summaryrefslogtreecommitdiff
AgeCommit message (Collapse)Author
2025-07-28MIPS: Update Joshua Kinard's e-mail addressJoshua Kinard
I am switching my address to a personal domain, so some files in the SGI IP30 and IOC3 files need to be updated. I will send updates for the MAINTAINERS file and rtc-ds1685 separately to linux-rtc. Signed-off-by: Joshua Kinard <kumba@gentoo.org> Signed-off-by: Thomas Bogendoerfer <tsbogend@alpha.franken.de>
2025-07-28MIPS: mobileye: dts: eyeq5,eyeq6h: rename the emmc controllerBenoît Monin
The name should match the pattern defined in the mmc-controller binding. Reported-by: kernel test robot <lkp@intel.com> Closes: https://lore.kernel.org/oe-kbuild-all/202507220336.JhvVLL7k-lkp@intel.com/ Closes: https://lore.kernel.org/oe-kbuild-all/202507220215.wVoUMK5B-lkp@intel.com/ Signed-off-by: Benoît Monin <benoit.monin@bootlin.com> Reviewed-by: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org> Signed-off-by: Thomas Bogendoerfer <tsbogend@alpha.franken.de>
2025-07-28MIPS: alchemy: gpio: use new GPIO line value setter callbacks for the ↵Bartosz Golaszewski
remaining chips Previous commit missed two other places that need converting, it only came out in tests on autobuilders now. Convert the rest of the driver. Fixes: 68bdc4dc1130 ("MIPS: alchemy: gpio: use new line value setter callbacks") Acked-by: Thomas Bogendoerfer <tsbogend@alpha.franken.de> Link: https://lore.kernel.org/r/20250727082442.13182-1-brgl@bgdev.pl Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski@linaro.org>
2025-07-28Merge tag 'v6.16' into x86/cpu, to resolve conflictIngo Molnar
Resolve overlapping context conflict between this upstream fix: d8010d4ba43e ("x86/bugs: Add a Transient Scheduler Attacks mitigation") And this pending commit in tip:x86/cpu: 65f55a301766 ("x86/CPU/AMD: Add CPUID faulting support") Conflicts: arch/x86/kernel/cpu/amd.c Signed-off-by: Ingo Molnar <mingo@kernel.org>
2025-07-28powerpc64/bpf: Add jit support for load_acquire and store_releasePuranjay Mohan
Add JIT support for the load_acquire and store_release instructions. The implementation is similar to the kernel where: load_acquire => plain load -> lwsync store_release => lwsync -> plain store To test the correctness of the implementation, following selftests were run: [fedora@linux-kernel bpf]$ sudo ./test_progs -a \ verifier_load_acquire,verifier_store_release,atomics #11/1 atomics/add:OK #11/2 atomics/sub:OK #11/3 atomics/and:OK #11/4 atomics/or:OK #11/5 atomics/xor:OK #11/6 atomics/cmpxchg:OK #11/7 atomics/xchg:OK #11 atomics:OK #519/1 verifier_load_acquire/load-acquire, 8-bit:OK #519/2 verifier_load_acquire/load-acquire, 8-bit @unpriv:OK #519/3 verifier_load_acquire/load-acquire, 16-bit:OK #519/4 verifier_load_acquire/load-acquire, 16-bit @unpriv:OK #519/5 verifier_load_acquire/load-acquire, 32-bit:OK #519/6 verifier_load_acquire/load-acquire, 32-bit @unpriv:OK #519/7 verifier_load_acquire/load-acquire, 64-bit:OK #519/8 verifier_load_acquire/load-acquire, 64-bit @unpriv:OK #519/9 verifier_load_acquire/load-acquire with uninitialized src_reg:OK #519/10 verifier_load_acquire/load-acquire with uninitialized src_reg @unpriv:OK #519/11 verifier_load_acquire/load-acquire with non-pointer src_reg:OK #519/12 verifier_load_acquire/load-acquire with non-pointer src_reg @unpriv:OK #519/13 verifier_load_acquire/misaligned load-acquire:OK #519/14 verifier_load_acquire/misaligned load-acquire @unpriv:OK #519/15 verifier_load_acquire/load-acquire from ctx pointer:OK #519/16 verifier_load_acquire/load-acquire from ctx pointer @unpriv:OK #519/17 verifier_load_acquire/load-acquire with invalid register R15:OK #519/18 verifier_load_acquire/load-acquire with invalid register R15 @unpriv:OK #519/19 verifier_load_acquire/load-acquire from pkt pointer:OK #519/20 verifier_load_acquire/load-acquire from flow_keys pointer:OK #519/21 verifier_load_acquire/load-acquire from sock pointer:OK #519 verifier_load_acquire:OK #556/1 verifier_store_release/store-release, 8-bit:OK #556/2 verifier_store_release/store-release, 8-bit @unpriv:OK #556/3 verifier_store_release/store-release, 16-bit:OK #556/4 verifier_store_release/store-release, 16-bit @unpriv:OK #556/5 verifier_store_release/store-release, 32-bit:OK #556/6 verifier_store_release/store-release, 32-bit @unpriv:OK #556/7 verifier_store_release/store-release, 64-bit:OK #556/8 verifier_store_release/store-release, 64-bit @unpriv:OK #556/9 verifier_store_release/store-release with uninitialized src_reg:OK #556/10 verifier_store_release/store-release with uninitialized src_reg @unpriv:OK #556/11 verifier_store_release/store-release with uninitialized dst_reg:OK #556/12 verifier_store_release/store-release with uninitialized dst_reg @unpriv:OK #556/13 verifier_store_release/store-release with non-pointer dst_reg:OK #556/14 verifier_store_release/store-release