summaryrefslogtreecommitdiff
path: root/include/linux
AgeCommit message (Collapse)Author
2026-07-20posix-cpu-timers: Avoid kernel-doc warningsRandy Dunlap
Use the struct keyword when describing a struct. Without that, the type defaults to function. Warning: ./include/linux/posix-timers_types.h:40 cannot understand function prototype: 'struct posix_cputimer_base' Warning: ./include/linux/posix-timers_types.h:55 cannot understand function prototype: 'struct posix_cputimers' Warning: ./include/linux/posix-timers_types.h:67 cannot understand function prototype: 'struct posix_cputimers_work' Signed-off-by: Randy Dunlap <rdunlap@infradead.org> Signed-off-by: Thomas Gleixner <tglx@kernel.org> Link: https://patch.msgid.link/20260720031236.3070575-2-rdunlap@infradead.org
2026-07-20posix-timers: Clean up kernel-doc warningsRandy Dunlap
Use the struct keyword when describing a struct. Add missing kernel-doc for @it_pid_type. Warning: ./include/linux/posix-timers.h:58 cannot understand function prototype: 'struct cpu_timer' Warning: ./include/linux/posix-timers.h:222 struct member 'it_pid_type' not described in 'k_itimer' Signed-off-by: Randy Dunlap <rdunlap@infradead.org> Signed-off-by: Thomas Gleixner <tglx@kernel.org> Link: https://patch.msgid.link/20260720031236.3070575-1-rdunlap@infradead.org
2026-07-20PCI: host-generic: Fix NULL pointer dereference on 32-bit CAM systemsSteffen Persvold
On 32-bit systems the config space is too large to ioremap in one go, so pci_ecam_create() maps each bus segment separately and relies on the ->add_bus callback (pci_ecam_add_bus) to populate the per-bus mapping in cfg->winp[]. pci_ecam_map_bus() then uses that mapping as the base for every config access. The generic ECAM ops (pci_generic_ecam_ops) already provide the ->add_bus and ->remove_bus callbacks, but the CAM (legacy) ops in pci-host-generic.c do not. As a result, on a 32-bit host using "pci-host-cam-generic" the per-bus mapping is never set up and the first config read dereferences a NULL base, crashing during bus enumeration: Unable to handle kernel NULL pointer dereference at virtual address 00000800 Oops [#1] CPU: 0 PID: 1 Comm: swapper Not tainted 6.9.7+ #43 Hardware name: Digilent Nexys-Video-A7 RV32 (DT) epc : pci_generic_config_read+0x40/0xb0 ra : pci_generic_config_read+0x2c/0xb0 [<c038db9c>] pci_generic_config_read+0x40/0xb0 [<c038da04>] pci_bus_read_config_dword+0x50/0xb0 [<c0391e94>] pci_bus_generic_read_dev_vendor_id+0x3c/0x1ec [<c039245c>] pci_scan_single_device+0xa4/0x11c [<c0392570>] pci_scan_slot+0x9c/0x23c [<c039388c>] pci_scan_child_bus_extend+0x58/0x2f4 [<c0393db0>] pci_scan_root_bus_bridge+0x64/0xe8 [<c0393e54>] pci_host_probe+0x20/0xc8 [<c03bc6f4>] pci_host_common_probe+0x144/0x1e4 Fix this by giving the CAM ops the same ->add_bus/->remove_bus callbacks. Since pci_ecam_add_bus() and pci_ecam_remove_bus() are static to ecam.c, move the CAM ops definition there as pci_generic_cam_ops (mirroring pci_generic_ecam_ops) and export it for pci-host-generic.c to reference. Fixes: 8fe55ef23387 ("PCI: Dynamically map ECAM regions") Signed-off-by: Steffen Persvold <spersvold@gmail.com> [mani: removed timestamp from log] Signed-off-by: Manivannan Sadhasivam <mani@kernel.org> Cc: stable@vger.kernel.org Link: https://patch.msgid.link/20260709122446.3151899-1-spersvold@gmail.com
2026-07-20Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/netPaolo Abeni
Cross-merge networking fixes after downstream PR (net-7.2-rc4). No conflicts. Signed-off-by: Paolo Abeni <pabeni@redhat.com>
2026-07-19sched_ext: Hand over cgroups at sub-scheduler enable/disableTejun Heo
Sub-schedulers don't get cgroups yet: every task_group is inited on the root sched and the routing added by the previous patches always resolves to it. Add the handover: an enabling sub-scheduler takes over the cgroups in its subtree and a disabling one returns them to its parent. scx_cgroup_claim_subtree() runs while the sub enables, after the subtree's cgrp->scx_sched's are set and before any task is claimed. It inits each subtree task_group on the sub, exits it from the parent and updates tg->scx.sched. A failed ops.cgroup_init() unwinds the sub-side inits and aborts the enable with the parent untouched. Disabling reverses it with scx_cgroup_return_subtree(): exit each cgroup from the sub, then re-init it on the parent with the current tg->scx.* values, resyncing weight and bandwidth changes made while the sub had it. When a re-init fails, the parent is failed and the remaining task_groups still transfer uninited and get no cgroup ops - the same punting done for tasks. The dying parent's own disable moves them onward. The handover walks include dying but not yet offlined task_groups, the same as root's bulk walks: a removed cgroup keeps hosting scheduling events until its dying tasks finish their final context switches, and its ops.cgroup_exit() must follow the last of them. tg on/offlining is excluded through cgroup_lock(), so either ordering against an rmdir of a subtree cgroup delivers balanced init/exit pairs. Signed-off-by: Tejun Heo <tj@kernel.org> Reviewed-by: Andrea Righi <arighi@nvidia.com>
2026-07-19sched_ext: Deliver cgroup ops to each task_group's schedTejun Heo
With sub-schedulers claiming cgroup subtrees, cgroup ops must be delivered to each task_group's sched rather than always to root. Add tg->scx.sched to track which sched initialized the task_group. It is set and cleared together with SCX_TG_INITED. Deliver the ops accordingly: - ops.cgroup_exit() goes to the sched whose ops.cgroup_init() it pairs with. - ops.cgroup_prep_move/move/cancel_move() go to the task's sched, and only for moves that don't re-home the task. A re-homing move is reported through the ops.exit_task/init_task() pair instead. The cgroups passed to the move ops can be outside the sched's inited set as the cpu controller can be coarser than the sub-scheduler topology. - Knobs of a cgroup belong to the parent, so ops.set_weight/idle/bandwidth() go to the parent task_group's sched. All task_groups currently resolve to the root sched, so no behavior changes until sub-schedulers start claiming cgroups. While at it, scx_cgroup_init() is restructured so both paths share the recording. Signed-off-by: Tejun Heo <tj@kernel.org> Reviewed-by: Andrea Righi <arighi@nvidia.com>
