Heiko Carstens [Wed, 4 Feb 2026 07:32:01 +0000 (08:32 +0100)]
Merge branch 'tape-devices'
Jan Höppner says:
====================
Quite a lot of the tape device driver code is outdated as devices and
storage systems supported by that code aren't supported by IBM anymore for
a long time. Especially physical tape devices are not supported or used
directly anymore.
The only tape storage system supported by IBM is the Virtual Tape Server
(VTS) family with TS7700 systems [1]. Host systems will only talk to VTS
and are presented with the virtualized 3490E tape device type only. VTS can
and still uses tape libraries with physical 3592 cartridges as storage
backends (e.g. TS4500). However, these are never seen by any host.
The general goal/idea for the tape device driver is to only support VTS
from now on. This series gets rid of old outdated code that is not
relevant to VTS. There is probably quite a bit more that could be
cleaned up or could be improved. However, this is a first run to cleanup
the code base and somewhat reduce maintenance burden.
Jan Höppner [Mon, 2 Feb 2026 13:48:45 +0000 (14:48 +0100)]
s390/tape: Rename tape_34xx.c to tape_3490.c
The driver now exclusively supports 3490 tape devices, given support for
3480 tape devices has been removed. Update the device driver name, its
source file name, and change any occurrences of "34xx/34XX" to "3490" in
the source code and comments.
Jan Höppner [Mon, 2 Feb 2026 13:48:44 +0000 (14:48 +0100)]
s390/tape: Cleanup sense data analysis and error handling
Quite a few Error Recovery Action (ERA) codes and sense data entries are
not relevant anymore for the Virtual Tape Server (VTS) and are not being
used by VTS. Most of them were relevant for actual physical errors when
a tape cartridge got stuck or a tape didn't rewind properly for example.
Remove these codes from the sense data analysis as it's dead code
anyway.
Jan Höppner [Mon, 2 Feb 2026 13:48:43 +0000 (14:48 +0100)]
s390/tape: Remove 3480 tape device type
The only supported device type by the Virtual Tape Server is 3490. The
3480 device type was an old physical tape model and doesn't exist
anymore. Remove 3480 from the list and any mention of it.
Jan Höppner [Mon, 2 Feb 2026 13:48:42 +0000 (14:48 +0100)]
s390/tape: Remove unused command definitions
Quite a few command definitions are either not used or don't exist for
3490 tape devices on Virtual Tape Servers (VTS). Cleanup the list, which
makes it easier to understand what commands are actually implemented by
the driver. The lists below outline the exact reason for the removal.
Description for existing commands are adapted to reflect the removal of
support for old device types.
The following commands don't exist in VTS for 3490 devices and are
unused:
INVALID_00 0x00
DIAG_MODE_SET 0x0B
FORCE_STREAM_CNT 0xEB
LOOP_WRITE_TO_READ 0x8B
MODE_SET_C3 0xC3
MODE_SET_CB 0xCB
MODE_SET_D3 0xD3
NEW_MODE_SET 0xEB
RELEASE 0xD4
REQ_TRK_IN_ERROR 0x1B
RESERVE 0xF4
SET_DIAGNOSE 0x4B
The following command definitions are not used:
CONTROL_ACCESS 0xE3
PERF_SUBSYS_FUNC 0x77
READ_BACKWARD 0x0C
READ_BUFFER 0x12
READ_BUFF_LOG 0x24
READ_CONFIG_DATA 0xFA
READ_DEV_CHAR 0x64
READ_MESSAGE_ID 0x4E
READ_SUBSYS_DATA 0x3E
SENSE_GROUP_ID 0x34
SENSE_ID 0xE4
SET_GROUP_ID 0xAF
SET_INTERFACE_ID 0x73
SET_TAPE_WRITE_IMMED 0xC3
SUSPEND 0x5B
SYNC 0x43
Jan Höppner [Mon, 2 Feb 2026 13:48:41 +0000 (14:48 +0100)]
s390/tape: Remove special block id handling
For real 3490 tape models a logical block was composed of a direction
bit (wrap), a segment number, a format mode, and a logical block number.
This is represented in a 4byte identifier.
The Virtual Tape Server (VTS) emulates 3490 tape devices and uses a
stripped block id format where bit 0-9 of the 4byte identifier are
always 0. Bit 10-31 represent the logical block number.
All tapes use the 3480-2 XF format, which was defined via
TAPE34XX_FMT_3480_2_XF but never used. There is also no special handling
required anymore as this is the only format being used.
Since VTS doesn't require any special handling of block ids and format,
corresponding code is removed.
Jan Höppner [Mon, 2 Feb 2026 13:48:40 +0000 (14:48 +0100)]
s390/tape: Remove tape load display support
The LOAD_DISPLAY (LDD) X'9F' is still accepted by the Virtual Tape
Server (VTS) but does not perform any action.
Remove all functions and definitions related to this command.
The tape_34xx_ioctl() function is also removed as it was mainly used to
handle additional ioctl functionality. LOAD_DISPLAY was the only left
case. All other ioctls are handled in tapechar_ioctl().
With LOAD_DISPLAY, the remaining definitions in asm/tape390.h are gone.
Delete the file.
Jan Höppner [Mon, 2 Feb 2026 13:48:39 +0000 (14:48 +0100)]
s390/tape: Remove support for 3590/3592 models
Physical 3590/3592 tape models are not supported anymore for a very long
time. The Virtual Tape Server (VTS) emulates and presents only 3490E
models to the host. This is the only supported model and storage server.
Remove the entire code base for 3590/3592 models as it can be considered
dead code for quite some time already.
Vasily Gorbik [Tue, 3 Feb 2026 09:18:03 +0000 (10:18 +0100)]
s390/kexec: Emit an error message when cmdline is too long
Currently, if the command line passed to kexec_file_load() exceeds
the supported limit of the kernel being kexec'd, -EINVAL is returned
to userspace, which is consistent across architectures. Since
-EINVAL is not specific to this case, the kexec tool cannot provide
a specific reason for the failure. Many architectures emit an error
message in this case. Add a similar error message, including the
effective limit, since the command line length is configurable.
Thomas Richter [Fri, 23 Jan 2026 09:14:12 +0000 (10:14 +0100)]
s390/perf: Disable register readout on sampling events
Running commands
# ./perf record -IR0,R1 -a sleep 1
extracts and displays register value of general purpose register r1 and r0.
However the value displayed of any register is random and does not
reflect the register value recorded at the time of the sample interrupt.
The sampling device driver on s390 creates a very large buffer
for the hardware to store the samples. Only when that large buffer
gets full an interrupt is generated and many hundreds of sample
entries are processed and copied to the kernel ring buffer and
eventually get copied to the perf tool. It is during the copy
to the kernel ring buffer that each sample is processed (on s390)
and at that time the register values are extracted.
This is not the original goal, the register values should be read
when the samples are created not when the samples are copied to the
kernel ring buffer.
Prevent this event from being installed in the first place and
return -EOPNOTSUPP. This is already the case for PERF_SAMPLE_REGS_USER.
Signed-off-by: Thomas Richter <tmricht@linux.ibm.com> Reviewed-by: Jan Polensky <japo@linux.ibm.com> Signed-off-by: Heiko Carstens <hca@linux.ibm.com>
Define CONFIG_ILLEGAL_POINTER_VALUE to the eye-catching non-zero value
of 0xdead000000000000, consistent with other architectures. Assert at
compile-time that the poison pointers that include/linux/poison.h
defines based on this illegal pointer are beyond the largest useful
virtual addresses. Also, assert at compile-time that the range of poison
pointers per include/linux/poison.h (currently a range of less than
0x10000 addresses) does not overlap with the range used for address
handles for s390's non-MIO PCI instructions.
This enables s390 to track the DMA mappings by the network stack's
page_pool that was introduced with [0]. Other functional changes are not
intended.