with non-pointer dst_reg @unpriv:OK #556/15 verifier_store_release/misaligned store-release:OK #556/16 verifier_store_release/misaligned store-release @unpriv:OK #556/17 verifier_store_release/store-release to ctx pointer:OK #556/18 verifier_store_release/store-release to ctx pointer @unpriv:OK #556/19 verifier_store_release/store-release, leak pointer to stack:OK #556/20 verifier_store_release/store-release, leak pointer to stack @unpriv:OK #556/21 verifier_store_release/store-release, leak pointer to map:OK #556/22 verifier_store_release/store-release, leak pointer to map @unpriv:OK #556/23 verifier_store_release/store-release with invalid register R15:OK #556/24 verifier_store_release/store-release with invalid register R15 @unpriv:OK #556/25 verifier_store_release/store-release to pkt pointer:OK #556/26 verifier_store_release/store-release to flow_keys pointer:OK #556/27 verifier_store_release/store-release to sock pointer:OK #556 verifier_store_release:OK Summary: 3/55 PASSED, 0 SKIPPED, 0 FAILED Signed-off-by: Puranjay Mohan <puranjay@kernel.org> Tested-by: Saket Kumar Bhaskar <skb99@linux.ibm.com> Reviewed-by: Hari Bathini <hbathini@linux.ibm.com> Signed-off-by: Madhavan Srinivasan <maddy@linux.ibm.com> Link: https://patch.msgid.link/20250717202935.29018-2-puranjay@kernel.org
2025-07-28docs: powerpc: add htm.rst to toctreeVishal Parmar
The file Documentation/arch/powerpc/htm.rst is not included in the index.rst toctree. This results in a warning when building the docs: WARNING: document isn't included in any toctree: htm.rst Add it to the index.rst file so that it is properly included in the PowerPC documentation TOC. Signed-off-by: Vishal Parmar <vishistriker@gmail.com> Signed-off-by: Madhavan Srinivasan <maddy@linux.ibm.com> Link: https://patch.msgid.link/20250727110145.839906-1-vishistriker@gmail.com
2025-07-27dt-bindings: hwmon: Replace bouncing Alexandru Tachici emailsKrzysztof Kozlowski
Emails to alexandru.tachici@analog.com bounce permanently: Remote Server returned '550 5.1.10 RESOLVER.ADR.RecipientNotFound; Recipient not found by SMTP address lookup' so replace him with Cedric Encarnacion from Analog. Signed-off-by: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org> Acked-by: Rob Herring (Arm) <robh@kernel.org> Link: https://lore.kernel.org/r/20250724113735.59148-2-krzysztof.kozlowski@linaro.org Signed-off-by: Guenter Roeck <linux@roeck-us.net>
2025-07-27hwmon: (ina238) Add support for INA228Jonas Rebmann
Add support for the Texas Instruments INA228 Ultra-Precise Power/Energy/Charge Monitor. The INA228 is very similar to the INA238 but offers four bits of extra precision in the temperature, voltage and current measurement fields. It also supports energy and charge monitoring, the latter of which is not supported through this patch. While it seems in the datasheet that some constants such as LSB values differ between the 228 and the 238, they differ only for those registers where four bits of precision have been added and they differ by a factor of 16 (VBUS, VSHUNT, DIETEMP, CURRENT). Therefore, the INA238 constants are still applicable with regard to the bit of the same significance. Signed-off-by: Jonas Rebmann <jre@pengutronix.de> Link: https://lore.kernel.org/r/20250718-ina228-v2-3-227feb62f709@pengutronix.de Signed-off-by: Guenter Roeck <linux@roeck-us.net>
2025-07-27dt-bindings: Add INA228 to ina2xx devicetree bindingsJonas Rebmann
Add the ina228 to ina2xx bindings. Reviewed-by: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org> Signed-off-by: Jonas Rebmann <jre@pengutronix.de> Link: https://lore.kernel.org/r/20250718-ina228-v2-2-227feb62f709@pengutronix.de Signed-off-by: Guenter Roeck <linux@roeck-us.net>
2025-07-27hwmon: (ina238) Fix inconsistent whitespaceJonas Rebmann
Some purely cosmetic changes in ina238.c: - When aligning definitions, do so consistently with tab stop of 8. - Use spaces instead of tabs around operators. - Align wrapped lines. Signed-off-by: Jonas Rebmann <jre@pengutronix.de> Link: https://lore.kernel.org/r/20250718-ina228-v2-1-227feb62f709@pengutronix.de Signed-off-by: Guenter Roeck <linux@roeck-us.net>
2025-07-27cifs: Add support for creating reparse points over SMB1Pali Rohár
