Eric Biggers [Thu, 26 Mar 2026 00:15:00 +0000 (17:15 -0700)]
crypto: geniv - Use crypto_stdrng_get_bytes()
Replace the sequence of crypto_get_default_rng(),
crypto_rng_get_bytes(), and crypto_put_default_rng() with the equivalent
helper function crypto_stdrng_get_bytes().
Signed-off-by: Eric Biggers <ebiggers@kernel.org> Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Eric Biggers [Thu, 26 Mar 2026 00:14:59 +0000 (17:14 -0700)]
crypto: ecc - Use crypto_stdrng_get_bytes()
Replace the sequence of crypto_get_default_rng(),
crypto_rng_get_bytes(), and crypto_put_default_rng() with the equivalent
helper function crypto_stdrng_get_bytes().
Signed-off-by: Eric Biggers <ebiggers@kernel.org> Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Eric Biggers [Thu, 26 Mar 2026 00:14:58 +0000 (17:14 -0700)]
crypto: dh - Use crypto_stdrng_get_bytes()
Replace the sequence of crypto_get_default_rng(),
crypto_rng_get_bytes(), and crypto_put_default_rng() with the equivalent
helper function crypto_stdrng_get_bytes().
Signed-off-by: Eric Biggers <ebiggers@kernel.org> Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
While it may have been intended that callers amortize the cost of
getting and putting the "default RNG" (i.e. "stdrng") over multiple
calls, in practice that optimization is never used. The callers just
want a function that gets random bytes from the "stdrng".
Therefore, add such a function: crypto_stdrng_get_bytes().
Importantly, this decouples the callers from the crypto_rng API. That
allows a later commit to make this function simply call
get_random_bytes_wait() unless the kernel is in "FIPS mode".
Signed-off-by: Eric Biggers <ebiggers@kernel.org> Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Giovanni Cabiddu [Tue, 24 Mar 2026 18:29:05 +0000 (18:29 +0000)]
crypto: iaa - fix per-node CPU counter reset in rebalance_wq_table()
The cpu counter used to compute the IAA device index is reset to zero
at the start of each NUMA node iteration. This causes CPUs on every
node to map starting from IAA index 0 instead of continuing from the
previous node's last index. On multi-node systems, this results in all
nodes mapping their CPUs to the same initial set of IAA devices,
leaving higher-indexed devices unused.
Move the cpu counter initialization before the for_each_node_with_cpus()
loop so that the IAA index computation accumulates correctly across all
nodes.
Fixes: 714ca27e9bf4 ("crypto: iaa - Optimize rebalance_wq_table()") Signed-off-by: Giovanni Cabiddu <giovanni.cabiddu@intel.com> Acked-by: Vinicius Costa Gomes <vinicius.gomes@intel.com> Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Atharv Dubey [Tue, 24 Mar 2026 18:17:24 +0000 (18:17 +0000)]
crypto: qat - replace scnprintf() with sysfs_emit()
Replace scnprintf() with sysfs_emit() in the three RAS error counter
sysfs show callbacks. sysfs_emit() is the recommended API for sysfs show
functions as per Documentation/filesystems/sysfs.rst; it enforces the
PAGE_SIZE limit implicitly, removing the need to pass it explicitly.
Signed-off-by: Atharv Dubey <atharvd440@gmail.com> Signed-off-by: Giovanni Cabiddu <giovanni.cabiddu@intel.com> Reviewed-by: Ahsan Atta <ahsan.atta@intel.com> Reviewed-by: Andy Shevchenko <andriy.shevchenko@intel.com> Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Giovanni Cabiddu [Tue, 24 Mar 2026 18:17:23 +0000 (18:17 +0000)]
crypto: qat - fix type mismatch in RAS sysfs show functions
ADF_RAS_ERR_CTR_READ() expands to atomic_read(), which returns int.
The local variable 'counter' was declared as 'unsigned long', causing
a type mismatch on the assignment. The format specifier '%ld' was
consequently wrong in two ways: wrong length modifier and wrong
signedness.
Use int to match the return type of atomic_read() and update the
format specifier to '%d' accordingly.
Fixes: 532d7f6bc458 ("crypto: qat - add error counters") Signed-off-by: Giovanni Cabiddu <giovanni.cabiddu@intel.com> Reviewed-by: Ahsan Atta <ahsan.atta@intel.com> Reviewed-by: Andy Shevchenko <andriy.shevchenko@intel.com> Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Giovanni Cabiddu [Tue, 24 Mar 2026 17:59:40 +0000 (17:59 +0000)]
crypto: qat - fix compression instance leak
qat_comp_alg_init_tfm() acquires a compression instance via
qat_compression_get_instance_node() before calling qat_comp_build_ctx()
to initialize the compression context. If qat_comp_build_ctx() fails, the
function returns an error without releasing the compression instance,
causing a resource leak.
When qat_comp_build_ctx() fails, release the compression instance with
qat_compression_put_instance() and clear the context to avoid leaving a
stale reference to the released instance.
The issue was introduced when build_deflate_ctx() (which always returned
void) was replaced by qat_comp_build_ctx() (which can return an error)
without adding error handling for the failure path.
Fixes: cd0e7160f80f ("crypto: qat - refactor compression template logic") Signed-off-by: Giovanni Cabiddu <giovanni.cabiddu@intel.com> Reviewed-by: Laurent M Coquerel <laurent.m.coquerel@intel.com> Reviewed-by: Ahsan Atta <ahsan.atta@intel.com> Reviewed-by: Wojciech Drewek <wojciech.drewek@linux.intel.com> Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Giovanni Cabiddu [Tue, 24 Mar 2026 16:52:11 +0000 (16:52 +0000)]
crypto: qat - use acomp_tfm_ctx()
Replace the usage of crypto_acomp_tfm() followed by crypto_tfm_ctx()
with a single call to the equivalent acomp_tfm_ctx().
This does not introduce any functional changes.
Signed-off-by: Giovanni Cabiddu <giovanni.cabiddu@intel.com> Reviewed-by: Laurent M Coquerel <laurent.m.coquerel@intel.com> Reviewed-by: Andy Shevchenko <andriy.shevchenko@intel.com> Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Ahsan Atta [Tue, 24 Mar 2026 11:12:34 +0000 (11:12 +0000)]
crypto: qat - disable 420xx AE cluster when lead engine is fused off
The get_ae_mask() function only disables individual engines based on
the fuse register, but engines are organized in clusters of 4. If the
lead engine of a cluster is fused off, the entire cluster must be
disabled.
Replace the single bitmask inversion with explicit test_bit() checks
on the lead engine of each group, disabling the full ADF_AE_GROUP
when the lead bit is set.
Signed-off-by: Ahsan Atta <ahsan.atta@intel.com> Reviewed-by: Giovanni Cabiddu <giovanni.cabiddu@intel.com> Fixes: fcf60f4bcf54 ("crypto: qat - add support for 420xx devices") Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Ahsan Atta [Tue, 24 Mar 2026 11:11:12 +0000 (11:11 +0000)]
crypto: qat - disable 4xxx AE cluster when lead engine is fused off
The get_ae_mask() function only disables individual engines based on
the fuse register, but engines are organized in clusters of 4. If the
lead engine of a cluster is fused off, the entire cluster must be
disabled.
Replace the single bitmask inversion with explicit test_bit() checks
on the lead engine of each group, disabling the full ADF_AE_GROUP
when the lead bit is set.
Signed-off-by: Ahsan Atta <ahsan.atta@intel.com> Reviewed-by: Giovanni Cabiddu <giovanni.cabiddu@intel.com> Fixes: 8c8268166e834 ("crypto: qat - add qat_4xxx driver") Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
crypto: testmgr - Add test vectors for authenc(hmac(md5),cbc(aes))
Test vectors were generated starting from existing CBC(AES) test vectors
(RFC3602, NIST SP800-38A) and adding HMAC(MD5) computed with Python
script. Then, the results were double-checked on Mediatek MT7981 (safexcel)
and NXP P2020 (talitos). Both platforms pass self-tests.
Signed-off-by: Aleksander Jan Bajkowski <olek2@wp.pl> Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Make af_alg_get_rsgl() limit each RX scatterlist extraction to the
remaining receive buffer budget.
af_alg_get_rsgl() currently uses af_alg_readable() only as a gate
before extracting data into the RX scatterlist. Limit each extraction
to the remaining af_alg_rcvbuf(sk) budget so that receive-side
accounting matches the amount of data attached to the request.
If skcipher cannot obtain enough RX space for at least one chunk while
more data remains to be processed, reject the recvmsg call instead of
rounding the request length down to zero.