2026-07-19cgroup: Add cgroup_task_notifier and task migration eventsTejun Heo
A subsystem can attach to the cgroup hierarchy itself, independent of which controllers are enabled where - BPF hooks already behave this way and sched_ext sub-schedulers do too. Controller callbacks can't track task migrations for them: sched_ext must re-home a task whose migration crosses a sub-scheduler boundary, but the cpu controller's attach callbacks fire only when the task_group changes and miss moves whenever the controller topology is coarser than the sub-scheduler topology. Add cgroup_task_notifier with per-task migration events mirroring the can_attach/attach/cancel_attach phases so that a consumer which prepares per-task state can also veto a migration: CGROUP_TASK_MIGRATING fires pre-commit, CGROUP_TASK_MIGRATED post-commit and CGROUP_TASK_MIGRATE_CANCELED unwinds a failed migration. Only migrations that change a task's dfl cgroup are reported. Signed-off-by: Tejun Heo <tj@kernel.org> Reviewed-by: Andrea Righi <arighi@nvidia.com>
2026-07-19bpf: Disallow interpreter fallback for BPF_ADDR_PERCPU insnLeon Hwang
The BPF_MOV64_PERCPU_REG insn requires JIT to emit native code to for 'dst_reg = src_reg + <percpu_base_off>'. However, the interpreter ignores the 'off' at its ALU64_MOV_X label. The 'off' indicates the insn is BPF_MOV64_PERCPU_REG insn. Then, when the interpreter loads memory from the register, it will hit a page fault. [ 2.545572] BUG: unable to handle page fault for address: ffffffffacaaf034 [ 2.546485] #PF: supervisor read access in kernel mode [ 2.547167] #PF: error_code(0x0000) - not-present page [ 2.547850] PGD 134e63067 P4D 134e63067 PUD 134e64063 PMD 10021c063 PTE 800ffffeca550062 [ 2.548912] Oops: Oops: 0000 [#1] SMP PTI Set jit_required as true in order to disallow interpreter fallback in core.c::__bpf_prog_select_runtime(), if any BPF_ADDR_PERCPU insn is patched to the prog. BTW, rename the helper bpf_map_supports_cpu_flags() to bpf_map_is_percpu_map(). Fixes: 7bdbf7446305 ("bpf: add special internal-only MOV instruction to resolve per-CPU addrs") Signed-off-by: Leon Hwang <leon.hwang@linux.dev> Link: https://lore.kernel.org/bpf/20260715141122.15783-4-leon.hwang@linux.dev Signed-off-by: Kumar Kartikeya Dwivedi <memxor@gmail.com>
2026-07-17Merge branch 'for-7.2-fixes' into for-7.3Tejun Heo
Pull to receive: 477869bfafea ("sched_ext: Reject setting disallow from init_task outside the enable path") 5f8b69642d18 ("sched_ext: Take cgroup_lock() first in scx_cgroup_lock()") 8c13364db9c9 ("sched_ext: Skip sub-disable teardown for never-linked sub-schedulers") 5cdc92859809 ("sched_ext: Don't enable non-ext tasks in the sub-sched task loops") as dependencies for the upcoming cgroup migration patchset and to resolve the conflicts with the ext.c/sub.c split on for-7.3. 5f8b69642d18 comments scx_cgroup_lock() which for-7.3 exported for sub.c. Resolved by keeping the exported version with the comment. 8c13364db9c9 and 5cdc92859809 patch the pre-split sub-sched enable and disable paths in ext.c which for-7.3 moved to sub.c. Resolved by applying the never-linked teardown skip and the class gates to sub.c. Signed-off-by: Tejun Heo <tj@kernel.org>
2026-07-17sched_ext: Reject setting disallow from init_task outside the enable pathTejun Heo
The p->scx.disallow revert assumes the root enable path, where the switching loop reads the reverted policy right afterwards and leaves the task off SCX. The sub-scheduler disable path also reaches it when re-initializing the returned tasks on a root parent. Nothing reads the policy there: the task is enabled on root anyway and keeps running on the ext class with a silently rewritten policy. Kill the sched instead, matching the fork and non-root branches, and update the disallow documentation, which equated !fork with the load path and pointed at a stale debugfs path for nr_rejected. Fixes: 337ec00b1d9c ("sched_ext: Implement cgroup sub-sched enabling and disabling") Signed-off-by: Tejun Heo <tj@kernel.org> Reviewed-by: Andrea Righi <arighi@nvidia.com>
2026-07-18ata: libata-eh: make ata_eh_qc_complete() and ata_eh_qc_retry() staticDamien Le Moal
The functions ata_eh_qc_complete() and ata_eh_qc_retry() are used only in libata-eh.c. So remove the declaration of these functions from include/linux/libata.h and define them as static. While at it, add a missing blank line between variable declaration and code in these two functions. No functional changes intended. Signed-off-by: Damien Le Moal <dlemoal@kernel.org> Reviewed-by: Niklas Cassel <cassel@kernel.org>
2026-07-18ata: libata-scsi: add support for the REMOVE ELEMENT AND MODIFY ZONES commandDamien Le Moal
Define the translation for the REMOVE ELEMENT AND MODIFY ZONES command (SERVICE ACTION IN command with service action SAI_REMOVE_ELEMENT_AND_MODIFY_ZONES) into the ATA command ATA_CMD_REMOVE_ELEMENT_AND_MODIFY_ZONES with the new function ata_scsi_remove_element_and_modify_zones_xlat() The array of supported commands ata_supported_cmds is modified to add a new entry for this command. ata_scsi_cmd_is_supported() is also modify to correctly handle this new entry depending on the target device flag ATA_DFLAG_DEPOP being set, and the target device being a ZAC zoned device. Signed-off-by: Damien Le Moal <dlemoal@kernel.org> Reviewed-by: Martin K. Petersen <martin.petersen@oracle.com> Reviewed-by: Hannes Reinecke <hare@kernel.org>
2026-07-18ata: libata-scsi: add support for the RESTORE ELEMENTS AND REBUILD commandDamien Le Moal
Define the translation for the RESTORE ELEMENTS AND REBUILD command (SERVICE ACTION IN command with service action SAI_RESTORE_ELEMENTS_AND_REBUILD) into the ATA command ATA_CMD_RESTORE_ELEMENTS_AND_REBUILD with the new function ata_scsi_restore_elements_and_rebuild_xlat() The array of supported commands ata_supported_cmds is modified to add a new entry for this command. ata_scsi_cmd_is_supported() is also modify to correctly handle this new entry depending on the target device flag ATA_DFLAG_DEPOP_RESTORE being set. The ATA command completion is handled using the function ata_scsi_depop_ua_cap_changed_complete() so that on a successful completion, a UNIT ATTENTION with the additional sense code set to CAPACITY DATA HAS CHANGED is raised. Signed-off-by: Damien Le Moal <dlemoal@kernel.org> Reviewed-by: Martin K. Petersen <martin.petersen@oracle.com> Reviewed-by: Hannes Reinecke <hare@kernel.org>
