoY -----END PGP SIGNATURE----- gpgsig -----BEGIN PGP SIGNATURE----- iQIzBAABCgAdFiEEo6/YBQwIrVS28WGKmmx57+YAGNkFAmpjjcYACgkQmmx57+YA GNlzlxAAjiIt/mYIrJSdxomPE8wfiY5XhL6lzFPvxF6vaJCYCdPN6vc82LUmPZPd iKAX890VwhetTvy+H9AXMIKgPS+9LB5MhzhqvNAdn1lIVXywz15pAVnzA77vGTWz OQMfT3ckDhlhGmOaUIWfeHDw9ezn17B0Uwfa/AGhu/XZQOuUcegluXbjRYgDf1Zu YDHYIYB/w+U0/Yuwr67w7UL/aoAb94xyDYtaSIUk9BmpwygNH/9GkafRn+PPAO5U CCbZvs+MAxu9Rfl8RxLAe//rJ7ElViMMY+Yuif7jVet5C0+Z/Y2SC5HGwTrGR4fe xbHyP5qhQ9O4f2Yrp3Ey/22mrkfLNhYZeAUK0f22FfscJFm6q/a+hNXQOSibv7Ua r6+jZYQo9or+fPZ3NSlZbLVmrv8sos1NADGLLBGBhDKrWDjd1kUPtCZO3d/uqbU/ pe/e+Ov2QE4/18deCONX0/DUtwRqmbv27A5yBYV8FJPvS65QNJ7KVavdmVXRPYVQ Ha3ORFJaX5YC1oBva17+e2U82L/ScfJJcP3cN31KLjTgL5XRCnRSNmcWqbZIw4G8 FfADEgHnwnSsz2kRB63vK3mHUjGRb3ytcbxG+J/z1kkcdI0IilJxbQ0PznG99oST Tb5oqwgRGgW7eQ2moM81IrcT5ZoE+e8w8IO47gLAB8KDqGVUi8M= =WeZN -----END PGP SIGNATURE----- Merge tag 'v7.3-rockchip-drivers1' of https://git.kernel.org/pub/scm/linux/kernel/git/mmind/linux-rockchip into soc/drivers Narrowing of reboot-mode definitions in the bindings for GRF and PMU. * tag 'v7.3-rockchip-drivers1' of https://git.kernel.org/pub/scm/linux/kernel/git/mmind/linux-rockchip: dt-bindings: rockchip: grf: Narrow allowed reboot modes dt-bindings: rockchip: pmu: Narrow definition of reboot-mode Signed-off-by: Arnd Bergmann <arnd@arndb.de> |
||
|
Arnd Bergmann
|
7c4856193d |
Arm SCMI updates/fixes for v7.3
A collection of SCMI core and transport fixes addressing resource lifetimes, teardown races and error handling. Most of these issues are reported by Sashiko as existing issues while reviewing new feature additions to SCMI. The changes: - publish channel state before mailbox and SMC callbacks can run, - quiesce notification work before tearing down transport channels, - fix partial channel setup and mailbox allocation cleanup, - make IDR iteration and shared-channel teardown safe, - correct SCMI device, OF node, handle, bus ID and SystemPower lifetimes;, - harden requested-device registration and removal against races and partial failures, - reject out-of-range DT protocol IDs, and - simplify notification allocations using flexible arrays. -----BEGIN PGP SIGNATURE----- iQIzBAABCAAdFiEEunHlEgbzHrJD3ZPhAEG6vDF+4pgFAmpjMg8ACgkQAEG6vDF+ 4pg3Kw/+N09f4Zd1c8xwQi5NEfwv8uEKRE73VSAL18aNn89mGj6J1cGOs1NWHJ0b bKDOuhoJWYynHDGbaZGFVLhh3l2Jj2yE+Hr9sq2nOHktA7HFqSVV5ea8RuRD/XHt 3rNIX6UBLSEp7N40ehkwD506zr3eRcfwtUwS8taEvl0NWNKrPJ+TpMxN3LBGWzBq oXaD7642Mb9rDyApuwOGWlHitDPU1qQv5JrLLWP8/Nx4PQlb1TX6171FXvrMdjdx qKUiUBZM9Q9w4gaKgnIEcq0KCBWdxa5ZKPupZTUzt60NEpkemjYcmjxoJFDIArGC 013Z/dXhynkigaEjfvWPhoNaoLx1Q3NTk5ChljaKLizI6sE0N02wuax8rHIuKSnL fhbyNcpmsEgiVwnX4zw6l44AakWHx8qkE3avtx0yks+joAWt8ERzIHCd+uWF1z15 b18humBSxcs3DmmejH8JMMCTpL7OxI3PHtdntttXWpvM43/pZnO6vF23Nfo0KQ3q ZrOD15W4qQ8M9nGKmpaa6f6tDPoWuULLcMhMHZo3FLdOYa5lnGtAs1Rj7MvJ5I0b u8/t4P2hoCskSVN973P51ZA3r1NI9ZK+uZ3Krq9TFEvgI5ZZQTfDoz6Zc4q9/ERV 80k8/wRP8vCjBM2mQ+WVlWG1gJEq487t6bBPfQVeHmS+/BI0g+s= =w04g -----END PGP SIGNATURE----- gpgsig -----BEGIN PGP SIGNATURE----- iQIzBAABCgAdFiEEo6/YBQwIrVS28WGKmmx57+YAGNkFAmpjjIsACgkQmmx57+YA GNmWgQ//e5oKyKC8Ac6vcjbRbwb6joIX0u0N8slFoKi3rano2Hb0e0TOLSywjCq8 w2G/n5tBjZKfp9RSqSWY0lZHjZhyyokosiSldtr8rX6v0LLQurHIPHakFHI0uW1h 1iquU37P+TJ8C/EcBHcG/3jrvMGPO2PFln7+XVNE2eG2Q79E26NcU9sNoLJeBTlt AZrwpJ9jnUnay+zbc5jtqxqN50cam5I+lNNu+sZmDd67rN+wOUX68yn8vE6Buk+5 li1Ni0W6sKTbMchx+G56ibqnvTcLnouD5wvSNcgJOVycYsykzMB6pSKgqnUGqBTu uHtvRJ1/Nzp+iQqdiGnzGw4x4bB7tackKIQtOww2wUYuE9KY+OCmnieS3hPpg/Od kRBHrxaZ6fyfb++Mw+Ze5gwFEwhQDI0UgGAqu7DsSAuWefcCdPTo4ia9G+HGS1ID 80SNS/GdUmtLdCfsVIqOtvOY2TKwgfsqBWgimyF2apl3nQgbAUkjUlLTUTIFbhXo em2oi6yLQVvte3HGc5r9NbmBnO3KRYIXYRU+t73bOBYeAKNdIPsA357dcrx/5MnN eGli+DrKk/oC1zrvl9OjpAcD83enZ76EPHKRav8zGAnYQ1sLS+GweJsbSg9Yj4Dq XbJGb8LM7mCFefrDvZKOVSWy5DMazHiofguPBOSgEnqASdp+Ydo= =JO1v -----END PGP SIGNATURE----- Merge tag 'scmi-updates-7.3' of https://git.kernel.org/pub/scm/linux/kernel/git/sudeep.holla/linux into soc/drivers Arm SCMI updates/fixes for v7.3 A collection of SCMI core and transport fixes addressing resource lifetimes, teardown races and error handling. Most of these issues are reported by Sashiko as existing issues while reviewing new feature additions to SCMI. The changes: - publish channel state before mailbox and SMC callbacks can run, - quiesce notification work before tearing down transport channels, - fix partial channel setup and mailbox allocation cleanup, - make IDR iteration and shared-channel teardown safe, - correct SCMI device, OF node, handle, bus ID and SystemPower lifetimes;, - harden requested-device registration and removal against races and partial failures, - reject out-of-range DT protocol IDs, and - simplify notification allocations using flexible arrays. * tag 'scmi-updates-7.3' of https://git.kernel.org/pub/scm/linux/kernel/git/sudeep.holla/linux: (25 commits) firmware: arm_scmi: Unrequest devices if driver registration fails firmware: arm_scmi: Roll back partial protocol table registration firmware: arm_scmi: Fix requested device removal race firmware: arm_scmi: Fix transport device teardown lookup firmware: arm_scmi: Fix SCMI device destroy lifetimes firmware: arm_scmi: Unwind P2A receiver mailbox setup failure firmware: arm_scmi: Unwind TX receiver mailbox setup failure firmware: arm_scmi: Fix OF node reference handling firmware: arm_scmi: Clear SystemPower flag on create failure firmware: arm_scmi: Drop handle on protocol bind failures firmware: arm_scmi: Protect device request lookup with RCU firmware: arm_scmi: Use channel ID for transport teardown firmware: arm_scmi: Reject out of range DT protocol IDs firmware: arm_scmi: Avoid IDR updates while cleaning channels firmware: arm_scmi: Free transport channel on IDR failure firmware: arm_scmi: Clean up channels on setup failure firmware: arm_scmi: Quiesce notifications before teardown firmware: arm_scmi: Unregister device notifier before IDR teardown firmware: arm_scmi: Publish channel state before callbacks firmware: arm_scmi: Simplify notification allocations ... Signed-off-by: Arnd Bergmann <arnd@arndb.de> |
||
|
Arnd Bergmann
|
4d51357318 |
