summaryrefslogtreecommitdiff
AgeCommit message (Collapse)Author
2026-01-16KVM: selftests: Test READ=>WRITE dirty logging behavior for shadow MMUSean Christopherson
Update the nested dirty log test to validate KVM's handling of READ faults when dirty logging is enabled. Specifically, set the Dirty bit in the guest PTEs used to map L2 GPAs, so that KVM will create writable SPTEs when handling L2 read faults. When handling read faults in the shadow MMU, KVM opportunistically creates a writable SPTE if the mapping can be writable *and* the gPTE is dirty (or doesn't support the Dirty bit), i.e. if KVM doesn't need to intercept writes in order to emulate Dirty-bit updates. To actually test the L2 READ=>WRITE sequence, e.g. without masking a false pass by other test activity, route the READ=>WRITE and WRITE=>WRITE sequences to separate L1 pages, and differentiate between "marked dirty due to a WRITE access/fault" and "marked dirty due to creating a writable SPTE for a READ access/fault". The updated sequence exposes the bug fixed by KVM commit 1f4e5fc83a42 ("KVM: x86: fix nested guest live migration with PML") when the guest performs a READ=>WRITE sequence with dirty guest PTEs. Opportunistically tweak and rename the address macros, and add comments, to make it more obvious what the test is doing. E.g. NESTED_TEST_MEM1 vs. GUEST_TEST_MEM doesn't make it all that obvious that the test is creating aliases in both the L2 GPA and GVA address spaces, but only when L1 is using TDP to run L2. Cc: Yosry Ahmed <yosry.ahmed@linux.dev> Reviewed-by: Yosry Ahmed <yosry.ahmed@linux.dev> Link: https://patch.msgid.link/20260115172154.709024-1-seanjc@google.com Signed-off-by: Sean Christopherson <seanjc@google.com>
2026-01-16KVM: VMX: Add a wrapper around ROL16() to get a vmcs12 from a field encodingSean Christopherson
Add a wrapper macro, ENC_TO_VMCS12_IDX(), to get a vmcs12 index given a field encoding in anticipation of adding a macro to get from a vmcs12 index back to the field encoding. And because open coding ROL16(n, 6) everywhere is gross. No functional change intended. Suggested-by: Xiaoyao Li <xiaoyao.li@intel.com> Reviewed-by: Xiaoyao Li <xiaoyao.li@intel.com> Link: https://patch.msgid.link/20260115173427.716021-3-seanjc@google.com Signed-off-by: Sean Christopherson <seanjc@google.com>
2026-01-16KVM: nVMX: Setup VMX MSRs on loading CPU during nested_vmx_hardware_setup()Sean Christopherson
Move the call to nested_vmx_setup_ctls_msrs() from vmx_hardware_setup() to nested_vmx_hardware_setup() so that the nested code can deal with ordering dependencies without having to straddle vmx_hardware_setup() and nested_vmx_hardware_setup(). Specifically, an upcoming change will sanitize the vmcs12 fields based on hardware support, and that code needs to run _before_ the MSRs are configured, because the lovely vmcs_enum MSR depends on the max support vmcs12 field. No functional change intended. Reviewed-by: Xiaoyao Li <xiaoyao.li@intel.com> Link: https://patch.msgid.link/20260115173427.716021-2-seanjc@google.com Signed-off-by: Sean Christopherson <seanjc@google.com>
2026-01-16driver core: attribute_container: change return type to voidDaniel Gomez
attribute_container_register() has always returned 0 since its introduction in commit 06ff5a987e ("Add attribute container to generic device model") in the historical Linux tree [1]. Convert the return type to void and update all callers. This removes dead code where callers checked for errors that could never occur. Link: https://git.kernel.org/pub/scm/linux/kernel/git/tglx/history.git [1] Signed-off-by: Daniel Gomez <da.gomez@samsung.com> Link: https://patch.msgid.link/20251220-dev-attribute-container-linux-scsi-v1-1-d58fcd03bf21@samsung.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-01-16devtmpfs: Replace simple_strtoul with kstrtoint in mount_paramThorsten Blum
Replace simple_strtoul() with the recommended kstrtoint() for parsing the 'devtmpfs.mount=' boot parameter. Unlike simple_strtoul(), which returns an unsigned long, kstrtoint() converts the string directly to int and avoids implicit casting. Check the return value of kstrtoint() and reject invalid values. This adds error handling while preserving behavior for existing values, and removes use of the deprecated simple_strtoul() helper. The current code silently sets 'mount_dev = 0' if parsing fails, instead of leaving the default value (IS_ENABLED(CONFIG_DEVTMPFS_MOUNT)) unchanged. Signed-off-by: Thorsten Blum <thorsten.blum@linux.dev> Link: https://patch.msgid.link/20251220125930.76836-2-thorsten.blum@linux.dev Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-01-16devtmpfs: make 'devtmpfs_context_ops' staticBen Dooks
The 'devtmpfs_context_ops' object is not exported outside the devtmpfs.c file nor defined anywhere for use outside. Make this static to remove the following sparse warning: drivers/base/devtmpfs.c:88:30: warning: symbol 'devtmpfs_context_ops' was not declared. Should it be static? Signed-off-by: Ben Dooks <ben.dooks@codethink.co.uk> Link: https://patch.msgid.link/20260116150745.1330145-1-ben.dooks@codethink.co.uk Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-01-16comedi: dmm32at: serialize use of paged registersIan Abbott
