| Age | Commit message (Collapse) | Author |
|---|
|
git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net-next
Pull networking updates from Paolo Abeni:
"This includes a significant number of low-priority fixes - especially
in the NIC drivers area - that we deferred from the last few RCs in
the previous cycle, which can't be easily outlined in the synopsis
below.
Core & protocols:
- Continue the work on removing rtnl_lock dependencies:
- per-netns ARP and ND neighbour tables, with the default settings
now configurable per netns (inheritance from init_net is
controlled by the new net.core.neigh_inherit_init_net sysctl)
- RCU-protected configuration and rtnl_lock-less fill_info() for
hsr, netkit, sit, vlan and vxlan devices
- per-netns device unregistration for ip tunnel and gre devices
- use the netdev instance lock instead of rtnl_lock when reading
speed and duplex via sysfs
- batch the flushing of uncached routes at device unregistration
time, relieving rtnl_lock contention on netns dismantle.
- Add hardware pacing offload support, admin-controlled via a new
rtnetlink attribute, with sch_fq integration (implemented in idpf).
- Re-segment BIG TCP GSO packets into GSO packets fitting the egress
device limits instead of plain MSS-sized segments, improving
throughput for mixed BIG TCP / non-BIG TCP paths by up to 70%.
- Generate RSS keys that spread flows over all the RX queues; the
previous random keys could leave some queues unused.
- Optimize the bridge VLAN forwarding paths: cache the port-VLAN in
fdb entries and consider only VLAN members when flooding, for ~10%
more Mpps in the fdb forwarding path.
- A few TCP/IP performance improvements aimed at efficient cache
usage and reducing contention.
- Add the TCP ROCCET congestion control, a CUBIC variant aimed at
avoiding bufferbloat in cellular networks.
- Continue the conversion of getsockopt callbacks to sockopt_t.
- Add an ethtool command to list the front-facing ports of an
interface, including SFP cages and modules, using the phy_port
representation.
- Enable BIG TCP support for bareudp tunnels.
- Remove the IPV6_ADDRFORM socket option and disallow buggy TCP state
transitions (listen() + shutdown() + connect() and connect() +
connect(AF_UNSPEC) + listen()).
- Remove most BUG_ON()s from core packet processing, replacing them
with error paths.
Wireless:
- Latency improvements, including lockless station get/dump and
beacon updates, plus RTNL reduction and locking cleanups.
- Infrastructure for non-station TX/RX with MLO.
- NAN (Wi-Fi Aware) Instant Communication support and other NAN
improvements.
- Control frame Integrity Protocol (CIP) and protected TWT support.
- Improvements for AP regulatory checks.
Netfilter:
- Disable br_netfilter in user namespaces and schedule it for removal
in 2027.
- Restrict the raw table in nft_compat to the specific family, hook
and priority.
- Prepare the flowtable for mixed IPv4-over-IPv6 tunneling (and vice
versa).
- Use GFP_KERNEL_ACCOUNT for most netfilter allocations, for better
integration with memcg.
- Allow discovering conntrack zone filtering support in ctnetlink
dumps, and fix nfnetlink_hook handling of large dumps.
Deletions:
- Move the LLC type 2 sockets out of tree. There are no known users
and the code attracts a never-ending stream of LLM-driven fixes.
Device drivers:
- New drivers:
- Meta Platforms NIC (mpnic), the second-generation NIC from Meta
- initial skeleton of the Nebula-matrix NICs driver (nbl)
- X-Powers AC200/AC300 Fast Ethernet PHYs
- Ethernet high-speed NICs:
- Intel:
- i40e: XDP metadata support for RX hash and VLAN tag
- ice: expose the E825 TSPLL state via the DPLL subsystem
- nVidia/Mellanox:
- move the data direct infrastructure from IB to core, in
preparation for netdev support.