Fixes: e870456d8e7c8d57c059ea479b5aadbb55ff4c3a ("crypto: algif_skcipher - overhaul memory management") Reported-by: Yifan Wu <yifanwucs@gmail.com> Reported-by: Juefei Pu <tomapufckgml@gmail.com> Co-developed-by: Yuan Tan <yuantan098@gmail.com> Signed-off-by: Yuan Tan <yuantan098@gmail.com> Suggested-by: Xin Liu <bird@lzu.edu.cn> Signed-off-by: Douya Le <ldy3087146292@gmail.com> Signed-off-by: Ren Wei <n05ec@lzu.edu.cn> Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Merge tag 'v7.0-p4' of git://git.kernel.org/pub/scm/linux/kernel/git/herbert/crypto-2.6
Pull crypto fixes from Herbert Xu:
- Add missing async markers to tegra
- Fix long hmac key DMA handling in caam
- Fix spurious ENOSPC errors in deflate
- Fix SG chaining in af_alg
- Do not use in-place process in algif_aead
- Fix out-of-place destination overflow in authencesn
* tag 'v7.0-p4' of git://git.kernel.org/pub/scm/linux/kernel/git/herbert/crypto-2.6:
crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption
crypto: algif_aead - Revert to operating out-of-place
crypto: af-alg - fix NULL pointer dereference in scatterwalk
crypto: deflate - fix spurious -ENOSPC
crypto: caam - fix overflow on long hmac keys
crypto: caam - fix DMA corruption on long hmac keys
crypto: tegra - Add missing CRYPTO_ALG_ASYNC
NEON intrinsics are useful because they remove the need for manual
register allocation, and the resulting code can be re-compiled and
optimized for different micro-architectures, and shared between arm64
and 32-bit ARM.
However, the strong typing of the vector variables can lead to
incomprehensible gibberish, as is the case with the new CRC64
implementation. To address this, let's repaint all variables as
uint64x2_t to minimize the number of vreinterpretq_xxx() calls, and to
be able to rely on the ^ operator for exclusive OR operations. This
makes the code much more concise and readable.
While at it, wrap the calls to vmull_p64() et al in order to have a more
consistent calling convention, and encapsulate any remaining
vreinterpret() calls that are still needed.
Ard Biesheuvel [Mon, 30 Mar 2026 14:46:33 +0000 (16:46 +0200)]
lib/crc: arm64: Use existing macros for kernel-mode FPU cflags
Use the existing CC_FPU_CFLAGS and CC_NO_FPU_CFLAGS to pass the
appropriate compiler command line options for building kernel mode NEON
intrinsics code. This is tidier, and will make it easier to reuse the
code for 32-bit ARM.
Eric Biggers [Wed, 1 Apr 2026 00:44:31 +0000 (17:44 -0700)]
lib/crc: arm64: Assume a little-endian kernel
Since support for big-endian arm64 kernels was removed, the CPU_LE()
macro now unconditionally emits the code it is passed, and the CPU_BE()
macro now unconditionally discards the code it is passed.
Simplify the assembly code in lib/crc/arm64/ accordingly.
Jori Koolstra [Fri, 6 Mar 2026 18:33:17 +0000 (19:33 +0100)]
virt: coco: change tsm_class to a const struct
The class_create() call has been deprecated in favor of class_register()
as the driver core now allows for a struct class to be in read-only
memory. Change tsm_class to be a const struct class and drop the
class_create() call. Compile tested only.
power: reset: drop unneeded dependencies on OF_GPIO
OF_GPIO is selected automatically on all OF systems. Any symbols it
controls also provide stubs so there's really no reason to select it
explicitly. For Kconfig entries that have no other dependencies: convert
it to requiring OF to avoid new symbols popping up for everyone in make
config, for others just drop it altogether.
Alex Williamson [Tue, 31 Mar 2026 20:24:41 +0000 (14:24 -0600)]
vfio/pci: Require vfio_device_ops.name
vfio-pci-core code makes use of the vfio_device_ops.name field in order
to set a default driver_override for VFs created on a user-owned PF.
This avoids default driver matching, which might otherwise bind those
VFs to native drivers.
The mechanism for this currently uses kasprintf(), which will set
driver_override to the literal "(null)" if name is NULL. This is
effective in sequestering the device, but presents a challenging debug
situation to differentiate driver_override being set to "(null)" versus
being NULL and interpreted as "(null)" via the sysfs show attribute.
There's also a tree-wide effort to convert to generic driver_override
support, where passing NULL will generate an error, resulting in a
WARN_ON without setting any driver_override.
All drivers making use of vfio-pci-core already set a driver name,
therefore by requiring this behavior, all of these corner cases are
rendered moot. This is expected to have no impact on current
in-kernel drivers.
Andreas Kemnade [Wed, 1 Apr 2026 21:17:05 +0000 (23:17 +0200)]
power: supply: bd71828: add input current limit property
Add input current property to be able to work around issues created by
automatic input limiting and have some control.
Disabling the automatic management is another step.
Thorsten Blum [Mon, 30 Mar 2026 10:35:17 +0000 (12:35 +0200)]
ecryptfs: Drop TODO comment in ecryptfs_derive_iv
Remove the TODO from 2006. eCryptfs is generally not receiving new
features and changing the IV derivation is only likely to happen to
address security concerns in the future.
Signed-off-by: Thorsten Blum <thorsten.blum@linux.dev>
[tyhicks: Add the reasoning to the commit message] Signed-off-by: Tyler Hicks <code@tyhicks.com>
====================
Task local data bug fixes and improvement
This patchset fixed three task local data bugs, improved the
memory allocation code, and dropped unnecessary TLD_READ_ONCE. Please
find the detail in each patch's commit msg.
One thing worth mentioning is that Patch 3 allows us to renable task
local data selftests as the library now always calls aligned_alloc()
with size matching alignment under default configuration.
Amery Hung [Tue, 31 Mar 2026 21:35:55 +0000 (14:35 -0700)]
selftests/bpf: Improve task local data documentation and fix potential memory leak
If TLD_FREE_DATA_ON_THREAD_EXIT is not enabled in a translation unit
that calls __tld_create_key() first, another translation unit that
enables it will not get the auto cleanup feature as pthread key is only
created once when allocation metadata. Fix it by always try to create
the pthread key when __tld_create_key() is called.
Also improve the documentation:
- Discourage user from using different options in different translation
units
- Specify calling tld_free() before thread exit as undefined behavior
Amery Hung [Tue, 31 Mar 2026 21:35:54 +0000 (14:35 -0700)]
selftests/bpf: Remove TLD_READ_ONCE() in the user space header
TLD_READ_ONCE() is redundant as the only reference passed to it is
defined as _Atomic. The load is guaranteed to be atomic in C11 standard
(6.2.6.1). Drop the macro.
Amery Hung [Tue, 31 Mar 2026 21:35:53 +0000 (14:35 -0700)]
selftests/bpf: Make sure TLD_DEFINE_KEY runs first
Without specifying constructor priority of the hidden constructor
function defined by TLD_DEFINE_KEY, __tld_create_key(..., dyn_data =
false) may run after tld_get_data() called from other constructors.
Threads calling tld_get_data() before __tld_create_key(..., dyn_data
= false) will not allocate enough memory for all TLDs and later result
in OOB access. Therefore, set it to the lowest value available to
users. Note that lower means higher priority and 0-100 is reserved to
the compiler.
Simplify data allocation by always using aligned_alloc() and passing
size_pot, size rounded up to the closest power of two to alignment.
Currently, aligned_alloc(page_size, size) is only intended to be used
with memory allocators that can fulfill the request without rounding
size up to page_size to conserve memory. This is enabled by defining
TLD_DATA_USE_ALIGNED_ALLOC. The reason to align to page_size is due to
the limitation of UPTR where only a page can be pinned to the kernel.
Otherwise, malloc(size * 2) is used to allocate memory for data.
However, we don't need to call aligned_alloc(page_size, size) to get
a contiguous memory of size bytes within a page. aligned_alloc(size_pot,
...) will also do the trick. Therefore, just use aligned_alloc(size_pot,
...) universally.
As for the size argument, create a new option,
TLD_DONT_ROUND_UP_DATA_SIZE, to specify not rounding up the size.
This preserves the current TLD_DATA_USE_ALIGNED_ALLOC behavior, allowing
memory allocators with low overhead aligned_alloc() to not waste memory.
To enable this, users need to make sure it is not an undefined behavior
for the memory allocator to have size not being an integral multiple of
alignment.