2026-07-18ata: libata-scsi: add support for the REMOVE ELEMENT AND TRUNCATE commandDamien Le Moal
Define the translation for the REMOVE ELEMENT AND TRUNCATE command (SERVICE ACTION IN command with service action SAI_REMOVE_ELEMENT_AND_TRUNCATE) into the ATA command ATA_CMD_REMOVE_ELEMENT_AND_TRUNCATE with the new function ata_scsi_remove_element_and_truncate_xlat() The array of supported commands ata_supported_cmds is modified to add a new entry for this command. ata_scsi_cmd_is_supported() is also modify to correctly handle this new entry depending on the target device flag ATA_DFLAG_DEPOP being set. The ATA command completion is handled using the function ata_scsi_depop_ua_cap_changed_complete() so that on a successful completion, a UNIT ATTENTION with the additional sense code set to CAPACITY DATA HAS CHANGED is raised. Signed-off-by: Damien Le Moal <dlemoal@kernel.org> Reviewed-by: Martin K. Petersen <martin.petersen@oracle.com> Reviewed-by: Hannes Reinecke <hare@kernel.org>
2026-07-18ata: libata-scsi: add support for the GET PHYSICAL ELEMENT STATUS commandDamien Le Moal
Define the translation for the GET PHYSICAL ELEMENT STATUS command (SERVICE ACTION IN command with service action SAI_GET_PHYSICAL_ELEMENT_STATUS) into the ATA command ATA_CMD_GET_PHYS_ELEMENT_STATUS with the new function ata_scsi_get_phys_element_status_xlat(). The reply of this function also needs translation from little endian to big endian. This is done with the completion callback ata_scsi_get_phys_element_status_complete(). The array of supported commands ata_supported_cmds is modified to add a new entry for this command. ata_scsi_cmd_is_supported() is also modified to correctly handle this new entry depending on the target device flag ATA_DFLAG_DEPOP being set. Signed-off-by: Damien Le Moal <dlemoal@kernel.org> Reviewed-by: Martin K. Petersen <martin.petersen@oracle.com> Reviewed-by: Hannes Reinecke <hare@kernel.org>
2026-07-18ata: libata-core: detect support for depopulation capabilitiesDamien Le Moal
Introduce the device flags ATA_DFLAG_DEPOP to indicate support by a device for the basic commands of the storage element depopulation feature set, that is, the GET PHYSICAL ELEMENT STATUS and REMOVE ELEMENT AND TRUNCATE commands. The device flag ATA_DFLAG_DEPOP_RESTORE flag is introduced to indicate support for the RESTORE ELEMENTS AND REBUILD command. Both flags are obtained from the command support bits of the qword at bytes 152 to 159 of the supported capabilities log page. For ZAC devices, the device flag ATA_DFLAG_DEPOP_MODIFY is introduced to indicate support for the REMOVE ELEMENT AND MODIFY ZONES command. This support is indicated by the REMOVE ELEMENT AND MODIFY ZONES SUPPORTED bit in the qword at byte 8 to 15 of the zoned device information log page. The function ata_dev_config_depop() is introduced to set these flags based on the content of the supported capabilities log and zoned device information log. As per the ACS specifications, NCQ autosense support is also mandatory if these flags are set. Signed-off-by: Damien Le Moal <dlemoal@kernel.org> Reviewed-by: Martin K. Petersen <martin.petersen@oracle.com> Reviewed-by: Hannes Reinecke <hare@kernel.org>
2026-07-18ata: libata: improve the definition of device flagsDamien Le Moal
The flags field of struct ata_device has the unsigned long type. Define all the ATA_DFLAG_XXX flags using a 1UL bit shift to match this type, thus avoiding flags to become signed values (e.g. for bit 31 flag). To avoid all other values defined in the same enum as the ATA_DFLAG_XXX flags to implicitly also become unsigned long values, move the device flags definition to a separate enum. Signed-off-by: Damien Le Moal <dlemoal@kernel.org> Reviewed-by: Martin K. Petersen <martin.petersen@oracle.com>
2026-07-17Merge git://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf 7.2-rc4Kumar Kartikeya Dwivedi
Cross-merge BPF and other fixes after downstream PR. Signed-off-by: Kumar Kartikeya Dwivedi <memxor@gmail.com>
2026-07-17Merge tag 'bpf-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpfLinus Torvalds
Pull bpf fixes from Kumar Kartikeya Dwivedi: - Fix a UAF in socket clone early bailout paths (Matt Bobrowski) - Reject unhashed UDP sockets on sockmap update to prevent refcount leaks (Michal Luczaj) - Account for receive queue data in FIONREAD on sockmap sockets without a verdict program (Mattia Meleleo) - Reject negative constant offsets for verifier buffer pointers (Sun Jian) - Fix for tracing of kfuncs with implicit arguments (Ihor Solodrai) * tag 'bpf-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf: selftests/bpf: Cover tracing implicit kfunc args bpf: Fix tracing of kfuncs with implicit args selftests/bpf: Cover negative buffer pointer offsets bpf: Reject negative const offsets for buffer pointers selftests/bpf: Test FIONREAD on a sockmap socket without a verdict program bpf, sockmap: Account for receive queue in FIONREAD without a verdict program selftests/bpf: Fail unbound UDP on sockmap update selftests/bpf: Adapt sockmap update error handling bpf, sockmap: Reject unhashed UDP sockets on sockmap update selftests/bpf: Ensure UDP sockets are bound bpf: Fix UAF in sock clone early bailouts