Other archictectures have introduced this for various other reasons with
commit 5c178472af24 ("riscv: define ILLEGAL_POINTER_VALUE for 64bit")
commit f6853eb561fb ("powerpc/64: Define ILLEGAL_POINTER_VALUE for 64-bit")
commit bf0c4e047324 ("arm64: kconfig: Move LIST_POISON to a safe value")
commit a29815a333c6 ("core, x86: make LIST_POISON less deadly")
Heiko Carstens [Tue, 27 Jan 2026 11:16:52 +0000 (12:16 +0100)]
Merge branch 'warn-exception'
Heiko Carstens says:
====================
v2:
- Use generic WARN() implementation in case of gcc-8, which avoids the need
to raise the minimum gcc version to gcc-9 for (only) s390
- Add couple of additional ifdef guards to avoid compile errors and
warnings
v1 ([1]):
Use the generic infrastructure introduced by Peter Zijlstra [2] to implement
an exception based WARN() and WARN_ONCE() similar to x86.
Due to some compiler oddities on s390 this requires to raise the minimum gcc
version to 9. Maybe there are ways to avoid this, but I failed to find a
working solution. Details are in the patch descriptions.
Just posting this now to also get some compile bot testing, since I'm afraid
there might be some compiler version / config option around where even this
new approach breaks.
Peter, since you were wondering: your generic infrastructure pieces work very
nice. Looking at the x86 and s390 implementation: it might be possible to make
things even more generic since both __WARN_printf(), and WARN_ONCE() are
identical; it looks like only __WARN_print_arg() needs to be provided.
Heiko Carstens [Fri, 9 Jan 2026 15:31:44 +0000 (16:31 +0100)]
s390/bug: Prevent tail-call optimization
For the exception based __WARN_trap() implementation it is technically not
necessary to prevent tail-call optimization, however it may be confusing to
see warning messages like:
WARNING: arch/s390/kernel/setup.c:1017 at foobar+0x2c/0x50, CPU#0: swapper/0/0
together with a disassembly of a different function caused by tail-call
optimization for the __WARN_trap() call. Prevent that by adding an empty
asm statement. This generates slightly worse code, but should hopefully
avoid confusion.
A better solution would be to replace or patch the branch instruction to
__WARN_trap() with the monitor call instruction, similar to what is done
for x86 [1]. However s390 does not support static_cond_calls(). Therefore
use the simple approach for the time being.
[1] commit 860238af7a33 ("x86_64/bug: Inline the UD1")
Reviewed-by: Sven Schnelle <svens@linux.ibm.com> Signed-off-by: Heiko Carstens <hca@linux.ibm.com>
Heiko Carstens [Fri, 9 Jan 2026 15:31:43 +0000 (16:31 +0100)]
s390/bug: Skip __WARN_trap() in call traces
In order to avoid rather pointless warning disassemblies of __WARN_trap()
set the PSW address to the return address of the function which called
__WARN_trap(). This is the address to which __WARN_trap() would return
in any case.
The result is a disassembly of the function which called __WARN_trap(),
which is much more helpful.
Heiko Carstens [Fri, 9 Jan 2026 15:31:41 +0000 (16:31 +0100)]
s390/bug: Implement __WARN_printf()
This is the s390 variant of commit 5b472b6e5bd9 ("x86_64/bug: Implement
__WARN_printf()"). See the x86 commit for the general idea; there are only
implementation details which are different.
With the new exception based __WARN_printf() implementation the generated
code for a simple WARN() is simplified.
For example:
void foo(int a) { WARN(a, "bar"); }
Before this change the generated code looks like this:
Heiko Carstens [Fri, 9 Jan 2026 15:31:40 +0000 (16:31 +0100)]
s390/traps: Copy monitor code to pt_regs
In case of a monitor call program check the CPU stores the monitor code to
lowcore. Let the program check handler copy it to the pt_regs structure so
it can be used by the monitor call exception handler.
Instead of increasing the pt_regs size add a union which contains both
orig_gpr2 and monitor_code, since orig_gpr2 is not used in case of a
program check.
Reviewed-by: Sven Schnelle <svens@linux.ibm.com> Signed-off-by: Heiko Carstens <hca@linux.ibm.com>
Heiko Carstens [Fri, 9 Jan 2026 15:31:39 +0000 (16:31 +0100)]
s390/bug: Introduce and use monitor code macro
The first operand address of the monitor call (mc) instruction is the
monitor code. Currently the monitor code is ignored, but this will
change. Therefore add and use MONCODE_BUG instead of a hardcoded zero.
Reviewed-by: Sven Schnelle <svens@linux.ibm.com> Signed-off-by: Heiko Carstens <hca@linux.ibm.com>
Heiko Carstens [Fri, 9 Jan 2026 15:31:37 +0000 (16:31 +0100)]
s390/bug: Convert to inline assembly with input operands
Rewrite the bug inline assembly so it uses input operands again instead of
pure macro replacements. This more or less reverts the conversion done when
'cond_str' support was added [1].
Reason for this is that the upcoming __WARN_printf() implementation
requires an inline assembly with an output operand. At the same time input
strings (format specifier and condition string) may contain the special '%'
character. As soon as an inline assembly is specified to have input/output
operands the '%' has a special meaning: e.g. converting the existing
will result in a compile error as soon as 'cond_str' contains a '%'
character:
net/core/neighbour.c: In function ‘neigh_table_init’:
././include/linux/compiler_types.h:546:20: error: invalid 'asm': invalid %-code
...
net/core/neighbour.c:1838:17: note: in expansion of macro ‘WARN_ON’
1838 | WARN_ON(tbl->entry_size % NEIGH_PRIV_ALIGN);
| ^~~~~~~
Convert the code, use immediate operands, and also add comments similar to
x86 which are emitted to the generated assembly file, which makes debugging
much easier.
Note: since gcc-8 does not support strings as immediate input operands,
guard the new implementation with CC_HAS_ASM_IMMEDIATE_STRINGS and fallback
to the generic non-exception based warning implementation for incompatible
compilers.
[1] 6584ff203aec ("bugs/s390: Use 'cond_str' in __EMIT_BUG()")
Reviewed-by: Sven Schnelle <svens@linux.ibm.com> Signed-off-by: Heiko Carstens <hca@linux.ibm.com>
Heiko Carstens [Fri, 9 Jan 2026 15:31:36 +0000 (16:31 +0100)]
s390: Add CC_HAS_ASM_IMMEDIATE_STRINGS
Upcoming changes to s390 specific inline assemblies require the usage of
strings as immediate input operands. This works only with gcc-9 and newer
compilers. With gcc-8 this leads to a compile error:
In function 'bar':
warning: asm operand 0 probably doesn't match constraints
asm volatile("" :: "i" ("foo"));
^~~
error: impossible constraint in 'asm'
Provide a CC_HAS_ASM_IMMEDIATE_STRINGS config option which allows to tell
if the compiler supports strings as immediate input operands.
Based on that conditional code can be provided.
Reviewed-by: Sven Schnelle <svens@linux.ibm.com> Signed-off-by: Heiko Carstens <hca@linux.ibm.com>
Niklas Schnelle [Thu, 8 Jan 2026 15:45:54 +0000 (16:45 +0100)]
s390/pci: Use PCIBIOS return values in pci_read()/pci_write()
While pci_read() and pci_write() have returned errno values since their
inception with commit cd24834130ac ("s390/pci: base support") other
config accessors in particular pci_generic_config_read() as well as
pci_generic_config_write() return specific error values which are then
converted to errno by pcibios_err_to_errno(). Since latter does handle
the case where the error value already looks like an errno the previous
behavior is unlikely to cause actual issues.
Still, for consistency and in case any caller explicitly checks error
values align pci_read() and pci_write() with the generic accessors.
Reviewed-by: Benjamin Block <bblock@linux.ibm.com> Signed-off-by: Niklas Schnelle <schnelle@linux.ibm.com> Reviewed-by: Farhan Ali <alifm@linux.ibm.com> Signed-off-by: Heiko Carstens <hca@linux.ibm.com>
Niklas Schnelle [Thu, 8 Jan 2026 15:45:53 +0000 (16:45 +0100)]
s390/pci: Handle futile config accesses of disabled devices directly
On s390 PCI busses and slots with multiple functions may have holes
because PCI functions are passed-through by the hypervisor on a per
function basis and some functions may be in standby or reserved. This
fact is indicated by returning true from the
hypervisor_isolated_pci_functions() helper and triggers common code to
scan all possible devfn values. Via pci_scan_single_device() this in
turn causes config reads for the device and vendor IDs, even for PCI
functions which are in standby and thereofore disabled.