Compared to the current implementation, !TLD_DATA_USE_ALIGNED_ALLOC
used to always waste size-byte of memory due to malloc(size * 2).
Now the worst case becomes size - 1 and the best case is 0 when the size
is already a power of two.
Amery Hung [Tue, 31 Mar 2026 21:35:51 +0000 (14:35 -0700)]
selftests/bpf: Fix task_local_data data allocation size
Currently, when allocating memory for data, size of tld_data_u->start
is not taken into account. This may cause OOB access. Fixed it by adding
the non-flexible array part of tld_data_u.
Besides, explicitly align tld_data_u->data to 8 bytes in case some
fields are added before data in the future. It could break the
assumption that every data field is 8 byte aligned and
sizeof(tld_data_u) will no longer be equal to
offsetof(struct tld_data_u, data), which we use interchangeably.
Merge tag 'qcom-arm64-for-7.1' of https://git.kernel.org/pub/scm/linux/kernel/git/qcom/linux into soc/dt
Qualcomm Arm64 DeviceTree updates for v7.1
Introduce the Eliza, Glymur, Mahua, and IPQ5210 Qualcomm SoCs.
Introduce the Redmi 4A, Redmi Go, Arduino Monza (VENTUNO Q), Redmi Note
8T, Purwa EVK, ECS Liva QCS710, additional variants of the DB820c,
Ayaneo Pocket S2, Thundercomm AI Mini PC G1, Samsung Galaxy Core Prime
LTE Verizon Wireless, Wiko Pulp 4G, the Purwa-variant of ASUS Vivobook
S15, the Eliza MTP, and the Glymur and Mahua CRDs.
Introduce UFS support and flatten the DWC3 node on Hamoa. Enable UFS,
SDC, DisplayPort audio playback, and an EL2 overlay for the Hamoa IoT
EVK. Enable DisplayPort audio on the Hamoa CRD and add HDMI support on
the ASUS Zenbook A14. Reduce the duplication of thermal sensors across
Purwa and Hamoa.
Add the QPIC SPI NAND controller on IPQ5332 and IPQ9574. Describe and
enable the eMMC controller on IPQ9574.
Add display, audio/compute remoteprocs, QUP devices, thermal sensors,
display, and CoreSight on the Kaanapali platform. Enable audio, compute
display, PMIC, Bluetooth, and WiFi on the MTP. Describe PMIC, audio and
compute remoteprocs on QRD.
Add role-switching support for the tertiary USB controller on Lemans.
Enable the tertiary USB controller and the GPIO expander on the Lemans
EVK, and add an overlay for the IFP Mezzanine.
Add UFS, camera control interface, audio GPR, and FastRPC support on
Milos. Enable UFS, camera EEPROMs, and hall effect sensor on the
Fairphone FP6.
Add camera control interface and fix a variety of things on the Monaco
platform, add missing FastRPC compute banks. Add eMMC support, describe
the DisplayPort bridge and GPIO expander on the Monaco EVK. Add overlay
for EVK camera and the IFP mezzanine.
Add touchscreen to the Xiaomi Redmi 4A, 5A, and Go, and fix the board-id
on the 4A.
Add the ambient light and proximity sensor on the Asus ZenFone 2
Laser/Selfie.
On Kodiak-based boards, enable the ethernet and USB Type-A ports on the
Rb3Gen2, correct the LT9611 routing on the RubikPi3, add Bluetooth on
the IDP, and add front camera support on the Fairphone FP5.
Introduce an overlay for the Rb3Gen2 Industrial Mezzanine.
Describe DSI on the Monaco SoC and enable Bluetooth, WiFi and DSI/DP
bridge on the Ride board.
Describe the WiFi/BT combo chip properly on the QRB2210 RB1 and QRB4210.
The describe the DSI/DP bringde on the Arduino UnoQ.
Add LLCC on SDM670 and another SPI controller on SDM630.
Properly describe the WiFi/BT chip on a variety of SDM845-based
devices. Introduce the "alert slider" on the OnePlus 6 and OnePlus 6T
devices.
Introduce the PRNG, describe the debug UART, and add the MDSS core reset
on SM6125. Enable the debug UART and fix various issues on the Xiaomi
Redmi Note 8. Describe the touchscreen on the Xiaomi Mi A3.
Properly describe the WiFi/BT combo chip in SM8150 HDK.
Improve the EAS properties on SM8550, in addition to various other
fixes. Introduce a new overlay for the HDK display card.
Introduce various smaller fixes across SM8450 and SM8650.
Add display support on SM8750 and enable DSI and DisplayPort on the MTP.
Also add tsens and thermal-zones.
Add ETR devices, flatten the USB controller node, and mark USB
controllers as wakeup-capable devices, on Talos.
Properly describe the IPA IMEM slice on a variety of platforms.
Drop redundant non-controllable regulator definitions from a variety of
boards.
Drop redundant VSYNC pin state definition from various platforms.
* tag 'qcom-arm64-for-7.1' of https://git.kernel.org/pub/scm/linux/kernel/git/qcom/linux: (254 commits)
arm64: dts: qcom: sm8250: Add missing CPU7 3.09GHz OPP
arm64: dts: qcom: sm8550-hdk: add support for the Display Card overlay
arm64: dts: qcom: msm8916-samsung-coreprimeltevzw: add device tree
dt-bindings: qcom: Document samsung,coreprimeltevzw
arm64: dts: qcom: msm8916-samsung-fortuna: Move SM5504 from rossa and refactor MUIC
arm64: dts: qcom: sdm670: add llcc
arm64: dts: qcom: qcm6490-fairphone-fp5: Add front camera support
arm64: dts: qcom: qcm6490-fairphone-fp5: Sort pinctrl nodes by pins
arm64: dts: qcom: milos-fairphone-fp6: Add camera EEPROMs on CCI busses
arm64: dts: qcom: milos: Add CCI busses
arm64: dts: qcom: purwa-iot-evk: Enable UFS
arm64: dts: qcom: eliza: Add thermal sensors
arm64: dts: qcom: sc8280xp: Add dsi nodes on SC8280XP
arm64: dts: qcom: sdm845-oneplus: Describe Wi-Fi/BT properly
arm64: dts: qcom: sdm845-google: Describe Wi-Fi/BT properly
arm64: dts: qcom: drop redundant zap-shader memory-region
arm64: dts: qcom: fix remaining gpu_zap_shader labels
arm64: dts: qcom: msm8996: fix indentation in sdhc2 node
arm64: dts: qcom: monaco-evk: enable UART6 for robot expansion board
arm64: dts: qcom: lemans-evk: enable UART0 for robot expansion board
...
Merge tag 'omap-for-v7.1/soc-signed' of git://git.kernel.org/pub/scm/linux/kernel/git/khilman/linux-omap into soc/arm
ARM: soc/omap updates for v7.1
* tag 'omap-for-v7.1/soc-signed' of git://git.kernel.org/pub/scm/linux/kernel/git/khilman/linux-omap:
ARM: omap2: dead code cleanup in kconfig for ARCH_OMAP4
ARM: OMAP1: Fix DEBUG_LL and earlyprintk on OMAP16XX
ARM: omap: fix all kernel-doc warnings
ARM: omap2: Replace scnprintf with strscpy in omap3_cpuinfo
Merge tag 'v7.1-rockchip-dts64-2' of https://git.kernel.org/pub/scm/linux/kernel/git/mmind/linux-rockchip into soc/arm
New board, the Khadas Edge 2L. Newly added peripherals are the
OTP nvmem controllers for RK3528, RK3562 and RK3566/8, SPDIF on RK3576.
The RK3566/8 SoCs now also control the Pipe-clocks on their PCIe
controllers and UFSHC controller on RK3576 got an additional reset line.
Apart from that are of course individual board changes and fixes for
older issues that are not specific to the current development cycle.