IXP4xx SoC changes for v7.3:
- Add some MODULE_DEVICE_TABLE():s to the ixp4xx SoC drivers. - Drop redundant dev_err() calls in the ixp4xx SoC drivers. -----BEGIN PGP SIGNATURE----- iQIzBAABCgAdFiEElDRnuGcz/wPCXQWMQRCzN7AZXXMFAmpjHakACgkQQRCzN7AZ XXPOKw/9H+JO8mYoHNEu+3bbCzcmgbxeV4YbWbvwU7yaAVLC1jPfCoJhSGSHvXDr /eh1bLfnsYQsYFKY+t14OMdrBqlRrUGyvunYKBsTMzopYJ80rzRzzyTrQb7FiOkc J1oYIWH3uyjkky//dxTIN8sBWpifQnyFMudQo2agxnmx1Nn88+jIgMkxGGDRMwRl nXf4lbkagfQGAZ+nYIXKpfwnwU1TmkbzFxls+SsagQfS7A9YCcOorA712bCgjKhe VjjxHFEfhaqbYa9ZOKEt4y0zY2L0aTBjuhLhVG0RE3LG0v03XIvcBb/biEq6qn9v EohYPID2bVC38PMXn9JNc+gALnYCb5ftPV+xVTj1tPLJTgUKZPxjmSifY06JkLMQ IYU7LATUDPKF3hFTsmrNYhG+DFQZ+jERnAo2U0mv/v7x4lU8GB0kIAXB2J0LiImV FJGXxSORC0h2b19RZ+xvq6n9FJqqO0meVmhlbucVy5KlGK3c0zfNEnwrbgjjO7hz 0Yqp/sZ56pv4wt2Oy45ZbRSRBgPCjhkLjuKzIkCZe1Zk/Xjm3T7Bp8ujMd9ougeT 7aOk2Iqulo2a0lS67duHYu5ypw/G0nE77mZRMmXkoEHYcMtB2ZWsOOspnQ+L0X51 z4FlOvxEe6dAMd5OoUcaNtGP5iMmJOyFOesuQ4g/XUouzOFPSWI= =ClVv -----END PGP SIGNATURE----- gpgsig -----BEGIN PGP SIGNATURE----- iQIzBAABCgAdFiEEo6/YBQwIrVS28WGKmmx57+YAGNkFAmpjjA8ACgkQmmx57+YA GNl7YA//fzGyd9UzKsSHKfm5tBYl3bzUmevt3qvViSwH0ofCMtFtIF5Um8SGERno OODzLhtNG46Y2qjBTeBeYQsV2JmYdUSTmQN9fjRPpH3A/aFyi1/Ye6K2vy1bixUA ScVZwD27M6a2dqbJWSsW55RX53A7ovgMglcfMLATbNpHJS0J0qcMbaTGVfk+Uv9M 2QHhA5ACnSu1JM2aphBkn7t9GtX62OtmerhEBooDZ3asukwZS9/jlZBmO6BCYT38 ovrcdArw7O6XOJIJnGzdildK+xVIkl/SoPj+WWAOhtvOxyjU6wNs0iQHJCetUPLQ zAikqFMZ8TmzzQi9ZfIh+o58WYivYsJGUxrS19PdFv9I9FsKrXPLs/AwuoB6dJzy 6qiF1Krwa4O+MRmRu3NS5w9XrDJD33IUwPD9XtAc396hxoH1mo+smjgMcvQM9HOt jTrGr9d0tkASpNlIggf53xpkJQAs2AfJOFBzb7A74cmBqA/zyMdEQX0L1Me/DRA4 McinL7UiPZgNV24LtEzTZVlv4YjrBVGH6HavGJBNkUuqT16BeymNMP5+c4iALcOX GVEkg7CCi+8JiF8kClCO95jE2IE88+36MToVlVeRXRbkuu+inbBDch5gzWtEw0Kc pyDj6hl6IQ1tjaDpZ2mbOGMP2buK9J0PbLlI/qgbtClDUdr4B24= =HzzV -----END PGP SIGNATURE----- Merge tag 'ixp4xx-soc-v7.3' of https://git.kernel.org/pub/scm/linux/kernel/git/linusw/linux-integrator into soc/drivers IXP4xx SoC changes for v7.3: - Add some MODULE_DEVICE_TABLE():s to the ixp4xx SoC drivers. - Drop redundant dev_err() calls in the ixp4xx SoC drivers. * tag 'ixp4xx-soc-v7.3' of https://git.kernel.org/pub/scm/linux/kernel/git/linusw/linux-integrator: soc: ixp4xx: Remove redundant dev_err() soc: ixp4xx: npe: add missing MODULE_DEVICE_TABLE() soc: ixp4xx: qmgr: add missing MODULE_DEVICE_TABLE() Signed-off-by: Arnd Bergmann <arnd@arndb.de> |
||
|
Pan Chuang
|
48e54749c1 |
soc: ixp4xx: Remove redundant dev_err()
Since commit
|
||
|
Pengpeng Hou
|
f0b93c158a |
soc: ixp4xx: npe: add missing MODULE_DEVICE_TABLE()
The driver has an OF match table wired to .of_match_table, but does not export the table with MODULE_DEVICE_TABLE(). Add the missing MODULE_DEVICE_TABLE(of, ...) entry so module alias information is generated for OF based module autoloading. This is a source-level fix. It does not claim dynamic hardware reproduction; the evidence is the driver-owned match table, its use by the platform driver, and the missing module alias publication. Signed-off-by: Pengpeng Hou <pengpeng@iscas.ac.cn> Message-ID: <20260704122324.80274-1-pengpeng@iscas.ac.cn> Signed-off-by: Linus Walleij <linusw@kernel.org> |
||
|
Pengpeng Hou
|
01479280fa |
soc: ixp4xx: qmgr: add missing MODULE_DEVICE_TABLE()
The driver has an OF match table wired to .of_match_table, but does not export the table with MODULE_DEVICE_TABLE(). Add the missing MODULE_DEVICE_TABLE(of, ...) entry so module alias information is generated for OF based module autoloading. This is a source-level fix. It does not claim dynamic hardware reproduction; the evidence is the driver-owned match table, its use by the platform driver, and the missing module alias publication. Signed-off-by: Pengpeng Hou <pengpeng@iscas.ac.cn> Message-ID: <20260704121851.63805-1-pengpeng@iscas.ac.cn> Signed-off-by: Linus Walleij <linusw@kernel.org> |
||
|
Sudeep Holla
|
9f7cd6a62a |
firmware: arm_scmi: Unrequest devices if driver registration fails
scmi_driver_register() requests protocol devices before registering the
driver. If driver_register() fails, those requests remain in the global
IDR and retain pointers to the module's ID table. Once the failed module
load releases that storage, later request matching or SCMI device creation
can dereference the stale pointers.
Unrequest the complete protocol table before returning the registration
failure. At this point table registration succeeded, so every entry is
owned by the current registration attempt.
Fixes:
|
||
|
Sudeep Holla
|
2224b62226 |
firmware: arm_scmi: Roll back partial protocol table registration
scmi_protocol_table_register() can leave earlier requests registered when
a later entry in the same ID table fails. Each request retains a pointer
to the driver's ID table, so a failed module load can leave a dangling
pointer after the module storage is released.
Unrequest only the successfully registered prefix, in reverse order,
before returning the failure. Leave the failed entry and the remaining
entries untouched because matching requests can be owned by another
driver.
Fixes:
|
||
|
Sudeep Holla
|
2c4097e6c4 |
firmware: arm_scmi: Fix requested device removal race
scmi_protocol_device_unrequest() drops scmi_requested_devices_mtx while
notifying listeners but continues to retain the per-protocol list head.
When two SCMI drivers for the same protocol unregister concurrently, one
thread can remove the final request and free the list head while the other
is running its notifier. The latter then dereferences the freed list head
after reacquiring the mutex and can free it a second time.
Complete the list and IDR updates, including freeing an empty list head,
before dropping the mutex. Keep the blocking notifier outside the critical
section and retain only the detached request across the callback.
Fixes:
|
||
|
Geert Uytterhoeven
|
07231087d5 |
soc: renesas: r8a78000: Drop duplicate "default ARCH_RENESAS"
The Kconfig entry for ARCH_R8A78000 contains both "default y if
ARCH_RENESAS" and "default ARCH_RENESAS", which are sort-of duplicates.
Drop the latter, to restore consistency with the other ARM64 entries.
