Commit Graph

1440650 Commits

Author SHA1 Message Date
Vishnu Sankar
4b0f556deb HID: lenovo: Use KEY_PERFORMANCE capability for ThinkPad X12 Tab Gen 2
The X12 Tab Gen 2 emits KEY_PERFORMANCE via Fn+F8 through the raw
event handler but never declared the capability via
input_set_capability(). This prevents userspace tools from
discovering the key through evdev capability bits.

Signed-off-by: Vishnu Sankar <vishnuocv@gmail.com>
Signed-off-by: Jiri Kosina <jkosina@suse.com>
2026-06-10 17:38:39 +02:00
Vishnu Sankar
df72cacda3 HID: lenovo: Add support for ThinkPad X13 Folio keyboard
Add USB ID support for the ThinkPad X13 detachable keyboard.
The Keyboard uses the same HID raw event protocol as the ThinkPad
X12 Gen 2. The functionality stays the same with X12 Gen 2 Keyboards.

Also declare KEY_PERFORMANCE capability in lenovo_input_configured()
for X13 detachable, allowing userspace to discover the key via evdev
capability bits.

Signed-off-by: Vishnu Sankar <vishnuocv@gmail.com>
Signed-off-by: Jiri Kosina <jkosina@suse.com>
2026-06-10 17:38:30 +02:00
Manish Khadka
73fde0cbff HID: hid-lenovo-go: cancel cfg_setup work in hid_go_cfg_remove()
hid_go_cfg_probe() initialises drvdata.go_cfg_setup and schedules it
to run 2 ms later:

    INIT_DELAYED_WORK(&drvdata.go_cfg_setup, &cfg_setup);
    schedule_delayed_work(&drvdata.go_cfg_setup, msecs_to_jiffies(2));

cfg_setup() dereferences drvdata.hdev to issue MCU command requests.
hid_go_cfg_remove() tears down sysfs and stops the HID device, but
never drains the delayed work.  If the device is unbound within the
2 ms scheduling delay (a probe failure rolling back via remove, or a
fast rmmod after probe), the work fires after hid_destroy_device()
has dropped its reference and released the underlying hdev struct,
leaving cfg_setup() with a stale drvdata.hdev pointer.

Mirror the sibling driver hid-lenovo-go-s.c, whose hid_gos_cfg_remove()
already calls cancel_delayed_work_sync() on its analogous work, and
drain go_cfg_setup at the top of hid_go_cfg_remove().  The cancel
must come before guard(mutex)(&drvdata.cfg_mutex) because cfg_setup()
acquires that mutex; reversing the order would deadlock.

Fixes: d69ccfcbc9 ("HID: hid-lenovo-go: Add Lenovo Legion Go Series HID Driver")
Cc: stable@vger.kernel.org
Signed-off-by: Manish Khadka <maskmemanish@gmail.com>
Signed-off-by: Jiri Kosina <jkosina@suse.com>
2026-06-03 14:18:18 +02:00
Rafael Passos
426e5846eb HID: Input: Add battery list cleanup with devm action
The batteries list (hdev->batteries) is not cleaned up during
hidinput_disconnect(), but struct hid_battery entries are allocated
with devm_kzalloc.
When a driver is unbound (e.g. during devicereprobe), devm frees those
entries while their list_head nodesremain dangling in hdev->batteries,
which persists across rebinds.

Link: https://lore.kernel.org/all/20260602011949.2825852-1-rafael@rcpassos.me/
Fixes: 4a58ae85c3 ("HID: input: Add support for multiple batteries per device")
Signed-off-by: Rafael Passos <rafael@rcpassos.me>
Acked-by: Lucas Zampieri <lcasmz54@gmail.com>
Signed-off-by: Benjamin Tissoires <bentiss@kernel.org>
2026-06-02 10:28:39 +02:00
Lee Jones
c0a8899e02 HID: wacom: Fix OOB write in wacom_hid_set_device_mode()
wacom_hid_set_device_mode() currently assumes that the HID_DG_INPUTMODE
usage is always located in the first field (field[0]) of the feature report.
However, a device can specify HID_DG_INPUTMODE in a different field.

If HID_DG_INPUTMODE is in a field other than the first one and the first
field has a report_count smaller than the usage_index of HID_DG_INPUTMODE,
this leads to an out-of-bounds write to r->field[0]->value.

Fix this by storing the field index of HID_DG_INPUTMODE in 'struct
hid_data' during feature mapping.  In wacom_hid_set_device_mode(), use
this stored field index to access the correct field and add bounds
checks to ensure both the field index and the value index are within
valid ranges before writing.

Cc: stable@vger.kernel.org
Fixes: 5ae6e89f74 ("HID: wacom: implement the finger part of the HID generic handling")
Tested-by: Ping Cheng <ping.cheng@wacom.com>
Reviewed-by: Ping Cheng <ping.cheng@wacom.com>
Signed-off-by: Lee Jones <lee@kernel.org>
Signed-off-by: Benjamin Tissoires <bentiss@kernel.org>
2026-05-28 17:43:16 +02:00
Louis Clinckx
da7f96a68c HID: lenovo-go: drop dead NULL check on to_usb_interface()
to_usb_interface() is a container_of_const() macro: it performs
pointer arithmetic and never returns NULL. The if (!intf) and if
(intf) tests in get_endpoint_address() can never fire. Remove them
in both drivers.

No functional change.

Suggested-by: Derek J. Clark <derekjohn.clark@gmail.com>
Signed-off-by: Louis Clinckx <clinckx.louis@gmail.com>
Reviewed-by: Derek J. Clark <derekjoh.clark@gmail.com>
Tested-by: Derek J. Clark <derekjohn.clark@gmail.com>
Signed-off-by: Benjamin Tissoires <bentiss@kernel.org>
2026-05-21 17:12:54 +02:00
Louis Clinckx
2ee7e63240 HID: lenovo-go: reject non-USB transports in probe
These drivers only match HID_USB_DEVICE() entries and assume the
underlying bus is USB. Make that explicit at probe by rejecting any
non-USB hdev, following the pattern used by other HID drivers.

Signed-off-by: Louis Clinckx <clinckx.louis@gmail.com>
Reviewed-by: Derek J. Clark <derekjoh.clark@gmail.com>
Tested-by: Derek J. Clark <derekjohn.clark@gmail.com>
Signed-off-by: Benjamin Tissoires <bentiss@kernel.org>
2026-05-21 17:12:54 +02:00
Kean
c7ee0b73c8 HID: lenovo: Fix buffer over-read and unaligned access in X12 Tab raw_event handler
In lenovo_raw_event(), the X12 Tab keyboard handler reads a 4-byte
little-endian value from the raw HID report buffer but:

  1. The size guard is size >= 3, while the access reads 4 bytes.
     A malformed 3-byte report with ID 0x03 would over-read the
     buffer by one byte.

  2. Casting u8 *data directly to __le32 * can trigger unaligned
     access faults on architectures like ARM, MIPS, and SPARC,
     because HID input buffers carry no alignment guarantee.
     (e.g. uhid payloads start at offset 6 in struct uhid_event,
     giving only 2-byte alignment.)

Fix both by tightening the size check to >= 4 and replacing the
open-coded cast + le32_to_cpu() with get_unaligned_le32(), which
handles the LE-to-CPU conversion safely regardless of alignment.

Link: https://sashiko.dev/#/message/20260512044911.99B6DC2BCB0%40smtp.kernel.org
Assisted-by: CLAUDE:claude-4-sonnet
Signed-off-by: Kean <rh_king@163.com>
Signed-off-by: Benjamin Tissoires <bentiss@kernel.org>
2026-05-21 17:10:27 +02:00
hlleng
07466fc91c HID: quirks: Add ALWAYS_POLL quirk for SIGMACHIP USB mouse
The SIGMACHIP USB mouse with VID/PID 1c4f:0034 can disconnect and
re-enumerate repeatedly after it has been enumerated if its interrupt
endpoint is not continuously polled.

This was observed with the device reporting itself as "SIGMACHIP Usb
Mouse". Keeping the input event device open avoids the disconnects.

Add HID_QUIRK_ALWAYS_POLL for this device so the HID core keeps polling
it even when there is no userspace input consumer.

Cc: stable@vger.kernel.org
Signed-off-by: hlleng <a909204013@gmail.com>
Signed-off-by: Benjamin Tissoires <bentiss@kernel.org>
2026-05-21 16:51:30 +02:00
Liu Kai
dd2147375a HID: remove duplicate hid_warn_ratelimited definition
The hid_warn_ratelimited macro is defined twice in include/linux/hid.h:
- first one added by commit 4051ead998 ("HID: rate-limit hid_warn to
  prevent log flooding")
- second one added by commit 1d64624243 ("HID: core: Add
  printk_ratelimited variants to hid_warn() etc")).

The second definition is correctly grouped with other ratelimited macros.
Remove the duplicate definition.

Fixes: 1d64624243 ("HID: core: Add printk_ratelimited variants to hid_warn() etc")
Signed-off-by: Liu Kai <lukace97@outlook.com>
[bentiss: edited commit message]
Signed-off-by: Benjamin Tissoires <bentiss@kernel.org>
2026-05-21 16:14:33 +02:00
Myeonghun Pak
2e78b21864 HID: u2fzero: free allocated URB on probe errors
u2fzero_fill_in_urb() allocates dev->urb with usb_alloc_urb(), but
u2fzero_probe() ignored its return value and only freed the URB from
u2fzero_remove().

If LED or hwrng registration fails after the URB allocation, probe returns
an error and the driver core does not call .remove(), leaking the URB. A
failed URB setup was also allowed to continue probing with an unusable
device.

Check the URB setup result and add the missing probe-error unwind so the
URB is freed before returning from later errors.

Signed-off-by: Myeonghun Pak <mhun512@gmail.com>
Signed-off-by: Benjamin Tissoires <bentiss@kernel.org>
2026-05-21 15:47:17 +02:00
Alain Michaud
64ffa2e5e0 HID: logitech-hidpp: Add support for newer Bluetooth keyboards
Add product IDs (PIDs) for several newer Logitech Bluetooth keyboards
to the hidpp_devices matching table, enabling full HID++ support for
them.

The added keyboards are:
- Logitech Signature K650 & B2B
- Logitech Pebble Keys 2 K380S
- Logitech Casa Pop-Up Desk & B2B
- Logitech Wave Keys & B2B
- Logitech Signature Slim K950 & B2B
- Logitech MX Keys S & B2B
- Logitech Keys-To-Go 2
- Logitech Pop Icon Keys
- Logitech MX Keys Mini & B2B
- Logitech Signature Slim Solar+ K980 B2B
- Logitech Bluetooth Keyboard K250/K251
- Logitech Signature Comfort K880 & B2B

Signed-off-by: Alain Michaud <alainmichaud@google.com>
Reviewed-by: Olivier Gay <ogay@logitech.com>
Signed-off-by: Jiri Kosina <jkosina@suse.com>
2026-05-12 18:16:46 +02:00
Tomasz Pakuła
48d1677779 HID: pidff: Fix integer overflow in pidff_rescale
Rescaling values close to the max (U16_MAX) temporarily creates values
that exceed the s32 range. This caused value overflow in case when, for
example, a periodic effect phase was higer than 180 degrees. In turn,
rescale function could return values outised of the logical range of the
HID field.

Fix by using 64 bit signed integer to store the value during calculation
but still return only 32 bit integer.

Closes: https://github.com/JacKeTUs/universal-pidff/issues/116
Fixes: 224ee88fe3 ("Input: add force feedback driver for PID devices")
Cc: stable@vger.kernel.org
Signed-off-by: Tomasz Pakuła <tomasz.pakula.oficjalny@gmail.com>
Signed-off-by: Jiri Kosina <jkosina@suse.com>
2026-05-12 18:13:40 +02:00
Xu Rao
a991aa5e89 HID: i2c-hid: add reset quirk for BLTP7853 touchpad
The BLTP7853 I2C HID touchpad may fail to probe after reboot or
reprobe because reset completion is not signalled to the host. The
driver then waits for the reset-complete interrupt until it times out
and the device probe fails:

  i2c_hid i2c-BLTP7853:00: failed to reset device.
  i2c_hid i2c-BLTP7853:00: can't add hid device: -61
  i2c_hid: probe of i2c-BLTP7853:00 failed with error -61

Add I2C_HID_QUIRK_NO_IRQ_AFTER_RESET for the device so i2c-hid does
not wait for a reset interrupt that may never arrive.

Signed-off-by: Xu Rao <raoxu@uniontech.com>
Signed-off-by: Jiri Kosina <jkosina@suse.com>
2026-05-12 18:11:43 +02:00
Benjamin Tissoires
206342541f HID: core: introduce hid_safe_input_report()
hid_input_report() is used in too many places to have a commit that
doesn't cross subsystem borders. Instead of changing the API, introduce
a new one when things matters in the transport layers:
- usbhid
- i2chid

This effectively revert to the old behavior for those two transport
layers.