2026-07-17Merge tag 'net-7.2-rc4' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net Pull networking fixes from Paolo Abeni: "Including fixes from Wireless, IPsec, Netfilter and Bluetooth. Current release - new code bugs: - netfilter: flowtable: use correct direction to set up tunnel route Previous releases - regressions: - wifi: - mac80211: - free AP_VLAN bc_buf SKBs outside IRQ lock - defer link RX stats percpu free to RCU - fix double free on alloc failure - cfg80211: convert pmsr_free_wk to wiphy_work to fix deadlock - ipv4: free fib_alias with kfree_rcu() on insert error path - sched: act_tunnel_key: Defer dst_release to RCU callback - xfrm: fix sk_dst_cache double-free in xfrm_user_policy() - bluetooth: fix locking in unpair_device/disconnect_sync - can: add locking for raw flags bitfield - openvswitch: reject oversized nested action attrs - eth: - bnxt_en: handle partially initialized auxiliary devices - ppp: defer channel free to an RCU grace period to fix UAF Previous releases - always broken: - netfilter: xt_nat: reject unsupported target families - wifi: - brcmfmac: fix heap overflow on a short auth frame - cfg80211: add missing FTM API validation - xfrm: - reject optional IPTFS templates in outbound policies - policy: preallocate inexact bins before xfrm_hash_rebuild reinsert - bluetooth: revalidate LOAD_CONN_PARAM queued update - can: fix lockless bound/ifindex race and silent RX_SETUP failure - eth: mlx5: free mlx5_st_idx_data on final dealloc" * tag 'net-7.2-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net: (108 commits) mpls: fix NULL deref in mpls_valid_fib_dump_req() on CONFIG_INET=n llc: fix SAP refcount leak when creating incoming sockets selftests: netconsole: only restore MAC when it changed on resume bnxt_en: Handle partially initialized auxiliary devices sctp: fix auth_hmacs array size in struct sctp_cookie net/sched: act_tunnel_key: Defer dst_release to RCU callback dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() tcp: fix TIME_WAIT socket reference leak on PSP policy failure net/mlx5: free mlx5_st_idx_data on final dealloc can: isotp: serialize TX state transitions under so->rx_lock can: isotp: fix use-after-free race with concurrent NETDEV_UNREGISTER can: isotp: use unconditional synchronize_rcu() in isotp_release() can: bcm: track a single source interface for ANYDEV timeout/throttle ops can: bcm: fix data race on rx_stamp/rx_ifindex in bcm_rx_handler() can: bcm: fix stale rx/tx ops after device removal can: bcm: add missing device refcount for CAN filter removal can: bcm: validate frame length in bcm_rx_setup() for RTR replies can: bcm: extend bcm_tx_lock usage for data and timer updates can: bcm: add missing rcu list annotations and operations can: bcm: fix CAN frame rx/tx statistics ...
2026-07-17mtd: nand-omap2: Move omap_nand_ids[] to raw nand driverUwe Kleine-König (The Capable Hub)
Defining a static array in a header results in each .c file that includes the header (here: drivers/memory/omap-gpmc.c and drivers/mtd/nand/raw/omap2.c) to contain a copy of that array when compiled to an object file. With sizeof(struct of_device_id[3]) ≥ 588 having omap_nand_ids[] twice just to do two string comparisons is quite some bloat. So move omap_nand_ids[] to the nand driver which actually needs that array for its module meta data and do the compatible check by hand. bloat-o-meter reports for drivers/memory/omap-gpmc.o (ARCH=arm): add/remove: 1/2 grow/shrink: 1/0 up/down: 28/-588 (-560) Function old new delta gpmc_probe_generic_child 2108 2136 +28 omap_nand_ids 588 - -588 Total: Before=18114, After=17554, chg -3.09% (drivers/mtd/nand/raw/omap2.o doesn't change). This allows to drop <linux/mod_devicetable.h> from include/linux/platform_data/mtd-nand-omap2.h (which is my original motivation for this change). Note that this header isn't needed in the two drivers because omap-gpmc.c doesn't use any device id struct and for the nand driver omap2.c of_device_id is already provided via <linux/platform_device.h>. Signed-off-by: Uwe Kleine-König (The Capable Hub) <u.kleine-koenig@baylibre.com> Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
2026-07-17mtd: rawnand: qcom: Make has_onfi_read_op separate from qpic_version2Stephan Gerhold
QPIC v1.5 requires using the OP_PAGE_READ_ONFI_READ command, but is missing the rest of the hardware changes that are currently covered by the QPIC v2 (qpic_version2) check in the driver. Split that into an extra has_onfi_read_op feature flag so it can be separately enabled. No functional change. Reviewed-by: Manivannan Sadhasivam <mani@kernel.org> Signed-off-by: Stephan Gerhold <stephan.gerhold@linaro.org> Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
2026-07-17greybus: Drop #include of <linux/mod_devicetable.h>Uwe Kleine-König (The Capable Hub)
The header itself also includes <linux/types.h> and additional to that doesn't make use of any symbol defined (transitively) by <linux/mod_devicetable.h>. Also the .c files that include that header don't need it (there is no direct include, only via <linux/greybus.h>): $ git grep -l greybus\\.h | xargs grep -E "\<(acpi_device_id|amba_id|ap_device_id|apr_device_id|auxiliary_device_id|bcma_device_id|ccw_device_id|cdx_device_id|coreboot_device_id|css_device_id|dfl_device_id|dmi_(device|system)_id|eisa_device_id|fsl_mc_device_id|hda_device_id|hid_device_id|hv_vmbus_device_id|i2c_device_id|i3c_device_id|ieee1394_device_id|input_device_id|ipack_device_id|isapnp_device_id|ishtp_device_id|mcb_device_id|mdio_device_id|mei_cl_device_id|mhi_device_id|mips_cdmm_device_id|of_device_id|parisc_device_id|pci_device_id|pci_epf_device_id|pcmcia_device_id|platform_device_id|pnp_(card_)?device_id|rio_device_id|rpmsg_device_id|sdio_device_id|sdw_device_id|serio_device_id|slim_device_id|spi_device_id|spmi_device_id|ssam_device_id|ssb_device_id|tb_service_id|tee_client_device_id|typec_device_id|ulpi_device_id|usb_device_id|vchiq_device_id|virtio_device_id|wmi_device_id|x86_(cpu|device)_id|zorro_device_id|cpu_feature)\>" drivers/greybus/es2.c:static const struct usb_device_id id_table[] = { drivers/greybus/es2.c: const struct usb_device_id *id) drivers/greybus/gb-beagleplay.c:static const struct of_device_id gb_beagleplay_of_match[] = { drivers/staging/greybus/arche-platform.c:static const struct of_device_id arche_platform_of_match[] = { drivers/greybus/es2.c includes <linux/usb.h>, drivers/greybus/gb-beagleplay.c includes <linux/serdev.h> which provides of_device_id via <linux/device.h>, similar drivers/staging/greybus/arche-platform.c includes <linux/platform_device.h> which also provides of_device_id. So the #include can go away without further adaption. Signed-off-by: Uwe Kleine-König (The Capable Hub) <u.kleine-koenig@baylibre.com> Link: https://patch.msgid.link/80964227feede2d8f1978f13f4219fcf9e63d8d0.1783354012.git.u.kleine-koenig@baylibre.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-07-17misc: amd-sbi: Add SBTSI ioctl register transfer interfacePrathima