* tag 'v7.1-rockchip-dts64-2' of https://git.kernel.org/pub/scm/linux/kernel/git/mmind/linux-rockchip: (44 commits)
arm64: dts: rockchip: configure hdmirx in Rock 5 ITX
arm64: dts: rockchip: assign pipe clock to rk356x PCIe lanes
arm64: dts: rockchip: Add mphy reset to ufshc node
arm64: dts: rockchip: Enable OTP controller for RK3528
arm64: dts: rockchip: Enable OTP controller for RK356x
arm64: dts: rockchip: Enable OTP controller for RK3562
arm64: dts: rockchip: Enable PCIe CLKREQ# for RK3588 on Rock 5b-5bp-5t series
arm64: dts: rockchip: add SD/eMMC aliases for ArmSom Sige5
arm64: dts: rockchip: Add SPDIF nodes to RK3576 device tree
arm64: dts: rockchip: Add Khadas Edge 2L board
dt-bindings: arm: rockchip: Add Khadas Edge 2L board
arm64: dts: rockchip: Fix RK3562 EVB2 model name
arm64: dts: rockchip: Correct Joystick Axes on Gameforce Ace
arm64: dts: rockchip: Correct Fan Supply for Gameforce Ace
Revert "arm64: dts: rockchip: add SPDIF audio to Beelink A1"
arm64: dts: rockchip: Fix Bluetooth stability on LCKFB TaiShan Pi
arm64: dts: rockchip: enable vicap dvp on wolfvision pf5 io expander
arm64: dts: rockchip: Add analog audio switches to RK3576 EVB1
arm64: dts: rockchip: Enable GPU on rk3566-pinenote
arm64: dts: rockchip: Make Jaguar PCIe-refclk pin use pull-up config
...
Merge tag 'ti-k3-dt-for-v7.1' of https://git.kernel.org/pub/scm/linux/kernel/git/ti/linux into soc/arm
TI K3 device tree updates for v7.1
Generic Fixes/Cleanups:
- k3-pinctrl: Cleanup alignment and reorder macros
- ti,min-output-impedance addition to all K3 board DT files
SoC Specific Features and Fixes:
AM62L:
- Add RNG node
- Support cpufreq scaling
J721S2:
- Make MAIN domain system control bus a simple-bus
- Add second DSI node
J722S:
- Add main_i2c4 device node
J7200:
- Make MAIN domain system control bus a simple-bus
Board Specific Features and Fixes:
AM642 EVM:
- Add ICSSG0 overlay for dual EMAC support
AM62:
- LP-SK: Enable internal pulls for MMC0 data pins
- SK: Enable Main UART wakeup
- phycore-som: Add 128MiB of global CMA
- Verdin: Add Zinnia board support and misc cleanup
AM62A7-SK:
- Enable Main UART wakeup
- Fix pin name in comment from M19 to N22
AM62D2 EVM:
- Enable Main UART wakeup and set wakeup-source system-states
AM62L3 EVM:
- Disable MMC1 internal pulls on data pins
- Enable Main UART wakeup and enable wkup_uart0 pins/target node
AM62P:
- SK: Disable MMC1 internal pulls on data pins and enable Main UART
wakeup
- Verdin: Add Zinnia support and misc cleanup
spear13xx.dtsi defines a thermal_flags property in spear thermal sensor
node which is both unused in kernel and undocumented in spear thermal
sensor's binding.
There were no dtbs_check warnings associated with this property as the
underlying spear thermal binding was not converted to DTSchema.
Most likely st,thermal-flags is a misspelling of thermal_flags in
spear13xx.dtsi. Since both st/spear1310.dtsi and st/spear1340.dtsi
define st,thermal-flags property in spear thermal sensor node, we can
safely remove this property from spear13xx.dtsi.
Merge tag 'omap-for-v7.1/soc-signed' of git://git.kernel.org/pub/scm/linux/kernel/git/khilman/linux-omap into soc/arm
ARM: soc/omap updates for v7.1
* tag 'omap-for-v7.1/soc-signed' of git://git.kernel.org/pub/scm/linux/kernel/git/khilman/linux-omap:
ARM: omap2: dead code cleanup in kconfig for ARCH_OMAP4
ARM: OMAP1: Fix DEBUG_LL and earlyprintk on OMAP16XX
ARM: omap: fix all kernel-doc warnings
ARM: omap2: Replace scnprintf with strscpy in omap3_cpuinfo
Merge tag 'qcom-drivers-for-7.1' of https://git.kernel.org/pub/scm/linux/kernel/git/qcom/linux into soc/drivers
Qualcomm driver updates for v7.1
Add ECS LIVA QC710, Glymur CRD, Mahua CRD, Purwa IoT EVK, and Asus
Vivobook to the QSEECOM allow-list, to enable UEFI variable access
through uefisecapp.
Register the Gunyah watchdog device if the SCM driver finds itself
running under Gunyah. Clean up some locking using guards.
Handle possible cases where AOSS cooling state is given a non-boolean
state.
Replace LLCC per-slice activation bitmap with reference counting. Also
add SDM670 support.
Improve probe deferral handling in the OCMEM driver.
Add Milos, QCS615, Eliza, Glymur, and Mahua support to the pd-mapper.
Add support for SoCCP-based pmic-glink, as found in Glymur and
Kaanapali.
Add common QMI service ids to the main qmi headerfile, to avoid
spreading these constants in various drivers.
Add support for version 2 of SMP2P and implement the irqchip state
reading support.
Add CQ7790, SA8650P, SM7450, SM7450P, and IPQ5210 SoC and the PM7550BA
PMIC identifiers to the socinfo driver.
Add Eliza and Mahua support to the UBWC driver, introduce helpers for
drivers to read out min_acc length and other programmable values, and
disable bank swizzling for Glymur.
Simplify the logic related to allocation of NV download request in the
WCNSS control driver.
* tag 'qcom-drivers-for-7.1' of https://git.kernel.org/pub/scm/linux/kernel/git/qcom/linux: (51 commits)
soc: qcom: ubwc: add helpers to get programmable values
soc: qcom: ubwc: add helper to get min_acc length
firmware: qcom: scm: Register gunyah watchdog device
soc: qcom: socinfo: Add SoC ID for SA8650P
dt-bindings: arm: qcom,ids: Add SoC ID for SA8650P
firmware: qcom: scm: Allow QSEECOM on Mahua CRD
soc: qcom: wcnss: simplify allocation of req
soc: qcom: pd-mapper: Add support for Eliza
soc: qcom: aoss: compare against normalized cooling state
soc: qcom: llcc: fix v1 SB syndrome register offset
dt-bindings: firmware: qcom,scm: Document ipq9650 SCM
soc: qcom: ubwc: Add support for Mahua
soc: qcom: pd-mapper: Add support for Glymur and Mahua
soc: qcom: ubwc: Add configuration Eliza SoC
soc: qcom: ubwc: Remove redundant x1e80100_data
dt-bindings: firmware: qcom,scm: document Eliza SCM Firmware Interface
soc: qcom: ocmem: return -EPROBE_DEFER is ocmem is not available
soc: qcom: ocmem: register reasons for probe deferrals
soc: qcom: ocmem: make the core clock optional
soc: qcom: ubwc: disable bank swizzling for Glymur platform
...
Merge tag 'reset-for-v7.1' of https://git.pengutronix.de/git/pza/linux into soc/drivers
Reset controller updates for v7.1
* Rework the reset core to support firmware nodes, add more fine
grained locking, and use guard() helpers.
* Change the reset-gpio driver to use firmware nodes.
* Add support for the Cix Sky1 SoC reset controller.
* Add support for the RZ/G3E SoC to the reset-rzv2h-usb2phy driver and
convert it to regmap. Prepare registering a VBUS mux controller.
* Replace use of the deprecated register_restart_handler() function in
the ath79, intel-gw, lpc18xx, ma35d1, npcm, and sunplus reset drivers.
* Combine two allocations into one in the sti/reset-syscfg driver.
* Fix the reset-rzg2l-usbphy-ctrl MODULE_AUTHOR email.
* Fix the reset_control_rearm() kerneldoc comment.
The last commit is a merge of reset-fixes-for-v7.0-2 into reset/next,
to solve a merge conflict between commits a9b95ce36de4 ("reset: gpio: add a
devlink between reset-gpio and its consumer") and fbffb8c7c7bb ("reset: gpio:
fix double free in reset_add_gpio_aux_device() error path").
* tag 'reset-for-v7.1' of https://git.pengutronix.de/git/pza/linux: (35 commits)
reset: rzv2h-usb2phy: Add support for VBUS mux controller registration
reset: rzv2h-usb2phy: Convert to regmap API
dt-bindings: reset: renesas,rzv2h-usb2phy: Document RZ/G3E USB2PHY reset
dt-bindings: reset: renesas,rzv2h-usb2phy: Add '#mux-state-cells' property
reset: core: Drop unnecessary double quote
reset: rzv2h-usb2phy: Keep PHY clock enabled for entire device lifetime
reset: spacemit: k3: Decouple composite reset lines
reset: gpio: fix double free in reset_add_gpio_aux_device() error path
reset: rzg2l-usbphy-ctrl: Fix malformed MODULE_AUTHOR string
reset: sti: kzalloc + kcalloc to kzalloc
reset: don't overwrite fwnode_reset_n_cells
reset: core: Fix indentation
reset: add Sky1 soc reset support
dt-bindings: soc: cix: document the syscon on Sky1 SoC
reset: gpio: make the driver fwnode-agnostic
reset: convert reset core to using firmware nodes
reset: convert the core API to using firmware nodes
reset: convert of_reset_control_get_count() to using firmware nodes
reset: protect struct reset_control with its own mutex
reset: protect struct reset_controller_dev with its own mutex
...