SMB1 already supports querying reparse points and detecting types of symlink, fifo, socket, block and char. This change implements the missing part - ability to create a new reparse points over SMB1. This includes everything which SMB2+ already supports: - native SMB symlinks and sockets - NFS style of special files (symlinks, fifos, sockets, char/block devs) - WSL style of special files (symlinks, fifos, sockets, char/block devs) Attaching a reparse point to an existing file or directory is done via SMB1 SMB_COM_NT_TRANSACT/NT_TRANSACT_IOCTL/FSCTL_SET_REPARSE_POINT command and implemented in a new cifs_create_reparse_inode() function. This change introduce a new callback ->create_reparse_inode() which creates a new reperse point file or directory and returns inode. For SMB1 it is provided via that new cifs_create_reparse_inode() function. Existing reparse.c code was only slightly updated to call new protocol callback ->create_reparse_inode() instead of hardcoded SMB2+ function. This make the whole reparse.c code to work with every SMB dialect. The original callback ->create_reparse_symlink() is not needed anymore as the implementation of new create_reparse_symlink() function is dialect agnostic too. So the link.c code was updated to call that function directly (and not via callback). Signed-off-by: Pali Rohár <pali@kernel.org> Signed-off-by: Steve French <stfrench@microsoft.com>
2025-07-27cifs: Do not query WSL EAs for native SMB symlinkPali Rohár
WSL EAs are not required for native SMB symlinks, so do not query them from server. Signed-off-by: Pali Rohár <pali@kernel.org> Signed-off-by: Steve French <stfrench@microsoft.com>
2025-07-27cifs: Optimize CIFSFindFirst() response when not searchingPali Rohár
When not searching for child entries with msearch wildcard pattern then ask server just for one output entry. There is no need to ask for more entries as we are interested only for one search result, as we are doing query on path. CIFSFindFirst() with msearch=false is called by the cifs_query_path_info() function. Signed-off-by: Pali Rohár <pali@kernel.org> Signed-off-by: Steve French <stfrench@microsoft.com>
2025-07-27cifs: Fix calling CIFSFindFirst() for root path without msearchPali Rohár
To query root path (without msearch wildcard) it is needed to send pattern '\' instead of '' (empty string). This allows to use CIFSFindFirst() to query information about root path which is being used in followup changes. This change fixes the stat() syscall called on the root path on the mount. It is because stat() syscall uses the cifs_query_path_info() function and it can fallback to the CIFSFindFirst() usage with msearch=false. Signed-off-by: Pali Rohár <pali@kernel.org> Signed-off-by: Steve French <stfrench@microsoft.com>
2025-07-27smb: client: fix session setup against servers that require SPNPaulo Alcantara
Some servers might enforce the SPN to be set in the target info blob (AV pairs) when sending NTLMSSP_AUTH message. In Windows Server, this could be enforced with SmbServerNameHardeningLevel set to 2. Fix this by always appending SPN (cifs/<hostname>) to the existing list of target infos when setting up NTLMv2 response blob. Cc: linux-cifs@vger.kernel.org Cc: David Howells <dhowells@redhat.com> Reported-by: Pierguido Lambri <plambri@redhat.com> Signed-off-by: Paulo Alcantara (Red Hat) <pc@manguebit.org> Signed-off-by: Steve French <stfrench@microsoft.com>
2025-07-27smb: client: allow parsing zero-length AV pairsPaulo Alcantara
Zero-length AV pairs should be considered as valid target infos. Don't skip the next AV pairs that follow them. Cc: linux-cifs@vger.kernel.org Cc: David Howells <dhowells@redhat.com> Fixes: 0e8ae9b953bc ("smb: client: parse av pair type 4 in CHALLENGE_MESSAGE") Signed-off-by: Paulo Alcantara (Red Hat) <pc@manguebit.org> Signed-off-by: Steve French <stfrench@microsoft.com>
2025-07-27cifs: add new field to track the last access time of cfidShyam Prasad N
The handlecache code today tracks the time at which dir lease was acquired and the laundromat thread uses that to check for old entries to cleanup. However, if a directory is actively accessed, it should not be chosen to expire first. This change adds a new last_access_time field to cfid and uses that to decide expiry of the cfid. Signed-off-by: Shyam Prasad N <sprasad@microsoft.com> Signed-off-by: Steve French <stfrench@microsoft.com>
2025-07-27smb: change return type of cached_dir_lease_break() to boolBharath SM
cached_dir_lease_break() has return type as int but only returning true or false. change return type of this function to bool for clarity. Signed-off-by: Bharath SM <bharathsm@microsoft.com> Signed-off-by: Steve French <stfrench@microsoft.com>
2025-07-27cifs: reset iface weights when we cannot find a candidateShyam Prasad N
We now do a weighted selection of server interfaces when allocating new channels. The weights are decided based on the speed advertised. The fulfilled weight for an interface is a counter that is used to track the interface selection. It should be reset back to zero once all interfaces fulfilling their weight. In cifs_chan_update_iface, this reset logic was missing. As a result when the server interface list changes, the client may not be able to find a new candidate for other channels after all interfaces have been fulfilled. Fixes: a6d8fb54a515 ("cifs: distribute channels across interfaces based on speed") Cc: <stable@vger.kernel.org> Signed-off-by: Shyam Prasad N <sprasad@microsoft.com> Signed-off-by: Steve French <stfrench@microsoft.com>