Fixes:
|
||
|
Sudeep Holla
|
a14dd8fe0a |
firmware: arm_scmi: Fix transport device teardown lookup
SCMI transport devices are deliberately excluded from normal SCMI bus
matching so protocol drivers cannot bind to the internal transport
children. However, scmi_device_destroy() uses the same protocol/name
lookup to find devices that must be unregistered during channel teardown.
Split the match helper so driver matching still skips transport devices,
while explicit child lookup can find them for teardown. Use a shared
transport-device name prefix macro for both matching and name generation.
Since transport-device names are derived from direction and protocol ID,
reject duplicate protocol channel setup before creating or finding a
transport device. This prevents malformed firmware with duplicate
protocol child nodes from reusing an existing transport device and then
destroying it when the duplicate IDR insertion fails.
Fixes:
|
||
|
Sudeep Holla
|
6abe8fe36b |
firmware: arm_scmi: Fix SCMI device destroy lifetimes
scmi_child_dev_find() drops the reference returned by
device_find_child() before returning the scmi_device pointer. A
concurrent unregister can then release the device while the destroy path
is still using the returned pointer.
Make the lookup helper return the device_find_child() reference and keep
it until scmi_device_destroy() has finished unregistering the child.
Also split device_unregister() in __scmi_device_destroy() so the SCMI bus
ID is not made reusable until after device_del() has removed the old
scmi_dev.N name from sysfs. This avoids a new SCMI device reusing the
same ID while the old device is still registered.
The final device release callback is also a possible cleanup path when
SCMI children are deleted by driver core recursion rather than
__scmi_device_destroy(). Release the SCMI bus ID from a common helper
used by destroy, register-failure and final-release paths, and clear
scmi_dev->id after freeing it so the final release cannot free the same
ID again.
Fixes:
|
||
|
Sudeep Holla
|
f3e3773c4e |
firmware: arm_scmi: Unwind P2A receiver mailbox setup failure
mailbox_chan_setup() can request an additional P2A receiver channel after
successfully acquiring the primary P2A channel. If that later request
fails, the function returns immediately and leaves the primary channel
allocated.
Unwind the primary mailbox channel before returning the error so probe
deferral or other setup failures do not leave the channel busy for later
probe attempts.
Fixes:
|
||
|
Sudeep Holla
|
6f7c06744d |
firmware: arm_scmi: Unwind TX receiver mailbox setup failure
mailbox_chan_setup() can request an additional unidirectional TX
receiver channel after successfully acquiring the primary channel. If
that second request fails, the function returns immediately and leaves
the primary channel allocated.
Unwind the primary mailbox channel before returning the error so probe
deferral or other setup failures do not leave the channel busy for later
probe attempts.
Fixes:
|
||
|
Sudeep Holla
|
659705f5eb |
firmware: arm_scmi: Fix OF node reference handling
SCMI devices store the DT node in dev.of_node through
device_set_node(), but that helper only assigns the fwnode and
of_node pointers without taking an OF node reference.
Take a reference when assigning the node and release it from the
SCMI device release path. With the device owning that reference,
remove the separate channel-side get/put pair from the core driver.
Fixes:
|
||
|
Sudeep Holla
|
e4c16ae24c |
firmware: arm_scmi: Clear SystemPower flag on create failure
__scmi_device_create() reserves the singleton SystemPower protocol device
before registering the SCMI device. If any later step fails, a stale
reservation can make a later retry reject SystemPower device creation
permanently, for example after probe deferral.
A plain global boolean is not enough to track the reservation. A delayed
final release of an older SystemPower device could clear the boolean after
a newer device has already claimed it, breaking the singleton guarantee for
the active device.
Track the reservation with the scmi_device pointer itself. Claim it with
cmpxchg(NULL, scmi_dev) after allocating the device object, and release it
with cmpxchg(scmi_dev, NULL) from the common cleanup helper. This lets the
create-failure, explicit destroy and final release paths clear only the
reservation owned by the device being cleaned up.
Fixes:
|
||
|
Sudeep Holla
|
e3a5c30d23 |
firmware: arm_scmi: Drop handle on protocol bind failures
The SCMI bus notifier acquires an SCMI handle when the driver core emits
BUS_NOTIFY_BIND_DRIVER, before invoking the protocol driver probe
callback. The protocol probe path only checks whether sdev->handle is
set.
If device_link_add() fails after the handle has been acquired, the
protocol device can still bind with a valid handle but without the
dependency link to the SCMI parent. A concurrent parent unbind can then
miss the child and tear down the SCMI instance while the child still
holds a handle into it.
If the protocol driver probe later fails, for example with
-EPROBE_DEFER, the driver core emits BUS_NOTIFY_DRIVER_NOT_BOUND rather
than BUS_NOTIFY_UNBOUND_DRIVER. The SCMI notifier only released the
handle on BUS_NOTIFY_UNBOUND_DRIVER, so each failed protocol-device bind
leaked the SCMI instance users refcount and left sdev->handle set after
the failed probe.
Make the link helper report failure and drop the acquired handle if the
link cannot be created. Also handle BUS_NOTIFY_DRIVER_NOT_BOUND in the
same cleanup path used for unbind so failed probes balance the earlier
BUS_NOTIFY_BIND_DRIVER acquisition.
Fixes:
|
||
|
Sudeep Holla
|
e6a0e7a49d |
firmware: arm_scmi: Protect device request lookup with RCU
The SCMI device request notifier looks up protocol OF nodes from the
active_protocols IDR. The IDR lookup can run concurrently with protocol
activation while probe is still registering protocols and creating their
SCMI devices.
Wrap the lookup in an RCU read-side critical section as required by the
IDR API for lockless readers.
Fixes:
|
||
|
Sudeep Holla
|
a71a3d4d8a |
firmware: arm_scmi: Use channel ID for transport teardown
SCMI protocols can share the BASE transport channel when firmware does
not describe a dedicated channel for the protocol. In that case multiple
IDR entries can point at the same scmi_chan_info, whose owning transport
device was created with cinfo->id.
scmi_chan_destroy() used the IDR iterator key when destroying the
transport device. If an alias entry is visited before the owning channel
entry, the lookup can miss the device because the iterator key does not
match the protocol ID used when the transport device was created. The
code then clears cinfo->dev, so the later owning entry skips teardown and
leaks the transport device.
Destroy the transport device using cinfo->id, which is the protocol ID
that owns the channel and was used when creating the transport device.
Fixes:
|
||
|
Sudeep Holla
|
59407ccb52 |
firmware: arm_scmi: Reject out of range DT protocol IDs
SCMI protocol IDs carried in message headers are limited by
MSG_PROTOCOL_ID_MASK. The DT parsing paths noticed protocol IDs
outside that range, but only logged an error and then kept processing
the invalid value.
That lets a malformed 32-bit DT reg value reach helpers which take a u8
protocol ID, where it can be truncated and/or treated as a different
protocol.
For channel setup, two different out-of-range values can also be used as
distinct IDR keys while aliasing the generated SCMI protocol identity.
Skip DT protocol nodes whose reg value does not fit the SCMI protocol ID
field before setting up channels or creating protocol devices.
Fixes:
|
||
|
Sudeep Holla
|
c38b1e1948 |
firmware: arm_scmi: Avoid IDR updates while cleaning channels
scmi_cleanup_channels() walks the TX/RX channel IDRs with
idr_for_each() to free transport resources and destroy the dedicated
transport devices before calling idr_destroy().
The destroy callback removed each entry from the same IDR being walked.
That is not needed for this cleanup path, and it is unsafe because
idr_for_each() has not advanced its radix-tree iterator while the
callback is running. Removing the current entry from the callback can
invalidate the iterator state. The callback also cannot be protected by
rcu_read_lock(), because scmi_device_destroy() may sleep.
Leave IDR teardown to the following idr_destroy() call and keep the
callback limited to device destruction.
Fixes:
|
||
|
Sudeep Holla
|
d72e7e5f24 |
firmware: arm_scmi: Free transport channel on IDR failure
If transport channel setup succeeds but the following IDR insertion fails,
the error path destroys the transport device and frees the channel info
without invoking the transport cleanup callback.
Call chan_free() before destroying the device so transport specific
resources such as IRQs, mailbox channels and mapped shared memory are
released consistently with the normal teardown path.
Fixes:
|
||
|
Sudeep Holla
|
687d67be3d |
firmware: arm_scmi: Clean up channels on setup failure
scmi_channels_setup() can fail after the common BASE channel or earlier
protocol channels have already been registered in the TX/RX IDRs.
Route this failure through the existing channel cleanup label so the
transport channels, transport devices and IDR state created before the
failure are released before the probe error path frees the SCMI instance
ID.
Fixes:
|
||
|
Sudeep Holla
|
8e49055d0d |
firmware: arm_scmi: Quiesce notifications before teardown
scmi_notification_exit() clears and releases the notification instance,
but transport callbacks can still deliver incoming notifications until
the TX/RX channels are freed. During remove, an RX interrupt in that
window can enter scmi_notify() while notification state is being torn
down and then dereference freed memory. The same ordering exists on the
probe error path after notification initialization.