So far these futile config reads, as well as potentially writes, which
can never succeed were handled by the PCI load/store instructions
themselves. This works as the platform just returns an error for
a disabled and thus not usable function handle. It does cause spamming
of error logs and additional overhead though.
Instead check if the used function handle is enabled in zpci_cfg_load()
and zpci_cfg_write() and if not enable directly return -ENODEV. Also
refactor zpci_cfg_load() and zpci_cfg_store() slightly to accommodate
the new logic while meeting modern kernel style guidelines.
Cc: stable@vger.kernel.org Fixes: a50297cf8235 ("s390/pci: separate zbus creation from scanning") Signed-off-by: Niklas Schnelle <schnelle@linux.ibm.com> Reviewed-by: Benjamin Block <bblock@linux.ibm.com> Reviewed-by: Farhan Ali <alifm@linux.ibm.com> Signed-off-by: Heiko Carstens <hca@linux.ibm.com>
Heiko Carstens [Sat, 17 Jan 2026 14:53:26 +0000 (15:53 +0100)]
Merge branch 'preempt'
Heiko Carstens says:
====================
The option to select PREEMPT_NONE will go away for all architectures which
support PREEMPT_LAZY [1]. Until now all distributions provide kernels built
with PREEMPT_NONE enabled for s390. In particular this means that all
preempt_disable() / preempt_enable() pairs are optimized away during
compile time.
With PREEMPT_LAZY this is not the case. Switching to PREEMPT_LAZY leads
to a kernel image size increase of ~218kb (defconfig, gcc15).
s390 provides optimized preempt primitives, however there is still room for
improvement. Since support for relocatable lowcore was added access to
preempt_count in lowcore requires an extra call of get_lowcore(), which
generates an extra instruction. Also all instructions have to use a base
register which is not zero to access preempt_count.
Address this by adding a couple of inline assemblies with alternatives.
This generates better code and reduces the size of a PREEMPT_LAZY built
kernel image by ~58kb.
Provide an inline assembly using alternatives to avoid the need of a
base register due to relocatable lowcore when adding or subtracting
small constants from preempt_count.
Main user is preempt_enable(), which subtracts one from preempt_count
and tests if the result is zero.
Provide an inline assembly using alternatives to avoid the need of a
base register due to relocatable lowcore when adding or subtracting
small constants from preempt_count.
Main user is preempt_disable(), which subtracts one from
preempt_count. With this the generated code changes from
Heiko Carstens [Tue, 13 Jan 2026 19:43:57 +0000 (20:43 +0100)]
s390/preempt: Optimize preempt_count()
Provide an inline assembly using alternatives to avoid the need of
a base register when reading preempt_count() from lowcore. Use the
LLGT instruction, which reads only the least significant 31 bits of
preempt_count. This masks out the encoded PREEMPT_NEED_RESCHED bit.
Overall savings are only 82 bytes according to bloat-o-meter. This
is because of different inlining decisions, and there aren't many
preempt_count() users in the kernel.
Reviewed-by: Sven Schnelle <svens@linux.ibm.com> Signed-off-by: Heiko Carstens <hca@linux.ibm.com>
Revisit and rework module parameter permissions for AP bus and zcrypt
device drivers.
In general all sysfs permissions for AP bus and zcrypt parameters should be
0444 so that user space tools like lszcrypt can read the current value of
module parameters.
Some exceptions are only for some internal tweak parameters like
ap_msg_pool_min_items and zcrypt_mempool_threshold which should only be
readable by an administrator.
Jens Remus [Thu, 11 Dec 2025 12:19:31 +0000 (13:19 +0100)]
s390/ptrace: Convert function macros to inline functions
Convert the function macros user_mode(), instruction_pointer(), and
user_stack_pointer() to inline functions, to align their definition
with x86 and arm64.
Use const qualifier on struct pt_regs pointer parameters to prevent
compiler warnings:
arch/s390/kernel/stacktrace.c: In function ‘arch_stack_walk_user_common’:
arch/s390/kernel/stacktrace.c:114:34: warning: passing argument 1 of
‘instruction_pointer’ discards ‘const’ qualifier from pointer target
type [-Wdiscarded-qualifiers]
...
arch/s390/kernel/stacktrace.c:117:48: warning: passing argument 1 of
‘user_stack_pointer’ discards ‘const’ qualifier from pointer target
type [-Wdiscarded-qualifiers]
...
While at it add const qualifier to all struct pt_regs pointer parameters
that are accessed read-only and use __always_inline instead of inline to
harmonize the helper functions.
Heiko Carstens [Fri, 12 Dec 2025 15:47:07 +0000 (16:47 +0100)]
s390/purgatory: Add -Wno-default-const-init-unsafe to KBUILD_CFLAGS
Add -Wno-default-const-init-unsafe to purgatory KBUILD_CFLAGS, similar
to scripts/Makefile.extrawarn, since clang generates warnings for the
dummy variable in typecheck():
CC arch/s390/purgatory/purgatory.o
arch/s390/include/asm/ptrace.h:221:9: warning: default initialization of an object of type 'typeof (regs->psw)' (aka 'const psw_t') leaves the object uninitialized [-Wdefault-const-init-var-unsafe]
221 | return psw_bits(regs->psw).pstate;
| ^
arch/s390/include/asm/ptrace.h:98:2: note: expanded from macro 'psw_bits'
98 | typecheck(psw_t, __psw); \
| ^
include/linux/typecheck.h:11:12: note: expanded from macro 'typecheck'
11 | typeof(x) __dummy2; \
| ^
Heiko Carstens [Fri, 12 Dec 2025 15:43:58 +0000 (16:43 +0100)]
s390/boot: Add -Wno-default-const-init-unsafe to KBUILD_CFLAGS
Add -Wno-default-const-init-unsafe to boot KBUILD_CFLAGS, similar to
scripts/Makefile.extrawarn, since clang generates warnings for the dummy
variable in typecheck():
CC arch/s390/boot/version.o
arch/s390/include/asm/ptrace.h:221:9: warning: default initialization of an object of type 'typeof (regs->psw)' (aka 'const psw_t') leaves the object uninitialized [-Wdefault-const-init-var-unsafe]
221 | return psw_bits(regs->psw).pstate;
| ^
arch/s390/include/asm/ptrace.h:98:2: note: expanded from macro 'psw_bits'
98 | typecheck(psw_t, __psw); \
| ^
include/linux/typecheck.h:11:12: note: expanded from macro 'typecheck'
11 | typeof(x) __dummy2; \
| ^
Linus Torvalds [Sun, 21 Dec 2025 23:28:59 +0000 (15:28 -0800)]
Merge tag 'coccinelle-6.19' of git://git.kernel.org/pub/scm/linux/kernel/git/jlawall/linux
Pull Coccinelle fixes from Julia Lawall:
"These fix a typo and make the coccicheck script more robust by
ensuring that only compatible semantic patches are executed for the
chosen mode"
* tag 'coccinelle-6.19' of git://git.kernel.org/pub/scm/linux/kernel/git/jlawall/linux:
Coccinelle: pm_runtime: Fix typo in report message
scripts: coccicheck: filter *.cocci files by MODE
Linus Torvalds [Sun, 21 Dec 2025 22:41:29 +0000 (14:41 -0800)]
Merge tag 'x86-urgent-2025-12-21' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip
Pull x86 fixes from Ingo Molnar:
- Fix FPU core dumps on certain CPU models
- Fix htmldocs build warning
- Export TLB tracing event name via header
- Remove unused constant from <linux/mm_types.h>
- Fix comments
- Fix whitespace noise in documentation
- Fix variadic structure's definition to un-confuse UBSAN
- Fix posted MSI interrupts irq_retrigger() bug
- Fix asm build failure with older GCC builds
* tag 'x86-urgent-2025-12-21' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
x86/bug: Fix old GCC compile fails
x86/msi: Make irq_retrigger() functional for posted MSI
x86/platform/uv: Fix UBSAN array-index-out-of-bounds
mm: Remove tlb_flush_reason::NR_TLB_FLUSH_REASONS from <linux/mm_types.h>
x86/mm/tlb/trace: Export the TLB_REMOTE_WRONG_CPU enum in <trace/events/tlb.h>
x86/sgx: Remove unmatched quote in __sgx_encl_extend function comment
x86/boot/Documentation: Fix whitespace noise in boot.rst
x86/fpu: Fix FPU state core dump truncation on CPUs with no extended xfeatures
x86/boot/Documentation: Fix htmldocs build warning due to malformed table in boot.rst
Songwei Chai [Fri, 6 Jun 2025 06:09:36 +0000 (14:09 +0800)]
scripts: coccicheck: filter *.cocci files by MODE
Enhance the coccicheck script to filter *.cocci files based on the
specified MODE (e.g., report, patch). This ensures that only compatible
semantic patch files are executed, preventing errors such as:
"virtual rule report not supported"
This error occurs when a .cocci file does not define a 'virtual <MODE>'
rule, yet is executed in that mode.