2025-07-27smb: client: fix netns refcount leak after net_passive changesWang Zhaolong
After commit 5c70eb5c593d ("net: better track kernel sockets lifetime"), kernel sockets now use net_passive reference counting. However, commit 95d2b9f693ff ("Revert "smb: client: fix TCP timers deadlock after rmmod"") restored the manual socket refcount manipulation without adapting to this new mechanism, causing a memory leak. The issue can be reproduced by[1]: 1. Creating a network namespace 2. Mounting and Unmounting CIFS within the namespace 3. Deleting the namespace Some memory leaks may appear after a period of time following step 3. unreferenced object 0xffff9951419f6b00 (size 256): comm "ip", pid 447, jiffies 4294692389 (age 14.730s) hex dump (first 32 bytes): 1b 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 00 00 00 00 00 00 00 00 80 77 c2 44 51 99 ff ff .........w.DQ... backtrace: __kmem_cache_alloc_node+0x30e/0x3d0 __kmalloc+0x52/0x120 net_alloc_generic+0x1d/0x30 copy_net_ns+0x86/0x200 create_new_namespaces+0x117/0x300 unshare_nsproxy_namespaces+0x60/0xa0 ksys_unshare+0x148/0x360 __x64_sys_unshare+0x12/0x20 do_syscall_64+0x59/0x110 entry_SYSCALL_64_after_hwframe+0x78/0xe2 ... unreferenced object 0xffff9951442e7500 (size 32): comm "mount.cifs", pid 475, jiffies 4294693782 (age 13.343s) hex dump (first 32 bytes): 40 c5 38 46 51 99 ff ff 18 01 96 42 51 99 ff ff @.8FQ......BQ... 01 00 00 00 6f 00 c5 07 6f 00 d8 07 00 00 00 00 ....o...o....... backtrace: __kmem_cache_alloc_node+0x30e/0x3d0 kmalloc_trace+0x2a/0x90 ref_tracker_alloc+0x8e/0x1d0 sk_alloc+0x18c/0x1c0 inet_create+0xf1/0x370 __sock_create+0xd7/0x1e0 generic_ip_connect+0x1d4/0x5a0 [cifs] cifs_get_tcp_session+0x5d0/0x8a0 [cifs] cifs_mount_get_session+0x47/0x1b0 [cifs] dfs_mount_share+0xfa/0xa10 [cifs] cifs_mount+0x68/0x2b0 [cifs] cifs_smb3_do_mount+0x10b/0x760 [cifs] smb3_get_tree+0x112/0x2e0 [cifs] vfs_get_tree+0x29/0xf0 path_mount+0x2d4/0xa00 __se_sys_mount+0x165/0x1d0 Root cause: When creating kernel sockets, sk_alloc() calls net_passive_inc() for sockets with sk_net_refcnt=0. The CIFS code manually converts kernel sockets to user sockets by setting sk_net_refcnt=1, but doesn't call the corresponding net_passive_dec(). This creates an imbalance in the net_passive counter, which prevents the network namespace from being destroyed when its last user reference is dropped. As a result, the entire namespace and all its associated resources remain allocated. Timeline of patches leading to this issue: - commit ef7134c7fc48 ("smb: client: Fix use-after-free of network namespace.") in v6.12 fixed the original netns UAF by manually managing socket refcounts - commit e9f2517a3e18 ("smb: client: fix TCP timers deadlock after rmmod") in v6.13 attempted to use kernel sockets but introduced TCP timer issues - commit 5c70eb5c593d ("net: better track kernel sockets lifetime") in v6.14-rc5 introduced the net_passive mechanism with sk_net_refcnt_upgrade() for proper socket conversion - commit 95d2b9f693ff ("Revert "smb: client: fix TCP timers deadlock after rmmod"") in v6.15-rc3 reverted to manual refcount management without adapting to the new net_passive changes Fix this by using sk_net_refcnt_upgrade() which properly handles the net_passive counter when converting kernel sockets to user sockets. Link: https://bugzilla.kernel.org/show_bug.cgi?id=220343 [1] Fixes: 95d2b9f693ff ("Revert "smb: client: fix TCP timers deadlock after rmmod"") Cc: stable@vger.kernel.org Reviewed-by: Kuniyuki Iwashima <kuniyu@google.com> Reviewed-by: Enzo Matsumiya <ematsumiya@suse.de> Signed-off-by: Wang Zhaolong <wangzhaolong@huaweicloud.com> Signed-off-by: Steve French <stfrench@microsoft.com>
2025-07-27Linux 6.16v6.16Linus Torvalds
2025-07-27fbcon: Use 'bool' where appopriateVille Syrjälä
Use 'bool' type where it makes more sense than 'int'. v2: Rebase due to corrected 'fbcon_cursor_blink' initial value Acked-by: Helge Deller <deller@gmx.de> Signed-off-by: Ville Syrjälä <ville.syrjala@linux.intel.com> Reviewed-by: Thomas Zimmermann <tzimmermann@suse.de> Signed-off-by: Helge Deller <deller@gmx.de>
2025-07-27fbcon: Introduce get_{fg,bg}_color()Ville Syrjälä
Make the code more legible by adding get_{fg,bg}_color() which hide the obscure 'is_fg' parameter of get_color() from the caller. Signed-off-by: Ville Syrjälä <ville.syrjala@linux.intel.com> Acked-by: Helge Deller <deller@gmx.de> Reviewed-by: Thomas Zimmermann <tzimmermann@suse.de> Signed-off-by: Helge Deller <deller@gmx.de>
2025-07-27fbcon: fbcon_is_inactive() -> fbcon_is_active()Ville Syrjälä
Invert fbcon_is_inactive() into fbcon_is_active(). Much easier on the poor brain when you don't have to do dobule negations all over the place. Signed-off-by: Ville Syrjälä <ville.syrjala@linux.intel.com> Acked-by: Helge Deller <deller@gmx.de> Reviewed-by: Thomas Zimmermann <tzimmermann@suse.de> Signed-off-by: Helge Deller <deller@gmx.de>