The notification late-init worker has a separate lifetime issue: protocol
event registration queues ni->init_work on the system workqueue, so
destroying ni->notify_wq does not drain that work. If the devres group is
released while init_work is still pending or running, the late-init worker
can dereference the freed notification instance.
Quiesce the notification core before TX/RX channels are torn down, then
clean up the channels before releasing the notification core resources.
Use disable_work_sync() so future late-init queueing is rejected and any
already queued or running late-init work has completed before channel
teardown starts.
Fixes:
|
||
|
Sudeep Holla
|
66a0bbf30c |
firmware: arm_scmi: Unregister device notifier before IDR teardown
The requested-devices notifier looks up protocol fwnodes from the
active_protocols IDR. During remove, unregister the notifier before
releasing and destroying active_protocols so no notifier callback can race
with the IDR teardown.
Keep the bus notifier registered until after the protocol state is torn
down, matching the existing remove ordering for SCMI bus users.
Fixes:
|
||
|
Sudeep Holla
|
0314900dcd |
firmware: arm_scmi: Publish channel state before callbacks
Transport setup can enable callbacks before the setup routine returns.
mailbox_chan_setup() registers the mailbox client with
mbox_request_channel(), and the mailbox controller startup path can enable
interrupt delivery before SCMI mailbox channel state has been published.
Similarly, smc_chan_setup() requests the optional A2P completion IRQ before
the SMC transport has made its cinfo pointer visible.
If a pending or spurious callback fires in those windows, the transport RX
callback can dereference a NULL transport cinfo pointer. Publishing only
the transport-private pointer is not sufficient either: an early callback
can enter the SCMI core before scmi_chan_setup() has assigned
cinfo->handle.
The core derives scmi_info from cinfo->handle in the RX path, so a NULL
handle can still fault even when the transport-private cinfo is valid.
Assign cinfo->handle before invoking the transport setup callback. Publish
the mailbox and SMC transport-private channel state before requesting the
mailbox channels or IRQ, and clear the early-published pointers again on
setup failure. Also unwind mailbox setup devres resources on failure so an
optional RX setup error that is ignored by the core does not leave stale
transport state behind.
Fixes:
|
||
|
Rosen Penev
|
9c62bb72a5 |
firmware: arm_scmi: Simplify notification allocations
Several SCMI notification data structures allocate a descriptor and then allocate a fixed-size array referenced by that descriptor. Use flexible array members for per-protocol registered events and per-event source refcounts so each descriptor and its array can be allocated together. Annotate the flexible arrays with __counted_by() and assign the count fields immediately after allocation, before any array access. The registered_protocols table has a fixed SCMI_MAX_PROTO size, so embed it directly in the notification instance instead of allocating it separately. Signed-off-by: Rosen Penev <rosenp@gmail.com> Link: https://patch.msgid.link/20260630204719.334211-1-rosenp@gmail.com (sudeep.holla: Updated title and improved change description) Signed-off-by: Sudeep Holla <sudeep.holla@kernel.org> |
||
|
Sudeep Holla
|
980a8bfe7b |
Merge branches 'for-next/scmi/fixes' and 'for-next/ffa/fixes'
* for-next/scmi/fixes: firmware: arm_scmi: Rate-limit queue-full warnings in IRQ context firmware: arm_scmi: Use 64-bit division for clock rate rounding firmware: arm_scmi: Grammar s/may needed/may be needed/ * for-next/ffa/fixes: firmware: arm_ffa: Fix NULL dereference in ffa_partition_info_get() firmware: arm_ffa: Respect firmware advertised RX/TX buffer size limits Signed-off-by: Sudeep Holla <sudeep.holla@kernel.org> |
||
|
Linus Torvalds
|
a13c140cc2 | Linux 7.2-rc3 | ||
|
Jaewon Yang
|
f20d61c22b |
tpm: Make the TPM character devices non-seekable
The TPM character devices expose a sequential command/response
interface, but their open handlers leave FMODE_PREAD and FMODE_PWRITE
enabled.
After a command leaves a response pending, pread(fd, buf, 16, 0x1400)
passes 0x1400 as *off to tpm_common_read(). The transfer length is
bounded by response_length, but the offset is used unchecked when
forming data_buffer + *off. A sufficiently large offset therefore causes
an out-of-bounds heap read through copy_to_user() and, if the copy
succeeds, an out-of-bounds zero-write through the following memset().
Positional I/O does not provide coherent semantics for this interface.
An arbitrary pread offset cannot represent how much of a response has
been consumed sequentially. The write callback always stores a command
at the start of data_buffer, while pwrite() does not update file->f_pos
and can leave the sequential read cursor stale.
Call nonseekable_open() from both open handlers. This removes
FMODE_PREAD and FMODE_PWRITE, causing positional reads and writes to
fail with -ESPIPE before reaching the TPM callbacks, and explicitly
marks the files non-seekable. Normal read() and write() continue to use
the existing sequential f_pos cursor, leaving the response state machine
unchanged.
Tested on Linux 6.12 with KASAN and a swtpm TPM2 device:
- sequential partial reads returned the complete response
- pread() and preadv() with offset 0x1400 returned -ESPIPE
- pwrite() and pwritev() with offset zero returned -ESPIPE
- the pending response remained intact after the rejected operations
- a subsequent normal command/response cycle completed normally
- no KASAN report was produced.
Fixes:
|
||
|
Linus Torvalds
|
940d91caf0 |
Staging driver fixes for 7.2-rc3
Here are some staging driver fixes for 7.2-rc3 for some reported bugs in the vme_user and rtl8723bs drivers. These include: - many rtl8723bs OOB fixes for when connecting to "bad" wifi hosts - vme_user bugfixes to correctly validate some user-provided data All of these have been in linux-next for a while with no reported issues. Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> -----BEGIN PGP SIGNATURE----- iG0EABECAC0WIQT0tgzFv3jCIUoxPcsxR9QN2y37KQUCalNT5Q8cZ3JlZ0Brcm9h aC5jb20ACgkQMUfUDdst+ynpAACgja2SsuFbsIOiofjEjyXZnjE55IcAoNkmr/yp XkMNN2/oQHc1faGW47cm =jtsV -----END PGP SIGNATURE----- Merge tag 'staging-7.2-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/staging Pull staging driver fixes from Greg KH: "Here are some staging driver fixes for 7.2-rc3 for some reported bugs in the vme_user and rtl8723bs drivers. These include: - many rtl8723bs OOB fixes for when connecting to "bad" wifi hosts - vme_user bugfixes to correctly validate some user-provided data All of these have been in linux-next for a while with no reported issues" * tag 'staging-7.2-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/staging: staging: rtl8723bs: fix OOB reads in rtw_get_sec_ie(), rtw_get_wapi_ie(), and rtw_get_wps_attr() staging: rtl8723bs: fix OOB reads in is_ap_in_tkip() IE loop staging: rtl8723bs: fix OOB read in OnAssocRsp() IE loop staging: rtl8723bs: fix OOB write in HT_caps_handler() staging: rtl8723bs: fix heap buffer overflow in rtw_cfg80211_set_wpa_ie() staging: rtl8723bs: fix OOB reads in IE loops in issue_assocreq() and join_cmd_hdl() staging: rtl8723bs: fix OOB read in update_beacon_info() IE loop staging: rtl8723bs: fix WEP length underflow and OOB read in OnAuth() staging: vme_user: fix location monitor leak in tsi148 bridge staging: vme_user: fix location monitor leak in fake bridge staging: vme_user: bound slave read/write to the kern_buf size staging: rtl8723bs: don't drop short TX frames in _rtw_pktfile_read() |
||
|
Linus Torvalds
|
bffa972b3f |
Android/IIO bugfixes for 7.2-rc3
Here is a set of bugfixes for 7.2-rc3 that resolve a bunch of reported
issues in just the binder and iio codebases. Included in here are:
- binder driver bugfixes for both the rust and c versions for reported
problems
- lots and lots of iio driver bugfixes for lots of reported issues
(including a hid sensor driver bugfix)
Full details are in the shortlog, all of these have been in linux-next
with no reported issues.