For example:
make coccicheck M=drivers/hwtracing/coresight/ MODE=report
In this case, running "secs_to_jiffies.cocci" would trigger the error
because it lacks support for 'report' mode. With this change, such files
are skipped automatically, improving robustness and developer
experience.
Signed-off-by: Songwei Chai <quic_songchai@quicinc.com> Reviewed-by: Julia Lawall <Julia.Lawall@inria.fr>
Linus Torvalds [Sun, 21 Dec 2025 00:54:42 +0000 (16:54 -0800)]
Merge tag 'spi-fix-v6.19-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/spi
Pull spi fixes from Mark Brown:
"A small collection of fixes for various SPI drivers, plus a relaxation
of constraints in the DT for the DesignWare controller to reflect
hardware that's been seen.
There's several fixes for the Cadence QuadSPI driver since a fix
during the last release made some existing issues with error handling
during probe more readily visible"
* tag 'spi-fix-v6.19-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/spi:
spi: mt65xx: Use IRQF_ONESHOT with threaded IRQ
spi: dt-bindings: snps,dw-abp-ssi: Allow up to 16 chip-selects
spi: cadence-quadspi: Fix clock disable on probe failure path
spi: cadence-quadspi: Add error logging for DMA request failure
spi: fsl-cpm: Check length parity before switching to 16 bit mode
spi: mpfs: Fix an error handling path in mpfs_spi_probe()
// Three instructions to ajust the stack, read the per-cpu canary
// and copy it to 8(%rsp) ffffffff82067a3a: 48 83 ec 10 sub $0x10,%rsp ffffffff82067a3e: 65 48 8b 05 da 15 45 02 mov %gs:0x24515da(%rip),%rax # <__stack_chk_guard> ffffffff82067a46: 48 89 44 24 08 mov %rax,0x8(%rsp)
Linus Torvalds [Sat, 20 Dec 2025 20:45:35 +0000 (12:45 -0800)]
Merge tag 'xfs-fixes-6.19-rc2' of git://git.kernel.org/pub/scm/fs/xfs/xfs-linux
Pull xfs fixes from Carlos Maiolino:
"This contains a few fixes for zoned devices support, an UAF and a
compiler warning, and some cleaning up"
* tag 'xfs-fixes-6.19-rc2' of git://git.kernel.org/pub/scm/fs/xfs/xfs-linux:
xfs: fix the zoned RT growfs check for zone alignment
xfs: validate that zoned RT devices are zone aligned
xfs: fix XFS_ERRTAG_FORCE_ZERO_RANGE for zoned file system
xfs: fix a memory leak in xfs_buf_item_init()
xfs: fix stupid compiler warning
xfs: fix a UAF problem in xattr repair
xfs: ignore discard return value
Linus Torvalds [Sat, 20 Dec 2025 20:22:53 +0000 (12:22 -0800)]
Merge tag 'hwmon-for-v6.19-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/groeck/linux-staging
Pull hwmon fixes from Guenter Roeck:
- ltc4282: Fix reset_history file permissions
- ds620: Update broken Datasheet URL in driver documentation
- tmp401: Fix overflow caused by default conversion rate value
- ibmpex: Fix use-after-free in high/low store
- dell-smm: Limit fan multiplier to avoid overflow
* tag 'hwmon-for-v6.19-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/groeck/linux-staging:
hwmon: (ltc4282): Fix reset_history file permissions
hwmon: (DS620) Update broken Datasheet URL in driver documentation
hwmon: (tmp401) fix overflow caused by default conversion rate value
hwmon: (ibmpex) fix use-after-free in high/low store
hwmon: (dell-smm) Limit fan multiplier to avoid overflow
Linus Torvalds [Sat, 20 Dec 2025 20:18:32 +0000 (12:18 -0800)]
Merge tag 'mmc-v6.19-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/ulfh/mmc
Pull MMC host fixes from Ulf Hansson:
- sdhci-esdhc-imx: Fix build problem dependency
- sdhci-of-arasan: Increase card-detect stable timeout to 2 seconds
- sdhci-of-aspeed: Fix DT doc for missing properties
* tag 'mmc-v6.19-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/ulfh/mmc:
mmc: sdhci-esdhc-imx: add alternate ARCH_S32 dependency to Kconfig
mmc: sdhci-of-arasan: Increase CD stable timeout to 2 seconds
dt-bindings: mmc: sdhci-of-aspeed: Switch ref to sdhci-common.yaml
Linus Torvalds [Sat, 20 Dec 2025 20:08:02 +0000 (12:08 -0800)]
Merge tag 'drm-fixes-2025-12-20' of https://gitlab.freedesktop.org/drm/kernel
Pull drm fixes from Dave Airlie:
"rc2 fixes for the week, mostly xe, with amdgpu as usual. Then a
smattering of small fixes across the core/tests/panel and amdxdna.
I expect things will be quiet for rc3/4 as teams take a break, and I'm
travelling but will keep an eye on things.
core:
- fix gem handle leak on DRM_IOCTL_GEM_CHANGE_HANDLE
xe:
- Limit num_syncs to prevent oversized kernel allocations
- Disallow 0 OA property values
- Disallow 0 EU stall property values
- Fix kobject leak
- Workaround
- Loop variable reference fix
- Fix a CONFIG corner-case incorrect number of argument
- Skip reason prefix while emitting array
- VF migration fix
- Fix context in mei interrupt top half
- Don't include the CCS metadata in the dma-buf sg-table
- VF queueing recovery work fix
- Increase TDF timeout
- GT reset registers vs scheduler ordering fix
- Adjust long-running workload timeslices
- Always set OA_OAGLBCTXCTRL_COUNTER_RESUME
- Fix a return value
- Drop preempt-fences when destroying imported dma-bufs
- Use usleep_range for accurate long-running workload timeslicing
* tag 'drm-fixes-2025-12-20' of https://gitlab.freedesktop.org/drm/kernel: (34 commits)
drm/xe: Use usleep_range for accurate long-running workload timeslicing
drm/xe: Drop preempt-fences when destroying imported dma-bufs.
drm/xe/eustall: Disallow 0 EU stall property values
drm/xe/oa: Disallow 0 OA property values
drm/xe/xe_sriov_vfio: Fix return value in xe_sriov_vfio_migration_supported()
drm/xe/oa: Always set OAG_OAGLBCTXCTRL_COUNTER_RESUME
drm/xe: Adjust long-running workload timeslices to reasonable values
drm/xe/oa: Limit num_syncs to prevent oversized allocations
drm/xe: Limit num_syncs to prevent oversized allocations
drm/amdkfd: Fix improper NULL termination of queue restore SMI event string
drm/amd/pm: restore SCLK settings after S0ix resume
drm/amdgpu: fix a job->pasid access race in gpu recovery
drm/amd/display: Fix DP no audio issue
drm/amd/display: Fix scratch registers offsets for DCN351
drm/amd/display: Fix scratch registers offsets for DCN35
drm/amd: Resume the device in thaw() callback when console suspend is disabled
drm/panel: visionox-rm69299: Depend on BACKLIGHT_CLASS_DEVICE
accel/amdxdna: Block running under a hypervisor
drm/panel: sony-td4353-jdi: Enable prepare_prev_first
drm/xe: Restore engine registers before restarting schedulers after GT reset
...