Some of the hardware registers of the DMM-32-AT board are multiplexed, using the least significant two bits of the Miscellaneous Control register to select the function of registers at offsets 12 to 15: 00 => 8254 timer/counter registers are accessible 01 => 8255 digital I/O registers are accessible 10 => Reserved 11 => Calibration registers are accessible The interrupt service routine (`dmm32at_isr()`) clobbers the bottom two bits of the register with value 00, which would interfere with access to the 8255 registers by the `dm32at_8255_io()` function (used for Comedi instruction handling on the digital I/O subdevice). Make use of the generic Comedi device spin-lock `dev->spinlock` (which is otherwise unused by this driver) to serialize access to the miscellaneous control register and paged registers. Fixes: 3c501880ac44 ("Staging: comedi: add dmm32at driver") Cc: stable@vger.kernel.org Signed-off-by: Ian Abbott <abbotti@mev.co.uk> Link: https://patch.msgid.link/20260112162835.91688-1-abbotti@mev.co.uk Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-01-16mei: trace: treat reg parameter as stringAlexander Usyskin
The commit afd2627f727b ("tracing: Check "%s" dereference via the field and not the TP_printk format") forbids to emit event with a plain char* without a wrapper. The reg parameter always passed as static string and wrapper is not strictly required, contrary to dev parameter. Use the string wrapper anyway to check sanity of the reg parameters, store it value independently and prevent internal kernel data leaks. Since some code refactoring has taken place, explicit backporting may be needed for kernels older than 6.10. Cc: stable@vger.kernel.org # v6.11+ Fixes: a0a927d06d79 ("mei: me: add io register tracing") Signed-off-by: Alexander Usyskin <alexander.usyskin@intel.com> Link: https://patch.msgid.link/20260111145125.1754912-1-alexander.usyskin@intel.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-01-16uio: pci_sva: correct '-ENODEV' check logicHaiyue Wang
The current '-ENODEV' check uses '&&', which can lead to a NULL pointer dereference when udev is NULL. Fix the condition to return -ENODEV if either udev or its pdev is NULL. Fixes: 3397c3cd859a ("uio: Add SVA support for PCI devices via uio_pci_generic_sva.c") Signed-off-by: Haiyue Wang <haiyuewa@163.com> Link: https://patch.msgid.link/20260109175448.34309-1-haiyuewa@163.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-01-16uacce: ensure safe queue release with state managementChenghai Huang
Directly calling `put_queue` carries risks since it cannot guarantee that resources of `uacce_queue` have been fully released beforehand. So adding a `stop_queue` operation for the UACCE_CMD_PUT_Q command and leaving the `put_queue` operation to the final resource release ensures safety. Queue states are defined as follows: - UACCE_Q_ZOMBIE: Initial state - UACCE_Q_INIT: After opening `uacce` - UACCE_Q_STARTED: After `start` is issued via `ioctl` When executing `poweroff -f` in virt while accelerator are still working, `uacce_fops_release` and `uacce_remove` may execute concurrently. This can cause `uacce_put_queue` within `uacce_fops_release` to access a NULL `ops` pointer. Therefore, add state checks to prevent accessing freed pointers. Fixes: 015d239ac014 ("uacce: add uacce driver") Cc: stable@vger.kernel.org Signed-off-by: Chenghai Huang <huangchenghai2@huawei.com> Signed-off-by: Yang Shen <shenyang39@huawei.com> Acked-by: Zhangfei Gao <zhangfei.gao@linaro.org> Link: https://patch.msgid.link/20251202061256.4158641-5-huangchenghai2@huawei.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-01-16uacce: implement mremap in uacce_vm_ops to return -EPERMYang Shen
The current uacce_vm_ops does not support the mremap operation of vm_operations_struct. Implement .mremap to return -EPERM to remind users. The reason we need to explicitly disable mremap is that when the driver does not implement .mremap, it uses the default mremap method. This could lead to a risk scenario: An application might first mmap address p1, then mremap to p2, followed by munmap(p1), and finally munmap(p2). Since the default mremap copies the original vma's vm_private_data (i.e., q) to the new vma, both munmap operations would trigger vma_close, causing q->qfr to be freed twice(qfr will be set to null here, so repeated release is ok). Fixes: 015d239ac014 ("uacce: add uacce driver") Cc: stable@vger.kernel.org Signed-off-by: Yang Shen <shenyang39@huawei.com> Signed-off-by: Chenghai Huang <huangchenghai2@huawei.com> Acked-by: Zhangfei Gao <zhangfei.gao@linaro.org> Link: https://patch.msgid.link/20251202061256.4158641-4-huangchenghai2@huawei.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-01-16uacce: fix isolate sysfs check conditionChenghai Huang