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
-----BEGIN PGP SIGNATURE-----
iG0EABECAC0WIQT0tgzFv3jCIUoxPcsxR9QN2y37KQUCalNPWw8cZ3JlZ0Brcm9h
aC5jb20ACgkQMUfUDdst+yltzACdFC2/ouvc1ea1jGFBP1ZN4lKU6gAAn1ak5lRK
30pEMSmJwYteOj8AlpuE
=ZIWT
-----END PGP SIGNATURE-----
Merge tag 'char-misc-7.2-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc
Pull Android/IIO fixes from Greg KH:
"Here is a set of bugfixes for 7.2-rc3 that resolve a bunch of reported
issues in just the binder and iio codebases. Included in here are:
- binder driver bugfixes for both the rust and c versions for
reported problems
- lots and lots of iio driver bugfixes for lots of reported issues
(including a hid sensor driver bugfix)
Full details are in the shortlog, all of these have been in linux-next
with no reported issues"
* tag 'char-misc-7.2-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc: (36 commits)
iio: event: Fix event FIFO reset race
iio: imu: inv_icm42600: fix timestamp clock period by using lower value
iio: light: al3010: fix incorrect scale for the highest gain range
iio: adc: nxp-sar-adc: Fix the delay calculation in nxp_sar_adc_wait_for()
iio: light: tsl2591: return actual error from probe IRQ failure
iio: imu: inv_icm42600: fix timestamping by limiting FIFO reading
iio: imu: st_lsm6dsx: deselect shub page before reading whoami
rust_binder: clear freeze listener on node removal
rust_binder: reject context manager self-transaction
rust_binder: use a u64 stride when cleaning up the offsets array
binder: fix UAF in binder_free_transaction()
binder: fix UAF in binder_thread_release()
rust_binder: synchronize Rust Binder stats with freeze commands
binder: cache secctx size before release zeroes it
rust_binder: fix BINDER_GET_EXTENDED_ERROR
iio: adc: ad7779: add missing 'select IIO_TRIGGERED_BUFFER' to Kconfig
iio: adc: ad4130: add missing `select IIO_TRIGGERED_BUFFER` to Kconfig
iio: adc: ti-ads124s08: Return reset GPIO lookup errors
iio: temperature: Build mlx90635 with CONFIG_MLX90635
iio: light: al3320a: add missing REGMAP_I2C to Kconfig
...
|
||
|
Linus Torvalds
|
8a65af0e39 |
TTY/Serial fixes for 7.2-rc3
Here are some small tty/serial/vt fixes for 7.2-rc3 that resolve some
reported problems. Included in here are:
- vt spurious modifier issue that showed up in -rc1 (reported a bunch)
- 8250 driver bugfixes
- msm serial driver bugfix
- max310x serial driver bugfix
All of these have been in linux-next with no reported issues
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
-----BEGIN PGP SIGNATURE-----
iG0EABECAC0WIQT0tgzFv3jCIUoxPcsxR9QN2y37KQUCalNRQg8cZ3JlZ0Brcm9h
aC5jb20ACgkQMUfUDdst+ymuIQCdGVJwWd6MdGl+vzAO5GhJA7ndewEAoIbyOkQ2
zriM/Mn6vzKP81QKvGRY
=Gmi1
-----END PGP SIGNATURE-----
Merge tag 'tty-7.2-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/tty
Pull tty/serial fixes from Greg KH:
"Here are some small tty/serial/vt fixes for 7.2-rc3 that resolve some
reported problems. Included in here are:
- vt spurious modifier issue that showed up in -rc1 (reported a
bunch)
- 8250 driver bugfixes
- msm serial driver bugfix
- max310x serial driver bugfix
All of these have been in linux-next with no reported issues"
* tag 'tty-7.2-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/tty:
serial: 8250: Ignore flow control on suspend/resume with no_console_suspend
serial: 8250_mid: Disable DMA for selected platforms
serial: 8250_omap: clear rx_running on zero-length DMA completes
vt: fix spurious modifier in CSI/cursor key sequences
serial: msm: Disable DMA for kernel console UART
serial: max310x: implement gpio_chip::get_direction()
|
||
|
Linus Torvalds
|
534f8f051e |
USB fixes for 7.2-rc3
Here are a number of small USB driver fixes for many reported issues. Included in here are: - usb serial driver corruption and use-after-free fixes - usb gadget rndis bugfixes for malicious/buggy host connections - typec driver fixes for a load of different tiny reported issues - typec mux driver revert for a broken patch in -rc1 - usb gadget driver fixes for many different reported problems - new usb device quirks added - usbip tool fixes and some core usbip fixes as well - dwc3 driver fixes for minor issues - xhci driver fixes for reported problems - lots of other tiny usb driver fixes for many tiny issues All of these have been in linux-next with no reported issues. Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> -----BEGIN PGP SIGNATURE----- iG0EABECAC0WIQT0tgzFv3jCIUoxPcsxR9QN2y37KQUCalNSkw8cZ3JlZ0Brcm9h aC5jb20ACgkQMUfUDdst+ynUlACgtUhZOR/MsYMcNbKJe9vk0iG35+AAnjrhznd4 OJqmb+1vVQ7xDm2fq+gz =Ky4T -----END PGP SIGNATURE----- Merge tag 'usb-7.2-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb Pull USB fixes from Greg KH: "Here are a number of small USB driver fixes for many reported issues. Included in here are: - usb serial driver corruption and use-after-free fixes - usb gadget rndis bugfixes for malicious/buggy host connections - typec driver fixes for a load of different tiny reported issues - typec mux driver revert for a broken patch in -rc1 - usb gadget driver fixes for many different reported problems - new usb device quirks added - usbip tool fixes and some core usbip fixes as well - dwc3 driver fixes for minor issues - xhci driver fixes for reported problems - lots of other tiny usb driver fixes for many tiny issues All of these have been in linux-next with no reported issues" * tag 'usb-7.2-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb: (56 commits) USB: core: ratelimit cabling message usb: misc: usbio: fix disconnect UAF in client teardown Revert "usb: typec: mux: avoid duplicated mux switches" USB: chaoskey: Fix slab-use-after-free in chaoskey_release() usb: ucsi: huawei_gaokun: move typec_altmode off stack usb: typec: tcpci_rt1711h: unregister TCPCI port with devres usb: typec: tcpm: Fix VDM type for Enter Mode commands usb: typec: ucsi: cancel pending work on system suspend usb: typec: class: drop PD lookup reference usb: typec: ps883x: Fix DP+USB3 configuration usb: xhci: Fix sleep in atomic context in xhci_free_streams() xhci: sideband: fix ring sg table pages leak usb: gadget: udc: Fix use-after-free in gadget_match_driver usb: dwc3: run gadget disconnect from sleepable suspend context usb: sl811-hcd: disable controller wakeup on remove usb: typec: anx7411: use devm_pm_runtime_enable() usb: dwc3: fix dwc3_readl() and dwc3_writel() calls in dwc3_ulpi_setup() USB: misc: uss720: unregister parport on probe failure usb: gadget: function: rndis: add length check for header usb: gadget: function: rndis: add length check to response query ... |
||
|
Linus Torvalds
|
f4fb100039 |
s390 updates for 7.2-rc3
- Fix missing array_index_nospec() call in diag310 memory topology code to prevent speculative execution with a user controlled array index - Fix get_align_mask() return type to match vm_unmapped_area_info align_mask, avoiding possible truncation for future larger masks - Remove empty zcrypt CEX2 files left over after CEX2 and CEX3 driver removal - Add build salt to the vDSO so it gets a unique build id, similar to the kernel and modules -----BEGIN PGP SIGNATURE----- iQEzBAABCgAdFiEE3QHqV+H2a8xAv27vjYWKoQLXFBgFAmpT1poACgkQjYWKoQLX FBgEkAf/f/qKKj7ojuIsHoPpgTun3csqbGJqOnLShYaX3itzN8wbT5m0JGbKAKfv BMpu5LSC5auGF6fvRhfJM/RbSX2LgEOMBtjx9kSAFFbNtkzu5urzZ1QFQyJ+DZq+ 0Ny8E1ozB5dlizqqIIzijyAXbMt5vDrlaPKUh+LJMlkA0OY9NUt+KLah3soEexli Oh18KMzrmik/SOr0qCuxrUa0Z0B5i2q8mp9AaS9/YaOHeuBspm4G47XKMHg4UMg8 yMb7ofaX4isgRYXrDsNUkLGe/KPkwntWnU7EVVJH/u4ZkjUlwEyIH0lhp6BnVlte LSQ4742J4lxHa2Y+sQDxzFgaFr6reA== =FOvG -----END PGP SIGNATURE----- Merge tag 's390-7.2-4' of git://git.kernel.org/pub/scm/linux/kernel/git/s390/linux Pull s390 fixes from Vasily Gorbik: - Fix missing array_index_nospec() call in diag310 memory topology code to prevent speculative execution with a user controlled array index - Fix get_align_mask() return type to match vm_unmapped_area_info align_mask, avoiding possible truncation for future larger masks - Remove empty zcrypt CEX2 files left over after CEX2 and CEX3 driver removal - Add build salt to the vDSO so it gets a unique build id, similar to the kernel and modules * tag 's390-7.2-4' of git://git.kernel.org/pub/scm/linux/kernel/git/s390/linux: s390: Add build salt to the vDSO s390/zcrypt: Remove the empty file s390/mm: Fix type mismatch in get_align_mask(). s390/diag: Add missing array_index_nospec() call to memtop_get_page_count() |