Linus Torvalds [Sat, 20 Dec 2025 19:59:06 +0000 (11:59 -0800)]
Merge tag 'linux_kselftest-kunit-fixes-6.19-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/shuah/linux-kselftest
Pull kunit fixes from Shuah Khan:
"Drop unused parameter from kunit_device_register_internal and make
FAULT_TEST default to n when PANIC_ON_OOPS"
* tag 'linux_kselftest-kunit-fixes-6.19-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/shuah/linux-kselftest:
kunit: make FAULT_TEST default to n when PANIC_ON_OOPS
kunit: Drop unused parameter from kunit_device_register_internal
Linus Torvalds [Sat, 20 Dec 2025 19:40:51 +0000 (11:40 -0800)]
Merge tag 'mips-fixes_6.19_1' of git://git.kernel.org/pub/scm/linux/kernel/git/mips/linux
Pull MIPS fixes from Thomas Bogendoerfer:
- Fix build error for Alchemy
- Fix reference leak
* tag 'mips-fixes_6.19_1' of git://git.kernel.org/pub/scm/linux/kernel/git/mips/linux:
MIPS: Fix a reference leak bug in ip22_check_gio()
MIPS: Alchemy: Remove bogus static/inline specifiers
Linus Torvalds [Sat, 20 Dec 2025 19:34:37 +0000 (11:34 -0800)]
Merge tag 'arm64-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux
Pull arm64 fixes from Catalin Marinas:
"Two left-over updates that could not go into -rc1 due to conflicts
with other series:
- Simplify checks in arch_kfence_init_pool() since
force_pte_mapping() already takes BBML2-noabort (break-before-make
Level 2 with no aborts generated) into account
- Remove unneeded SVE/SME fallback preserve/store handling in the
arm64 EFI. With the recent updates, the fallback path is only taken
for EFI runtime calls from hardirq or NMI contexts. In practice,
this only happens under panic/oops/emergency_restart() and no
restoring of the user state expected.
There's a corresponding lkdtm update to trigger a BUG() or panic()
from hardirq context together with a fixup not to confuse
clang/objtool about the control flow
GCS (guarded control stacks) fix: flush the GCS locking state on exec,
otherwise the new task will not be able to enable GCS (locked as
disabled)"
* tag 'arm64-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux:
lkdtm/bugs: Do not confuse the clang/objtool with busy wait loop
arm64/gcs: Flush the GCS locking state on exec
arm64/efi: Remove unneeded SVE/SME fallback preserve/store handling
lkdtm/bugs: Add cases for BUG and PANIC occurring in hardirq context
arm64: mm: Simplify check in arch_kfence_init_pool()
Linus Torvalds [Sat, 20 Dec 2025 19:31:37 +0000 (11:31 -0800)]
Merge tag 'for-linus' of git://git.kernel.org/pub/scm/virt/kvm/kvm
Pull x86 kvm fixes from Paolo Bonzini:
"x86 fixes. Everyone else is already in holiday mood apparently.
- Add a missing 'break' to fix param parsing in the rseq selftest
- Apply runtime updates to the _current_ CPUID when userspace is
setting CPUID, e.g. as part of vCPU hotplug, to fix a false
positive and to avoid dropping the pending update
- Disallow toggling KVM_MEM_GUEST_MEMFD on an existing memslot, as
it's not supported by KVM and leads to a use-after-free due to KVM
failing to unbind the memslot from the previously-associated
guest_memfd instance
- Harden against similar KVM_MEM_GUEST_MEMFD goofs, and prepare for
supporting flags-only changes on KVM_MEM_GUEST_MEMFD memlslots,
e.g. for dirty logging
- Set exit_code[63:32] to -1 (all 0xffs) when synthesizing a nested
SVM_EXIT_ERR (a.k.a. VMEXIT_INVALID) #VMEXIT, as VMEXIT_INVALID is
defined as -1ull (a 64-bit value)
- Update SVI when activating APICv to fix a bug where a
post-activation EOI for an in-service IRQ would effective be lost
due to SVI being stale
- Immediately refresh APICv controls (if necessary) on a nested
VM-Exit instead of deferring the update via KVM_REQ_APICV_UPDATE,
as the request is effectively ignored because KVM thinks the vCPU
already has the correct APICv settings"
* tag 'for-linus' of git://git.kernel.org/pub/scm/virt/kvm/kvm:
KVM: nVMX: Immediately refresh APICv controls as needed on nested VM-Exit
KVM: VMX: Update SVI during runtime APICv activation
KVM: nSVM: Set exit_code_hi to -1 when synthesizing SVM_EXIT_ERR (failed VMRUN)
KVM: nSVM: Clear exit_code_hi in VMCB when synthesizing nested VM-Exits
KVM: Harden and prepare for modifying existing guest_memfd memslots
KVM: Disallow toggling KVM_MEM_GUEST_MEMFD on an existing memslot
KVM: selftests: Add a CPUID testcase for KVM_SET_CPUID2 with runtime updates
KVM: x86: Apply runtime updates to current CPUID during KVM_SET_CPUID{,2}
KVM: selftests: Add missing "break" in rseq_test's param parsing
Linus Torvalds [Sat, 20 Dec 2025 19:24:42 +0000 (11:24 -0800)]
Merge tag 'slab-for-6.19-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/vbabka/slab
Pull slab fix from Vlastimil Babka:
- A stable fix for a missing tag reset that can happen in
kfree_nolock() with KASAN+SLUB_TINY configs (Deepanshu Kartikey)
* tag 'slab-for-6.19-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/vbabka/slab:
mm/slub: reset KASAN tag in defer_free() before accessing freed memory
Linus Torvalds [Sat, 20 Dec 2025 19:18:32 +0000 (11:18 -0800)]
Merge tag 'iommu-fixes-v6.19-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/iommu/linux
Pull iommu fixes from Joerg Roedel:
- iommupt: Fix an oops found by syzcaller in the new generic
IO-page-table code.
- AMD-Vi: Fix IO_PAGE_FAULTs in kdump kernels triggered by re-using
domain-ids from previous kernel.
* tag 'iommu-fixes-v6.19-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/iommu/linux:
amd/iommu: Make protection domain ID functions non-static
amd/iommu: Preserve domain ids inside the kdump kernel
iommupt: Return ERR_PTR from _table_alloc()
Linus Torvalds [Sat, 20 Dec 2025 17:48:56 +0000 (09:48 -0800)]
Merge tag 'block-6.19-20251218' of git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux
Pull block fixes from Jens Axboe:
- ublk selftests for missing coverage
- two fixes for the block integrity code
- fix for the newly added newly added PR read keys ioctl, limiting the
memory that can be allocated
- work around for a deadlock that can occur with ublk, where partition
scanning ends up recursing back into file closure, which needs the
same mutex grabbed. Not the prettiest thing in the world, but an
acceptable work-around until we can eliminate the reliance on
disk->open_mutex for this
- fix for a race between enabling writeback throttling and new IO
submissions
- move a bit of bio flag handling code. No changes, but needed for a
patchset for a future kernel
- fix for an init time id leak failure in rnbd
- loop/zloop state check fix
* tag 'block-6.19-20251218' of git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux:
block: validate interval_exp integrity limit
block: validate pi_offset integrity limit
block: rnbd-clt: Fix leaked ID in init_dev()
ublk: fix deadlock when reading partition table
block: add allocation size check in blkdev_pr_read_keys()
Documentation: admin-guide: blockdev: replace zone_capacity with zone_capacity_mb when creating devices
zloop: use READ_ONCE() to read lo->lo_state in queue_rq path
loop: use READ_ONCE() to read lo->lo_state without locking
block: fix race between wbt_enable_default and IO submission
selftests: ublk: add user copy test cases
selftests: ublk: add support for user copy to kublk
selftests: ublk: forbid multiple data copy modes
selftests: ublk: don't share backing files between ublk servers
selftests: ublk: use auto_zc for PER_IO_DAEMON tests in stress_04
selftests: ublk: fix fio arguments in run_io_and_recover()
selftests: ublk: remove unused ios map in seq_io.bt
selftests: ublk: correct last_rw map type in seq_io.bt
selftests: ublk: fix overflow in ublk_queue_auto_zc_fallback()
block: move around bio flagging helpers
Linus Torvalds [Sat, 20 Dec 2025 17:38:56 +0000 (09:38 -0800)]
Merge tag 'io_uring-6.19-20251218' of git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux
Pull io_uring fix from Jens Axboe:
"Just a single fix this week, for an issue with the calculation of the
number of segments in the ublk kbuf import path"
* tag 'io_uring-6.19-20251218' of git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux:
io_uring: fix nr_segs calculation in io_import_kbuf
Catalin Marinas [Fri, 19 Dec 2025 15:09:09 +0000 (15:09 +0000)]
lkdtm/bugs: Do not confuse the clang/objtool with busy wait loop
Since commit eb972eab0794 ("lkdtm/bugs: Add cases for BUG and PANIC
occurring in hardirq context"), building with clang for x86_64 results
in the following warnings:
vmlinux.o: warning: objtool: lkdtm_PANIC_IN_HARDIRQ(): unexpected end of section .text.lkdtm_PANIC_IN_HARDIRQ
vmlinux.o: warning: objtool: lkdtm_BUG_IN_HARDIRQ(): unexpected end of section .text.lkdtm_BUG_IN_HARDIRQ
caused by busy "while (wait_for_...);" loops. Add READ_ONCE() and
cpu_relax() to better indicate the intention and avoid any unwanted
compiler optimisations.