- reduce the memory used per offloaded TC rule
- Meta (fbnic):
- support large io_uring zero-copy RX buffers
- Microsoft vNIC (mana):
- add BQL support
- Ethernet NICs consumer, and embedded:
- Airoha:
- LRO offload support
- Cadence (macb):
- context swapping for ringparam and MTU changes, avoiding
buffer loss under memory pressure
- Mucse (rnpgbe):
- TX/RX and link status support
- NXP (enetc):
- SR-IOV improvements and VF support for ENETC v4
- Qualcomm (ppe):
- IPQ5424 support
- Realtek PCI (r8169):
- phylink support
- RSS support for RTL8127
- Renesas (ravb):
- gPTP support for R-Car Gen4
- Synopsys (stmmac):
- XDP multi-buffer support on the TX side
- tc mqprio hw queue priority offload
- support for RK3568 SGMII, Allwinner H616 EMAC1, UltraRISC
DP1000 and Qualcomm sa8255p
- Ethernet switches:
- Mediatek (mt7530):
- fast age and change conduit support
- Microchip (ksz):
- support for KSZ8995XA/KS8995XA
- Microchip (lan966x):
- PCIe FDMA support, ~20x throughput increase in PCIe endpoint
- Microchip (sparx5):
- Time Aware Shaper (taprio) offload
- Motorcomm (yt921x):
- LED and SerDes PCS support
- Realtek (rtl8365mb):
- EEE support
- Ethernet PHYs:
- Broadcom:
- enable jumbo frames on BCM54xx
- Realtek:
- support for RTL8261CE_CG and RTL8261D_VM
- MDIO support for RTL838x and RTL839x
- WiFi drivers:
- Broadcom (brcmfmac):
- FT/OKC roaming offload
- Intel (iwlwifi):
- UHR sniffer support
- support for newer UEFI/BIOS tables
- MediaTek (mt76):
- mt7925 NAN improvements
- offchannel/scan improvements and MLO fixes
- Morse Micro (mm81x):
- monitor mode support
- Qualcomm (ath12k):
- IPQ5332 platform infrastructure
- Realtek (rtw88):
- RTL8723BS support
- SDIO TX performance improvements
- Realtek (rtw89):
- P2P_DEVICE support
- BT-coex updates for RTL8922D
- Bluetooth:
- move H:4 reassembly into the Bluetooth core
- add generic support for vendor packets
- MGMT: add security level changed event
- Bluetooth drivers:
- btusb: support Bulk Serialization Mode
- Intel: support Draco and Titan Lake, allow unsigned firmware
- Mediatek: MT7928 support
- Qualcomm: QCC2072 support
- Broadcom: Synaptics 4384 support"
* tag 'net-next-7.4' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net-next: (2126 commits)
Bluetooth: btusb: disable by default Qualcomm multi-subsystem
tipc: fix broadcast sender hang on last acker departure
tipc: fix use-after-free of broadcast reception link at node release
r8169: clear TX LPI on RTL8168h at link up after phylink conversion
tun: Require CAP_NET_ADMIN to attach to an ownerless device
net/sched/sch_cake: drop dead nla_nest_end() error check
net/sched/sch_cake: widen buffer_used to u64
net/sched/sch_cake: reduce parent backlog when clearing a tin
net/sched/sch_cake: serialize reconfiguration with the datapath
tg3: Add Datto SIRIS 5 1U Server to restart AER quirk table
net/mlx5e: Stop asserting for RTNL when closing channels
net: shrink the payload-only part of skb dataref to one bit
net: wwan: iosm: validate msg_head before indexing msg_ring
net: bgmac: rate limit RX error messages
selftests: net: veth: test XDP_TX to a peer with GRO enabled
veth: schedule the peer's NAPI after XDP_TX when only GRO is enabled
pppoe: delete session hash entries by pointer match
net: lan969x: don't disable hardirqs in fdma tx clear
net: sparx5/lan969x: do not clobber the PSFP cycle timer update period
net: lan969x: fix DSM calendar for empty taxis
...
|
|
git://git.kernel.org/pub/scm/linux/kernel/git/kees/linux
Pull hardening updates from Kees Cook:
- Provide kmalloc_obj*-style API for devm_kmalloc()
- Improve seq_buf API for saner C String handling with several bug
fixes along the way (Kees Cook, Bill Wendling)
- Overflow helper readability improvements (Bill Wendling)
- Unexport native_write_cr4() (Dennis Chen)
- um: fix CONFIG_GCOV for built-in code (Johannes Berg)
- Improve stackinit test coverage (Justin Stitt)
- KMSAN: fix memset() when using fortify-source, again (Arnd Bergmann)
- lkdtm: use kmalloc() instead of __get_free_page (Mahad Ibrahim)
- signalfd: don't dequeue the forced fatal signals (Oleg Nesterov)
- Fix randstruct to recognize new container_of() behavior
- coccinelle: kmalloc_obj: Convert multi-byte integral allocations too
- Fix a couple remaining allocation return type mismatches
* tag 'hardening-v7.4-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/kees/linux: (29 commits)
overflow: Match arithmetic in both parts of __builtin_choose_expr
lkdtm: Make UNSET_SMEP built-in-only and unexport native_write_cr4()
extcon: realtek: Remove const from type_c_cfg allocation type
coresight: cti: Add const to con_groups allocation type
docs: core-api: Document the seq_buf API
nvdimm: ndtest: Return the string length from flags_show()
powerpc/papr_scm: Return the string length from the sysfs show functions
seq_buf: Add seq_buf_init_append()
bpf: Remove dead newline stripping from format_disasm_line()
seq_buf: Add seq_buf_terminate()
seq_buf: Add seq_buf_strlen()
seq_buf: Clear what a writer did not claim when a seq_buf overflows
seq_buf: Copy what fits when seq_buf_puts() and seq_buf_putmem() overflow
scsi: lpfc: Print rx monitor records straight into the seq_buf
seq_buf: Do not pop from an overflowed seq_buf
seq_buf: Do not print an empty line from an overflowed seq_buf_do_printk()
.get_maintainer.ignore: Add Kees Cook
devres: Provide kmalloc_obj*-style API for devm_kmalloc
mm: Move default_gfp() into gfp_types.h
kunit/stackinit: Clean up XFAIL under instrumentation
...