Fixes: 0a3fe972a7 ("HID: core: Mitigate potential OOB by removing bogus memset()")
Cc: stable@vger.kernel.org
Signed-off-by: Benjamin Tissoires <bentiss@kernel.org>
Signed-off-by: Jiri Kosina <jkosina@suse.com>
2026-05-12 18:03:58 +02:00
Benjamin Tissoires
2c85c61d13 HID: pass the buffer size to hid_report_raw_event
commit 0a3fe972a7 ("HID: core: Mitigate potential OOB by removing
bogus memset()") enforced the provided data to be at least the size of
the declared buffer in the report descriptor to prevent a buffer
overflow. However, we can try to be smarter by providing both the buffer
size and the data size, meaning that hid_report_raw_event() can make
better decision whether we should plaining reject the buffer (buffer
overflow attempt) or if we can safely memset it to 0 and pass it to the
rest of the stack.

Fixes: 0a3fe972a7 ("HID: core: Mitigate potential OOB by removing bogus memset()")
Cc: stable@vger.kernel.org
Signed-off-by: Benjamin Tissoires <bentiss@kernel.org>
Acked-by: Johan Hovold <johan@kernel.org>
Reviewed-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Jiri Kosina <jkosina@suse.com>
2026-05-12 18:03:37 +02:00
Myeonghun Pak
b08665fe80 HID: google: hammer: stop hardware on devres action failure
hammer_probe() starts the HID hardware before registering the devres
action that stops it. If devm_add_action() fails, probe returns an
error with the hardware still started because the cleanup action was
never registered and the driver's remove callback is not called after a
failed probe.

Use devm_add_action_or_reset() so the stop action runs immediately on
registration failure while preserving the existing devres-managed cleanup
path for later probe failures and remove.

Signed-off-by: Myeonghun Pak <mhun512@gmail.com>
Signed-off-by: Jiri Kosina <jkosina@suse.com>
2026-05-12 18:01:05 +02:00
Sangyun Kim
1654e53349 HID: appletb-kbd: run inactivity autodim from workqueues
The autodim code in hid-appletb-kbd takes backlight_device->ops_lock
via backlight_device_set_brightness() -> mutex_lock() from two
different atomic contexts:

 * appletb_inactivity_timer() is a struct timer_list callback, so it
   runs in softirq context.  Every expiry triggers

     BUG: sleeping function called from invalid context at kernel/locking/mutex.c:591
     Call Trace:
      <IRQ>
      __might_resched
      __mutex_lock
      backlight_device_set_brightness
      appletb_inactivity_timer
      call_timer_fn
      run_timer_softirq

 * reset_inactivity_timer() is called from appletb_kbd_hid_event() and
   appletb_kbd_inp_event().  On real USB hardware these run in
   softirq/IRQ context (URB completion and input-event dispatch).
   When the Touch Bar has already been dimmed or turned off, the
   reset path calls backlight_device_set_brightness() directly to
   restore brightness, producing the same warning.

Both call sites hit the same mutex_lock()-from-atomic bug.  Fix them
together by moving the blocking work onto the system workqueue:

 * Convert the inactivity timer from struct timer_list to
   struct delayed_work; the callback (appletb_inactivity_work) now
   runs in process context where mutex_lock() is legal.
 * Add a dedicated struct work_struct restore_brightness_work and have
   reset_inactivity_timer() schedule it instead of calling
   backlight_device_set_brightness() directly.

Cancel both works synchronously during driver tear-down alongside the
existing backlight reference drop.

The semantics are unchanged (same delays, same state transitions on
dim, turn-off and user activity); only the execution context of the
sleeping call changes.  The timer field and callback are renamed to
match their new type; reset_inactivity_timer() keeps its name because
it is invoked from input event paths that read naturally as "reset
the inactivity timer".

Fixes: 93a0fc4894 ("HID: hid-appletb-kbd: add support for automatic brightness control while using the touchbar")
Cc: stable@vger.kernel.org
Signed-off-by: Sangyun Kim <sangyun.kim@snu.ac.kr>
Signed-off-by: Jiri Kosina <jkosina@suse.com>
2026-05-12 17:57:35 +02:00
Sangyun Kim
4db2af9292 HID: appletb-kbd: fix UAF in inactivity-timer cleanup path
Commit 38224c472a ("HID: appletb-kbd: fix slab use-after-free bug in
appletb_kbd_probe") added timer_delete_sync(&kbd->inactivity_timer) to
both the probe close_hw error path and appletb_kbd_remove(), but the
way it was wired in left the inactivity timer reachable during driver
tear-down via two distinct windows.

Window A -- put_device() before timer_delete_sync():

	put_device(&kbd->backlight_dev->dev);
	timer_delete_sync(&kbd->inactivity_timer);

The inactivity_timer softirq reads kbd->backlight_dev and calls
backlight_device_set_brightness() -> mutex_lock(&ops_lock).  If a
concurrent hid_appletb_bl unbind drops the last devm reference
between these two calls, the backlight_device is freed and the
mutex_lock() touches freed memory.

Window B -- backlight cleanup before hid_hw_stop():

	if (kbd->backlight_dev) {
		timer_delete_sync(...);
		put_device(...);
	}
	hid_hw_close(hdev);
	hid_hw_stop(hdev);

Even after Window A is closed, hid_hw_close()/hid_hw_stop() still run
afterwards, so a late ".event" callback from the HID core (USB URB
completion on real Apple hardware) can arrive after
timer_delete_sync() drained the softirq but before put_device() drops
the reference.  That callback reaches reset_inactivity_timer(), which
calls mod_timer() and re-arms the timer.  The freshly re-armed timer
can then fire on the about-to-be-freed backlight_device.

Both windows produce the same KASAN slab-use-after-free:

  BUG: KASAN: slab-use-after-free in __mutex_lock+0x1aab/0x21c0
  Read of size 8 at addr ffff88803ee9a108 by task swapper/0/0
  Call Trace:
   <IRQ>
   __mutex_lock
   backlight_device_set_brightness
   appletb_inactivity_timer
   call_timer_fn
   run_timer_softirq
   handle_softirqs
  Allocated by task N:
   devm_backlight_device_register
   appletb_bl_probe
  Freed by task M:
   (concurrent hid_appletb_bl unbind path)

Close both windows at once by reworking the tear-down in
appletb_kbd_remove() and in the probe close_hw error path so that

 1) hid_hw_close()/hid_hw_stop() run before the backlight cleanup,
    guaranteeing no further .event callback can fire and re-arm the
    timer, and
 2) inside the "if (kbd->backlight_dev)" block, timer_delete_sync()
    runs before put_device(), so the softirq is drained before the
    final reference is dropped.

Fixes: 38224c472a ("HID: appletb-kbd: fix slab use-after-free bug in appletb_kbd_probe")
Cc: stable@vger.kernel.org
Signed-off-by: Sangyun Kim <sangyun.kim@snu.ac.kr>
Signed-off-by: Jiri Kosina <jkosina@suse.com>
2026-05-12 17:57:35 +02:00
T.J. Mercier
cac61b58a3 HID: playstation: Clamp num_touch_reports
A device would never lie about the number of touch reports would it?

If it does the loop in dualshock4_parse_report will read off the end of
the touch_reports array, up to about 2 KiB for the maximum number of 256
loop iteraions. The data that is read is emitted via evdev if the
DS4_TOUCH_POINT_INACTIVE bit happens to be set. Protect against this by
clamping the num_touch_reports value provided by the device to the
maximum size of the touch_reports array.

Fixes: 7520382488 ("HID: playstation: add DualShock4 touchpad support.")
Cc: stable@vger.kernel.org
Reported-by: Xingyu Jin <xingyuj@google.com>
Signed-off-by: T.J. Mercier <tjmercier@google.com>
Signed-off-by: Jiri Kosina <jkosina@suse.com>
2026-05-12 17:54:48 +02:00
Lee Jones
d93ba918a1 HID: magicmouse: Prevent out-of-bounds (OOB) read during DOUBLE_REPORT_ID
It is currently possible for a malicious or misconfigured USB device to
cause an out-of-bounds (OOB) read when submitting reports using
DOUBLE_REPORT_ID by specifying a large report length and providing a
smaller one.

Let's prevent that by comparing the specified report length with the
actual size of the data read in from userspace.  If the actual data
length ends up being smaller than specified, we'll politely warn the
user and prevent any further processing.

Signed-off-by: Lee Jones <lee@kernel.org>
Reviewed-by: Günther Noack <gnoack@google.com>
Signed-off-by: Jiri Kosina <jkosina@suse.com>
2026-05-12 17:49:18 +02:00
Florian Pradines
f097d24667 HID: mcp2221: fix OOB write in mcp2221_raw_event()
mcp2221_raw_event() copies device-supplied data into mcp->rxbuf at
offset rxbuf_idx without checking that the copy fits within the
destination buffer. A device responding with up to 60 bytes to a
small I2C/SMBus read can overflow the buffer.

Add a rxbuf_size field to struct mcp2221, set it alongside rxbuf in
mcp_i2c_smbus_read(), and check rxbuf_idx + data[3] <= rxbuf_size
before the memcpy.

Reported-by: Benoît Sevens <bsevens@google.com>
Signed-off-by: Florian Pradines <florian.pradines@gmail.com>
Signed-off-by: Jiri Kosina <jkosina@suse.com>
2026-05-12 17:48:16 +02:00
Lukas Bulwahn
5f90dcfa8d HID: quirks: really enable the intended work around for appledisplay
Commit c7fabe4ad9 ("HID: quirks: work around VID/PID conflict for
appledisplay") intends to add a quirk for kernels built with Apple Cinema
Display support, but it refers to the non-existing config option
CONFIG_APPLEDISPLAY, whereas the config option for Apple Cinema Display
support is named CONFIG_USB_APPLEDISPLAY.

Refer to the intended config option CONFIG_USB_APPLEDISPLAY in the ifdef
directive.

Fixes: c7fabe4ad9 ("HID: quirks: work around VID/PID conflict for appledisplay")
Signed-off-by: Lukas Bulwahn <lukas.bulwahn@redhat.com>
Signed-off-by: Jiri Kosina <jkosina@suse.com>
2026-05-12 17:23:59 +02:00
Oliver Neukum
17ee873dba HID: hid-sjoy: race between init and usage
The driver uses an initial IO to set the device to a default
state. That initialization is currently being done after the device
node has been created. That means that the single buffer used
for output can be altered while IO is in progress.
Move the intialization before announcement to user space.

Fixes: fac733f029 ("HID: force feedback support for SmartJoy PLUS PS2/USB adapter")
Signed-off-by: Oliver Neukum <oneukum@suse.com>
Signed-off-by: Jiri Kosina <jkosina@suse.com>
2026-05-12 17:23:08 +02:00
Takashi Iwai
4873592845 HID: uclogic: Fix regression of input name assignment
The previous fix for adding the devm_kasprintf() return check in the
commit bd07f75120 ("HID: uclogic: Add NULL check in
uclogic_input_configured()") changed the condition of hi->input->name
assignment, and it resulted in missing the proper input device name
when no custom suffix is defined.

Restore the conditional to the original content to address the
regression.

Fixes: bd07f75120 ("HID: uclogic: Add NULL check in uclogic_input_configured()")
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Jiri Kosina <jkosina@suse.com>
2026-04-28 18:37:01 +02:00
Dan Carpenter
ae4ac07733 HID: intel-thc-hid: Intel-quickspi: Fix some error codes
If we have a partial read that is supposed to be treated as failure but
in this code we forgot to set the error code.  Return -EINVAL.

Fixes: 9d8d51735a ("HID: intel-thc-hid: intel-quickspi: Add HIDSPI protocol implementation")
Signed-off-by: Dan Carpenter <error27@gmail.com>
Reviewed-by: Even Xu <even.xu@intel.com>
Reviewed-by: Mark Pearson <mpearson-lenovo@squebb.ca>
Signed-off-by: Jiri Kosina <jkosina@suse.com>
2026-04-28 18:35:29 +02:00
Matthew Schwartz
3524900cc5 HID: hid-lenovo-go-s: restore OS_TYPE after resume from s2idle
The controller MCU does not persist OS_TYPE across power cycles. During
s2idle resume, the USB device may be power-cycled, causing the OS_TYPE
setting to revert to the default Windows value.

Add a reset_resume callback so that this is correctly restored after
resume.

Fixes: a23f3497bf ("HID: hid-lenovo-go-s: Add Lenovo Legion Go S Series HID Driver")
Reviewed-by: Derek J. Clark <derekjohn.clark@gmail.com>
Signed-off-by: Matthew Schwartz <matthew.schwartz@linux.dev>
Signed-off-by: Jiri Kosina <jkosina@suse.com>
2026-04-28 18:34:21 +02:00
Damien Dejean
55ce185884 HID: elan: Add support for ELAN SB974D touchpad
Elan SB974D touchpad uses ELAN_MT_I2C format to send HID reports. Add an
entry to match for the device and parse its vendor specific format.