Fixes: eb972eab0794 ("lkdtm/bugs: Add cases for BUG and PANIC occurring in hardirq context") Reported-by: kernel test robot <lkp@intel.com> Closes: https://lore.kernel.org/oe-kbuild-all/202512190111.jxFSqxUH-lkp@intel.com/ Signed-off-by: Catalin Marinas <catalin.marinas@arm.com>
Sairaj Kodilkar [Fri, 21 Nov 2025 09:11:16 +0000 (14:41 +0530)]
amd/iommu: Make protection domain ID functions non-static
So that both iommu.c and init.c can utilize them. Also define a new
function 'pdom_id_destroy()' to destroy 'pdom_ids' instead of directly
calling ida functions.
Sairaj Kodilkar [Fri, 21 Nov 2025 09:11:15 +0000 (14:41 +0530)]
amd/iommu: Preserve domain ids inside the kdump kernel
Currently AMD IOMMU driver does not reserve domain ids programmed in the
DTE while reusing the device table inside kdump kernel. This can cause
reallocation of these domain ids for newer domains that are created by
the kdump kernel, which can lead to potential IO_PAGE_FAULTs
Hence reserve these ids inside pdom_ids.
Fixes: 38e5f33ee359 ("iommu/amd: Reuse device table for kdump") Signed-off-by: Sairaj Kodilkar <sarunkod@amd.com> Reported-by: Jason Gunthorpe <jgg@nvidia.com> Reviewed-by: Vasant Hegde <vasant.hegde@amd.com> Reviewed-by: Jason Gunthorpe <jgg@nvidia.com> Signed-off-by: Joerg Roedel <joerg.roedel@amd.com>
Junjie Cao [Fri, 19 Dec 2025 05:56:59 +0000 (21:56 -0800)]
Input: ti_am335x_tsc - fix off-by-one error in wire_order validation
The current validation 'wire_order[i] > ARRAY_SIZE(config_pins)' allows
wire_order[i] to equal ARRAY_SIZE(config_pins), which causes out-of-bounds
access when used as index in 'config_pins[wire_order[i]]'.
Since config_pins has 4 elements (indices 0-3), the valid range for
wire_order should be 0-3. Fix the off-by-one error by using >= instead
of > in the validation check.
Signed-off-by: Junjie Cao <junjie.cao@intel.com> Link: https://patch.msgid.link/20251114062817.852698-1-junjie.cao@intel.com Fixes: bb76dc09ddfc ("input: ti_am33x_tsc: Order of TSC wires, made configurable") Cc: stable@vger.kernel.org Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
Gergo Koteles [Thu, 13 Nov 2025 16:02:58 +0000 (17:02 +0100)]
Input: add ABS_SND_PROFILE
ABS_SND_PROFILE used to describe the state of a multi-value sound profile
switch. This will be used for the alert-slider on OnePlus phones or other
phones.
Profile values added as SND_PROFLE_(SILENT|VIBRATE|RING) identifiers
to input-event-codes.h so they can be used from DTS.
Dave Airlie [Thu, 18 Dec 2025 21:32:21 +0000 (07:32 +1000)]
Merge tag 'drm-misc-fixes-2025-12-18' of https://gitlab.freedesktop.org/drm/misc/kernel into drm-fixes
drm-misc-fixes for v6.19-rc2:
- Add -EDEADLK handling in drm unit tests.
- Plug DRM_IOCTL_GEM_CHANGE_HANDLE leak.
- Fix regression in sony-td4353-jdi.
- Kconfig fix for visionox-rm69299.
- Do not load amdxdna when running virtualized.
Linus Torvalds [Thu, 18 Dec 2025 21:30:55 +0000 (09:30 +1200)]
Merge tag 'trace-v6.19-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace
Pull tracing fixes from Steven Rostedt:
- Add Documentation/core-api/tracepoint.rst to TRACING in MAINTAINERS
file
Updates to the tracepoint.rst document should be reviewed by the
tracing maintainers.
- Fix warning triggered by perf attaching to synthetic events
The synthetic events do not add a function to be registered when perf
attaches to them. This causes a warning when perf registers a
synthetic event and passes a NULL pointer to the tracepoint register
function.
Ideally synthetic events should be updated to work with perf, but as
that's a feature and not a bug fix, simply now return -ENODEV when
perf tries to register an event that has a NULL pointer for its
function. This no longer causes a kernel warning and simply causes
the perf code to fail with an error message.
- Fix 32bit overflow in option flag test
The option's flags changed from 32 bits in size to 64 bits in size.
Fix one of the places that shift 1 by the option bit number to to be
1ULL.
- Fix the output of printing the direct jmp functions
The enabled_functions that shows how functions are being attached by
ftrace wasn't updated to accommodate the new direct jmp trampolines
that set the LSB of the pointer, and outputs garbage. Update the
output to handle the direct jmp trampolines.
* tag 'trace-v6.19-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace:
ftrace: Fix address for jmp mode in t_show()
tracing: Fix UBSAN warning in __remove_instance()
tracing: Do not register unsupported perf events
MAINTAINERS: add tracepoint core-api doc files to TRACING
Linus Torvalds [Thu, 18 Dec 2025 20:39:48 +0000 (08:39 +1200)]
Merge tag 'libcrypto-fixes-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/ebiggers/linux
Pull crypto library fixes from Eric Biggers:
- Fix a performance issue with the scoped_ksimd() macro (new in 6.19)
where it unnecessarily initialized the entire fpsimd state.
- Add a missing gitignore entry for a generated file added in 6.18.
* tag 'libcrypto-fixes-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/ebiggers/linux:
lib/crypto: riscv: Add poly1305-core.S to .gitignore
arm64/simd: Avoid pointless clearing of FP/SIMD buffer
Linus Torvalds [Thu, 18 Dec 2025 20:37:08 +0000 (08:37 +1200)]
Merge tag 'acpi-6.19-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm
Pull ACPI fixes from Rafael Wysocki:
"These add a missing PCC check for guaranteed_perf in the ACPI CPPC
library and fix a static local variable access race condition in
acpi_pcc_address_space_setup() (Pengjie Zhang)"
* tag 'acpi-6.19-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm:
ACPI: PCC: Fix race condition by removing static qualifier
ACPI: CPPC: Fix missing PCC check for guaranteed_perf
Linus Torvalds [Thu, 18 Dec 2025 20:28:02 +0000 (08:28 +1200)]
Merge tag 'pm-6.19-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm
Pull power management fixes from Rafael Wysocki:
"These fix three issues in the power capping code including one recent
regression and a runtime PM framework regression introduced during the
6.17 development cycle:
- Fix CPU hotplug locking deadlock reported by lockdep after a recent
update of the Intel RAPL power capping driver (Srinivas Pandruvada)
- Fix sscanf() error return value handling in the power capping core
and a race condition in register_control_type() (Sumeet Pawnikar)
- Fix a concurrent bit field update issue in the runtime PM core code
by only updating the bit field in question when runtime PM is
disabled (Rafael Wysocki)"
* tag 'pm-6.19-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm:
powercap: intel_rapl: Fix possible recursive lock warning
PM: runtime: Do not clear needs_force_resume with enabled runtime PM
powercap: fix sscanf() error return value handling
powercap: fix race condition in register_control_type()
Linus Torvalds [Thu, 18 Dec 2025 20:23:23 +0000 (08:23 +1200)]
Merge tag 'thermal-6.19-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm
Pull thermal control fixes from Rafael Wysocki:
"These enable a new hardware feature in the int340x thermal driver and
fix up comments in the thermal core code:
- Set a feature flag in the int340x thermal driver to enable the
power slider interface for Wildcat Lake processors (Srinivas
Pandruvada)
- Fix typo and indentation in comments in the thermal core (Thorsten
Blum)"
* tag 'thermal-6.19-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm:
thermal: core: Fix typo and indentation in comments
thermal: intel: int340x: Enable power slider interface for Wildcat Lake
Input: apple_z2 - fix reading incorrect reports after exiting sleep
Under certain conditions (more prevalent after a suspend/resume cycle),
the touchscreen controller can send the "boot complete" interrupt before
it actually finished booting. In those cases, attempting to read touch
data resuls in a stream of "not ready" messages being read and
interpreted as a touch report. Check that the response is in fact a
touch report and discard it otherwise.