|
|
git://git.kernel.org/pub/scm/linux/kernel/git/kees/linux
Pull execve update Kees Cook:
"Make CIs happier about the execve tests: report the skipped
binfmt_misc_bpf test on stderr (Sasha Levin)"
* tag 'execve-v7.4-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/kees/linux:
selftests/exec: report the skipped binfmt_misc_bpf test on stderr
|
|
git://git.kernel.org/pub/scm/linux/kernel/git/kees/linux
Pull seccomp updates from Kees Cook:
- allow addfd to transfer O_PATH descriptors (Cong Wang)
- allow restarting interrupted unreceived notifications (Cong Wang)
- fix SECCOMP_ADDFD_FLAG_SEND when interrupted (Hui Peng)
- Various docs and test clean-ups
* tag 'seccomp-v7.4-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/kees/linux:
selftests/seccomp: Split fork_and_close into clone and close tests
seccomp: Document RESTART_BEFORE_RECV and O_PATH addfd
selftests/seccomp: test addfd with an O_PATH descriptor
seccomp: allow addfd to transfer O_PATH descriptors
docs/seccomp: describe the SECCOMP_FILTER_FLAG_RESTART_BEFORE_RECV flag
selftests/seccomp: cover restart of unreceived notifications
seccomp: allow restarting interrupted unreceived notifications
seccomp: restore knotif->state when SECCOMP_ADDFD_FLAG_SEND is interrupted
|
|
git://git.kernel.org/pub/scm/linux/kernel/git/kees/linux
Pull pstore updates from Kees Cook:
- don't leave an ERR_PTR in the ramoops zone pointer (Andrea Parri)
- reject persistent RAM zones too small for the buffer header (Andrea Parri)
- publish big_oops_buf after max_compressed_size (Jaidev Shastri)
* tag 'pstore-v7.4-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/kees/linux:
pstore: publish big_oops_buf after max_compressed_size
pstore: reject persistent RAM zones too small for the buffer header
pstore: don't leave an ERR_PTR in the ramoops zone pointer
|
|
git://git.kernel.org/pub/scm/linux/kernel/git/fwctl/fwctl
Pull fwctl update from Jason Gunthorpe:
- One bug fix for a CFI issue in the Rust bindings
* tag 'for-linus-fwctl' of git://git.kernel.org/pub/scm/linux/kernel/git/fwctl/fwctl:
rust: fwctl: declare cfi_encoding for fwctl_rpc_scope
|
|
Pull rdma updates from Jason Gunthorpe:
"A smaller cycle for features, still mostly AI and tool found bug fixes
for long standing issues:
- Bug fixes and minor cleanups across bnxt_re, cxgb4, EFA, ERDMA,
HFI1, HNS, ionic, iRDMA, mlx4/mlx5, rdmavt, rtrs, RXE, SIW, SRP,
isert and IPoIB. Lots of error unwind leaks, integer overflows, and
use after free during teardown from timers/work that was not
cancelled
- Core fixes for uverbs DMABUF lifetime, RMPP reassembly use after
free, multicast rb-tree corruption, restrack, and a user
triggerable NULL deref when creating a WQ without a CQ
- Prevent userspace from getting a writable mmap of the cxgb4 status
page and the mlx4 clock page
- Many rxe hardening fixes for bad user and network input, plus
netdev and tunnel socket lifetime fixes
- Peer supplied values are now validated in rtrs-clt, which is remote
triggerable
- umem now picks the DMA direction from the access flags instead of
always using DMA_BIDIRECTIONAL, so an IOMMU can stop the device
from writing to read-only memory. Several drivers were fixed to pin
CQ and queue memory as writable to go along with this
- SRQ support, firmware assigned CQ IDs and RCQ userspace support for
ionic
- RC QP improvements in MANA: MMQ creation, fixed size send WQEs and
power of two send queues. Also multi-port GSI QPs and a rework of
the UD send/receive and CQ polling paths
- Relaxed ordering MRs for EFA
- Non-contiguous kernel QP and CQ buffers for ERDMA
- Move the mlx5 data direct infrastructure from mlx5_ib to mlx5_core
so netdev can use it too. The data direct PCI driver is now named
"mlx5_dd"