Implement IOCTL interface for SB-TSI driver to enable userspace access to TSI register read/write operations through the AMD Advanced Platform Management Link (APML) protocol. Add an ioctl command (SBTSI_IOCTL_REG_XFER_CMD) that accepts a register address, data byte, and direction flag. The mutex is taken on the ioctl path here; the hwmon path is placed under the same lock in the next patch, which completes serialization between the hwmon and ioctl paths. Reviewed-by: Akshay Gupta <Akshay.Gupta@amd.com> Signed-off-by: Prathima <Prathima.Lk@amd.com> Link: https://patch.msgid.link/20260710111642.850022-7-Akshay.Gupta@amd.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-07-17misc: amd-sbi: Add support for SB-TSI over I3CPrathima
AMD SB-TSI temperature sensors can be accessed over both I2C and I3C buses depending on the platform configuration. Extend the SB-TSI driver to support both I2C and I3C bus interfaces by selecting the appropriate transport based on the probed bus type. The driver maintains backward compatibility with existing I2C deployments while enabling support for systems using the I3C bus. Register both I2C and I3C drivers using module_i3c_i2c_driver() and update the Kconfig dependency from I2C to I3C_OR_I2C. Reviewed-by: Akshay Gupta <Akshay.Gupta@amd.com> Signed-off-by: Prathima <Prathima.Lk@amd.com> Link: https://patch.msgid.link/20260710111642.850022-6-Akshay.Gupta@amd.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-07-17misc: amd-sbi: Consolidate Common SBTSI Probe PathPrathima
Refactor shared probe procedures into sbtsi_probe_common() to ensure that I2C and I3C probes focus solely on bus-specific allocation and device configuration. The utility function reads the configuration register via sbtsi_xfer(), initializes ext_range_mode and read_order, assigns the driver data, and registers the hwmon auxiliary device. Routing register access through sbtsi_xfer() keeps the probe path bus-agnostic, so no transfer logic has to be duplicated when SB-TSI over I3C support is added in a later patch. Reviewed-by: Akshay Gupta <Akshay.Gupta@amd.com> Signed-off-by: Prathima <Prathima.Lk@amd.com> Link: https://patch.msgid.link/20260710111642.850022-5-Akshay.Gupta@amd.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-07-17hwmon/misc: amd-sbi: Move sbtsi register transfer to core abstractionPrathima
Move the I2C read/write byte operations from the sbtsi hwmon driver into a common sbtsi_xfer() function in tsi-core.c. This decouples the hwmon sensor driver from the underlying bus transport, preparing for I3C support in a subsequent patch. This patch does not introduce any functional changes. The updates are limited to code organization/cleanup and should not affect the runtime behavior of the driver Reviewed-by: Akshay Gupta <Akshay.Gupta@amd.com> Signed-off-by: Prathima <Prathima.Lk@amd.com> Acked-by: Guenter Roeck <linux@roeck-us.net> Link: https://patch.msgid.link/20260710111642.850022-4-Akshay.Gupta@amd.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-07-17hwmon/misc: amd-sbi: Move core sbtsi support from hwmon to miscPrathima
Move SBTSI(Side-Band Temperature Sensor Interface) core functionality out of the hwmon-only path and into drivers/misc/amd-sbi so it can be reused by non-hwmon consumers. I2C probe parsing is moved from drivers/hwmon/sbtsi_temp.c into drivers/misc/amd-sbi/tsi.c under CONFIG_AMD_SBTSI. The core driver stores struct sbtsi_data on the bus device and registers an auxiliary device amd-sbtsi.temp-sensor.<addr> per target. The current hwmon temp sensor will now require the CONFIG_AMD_SBTSI configuration as a new dependency. This split prepares the driver for additional interfaces while keeping hwmon support in hwmon subsystem on top of common SBTSI core logic. Add platform dependencies to clarify this driver is intended to run on the BMC and not on the managed node. Reviewed-by: Akshay Gupta <Akshay.Gupta@amd.com> Signed-off-by: Prathima <Prathima.Lk@amd.com> Acked-by: Guenter Roeck <linux@roeck-us.net> Link: https://patch.msgid.link/20260710111642.850022-2-Akshay.Gupta@amd.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-07-17net: phy: at803x: Use a helper to check for phy reset existenceMaxime Chevallier
The at803x family of devices are subjected to an errata that requires hard-reseting the PHY upon link change. That can only work if there's a physical reset line wired to the PHY, which the driver checks by looking if there's a reset GPIO configured for the MDIO device. The reset may however be controlled through a reset controller, which isn't accounted for in the errata handling. Besides that, PHY drivers aren't expected to directly access the mdiodev's resources directly, let's therefore wrap this with a phylib helper, that uses a similar mdio helper to check for reset existence. This was found in preparation for bus-level resource management for better mdio scan support. Signed-off-by: Maxime Chevallier <maxime.chevallier@bootlin.com> Reviewed-by: Andrew Lunn <andrew@lunn.ch> Reviewed-by: Nicolai Buchwitz <nb@tipi-net.de> Link: https://patch.msgid.link/20260715101355.88536-1-maxime.chevallier@bootlin.com Signed-off-by: Paolo Abeni <pabeni@redhat.com>
2026-07-17dmaengine: Constify struct dma_descriptor_metadata_opsChristophe JAILLET
'struct dma_descriptor_metadata_ops' in not modified in these drivers. Constifying these structures moves some data to a read-only section, so increases overall security, especially when the structure holds some function pointers. On a x86_64, with allmodconfig, as an example: Before: ====== text data bss dec hex filename 120635 21584 64 142283 22bcb drivers/dma/xilinx/xilinx_dma.o After: ===== text data bss dec hex filename 120699 21520 64 142283 22bcb drivers/dma/xilinx/xilinx_dma.o Signed-off-by: Christophe JAILLET <christophe.jaillet@wanadoo.fr> Reviewed-by: Frank Li <Frank.Li@nxp.com> Reviewed-by: Sai Sree Kartheek Adivi <s-adivi@ti.com> Reviewed-by: Manivannan Sadhasivam <mani@kernel.org> Reviewed-by: Radhey Shyam Pandey <radhey.shyam.pandey@amd.com> Link: https://patch.msgid.link/b0a22171f3ed68e156a2fa84383e99c23ec6b2ff.1784037977.git.christophe.jaillet@wanadoo.fr Signed-off-by: Vinod Koul <vkoul@kernel.org>
2026-07-17Merge tag 'svc_fixes_for_v7.2' of ↵Greg Kroah-Hartman