2025-07-27fbcon: fbcon_cursor_noblink -> fbcon_cursor_blinkVille Syrjälä
Invert fbcon_cursor_noblink into fbcon_cursor_blink so that: - it matches the sysfs attribute exactly - avoids having to do these NOT operations all over the place - use bool instead of int Signed-off-by: Ville Syrjälä <ville.syrjala@linux.intel.com> Signed-off-by: Helge Deller <deller@gmx.de>
2025-07-27fbdev: Fix typo in Kconfig text for FB_DEVICEDaniel Palmer
Seems like someone hit 'c' when they meant to hit 'd'. Signed-off-by: Daniel Palmer <daniel.palmer@sony.com> Signed-off-by: Helge Deller <deller@gmx.de>
2025-07-27fbdev: imxfb: Check fb_add_videomode to prevent null-ptr-derefChenyuan Yang
fb_add_videomode() can fail with -ENOMEM when its internal kmalloc() cannot allocate a struct fb_modelist. If that happens, the modelist stays empty but the driver continues to register. Add a check for its return value to prevent poteintial null-ptr-deref, which is similar to the commit 17186f1f90d3 ("fbdev: Fix do_register_framebuffer to prevent null-ptr-deref in fb_videomode_to_var"). Fixes: 1b6c79361ba5 ("video: imxfb: Add DT support") Signed-off-by: Chenyuan Yang <chenyuan0y@gmail.com> Signed-off-by: Helge Deller <deller@gmx.de>
2025-07-27fbdev: svgalib: Clean up coding styleDarshan R.
This patch addresses various coding style issues in `svgalib.c` to improve readability and better align the code with the Linux kernel's formatting standards. The changes primarily consist of: - Adjusting whitespace around operators and after keywords. - Standardizing brace placement for control flow statements. - Removing unnecessary braces on single-statement if/else blocks. - Deleting extraneous blank lines throughout the file. These changes are purely stylistic and introduce no functional modifications. Signed-off-by: Darshan R. <rathod.darshan.0896@gmail.com> Signed-off-by: Helge Deller <deller@gmx.de>
2025-07-27fbdev: kyro: Use devm_ioremap_wc() for screen memGiovanni Di Santi
Replace the manual pci_ioremap_wc() call for mapping screen memory with the device-managed devm_ioremap_wc() variant. This simplifies the driver's resource management by ensuring the memory is automatically unmapped when the driver detaches from the device. Signed-off-by: Giovanni Di Santi <giovanni.disanti.lkl@gmail.com> Signed-off-by: Helge Deller <deller@gmx.de>
2025-07-27fbdev: kyro: Use devm_ioremap() for mmio registersGiovanni Di Santi
Replace the manual ioremap() call for the MMIO registers with the device-managed devm_ioremap() variant. This simplifies the driver's resource management by ensuring the memory is automatically unmapped when the driver detaches from the device. Signed-off-by: Giovanni Di Santi <giovanni.disanti.lkl@gmail.com> Signed-off-by: Helge Deller <deller@gmx.de>
2025-07-27fbdev: kyro: Add missing PCI memory region requestGiovanni Di Santi
The kyro framebuffer driver did not request its PCI memory regions, which could lead to conflicts with other drivers. This change addresses the task "Request memory regions in all fbdev drivers" from the file Documentation/gpu/todo.rst. This is addressed by using the managed device functions pcim_enable_device() and pcim_request_all_regions(). This simplifies the code by making error handling and driver removal cleanup automatic for these resources. Signed-off-by: Giovanni Di Santi <giovanni.disanti.lkl@gmail.com> Signed-off-by: Helge Deller <deller@gmx.de>
2025-07-27fbdev: simplefb: Use of_reserved_mem_region_to_resource() for "memory-region"Rob Herring (Arm)
Use the newly added of_reserved_mem_region_to_resource() function to handle "memory-region" properties. The error handling is a bit different. "memory-region" is optional, so failed lookup is not an error. But then an error in of_address_to_resource() is treated as an error. However, that distinction is not really important. Either the region is available and usable or it is not. So now, it is just of_reserved_mem_region_to_resource() which is checked for an error. Signed-off-by: Rob Herring (Arm) <robh@kernel.org> Signed-off-by: Helge Deller <deller@gmx.de>
2025-07-27fbdev: fix potential buffer overflow in do_register_framebuffer()Yongzhen Zhang
The current implementation may lead to buffer overflow when: 1. Unregistration creates NULL gaps in registered_fb[] 2. All array slots become occupied despite num_registered_fb < FB_MAX 3. The registration loop exceeds array bounds Add boundary check to prevent registered_fb[FB_MAX] access. Signed-off-by: Yongzhen Zhang <zhangyongzhen@kylinos.cn> Signed-off-by: Helge Deller <deller@gmx.de>
2025-07-27fbdev: nvidiafb: add depends on HAS_IOPORTRandy Dunlap