Signed-off-by: Damien Dejean <damiendejean@google.com>
Signed-off-by: Kornel Dulęba <korneld@google.com>
Signed-off-by: Jiri Kosina <jkosina@suse.com>
2026-04-28 18:30:02 +02:00
Rosalie Wanders
12bd440b66 HID: sony: add missing size validation for Rock Band 3 Pro instruments
This commit adds the missing size validation for Rock Band 3 PS3 Pro
instruments in sony_raw_event(), this prevents a malicious device from
allowing hid-sony to read out of bounds of the provided buffer.

Signed-off-by: Rosalie Wanders <rosalie@mailbox.org>
Signed-off-by: Jiri Kosina <jkosina@suse.com>
2026-04-28 18:28:32 +02:00
Rosalie Wanders
a4170b63ed HID: sony: add missing size validation for SMK-Link remotes
This commit adds the missing size validation for SMK-Link remotes in
sony_raw_event(), this prevents a malicious device from allowing
hid-sony to read out of bounds of the provided buffer.

I do not own these devices so the size check only forces that the buffer
is large enough for nsg_mrxu_parse_report().

Signed-off-by: Rosalie Wanders <rosalie@mailbox.org>
Signed-off-by: Jiri Kosina <jkosina@suse.com>
2026-04-28 18:27:26 +02:00
Rosalie Wanders
0f2b8466fb HID: sony: remove unneeded WARN_ON() in sony_leds_init()
This commit removes the unneeded WARN_ON() macro usage in
sony_leds_init(), this is unneeded because the sony_leds_init() function
call is already gated behind a SONY_LED_SUPPORT check in
sony_input_configured()

Signed-off-by: Rosalie Wanders <rosalie@mailbox.org>
Signed-off-by: Jiri Kosina <jkosina@suse.com>
2026-04-28 18:25:41 +02:00
Michael Zaidman
80c4bbb2b3 HID: ft260: validate i2c input report length
Add two checks to ft260_raw_event() to prevent out-of-bounds reads
from malicious or malfunctioning devices:

First, reject reports shorter than the 2-byte header (report ID +
length fields). Without this, even accessing xfer->length on a
1-byte report is an OOB read.

Second, validate xfer->length against the actual data capacity of
the received HID report. Each I2C data report ID (0xD0 through
0xDE) defines a different report size in the HID descriptor, so the
available payload varies per report. A corrupted length field could
cause memcpy to read beyond the report buffer.

Reported-by: Sebastián Josué Alba Vives <sebasjosue84@gmail.com>
Signed-off-by: Michael Zaidman <michael.zaidman@gmail.com>
Signed-off-by: Jiri Kosina <jkosina@suse.com>
2026-04-28 18:24:52 +02:00
Rosalie Wanders
278dd04879 HID: sony: fix incorrect force-feedback check in sony_suspend()
This commit fixes the incorrect force-feedback check in sony_suspend(),
without this the check will always be true due to checking a constant
define that is never 0.

Signed-off-by: Rosalie Wanders <rosalie@mailbox.org>
Signed-off-by: Jiri Kosina <jkosina@suse.com>
2026-04-28 18:22:59 +02:00
Linus Torvalds
d97e7d7c30 hid-for-linus-2026041601
-----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCAAdFiEEL65usyKPHcrRDEicpmLzj2vtYEkFAmnhNL4ACgkQpmLzj2vt
 YEmEyQ/+LTJ8CLjONWfamsF2XK2vcOWa9E41ot9vnaUZon4IKbGSFzpKxLGWO3zu
 gnu0wKvRtK4NZwN/T2M24pOgfAMzYh9YZ5oP4kdo3ZrJnw9GcBriY0KF1D10N+Ij
 qMz/8rzhOjM6GkINYZfR6iX3/vstFpavuVcHru2TBN5IPNTWOVS5ALAAp2WjRN7c
 da8XazEzk+xt2z7/Iv6t2Y/Bi826CS16vuXjYa5/2wM7kRH/y+It35MpwXK/KHol
 Foeor166Q2b6LPpvavusf1A6YWvagPyDvWvJssWw5Mi3heyq9YeOU0qZApJmTVRz
 neS9NYUFaZ+1YuZ/vRkJuvbqH9M6xYHXYXatXBmUJK2V18wHgD9X/Et4Crud8mmj
 thw3WNLWOCl5rtOQ3rKjy/o/QQfsjNHeb9XBfF4lmyY6ASeXQcJmVEK/XEQGVSJr
 71v7Q8ONFHgw44WJbIPeZcWRqcVGgnH08s/aQS890tZUyMBHAOzUqbNX5pBWlfnf
 btSMdK4KNikldgKBxZXQfIFRq8gpHjMVUfzhdGQ+IiZAqjipEipjlz/uS432oybR
 Nhukw8Lfr+LlwRvfzeCdV7/2qqLER+LFfJP8Q1jPb0fa/ET3A36Mwrd1ew3lMcLm
 +24BUDNUhcKSUMIMEeHZKnbW3/UnuRu8EMh0htdviB+08hKW9z4=
 =w455
 -----END PGP SIGNATURE-----

Merge tag 'hid-for-linus-2026041601' of git://git.kernel.org/pub/scm/linux/kernel/git/hid/hid

Pull HID updates from Jiri Kosina:
 "Core:
   - fixed handling of 0-sized reports (Dmitry Torokhov)
   - convert core code to __free() (Dmitry Torokhov)
   - support for multiple batteries per HID device (Lucas Zampieri)

  Drivers:
   - support for rumble effects in winwing driver (Ivan Gorinov)
   - new support for a variety of Sony Rock Band and Sony DJ Hero
     Turntable devices (Rosalie Wanders)
   - new driver for Lenovo Legion Go / S devices (Derek J. Clark)
   - power management improvements to intel-thc-hid driver (Even Xu)

  ... other assorted cleanups, fixes and device-specific quirks"

* tag 'hid-for-linus-2026041601' of git://git.kernel.org/pub/scm/linux/kernel/git/hid/hid: (73 commits)
  HID: core: clamp report_size in s32ton() to avoid undefined shift
  HID: logitech-dj: fix wrong detection of bad DJ_SHORT output report
  HID: logitech-hidpp: fix race condition when accessing stale stack pointer
  HID: winwing: Enable rumble effects
  HID: core: do not allow parsing 0-sized reports
  HID: usbhid: refactor endpoint lookup
  HID: huawei: fix CD30 keyboard report descriptor issue
  HID: playstation: validate num_touch_reports in DualShock 4 reports
  HID: drop 'default !EXPERT' from tristate symbols
  HID: usbhid: fix deadlock in hid_post_reset()
  HID: apple: ensure the keyboard backlight is off if suspending
  HID: quirks: Set ALWAYS_POLL for LOGITECH_BOLT_RECEIVER
  HID: alps: fix NULL pointer dereference in alps_raw_event()
  HID: logitech-dj: Prevent REPORT_ID_DJ_SHORT related user initiated OOB write
  HID: logitech-dj: Standardise hid_report_enum variable nomenclature
  HID: sony: update module description
  HID: logitech-hidpp: Check bounds when deleting force-feedback effects
  HID: sony: add battery status support for Rock Band 4 PS5 guitars
  HID: sony: fix style issues
  HID: quirks: update hid-sony supported devices
  ...
2026-04-17 11:24:00 -07:00
Linus Torvalds
87768582a4 dma-mapping updates for Linux 7.0:
- added support for batched cache sync, what improves performance of
   dma_map/unmap_sg() operations on ARM64 architecture (Barry Song)
 
 - introduced DMA_ATTR_CC_SHARED attribute for explicitly shared memory
   used in confidential computing (Jiri Pirko)
 
 - refactored spaghetti-like code in drivers/of/of_reserved_mem.c and its
   clients (Marek Szyprowski, shared branch with device-tree updates to
   avoid merge conflicts)
 
 - prepared Contiguous Memory Allocator related code for making dma-buf
   drivers modularized (Maxime Ripard)
 
 - added support for benchmarking dma_map_sg() calls to tools/dma utility
   (Qinxin Xia)
 -----BEGIN PGP SIGNATURE-----
 
 iHUEABYIAB0WIQSrngzkoBtlA8uaaJ+Jp1EFxbsSRAUCaeCbdQAKCRCJp1EFxbsS
 RHbWAQCt70dzrU0lu0omTR1HdDP4GTYfuM6nZR91e8/itGN1+QD/XH4I/0wuybzk
 v5uxbIC6lR3abQRc3YNRXfi+i5j26A4=
 =Oee2
 -----END PGP SIGNATURE-----

Merge tag 'dma-mapping-7.1-2026-04-16' of git://git.kernel.org/pub/scm/linux/kernel/git/mszyprowski/linux

Pull dma-mapping updates from Marek Szyprowski:

 - added support for batched cache sync, what improves performance of
   dma_map/unmap_sg() operations on ARM64 architecture (Barry Song)

 - introduced DMA_ATTR_CC_SHARED attribute for explicitly shared memory
   used in confidential computing (Jiri Pirko)

 - refactored spaghetti-like code in drivers/of/of_reserved_mem.c and
   its clients (Marek Szyprowski, shared branch with device-tree updates
   to avoid merge conflicts)

 - prepared Contiguous Memory Allocator related code for making dma-buf
   drivers modularized (Maxime Ripard)

 - added support for benchmarking dma_map_sg() calls to tools/dma
   utility (Qinxin Xia)

* tag 'dma-mapping-7.1-2026-04-16' of git://git.kernel.org/pub/scm/linux/kernel/git/mszyprowski/linux: (24 commits)
  dma-buf: heaps: system: document system_cc_shared heap
  dma-buf: heaps: system: add system_cc_shared heap for explicitly shared memory
  dma-mapping: introduce DMA_ATTR_CC_SHARED for shared memory
  mm: cma: Export cma_alloc(), cma_release() and cma_get_name()
  dma: contiguous: Export dev_get_cma_area()
  dma: contiguous: Make dma_contiguous_default_area static
  dma: contiguous: Make dev_get_cma_area() a proper function
  dma: contiguous: Turn heap registration logic around
  of: reserved_mem: rework fdt_init_reserved_mem_node()
  of: reserved_mem: clarify fdt_scan_reserved_mem*() functions
  of: reserved_mem: rearrange code a bit
  of: reserved_mem: replace CMA quirks by generic methods
  of: reserved_mem: switch to ops based OF_DECLARE()
  of: reserved_mem: use -ENODEV instead of -ENOENT
  of: reserved_mem: remove fdt node from the structure
  dma-mapping: fix false kernel-doc comment marker
  dma-mapping: Support batch mode for dma_direct_{map,unmap}_sg
  dma-mapping: Separate DMA sync issuing and completion waiting
  arm64: Provide dcache_inval_poc_nosync helper
  arm64: Provide dcache_clean_poc_nosync helper
  ...
2026-04-17 11:12:42 -07:00
Linus Torvalds
d662a710c6 dmaengine updates for v7.1
Core:
   - New devm_of_dma_controller_register() API
 
  New Support:
   - Support for RZ/G3L SoC
   - Loongson Multi-Channel DMA controller support
   - Conversion of Xilinx AXI DMA binding
   - DW AXI CV1800B DMA support
   - Switchtec DMA engine driver
 
  Updates:
   - AMD MDB Endpoint and non-LL mode support
   - DW edma virtual IRQ for interrupt-emulation, cyclic transfers support
 -----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCgAdFiEE+vs47OPLdNbVcHzyfBQHDyUjg0cFAmnh8XgACgkQfBQHDyUj
 g0e7WQ//d6UvT8cv+2OUtbM3I3OeqhiHJvTYvuLLWkxG1vm5vCj3h8gvaeI+2GiP
 dN6UhKTMZz0fn3lacCaYBDL3ebR2P3z9HuXPljz5kxr+akM58r9ehevbzY0Vgivg
 jh+zw/sNYAv1Cwld75jglPaBotS2Qmne3a28WIioeGSp1QqO2veWRqFOFzL2P6Fc
 EEWGB45UkgrKp4tiG8GZf3plOFu+S46oYOAsRyT26IkS/DxNlEXbLaI62XBThr5Z
 4q1xJ0wLJRzFt9fMyBJ3Uz/pPui1TXb8R1060Vx1TPXgKF0g2qtMLmEoJ1rw1u4t
 8w49po1YvDHV7NuC6ZuXdQTb7J9X8+q5/IyK3794pKKz+2jM1CS3FN6Z0VEYvvQQ
 nhFnLAvtW0ziKL1+U3P9FJnI7ztbgMpltvQ3NGuNC0bp3JMoOaVcMr01M7sMMzpl
 gX0qtWZO94jTO5dYjFvLUQU9HtM1rG/3p7o99RtGfe1EKudF7w209LLYC5g6OSm/
 s2I4MNOirViKUhweEU2PbFxTgaPWbIlp/UewEvKQrnmxmikgzzYDVoMTjq8fGt3X
 uyxaAudFBMVWrAHlk3RLjTgYew8njqahjNzTR05atWLRpawbULQKHKHW1UFuxJTI
 apsjbbrlZCT4tIyYZT0XSt3KzEtB+4KwYMBzV2S5b0q0DQuvGJQ=
 =uoUT
 -----END PGP SIGNATURE-----