ssh://gitolite.kernel.org/pub/scm/linux/kernel/git/dinguyen/linux into char-misc-linus Dinh writes: firmware: stratix10-svc: fixes for v7.2 - Fix a memory leak by explicitly using kfree() to match the list-managed lifetime - Fix FCS SMC call documentation - Add proper handling of a no response from the SDM - Fix teardown order of service driver * tag 'svc_fixes_for_v7.2' of ssh://gitolite.kernel.org/pub/scm/linux/kernel/git/dinguyen/linux: firmware: stratix10-svc: fix teardown order in remove to prevent race firmware: stratix10-svc: handle NO_RESPONSE in async poll firmware: stratix10-svc: fix FCS SMC call kernel-doc firmware: stratix10-svc: fix memory leaks and list corruption bugs
2026-07-17dmaengine: dw-edma: Enable HDMA 64R/W ChannelsDevendra K Verma
As per 'Designware Cores PCI Express Controller Databook', Section 7.1 - Overview, HDMA supports 64 Read and 64 Write channels. Current controller driver supports up to 8 read and write channels only. In order to utilize all the channels the controller driver need to have the channel related structs and variables as per the number of channels supported by IP. Following changes are made to enable 64 Read / 64 Write channel support: o Defined HDMA specific macros to reflect the channel count. o The count of ll_regions and dt_regions in dw_edma_chip and dw_edma_pcie_data shall be in accordance to number of read and write channels. o In dw_edma_probe() configure the channels as per the channels of the IP used. o Changed mask types to u64 for higher channel counts. Signed-off-by: Devendra K Verma <devendra.verma@amd.com> Reviewed-by: Frank Li <Frank.Li@nxp.com> Link: https://patch.msgid.link/20260713064854.4065262-1-devverma@amd.com Signed-off-by: Vinod Koul <vkoul@kernel.org>
2026-07-17ssb: gpio: Add and register software node for GPIO controllerDmitry Torokhov
We want to convert the legacy gpio-keys platform device on BCM47XX boards to use software nodes. To do this properly and allow referencing the GPIO controller by address rather than relying on name-based matching (which is being removed from the gpiolib core), we need to associate the GPIO controller with a software node. Introduce ssb_gpio_swnode, register it, and associate it with the gpio_chip. Assisted-by: Antigravity:gemini-3.5-flash Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com> Tested-by: Waldemar Brodkorb <wbx@openadk.org> Signed-off-by: Thomas Bogendoerfer <tsbogend@alpha.franken.de>
2026-07-17bcma: gpio: Add and register software node for GPIO controllerDmitry Torokhov
We want to convert the legacy gpio-keys platform device on BCM47XX boards to use software nodes. To do this properly and allow referencing the GPIO controller by address rather than relying on name-based matching (which is being removed from the gpiolib core), we need to associate the GPIO controller with a software node. Introduce bcma_gpio_swnode, register it if the device does not already have a firmware node, and associate it with the gpio_chip. Assisted-by: Antigravity:gemini-3.5-flash Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com> Tested-by: Waldemar Brodkorb <wbx@openadk.org> Signed-off-by: Thomas Bogendoerfer <tsbogend@alpha.franken.de>
2026-07-17usb: typec: tcpm: Add support for Battery Cap response messageAmit Sunil Dhamne
Add support for responding to Get_Battery_Cap (extended) request with a a Battery_Capabilities (extended) msg. The requester will request Battery Cap for a specific battery using an index in Get_Battery_Cap. In case of failure to identify battery, TCPM shall reply with an appropriate message indicating so. As the Battery Cap Data Block size is 9 Bytes (lesser than MaxExtendedMsgChunkLen of 26B), only a single chunk is required to complete the AMS. Support for Battery_Capabilities message is required for sinks that contain battery as specified in USB PD Rev3.1 v1.8 ("Applicability of Data Messages" section). Signed-off-by: Amit Sunil Dhamne <amitsd@google.com> Reviewed-by: Badhri Jagan Sridharan <badhri@google.com> Acked-by: Heikki Krogerus <heikki.krogerus@linux.intel.com> Link: https://patch.msgid.link/20260714-batt-caps-upstream-v1-1-c86f0a7fbbda@google.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-07-17usb: typec: tcpm: Add support for Battery Status response messageAmit Sunil Dhamne
Add support for responding to a Get_Battery_Status request with a Battery_Status message. The port partner shall request the status of a port's battery by providing an index in the Get_Battery_Status AMS. In case of failure to identify the battery, the port shall reply with an appropriate message indicating so. Support for Battery_Status message is required for sinks that contain battery as specified in USB PD Rev3.1 v1.8 ("Applicability of Data Messages" section). Signed-off-by: Amit Sunil Dhamne <amitsd@google.com> Reviewed-by: Badhri Jagan Sridharan <badhri@google.com> Acked-by: Heikki Krogerus <heikki.krogerus@linux.intel.com> Link: https://patch.msgid.link/20260714-batt-status-v5-2-9de4aa900b69@google.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-07-17power: supply: Add helpers to get and put arrays of power supply handlesAmit Sunil Dhamne
Add power_supply_get_system_batteries() to allow drivers to obtain a list of registered battery type power supply references in the system. Also add power_supply_put_system_batteries() to perform cleanup after the former function is called. Signed-off-by: Amit Sunil Dhamne <amitsd@google.com> Reviewed-by: Hans de Goede <johannes.goede@oss.qualcomm.com> Link: https://patch.msgid.link/20260714-batt-status-v5-1-9de4aa900b69@google.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-07-17netconsole: move skb_pool / refill_wq from struct netpoll to netconsole_targetBreno Leitao
These two fields back the fallback skb pool that find_skb() uses. Every helper that touches them lives in netconsole now (refill_skbs, refill_skbs_work_handler, netconsole_skb_pool_init, netconsole_skb_pool_flush, find_skb, netcons_skb_pop), so the data can move alongside its only consumer. Add skb_pool and refill_wq to struct netconsole_target, drop them from struct netpoll. This will save 48-bytes for every netpoll user instance (except netconsole that will have it in netconsole target struct). Signed-off-by: Breno Leitao <leitao@debian.org> Link: https://patch.msgid.link/20260710-netconsole_move_more-v3-7-6f63f76b28bc@debian.org Reviewed-by: Simon Horman <horms@kernel.org> Signed-off-by: Paolo Abeni <pabeni@redhat.com>