The nvidiafb driver uses inb()/outb() without depending on HAS_IOPORT, which leads to build errors since kernel v6.13-rc1: commit 6f043e757445 ("asm-generic/io.h: Remove I/O port accessors for HAS_IOPORT=n") Add the HAS_IOPORT dependency to prevent the build errors. (Found in ARCH=um allmodconfig builds) drivers/video/fbdev/nvidia/nv_accel.c: In function ‘NVDmaWait’: include/asm-generic/io.h:596:15: error: call to ‘_outb’ declared with attribute error: outb() requires CONFIG_HAS_IOPORT 596 | #define _outb _outb Signed-off-by: Randy Dunlap <rdunlap@infradead.org> Cc: Arnd Bergmann <arnd@kernel.org> Cc: Niklas Schnelle <schnelle@linux.ibm.com> Cc: Antonino Daplas <adaplas@gmail.com> Cc: Helge Deller <deller@gmx.de> Cc: linux-fbdev@vger.kernel.org Cc: dri-devel@lists.freedesktop.org Cc: stable@vger.kernel.org # v6.13+ Signed-off-by: Helge Deller <deller@gmx.de>
2025-07-27fbdev: nvidiafb: fix build on 32-bit ARCH=umJohannes Berg
Now that ARCH=um no longer has IO port accesses, this driver can no longer build as-is. Make the IO port calls not just conditional on i386 but also !UML. Reported-by: Arnd Bergmann <arnd@arndb.de> Signed-off-by: Johannes Berg <johannes.berg@intel.com> Signed-off-by: Helge Deller <deller@gmx.de>
2025-07-27bpf: Simplify bounds refinement from s32Paul Chaignon
During the bounds refinement, we improve the precision of various ranges by looking at other ranges. Among others, we improve the following in this order (other things happen between 1 and 2): 1. Improve u32 from s32 in __reg32_deduce_bounds. 2. Improve s/u64 from u32 in __reg_deduce_mixed_bounds. 3. Improve s/u64 from s32 in __reg_deduce_mixed_bounds. In particular, if the s32 range forms a valid u32 range, we will use it to improve the u32 range in __reg32_deduce_bounds. In __reg_deduce_mixed_bounds, under the same condition, we will use the s32 range to improve the s/u64 ranges. If at (1) we were able to learn from s32 to improve u32, we'll then be able to use that in (2) to improve s/u64. Hence, as (3) happens under the same precondition as (1), it won't improve s/u64 ranges further than (1)+(2) did. Thus, we can get rid of (3). In addition to the extensive suite of selftests for bounds refinement, this patch was also tested with the Agni formal verification tool [1]. Additionally, Eduard mentioned: The argument appears to be as follows: Under precondition `(u32)reg->s32_min <= (u32)reg->s32_max` __reg32_deduce_bounds produces: reg->u32_min = max_t(u32, reg->s32_min, reg->u32_min); reg->u32_max = min_t(u32, reg->s32_max, reg->u32_max); And then first part of __reg_deduce_mixed_bounds assigns: a. reg->umin umax= (reg->umin & ~0xffffffffULL) | max_t(u32, reg->s32_min, reg->u32_min); b. reg->umax umin= (reg->umax & ~0xffffffffULL) | min_t(u32, reg->s32_max, reg->u32_max); And then second part of __reg_deduce_mixed_bounds assigns: c. reg->umin umax= (reg->umin & ~0xffffffffULL) | (u32)reg->s32_min; d. reg->umax umin= (reg->umax & ~0xffffffffULL) | (u32)reg->s32_max; But assignment (c) is a noop because: max_t(u32, reg->s32_min, reg->u32_min) >= (u32)reg->s32_min Hence RHS(a) >= RHS(c) and umin= does nothing. Also assignment (d) is a noop because: min_t(u32, reg->s32_max, reg->u32_max) <= (u32)reg->s32_max Hence RHS(b) <= RHS(d) and umin= does nothing. Plus the same reasoning for the part dealing with reg->s{min,max}_value: e. reg->smin_value smax= (reg->smin_value & ~0xffffffffULL) | max_t(u32, reg->s32_min_value, reg->u32_min_value); f. reg->smax_value smin= (reg->smax_value & ~0xffffffffULL) | min_t(u32, reg->s32_max_value, reg->u32_max_value); vs g. reg->smin_value smax= (reg->smin_value & ~0xffffffffULL) | (u32)reg->s32_min_value; h. reg->smax_value smin= (reg->smax_value & ~0xffffffffULL) | (u32)reg->s32_max_value; RHS(e) >= RHS(g) and RHS(f) <= RHS(h), hence smax=,smin= do nothing. This appears to be correct. Also, Shung-Hsi: Beside going through the reasoning, I also played with CBMC a bit to double check that as far as a single run of __reg_deduce_bounds() is concerned (and that the register state matches certain handwavy expectations), the change indeed still preserve the original behavior. Signed-off-by: Paul Chaignon <paul.chaignon@gmail.com> Signed-off-by: Daniel Borkmann <daniel@iogearbox.net> Reviewed-by: Shung-Hsi Yu <shung-hsi.yu@suse.com> Acked-by: Eduard Zingerman <eddyz87@gmail.com> Link: https://github.com/bpfverif/agni [1] Link: https://lore.kernel.org/bpf/aIJwnFnFyUjNsCNa@mail.gmail.com