Merge tag 'tegra-for-7.1-firmware' of git://git.kernel.org/pub/scm/linux/kernel/git/tegra/linux into soc/drivers
firmware: tegra: Changes for v7.1-rc1
This introduces a new API for the BPMP to be pass along a specifier from
DT when getting a reference from a phandle. This is used to reference
specific instances of the PCI controller on Tegra264. The ABI header for
BPMP is updated to the latest version and BPMP APIs now use the more
intuitive ENODEV instead of the non SUSV4 ENOTSUPP error code for stub
implementations.
* tag 'tegra-for-7.1-firmware' of git://git.kernel.org/pub/scm/linux/kernel/git/tegra/linux:
soc/tegra: bpmp: Use ENODEV instead of ENOTSUPP
firmware: tegra: bpmp: Add tegra_bpmp_get_with_id() function
soc/tegra: Update BPMP ABI header
firmware: tegra: bpmp: Rename Tegra239 to Tegra238
Merge tag 'tegra-for-7.1-soc' of git://git.kernel.org/pub/scm/linux/kernel/git/tegra/linux into soc/drivers
soc/tegra: Changes for v7.1-rc1
A number of fixes went into this for the PMC and CBB drivers. The PMC
driver also gains support for Tegra264 and a Kconfig symbol for the
upcoming Tegra238 is added. The various per-generation Kconfig symbols
are now also enabled by default for ARCH_TEGRA in order to reduce the
number of configuration options that need to be explicitly enabled.
* tag 'tegra-for-7.1-soc' of git://git.kernel.org/pub/scm/linux/kernel/git/tegra/linux:
MAINTAINERS: Change email address for Thierry Reding
soc/tegra: pmc: Add IO pads for Tegra264
soc/tegra: pmc: Rename has_impl_33v_pwr flag
soc/tegra: pmc: Refactor IO pad voltage control
soc/tegra: pmc: Add Tegra264 wake events
soc/tegra: pmc: Add AOWAKE regs for Tegra264
soc/tegra: pmc: Add support for SoC specific AOWAKE offsets
soc/tegra: pmc: Remove unused AOWAKE definitions
soc/tegra: pmc: Add kerneldoc for wake-up variables
soc/tegra: pmc: Correct function names in kerneldoc
soc/tegra: pmc: Add kerneldoc for reboot notifier
soc/tegra: common: Add Tegra114 support to devm_tegra_core_dev_init_opp_table
soc/tegra: pmc: Enable core domain support for Tegra114
soc/tegra: cbb: Fix cross-fabric target timeout lookup
soc/tegra: cbb: Fix incorrect ARRAY_SIZE in fabric lookup tables
soc/tegra: cbb: Set ERD on resume for err interrupt
soc/tegra: cbb: Add support for CBB fabrics in Tegra238
soc/tegra: Add Tegra238 Kconfig symbol
soc/tegra: Make ARCH_TEGRA_SOC_FOO defaults for NVIDIA Tegra
arm64: dts: qcom: Add the Lenovo IdeaCentre Mini X
The Lenovo IdeaCentre Mini X (Snapdragon) Desktop is a Hamoa-based
ultracompact desktop PC. It provides HDMI, DisplayPort, USB Type-C
display outputs, 5 additional USB ports, Ethernet, dual NVME slots,
headphone jack, WiFi, and Bluetooth.
dt-bindings: arm: qcom: Document the Lenovo IdeaCentre Mini X
The Lenovo IdeaCentre Mini X (Snapdragon) Desktop is a Hamoa-based
ultracompact desktop PC. It provides HDMI, DisplayPort, USB Type-C
display outputs, 5 additional USB ports, Ethernet, dual NVME slots,
headphone jack, WiFi, and Bluetooth.
Merge tag 'tegra-for-7.1-arm64-defconfig' of git://git.kernel.org/pub/scm/linux/kernel/git/tegra/linux into soc/defconfig
arm64: tegra: Default configuration changes for v7.1-rc1
Drop the various ARCH_TEGRA_*_SOC options from the default configurations
since they are now enabled by default for ARCH_TEGRA.
* tag 'tegra-for-7.1-arm64-defconfig' of git://git.kernel.org/pub/scm/linux/kernel/git/tegra/linux:
arm64: tegra: defconfig: Drop redundant ARCH_TEGRA_foo_SOC
Merge tag 'tegra-for-7.1-arm-defconfig' of git://git.kernel.org/pub/scm/linux/kernel/git/tegra/linux into soc/defconfig
ARM: tegra: Default configuration changes for v7.1-rc1
Drop the various ARCH_TEGRA_*_SOC options from the default configurations
since they are now enabled by default for ARCH_TEGRA.
* tag 'tegra-for-7.1-arm-defconfig' of git://git.kernel.org/pub/scm/linux/kernel/git/tegra/linux:
ARM: tegra: defconfig: Drop redundant ARCH_TEGRA_foo_SOC
soc/tegra: Make ARCH_TEGRA_SOC_FOO defaults for NVIDIA Tegra
The Talos EVK board does not include a camera sensor
by default. This DTSO has enabled the Arducam 12.3MP
IMX577 Mini Camera Module on the CSI-1 interface.
CSI-1 interface using mclk2 as the MCLK source on this board.
Reviewed-by: Vladimir Zapolskiy <vladimir.zapolskiy@linaro.org> Signed-off-by: Wenmeng Liu <wenmeng.liu@oss.qualcomm.com> Reviewed-by: Konrad Dybcio <konrad.dybcio@oss.qualcomm.com> Link: https://lore.kernel.org/r/20260305-sm6150_evk-v6-5-38ce4360d5e0@oss.qualcomm.com Signed-off-by: Bjorn Andersson <andersson@kernel.org>
Mukesh Ojha [Tue, 27 Jan 2026 11:43:50 +0000 (17:13 +0530)]
arm64: dts: qcom: talos: Add EL2 overlay
All the existing variants Talos boards are using Gunyah hypervisor
which means that, so far, Linux-based OS could only boot in EL1 on
those devices. However, it is possible for us to boot Linux at EL2
on these devices [1].
When running under Gunyah, the remote processor firmware IOMMU streams
are controlled by Gunyah. However, without Gunyah, the IOMMU is managed
by the consumer of this DeviceTree. Therefore, describe the firmware
streams for each remote processor.
Add a EL2-specific DT overlay and apply it to Talos IOT variant
devices to create -el2.dtb for each of them alongside "normal" dtb.
Sudarshan Shetty [Tue, 31 Mar 2026 06:01:07 +0000 (11:31 +0530)]
arm64: dts: qcom: talos-evk: Add support for QCS615 talos evk board
Add the device tree for the QCS615-based Talos EVK platform. The
platform is composed of a System-on-Module following the SMARC
standard, and a Carrier Board.
The Carrier Board supports several display configurations, HDMI and
LVDS. Both configurations use the same base hardware, with the display
selection controlled by a DIP switch.
Use a DTBO file, talos-evk-lvds-auo,g133han01.dtso, which defines an
overlay that disables HDMI and adds LVDS. The DTs file talos-evk
can describe the HDMI display configurations.
According to the hardware design and vendor guidance, the WiFi PA
supplies VDD_PA_A and VDD_PA_B only need to be enabled at the same time
as asserting WLAN_EN.
On this platform, WiFi enablement is controlled via the WLAN_EN GPIO
(GPIO84), which also drives the VDD_PA_A and VDD_PA_B power enables.
Remove the VDD_PA_A and VDD_PA_B regulator nodes from the device tree
and rely on WLAN_EN to enable WiFi functionality.
Add talos-evk-usb1-peripheral.dtso overlay to enable USB0 peripheral
(EDL) mode. The base DTS will keep USB0 host-only due to hardware
routing through the EDL DIP switch, and the overlay switches the
configuration for device-mode operation.
The LVDS backlight hardware has been updated to use a simplified
design. The backlight enable signal is now permanently pulled up
to 3.3V and is no longer controlled via GPIO59.
Remove the GPIO59 based backlight configuration from the device
tree, as it is no longer routed to the LVDS interface.