||
|
Linus Torvalds
|
2f9eb0c54a |
RISC-V updates for v7.2-rc3
- Avoid a null pointer deference in machine_kexec_prepare() that the
IMA subsystem can trigger
- Bypass libc in part of the ptrace_v_not_enabled kselftest to avoid
noise from child atfork handlers that libc might run
- Include Kconfig support for UltraRISC SoCs, already referenced by
some device drivers; and enable it in our defconfig
- Fix the build of the rseq kselftest for RISC-V by borrowing a
technique from the KVM and S390 kselftests that includes
arch-specific header files from tools/arch/<arch>/include
- Fix some memory leaks in the RISC-V vector ptrace kselftests
- Clean up some DT bindings and hwprobe documentation
-----BEGIN PGP SIGNATURE-----
iQIzBAABCgAdFiEElRDoIDdEz9/svf2Kx4+xDQu9KksFAmpRj9YACgkQx4+xDQu9
KktUEQ/8Cvup7jqUkHj3JBI/gjLLUyiOsa0q7KC3F2A+CznCFlrjwezGUZSeIiKq
lmVIeBFejOK+8VKNg+SeDTbfw10YlZOpUtBozJmRtFx17K0m5R6eGn6Qjy5IwMSI
wJmDylHtnLqrydYqESRt1iLDgETnZkmYdSlFDow2LKTa2g9BYPno+avB9uuzV2nj
/JCAC7kWSABRmROfNDBtZikT6Qcx1hGAxSQnkHmgvjYEInNggMefIfU7+/wgqksm
CEBCsoIZ3kqIVEkrGrYwlxoyj81wA8uOcg802xJs5ByffrdPc7xy43WZ9J41dKIb
EDXXbXH9tudhLmGfXDI8xt0gJz03L+t05pmYTaNN8o6/CWKQ7Dj5xvqfM1WllUDD
Q71Q6H0Smd7UmQkQ0/olyhG7yFEaewR+yJFvIEhISfQpIKUVWvVEVkEyJQdv66R4
ei2Oc2mUjQd+drCVD8d59whctUPMKDlg0JaesSE7rwNbx03NnOsLtg2JFHQxEVdn
GeUlKqAYLhTjPXrUvoWm3ebnU0DCvchKhY8So00aXWbdJnn2u9Qg81887czT0hQn
lsTLAt1n7/RCsuGo1zdw9lEMXmPJI9uX/HsyfatGYR9CVxj4M4tbVYjEz+wOFu+F
m7JKMnLFrvWF1+gRmmTXwcHCmi1qJnsqsILO4YvB+P/2vLs1FtU=
=P9QE
-----END PGP SIGNATURE-----
Merge tag 'riscv-for-linus-7.2-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/riscv/linux
Pull RISC-V fixes from Paul Walmsley:
"The most notable change involves the rseq kselftest common Makefile
(as it is not RISC-V-specific). The basic approach in the patch
appears similar to one used in the KVM and S390 selftests (grep for
LINUX_TOOL_ARCH_INCLUDE and SUBARCH), and the rseq kselftests pass a
quick build test on x86 after this.
- Avoid a null pointer deference in machine_kexec_prepare() that the
IMA subsystem can trigger
- Bypass libc in part of the ptrace_v_not_enabled kselftest to avoid
noise from child atfork handlers that libc might run
- Include Kconfig support for UltraRISC SoCs, already referenced by
some device drivers; and enable it in our defconfig
- Fix the build of the rseq kselftest for RISC-V by borrowing a
technique from the KVM and S390 kselftests that includes
arch-specific header files from tools/arch/<arch>/include
- Fix some memory leaks in the RISC-V vector ptrace kselftests
- Clean up some DT bindings and hwprobe documentation"
* tag 'riscv-for-linus-7.2-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/riscv/linux:
selftests/riscv: ptrace: Fix memory leak of regset_data in vector tests
selftests/rseq: Fix a building error for riscv arch
riscv: defconfig: enable ARCH_ULTRARISC
riscv: add UltraRISC SoC family Kconfig support
riscv: hwprobe.rst: Document EXT_ZICFISS and EXT_ZICFILP
riscv: hwprobe.rst: Make indentation consistent
dt-bindings: riscv: sort multi-letter Z extensions alphanumerically
selftests: riscv: Bypass libc in inactive vector ptrace test
riscv: Prevent NULL pointer dereference in machine_kexec_prepare()
|
||
|
Linus Torvalds
|
f4bf75d4e8 |
m68knommu: fix on top off v7.2-rc2
. fix broken local SoC IO accesses -----BEGIN PGP SIGNATURE----- iQJEBAABCgAuFiEEmsfM6tQwfNjBOxr3TiQVqaG9L4AFAmpTidQQHGdlcmdAa2Vy bmVsLm9yZwAKCRBOJBWpob0vgHIYEACBKY4WSbwBRjefo+Cw1f2+rM6ZaffCkT4q CdMQb1EQ6EA7OVOov+ZIPuDTgAPv0l2oksi8iZuVh4FaI6M9jlz3QTVVJKXafSAM DSjFj6IUiRyX9Eav96MO7NjOdT0+kUQxZnVEo7Cde4F3LLEoluXiSumkmLKpE9/t MLE+f8lPVxLwlQm4DhYUQvogkHoUb/eYqVbFg1lzs85+PzeC7urhtZVlSXCtvd73 lv37qlPUwAp0hHRe7ASmZCeStwNxXrvJ9sB1BmMYhdp2YHrd8ZJmzLA5cs6HB0w2 wjMBc9wUjRLb3jIosJpEnfOKTmlXZFbZ5hG8i97MTlsUXgw3bPswD+x9Cq9vVP3F w+1rpAMGGG/Cn2I/AABrGpEQS6ld3ZY3er/1E/Fm3wZPGkEwe33f5xlY/0EiCY7g 2tf6yiiyTDtM4sYzZeIJUAItWVYwSZ5ym6H9AfAjaMG8HxnnmcYnHCYH1OOMY1FC ziIElbsVIZPJKTY6ghBEEgijC9ASNGUb2ULwotjtAIHPOLRm44T6HXrmbCbuSdNn DFf7oq2aXmYR/zVmMYk3Iz9z84SFwjDMQo9CCvNwPt5bnVWdfXyCuXvUALGxQ1fN vzDaO1BZGilfW/vYAvaVN6uzEZzZsE1Qk0H66Xmu+Q6p/ydQRvHJstZqXzWLcgO/ S8EkwDXPzQ== =3/dn -----END PGP SIGNATURE----- Merge tag 'm68knommu-fixes-on-top-off-7.2-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/gerg/m68knommu Pull m68knommu fix from Greg Ungerer: "Fix incorrectly updated local SoC IO access function names. Testing didn't pick them up because there was no specific defconfig for these particular SoC parts. New defconfigs will be introduced in the next merge cycle to remedy that" * tag 'm68knommu-fixes-on-top-off-7.2-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/gerg/m68knommu: m68k: coldfire: fix breakage of missed IO access updates |
||
|
Linus Torvalds
|
6205562c59 |
tracing fixes for 7.2:
- Free field in error path of synthetic event parse In __create_synth_event() the field was allocated but was not freed in the error path. - Fix ring_buffer_event_length() on 8 byte aligned architectures On architectures with CONFIG_HAVE_64BIT_ALIGNED_ACCESS set to y, the ring_buffer_event_length() may return the wrong size. This is because archs with that config set will always use the "big event meta header" as that is 8 bytes keeping the payload 8 bytes aligned, even when a 4 byte header could hold the size of the event. But ring_buffer_event_length() doesn't take this into account and only subtracts 4 bytes for the meta header in the length when it should have subtracted 8 bytes. - Have osnoise wait for a full rcu synchronization on unregister osnoise_unregister_instance() used to call synchronize_rcu() before freeing its copy of the instance but was switched to kfree_rcu(). The osniose tracer has code that traverses the instances that it uses, and inst is just a pointer to that instance. By using kfree_rcu() instead of synchronize_rcu(), the instance that the inst pointer is pointing to can be freed while the osnoise code is still referencing it. That is, a rmdir on an instance first unregisters the tracer. When the unregister finishes, the rmdir expects that the tracer is finished with the instance that it is using. By putting back the synchronize_rcu() in osnoise_unregister_instance() the unregistering of osnoise will now return when all the users of the instance have finished. - Remove an unused setting of "ret" in tracing_set_tracer() - Fix ring_buffer_read_page() copying events The commit that changed ring_buffer_read_page() to show dropped events from the buffer itself, split the "commit" variable between the commit value (with flags) and "size" that holds the size of the sub-buffer. A cut and paste error changed the test of the reading from checking the size of the buffer to the size of the event causing reads to only read one event at a time. - Make tracepoint_printk a static variable When the tracing sysctl knobs were move from sysctl.c to trace.c, the variable tracepoint_printk no longer needed to be global. Make it static. - Fix some typos - Fix NULL pointer dereference in func_set_flag() The flags update of the function tracer first checks if the value of the flag is the same and exits if they are, and then it checks if the current tracer is the function tracer and exits if it isn't. The problem is that these checks need to be in a reversed order, as if the tracer isn't the function tracer, then the flag being checked may not exist. Reverse the order of these checks. - Fix ufs core trace events to not dereference a pointer in TP_printk() The TP_printk() part of the TRACE_EVENT() macro is called when the user reads the "trace" file. This can be seconds, minutes, hours, days, weeks, and even months after the data was recorded into the ring buffer. Thus, saving a pointer to an object into the ring buffer and then dereferencing it from TP_printk() can cause harm as the object the pointer is pointing to may no longer exist. Fix all the trace events in ufs core to save the device name in the ring buffer instead of dereferencing the device descriptor