2025-07-27Merge tag 'timers-urgent-2025-07-27' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull timer fix from Thomas Gleixner: "A single fix for the PTP systemcounter mechanism: The rework of this mechanism added a 'use_nsec' member to struct system_counterval. get_device_system_crosststamp() instantiates that struct on the stack and hands a pointer to the driver callback. Only the drivers which set use_nsec to true, initialize that field, but all others ignore it. As get_device_system_crosststamp() does not initialize the struct, the use_nsec field contains random stack content in those cases. That causes a miscalulation usually resulting in a failing range check in the best case. Initialize the structure before handing it to the drivers to cure that" * tag 'timers-urgent-2025-07-27' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: timekeeping: Zero initialize system_counterval when querying time from phc drivers
2025-07-27crypto: keembay - Use min() to simplify ocs_create_linked_list_from_sg()Thorsten Blum
Use min() to simplify ocs_create_linked_list_from_sg() and improve its readability. Signed-off-by: Thorsten Blum <thorsten.blum@linux.dev> Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
2025-07-27crypto: hisilicon/hpre - fix dma unmap sequenceZhiqi Song
Perform DMA unmapping operations before processing data. Otherwise, there may be unsynchronized data accessed by the CPU when the SWIOTLB is enabled. Signed-off-by: Zhiqi Song <songzhiqi1@huawei.com> Signed-off-by: Chenghai Huang <huangchenghai2@huawei.com> Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
2025-07-27crypto: qat - make adf_dev_autoreset() staticGiovanni Cabiddu
The function adf_dev_autoreset() is only used within adf_aer.c and does not need to be exposed outside the compilation unit. Make it static and remove it from the header adf_common_drv.h. This does not introduce any functional change. Signed-off-by: Giovanni Cabiddu <giovanni.cabiddu@intel.com> Reviewed-by: Ahsan Atta <ahsan.atta@intel.com> Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
2025-07-27crypto: ccp - reduce stack usage in ccp_run_aes_gcm_cmdArnd Bergmann
A number of functions in this file have large structures on the stack, ccp_run_aes_gcm_cmd() being the worst, in particular when KASAN is enabled on gcc: drivers/crypto/ccp/ccp-ops.c: In function 'ccp_run_sha_cmd': drivers/crypto/ccp/ccp-ops.c:1833:1: error: the frame size of 1136 bytes is larger than 1024 bytes [-Werror=frame-larger-than=] drivers/crypto/ccp/ccp-ops.c: In function 'ccp_run_aes_gcm_cmd': drivers/crypto/ccp/ccp-ops.c:914:1: error: the frame size of 1632 bytes is larger than 1024 bytes [-Werror=frame-larger-than=] Avoid the issue by using dynamic memory allocation in the worst one of these. Signed-off-by: Arnd Bergmann <arnd@arndb.de> Acked-by: Tom Lendacky <thomas.lendacky@amd.com> Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
2025-07-27crypto: qat - refactor ring-related debug functionsGiovanni Cabiddu
Refactor the functions `adf_ring_start()` and `adf_ring_next()` to improve readability. This does not introduce any functional change. Signed-off-by: Giovanni Cabiddu <giovanni.cabiddu@intel.com> Reviewed-by: Ahsan Atta <ahsan.atta@intel.com> Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
2025-07-27crypto: qat - fix seq_file position update in adf_ring_next()Giovanni Cabiddu
The `adf_ring_next()` function in the QAT debug transport interface fails to correctly update the position index when reaching the end of the ring elements. This triggers the following kernel warning when reading ring files, such as /sys/kernel/debug/qat_c6xx_<D:B:D:F>/transport/bank_00/ring_00: [27725.022965] seq_file: buggy .next function adf_ring_next [intel_qat] did not update position index Ensure that the `*pos` index is incremented before returning NULL when after the last element in the ring is found, satisfying the seq_file API requirements and preventing the warning. Fixes: a672a9dc872e ("crypto: qat - Intel(R) QAT transport code") Signed-off-by: Giovanni Cabiddu <giovanni.cabiddu@intel.com> Reviewed-by: Ahsan Atta <ahsan.atta@intel.com> Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
2025-07-27crypto: qat - fix DMA direction for compression on GEN2 devicesGiovanni Cabiddu
QAT devices perform an additional integrity check during compression by decompressing the output. Starting from QAT GEN4, this verification is done in-line by the hardware. However, on GEN2 devices, the hardware reads back the compressed output from the destination buffer and performs a decompression operation using it as the source. In the current QAT driver, destination buffers are always marked as write-only. This is incorrect for QAT GEN2 compression, where the buffer is also read during verification. Since commit 6f5dc7658094 ("iommu/vt-d: Restore WO permissions on second-level paging entries"), merged in v6.16-rc1, write-only permissions are strictly enforced, leading to DMAR errors when using QAT GEN2 devices for compression, if VT-d is enabled. Mark the destination buffers as DMA_BIDIRECTIONAL. This ensures compatibility with GEN2 devices, even though it is not required for QAT GEN4 and later. Signed-off-by: Giovanni Cabiddu <giovanni.cabiddu@intel.com> Fixes: cf5bb835b7c8 ("crypto: qat - fix DMA transfer direction") Reviewed-by: Ahsan Atta <ahsan.atta@intel.com> Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