Merge tag 'dmaengine-7.1-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/vkoul/dmaengine

Pull dmaengine updates from Vinod Koul:
 "Core:
   - New devm_of_dma_controller_register() API

  New Support:
   - Support for RZ/G3L SoC
   - Loongson Multi-Channel DMA controller support
   - Conversion of Xilinx AXI DMA binding
   - DW AXI CV1800B DMA support
   - Switchtec DMA engine driver

  Updates:
   - AMD MDB Endpoint and non-LL mode support
   - DW edma virtual IRQ for interrupt-emulation, cyclic transfers support"

* tag 'dmaengine-7.1-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/vkoul/dmaengine: (65 commits)
  dmaengine: dw-edma: Add non-LL mode
  dmaengine: dw-edma: Add AMD MDB Endpoint Support
  dt-bindings: dmaengine: Fix spelling mistake "Looongson" -> "Looogson"
  dmaengine: loongson: Fix spelling mistake "Looongson" -> "Looogson"
  dmaengine: loongson: New driver for the Loongson Multi-Channel DMA controller
  dt-bindings: dmaengine: Add Loongson Multi-Channel DMA controller
  dmaengine: loongson: loongson2-apb: Simplify locking with guard() and scoped_guard()
  dmaengine: loongson: loongson2-apb: Convert to devm_clk_get_enabled()
  dmaengine: loongson: loongson2-apb: Convert to dmaenginem_async_device_register()
  dmaengine: loongson: New directory for Loongson DMA controllers drivers
  dt-bindings: dma: xlnx,axi-dma: Convert to DT schema
  dt-bindings: dma: rz-dmac: Add conditional schema for RZ/G3L
  dmaengine: sh: rz-dmac: Add device_{pause,resume}() callbacks
  dmaengine: sh: rz-dmac: Add device_tx_status() callback
  dmaengine: sh: rz-dmac: Use rz_lmdesc_setup() to invalidate descriptors
  dmaengine: sh: rz-dmac: Drop unnecessary local_irq_save() call
  dmaengine: sh: rz-dmac: Drop goto instruction and label
  dmaengine: sh: rz-dmac: Drop read of CHCTRL register
  dmaengine: sh: rz_dmac: add RZ/{T2H,N2H} support
  dt-bindings: dma: renesas,rz-dmac: document RZ/{T2H,N2H}
  ...
2026-04-17 10:29:01 -07:00
Linus Torvalds
3f887edd35 phy-for-7.1
- New Support
   - Qualcomm Eliza QMP UFS PHY
   - Canaan K230 USB 2.0 PHY driver
   - Mediatek mt8167 dsi-phy
   - Eswin EIC7700 SATA PHY driver
 
 - Updates
   - Sorted subsytem Makefile/Kconfig and some kernel-doc udpates
 -----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCgAdFiEE+vs47OPLdNbVcHzyfBQHDyUjg0cFAmnh4msACgkQfBQHDyUj
 g0ctew/+K/rVLCUu/UgbvnV1hPH3q/OCytwcymurSp5+lZ2TGsHcwjzGNKrGxCAp
 nxgzffHwukyuRGq/FHDc1QQa+i5bDzf6dlE3CuZYnZWka8mxbqcBetMQvLb93LXL
 9MEQ8YQgjh96AyX87sP0r5IhBVLl3LiGHj2+L6VXoTzMsJeqT6Kx2rABHgFjXM97
 gjurp1PbHwi2EGQowa9zjsoQnRnN2C4O2xlZsXeNljzS2KPpToQ+sjADwHSau8nw
 b9idowJlJMlN+RFrNKJWgja7ro/E17IGQptJT9Hz89j2dXg0QiWIY/uok25o6XAn
 h0yYWpXP6gaQH1mnpS5Meb8d+ljTL4SNLv/64pYSGPzqXUbuJXVx2Rn7ZBuB3R/H
 +pmVbrdWSUwhXcgXDyVCMLguhCxns4M/SmaYrjVayrogDiz9gqHlGMTfsSmYCnbI
 UDqHyFSa6HRZIFnba0pBkb3eyrKE9qMK0FFgQURQp8GCOJu8waeNyCZ4fTCjXo6v
 MULhauFWDC267LNogt6KGgTC6sFmsitsI8jymMQGfb3g6FdhJUFpQLmNvwYpoHXH
 AofeTHrzdXWRVNiVKO01J2tPskVCczx5R5q5dfDGTM0mIRXMaHCuzT2RNdRmBpNk
 rgBlCvIiiE9VbusN+zybPQfTJAQa2eVMTvBRzjwkdLUYeMUJS0I=
 =qz0Z
 -----END PGP SIGNATURE-----

Merge tag 'phy-for-7.1' of git://git.kernel.org/pub/scm/linux/kernel/git/phy/linux-phy

Pull phy updates from Vinod Koul:
 "New Support:
   - Qualcomm Eliza QMP UFS PHY
   - Canaan K230 USB 2.0 PHY driver
   - Mediatek mt8167 dsi-phy
   - Eswin EIC7700 SATA PHY driver

  Updates:
   - Sorted subsytem Makefile/Kconfig and some kernel-doc udpates"

* tag 'phy-for-7.1' of git://git.kernel.org/pub/scm/linux/kernel/git/phy/linux-phy:
  dt-bindings: phy: qcom,sc8280xp-qmp-ufs-phy: document the Eliza QMP UFS PHY
  phy: qcom: m31-eusb2: clear PLL_EN during init
  phy: eswin: Create eswin directory and add EIC7700 SATA PHY driver
  dt-bindings: phy: eswin: Document the EIC7700 SoC SATA PHY
  phy: apple: apple: Use local variable for ioremap return value
  phy: qcom: qmp-usbc: Simplify check for non-NULL pointer
  phy: marvell: mmp3-hsic: Avoid re-casting __iomem
  phy: apple: atc: Make atcphy_dwc3_reset_ops variable static
  dt-bindings: phy: mediatek,dsi-phy: Add support for mt8167
  phy: usb: Add driver for Canaan K230 USB 2.0 PHY
  dt-bindings: phy: Add Canaan K230 USB PHY
  phy: phy-mtk-tphy: Update names and format of kernel-doc comments
  phy: Sort the subsystem Kconfig
  phy: Sort the subsystem Makefile
  phy: move spacemit pcie driver to its subfolder
2026-04-17 10:22:08 -07:00
Linus Torvalds
65bec0c4ea soundwire updates for 7.1
- Core: DP prepare polling for avoiding interrupt deadlock
  - AMD clock init and bandwidth refactoring
  - Intel more codecs to wake list, clear message on before signaling waiting thread
 -----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCgAdFiEE+vs47OPLdNbVcHzyfBQHDyUjg0cFAmnh3twACgkQfBQHDyUj
 g0eZwhAApdSFRhk43yNAMWr33Vxb+IFjRylNaJb6h5IWS7+0Z3yfq6zOuM3tW7Yh
 C9804L0RkncHwq6th0T5pi3neAwm/dVi1zmnzXiAe5Kgzl/Eru4ZNMh59VD8aNwQ
 K/emES6AJR6ulezYHNDE5Y74kjQHzMQUWiUo1DoAapoqr+WnZvfK+ZYAYh7I/ctY
 FxzBxx13yIHInDHsl3WQ+r1CSinDEe3RiQHW5+5DWdmmw8LfHLGUBBFIJQcVxRN/
 8NlNYr1wvRxUij11cZMPc3TetPfSsIGFpa7eOKezX1P9GxwY7qWvPvPmO0kzgLvH
 AsbFXOHZKYbtPy87agF1QdGq0Seym9x6OhNFucXs1yXIk1t/isv9bOrrOOmnSbR2
 U3ycbMCUmJEUKhd7MWPWRaFUCEM2j/CRugFwpIbeE7AgJ5hZIUXlfWykDdlFxDTM
 e9IQ1jMTSnwyXs705FLLF3hxjIIAWS1kHIgEPWrxuSkAD9/Xx6sbD2fca7Ca6qrm
 W90TlprDAj/KiisEvje0tjEfZ8fTUanLC67d2sbxtrpzwpus4u8GzD62RAgsLlYP
 y9qGeAE1I5FMtJB83dewiYPCIofoez4DizM5wemojI+TtmvZwEWYfeXievD3ibad
 xN3uXtX6fqZ6BWUVIaxjdhSEB2FYdaZjTWPSmcUIwKlApOso0dY=
 =0cvn
 -----END PGP SIGNATURE-----

Merge tag 'soundwire-7.1-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/vkoul/soundwire

Pull soundwire updates from Vinod Koul:

 - Core: DP prepare polling for avoiding interrupt deadlock

 - AMD clock init and bandwidth refactoring

 - Intel more codecs to wake list, clear message on before signaling
   waiting thread

* tag 'soundwire-7.1-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/vkoul/soundwire:
  soundwire: intel_auxdevice: Add cs42l49 to wake_capable_list
  soundwire: cadence: Clear message complete before signaling waiting thread
  soundwire: Intel: test bus.bpt_stream before assigning it
  soundwire: bus: demote UNATTACHED state warnings to dev_dbg()
  soundwire: stream: Poll for DP prepare to avoid interrupt deadlock
  soundwire: amd: refactor bandwidth calculation logic
  soundwire: amd: add clock init control function
  soundwire: intel_auxdevice: Add CS47L47 to wake_capable_list
  soundwire: slave: Don't register devices that are disabled in ACPI
  soundwire: sdw.h: repair names and format of kernel-doc comments
2026-04-17 10:16:53 -07:00
Linus Torvalds
0b6bc3dbe6 tracing latency updates for 7.1:
- Add TIMERLAT_ALIGN osnoise option
 
   Add a timer alignment option for timerlat that makes it work like the
   cyclictest -A option. timelat creates threads to test the latency of the
   kernel. The alignment option will have these threads trigger at the
   alignment offsets from each other. Instead of having each thread wake up
   at the exact same time, if the alignment is set to "20" each thread will
   wake up at 20 microseconds from the previous one.
 -----BEGIN PGP SIGNATURE-----
 
 iIoEABYKADIWIQRRSw7ePDh/lE+zeZMp5XQQmuv6qgUCaeIBaBQccm9zdGVkdEBn
 b29kbWlzLm9yZwAKCRAp5XQQmuv6qqM8AQCyz4uL1lCLQtJb5thG8V9QFRkYh5F3
 +DyuRNoht3ijyAD+K4nZPAu4F09feWuHkssONtSZECKEuN6EhiHE4XX6Pgc=
 =WYYW
 -----END PGP SIGNATURE-----

Merge tag 'trace-latency-v7.1' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace

Pull tracing latency update from Steven Rostedt:

 - Add TIMERLAT_ALIGN osnoise option

   Add a timer alignment option for timerlat that makes it work like the
   cyclictest -A option. timelat creates threads to test the latency of
   the kernel. The alignment option will have these threads trigger at
   the alignment offsets from each other. Instead of having each thread
   wake up at the exact same time, if the alignment is set to "20" each
   thread will wake up at 20 microseconds from the previous one.

* tag 'trace-latency-v7.1' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace:
  tracing/osnoise: Add option to align tlat threads
2026-04-17 10:12:11 -07:00
Linus Torvalds
cb30bf881c tracing updates for v7.1:
- Fix printf format warning for bprintf
 
   sunrpc uses a trace_printk() that triggers a printf warning during the
   compile. Move the __printf() attribute around for when debugging is not
   enabled the warning will go away.
 
 - Remove redundant check for EVENT_FILE_FL_FREED in event_filter_write()
 
   The FREED flag is checked in the call to event_file_file() and then
   checked again right afterward, which is unneeded.
 
 - Clean up event_file_file() and event_file_data() helpers
 
   These helper functions played a different role in the past, but now with
   eventfs, the READ_ONCE() isn't needed. Simplify the code a bit and also
   add a warning to event_file_data() if the file or its data is not present.
 
 - Remove updating file->private_data in tracing open
 
   All access to the file private data is handled by the helper functions,
   which do not use file->private_data. Stop updating it on open.
 