from TP_printk(). - Prevent out-of-bound reads in glob matching of trace events The filter logic of events allows simple glob logic to add wild cards to filter on strings. But some events have fields that may not have a terminating 'nul' character. This may cause the glob matching to go beyond the string. Change the logic to always pass in the length of the field that is being matched. - Add no-rcu-check version of trace_##event##_enabled() The trace_##event##_enabled() usually wraps trace events to do extra work that is only needed when the trace event is enabled. But this can hide events that are placed in locations where RCU is not watching, and can make lockdep not see these bugs when the event is not enabled. The trace_##event##_enabled() was updated to always test to make sure RCU is watching to catch locations that may call events without RCU being active. This caused a false positive for the irq_disabled() and related events. As that use trace_irq_disabled_enabled() to force RCU to be watching when the event is enabled via the ct_irq_enter() function, calls the event, and then calls ct_irq_exit() to put RCU back to its original state. The trace_irq_disabled_enabled() should not trigger a warning when RCU is not watching because the code within its block handles the case properly. Make a __trace_##event##_enabled() version for this event to use that doesn't check RCU is watching as it handles the case when it isn't. - Fix use-after-free in user_event_mm_dup() When the enabler is removed from the link list, it is freed immediately. But it is protected via RCU and needs to be freed after an RCU grace period. Use queue_rcu_work() so that the event_mutex can also be taken as user_event_put() takes the mutex on the last reference is released. - Free type string in error path of parse_synth_field() There's an error path in parse_synth_field() where the allocated type string is not freed. - Add selftest that tests deferred event teardown - Fix leak in error path of trace_remote_alloc_buffer() If page allocation fails, the desc->nr_cpus is not incremented for the current CPU and the allocations done for it are not freed. - Fix allocation length in trace_remote_alloc_buffer() The logic to calculate the struct_len was doing a double count and setting the value too large. Calculate the size upfront to fix the error and simplify the logic. - Fix sparse CPU masks in ring_buffer_desc() If there are sparse CPUs (gaps in the numbering), the ring_buffer_desc() will fail as it tests the CPU number against the number of CPUs that are used. -----BEGIN PGP SIGNATURE----- iQJIBAABCgAyFiEEXtmkj8VMCiLR0IBM68Js21pW3nMFAmpTv/cUHHJvc3RlZHRA Z29vZG1pcy5vcmcACgkQ68Js21pW3nN80w/9HEbliUUrJVNw8QCY8BmeBEzfCRhZ 2CeDzTg+UrLMb2BtqUhA9EjQnRPawe8mPxAfpZ750SdFnCkRhbfNwYmKar3M/8iW y2Bhsvd3Hz6nRiHvKhG/1RkflgKOWLYf/TQSByKlakYLV8t4uffa0fe0N0zcnikK XPGrhrTeRDJ7s94vb1u7p7mSSp2iy4ZhfXbagk966X3I4zvseIYNn5IIzyM3IIPT M7mE60SxvgSRz0QqTJqihmqjXYSeNOQ2iU18wnvp4QfcT0IVuLKm027JnK/YpjWS ZasMNGzO1kp5uo6hkXLrMlT3LjaNEMFTGogs1m9o9auhbMf443LK8GtZ1m1rwnTG cXn1PocBevQIaXWPbnxMrSwIuN7YMUqjgX6SCxbXpDxSSuE5i/x1VmE08CjxnSm6 TdAdom9bE44FvMgaAz9+KhIUgm013c2rFDNiFroYtfkma5FqpfnfglA4/TkJvexY e2L75cR3lrDEDiXXMQDndmvxNMhppwNlAH3mOZLiaCmGyFQFHhgAaG250K2Y6a5K HtIfJkT6RQ3rWifV0E0+zlyRiOrvVCCA8WwNArWb1dTWrVU86Hr7q58jAq9p0Yrz FnhpjdE3eWoUHZ5f28AMR2k5lMG3o6mOGT55JyUVCLw+rPSG5358UIg2xZiEo22k RFlT26FFHbMW50Y= =+//w -----END PGP SIGNATURE----- Merge tag 'trace-v7.2-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace Pull tracing fixes from Steven Rostedt: - Free field in error path of synthetic event parse In __create_synth_event() the field was allocated but was not freed in the error path - Fix ring_buffer_event_length() on 8 byte aligned architectures On architectures with CONFIG_HAVE_64BIT_ALIGNED_ACCESS set to y, the ring_buffer_event_length() may return the wrong size. This is because archs with that config set will always use the "big event meta header" as that is 8 bytes keeping the payload 8 bytes aligned, even when a 4 byte header could hold the size of the event But ring_buffer_event_length() doesn't take this into account and only subtracts 4 bytes for the meta header in the length when it should have subtracted 8 bytes - Have osnoise wait for a full rcu synchronization on unregister osnoise_unregister_instance() used to call synchronize_rcu() before freeing its copy of the instance but was switched to kfree_rcu(). The osniose tracer has code that traverses the instances that it uses, and inst is just a pointer to that instance. By using kfree_rcu() instead of synchronize_rcu(), the instance that the inst pointer is pointing to can be freed while the osnoise code is still referencing it That is, a rmdir on an instance first unregisters the tracer. When the unregister finishes, the rmdir expects that the tracer is finished with the instance that it is using. By putting back the synchronize_rcu() in osnoise_unregister_instance() the unregistering of osnoise will now return when all the users of the instance have finished - Remove an unused setting of "ret" in tracing_set_tracer() - Fix ring_buffer_read_page() copying events The commit that changed ring_buffer_read_page() to show dropped events from the buffer itself, split the "commit" variable between the commit value (with flags) and "size" that holds the size of the sub-buffer. A cut and paste error changed the test of the reading from checking the size of the buffer to the size of the event causing reads to only read one event at a time - Make tracepoint_printk a static variable When the tracing sysctl knobs were move from sysctl.c to trace.c, the variable tracepoint_printk no longer needed to be global. Make it static - Fix some typos - Fix NULL pointer dereference in func_set_flag() The flags update of the function tracer first checks if the value of the flag is the same and exits if they are, and then it checks if the current tracer is the function tracer and exits if it isn't. The problem is that these checks need to be in a reversed order, as if the tracer isn't the function tracer, then the flag being checked may not exist. Reverse the order of these checks - Fix ufs core trace events to not dereference a pointer in TP_printk() The TP_printk() part of the TRACE_EVENT() macro is called when the user reads the "trace" file. This can be seconds, minutes, hours, days, weeks, and even months after the data was recorded into the ring buffer. Thus, saving a pointer to an object into the ring buffer and then dereferencing it from TP_printk() can cause harm as the object the pointer is pointing to may no longer exist Fix all the trace events in ufs core to save the device name in the ring buffer instead of dereferencing the device descriptor from TP_printk() - Prevent out-of-bound reads in glob matching of trace events The filter logic of events allows simple glob logic to add wild cards to filter on strings. But some events have fields that may not have a terminating 'nul' character. This may cause the glob matching to go beyond the string. Change the logic to always pass in the length of the field that is being matched - Add no-rcu-check version of trace_##event##_enabled() The trace_##event##_enabled() usually wraps trace events to do extra work that is only needed when the trace event is enabled. But this can hide events that are placed in locations where RCU is not watching, and can make lockdep not see these bugs when the event is not enabled The trace_##event##_enabled() was updated to always test to make sure RCU is watching to catch locations that may call events without RCU being active This caused a false positive for the irq_disabled() and related events. As that use trace_irq_disabled_enabled() to force RCU to be watching when the event is enabled via the ct_irq_enter() function, calls the event, and then calls ct_irq_exit() to put RCU back to its original state The trace_irq_disabled_enabled() should not trigger a warning when RCU is not watching because the code within its block handles the case properly. Make a __trace_##event##_enabled() version for this event to use that doesn't check RCU is watching as it handles the case when