Reported-by: pitust <piotr@stelmaszek.com> Closes: https://oftc.catirclogs.org/asahi/2025-12-17#34878715; Fixes: 471a92f8a21a ("Input: apple_z2 - add a driver for Apple Z2 touchscreens") Signed-off-by: Sasha Finkelstein <fnkl.kernel@gmail.com> Link: https://patch.msgid.link/20251218-z2-init-fix-v1-1-48e3aa239caf@gmail.com Cc: stable@vger.kernel.org Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
Linus Torvalds [Thu, 18 Dec 2025 20:11:53 +0000 (08:11 +1200)]
Merge tag 'for-linus-iommufd' of git://git.kernel.org/pub/scm/linux/kernel/git/jgg/iommufd
Pull iommufd fixes from Jason Gunthorpe:
"A few minor fixes, other than the randconfig fix this is only relevant
to test code, not releases:
- Randconfig failure if CONFIG_DMA_SHARED_BUFFER is not set
- Remove gcc warning in kselftest
- Fix a refcount leak on an error path in the selftest support code
- Fix missing overflow checks in the selftest support code"
* tag 'for-linus-iommufd' of git://git.kernel.org/pub/scm/linux/kernel/git/jgg/iommufd:
iommufd/selftest: Check for overflow in IOMMU_TEST_OP_ADD_RESERVED
iommufd/selftest: Do not leak the hwpt if IOMMU_TEST_OP_MD_CHECK_MAP fails
iommufd/selftest: Make it clearer to gcc that the access is not out of bounds
iommufd: Fix building without dmabuf
- Jozsef Kadlecsik retires from maintaining netfilter
- tools: ynl: fix build on systems with old kernel headers"
* tag 'net-6.19-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net: (83 commits)
net: hns3: add VLAN id validation before using
net: hns3: using the num_tqps to check whether tqp_index is out of range when vf get ring info from mbx
net: hns3: using the num_tqps in the vf driver to apply for resources
net: enetc: do not transmit redirected XDP frames when the link is down
selftests/tc-testing: Test case exercising potential mirred redirect deadlock
net/sched: act_mirred: fix loop detection
sctp: Clear inet_opt in sctp_v6_copy_ip_options().
sctp: Fetch inet6_sk() after setting ->pinet6 in sctp_clone_sock().
net/handshake: duplicate handshake cancellations leak socket
net/mlx5e: Don't include PSP in the hard MTU calculations
net/mlx5e: Do not update BQL of old txqs during channel reconfiguration
net/mlx5e: Trigger neighbor resolution for unresolved destinations
net/mlx5e: Use ip6_dst_lookup instead of ipv6_dst_lookup_flow for MAC init
net/mlx5: Serialize firmware reset with devlink
net/mlx5: fw_tracer, Handle escaped percent properly
net/mlx5: fw_tracer, Validate format string parameters
net/mlx5: Drain firmware reset in shutdown callback
net/mlx5: fw reset, clear reset requested on drain_fw_reset
net: dsa: mxl-gsw1xx: manually clear RANEG bit
net: dsa: mxl-gsw1xx: fix .shutdown driver operation
...
Linus Torvalds [Thu, 18 Dec 2025 19:50:20 +0000 (07:50 +1200)]
Merge tag 'v6.19-rc1-smb3-client-fixes' of git://git.samba.org/sfrench/cifs-2.6
Pull smb client fixes from Steve French:
- important fix for reconnect problem
- minor cleanup
* tag 'v6.19-rc1-smb3-client-fixes' of git://git.samba.org/sfrench/cifs-2.6:
cifs: update internal module version number
smb: move some SMB1 definitions into common/smb1pdu.h
smb: align durable reconnect v2 context to 8 byte boundary
Linus Torvalds [Thu, 18 Dec 2025 19:41:17 +0000 (07:41 +1200)]
Merge tag 'fsnotify_for_v6.19-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/jack/linux-fs
Pull fsnotify fixes from Jan Kara:
"Two fsnotify fixes.
The fix from Ahelenia makes sure we generate event when modifying
inode flags, the fix from Amir disables sending of events from device
inodes to their parent directory as it could concievably create a
usable side channel attack in case of some devices and so far we
aren't aware of anybody depending on the functionality"
* tag 'fsnotify_for_v6.19-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/jack/linux-fs:
fs: send fsnotify_xattr()/IN_ATTRIB from vfs_fileattr_set()/chattr(1)
fsnotify: do not generate ACCESS/MODIFY events on child for special files
Paolo Bonzini [Thu, 18 Dec 2025 17:38:45 +0000 (18:38 +0100)]
Merge tag 'kvm-x86-fixes-6.19-rc1' of https://github.com/kvm-x86/linux into HEAD
KVM fixes for 6.19-rc1
- Add a missing "break" to fix param parsing in the rseq selftest.
- Apply runtime updates to the _current_ CPUID when userspace is setting
CPUID, e.g. as part of vCPU hotplug, to fix a false positive and to avoid
dropping the pending update.
- Disallow toggling KVM_MEM_GUEST_MEMFD on an existing memslot, as it's not
supported by KVM and leads to a use-after-free due to KVM failing to unbind
the memslot from the previously-associated guest_memfd instance.
- Harden against similar KVM_MEM_GUEST_MEMFD goofs, and prepare for supporting
flags-only changes on KVM_MEM_GUEST_MEMFD memlslots, e.g. for dirty logging.
- Set exit_code[63:32] to -1 (all 0xffs) when synthesizing a nested
SVM_EXIT_ERR (a.k.a. VMEXIT_INVALID) #VMEXIT, as VMEXIT_INVALID is defined
as -1ull (a 64-bit value).
- Update SVI when activating APICv to fix a bug where a post-activation EOI
for an in-service IRQ would effective be lost due to SVI being stale.
- Immediately refresh APICv controls (if necessary) on a nested VM-Exit
instead of deferring the update via KVM_REQ_APICV_UPDATE, as the request is
effectively ignored because KVM thinks the vCPU already has the correct
APICv settings.
Matthew Brost [Fri, 12 Dec 2025 18:28:42 +0000 (10:28 -0800)]
drm/xe: Use usleep_range for accurate long-running workload timeslicing
msleep is not very accurate in terms of how long it actually sleeps,
whereas usleep_range is precise. Replace the timeslice sleep for
long-running workloads with the more accurate usleep_range to avoid
jitter if the sleep period is less than 20ms.
Thomas Hellström [Wed, 17 Dec 2025 09:34:41 +0000 (10:34 +0100)]
drm/xe: Drop preempt-fences when destroying imported dma-bufs.
When imported dma-bufs are destroyed, TTM is not fully
individualizing the dma-resv, but it *is* copying the fences that
need to be waited for before declaring idle. So in the case where
the bo->resv != bo->_resv we can still drop the preempt-fences, but
make sure we do that on bo->_resv which contains the fence-pointer
copy.
In the case where the copying fails, bo->_resv will typically not
contain any fences pointers at all, so there will be nothing to
drop. In that case, TTM would have ensured all fences that would
have been copied are signaled, including any remaining preempt
fences.