 - Show ENUM names in function arguments via BTF in function tracing
 
   When showing the function arguments when func-args option is set for
   function tracing, if one of the arguments is found to be an enum, show the
   name of the enum instead of its number.
 
 - Add new trace_call__##name() API for tracepoints
 
   Tracepoints are enabled via static_branch() blocks, where when not
   enabled, there's only a nop that is in the code where the execution will
   just skip over it. When tracing is enabled, the nop is converted to a
   direct jump to the tracepoint code. Sometimes more calculations are
   required to be performed to update the parameters of the tracepoint. In
   this case, trace_##name##_enabled() is called which is a static_branch()
   that gets enabled only when the tracepoint is enabled. This allows the
   extra calculations to also be skipped by the nop:
 
   if (trace_foo_enabled()) {
       x = bar();
       trace_foo(x);
   }
 
   Where the x=bar() is only performed when foo is enabled. The problem with
   this approach is that there's now two static_branch() calls. One for
   checking if the tracepoint is enabled, and then again to know if the
   tracepoint should be called. The second one is redundant.
 
   Introduce trace_call__foo() that will call the foo() tracepoint directly
   without doing a static_branch():
 
   if (trace_foo_enabled()) {
       x = bar();
       trace_call__foo();
   }
 
 - Update various locations to use the new trace_call__##name() API
 
 - Move snapshot code out of trace.c
 
   Cleaning up trace.c to not be a "dump all", move the snapshot code out of
   it and into a new trace_snapshot.c file.
 
 - Clean up some "%*.s" to "%*s"
 
 - Allow boot kernel command line options to be called multiple times
 
   Have options like:
 
     ftrace_filter=foo ftrace_filter=bar ftrace_filter=zoo
 
   Equal to:
 
     ftrace_filter=foo,bar,zoo
 
 - Fix ipi_raise event CPU field to be a CPU field
 
   The ipi_raise target_cpus field is defined as a __bitmask(). There is now a
   __cpumask() field definition. Update the field to use that.
 
 - Have hist_field_name() use a snprintf() and not a series of strcat()
 
   It's safer to use snprintf() that a series of strcat().
 
 - Fix tracepoint regfunc balancing
 
   A tracepoint can define a "reg" and "unreg" function that gets called
   before the tracepoint is enabled, and after it is disabled respectively.
   But on error, after the "reg" func is called and the tracepoint is not
   enabled, the "unreg" function is not called to tear down what the "reg"
   function performed.
 
 - Fix output that shows what histograms are enabled
 
   Event variables are displayed incorrectly in the histogram output.
 
   Instead of "sched.sched_wakeup.$var", it is showing
   "$sched.sched_wakeup.var" where the '$' is in the incorrect location.
 
 - Some other simple cleanups.
 -----BEGIN PGP SIGNATURE-----
 
 iIoEABYKADIWIQRRSw7ePDh/lE+zeZMp5XQQmuv6qgUCaeCpvxQccm9zdGVkdEBn
 b29kbWlzLm9yZwAKCRAp5XQQmuv6qt2WAP44m85BbAjBqJe4WR103eOXV+bREBta
 dRoReKJOMe519gEAp0rK/HoCvHgHhIGe3gaGdIsNhnaxoFyNWMG/wokoLAY=
 =Hg6+
 -----END PGP SIGNATURE-----

Merge tag 'trace-v7.1' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace

Pull tracing updates from Steven Rostedt:

 - Fix printf format warning for bprintf

   sunrpc uses a trace_printk() that triggers a printf warning during
   the compile. Move the __printf() attribute around for when debugging
   is not enabled the warning will go away

 - Remove redundant check for EVENT_FILE_FL_FREED in
   event_filter_write()

   The FREED flag is checked in the call to event_file_file() and then
   checked again right afterward, which is unneeded

 - Clean up event_file_file() and event_file_data() helpers

   These helper functions played a different role in the past, but now
   with eventfs, the READ_ONCE() isn't needed. Simplify the code a bit
   and also add a warning to event_file_data() if the file or its data
   is not present

 - Remove updating file->private_data in tracing open

   All access to the file private data is handled by the helper
   functions, which do not use file->private_data. Stop updating it on
   open

 - Show ENUM names in function arguments via BTF in function tracing

   When showing the function arguments when func-args option is set for
   function tracing, if one of the arguments is found to be an enum,
   show the name of the enum instead of its number

 - Add new trace_call__##name() API for tracepoints

   Tracepoints are enabled via static_branch() blocks, where when not
   enabled, there's only a nop that is in the code where the execution
   will just skip over it. When tracing is enabled, the nop is converted
   to a direct jump to the tracepoint code. Sometimes more calculations
   are required to be performed to update the parameters of the
   tracepoint. In this case, trace_##name##_enabled() is called which is
   a static_branch() that gets enabled only when the tracepoint is
   enabled. This allows the extra calculations to also be skipped by the
   nop:

	if (trace_foo_enabled()) {
		x = bar();
		trace_foo(x);
	}

   Where the x=bar() is only performed when foo is enabled. The problem
   with this approach is that there's now two static_branch() calls. One
   for checking if the tracepoint is enabled, and then again to know if
   the tracepoint should be called. The second one is redundant

   Introduce trace_call__foo() that will call the foo() tracepoint
   directly without doing a static_branch():

	if (trace_foo_enabled()) {
		x = bar();
		trace_call__foo();
	}

 - Update various locations to use the new trace_call__##name() API

 - Move snapshot code out of trace.c

   Cleaning up trace.c to not be a "dump all", move the snapshot code
   out of it and into a new trace_snapshot.c file

 - Clean up some "%*.s" to "%*s"

 - Allow boot kernel command line options to be called multiple times

   Have options like:

	ftrace_filter=foo ftrace_filter=bar ftrace_filter=zoo

   Equal to:

	ftrace_filter=foo,bar,zoo

 - Fix ipi_raise event CPU field to be a CPU field

   The ipi_raise target_cpus field is defined as a __bitmask(). There is
   now a __cpumask() field definition. Update the field to use that

 - Have hist_field_name() use a snprintf() and not a series of strcat()

   It's safer to use snprintf() that a series of strcat()

 - Fix tracepoint regfunc balancing

   A tracepoint can define a "reg" and "unreg" function that gets called
   before the tracepoint is enabled, and after it is disabled
   respectively. But on error, after the "reg" func is called and the
   tracepoint is not enabled, the "unreg" function is not called to tear
   down what the "reg" function performed

 - Fix output that shows what histograms are enabled

   Event variables are displayed incorrectly in the histogram output

   Instead of "sched.sched_wakeup.$var", it is showing
   "$sched.sched_wakeup.var" where the '$' is in the incorrect location

 - Some other simple cleanups

* tag 'trace-v7.1' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace: (24 commits)
  selftests/ftrace: Add test case for fully-qualified variable references
  tracing: Fix fully-qualified variable reference printing in histograms
  tracepoint: balance regfunc() on func_add() failure in tracepoint_add_func()
  tracing: Rebuild full_name on each hist_field_name() call
  tracing: Report ipi_raise target CPUs as cpumask
  tracing: Remove duplicate latency_fsnotify() stub
  tracing: Preserve repeated trace_trigger boot parameters
  tracing: Append repeated boot-time tracing parameters
  tracing: Remove spurious default precision from show_event_trigger/filter formats
  cpufreq: Use trace_call__##name() at guarded tracepoint call sites
  tracing: Remove tracing_alloc_snapshot() when snapshot isn't defined
  tracing: Move snapshot code out of trace.c and into trace_snapshot.c
  mm: damon: Use trace_call__##name() at guarded tracepoint call sites
  btrfs: Use trace_call__##name() at guarded tracepoint call sites
  spi: Use trace_call__##name() at guarded tracepoint call sites
  i2c: Use trace_call__##name() at guarded tracepoint call sites
  kernel: Use trace_call__##name() at guarded tracepoint call sites
  tracepoint: Add trace_call__##name() API
  tracing: trace_mmap.h: fix a kernel-doc warning
  tracing: Pretty-print enum parameters in function arguments
  ...
2026-04-17 09:43:12 -07:00
Linus Torvalds
c9e03d5948 Probes updates for v7.1
- fprobe: do not zero out unused fgraph_data. This removes unneeded
   memset of fgraph_data in fprobe entry handler.
 -----BEGIN PGP SIGNATURE-----
 
 iQFPBAABCgA5FiEEh7BulGwFlgAOi5DV2/sHvwUrPxsFAmnhhjEbHG1hc2FtaS5o
 aXJhbWF0c3VAZ21haWwuY29tAAoJENv7B78FKz8bfBMH/21EM4dL2oDrsR3Ud7G+
 R1LYB959jkztJlIKQ9xGBdUpyMd97JYszknpTG4QHb7XW4FrcvZMiHeT9AW6ZBzw
 zJkWVbSCst7sNYpjmqFcf/p3uUJp3/jHNG6byQ2/oWW9bilWPitY1LDL8u/VwzWN
 ZN35B09bw2IgKXbxCNoNlASdV8w/nnVI+CEjKSbLJBVQffBzU9losLt5Qu1i5w/A
 Q5O5ZLkeawQhRzilxVAqae7U949MzRvn28EiLyMJ4rJA0vWH+ijg7vFYmC4hnFde
 GNzJ7q7S87BmApTsSVT+QBCpIGd2XjLYfiYZBBoZIZE2wXI4fxgF+cd05XE51hrG
 mTs=
 =ycSD
 -----END PGP SIGNATURE-----

Merge tag 'probes-v7.1' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace

Pull fprobe update from Masami Hiramatsu:

 - do not zero out unused fgraph_data. This removes unneeded memset of
   fgraph_data in fprobe entry handler.

* tag 'probes-v7.1' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace:
  tracing: fprobe: do not zero out unused fgraph_data
2026-04-17 09:18:32 -07:00
Linus Torvalds
829000f789 Bootconfig for v7.1:
- bootconfig: Minor fixes for handling errors, which includes
   the following commits:
  . fix off-by-one in xbc_verify_tree() next node check
  . increment xbc_node_num after node init succeeds
  . validate child node index in xbc_verify_tree()
 
 - bootconfig: Code cleanups (mainly type/attribute changes), which
    includes the following commits.
  . clean up comment typos and bracing
  . drop redundant memset of xbc_nodes
  . replace linux/kernel.h with specific includes
  . narrow flag parameter type from uint32_t to uint16_t
  . constify xbc_calc_checksum() data parameter
  . fix signed comparison in xbc_node_get_data()
  . use size_t for strlen result in xbc_node_match_prefix()
  . use signed type for offset in xbc_init_node()
  . use size_t for key length tracking in xbc_verify_tree()
  . change xbc_node_index() return type to uint16_t
 -----BEGIN PGP SIGNATURE-----
 
 iQFPBAABCgA5FiEEh7BulGwFlgAOi5DV2/sHvwUrPxsFAmncYnAbHG1hc2FtaS5o
 aXJhbWF0c3VAZ21haWwuY29tAAoJENv7B78FKz8bYZoH/2/lHKTucvTYAcyz039Z
 73l8IPz8aIQPTLaqrQ0JBVRD0FnT0lZZRla+p4mZFMFu+gek5kd6y2wj5seEkgR1
 tKhdY3YNP5c0NNpN5fsft4hCO9rShEdS0B3NsIiZ62onFAAKOgDd9ON2CQw4LlkJ
 cv3Y3Ax0y0EYDNqh+OuV2sDkEv74sR7NpekxnC+RBi/v+cF8q5uSHusnRYs6PQng
 zRnjluKT0Ahfmzi80WRinSfj+wNcCMoDKngxwNu+VZ14w8lGfYV4G318QCNH24IB
 +8bb3Uu/LZ47kxbcCdW5yYzC2KgJbnhp7HWhyw7bPx8ANoRHM8VlFU9qJzODI7JN
 eLw=
 =1AAh
 -----END PGP SIGNATURE-----

Merge tag 'bootconfig-v7.1' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace

Pull bootconfig updates from Masami Hiramatsu:
 "Minor fixes for handling errors:
   - fix off-by-one in xbc_verify_tree() next node check
   - increment xbc_node_num after node init succeeds
   - validate child node index in xbc_verify_tree()

  Code cleanups (mainly type/attribute changes):
   - clean up comment typos and bracing
   - drop redundant memset of xbc_nodes
   - replace linux/kernel.h with specific includes
   - narrow flag parameter type from uint32_t to uint16_t
   - constify xbc_calc_checksum() data parameter
   - fix signed comparison in xbc_node_get_data()
   - use size_t for strlen result in xbc_node_match_prefix()
   - use signed type for offset in xbc_init_node()
   - use size_t for key length tracking in xbc_verify_tree()
   - change xbc_node_index() return type to uint16_t"