The initial device tree includes support for:
- CPU and memory
- UART
- GPIOs
- Regulators
- PMIC
- Early console
- AT24MAC602 EEPROM
- MCP2515 SPI to CAN
- ADV7535 DSI-to-HDMI bridge
- DisplayPort interface
- SN65DSI84ZXHR DSI-to-LVDS bridge
- Wi-Fi/BT
Sudarshan Shetty [Tue, 31 Mar 2026 06:01:06 +0000 (11:31 +0530)]
arm64: dts: qcom: talos/qcs615-ride: Fix inconsistent USB PHY node naming
The USB PHY nodes has inconsistent labels as 'usb_1_hsphy'
and 'usb_hsphy_2' across talos.dtsi and qcs615-ride.dts.
This patch renames them to follow a consistent naming
scheme.
Merge tag 'omap-for-v7.1/defconfig-signed' of git://git.kernel.org/pub/scm/linux/kernel/git/khilman/linux-omap into soc/defconfig
arm: OMAP defconfig updates for v7.1
* tag 'omap-for-v7.1/defconfig-signed' of git://git.kernel.org/pub/scm/linux/kernel/git/khilman/linux-omap:
arm: multi_v7_defconfig: Enable more OMAP 3/4 related configs
ARM: multi_v7_defconfig: omap2plus_defconfig: Enable ITE IT66121 driver
Mark Brown [Fri, 6 Mar 2026 17:00:53 +0000 (17:00 +0000)]
arm64/sysreg: Update SMIDR_EL1 to DDI0601 2025-06
Update the definition of SMIDR_EL1 in the sysreg definition to reflect the
information in DD0601 2025-06. This includes somewhat more generic ways of
describing the sharing of SMCUs, more information on supported priorities
and provides additional resolution for describing affinity groups.
Reviewed-by: Fuad Tabba <tabba@google.com> Signed-off-by: Mark Brown <broonie@kernel.org> Acked-by: Catalin Marinas <catalin.marinas@arm.com> Reviewed-by: Alex Bennée <alex.bennee@linaro.org> Signed-off-by: Catalin Marinas <catalin.marinas@arm.com>
====================
libbpf: clarify raw-address single kprobe attach behavior
Today libbpf documents single-kprobe attach through func_name, with an
optional offset. For the PMU-based path, func_name = NULL with an
absolute address in offset already works as well, but that is not
described in the API.
This patchset clarifies this behavior. First commit fixes kprobe
and uprobe attach error handling to use direct error codes. Next adds
kprobe API comments for the raw-address form and rejects it explicitly
for legacy tracefs/debugfs kprobes. Last adds PERF and LINK selftests
for the raw-address form, and checks that LEGACY rejects it.
---
Changes in v7:
- Change selftest line wrapping and assertions
Changes in v6:
- Split the kprobe/uprobe direct error-code fix into a separate patch
Changes in v5:
- Add kprobe API docs, use -EOPNOTSUPP, and switch selftests to LIBBPF_OPTS
Changes in v4:
- Inline raw-address error formatting and remove the probe_target buffer
Changes in v3:
- Drop bpf_kprobe_opts.addr and reuse offset when func_name is NULL
- Make legacy tracefs/debugfs kprobes reject the raw-address form
- Update selftests to cover PERF/LINK raw-address attach and LEGACY reject
Changes in v2:
- Fix line wrapping and indentation
====================
Hoyeon Lee [Wed, 1 Apr 2026 14:29:31 +0000 (23:29 +0900)]
selftests/bpf: Add test for raw-address single kprobe attach
Currently, attach_probe covers manual single-kprobe attaches by
func_name, but not the raw-address form that the PMU-based
single-kprobe path can accept.
This commit adds PERF and LINK raw-address coverage. It resolves
SYS_NANOSLEEP_KPROBE_NAME through kallsyms, passes the absolute address
in bpf_kprobe_opts.offset with func_name = NULL, and verifies that
kprobe and kretprobe are still triggered. It also verifies that LEGACY
rejects the same form.
Hoyeon Lee [Wed, 1 Apr 2026 14:29:30 +0000 (23:29 +0900)]
libbpf: Clarify raw-address single kprobe attach behavior
bpf_program__attach_kprobe_opts() documents single-kprobe attach
through func_name, with an optional offset. For the PMU-based path,
func_name = NULL with an absolute address in offset already works as
well, but that is not described in the API.
This commit clarifies this existing non-legacy behavior. For PMU-based
attach, callers can use func_name = NULL with an absolute address in
offset as the raw-address form. For legacy tracefs/debugfs kprobes,
reject this form explicitly.
Hoyeon Lee [Wed, 1 Apr 2026 14:29:29 +0000 (23:29 +0900)]
libbpf: Use direct error codes for kprobe/uprobe attach
perf_event_open_probe() and perf_event_{k,u}probe_open_legacy() helpers
are returning negative error codes directly on failure. This commit
changes bpf_program__attach_{k,u}probe_opts() to use those return
values directly instead of re-reading possibly changed errno.
Jean Delvare [Wed, 1 Apr 2026 10:23:23 +0000 (12:23 +0200)]
accel: ethosu: Add hardware dependency hint
The Ethos-U NPU is only available on ARM systems, so add a hardware
dependency hint to prevent this driver from being needlessly
included in kernels built for other architectures.
Align bpf_program__clone() with bpf_object_load_prog() by gating
BTF func/line info on FEAT_BTF_FUNC kernel support, and resolve
caller-provided prog_btf_fd before checking obj->btf so that callers
with their own BTF can use clone() even when the object has no BTF
loaded.
While at it, treat func_info and line_info fields as atomic groups
to prevent mismatches between pointer and count from different sources.
Thomas Richter [Wed, 1 Apr 2026 12:21:01 +0000 (14:21 +0200)]
perf test: Skip perf data type profiling tests for s390
Test case 'perf data type profiling tests' fails on s390 with this
error:
# ./perf mem record -- ./perf test -w code_with_type
failed: no PMU supports the memory events
# echo $?
255
#
because s390 does not support memory events at all. According to the
man page, perf annotate --code-with-type only works with memory
instructions only. As command 'perf mem record ...' is not supported
on s390, skip this test for s390.
Output before:
# ./perf test 'perf data type profiling tests'
77: perf data type profiling tests : FAILED!
Output after:
# ./perf test 'perf data type profiling tests'
77: perf data type profiling tests : Skip
Fixes: f60a5c22967b8 ("perf tests: Test annotate with data type profiling and rust") Signed-off-by: Thomas Richter <tmricht@linux.ibm.com> Reviewed-by: Ian Rogers <irogers@google.com> Cc: Dmitrii Dolgov <9erthalion6@gmail.com> Suggested-by: Namhyung Kim <namhyung@kernel.org> Suggested-by: Ian Rogers <irogers@google.com> Signed-off-by: Namhyung Kim <namhyung@kernel.org>
When sorting the dso array we sometimes get a crash due to null
comparisons in comparator functions. So prevent __dsos__add from
adding null to the dso array to avoid out-of-memory related errors.
Signed-off-by: Anubhav Shelat <ashelat@redhat.com> Reviewed-by: Ian Rogers <irogers@google.com> Signed-off-by: Namhyung Kim <namhyung@kernel.org>
Thomas Falcon [Fri, 27 Mar 2026 01:59:27 +0000 (20:59 -0500)]
perf test: Fix ratio_to_prev event parsing test
test__ratio_to_prev() assumed the first event in a group is the leader,
which is not the case when the event is expanded into two event groups
on hybrid PMU's with auto counter reload support. Instead, iterate over the
event group generated for each core PMU. Also update "wrong leader" test to
check that the subordinate event has the correct leader instead of checking
that it is not the group leader. Finally, do not exit immediately if a PMU
without auto counter reload support is found.
Signed-off-by: Thomas Falcon <thomas.falcon@intel.com> Reviewed-by: Dapeng Mi <dapeng1.mi@linux.intel.com> Reviewed-by: Ian Rogers <irogers@google.com> Fixes: 56be0fe5f62c ("perf record: Add auto counter reload parse and regression tests") Signed-off-by: Namhyung Kim <namhyung@kernel.org>
Chuck Lever [Mon, 23 Mar 2026 15:58:04 +0000 (11:58 -0400)]
perf tools: Fix module symbol resolution for non-zero .text sh_addr
When perf resolves symbols from kernel module ELF files (ET_REL),
it converts symbol addresses to file offsets so that sample IPs
can be matched to the correct symbol. The conversion adjusts each
symbol's st_value:
sym->st_value -= shdr->sh_addr - shdr->sh_offset;
For vmlinux (ET_EXEC), st_value is a virtual address and sh_addr
is the section's virtual base, so subtracting sh_addr and adding
sh_offset correctly yields a file offset.