2026-07-17netconsole: move remote_mac from struct netpoll to netconsole_targetBreno Leitao
The destination ethernet address is netconsole configuration: no other netpoll user (bonding, team, vlan, bridge, macvlan, dsa) references np->remote_mac, only netconsole's ethernet framing and its configfs/cmdline interface do. Move it into struct netconsole_target and convert push_eth() to take the netconsole_target; netconsole_print_banner() and netconsole_parser_cmdline() already take it. The configfs show/store handlers and alloc_and_init() reach the field directly. No functional change; the remote_mac sysfs attribute is unchanged. Signed-off-by: Breno Leitao <leitao@debian.org> Link: https://patch.msgid.link/20260710-netconsole_move_more-v3-9-6f63f76b28bc@debian.org Reviewed-by: Simon Horman <horms@kernel.org> Signed-off-by: Paolo Abeni <pabeni@redhat.com>
2026-07-17netconsole: move skb_pool_flush() from netpollBreno Leitao
skb_pool_flush() has no callers left in net/core/netpoll.c after netconsole took over the pool lifecycle. Inline its body into netconsole_skb_pool_flush() (the only caller) and drop the function and its export from netpoll. The prototype goes from <linux/netpoll.h>. Pure code motion: cancel_work_sync() + skb_queue_purge_reason() semantics are unchanged. Signed-off-by: Breno Leitao <leitao@debian.org> Link: https://patch.msgid.link/20260710-netconsole_move_more-v3-6-6f63f76b28bc@debian.org Reviewed-by: Simon Horman <horms@kernel.org> Signed-off-by: Paolo Abeni <pabeni@redhat.com>
2026-07-17netconsole: move local_port / remote_port from struct netpoll to ↵Breno Leitao
netconsole_target The source and destination UDP ports live in struct netpoll but are netconsole configuration. No other netpoll user (bonding, team, vlan, bridge, macvlan, dsa) touches np->local_port or np->remote_port; they only use the netpoll TX/forwarding path. Only netconsole's UDP framing and its configfs/cmdline interface read these fields. Move both into struct netconsole_target and convert the three helpers that read them - push_udp(), netconsole_print_banner() and netconsole_parser_cmdline() - to take the netconsole_target. The configfs show/store handlers already have the target in hand. No functional change; the local_port / remote_port sysfs attributes are unchanged. Signed-off-by: Breno Leitao <leitao@debian.org> Link: https://patch.msgid.link/20260710-netconsole_move_more-v3-8-6f63f76b28bc@debian.org Reviewed-by: Simon Horman <horms@kernel.org> Signed-off-by: Paolo Abeni <pabeni@redhat.com>
2026-07-17netconsole: move refill_skbs() and skb-pool sizing macros from netpollBreno Leitao
refill_skbs() is now only called from netconsole (directly via netconsole_skb_pool_init() and indirectly via the just-moved refill_skbs_work_handler()), and the MAX_UDP_CHUNK / MAX_SKBS / MAX_SKB_SIZE macros are private to it. Move them all into drivers/net/netconsole.c. MAX_UDP_CHUNK and MAX_SKB_SIZE were promoted to <linux/netpoll.h> by commit 6c537b845c99 ("netconsole: do not dequeue pooled skbs that cannot satisfy len") so find_skb() could detect oversized requests against the same value refill_skbs() used. With both functions now local to netconsole, the shared definition no longer needs to live in the header. Pure code motion: bodies and pool sizing semantics are unchanged. Signed-off-by: Breno Leitao <leitao@debian.org> Link: https://patch.msgid.link/20260710-netconsole_move_more-v3-5-6f63f76b28bc@debian.org Reviewed-by: Simon Horman <horms@kernel.org> Signed-off-by: Paolo Abeni <pabeni@redhat.com>
2026-07-17netconsole: move refill_skbs_work_handler() from netpollBreno Leitao
The work handler is wired via INIT_WORK() in netconsole_skb_pool_init() and has no other callers since the previous patch took the skb pool lifecycle out of __netpoll_setup(). Move the function body into drivers/net/netconsole.c as a file-static helper, drop EXPORT_SYMBOL_GPL() and remove the prototype from <linux/netpoll.h>. Pure code motion: the body is unchanged and still calls the exported refill_skbs() in net/core/netpoll.c. Signed-off-by: Breno Leitao <leitao@debian.org> Link: https://patch.msgid.link/20260710-netconsole_move_more-v3-4-6f63f76b28bc@debian.org Reviewed-by: Simon Horman <horms@kernel.org> Signed-off-by: Paolo Abeni <pabeni@redhat.com>
2026-07-17netpoll: export refill_skbs(), refill_skbs_work_handler(), skb_pool_flush()Breno Leitao
These three helpers manage the per-netpoll fallback skb pool. They are file-static today because all of their callers live in net/core/netpoll.c. Subsequent patches relocate the pool's owner from struct netpoll to the only consumer that actually uses it (netconsole), and that work needs netconsole to drive the helpers directly while the function bodies still live here. Drop static, add prototypes in <linux/netpoll.h>, and EXPORT_SYMBOL_GPL() each. No behaviour change. The exports are transitional. Each helper is moved into drivers/net/netconsole.c later in this series, and at that point its EXPORT_SYMBOL_GPL() and prototype are dropped. By the end of the series no symbol introduced here remains exported. The goal of this patch is to make the subsequente patches easy to review. Signed-off-by: Breno Leitao <leitao@debian.org> Link: https://patch.msgid.link/20260710-netconsole_move_more-v3-2-6f63f76b28bc@debian.org Reviewed-by: Simon Horman <horms@kernel.org> Signed-off-by: Paolo Abeni <pabeni@redhat.com>
2026-07-17ACPI: processor: idle: Add switch for strict _LPI processingRafael J. Wysocki
Add a "strict" argument to acpi_processor_extract_lpi_info() that, when set, will cause it to ignore _LPI states without minimum residency or wake latency instead of assuming 10 us values for these parameters. No intentional functional impact. Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com> Reviewed-by: Sudeep Holla <sudeep.holla@kernel.org> Acked-by: Huisong Li <lihuisong@huawei.com> Link: https://patch.msgid.link/3896986.MHq7AAxBmi@rafael.j.wysocki
2026-07-17ACPI: processor: idle: Relocate acpi_processor_extract_lpi_info()Rafael J. Wysocki