it isn't - Fix use-after-free in user_event_mm_dup() When the enabler is removed from the link list, it is freed immediately. But it is protected via RCU and needs to be freed after an RCU grace period. Use queue_rcu_work() so that the event_mutex can also be taken as user_event_put() takes the mutex on the last reference is released - Free type string in error path of parse_synth_field() There's an error path in parse_synth_field() where the allocated type string is not freed - Add selftest that tests deferred event teardown - Fix leak in error path of trace_remote_alloc_buffer() If page allocation fails, the desc->nr_cpus is not incremented for the current CPU and the allocations done for it are not freed - Fix allocation length in trace_remote_alloc_buffer() The logic to calculate the struct_len was doing a double count and setting the value too large. Calculate the size upfront to fix the error and simplify the logic - Fix sparse CPU masks in ring_buffer_desc() If there are sparse CPUs (gaps in the numbering), the ring_buffer_desc() will fail as it tests the CPU number against the number of CPUs that are used * tag 'trace-v7.2-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace: ring-buffer: Allow sparse CPU masks in ring_buffer_desc() tracing/remotes: Fix struct_len in trace_remote_alloc_buffer() tracing/remotes: Fix leak in trace_remote_alloc_buffer() error path selftests/user_events: Wait for deferred event teardown after unregister tracing/synthetic: Free type string on error path tracing/user_events: Fix use-after-free in user_event_mm_dup() tracing: Add a no-rcu-check version of trace_##event##_enabled() tracing: Prevent out-of-bounds read in glob matching ufs: core: tracing: Do not dereference pointers in TP_printk() tracing: Fix NULL pointer dereference in func_set_flag() samples: ftrace: Fix typos in benchmark comment tracing: Make tracepoint_printk static as not exported ring-buffer: Fix ring_buffer_read_page() copying only one event per page tracing: Remove unused ret assignment in tracing_set_tracer() tracing/osnoise: Call synchronize_rcu() when unregistering ring-buffer: Fix event length with forced 8-byte alignment tracing/synthetic: Free pending field on error path |
||
|
Linus Torvalds
|
44696aa3a4 |
Input updates for v7.2-rc2
- A fix for MELFAS MMS114 touchscreen driver to reject invalid touch IDs and avoid multi-touch slot corruption - A fix for a crash in Sega Dreamcast (Maple) mouse driver when opening the device, caused by missing driver data - Fixes for Maple drivers (keyboard, mouse, joystick) to properly order setting driver data and device registration to avoid races. -----BEGIN PGP SIGNATURE----- iHUEABYKAB0WIQST2eWILY88ieB2DOtAj56VGEWXnAUCalLC2QAKCRBAj56VGEWX nLLwAQDExlB/cWm2Hpmim13SIetpNbnRNDDUBXZqlx26U6tCUgD9Ek85LvbRiWOJ dTqs7ieSn2iPQxHFvHOAZD5ohSGj/wI= =g2px -----END PGP SIGNATURE----- Merge tag 'input-for-v7.2-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input Pull input fixes from Dmitry Torokhov: - fix MELFAS MMS114 touchscreen driver to reject invalid touch IDs and avoid multi-touch slot corruption - fix a crash in the Sega Dreamcast (Maple) mouse driver when opening the device, caused by missing driver data - fixes for Maple drivers (keyboard, mouse, joystick) to properly order setting driver data and device registration to avoid races * tag 'input-for-v7.2-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input: Input: mms114 - fix multi-touch slot corruption Input: maple_keyb - set driver data before registering input device Input: maplecontrol - set driver data before registering input device Input: maplemouse - set driver data before registering input device Input: maplemouse - fix NULL pointer dereference in open() |
||
|
Linus Torvalds
|
59dee6d287 |
- dm-log: fix overflow on 32-bit machines
- dm-era: fix out of bounds memory access; fix crashes on invalid args - dm-verity: fix buffer overflow in forward error correction - dm-thin: fix misbehavior on I/O failures - dm-pcache: fix NULL pointer dereference on invalid arguments - dm-inlinecrypt: fix memory leak on error handling - dm-integrity: fix ignoring the 'fix_hmac' option on device open - dm: don't store the keyring in memory for a long term - 12 miscellaneous fixes for bugs found by Claude Opus 4.6 -----BEGIN PGP SIGNATURE----- iIoEABYIADIWIQRnH8MwLyZDhyYfesYTAyx9YGnhbQUCalKUaxQcbXBhdG9ja2FA cmVkaGF0LmNvbQAKCRATAyx9YGnhbbQwAP9pHgNUinD95o9vnu3d3QNmjnEDmrgZ +kxNFRpWXvbzKQEArYWPLS/2dwf4nG0Fa8PtJTwkjI/6UeublAy5MrdTqA0= =pkBx -----END PGP SIGNATURE----- Merge tag 'for-7.2/dm-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/device-mapper/linux-dm Pull device mapper fixes from Mikulas Patocka: - dm-log: fix overflow on 32-bit machines - dm-era: fix out of bounds memory access; fix crashes on invalid args - dm-verity: fix buffer overflow in forward error correction - dm-thin: fix misbehavior on I/O failures - dm-pcache: fix NULL pointer dereference on invalid arguments - dm-inlinecrypt: fix memory leak on error handling - dm-integrity: fix ignoring the 'fix_hmac' option on device open - dm: don't store the keyring in memory for a long term - 12 miscellaneous fixes for bugs found by Claude Opus 4.6 * tag 'for-7.2/dm-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/device-mapper/linux-dm: (23 commits) dm thin metadata: fix superblock refcount leak on snapshot shadow failure dm-stats: fix dm_jiffies_to_msec64 dm-stats: fix merge accounting dm-bufio: fix wrong count calculation in dm_bufio_issue_discard dm-verity: make error counter atomic dm-verity: increase sprintf buffer size dm-verity: fix a possible NULL pointer dereference dm-verity: avoid double increment of &use_bh_wq_enabled dm-ioctl: fix a possible overflow in list_version_get_info dm_early_create: fix freeing used table on dm_resume failure dm-integrity: fix a bug if the bio is out of limits dm-integrity: don't increment hash_offset twice dm-integrity: fix leaking uninitialized kernel memory dm-integrity: fix the 'fix_hmac' option dm era: fix error code propagation in era_ctr() dm era: fix NULL pointer dereference in metadata_open() dm: avoid leaking the caller's thread keyring via the table device file dm-inlinecrypt: Fix an error handling path in inlinecrypt_ctr() dm-pcache: reject option groups without values dm thin metadata: fix metadata snapshot consistency on commit failure ... |
||
|
Linus Torvalds
|
cab9e339cf |
Misc perf events fixes:
- Fix SVM #GP on AMD CPUs that LBR but not BRS
(Sandipan Das)
- Fix UAF bug in the perf AUX code (Lee Jia Jie)
- Fix address leakage in the AMD LBR code
(Sandipan Das)
- Fix address leakage in the AMD BRS code
(Sandipan Das)
Signed-off-by: Ingo Molnar <mingo@kernel.org>
-----BEGIN PGP SIGNATURE-----
iQJFBAABCgAvFiEEBpT5eoXrXCwVQwEKEnMQ0APhK1gFAmpSKr0RHG1pbmdvQGtl
cm5lbC5vcmcACgkQEnMQ0APhK1hsTA//Vm7AzLa5iDBu12fINDMC/62kDTfLu5OD
WvIeygRJYOkx/P1FxAigJHXnA6/dqAoLusbgaLG0pzoNr0cI+MREuvuIYP0xDb6V
yTQe2mvvjBoQ+5XDRnt2D19Pgo9PAIN62zk3UJSTvtkJ7u0P+POGxKSMq6Kbg3sO
DcYaAXrs+JnFeKjAahXnX4USB15uhkq1BKDFfB+PJUaaAoysueu2/ceGRtXiN9eW
X/v59IhCYJ5sfOOJ72CCkLsAdXKjyHFnhaYoslu5V9nfUxhLzbEGGWTIdsVLazsp
t6F16c/dsxrMpG24TLfbucIDvV4Qt+oZrfVqHdLXvfunRwuCQt+ajXNBVi1krgKQ
mjFaXJ15NGE9xrs+Id+m0rBFMVvKqvEh0sw+1URItsmZKB4RK7IA6ktlnod5J9XF
nYPNr0OqYw/Nd8MAEERvlOmqB0GQ/XGxRF8AsYo+IY7VRD/hrC+wRvsCDkZnOnrf
Jc4zJVW/+kXI0PzA1o7qolCGR5t9Ed8VDGK7dxwMF7lWshidgpFtBOm6MW9yuVgc
DjemSRObXRDqrspF/VFn9u7xJ/RNiAi+tARDmKQRPKeu3dX0QaYVt5umSwjmas39
KVGP3vhVoPFyeuis1VJxdgDXyssaruXglV/AJo6yCZZDK1UgMzRo726ZUi2c5OZL
43uBh4RKUi8=
=OpxC
-----END PGP SIGNATURE-----
Merge tag 'perf-urgent-2026-07-11' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip
Pull perf events fixes from Ingo Molnar:
- Fix SVM #GP on AMD CPUs that LBR but not BRS (Sandipan Das)
- Fix UAF bug in the perf AUX code (Lee Jia Jie)
- Fix address leakage in the AMD LBR code (Sandipan Das)
- Fix address leakage in the AMD BRS code (Sandipan Das)
* tag 'perf-urgent-2026-07-11' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
perf/x86/amd/brs: Fix kernel address leakage
perf/x86/amd/lbr: Fix kernel address leakage
perf/aux: Fix page UAF in map_range()
perf/x86/amd/core: Avoid enabling BRS from the SVM reload path
|