For kernel modules (ET_REL), st_value is a section-relative
offset. The module loader ignores sh_addr entirely and places
symbols at module_base + st_value. Converting to file offset
requires only adding sh_offset; subtracting sh_addr introduces an
error equal to sh_addr bytes.
When .text has sh_addr == 0 -- the historical norm for simple
modules -- both formulas produce the same result and the bug is
latent. As modules gain more metadata sections before .text (.note,
.static_call.text, etc.), the linker assigns .text a non-zero
sh_addr, exposing the defect. For example, nfsd.ko on this kernel
has sh_addr=0xa80, kvm-intel.ko has sh_addr=0x1e90.
The effect is that all .text symbols in affected modules
shift by sh_addr bytes relative to sample IPs, causing perf
report to attribute samples to incorrect, nearby symbols. This
was observed as 13% of LLC-load-miss samples misattributed
to nfsd_file_get_dio_attrs when the actual hot function was
nfsd_cache_lookup, approximately 0xa80 bytes away in the symbol
table.
Use the existing dso__rel() flag (already set for ET_REL modules)
to select the correct adjustment: add sh_offset for ET_REL,
subtract (sh_addr - sh_offset) for ET_EXEC/ET_DYN.
Fixes: 0131c4ec794a ("perf tools: Make it possible to read object code from kernel modules") Signed-off-by: Chuck Lever <chuck.lever@oracle.com> Reviewed-by: Ian Rogers <irogers@google.com> Tested-by: Thomas Richter <tmricht@linux.ibm.com> Signed-off-by: Namhyung Kim <namhyung@kernel.org>
Namhyung Kim [Wed, 1 Apr 2026 23:05:09 +0000 (16:05 -0700)]
perf trace: Skip unnecessary synthesis for summary-only mode
It needs to synthesize task info for the comm name. The mmap
information is only needed for callchain symbolization which is not used
by the summary mode. Also total or cgroup summary mode don't require
the task info. Let's skip the processing if possible.
Reviewed-by: Ian Rogers <irogers@google.com> Signed-off-by: Namhyung Kim <namhyung@kernel.org>
Breno Leitao [Wed, 25 Mar 2026 10:24:30 +0000 (03:24 -0700)]
perf stat: Fix crash on arm64
Perf stat is crashing on arm64 hosts with the following issue:
# make -C tools/perf DEBUG=1
# perf stat sleep 1
perf: util/evsel.c:2034: get_group_fd: Assertion `!(!leader->core.fd)' failed.
[1] 1220794 IOT instruction (core dumped) ./perf stat
The sorting function introduced by commit a745c0831c15c ("perf stat:
Sort default events/metrics") compares events based on their individual
properties. This can cause events from different groups to be
interleaved, resulting in group members appearing before their leaders
in the sorted evlist.
When the iterator opens events in list order, a group member may be
processed before its leader has been opened.
For example, CPU_CYCLES (idx=32) with leader STALL_SLOT_BACKEND (idx=37)
could be sorted before its leader, causing the crash when CPU_CYCLES
tries to get its group fd from the not-yet-opened leader.
Fix this by comparing events based on their leader's attributes instead
of their own attributes when the events are in different groups. This
ensures all members of a group share the same sort key as their leader,
keeping groups together and guaranteeing leaders are opened before their
members.
Ryan Roberts [Mon, 30 Mar 2026 16:17:04 +0000 (17:17 +0100)]
arm64: mm: Remove pmd_sect() and pud_sect()
The semantics of pXd_leaf() are very similar to pXd_sect(). The only
difference is that pXd_sect() only considers it a section if PTE_VALID
is set, whereas pXd_leaf() permits both "valid" and "present-invalid"
types.
Using pXd_sect() has caused issues now that large leaf entries can be
present-invalid since commit a166563e7ec37 ("arm64: mm: support large
block mapping when rodata=full"), so let's just remove the API and
standardize on pXd_leaf().
There are a few callsites of the form pXd_leaf(READ_ONCE(*pXdp)). This
was previously fine for the pXd_sect() macro because it only evaluated
its argument once. But pXd_leaf() evaluates its argument multiple times.
So let's avoid unintended side effects by reimplementing pXd_leaf() as
an inline function.
Signed-off-by: Ryan Roberts <ryan.roberts@arm.com> Signed-off-by: Catalin Marinas <catalin.marinas@arm.com>
Ryan Roberts [Mon, 30 Mar 2026 16:17:03 +0000 (17:17 +0100)]
arm64: mm: Handle invalid large leaf mappings correctly
It has been possible for a long time to mark ptes in the linear map as
invalid. This is done for secretmem, kfence, realm dma memory un/share,
and others, by simply clearing the PTE_VALID bit. But until commit a166563e7ec37 ("arm64: mm: support large block mapping when
rodata=full") large leaf mappings were never made invalid in this way.
It turns out various parts of the code base are not equipped to handle
invalid large leaf mappings (in the way they are currently encoded) and
I've observed a kernel panic while booting a realm guest on a
BBML2_NOABORT system as a result:
This panic occurs because the swiotlb memory was previously shared to
the host (__set_memory_enc_dec()), which involves transitioning the
(large) leaf mappings to invalid, sharing to the host, then marking the
mappings valid again. But pageattr_p[mu]d_entry() would only update the
entry if it is a section mapping, since otherwise it concluded it must
be a table entry so shouldn't be modified. But p[mu]d_sect() only
returns true if the entry is valid. So the result was that the large
leaf entry was made invalid in the first pass then ignored in the second
pass. It remains invalid until the above code tries to access it and
blows up.
The simple fix would be to update pageattr_pmd_entry() to use
!pmd_table() instead of pmd_sect(). That would solve this problem.
But the ptdump code also suffers from a similar issue. It checks
pmd_leaf() and doesn't call into the arch-specific note_page() machinery
if it returns false. As a result of this, ptdump wasn't even able to
show the invalid large leaf mappings; it looked like they were valid
which made this super fun to debug. the ptdump code is core-mm and
pmd_table() is arm64-specific so we can't use the same trick to solve
that.
But we already support the concept of "present-invalid" for user space
entries. And even better, pmd_leaf() will return true for a leaf mapping
that is marked present-invalid. So let's just use that encoding for
present-invalid kernel mappings too. Then we can use pmd_leaf() where we
previously used pmd_sect() and everything is magically fixed.
Additionally, from inspection kernel_page_present() was broken in a
similar way, so I'm also updating that to use pmd_leaf().
The transitional page tables component was also similarly broken; it
creates a copy of the kernel page tables, making RO leaf mappings RW in
the process. It also makes invalid (but-not-none) pte mappings valid.
But it was not doing this for large leaf mappings. This could have
resulted in crashes at kexec- or hibernate-time. This code is fixed to
flip "present-invalid" mappings back to "present-valid" at all levels.
Finally, I have hardened split_pmd()/split_pud() so that if it is passed
a "present-invalid" leaf, it will maintain that property in the split
leaves, since I wasn't able to convince myself that it would only ever
be called for "present-valid" leaves.
Fixes: a166563e7ec3 ("arm64: mm: support large block mapping when rodata=full") Cc: stable@vger.kernel.org Signed-off-by: Ryan Roberts <ryan.roberts@arm.com> Signed-off-by: Catalin Marinas <catalin.marinas@arm.com>
Ryan Roberts [Mon, 30 Mar 2026 16:17:02 +0000 (17:17 +0100)]
arm64: mm: Fix rodata=full block mapping support for realm guests
Commit a166563e7ec37 ("arm64: mm: support large block mapping when
rodata=full") enabled the linear map to be mapped by block/cont while
still allowing granular permission changes on BBML2_NOABORT systems by
lazily splitting the live mappings. This mechanism was intended to be
usable by realm guests since they need to dynamically share dma buffers
with the host by "decrypting" them - which for Arm CCA, means marking
them as shared in the page tables.
However, it turns out that the mechanism was failing for realm guests
because realms need to share their dma buffers (via
__set_memory_enc_dec()) much earlier during boot than
split_kernel_leaf_mapping() was able to handle. The report linked below
showed that GIC's ITS was one such user. But during the investigation I
found other callsites that could not meet the
split_kernel_leaf_mapping() constraints.