2025-07-27Input: st1232 - add touch-overlay handlingJavier Carrasco
Use touch-overlay to support overlay objects such as buttons and a resized frame defined in the device tree. A key event will be generated if the coordinates of a touch event are within the area defined by the button properties. Reviewed-by: Jeff LaBundy <jeff@labundy.com> Signed-off-by: Javier Carrasco <javier.carrasco@wolfvision.net> Link: https://lore.kernel.org/r/20241016-feature-ts_virtobj_patch-v11-4-b292a1bbb0a1@wolfvision.net Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
2025-07-27dt-bindings: input: touchscreen: st1232: add touch-overlay exampleJavier Carrasco
The touch-overlay feature adds support for segments (touch areas) on the touchscreen surface that represent overlays with clipped touchscreen areas and printed buttons. Add nodes for a clipped touchscreen and overlay buttons to the existing example. Reviewed-by: Rob Herring <robh@kernel.org> Signed-off-by: Javier Carrasco <javier.carrasco@wolfvision.net> Link: https://lore.kernel.org/r/20241016-feature-ts_virtobj_patch-v11-3-b292a1bbb0a1@wolfvision.net Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
2025-07-27Input: touch-overlay - add touchscreen overlay handlingJavier Carrasco
Some touch devices provide mechanical overlays with different objects like buttons or clipped touchscreen surfaces. In order to support these objects, add a series of helper functions to the input subsystem to transform them into overlay objects via device tree nodes. These overlay objects consume the raw touch events and report the expected input events depending on the object properties. Note that the current implementation allows for multiple definitions of touchscreen areas (regions that report touch events), but only the first one will be used for the touchscreen device that the consumers typically provide. Should the need for multiple touchscreen areas arise, additional touchscreen devices would be required at the consumer side. There is no limitation in the number of touch areas defined as buttons. Reviewed-by: Jeff LaBundy <jeff@labundy.com> Signed-off-by: Javier Carrasco <javier.carrasco@wolfvision.net> Link: https://lore.kernel.org/r/20241016-feature-ts_virtobj_patch-v11-2-b292a1bbb0a1@wolfvision.net Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
2025-07-27dt-bindings: touchscreen: add touch-overlay propertyJavier Carrasco
The touch-overlay encompasses a number of touch areas that define a clipped touchscreen area and/or buttons with a specific functionality. A clipped touchscreen area avoids getting events from regions that are physically hidden by overlay frames. For touchscreens with printed overlay buttons, sub-nodes with a suitable key code can be defined to report key events instead of the original touch events. Reviewed-by: Jeff LaBundy <jeff@labundy.com> Reviewed-by: Rob Herring <robh@kernel.org> Signed-off-by: Javier Carrasco <javier.carrasco@wolfvision.net> Link: https://lore.kernel.org/r/20241016-feature-ts_virtobj_patch-v11-1-b292a1bbb0a1@wolfvision.net Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
2025-07-27Input: atkbd - correctly map F13 - F24Werner Sembach
Currently only F23 is correctly mapped for PS/2 keyboards. According to this table: https://download.microsoft.com/download/1/6/1/161ba512-40e2-4cc9-843a-923143f3456c/translate.pdf - F24 and Zenkaku/Hankaku share the same scancode, but since in real world Zenkaku/Hankaku keys seem to just use the tilde scancode, this patch binds the scancode to F24. Note that on userspace side the KEY_ZENKAKUHANKAKU keycode is currently not bound in xkeyboard-config, so it is (mostly*) unused anyway. * Qt on Wayland and therefore KDE on Wayland can see the keypress anyway for some reason and it is actually used in a touchpad toggle shortcut, but this is currently being fixed in both KDE and xkeyboard-config to make this less weird, so it could directly be fixed to correctly handle the F24 keypress instead. - The scancodes for F13-F22 are currently unmapped so there will probably be no harm in mapping them. This would also fix the issue that some of these keys can't be mapped as the target from userspace using the `setkeycodes` command. Reviewed-by: Hans de Goede <hdegoede@redhat.com> Signed-off-by: Werner Sembach <wse@tuxedocomputers.com> Link: https://lore.kernel.org/r/20250722120438.28011-1-wse@tuxedocomputers.com Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
2025-07-27Input: xpad - use new BTN_GRIP* buttonsVicki Pfau
Map paddles to the newly defined BTN_GRIP* buttons. Signed-off-by: Vicki Pfau <vi@endrift.com> Link: https://lore.kernel.org/r/20250702040102.125432-3-vi@endrift.com Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>