uacce supports the device isolation feature. If the driver implements the isolate_err_threshold_read and isolate_err_threshold_write callback functions, uacce will create sysfs files now. Users can read and configure the isolation policy through sysfs. Currently, sysfs files are created as long as either isolate_err_threshold_read or isolate_err_threshold_write callback functions are present. However, accessing a non-existent callback function may cause the system to crash. Therefore, intercept the creation of sysfs if neither read nor write exists; create sysfs if either is supported, but intercept unsupported operations at the call site. Fixes: e3e289fbc0b5 ("uacce: supports device isolation feature") Cc: stable@vger.kernel.org Signed-off-by: Chenghai Huang <huangchenghai2@huawei.com> Acked-by: Zhangfei Gao <zhangfei.gao@linaro.org> Link: https://patch.msgid.link/20251202061256.4158641-3-huangchenghai2@huawei.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-01-16uacce: fix cdev handling in the cleanup pathWenkai Lin
When cdev_device_add fails, it internally releases the cdev memory, and if cdev_device_del is then executed, it will cause a hang error. To fix it, we check the return value of cdev_device_add() and clear uacce->cdev to avoid calling cdev_device_del in the uacce_remove. Fixes: 015d239ac014 ("uacce: add uacce driver") Cc: stable@vger.kernel.org Signed-off-by: Wenkai Lin <linwenkai6@hisilicon.com> Signed-off-by: Chenghai Huang <huangchenghai2@huawei.com> Acked-by: Zhangfei Gao <zhangfei.gao@linaro.org> Link: https://patch.msgid.link/20251202061256.4158641-2-huangchenghai2@huawei.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-01-16slimbus: core: clean up of_slim_get_device()Johan Hovold
Clean up of_find_slim_device() by folding in the of_find_slim_device() helper. Signed-off-by: Johan Hovold <johan@kernel.org> Link: https://patch.msgid.link/20251126145329.5022-7-johan@kernel.org Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-01-16slimbus: core: fix of_slim_get_device() kernel docJohan Hovold
Unlike slim_get_device() the of_slim_get_device() helper does not allocate and register any slimbus devices in case lookup fails. Update the of_slim_get_device() kernel doc to reflect this and add a comment about the helper taking a reference to the returned device. Fixes: e0772de8a48b ("slimbus: core: add of_slim_device_get() helper") Signed-off-by: Johan Hovold <johan@kernel.org> Link: https://patch.msgid.link/20251126145329.5022-6-johan@kernel.org Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-01-16slimbus: core: amend slim_get_device() kernel docJohan Hovold
Add a comment to clarify that slim_get_device() takes a reference to the embedded struct device of the returned slimbus device. Signed-off-by: Johan Hovold <johan@kernel.org> Link: https://patch.msgid.link/20251126145329.5022-5-johan@kernel.org Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-01-16slimbus: core: fix device reference leak on report presentJohan Hovold
Slimbus devices can be allocated dynamically upon reception of report-present messages. Make sure to drop the reference taken when looking up already registered devices. Note that this requires taking an extra reference in case the device has not yet been registered and has to be allocated. Fixes: 46a2bb5a7f7e ("slimbus: core: Add slim controllers support") Cc: stable@vger.kernel.org # 4.16 Signed-off-by: Johan Hovold <johan@kernel.org> Link: https://patch.msgid.link/20251126145329.5022-4-johan@kernel.org Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-01-16slimbus: core: fix runtime PM imbalance on report presentJohan Hovold
Make sure to balance the runtime PM usage count in case slimbus device or address allocation fails on report present, which would otherwise prevent the controller from suspending. Fixes: 4b14e62ad3c9 ("slimbus: Add support for 'clock-pause' feature") Cc: stable@vger.kernel.org # 4.16 Signed-off-by: Johan Hovold <johan@kernel.org> Link: https://patch.msgid.link/20251126145329.5022-3-johan@kernel.org Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-01-16slimbus: core: fix OF node leak on registration failureJohan Hovold
Make sure to drop the OF node reference taken when initialising and registering the slimbus device also on registration failure by releasing it in the destructor as expected. Fixes: 7588a511bdb4 ("slimbus: core: add support to device tree helper") Fixes: 01360857486c ("slimbus: core: Fix mismatch in of_node_get/put") Cc: Saravana Kannan <saravanak@google.com> Signed-off-by: Johan Hovold <johan@kernel.org> Link: https://patch.msgid.link/20251126145329.5022-2-johan@kernel.org Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-01-16intel_th: rename error labelJohan Hovold
Use a more a descriptive name for the error label that is used to put the reference to dev. Signed-off-by: Johan Hovold <johan@kernel.org> Link: https://patch.msgid.link/20251208153524.68637-3-johan@kernel.org Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-01-16intel_th: fix device leak on output open()Johan Hovold
Make sure to drop the reference taken when looking up the th device during output device open() on errors and on close(). Note that a recent commit fixed the leak in a couple of open() error paths but not all of them, and the reference is still leaking on successful open(). Fixes: 39f4034693b7 ("intel_th: Add driver infrastructure for Intel(R) Trace Hub devices") Fixes: 6d5925b667e4 ("intel_th: Fix error handling in intel_th_output_open") Cc: stable@vger.kernel.org # 4.4: 6d5925b667e4 Cc: Alexander Shishkin <alexander.shishkin@linux.intel.com> Cc: Ma Ke <make24@iscas.ac.cn> Signed-off-by: Johan Hovold <johan@kernel.org> Link: https://patch.msgid.link/20251208153524.68637-2-johan@kernel.org Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-01-16comedi: Fix getting range information for subdevices 16 to 255Ian Abbott