In preparation for adding ACPI _LPI support to the intel_idle driver, move acpi_processor_extract_lpi_info() along with some static functions used by it to the acpi_processor.c file containing the non-modular part of the ACPI processor driver, so it can be called by external non-modular code like intel_idle. However, export it to modules in the ACPI_PROCESSOR_IDLE import namespace so that the modular part of the ACPI processor driver can still invoke it. No intentional functional impact. Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com> Reviewed-by: Sudeep Holla <sudeep.holla@kernel.org> Acked-by: Huisong Li <lihuisong@huawei.com> Link: https://patch.msgid.link/2277662.Mh6RI2rZIc@rafael.j.wysocki
2026-07-17clk: fixed-factor: Export __clk_hw_register_fixed_factor()Benoît Monin
Make the base registration function for fixed-factor clocks public and re-implement the various registration functions that are a direct call to __clk_hw_register_fixed_factor() as macros. This is similar to how the registration functions of divider, mux and other clocks are implemented. Add a new macro clk_hw_register_fixed_factor_pdata() to register a fixed-factor clock with its parent clock passed as a struct clk_parent_data. Reviewed-by: Brian Masney <bmasney@redhat.com> Signed-off-by: Benoît Monin <benoit.monin@bootlin.com>
2026-07-17dma/swiotlb: introduce Kconfig option for compile-time default pool sizeJagadeesh Pagadala
The SWIOTLB bounce buffer pool size is hardcoded at 64 MB via IO_TLB_DEFAULT_SIZE with no compile-time knob to adjust it. On memory-constrained embedded or mobile platforms equipped with a hardware IOMMU (e.g., ARM SMMU) covering most DMA-capable devices, reserving 64 MB at boot is unnecessarily wasteful — the SWIOTLB is only exercised for devices that bypass the IOMMU or have restricted DMA address ranges. Introduce CONFIG_SWIOTLB_DEFAULT_SIZE_MB, an integer Kconfig option (range 1–64 MB, default 64) that allows platforms to set a smaller compile-time default. IO_TLB_DEFAULT_SIZE is updated to derive from this value when CONFIG_SWIOTLB is enabled, preserving the existing 64 MB default when the option is not configured. The runtime "swiotlb=<nslabs>" kernel parameter override remains fully supported and takes precedence over the compile-time default. Signed-off-by: Jagadeesh Pagadala <jpagadal@qti.qualcomm.com> Signed-off-by: Bibek Kumar Patro <bibek.patro@oss.qualcomm.com> Reviewed-by: Michael Kelley <mhklinux@outlook.com> Link: https://lore.kernel.org/r/20260702-swiotlb-v2-1-9205f3ba5408@oss.qualcomm.com Signed-off-by: Marek Szyprowski <m.szyprowski@samsung.com>
2026-07-16scsi: zorro: Simplify storing pointers in device id structUwe Kleine-König (The Capable Hub)
Technically it is fine (on all current Linux architectures) to store a pointer in an unsigned long variable. However this needs explicit casting which is an easy source for type mismatches. By replacing the plain unsigned long .driver_data in struct zorro_device_id by an anonymous union, most of the casting can be dropped. There is still some implicit casting involved (between a void * and a driver specific pointer type), but that's better than the approach to store a pointer in an unsigned long variable as this doesn't lose the information that the data being pointed to is const. All users of struct zorro_device_id are initialized in a way that is compatible with the new definition, so no adaptions are needed there. Signed-off-by: Uwe Kleine-König (The Capable Hub) <u.kleine-koenig@baylibre.com> Reviewed-by: Geert Uytterhoeven <geert@linux-m68k.org> Acked-by: Geert Uytterhoeven <geert@linux-m68k.org> Reviewed-by: Max Staudt <max@enpas.org> Acked-by: Helge Deller <deller@gmx.de> Link: https://patch.msgid.link/49576a7501128c93ef318566ed7faefce163f1fd.1779803053.git.u.kleine-koenig@baylibre.com Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
2026-07-16bpf: Fix tracing of kfuncs with implicit argsIhor Solodrai
A kfunc marked with KF_IMPLICIT_ARGS flag takes implicit arguments (such as bpf_prog_aux) that the verifier injects at load time. resolve_btfids strips those from the kfunc's BTF-visible prototype and keeps the real kernel ABI in a counterpart _impl prototype [1]. fentry/fexit/fmod_ret/fsession programs may attach to the BPF kernel functions, including those with implicit args. However bpf_check_attach_target() and bpf_check_attach_btf_id_multi() extract the struct btf_func_model from the wrong BTF prototype of the kfunc. The btf_func_model is later read to construct the trampoline, which then causes the injected implicit argument to be clobbered and the kfunc dereferencing garbage. Add btf_attach_func_proto() to resolve the real ABI prototype of the kfunc the way the call site does: by looking up the _impl prototype for a KF_IMPLICIT_ARGS kfunc. Use it at both attach-target model construction sites. To enable this, make two supporting changes: * pass bpf_verifier_log instead of bpf_verifier_env to find_kfunc_impl_proto(), so it can be reused from the attach path * add btf_kfunc_check_flag() to test a flag across all of a kfunc's hook sets, because a program attaching to a kfunc is not in the kfunc's call-set KF_IMPLICIT_ARGS must be consistent across the sets, so btf_kfunc_check_flag() returns -EINVAL on inconsistency. btf_kfunc_check_flag() reads the kfunc's flags from the target's kfunc_set_tab. For a module BTF that table is stable only after the module is live, so take a module reference around the read, mirroring how the kfunc call path gates the same lookup with btf_try_get_module(). The remaining call sites of btf_distill_func_proto() are safe as is. The BPF_TRACE_ITER case distills a registered iterator's prototype, and bpf_struct_ops_desc_init() distills the function-pointer members of a struct_ops type. Neither is a kfunc, and so can't have implicit arguments. [1] https://lore.kernel.org/all/20260120222638.3976562-1-ihor.solodrai@linux.dev/ Fixes: 64e1360524b9 ("bpf: Verifier support for KF_IMPLICIT_ARGS") Reported-by: Tejun Heo <tj@kernel.org> Signed-off-by: Ihor Solodrai <ihor.solodrai@linux.dev> Link: https://github.com/sched-ext/scx/issues/3687#issuecomment-4906694106 Link: https://patch.msgid.link/20260713235223.1639022-2-ihor.solodrai@linux.dev Signed-off-by: Eduard Zingerman <eddyz87@gmail.com>