The problem is that we block map the linear map based on the boot CPU
supporting BBML2_NOABORT, then check that all the other CPUs support it
too when finalizing the caps. If they don't, then we stop_machine() and
split to ptes. For safety, split_kernel_leaf_mapping() previously
wouldn't permit splitting until after the caps were finalized. That
ensured that if any secondary cpus were running that didn't support
BBML2_NOABORT, we wouldn't risk breaking them.
I've fix this problem by reducing the black-out window where we refuse
to split; there are now 2 windows. The first is from T0 until the page
allocator is inititialized. Splitting allocates memory for the page
allocator so it must be in use. The second covers the period between
starting to online the secondary cpus until the system caps are
finalized (this is a very small window).
All of the problematic callers are calling __set_memory_enc_dec() before
the secondary cpus come online, so this solves the problem. However, one
of these callers, swiotlb_update_mem_attributes(), was trying to split
before the page allocator was initialized. So I have moved this call
from arch_mm_preinit() to mem_init(), which solves the ordering issue.
I've added warnings and return an error if any attempt is made to split
in the black-out windows.
Note there are other issues which prevent booting all the way to user
space, which will be fixed in subsequent patches.
Reported-by: Jinjiang Tu <tujinjiang@huawei.com> Closes: https://lore.kernel.org/all/0b2a4ae5-fc51-4d77-b177-b2e9db74f11d@huawei.com/ Fixes: a166563e7ec3 ("arm64: mm: support large block mapping when rodata=full") Cc: stable@vger.kernel.org Reviewed-by: Kevin Brodsky <kevin.brodsky@arm.com> Signed-off-by: Ryan Roberts <ryan.roberts@arm.com> Reviewed-by: Suzuki K Poulose <suzuki.poulose@arm.com> Tested-by: Suzuki K Poulose <suzuki.poulose@arm.com> Signed-off-by: Catalin Marinas <catalin.marinas@arm.com>
Nicholas Carlini [Tue, 31 Mar 2026 13:25:32 +0000 (15:25 +0200)]
eventpoll: defer struct eventpoll free to RCU grace period
In certain situations, ep_free() in eventpoll.c will kfree the epi->ep
eventpoll struct while it still being used by another concurrent thread.
Defer the kfree() to an RCU callback to prevent UAF.
Fixes: f2e467a48287 ("eventpoll: Fix semi-unbounded recursion") Signed-off-by: Nicholas Carlini <nicholas@carlini.com> Signed-off-by: Christian Brauner <brauner@kernel.org>
Karol Wachowski [Thu, 2 Apr 2026 12:55:26 +0000 (14:55 +0200)]
accel/ivpu: Trigger recovery on TDR with OS scheduling
With OS scheduling mode the driver cannot determine which context
caused the timeout, so context abort cannot be used. Instead of
queuing context_abort_work, directly trigger full device recovery
when a job timeout (TDR) occurs in OS scheduling mode.
Fixes: ade00a6c903f ("accel/ivpu: Perform engine reset instead of device recovery on TDR") Reviewed-by: Jeff Hugo <jeff.hugo@oss.qualcomm.com> Reviewed-by: Lizhi Hou <lizhi.hou@amd.com> Signed-off-by: Karol Wachowski <karol.wachowski@linux.intel.com> Link: https://patch.msgid.link/20260402125526.845210-1-karol.wachowski@linux.intel.com
Changwoo Min [Thu, 2 Apr 2026 02:31:50 +0000 (11:31 +0900)]
sched_ext: Fix is_bpf_migration_disabled() false negative on non-PREEMPT_RCU
Since commit 8e4f0b1ebcf2 ("bpf: use rcu_read_lock_dont_migrate() for
trampoline.c"), the BPF prolog (__bpf_prog_enter) calls migrate_disable()
only when CONFIG_PREEMPT_RCU is enabled, via rcu_read_lock_dont_migrate().
Without CONFIG_PREEMPT_RCU, the prolog never touches migration_disabled,
so migration_disabled == 1 always means the task is truly
migration-disabled regardless of whether it is the current task.
The old unconditional p == current check was a false negative in this
case, potentially allowing a migration-disabled task to be dispatched to
a remote CPU and triggering scx_error in task_can_run_on_remote_rq().
Only apply the p == current disambiguation when CONFIG_PREEMPT_RCU is
enabled, where the ambiguity with the BPF prolog still exists.
Fixes: 8e4f0b1ebcf2 ("bpf: use rcu_read_lock_dont_migrate() for trampoline.c") Cc: stable@vger.kernel.org # v6.18+ Link: https://lore.kernel.org/lkml/20250821090609.42508-8-dongml2@chinatelecom.cn/ Signed-off-by: Changwoo Min <changwoo@igalia.com> Reviewed-by: Andrea Righi <arighi@nvidia.com> Signed-off-by: Tejun Heo <tj@kernel.org>
Ionut Nechita [Mon, 23 Mar 2026 21:13:43 +0000 (23:13 +0200)]
drm/amd/display: Wire up dcn10_dio_construct() for all pre-DCN401 generations
Description:
- Commit b82f0759346617b2 ("drm/amd/display: Migrate DIO registers access
from hwseq to dio component") moved DIO_MEM_PWR_CTRL register access
behind the new dio abstraction layer but only created the dio object for
DCN 4.01. On all other generations (DCN 10/20/21/201/30/301/302/303/
31/314/315/316/32/321/35/351/36), the dio pointer is NULL, causing the
register write to be silently skipped.
This results in AFMT HDMI memory not being powered on during init_hw,
which can cause HDMI audio failures and display issues on affected
hardware including Renoir/Cezanne (DCN 2.1) APUs that use dcn10_init_hw.
Call dcn10_dio_construct() in each older DCN generation's resource.c
to create the dio object, following the same pattern as DCN 4.01. This
ensures the dio pointer is non-NULL and the mem_pwr_ctrl callback works
through the dio abstraction for all DCN generations.
Fixes: b82f07593466 ("drm/amd/display: Migrate DIO registers access from hwseq to dio component.") Reviewed-by: Ivan Lipski <ivan.lipski@amd.com> Signed-off-by: Ionut Nechita <ionut_n2001@yahoo.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
sched_ext: Fix missing warning in scx_set_task_state() default case
In scx_set_task_state(), the default case was setting the
warn flag, but then returning immediately. This is problematic
because the only purpose of the warn flag is to trigger
WARN_ONCE, but the early return prevented it from ever firing,
leaving invalid task states undetected and untraced.
To fix this, a WARN_ONCE call is now added directly in the
default case.
The fix addresses two aspects:
- Guarantees the invalid task states are properly logged
and traced.
- Provides a distinct warning message
("sched_ext: Invalid task state") specifically for
states outside the defined scx_task_state enum values,
making it easier to distinguish from other transition
warnings.
This ensures proper detection and reporting of invalid states.
Signed-off-by: Samuele Mariotti <smariotti@disroot.org> Signed-off-by: Paolo Valente <paolo.valente@unimore.it> Reviewed-by: Andrea Righi <arighi@nvidia.com> Signed-off-by: Tejun Heo <tj@kernel.org>
ata: libata-transport: use static struct ata_transport_internal to simplify match functions
Both matching functions can make use of static struct
ata_transport_internal. This eliminates the dependency on static
variable ata_scsi_transport_template, and it allows to remove helper
to_ata_internal(). Small drawback is that a forward declaration of
both functions is needed.
Reviewed-by: Damien Le Moal <dlemoal@kernel.org> Signed-off-by: Heiner Kallweit <hkallweit1@gmail.com> Signed-off-by: Niklas Cassel <cassel@kernel.org>
Miklos Szeredi [Thu, 12 Mar 2026 19:30:08 +0000 (20:30 +0100)]
fuse: support FSCONFIG_SET_FD for "fd" option
This is not only cleaner to use in userspace (no need to sprintf the fd to
a string) but also allows userspace to detect that the devfd can be closed
after the fsconfig call.
Signed-off-by: Miklos Szeredi <mszeredi@redhat.com> Reviewed-by: "Darrick J. Wong" <djwong@kernel.org>
Miklos Szeredi [Thu, 12 Mar 2026 11:19:10 +0000 (12:19 +0100)]
fuse: clean up device cloning
- fuse_mutex is not needed for device cloning, because fuse_dev_install()
uses cmpxcg() to set fud->fc, which prevents races between clone/mount
or clone/clone. This makes the logic simpler
- Drop fc->dev_count. This is only used to check in release if the device
is the last clone, but checking list_empty(&fc->devices) is equivalent
after removing the released device from the list. Removing the fuse_dev
before calling fuse_abort_conn() is okay, since the processing and io
lists are now empty for this device.
projects / thirdparty / kernel / stable.git / log