* tag 'bootconfig-v7.1' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace:
  lib/bootconfig: change xbc_node_index() return type to uint16_t
  lib/bootconfig: use size_t for key length tracking in xbc_verify_tree()
  lib/bootconfig: use signed type for offset in xbc_init_node()
  lib/bootconfig: use size_t for strlen result in xbc_node_match_prefix()
  lib/bootconfig: fix signed comparison in xbc_node_get_data()
  lib/bootconfig: validate child node index in xbc_verify_tree()
  lib/bootconfig: replace linux/kernel.h with specific includes
  bootconfig: constify xbc_calc_checksum() data parameter
  lib/bootconfig: drop redundant memset of xbc_nodes
  lib/bootconfig: increment xbc_node_num after node init succeeds
  lib/bootconfig: fix off-by-one in xbc_verify_tree() next node check
  lib/bootconfig: narrow flag parameter type from uint32_t to uint16_t
  lib/bootconfig: clean up comment typos and bracing
2026-04-17 09:14:07 -07:00
Linus Torvalds
d730905bc3 Support for Mobileye EyeQ6Lplus
Cleanups and fixes
 -----BEGIN PGP SIGNATURE-----
 
 iQJOBAABCAA4FiEEbt46xwy6kEcDOXoUeZbBVTGwZHAFAmniNBwaHHRzYm9nZW5k
 QGFscGhhLmZyYW5rZW4uZGUACgkQeZbBVTGwZHB2QA//U53JZYmmOxKxwbYwLvK9
 Z8MuVgkvA/v7WktwL2PoMO0AlhQsteM5VtupddHhuhUiIr7gPy6Z7pEE9sDqM3gj
 p1d6vrg5XiWlh1fURdSqvzufKsm/etpElbvc2JjkcqD0sMGJUwlkP3ncZk/DCus6
 zhcvya7jVxyvzbCBgJSM8QHvOoj/g3EV4hsx8Ymru8XSdLVEegodZtvUHVx4Q29U
 fmHCf1u/v+rJVbe2T3nuqsqzQhmaWkC+WyeVJIDUNecjclPoGNOeg8duICNfOu9q
 dtkzOua7v6rRsUA9GDbMcR44PWzL4LqGTOffzwF7uvYakOAp6nQWsymAUIfkQbE6
 +I8heGaYPEQLjSHgCPI2WdJ4urbPdgsd5W2pC8s6WaHPdRlSMapH16I0DxmmNZlV
 CzW7o2ore5b8H4Mu5mboMjFzMY+A/0zC5S7twOpX+mvgPz+MTf1g0vD3hCSL+N7c
 LSW7rSZyd2smcgaHJBDpHceRHNZbVqloeO007DiJtrx+IWTBhvhFt2q/aqGG51xM
 2P/lRZrA8vAMaTR1hZKLmxUPZpSekezoWC8GbWNeIg5NUUTOJoTAtQvT5vU40GZA
 22o3s1a6rgz5KngV9rMWYERSV2yflvloYVo0ASVqgy1ijzzlsin/fbO976GdGD2I
 7vrch6tajmTSBYeG0SuKiFY=
 =jKsJ
 -----END PGP SIGNATURE-----

Merge tag 'mips_7.1' of git://git.kernel.org/pub/scm/linux/kernel/git/mips/linux

Pull MIPS updates from Thomas Bogendoerfer:

 - Support for Mobileye EyeQ6Lplus

 - Cleanups and fixes

* tag 'mips_7.1' of git://git.kernel.org/pub/scm/linux/kernel/git/mips/linux: (30 commits)
  MIPS/mtd: Handle READY GPIO in generic NAND platform data
  MIPS/input: Move RB532 button to GPIO descriptors
  MIPS: validate DT bootargs before appending them
  MIPS: Alchemy: Remove unused forward declaration
  MAINTAINERS: Mobileye: Add EyeQ6Lplus files
  MIPS: config: add eyeq6lplus_defconfig
  MIPS: Add Mobileye EyeQ6Lplus evaluation board dts
  MIPS: Add Mobileye EyeQ6Lplus SoC dtsi
  clk: eyeq: Add Mobileye EyeQ6Lplus OLB
  clk: eyeq: Adjust PLL accuracy computation
  clk: eyeq: Skip post-divisor when computing PLL frequency
  pinctrl: eyeq5: Add Mobileye EyeQ6Lplus OLB
  pinctrl: eyeq5: Use match data
  reset: eyeq: Add Mobileye EyeQ6Lplus OLB
  MIPS: Add Mobileye EyeQ6Lplus support
  dt-bindings: soc: mobileye: Add EyeQ6Lplus OLB
  dt-bindings: mips: Add Mobileye EyeQ6Lplus SoC
  MIPS: dts: loongson64g-package: Switch to Loongson UART driver
  mips: pci-mt7620: rework initialization procedure
  mips: pci-mt7620: add more register init values
  ...
2026-04-17 08:53:23 -07:00
Linus Torvalds
a10e80be63 alpha updates for v7.1
- alpha: Define pgprot_modify to silence tautological comparison warnings
 - alpha: add support for SECCOMP and SECCOMP_FILTER
 -----BEGIN PGP SIGNATURE-----
 
 iHUEABYKAB0WIQTIw07U9ivnHy+tugnaDr6nZQzE/AUCaeEX/gAKCRDaDr6nZQzE
 /FjpAPwMQssCV12H9JczlcTxcqUoBVCTDczxOEUxLwdhXA5UKQEAu/cxICAyaul7
 6gNqwffhpOWpehGa8T8BNZeJr5wJ+Ag=
 =g5Lf
 -----END PGP SIGNATURE-----

Merge tag 'alpha-for-v7.1-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/lindholm/alpha

Pull alpha updates from Magnus Lindholm:
 "One fix to silence pgprot_modify() compiler warnings, and one patch
  adding SECCOMP/SECCOMP_FILTER support together with the syscall and
  ptrace fixes needed for it"

* tag 'alpha-for-v7.1-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/lindholm/alpha:
  alpha: Define pgprot_modify to silence tautological comparison warnings
  alpha: add support for SECCOMP and SECCOMP_FILTER
2026-04-17 08:34:43 -07:00
Linus Torvalds
01f492e181 Arm:
- Add support for tracing in the standalone EL2 hypervisor code, which
   should help both debugging and performance analysis.  This uses the
   new infrastructure for 'remote' trace buffers that can be exposed
   by non-kernel entities such as firmware, and which came through the
   tracing tree.
 
 - Add support for GICv5 Per Processor Interrupts (PPIs), as the starting
   point for supporting the new GIC architecture in KVM.
 
 - Finally add support for pKVM protected guests, where pages are unmapped
   from the host as they are faulted into the guest and can be shared back
   from the guest using pKVM hypercalls.  Protected guests are created
   using a new machine type identifier.  As the elusive guestmem has not
   yet delivered on its promises, anonymous memory is also supported.
 
   This is only a first step towards full isolation from the host; for
   example, the CPU register state and DMA accesses are not yet isolated.
   Because this does not really yet bring fully what it promises, it is
   hidden behind CONFIG_ARM_PKVM_GUEST + 'kvm-arm.mode=protected', and
   also triggers TAINT_USER when a VM is created.  Caveat emptor.
 
 - Rework the dreaded user_mem_abort() function to make it more
   maintainable, reducing the amount of state being exposed to the
   various helpers and rendering a substantial amount of state immutable.
 
 - Expand the Stage-2 page table dumper to support NV shadow page tables
   on a per-VM basis.
 
 - Tidy up the pKVM PSCI proxy code to be slightly less hard to follow.
 
 - Fix both SPE and TRBE in non-VHE configurations so that they do not
   generate spurious, out of context table walks that ultimately lead
   to very bad HW lockups.
 
 - A small set of patches fixing the Stage-2 MMU freeing in error cases.
 
 - Tighten-up accepted SMC immediate value to be only #0 for host
   SMCCC calls.
 
 - The usual cleanups and other selftest churn.
 
 LoongArch:
 
 - Use CSR_CRMD_PLV for kvm_arch_vcpu_in_kernel().
 
 - Add DMSINTC irqchip in kernel support.
 
 RISC-V:
 
 - Fix steal time shared memory alignment checks
 
 - Fix vector context allocation leak
 
 - Fix array out-of-bounds in pmu_ctr_read() and pmu_fw_ctr_read_hi()
 
 - Fix double-free of sdata in kvm_pmu_clear_snapshot_area()
 
 - Fix integer overflow in kvm_pmu_validate_counter_mask()
 
 - Fix shift-out-of-bounds in make_xfence_request()
 
 - Fix lost write protection on huge pages during dirty logging
 
 - Split huge pages during fault handling for dirty logging
 
 - Skip CSR restore if VCPU is reloaded on the same core
 
 - Implement kvm_arch_has_default_irqchip() for KVM selftests
 
 - Factored-out ISA checks into separate sources
 
 - Added hideleg to struct kvm_vcpu_config
 
 - Factored-out VCPU config into separate sources
 
 - Support configuration of per-VM HGATP mode from KVM user space
 
 s390:
 
 - Support for ESA (31-bit) guests inside nested hypervisors.
 
 - Remove restriction on memslot alignment, which is not needed anymore with
   the new gmap code.
 
 - Fix LPSW/E to update the bear (which of course is the breaking event
   address register).
 
 x86:
 
 - Shut up various UBSAN warnings on reading module parameter before they
   were initialized.
 
 - Don't zero-allocate page tables that are used for splitting hugepages in
   the TDP MMU, as KVM is guaranteed to set all SPTEs in the page table and
   thus write all bytes.
 
 - As an optimization, bail early when trying to unsync 4KiB mappings if the
   target gfn can just be mapped with a 2MiB hugepage.
 
 x86 generic:
 
 - Copy single-chunk MMIO write values into struct kvm_vcpu (more precisely
   struct kvm_mmio_fragment) to fix use-after-free stack bugs where KVM
   would dereference stack pointer after an exit to userspace.
 
 - Clean up and comment the emulated MMIO code to try to make it easier to
   maintain (not necessarily "easy", but "easier").
 
 - Move VMXON+VMXOFF and EFER.SVME toggling out of KVM (not *all* of VMX
   and SVM enabling) as it is needed for trusted I/O.
 
 - Advertise support for AVX512 Bit Matrix Multiply (BMM) instructions
 
 - Immediately fail the build if a required #define is missing in one of
   KVM's headers that is included multiple times.
 
 - Reject SET_GUEST_DEBUG with -EBUSY if there's an already injected
   exception, mostly to prevent syzkaller from abusing the uAPI to
   trigger WARNs, but also because it can help prevent userspace from
   unintentionally crashing the VM.
 
 - Exempt SMM from CPUID faulting on Intel, as per the spec.
 
 - Misc hardening and cleanup changes.
 
 x86 (AMD):
 
 - Fix and optimize IRQ window inhibit handling for AVIC; make it per-vCPU
   so that KVM doesn't prematurely re-enable AVIC if multiple
   vCPUs have to-be-injected IRQs.
 
 - Clean up and optimize the OSVW handling, avoiding a bug in which KVM would
   overwrite state when enabling virtualization on multiple CPUs in parallel.
   This should not be a problem because OSVW should usually be the same for
   all CPUs.
 
 - Drop a WARN in KVM_MEMORY_ENCRYPT_REG_REGION where KVM complains about a
   "too large" size based purely on user input.
 
 - Clean up and harden the pinning code for KVM_MEMORY_ENCRYPT_REG_REGION.
 
 - Disallow synchronizing a VMSA of an already-launched/encrypted vCPU, as
   doing so for an SNP guest will crash the host due to an RMP violation
   page fault.
 
 - Overhaul KVM's APIs for detecting SEV+ guests so that VM-scoped queries
   are required to hold kvm->lock, and enforce it by lockdep.  Fix various
   bugs where sev_guest() was not ensured to be stable for the whole
   duration of a function or ioctl.
 
 - Convert a pile of kvm->lock SEV code to guard().
 
 - Play nicer with userspace that does not enable KVM_CAP_EXCEPTION_PAYLOAD,
   for which KVM needs to set CR2 and DR6 as a response to ioctls such as
   KVM_GET_VCPU_EVENTS (even if the payload would end up in EXITINFO2
   rather than CR2, for example).  Only set CR2 and DR6 when consumption of
   the payload is imminent, but on the other hand force delivery of the
   payload in all paths where userspace retrieves CR2 or DR6.
 
 - Use vcpu->arch.cr2 when updating vmcb12's CR2 on nested #VMEXIT instead
   of vmcb02->save.cr2.  The value is out of sync after a save/restore
   or after a #PF is injected into L2.
 
 - Fix a class of nSVM bugs where some fields written by the CPU are not
   synchronized from vmcb02 to cached vmcb12 after VMRUN, and so are not
   up-to-date when saved by KVM_GET_NESTED_STATE.
 