The `COMEDI_RANGEINFO` ioctl does not work properly for subdevice indices above 15. Currently, the only in-tree COMEDI drivers that support more than 16 subdevices are the "8255" driver and the "comedi_bond" driver. Making the ioctl work for subdevice indices up to 255 is achievable. It needs minor changes to the handling of the `COMEDI_RANGEINFO` and `COMEDI_CHANINFO` ioctls that should be mostly harmless to user-space, apart from making them less broken. Details follow... The `COMEDI_RANGEINFO` ioctl command gets the list of supported ranges (usually with units of volts or milliamps) for a COMEDI subdevice or channel. (Only some subdevices have per-channel range tables, indicated by the `SDF_RANGETYPE` flag in the subdevice information.) It uses a `range_type` value and a user-space pointer, both supplied by user-space, but the `range_type` value should match what was obtained using the `COMEDI_CHANINFO` ioctl (if the subdevice has per-channel range tables) or `COMEDI_SUBDINFO` ioctl (if the subdevice uses a single range table for all channels). Bits 15 to 0 of the `range_type` value contain the length of the range table, which is the only part that user-space should care about (so it can use a suitably sized buffer to fetch the range table). Bits 23 to 16 store the channel index, which is assumed to be no more than 255 if the subdevice has per-channel range tables, and is set to 0 if the subdevice has a single range table. For `range_type` values produced by the `COMEDI_SUBDINFO` ioctl, bits 31 to 24 contain the subdevice index, which is assumed to be no more than 255. But for `range_type` values produced by the `COMEDI_CHANINFO` ioctl, bits 27 to 24 contain the subdevice index, which is assumed to be no more than 15, and bits 31 to 28 contain the COMEDI device's minor device number for some unknown reason lost in the mists of time. The `COMEDI_RANGEINFO` ioctl extract the length from bits 15 to 0 of the user-supplied `range_type` value, extracts the channel index from bits 23 to 16 (only used if the subdevice has per-channel range tables), extracts the subdevice index from bits 27 to 24, and ignores bits 31 to 28. So for subdevice indices 16 to 255, the `COMEDI_SUBDINFO` or `COMEDI_CHANINFO` ioctl will report a `range_type` value that doesn't work with the `COMEDI_RANGEINFO` ioctl. It will either get the range table for the subdevice index modulo 16, or will fail with `-EINVAL`. To fix this, always use bits 31 to 24 of the `range_type` value to hold the subdevice index (assumed to be no more than 255). This affects the `COMEDI_CHANINFO` and `COMEDI_RANGEINFO` ioctls. There should not be anything in user-space that depends on the old, broken usage, although it may now see different values in bits 31 to 28 of the `range_type` values reported by the `COMEDI_CHANINFO` ioctl for subdevices that have per-channel subdevices. User-space should not be trying to decode bits 31 to 16 of the `range_type` values anyway. Fixes: ed9eccbe8970 ("Staging: add comedi core") Cc: stable@vger.kernel.org #5.17+ Signed-off-by: Ian Abbott <abbotti@mev.co.uk> Link: https://patch.msgid.link/20251203162438.176841-1-abbotti@mev.co.uk Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-01-16mux: mmio: Fix IS_ERR() vs NULL check in probe()Dan Carpenter
The devm_kmalloc() function never returns error pointers, it returns NULL on error. Fix the error checking. Fixes: 4863cb2b0f50 ("mux: mmio: Add suspend and resume support") Signed-off-by: Dan Carpenter <dan.carpenter@linaro.org> Reviewed-by: Krzysztof Kozlowski <krzysztof.kozlowski@oss.qualcomm.com> Link: https://patch.msgid.link/aSsIP7oKrhKfCUv3@stanley.mountain Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-01-16mmc: rtsx_pci_sdmmc: increase power-on settling delay to 5msMatthew Schwartz
The existing 1ms delay in sd_power_on is insufficient and causes resume errors around 4% of the time. Increasing the delay to 5ms resolves this issue after testing 300 s2idle cycles. Fixes: 1f311c94aabd ("mmc: rtsx: add 74 Clocks in power on flow") Signed-off-by: Matthew Schwartz <matthew.schwartz@linux.dev> Link: https://patch.msgid.link/20260105060236.400366-3-matthew.schwartz@linux.dev Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-01-16mmc: rtsx: reset power state on suspendMatthew Schwartz
When rtsx_pci suspends, the card reader hardware powers off but the sdmmc driver's prev_power_state remains as MMC_POWER_ON. This causes sd_power_on to skip reinitialization on the next I/O request, leading to DMA transfer timeouts and errors on resume 20% of the time. Add a power_off slot callback so the PCR can notify the sdmmc driver during suspend. The sdmmc driver resets prev_power_state, and sd_request checks this to reinitialize the card before the next I/O. Signed-off-by: Matthew Schwartz <matthew.schwartz@linux.dev> Link: https://patch.msgid.link/20260105060236.400366-2-matthew.schwartz@linux.dev Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-01-16mmc: rtsx_pci: add quirk to disable MMC_CAP_AGGRESSIVE_PM for RTS525AMatthew Schwartz