Fixes: dd08ebf6c352 ("drm/xe: Introduce a new DRM driver for Intel GPUs") Fixes: fa0af721bd1f ("drm/ttm: test private resv obj on release/destroy") Cc: Matthew Brost <matthew.brost@intel.com> Cc: <stable@vger.kernel.org> # v6.16+ Signed-off-by: Thomas Hellström <thomas.hellstrom@linux.intel.com> Tested-by: Matthew Brost <matthew.brost@intel.com> Reviewed-by: Matthew Brost <matthew.brost@intel.com> Link: https://patch.msgid.link/20251217093441.5073-1-thomas.hellstrom@linux.intel.com
(cherry picked from commit 425fe550fb513b567bd6d01f397d274092a9c274) Signed-off-by: Thomas Hellström <thomas.hellstrom@linux.intel.com>
Ashutosh Dixit [Fri, 12 Dec 2025 06:18:49 +0000 (22:18 -0800)]
drm/xe/oa: Disallow 0 OA property values
An OA property value of 0 is invalid and will cause a NPD.
Reported-by: Peter Senna Tschudin <peter.senna@linux.intel.com> Closes: https://gitlab.freedesktop.org/drm/xe/kernel/-/issues/6452 Fixes: cc4e6994d5a2 ("drm/xe/oa: Move functions up so they can be reused for config ioctl") Cc: stable@vger.kernel.org Signed-off-by: Ashutosh Dixit <ashutosh.dixit@intel.com> Reviewed-by: Harish Chegondi <harish.chegondi@intel.com> Link: https://patch.msgid.link/20251212061850.1565459-3-ashutosh.dixit@intel.com
(cherry picked from commit 7a100e6ddcc47c1f6ba7a19402de86ce24790621) Signed-off-by: Thomas Hellström <thomas.hellstrom@linux.intel.com>
Dan Carpenter [Fri, 5 Dec 2025 11:39:19 +0000 (14:39 +0300)]
drm/xe/xe_sriov_vfio: Fix return value in xe_sriov_vfio_migration_supported()
The xe_sriov_vfio_migration_supported() function is type bool so
returning -EPERM means returning true. Return false instead.
Fixes: bd45d46ffc8f ("drm/xe/pf: Export helpers for VFIO") Signed-off-by: Dan Carpenter <dan.carpenter@linaro.org> Reviewed-by: Michal Wajdeczko <michal.wajdeczko@intel.com> Link: https://patch.msgid.link/aTLEZ4g-FD-iMQ2V@stanley.mountain Signed-off-by: Michał Winiarski <michal.winiarski@intel.com>
(cherry picked from commit 0a2404c8f6a3a120f79c57ef8a3302c8e8bc34d9) Signed-off-by: Thomas Hellström <thomas.hellstrom@linux.intel.com>
Ashutosh Dixit [Fri, 5 Dec 2025 21:26:13 +0000 (13:26 -0800)]
drm/xe/oa: Always set OAG_OAGLBCTXCTRL_COUNTER_RESUME
Reports can be written out to the OA buffer using ways other than periodic
sampling. These include mmio trigger and context switches. To support these
use cases, when periodic sampling is not enabled,
OAG_OAGLBCTXCTRL_COUNTER_RESUME must be set.
Matthew Brost [Fri, 12 Dec 2025 18:28:41 +0000 (10:28 -0800)]
drm/xe: Adjust long-running workload timeslices to reasonable values
A 10ms timeslice for long-running workloads is far too long and causes
significant jitter in benchmarks when the system is shared. Adjust the
value to 5ms for preempt-fencing VMs, as the resume step there is quite
costly as memory is moved around, and set it to zero for pagefault VMs,
since switching back to pagefault mode after dma-fence mode is
relatively fast.
Also change min_run_period_ms to 'unsiged int' type rather than 's64' as
only positive values make sense.
Shuicheng Lin [Fri, 5 Dec 2025 23:47:18 +0000 (23:47 +0000)]
drm/xe/oa: Limit num_syncs to prevent oversized allocations
The OA open parameters did not validate num_syncs, allowing
userspace to pass arbitrarily large values, potentially
leading to excessive allocations.
Add check to ensure that num_syncs does not exceed DRM_XE_MAX_SYNCS,
returning -EINVAL when the limit is violated.
v2: use XE_IOCTL_DBG() and drop duplicated check. (Ashutosh)
Fixes: c8507a25cebd ("drm/xe/oa/uapi: Define and parse OA sync properties") Cc: Matthew Brost <matthew.brost@intel.com> Cc: Ashutosh Dixit <ashutosh.dixit@intel.com> Signed-off-by: Shuicheng Lin <shuicheng.lin@intel.com> Reviewed-by: Ashutosh Dixit <ashutosh.dixit@intel.com> Signed-off-by: Matthew Brost <matthew.brost@intel.com> Link: https://patch.msgid.link/20251205234715.2476561-6-shuicheng.lin@intel.com
(cherry picked from commit e057b2d2b8d815df3858a87dffafa2af37e5945b) Signed-off-by: Thomas Hellström <thomas.hellstrom@linux.intel.com>
Shuicheng Lin [Fri, 5 Dec 2025 23:47:17 +0000 (23:47 +0000)]
drm/xe: Limit num_syncs to prevent oversized allocations
The exec and vm_bind ioctl allow userspace to specify an arbitrary
num_syncs value. Without bounds checking, a very large num_syncs
can force an excessively large allocation, leading to kernel warnings
from the page allocator as below.
Introduce DRM_XE_MAX_SYNCS (set to 1024) and reject any request
exceeding this limit.
v2: Add "Reported-by" and Cc stable kernels.
v3: Change XE_MAX_SYNCS from 64 to 1024. (Matt & Ashutosh)
v4: s/XE_MAX_SYNCS/DRM_XE_MAX_SYNCS/ (Matt)
v5: Do the check at the top of the exec func. (Matt)
Fixes: dd08ebf6c352 ("drm/xe: Introduce a new DRM driver for Intel GPUs") Reported-by: Koen Koning <koen.koning@intel.com> Reported-by: Peter Senna Tschudin <peter.senna@linux.intel.com> Closes: https://gitlab.freedesktop.org/drm/xe/kernel/-/issues/6450 Cc: <stable@vger.kernel.org> # v6.12+ Cc: Matthew Brost <matthew.brost@intel.com> Cc: Michal Mrozek <michal.mrozek@intel.com> Cc: Carl Zhang <carl.zhang@intel.com> Cc: José Roberto de Souza <jose.souza@intel.com> Cc: Lionel Landwerlin <lionel.g.landwerlin@intel.com> Cc: Ivan Briano <ivan.briano@intel.com> Cc: Thomas Hellström <thomas.hellstrom@linux.intel.com> Cc: Ashutosh Dixit <ashutosh.dixit@intel.com> Signed-off-by: Shuicheng Lin <shuicheng.lin@intel.com> Reviewed-by: Matthew Brost <matthew.brost@intel.com> Signed-off-by: Matthew Brost <matthew.brost@intel.com> Link: https://patch.msgid.link/20251205234715.2476561-5-shuicheng.lin@intel.com
(cherry picked from commit b07bac9bd708ec468cd1b8a5fe70ae2ac9b0a11c) Signed-off-by: Thomas Hellström <thomas.hellstrom@linux.intel.com>
Various code assumes that the integrity interval is at least 1 sector
and evenly divides the logical block size. Add these checks to
blk_validate_integrity_limits(). This guards against block drivers that
report invalid interval_exp values.
The PI tuple must be contained within the metadata value, so validate
that pi_offset + pi_tuple_size <= metadata_size. This guards against
block drivers that report invalid pi_offset values.
Paolo Abeni [Thu, 18 Dec 2025 16:23:07 +0000 (17:23 +0100)]
Merge tag 'linux-can-fixes-for-6.19-20251218' of git://git.kernel.org/pub/scm/linux/kernel/git/mkl/linux-can
Marc Kleine-Budde says:
====================
pull-request: can 2025-12-18
this is a pull request of 3 patches for net/main.
Tetsuo Handa contributes 2 patches to fix race windows in the j1939
protocol to properly handle disappearing network devices.
The last patch is by me, it fixes a build dependency with the CAN
drivers, that got introduced while fixing a dependency between the CAN
protocol and CAN device code.
* tag 'linux-can-fixes-for-6.19-20251218' of git://git.kernel.org/pub/scm/linux/kernel/git/mkl/linux-can:
can: fix build dependency
can: j1939: make j1939_sk_bind() fail if device is no longer registered
can: j1939: make j1939_session_activate() fail if device is no longer registered
====================
projects / thirdparty / kernel / linux.git / log