 - Fix a class of bugs where the ordering between KVM_SET_NESTED_STATE and
   KVM_SET_{S}REGS could cause vmcb02 to be incorrectly initialized after
   save+restore.
 
 - Add a variety of missing nSVM consistency checks.
 
 - Fix several bugs where KVM failed to correctly update VMCB fields on
   nested #VMEXIT.
 
 - Fix several bugs where KVM failed to correctly synthesize #UD or #GP for
   SVM-related instructions.
 
 - Add support for save+restore of virtualized LBRs (on SVM).
 
 - Refactor various helpers and macros to improve clarity and (hopefully)
   make the code easier to maintain.
 
 - Aggressively sanitize fields when copying from vmcb12, to guard against
   unintentionally allowing L1 to utilize yet-to-be-defined features.
 
 - Fix several bugs where KVM botched rAX legality checks when emulating SVM
   instructions.  There are remaining issues in that KVM doesn't handle size
   prefix overrides for 64-bit guests.
 
 - Fail emulation of VMRUN/VMLOAD/VMSAVE if mapping vmcb12 fails instead of
   somewhat arbitrarily synthesizing #GP (i.e. don't double down on AMD's
   architectural but sketchy behavior of generating #GP for "unsupported"
   addresses).
 
 - Cache all used vmcb12 fields to further harden against TOCTOU bugs.
 
 x86 (Intel):
 
 - Drop obsolete branch hint prefixes from the VMX instruction macros.
 
 - Use ASM_INPUT_RM() in __vmcs_writel() to coerce clang into using a
   register input when appropriate.
 
 - Code cleanups.
 
 guest_memfd:
 
 - Don't mark guest_memfd folios as accessed, as guest_memfd doesn't support
   reclaim, the memory is unevictable, and there is no storage to write
   back to.
 
 LoongArch selftests:
 
 - Add KVM PMU test cases
 
 s390 selftests:
 
 - Enable more memory selftests.
 
 x86 selftests:
 
 - Add support for Hygon CPUs in KVM selftests.
 
 - Fix a bug in the MSR test where it would get false failures on AMD/Hygon
   CPUs with exactly one of RDPID or RDTSCP.
 
 - Add an MADV_COLLAPSE testcase for guest_memfd as a regression test for a
   bug where the kernel would attempt to collapse guest_memfd folios against
   KVM's will.
 -----BEGIN PGP SIGNATURE-----
 
 iQFIBAABCAAyFiEE8TM4V0tmI4mGbHaCv/vSX3jHroMFAmnftRQUHHBib256aW5p
 QHJlZGhhdC5jb20ACgkQv/vSX3jHroPAzwf+NKO4Ktv+7A22ImN0SBl0nlUuulsz
 vTcw3+hxdRoIw83GdNS+hG5js0wrpMDnbv3t4+VliDNBSSxrBzcSWX2wpilW0Xtw
 qGo1MWhs2lKPy1NlaRVOwPS6j7uF3AR0TQ1iQLGMedQuCU9WpiKJxyhNXJdbLrt3
 8EgFzsvtEsv+jKNRUNDf9+d0j4gZsFyIe+Brhianbw+u3/UCiUClLCdsKPc4+5ZX
 08otYXytacGNIf/5Ev1vT4pHkHL0yqKXAtX7LEtaS3+0KrPuLjV4slemivzE9vf5
 Evafm5AhA4wpaNMb1ZerhY3T94lsMaJpWxotjR//0Q7C9B59pCQnXCm8mg==
 =CcE0
 -----END PGP SIGNATURE-----

Merge tag 'for-linus' of git://git.kernel.org/pub/scm/virt/kvm/kvm

Pull kvm updates from Paolo Bonzini:
 "Arm:

   - Add support for tracing in the standalone EL2 hypervisor code,
     which should help both debugging and performance analysis. This
     uses the new infrastructure for 'remote' trace buffers that can be
     exposed by non-kernel entities such as firmware, and which came
     through the tracing tree

   - Add support for GICv5 Per Processor Interrupts (PPIs), as the
     starting point for supporting the new GIC architecture in KVM

   - Finally add support for pKVM protected guests, where pages are
     unmapped from the host as they are faulted into the guest and can
     be shared back from the guest using pKVM hypercalls. Protected
     guests are created using a new machine type identifier. As the
     elusive guestmem has not yet delivered on its promises, anonymous
     memory is also supported

     This is only a first step towards full isolation from the host; for
     example, the CPU register state and DMA accesses are not yet
     isolated. Because this does not really yet bring fully what it
     promises, it is hidden behind CONFIG_ARM_PKVM_GUEST +
     'kvm-arm.mode=protected', and also triggers TAINT_USER when a VM is
     created. Caveat emptor

   - Rework the dreaded user_mem_abort() function to make it more
     maintainable, reducing the amount of state being exposed to the
     various helpers and rendering a substantial amount of state
     immutable

   - Expand the Stage-2 page table dumper to support NV shadow page
     tables on a per-VM basis

   - Tidy up the pKVM PSCI proxy code to be slightly less hard to
     follow

   - Fix both SPE and TRBE in non-VHE configurations so that they do not
     generate spurious, out of context table walks that ultimately lead
     to very bad HW lockups

   - A small set of patches fixing the Stage-2 MMU freeing in error
     cases

   - Tighten-up accepted SMC immediate value to be only #0 for host
     SMCCC calls

   - The usual cleanups and other selftest churn

  LoongArch:

   - Use CSR_CRMD_PLV for kvm_arch_vcpu_in_kernel()

   - Add DMSINTC irqchip in kernel support

  RISC-V:

   - Fix steal time shared memory alignment checks

   - Fix vector context allocation leak

   - Fix array out-of-bounds in pmu_ctr_read() and pmu_fw_ctr_read_hi()

   - Fix double-free of sdata in kvm_pmu_clear_snapshot_area()

   - Fix integer overflow in kvm_pmu_validate_counter_mask()

   - Fix shift-out-of-bounds in make_xfence_request()

   - Fix lost write protection on huge pages during dirty logging

   - Split huge pages during fault handling for dirty logging

   - Skip CSR restore if VCPU is reloaded on the same core

   - Implement kvm_arch_has_default_irqchip() for KVM selftests

   - Factored-out ISA checks into separate sources

   - Added hideleg to struct kvm_vcpu_config

   - Factored-out VCPU config into separate sources

   - Support configuration of per-VM HGATP mode from KVM user space

  s390:

   - Support for ESA (31-bit) guests inside nested hypervisors

   - Remove restriction on memslot alignment, which is not needed
     anymore with the new gmap code

   - Fix LPSW/E to update the bear (which of course is the breaking
     event address register)

  x86:

   - Shut up various UBSAN warnings on reading module parameter before
     they were initialized

   - Don't zero-allocate page tables that are used for splitting
     hugepages in the TDP MMU, as KVM is guaranteed to set all SPTEs in
     the page table and thus write all bytes

   - As an optimization, bail early when trying to unsync 4KiB mappings
     if the target gfn can just be mapped with a 2MiB hugepage

  x86 generic:

   - Copy single-chunk MMIO write values into struct kvm_vcpu (more
     precisely struct kvm_mmio_fragment) to fix use-after-free stack
     bugs where KVM would dereference stack pointer after an exit to
     userspace

   - Clean up and comment the emulated MMIO code to try to make it
     easier to maintain (not necessarily "easy", but "easier")

   - Move VMXON+VMXOFF and EFER.SVME toggling out of KVM (not *all* of
     VMX and SVM enabling) as it is needed for trusted I/O

   - Advertise support for AVX512 Bit Matrix Multiply (BMM) instructions

   - Immediately fail the build if a required #define is missing in one
     of KVM's headers that is included multiple times

   - Reject SET_GUEST_DEBUG with -EBUSY if there's an already injected
     exception, mostly to prevent syzkaller from abusing the uAPI to
     trigger WARNs, but also because it can help prevent userspace from
     unintentionally crashing the VM

   - Exempt SMM from CPUID faulting on Intel, as per the spec

   - Misc hardening and cleanup changes

  x86 (AMD):

   - Fix and optimize IRQ window inhibit handling for AVIC; make it
     per-vCPU so that KVM doesn't prematurely re-enable AVIC if multiple
     vCPUs have to-be-injected IRQs

   - Clean up and optimize the OSVW handling, avoiding a bug in which
     KVM would overwrite state when enabling virtualization on multiple
     CPUs in parallel. This should not be a problem because OSVW should
     usually be the same for all CPUs

   - Drop a WARN in KVM_MEMORY_ENCRYPT_REG_REGION where KVM complains
     about a "too large" size based purely on user input

   - Clean up and harden the pinning code for KVM_MEMORY_ENCRYPT_REG_REGION

   - Disallow synchronizing a VMSA of an already-launched/encrypted
     vCPU, as doing so for an SNP guest will crash the host due to an
     RMP violation page fault

   - Overhaul KVM's APIs for detecting SEV+ guests so that VM-scoped
     queries are required to hold kvm->lock, and enforce it by lockdep.
     Fix various bugs where sev_guest() was not ensured to be stable for
     the whole duration of a function or ioctl

   - Convert a pile of kvm->lock SEV code to guard()

   - Play nicer with userspace that does not enable
     KVM_CAP_EXCEPTION_PAYLOAD, for which KVM needs to set CR2 and DR6
     as a response to ioctls such as KVM_GET_VCPU_EVENTS (even if the
     payload would end up in EXITINFO2 rather than CR2, for example).
     Only set CR2 and DR6 when consumption of the payload is imminent,
     but on the other hand force delivery of the payload in all paths
     where userspace retrieves CR2 or DR6

   - Use vcpu->arch.cr2 when updating vmcb12's CR2 on nested #VMEXIT
     instead of vmcb02->save.cr2. The value is out of sync after a
     save/restore or after a #PF is injected into L2

   - Fix a class of nSVM bugs where some fields written by the CPU are
     not synchronized from vmcb02 to cached vmcb12 after VMRUN, and so
     are not up-to-date when saved by KVM_GET_NESTED_STATE

   - Fix a class of bugs where the ordering between KVM_SET_NESTED_STATE
     and KVM_SET_{S}REGS could cause vmcb02 to be incorrectly
     initialized after save+restore

   - Add a variety of missing nSVM consistency checks

   - Fix several bugs where KVM failed to correctly update VMCB fields
     on nested #VMEXIT

   - Fix several bugs where KVM failed to correctly synthesize #UD or
     #GP for SVM-related instructions

   - Add support for save+restore of virtualized LBRs (on SVM)

   - Refactor various helpers and macros to improve clarity and
     (hopefully) make the code easier to maintain

   - Aggressively sanitize fields when copying from vmcb12, to guard
     against unintentionally allowing L1 to utilize yet-to-be-defined
     features

   - Fix several bugs where KVM botched rAX legality checks when
     emulating SVM instructions. There are remaining issues in that KVM
     doesn't handle size prefix overrides for 64-bit guests

   - Fail emulation of VMRUN/VMLOAD/VMSAVE if mapping vmcb12 fails
     instead of somewhat arbitrarily synthesizing #GP (i.e. don't double
     down on AMD's architectural but sketchy behavior of generating #GP
     for "unsupported" addresses)

   - Cache all used vmcb12 fields to further harden against TOCTOU bugs

  x86 (Intel):

   - Drop obsolete branch hint prefixes from the VMX instruction macros

   - Use ASM_INPUT_RM() in __vmcs_writel() to coerce clang into using a
     register input when appropriate

   - Code cleanups

  guest_memfd:

   - Don't mark guest_memfd folios as accessed, as guest_memfd doesn't
     support reclaim, the memory is unevictable, and there is no storage
     to write back to

  LoongArch selftests:

   - Add KVM PMU test cases

  s390 selftests:

   - Enable more memory selftests

  x86 selftests:

   - Add support for Hygon CPUs in KVM selftests

   - Fix a bug in the MSR test where it would get false failures on
     AMD/Hygon CPUs with exactly one of RDPID or RDTSCP

   - Add an MADV_COLLAPSE testcase for guest_memfd as a regression test
     for a bug where the kernel would attempt to collapse guest_memfd
     folios against KVM's will"

* tag 'for-linus' of git://git.kernel.org/pub/scm/virt/kvm/kvm: (373 commits)
  KVM: x86: use inlines instead of macros for is_sev_*guest
  x86/virt: Treat SVM as unsupported when running as an SEV+ guest
  KVM: SEV: Goto an existing error label if charging misc_cg for an ASID fails
  KVM: SVM: Move lock-protected allocation of SEV ASID into a separate helper
  KVM: SEV: use mutex guard in snp_handle_guest_req()
  KVM: SEV: use mutex guard in sev_mem_enc_unregister_region()
  KVM: SEV: use mutex guard in sev_mem_enc_ioctl()
  KVM: SEV: use mutex guard in snp_launch_update()
  KVM: SEV: Assert that kvm->lock is held when querying SEV+ support
  KVM: SEV: Document that checking for SEV+ guests when reclaiming memory is "safe"
  KVM: SEV: Hide "struct kvm_sev_info" behind CONFIG_KVM_AMD_SEV=y
  KVM: SEV: WARN on unhandled VM type when initializing VM
  KVM: LoongArch: selftests: Add PMU overflow interrupt test
  KVM: LoongArch: selftests: Add basic PMU event counting test
  KVM: LoongArch: selftests: Add cpucfg read/write helpers
  LoongArch: KVM: Add DMSINTC inject msi to vCPU
  LoongArch: KVM: Add DMSINTC device support
  LoongArch: KVM: Make vcpu_is_preempted() as a macro rather than function
  LoongArch: KVM: Move host CSR_GSTAT save and restore in context switch
  LoongArch: KVM: Move host CSR_EENTRY save and restore in context switch
  ...
2026-04-17 07:18:03 -07:00
Borislav Petkov (AMD)
e55d98e775 x86/CPU: Fix FPDSS on Zen1
Zen1's hardware divider can leave, under certain circumstances, partial
results from previous operations.  Those results can be leaked by
another, attacker thread.