- debugfs knob in hns to fix the SL used by the GSI QP, working
around a HW problem with dropped CQEs
- Selftest fixes, removal of the qib sysfs ABI docs, DT schema
conversion for hns, and MANA maintainer handover"
* tag 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/rdma/rdma: (153 commits)
RDMA/irdma: Bound in-flight CQP ops across deferred completions
RDMA/mlx5: Validate priority in STEERING_ANCHOR_CREATE handler
RDMA/mlx5: Fix CQ resize destination index mask
RDMA/usnic: Bound buffer size to sizeof(buf) in flowinfo_read()
RDMA/rxe: Clear pkt->qp before the early drop exits in rxe_rcv()
dt-bindings: infiniband: Convert hisilicon,hns-roce-v1 to DT schema
RDMA/srp: Avoid reading uninitialized has_port on srp_parse_in() failure
RDMA/irdma: Fix PBLE_LEVEL_2 FRWR generation
RDMA/core: Reject LAG selection when source MAC lookup fails
RDMA/core: Free unpublished port statistics after initial-read failure
RDMA/core: Preserve the selected source GID on failed AH modification
RDMA/uverbs: Fix DMABUF use-after-free during ufile cleanup
RDMA/uverbs: Fix uobject leak in DMABUF release
RDMA/irdma: Fix FRWR IRDMAQPSQ_PBLADDR field population
IB/rdmavt: Fix error unwind path for qp_priv_init() in rvt_create_qp()
RDMA/irdma: Check MR contiguity before PBLE alloc
IB/mlx4: Avoid requeueing executing CM timeout work
RDMA/rxe: bound the WQE opcode before indexing rxe_wr_opcode_info[]
RDMA/rxe: Fix out-of-range unsigned-to-signed conversion for RDMA message in 2GiB size
RDMA/rxe: validate inline sge_offset in finish_packet() before indexing inline_data[]
...
|
|
git://git.kernel.org/pub/scm/linux/kernel/git/jgg/iommufd
Pull iommufd updates from Jason Gunthorpe:
"Several bug fixes, probably found by AI based on the emails:
- Several edge cases in the self test
- Reject malformed invalidation commands in case the VMM let them
through
- Rework how the invalidation interface works to the drivers to be
more robust and fix several Sashiko issues
- Correct several error unwind paths
- UAF during eventq file release
- Reject more malformed usage of the dirty tracking by the VMM"
* tag 'for-linus-iommufd' of git://git.kernel.org/pub/scm/linux/kernel/git/jgg/iommufd:
iommupt: Do not allow PTEs to be split when dirty logging
iommufd/iova_bitmap: Ensure that iova_bitmap_set() handles the full IOVA
iommufd: Reject a zero-length dirty bitmap request
iommufd/iova_bitmap: Fail GET_DIRTY_BITMAP when a bitmap page cannot be pinned
iommufd: Fix event queue release use-after-free
iommufd: Keep dmabuf PFNs MMIO when filling another domain
iommufd: Keep reserved IOVA ranges when a replace within one IOAS fails
iommufd: Fix iommufd_hw_capabilities reference in kernel-doc
iommu/vt-d: Convert nested cache invalidation to the core array loop
iommu/arm-smmu-v3-iommufd: Convert cache invalidation to the core array loop
iommufd/selftest: Convert cache invalidation mocks to the core array loop
iommufd: Iterate the cache invalidation array in the core
iommu/arm-smmu-v3-iommufd: Reject unsupported bits in invalidation commands
iommufd/selftest: Skip when the mock device is not there
iommufd/selftest: Return dmabuf fd from IOMMU_TEST_OP_DMABUF_GET again
|
|
Pull TSM update from Jason Gunthorpe:
"One patch to update the maintainers file following Dan's passing for
TSM subsystem. Three people have volunteered to help complete this
work"
* tag 'for-linus-tsm' of https://github.com/jgunthorpe/linux:
coco/tsm: Update maintainership
|
|
git://git.kernel.org/pub/scm/linux/kernel/git/tj/sched_ext
Pull sched_ext updates from Tejun Heo:
- Proxy execution can now be enabled together with sched_ext. A BPF
scheduler can opt in to receive mutex-blocked tasks that donate their
scheduling context to the lock owner and place them itself.