Using MMC_CAP_AGGRESSIVE_PM on RTS525A card readers causes game performance issues when the card reader comes back from idle into active use. This can be observed in Hades II when loading new sections of the game or menu after the card reader puts itself into idle, and presents as a 1-2 second hang. Add EXTRA_CAPS_NO_AGGRESSIVE_PM quirk to allow cardreader drivers to opt-out of aggressive PM, and set it for RTS525A. Closes: https://lore.kernel.org/linux-mmc/ff9a7c20-f465-4afa-bf29-708d4a52974a@linux.dev/ Signed-off-by: Matthew Schwartz <matthew.schwartz@linux.dev> Link: https://patch.msgid.link/20260103204226.71752-1-matthew.schwartz@linux.dev Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-01-16stm class: Kconfig: correct symbol nameRandy Dunlap
Drop the leading "CONFIG_" when referring to Kconfig symbols-- it is supplied by the kconfig software. This make the default values work as (apparently) expected. Fixes: a02509f301c6 ("stm class: Factor out default framing protocol") Fixes: d69d5e83110f ("stm class: Add MIPI SyS-T protocol support") Signed-off-by: Randy Dunlap <rdunlap@infradead.org> Link: https://patch.msgid.link/20251228190502.2480758-1-rdunlap@infradead.org Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-01-16kunit: fix up const mis-match in many assert functionsGreg Kroah-Hartman
In many kunit assert functions a const pointer is passed to container_of() and out pops a non-const pointer, which really isn't the correct thing to do at all. Fix this up by correctly marking the casted-to pointer as const to preserve the marking. Cc: Brendan Higgins <brendan.higgins@linux.dev> Cc: David Gow <davidgow@google.com> Cc: Rae Moar <raemoar63@gmail.com> Cc: linux-kselftest@vger.kernel.org Cc: kunit-dev@googlegroups.com Reviewed-by: David Gow <davidgow@google.com> Link: https://patch.msgid.link/2025121746-result-staleness-5a68@gregkh Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-01-16test_list_sort: fix up const mismatchGreg Kroah-Hartman
In the internal cmp function, a const pointer is cast out to a non-const pointer by using container_of(). This is probably not what is intended at all, so fix up the const marking to properly preserve what is really happening (i.e. the const should flow through the container_of() call) Cc: Jakub Kicinski <kuba@kernel.org> Cc: David Gow <davidgow@google.com> Cc: Masami Hiramatsu (Google) <mhiramat@kernel.org> Cc: Vlastimil Babka <vbabka@suse.cz> Cc: Kees Cook <kees@kernel.org> Cc: linux-kernel@vger.kernel.org Reviewed-by: David Gow <davidgow@google.com> Link: https://patch.msgid.link/2025121751-backtrack-manifesto-7c57@gregkh Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-01-16xilinx_hwicap: fifo_icap.c: fix all kernel-doc warningsRandy Dunlap
Modify comments in fifo_icap.c to prevent all kernel-doc warnings: Warning: fifo_icap.c:51 This comment starts with '/**', but isn't a kernel-doc comment. * HwIcap Device Interrupt Status/Enable Registers Warning: fifo_icap.c:106 No description found for return value of 'fifo_icap_fifo_read' Warning: fifo_icap.c:160 No description found for return value of 'fifo_icap_get_status' Warning: fifo_icap.c:171 No description found for return value of 'fifo_icap_busy' Warning: fifo_icap.c:184 No description found for return value of 'fifo_icap_write_fifo_vacancy' Warning: fifo_icap.c:196 No description found for return value of 'fifo_icap_read_fifo_occupancy' Warning: fifo_icap.c:207 bad line: Warning: fifo_icap.c:214 No description found for return value of 'fifo_icap_set_configuration' Warning: fifo_icap.c:290 function parameter 'frame_buffer' not described in 'fifo_icap_get_configuration' Warning: fifo_icap.c:290 function parameter 'num_words' not described in 'fifo_icap_get_configuration' Warning: fifo_icap.c:290 No description found for return value of 'fifo_icap_get_configuration' Warning: fifo_icap.c:357 expecting prototype for buffer_icap_reset(). Prototype was for fifo_icap_reset() instead Signed-off-by: Randy Dunlap <rdunlap@infradead.org> Reviewed-by: Michal Simek <michal.simek@amd.com> Link: https://patch.msgid.link/20251214191750.2173225-1-rdunlap@infradead.org Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-01-16eeprom_93cx6: fix struct member kernel-docRandy Dunlap
Remove the function parameter parts of the struct member descriptions to prevent kernel-doc warnings: Warning: include/linux/eeprom_93cx6.h:64 struct member 'register_read' not described in 'eeprom_93cx6' Warning: ../include/linux/eeprom_93cx6.h:64 struct member 'register_write' not described in 'eeprom_93cx6' Signed-off-by: Randy Dunlap <rdunlap@infradead.org> Link: https://patch.msgid.link/20251214202739.2216904-1-rdunlap@infradead.org Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-01-16kgdbts: mark kgdbts_option_setup() with __init to free init memoryCan Peng