Fix that with a chicken bit.

Signed-off-by: Borislav Petkov (AMD) <bp@alien8.de>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
2026-04-17 06:04:42 -07:00
Linus Torvalds
43cfbdda5a iommufd v7.1 merge window pull request
Several fixes:
 
 - Add missing static const
 
 - Correct type 1 emulation for VFIO_CHECK_EXTENSION when no-iommu is
   turned on
 
 - Fix selftest memory leak and syzkaller splat
 
 - Fix missed -EFAULT in fault reporting write() fops
 
 - Fix a race where map/unmap with the internal IOVA allocator can unmap
   things it should not
 -----BEGIN PGP SIGNATURE-----
 
 iHUEABYKAB0WIQRRRCHOFoQz/8F5bUaFwuHvBreFYQUCaeECkwAKCRCFwuHvBreF
 YT5LAQD2DWHgrrgiv3z0X3J+ymvMPIw32hI2J7rAbrR+olAvigEA5adGbQAUI6cC
 msu5z8gv6bK1bzcqPbkL8hPlNU0naQQ=
 =fe0o
 -----END PGP SIGNATURE-----

Merge tag 'for-linus-iommufd' of git://git.kernel.org/pub/scm/linux/kernel/git/jgg/iommufd

Pull iommufd updates from Jason Gunthorpe:
 "Several fixes:

   - Add missing static const

   - Correct type 1 emulation for VFIO_CHECK_EXTENSION when no-iommu is
     turned on

   - Fix selftest memory leak and syzkaller splat

   - Fix missed -EFAULT in fault reporting write() fops

   - Fix a race where map/unmap with the internal IOVA allocator can
     unmap things it should not"

* tag 'for-linus-iommufd' of git://git.kernel.org/pub/scm/linux/kernel/git/jgg/iommufd:
  iommufd: Fix a race with concurrent allocation and unmap
  iommufd/selftest: Remove MOCK_IOMMUPT_AMDV1 format
  iommufd: Fix return value of iommufd_fault_fops_write()
  iommufd: update outdated comment for renamed iommufd_hw_pagetable_alloc()
  iommufd/selftest: Fix page leaks in mock_viommu_{init,destroy}
  iommufd: vfio compatibility extension check for noiommu mode
  iommufd: Constify struct dma_buf_attach_ops
2026-04-16 21:21:55 -07:00
Linus Torvalds
87fe97a184 fwctl 7.1 merge window pull request
- New fwctl driver for Broadcom RDMA NICs
 
 - Bug fix for non-modular builds
 -----BEGIN PGP SIGNATURE-----
 
 iHUEABYKAB0WIQRRRCHOFoQz/8F5bUaFwuHvBreFYQUCaeDp6gAKCRCFwuHvBreF
 YXiBAQCUW1N0n7iTqlkbdbCs3GsI0d78x2dDN7aEc7SKDr/+CgEA69TVKDTLkIJa
 CAzwZLkAKjRDUH7PXh65i8svJnwvzAk=
 =MoNI
 -----END PGP SIGNATURE-----

Merge tag 'for-linus-fwctl' of git://git.kernel.org/pub/scm/linux/kernel/git/fwctl/fwctl

Pull fwctl updates from Jason Gunthorpe:

 - New fwctl driver for Broadcom RDMA NICs

 - Bug fix for non-modular builds

* tag 'for-linus-fwctl' of git://git.kernel.org/pub/scm/linux/kernel/git/fwctl/fwctl:
  fwctl: Fix class init ordering to avoid NULL pointer dereference on device removal
  fwctl/bnxt_fwctl: Add documentation entries
  fwctl/bnxt_fwctl: Add bnxt fwctl device
  fwctl/bnxt_en: Create an aux device for fwctl
  fwctl/bnxt_en: Refactor aux bus functions to be more generic
  fwctl/bnxt_en: Move common definitions to include/linux/bnxt/
2026-04-16 21:15:56 -07:00
Linus Torvalds
8242c709d4 soc: ARM code changes for 7.1
These are again very minimal updates:
 
  - A workaround for firmware on Google Nexus 10
  - A fix for early debugging on OMAP1
  - A rework for Microchip SoC configuration
  - Cleanups on OMAP2 an R-Car-Gen2
 -----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCgAdFiEEo6/YBQwIrVS28WGKmmx57+YAGNkFAmnhCkAACgkQmmx57+YA
 GNlmlxAAgvOCI5Knxv0K0IyUTCknVY1kE6a/JasD6ib+4gVhSa1XDVSAzEWkkS5v
 8UoZtXQ/fvxx3PakgVuIe7BKRk1y9N2Msj3n2dlGBKCsvIXxNaZayyODWVnkJUmR
 anmyy4Y7jPtCi1uSOj9heA9VzMBu54sEJH0Ay7p6nykBPyD08Oo2hljbZyIjABTG
 FuAPksB345a2go5eb0MoAKQGHtrNjzXD1LXkcKammSxqEgcEocQa3DqLCCRNqLJu
 cfA8OmoOgtDoK9jbTh3sOmstM2LWCPBlBAnu56c1m5oEQr5IjrcCqKskMtyl47R9
 kNzIWISgBkj5pfl/zTIy/qD3msd8OssIe2ZAUSChZ5ceSi8aC4B+ISC+E8g8nm1j
 6wTAkeDK0iQVndPgoKwPSjyngsK+yAT6SMzZDGY9dODe9I35Mq1F5m32FuU3C3m/
 r/BLl7ixcUPo3mVK1eZCoNdHhmrINhJfed4Kj+phidBNGXWd82E1nJjZ98mo9V2s
 YbUerxScb9P1TMnUdPu69AeLTBH6dlgmKpQNa04KxhZwjx+JhSx+7/v6KohdRZIS
 Y+gfPKYYkwqtgItcQ6/otk6OWWsRx+msr+sJky3giIhkyqOLmBdxvhezuOs0Mmle
 9AOn3UrXubNteGR48AfYi+bOIb8FPQLoHOAgVIL0fbhqF2mzSNw=
 =nOGB
 -----END PGP SIGNATURE-----

Merge tag 'soc-arm-7.1' of git://git.kernel.org/pub/scm/linux/kernel/git/soc/soc

Pull SoC ARM code updates from Arnd Bergmann:
 "These are again very minimal updates:

   - A workaround for firmware on Google Nexus 10

   - A fix for early debugging on OMAP1

   - A rework for Microchip SoC configuration

   - Cleanups on OMAP2 an R-Car-Gen2"

* tag 'soc-arm-7.1' of git://git.kernel.org/pub/scm/linux/kernel/git/soc/soc:
  ARM: omap2: dead code cleanup in kconfig for ARCH_OMAP4
  ARM: OMAP1: Fix DEBUG_LL and earlyprintk on OMAP16XX
  arm64: Kconfig: provide a top-level switch for Microchip platforms
  ARM: shmobile: rcar-gen2: Use of_phandle_args_equal() helper
  ARM: omap: fix all kernel-doc warnings
  ARM: omap2: Replace scnprintf with strscpy in omap3_cpuinfo
  ARM: samsung: exynos5250: Allow CPU1 to boot
2026-04-16 20:45:14 -07:00
Linus Torvalds
231d703058 soc: defconfig updates for 7.1
As usual, we enable a number of additional device drivers as loadable
 modules, to support the added platforms. The largest change this time
 is for OMAP2/3, which were not that well supported in the generic arm32
 defconfig.
 
 The Tegra SoC platforms are now enabled by default in Kconfig when
 ARCH_TEGRA is enabled, which means the defconfig change is done at
 the same time as the Kconfig change here.
 -----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCgAdFiEEo6/YBQwIrVS28WGKmmx57+YAGNkFAmnhC1IACgkQmmx57+YA
 GNlH1BAAtiJ53U6+xf83+Eou3trytyXIs3qTw+wQ0mRfXxczeVMV76lRpLcK78iI
 8gZg0zMb71kEI4kScOqraewtVGap2ktkz40Nw146q+K+ctj0Qklb54oA+ZS/NVra
 nE0Cc3PCJkbWTUHQoYpLwiGefFJrahOm7q14JHedmS07Z7BUwzZRaefOp8Jdjafu
 sEo1gX4lW8f8Yh2HXxf2QuRTcihzGR/kqzYzzl44M4dC5QFRD0ddcUVYgKsfYLkA
 mp8+mdTcIeNTyOpf9BT0OSXDnt7242lzM+vg59rsp5BY9fxiO1kA1K6gsKb4OCX/
 v0R46ZsPdE1NV8BvnZ7eEUUKOhtjzu0hITtVgNg5DsLnRzhuEe/8FEUx1mB2jY56
 IwvjchSkUoRX2MPFjSneLSe+u+wZFXaeLNnmkVsIe9CYUThsydZyL8g+l5/xPaTC
 MMcrI8CehNehZ+ZW5fSt49zXzp80PivdG39xmoKc/UmGIGtPyl7Ual1OEVf+OoxR
 H8UguX368MK4h5e1KjNZynT/z3obxuOc9e1sqddWx2khDYp0XcGeRcc0nyMREruQ
 5Nvyx3KaqRGQBrPUyWBOB9G7ItgIv18aZ+eTtzI5xcgZxvzEmhbwrVecsMjh9B9f
 3g3eWOBcV5GbJ1RpN+z5wRXhmQuAXOWWWSCoAUhpm3QpdpNWxo4=
 =OCxO
 -----END PGP SIGNATURE-----

Merge tag 'soc-defconfig-7.1' of git://git.kernel.org/pub/scm/linux/kernel/git/soc/soc

Pull SoC defconfig updates from Arnd Bergmann:
 "As usual, we enable a number of additional device drivers as loadable
  modules, to support the added platforms. The largest change this time
  is for OMAP2/3, which were not that well supported in the generic
  arm32 defconfig.

  The Tegra SoC platforms are now enabled by default in Kconfig when
  ARCH_TEGRA is enabled, which means the defconfig change is done at the
  same time as the Kconfig change here"

* tag 'soc-defconfig-7.1' of git://git.kernel.org/pub/scm/linux/kernel/git/soc/soc: (25 commits)
  arch/arm: Drop CONFIG_FIRMWARE_EDID from defconfig files
  arm64: defconfig: Enable DP83TG720 PHY driver
  arm64: tegra: defconfig: Drop redundant ARCH_TEGRA_foo_SOC
  ARM: tegra: defconfig: Drop redundant ARCH_TEGRA_foo_SOC
  arm64: defconfig: enable pci-pwrctrl-generic as module
  arm64: defconfig: Enable Lontium LT8713sx driver
  arm64: defconfig: Enable Qualcomm Eliza SoC display clock controller
  arm64: defconfig: enable IPQ5210 RDP504 base configs
  arm64: defconfig: Enable Milos LPASS LPI pinctrl driver
  arm64: defconfig: Enable Kaanapali clock controllers
  arm64: defconfig: Enable configs for Arduino VENTUNO Q
  arm64: defconfig: Enable Qualcomm Eliza basic resource providers
  arm64: defconfig: Enable S5KJN1 camera sensor
  arm64: defconfig: Enable configurations for Toradex Aquila AM69
  arm64: defconfig: remove SENSORS_SA67MCU
  arm64: defconfig: Enable Qualcomm WCD937x headphone codec as module
  arm64: defconfig: Enable QCOMTEE module for QTEE-enabled Qualcomm SoCs
  ARM: shmobile: defconfig: Refresh for v7.0-rc1
  arm: multi_v7_defconfig: Enable more OMAP 3/4 related configs
  ARM: multi_v7_defconfig: omap2plus_defconfig: Enable ITE IT66121 driver
  ...
2026-04-16 20:40:20 -07:00