The kgdbts_option_setup() function is invoked only once early in boot via the __setup("kgdbts=", ...) mechanism to parse the kernel command-line option.After init is complete, it is never called again. Annotating it with __init places the function in the .init.text section, enabling the kernel to free its code memory during the init memory cleanup phase (free_initmem()). This reduces the kernel’s runtime memory footprint with no functional side effects. Signed-off-by: Can Peng <pengcan@kylinos.cn> Link: https://patch.msgid.link/20251208130525.2775885-1-pengcan@kylinos.cn Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-01-16comedi: comedi_8254: correct kernel-doc warningsRandy Dunlap
Correct typos in 3 struct member descriptions to eliminate all kernel-doc warnings in comedi_8254.h: Warning: include/linux/comedi/comedi_8254.h:112 struct member 'next_div' not described in 'comedi_8254' Warning: include/linux/comedi/comedi_8254.h:112 struct member 'clock_src' not described in 'comedi_8254' Warning: include/linux/comedi/comedi_8254.h:112 struct member 'gate_src' not described in 'comedi_8254' Signed-off-by: Randy Dunlap <rdunlap@infradead.org> Reviewed-by: Ian Abbott <abbotti@mev.co.uk> Link: https://patch.msgid.link/20251214202727.2215461-1-rdunlap@infradead.org Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-01-16comedi: comedi_test: add a DIO subdeviceIan Abbott
The fake "comedi_test" device currently has two subdevices: an analog input subdevice, and an analog output subdevice. To make it a bit more useful for testing, add a third subdevice for digital I/O. The new DIO subdevice has 32 channels with each channel individually programmable as an input or an output. To add a bit of interaction, channels 0 to 15 are wired to channels 16 to 31 (0 to 16, 1 to 17, etc.), and the state of each wire can be read back on both of the channels connected to it. The outputs are modelled as NPN open collector outputs with a pull-up resistor on the wire, so the state of each wire (and the value read back from each channel connected to it) will be logic level 1 unless either channel is configured as an output at logic level 0. Signed-off-by: Ian Abbott <abbotti@mev.co.uk> Link: https://patch.msgid.link/20251210124455.69131-1-abbotti@mev.co.uk Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-01-16comedi: don't use mutex for COMEDI_BUFINFO ioctlIan Abbott
The main mutex in a comedi device can get held for quite a while when processing comedi instructions, so for performance reasons, the "read", "write", and "poll" file operations do not use it; they use the `attach_lock` rwsemaphore to protect against the comedi device becoming detached at an inopportune moment. As an alternative to using the "read" and "write" operations, user-space can mmap the data buffer and use the `COMEDI_BUFINFO` ioctl to manage data transfer through the buffer. However, the "ioctl" file handler currently locks the main mutex for all ioctl commands. Make the handling of the `COMEDI_BUFINFO` an exception, using the `attach_lock` rwsemaphore during normal operation. However, before it calls `do_become_nonbusy()` at the end of acquisition, it does need to lock the main mutex, but it needs to unlock the `attach_lock` rwsemaphore first to avoid deadlock. After locking the main mutex, it needs to check that it is still in a suitable state to become non-busy, because things may have changed while unlocked. Signed-off-by: Ian Abbott <abbotti@mev.co.uk> Link: https://patch.msgid.link/20251205131332.16672-1-abbotti@mev.co.uk Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-01-16bus: fsl-mc: declare fsl_mc_bus_dpdbg_type staticChristophe Leroy (CS GROUP)
Fix following sparse warning: CHECK drivers/bus/fsl-mc/fsl-mc-bus.c drivers/bus/fsl-mc/fsl-mc-bus.c:435:26: warning: symbol 'fsl_mc_bus_dpdbg_type' was not declared. Should it be static? fsl_mc_bus_dpdbg_type is not used outside of fsl-mc-bus.c Remove the EXPORT_SYMBOL and declare it static. Signed-off-by: Christophe Leroy (CS GROUP) <chleroy@kernel.org> Link: https://patch.msgid.link/628c49881b3a1df76cfd2f8fd2aad976692a465a.1768566053.git.chleroy@kernel.org Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-01-16greybus: Use bus methods for .probe() and .remove()Uwe Kleine-König
These are nearly identical to the respective driver callbacks. The only difference is that .remove() returns void instead of int. The objective is to get rid of users of struct device_driver callbacks .probe() and .remove() to eventually remove these. Acked-by: Johan Hovold <johan@kernel.org> Signed-off-by: Uwe Kleine-König <u.kleine-koenig@baylibre.com> Link: https://patch.msgid.link/20260113145012.2379944-2-u.kleine-koenig@baylibre.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-01-16gpib: Fix memory leak in ni_usb_init()Zilin Guan
In ni_usb_init(), if ni_usb_setup_init() fails, the function returns -EFAULT without freeing the allocated writes buffer, leading to a memory leak. Additionally, ni_usb_setup_init() returns 0 on failure, which causes ni_usb_init() to return -EFAULT, an inappropriate error code for this situation. Fix the leak by freeing writes in the error path. Modify ni_usb_setup_init() to return -EINVAL on failure and propagate this error code in ni_usb_init(). Fixes: 4e127de14fa7 ("staging: gpib: Add National Instruments USB GPIB driver") Suggested-by: Greg KH <gregkh@linuxfoundation.org> Suggested-by: Dave Penkler <dpenkler@gmail.com> Co-developed-by: Jianhao Xu <jianhao.xu@seu.edu.cn> Signed-off-by: Jianhao Xu <jianhao.xu@seu.edu.cn> Signed-off-by: Zilin Guan <zilin@seu.edu.cn> Link: https://patch.msgid.link/20251230034546.929452-1-zilin@seu.edu.cn Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-01-16gpib: Fix error code in ni_usb_write_registers()Dan Carpenter
If ni_usb_receive_bulk_msg() succeeds but without reading 16 bytes, then the error code needs to be set. The current code returns success. Fixes: 4e127de14fa7 ("staging: gpib: Add National Instruments USB GPIB driver") Signed-off-by: Dan Carpenter <dan.carpenter@linaro.org> Link: https://patch.msgid.link/aSlMpbE4IrQuBGFS@stanley.mountain Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-01-16gpib: Fix error code in ibonline()Dan Carpenter
This accidentally returns 1 on error, but it should return negative error codes. Fixes: 9dde4559e939 ("staging: gpib: Add GPIB common core driver") Signed-off-by: Dan Carpenter <dan.carpenter@linaro.org> Link: https://patch.msgid.link/aSlMnaT1M104NJb2@stanley.mountain Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-01-16misc/mei: gsc_proxy: add dependency on Xe driverSimon Richter
This driver is useful if at least one DRM driver registers an auxiliary device for the ME interface. With the addition of Xe, this is no longer just i915. Cc: Usyskin, Alexander <alexander.usyskin@intel.com> Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org> Signed-off-by: Simon Richter <Simon.Richter@hogyros.de> Link: https://patch.msgid.link/20260107182615.488194-5-Simon.Richter@hogyros.de Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-01-16misc/mei: Allow building standalone for compile testingSimon Richter
While this is not a particularly useful configuration, the MEI code should compile even when no drivers for a GPU containing a management engine are built. Cc: Usyskin, Alexander <alexander.usyskin@intel.com> Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org> Signed-off-by: Simon Richter <Simon.Richter@hogyros.de> Link: https://patch.msgid.link/20260107182615.488194-4-Simon.Richter@hogyros.de Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-01-16misc/mei: Decouple ME interfaces from GPU driversSimon Richter
These are enumerated via an auxiliary bus, so there is no functional dependency between these drivers, therefore allow compiling MEI as builtin even when i915/xe are built as modules. Cc: Usyskin, Alexander <alexander.usyskin@intel.com> Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org> Signed-off-by: Simon Richter <Simon.Richter@hogyros.de> Link: https://patch.msgid.link/20260107182615.488194-3-Simon.Richter@hogyros.de Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-01-16misc/mei: Allow building Intel ME interface on non-x86Simon Richter
The xe driver supports dGPUs which can be plugged into non-x86 machines, and exposes a MEI GSC interface, so this driver is no longer x86 only. Cc: Usyskin, Alexander <alexander.usyskin@intel.com> Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org> Signed-off-by: Simon Richter <Simon.Richter@hogyros.de> Link: https://patch.msgid.link/20260107182615.488194-2-Simon.Richter@hogyros.de Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-01-16x86/uprobes: Fix XOL allocation failure for 32-bit tasksOleg Nesterov
This script #!/usr/bin/bash echo 0 > /proc/sys/kernel/randomize_va_space echo 'void main(void) {}' > TEST.c # -fcf-protection to ensure that the 1st endbr32 insn can't be emulated gcc -m32 -fcf-protection=branch TEST.c -o test bpftrace -e 'uprobe:./test:main {}' -c ./test "hangs", the probed ./test task enters an endless loop. The problem is that with randomize_va_space == 0 get_unmapped_area(TASK_SIZE - PAGE_SIZE) called by xol_add_vma() can not just return the "addr == TASK_SIZE - PAGE_SIZE" hint, this addr is used by the stack vma. arch_get_unmapped_area_topdown() doesn't take TIF_ADDR32 into account and in_32bit_syscall() is false, this leads to info.high_limit > TASK_SIZE. vm_unmapped_area() happily returns the high address > TASK_SIZE and then get_unmapped_area() returns -ENOMEM after the "if (addr > TASK_SIZE - len)" check. handle_swbp() doesn't report this failure (probably it should) and silently restarts the probed insn. Endless loop. I think that the right fix should change the x86 get_unmapped_area() paths to rely on TIF_ADDR32 rather than in_32bit_syscall(). Note also that if CONFIG_X86_X32_ABI=y, in_x32_syscall() falsely returns true in this case because ->orig_ax = -1. But we need a simple fix for -stable, so this patch just sets TS_COMPAT if the probed task is 32-bit to make in_ia32_syscall() true. Fixes: 1b028f784e8c ("x86/mm: Introduce mmap_compat_base() for 32-bit mmap()") Reported-by: Paulo Andrade <pandrade@redhat.com> Signed-off-by: Oleg Nesterov <oleg@redhat.com> Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org> Link: https://lore.kernel.org/all/aV5uldEvV7pb4RA8@redhat.com/ Cc: stable@vger.kernel.org Link: https://patch.msgid.link/aWO7Fdxn39piQnxu@redhat.com
2026-01-16selftests: revocable: Add kselftest casesTzung-Bi Shih
Add kselftest cases for the revocable API. The test consists of three parts: - A kernel module (revocable_test.ko) that creates a debugfs interface with `/provider` and `/consumer` files. - A user-space C program (revocable_test) that uses the kselftest harness to interact with the debugfs files. - An orchestrating shell script (test-revocable.sh) that loads the module, runs the C program, and unloads the module. The test cases cover the following scenarios: - Basic: Verifies that a consumer can successfully access the resource provided via the provider. - Revocation: Verifies that after the provider revokes the resource, the consumer correctly receives a NULL pointer on a subsequent access. - Try Access Macro: Same as "Revocation" but uses the REVOCABLE_TRY_ACCESS_WITH() and REVOCABLE_TRY_ACCESS_SCOPED(). Signed-off-by: Tzung-Bi Shih <tzungbi@kernel.org> Link: https://patch.msgid.link/20260116080235.350305-4-tzungbi@kernel.org Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-01-16revocable: Add Kunit test casesTzung-Bi Shih
Add Kunit test cases for the revocable API. The test cases cover the following scenarios: - Basic: Verifies that a consumer can successfully access the resource provided via the provider. - Revocation: Verifies that after the provider revokes the resource, the consumer correctly receives a NULL pointer on a subsequent access. - Try Access Macro: Same as "Revocation" but uses the REVOCABLE_TRY_ACCESS_WITH() and REVOCABLE_TRY_ACCESS_SCOPED(). A way to run the test: $ ./tools/testing/kunit/kunit.py run \ --kconfig_add CONFIG_REVOCABLE_KUNIT_TEST=y \ revocable_test Signed-off-by: Tzung-Bi Shih <tzungbi@kernel.org> Link: https://patch.msgid.link/20260116080235.350305-3-tzungbi@kernel.org Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-01-16revocable: Revocable resource managementTzung-Bi Shih
Some resources can be removed asynchronously, for example, resources provided by a hot-pluggable device like USB. When holding a reference to such a resource, it's possible for the resource to be removed and its memory freed, leading to use-after-free errors on subsequent access. The "revocable" mechanism addresses this by establishing a weak reference to a resource that might be freed at any time. It allows a resource consumer to safely attempt to access the resource, guaranteeing that the access is valid for the duration of its use, or it fails safely if the resource has already been revoked. The implementation uses a provider/consumer model built on Sleepable RCU (SRCU) to guarantee safe memory access: - A resource provider, such as a driver for a hot-pluggable device, allocates a struct revocable_provider and initializes it with a pointer to the resource. - A resource consumer that wants to access the resource allocates a struct revocable which acts as a handle containing a reference to the provider. - To access the resource, the consumer uses revocable_try_access(). This function enters an SRCU read-side critical section and returns the pointer to the resource. If the provider has already freed the resource, it returns NULL. After use, the consumer calls revocable_withdraw_access() to exit the SRCU critical section. The REVOCABLE_TRY_ACCESS_WITH() and REVOCABLE_TRY_ACCESS_SCOPED() are convenient helpers for doing that. - When the provider needs to remove the resource, it calls revocable_provider_revoke(). This function sets the internal resource pointer to NULL and then calls synchronize_srcu() to wait for all current readers to finish before the resource can be completely torn down. Acked-by: Danilo Krummrich <dakr@kernel.org> Signed-off-by: Tzung-Bi Shih <tzungbi@kernel.org> Link: https://patch.msgid.link/20260116080235.350305-2-tzungbi@kernel.org Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-01-16Merge branch 'pm-em'Rafael J. Wysocki
Merge fixes related to the energy model management for 6.19-rc6: - Fix a memory leak in em_create_pd() error path (Malaya Kumar Rout) - Fix stale description of the cost field in struct em_perf_state to reflect the current code (Yaxiong Tian) - Fix and revamp the energy model YNL specification added recently along with the energy model netlink interface (Changwoo Min) * pm-em: PM: EM: Add dump to get-perf-domains in the EM YNL spec PM: EM: Change cpus' type from string to u64 array in the EM YNL spec PM: EM: Rename em.yaml to dev-energymodel.yaml PM: EM: Fix yamllint warnings in the EM YNL spec PM: EM: Fix memory leak in em_create_pd() error path PM: EM: Fix incorrect description of the cost field in struct em_perf_state
2026-01-16arm64: dts: qcom: lemans: enable static TPDMJie Gan
Enable static TPDM device for lemans. Reviewed-by: Konrad Dybcio <konrad.dybcio@oss.qualcomm.com> Signed-off-by: Jie Gan <jie.gan@oss.qualcomm.com> Acked-by: Suzuki K Poulose <suzuki.poulose@arm.com> Link: https://lore.kernel.org/r/20251028-add_static_tpdm_support-v4-3-84e21b98e727@oss.qualcomm.com Signed-off-by: Bjorn Andersson <andersson@kernel.org>
generated by cgit v1.2.3 (git 2.25.1) at 2026-05-16 14:49:37 +0000