- Lazy preemption: a BPF scheduler can preempt or kick a CPU lazily,
deferring the switch to the next return to user space or tick, as the
fair class can.
- Sub-schedulers: a parent now learns which child runs on each CPU it
delegated and when a cap change takes effect. A detaching child loses
its caps before the parent restores the CPUs.
- New kfuncs re-enqueue single tasks from a dispatch queue iteration
and report a cgroup's CPU count and a CID's NUMA node. The CID
topology now includes clusters.
- Hot path optimizations: dispatch queue and task lookups compare keys
inline, remote task moves no longer take a dispatch queue lock twice,
and sub-scheduler hooks cost nothing without sub-schedulers.
- Kfuncs callable from tracing programs are hardened against NMI and
IRQ nesting, which could hard-lock the CPU or pick a wrong idle CPU.
- Built-in dispatch queues no longer allocate per-CPU state that grew
with the square of the CPU count.
- Header syncs with the scx repo, a BTF workaround for pahole 1.32, and
selftest fixes and coverage.
* tag 'sched_ext-for-7.4' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/sched_ext: (69 commits)
sched_ext: Drop the locks periodically while walking a user DSQ for re-enqueue
sched_ext: scx_qmap: Also re-enqueue stranded tasks with scx_bpf_dsq_reenq_task()
sched_ext: Add scx_bpf_dsq_reenq_task() to re-enqueue single tasks from a DSQ iteration
sched_ext: Factor out the rq lock switch of scx_dsq_move()
sched_ext: Don't queue balance callbacks from a core-sched pick
sched_ext: Don't leave balance callbacks queued across a pick retry
sched_ext: Fix a bypassed task stalling on a cpu its scheduler has no caps on
sched_ext: Fix the running task keeping its protection into bypass
sched_ext: Fix use-after-free of a local reenq node left on an inactive cpu
sched_ext: Keep proxy donors with slice left on the local DSQ
selftests/sched_ext: Report reload_loop attach failures
selftests/sched_ext: Bound exit waits
selftests/sched_ext: Add SCX_ASSERT_ALIVE and adopt it
selftests/sched_ext: Fail loudly when EXIT_KIND is missing from BTF
sched_ext: Add SCX_ECODE_RSN_CGROUP_OFFLINE to user_exit_info.h
selftests/sched_ext: Fix reload_loop error-path use-after-free
selftests/sched_ext: Fix build error in dequeue_remote selftest
sched_ext: scx_qmap: Reset a child's cpuperf targets once its PERF revoke takes effect
sched_ext: Add ops.sub_child_ecaps_updated() to report a child's effective cap changes
sched_ext: scx_qmap: Show actual cid use per participant
...
|
|
git://git.kernel.org/pub/scm/linux/kernel/git/tj/cgroup
Pull cgroup updates from Tejun Heo:
- A write to cgroup.subtree_control or cgroup.type could hang in D
state for as long as a task pinning a dying controller took to exit,
as syzbot reported. The wait is now interruptible.
- cpuset: the deadline bandwidth check ran on cpusets that weren't
valid partition roots, failing cpuset writes with -EBUSY while
deadline tasks existed. The CPU count the fair class takes from
cpuset assumed a shared hierarchy that cgroup1 may not have.
- Finding a cgroup's effective controller state no longer walks up the
hierarchy, for per-I/O users such as nvmet. io.stat reads of cgroups
without block devices skip the stat flush.
- cpuset v1-only code moved to the v1 file and the exclusive flag
dropped from v2, with documentation corrections for partition roots
and boot-isolated CPUs.
- Dead cgroups fail writes with -ENODEV consistently, plus small
cleanups.
- Selftest fixes, most visibly for tests that skipped on machines with
many mounts, and a new pids.events notification test.
* tag 'cgroup-for-7.4' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/cgroup: (27 commits)
selftests/cgroup: test pids.events notification
selftests: cgroup: make test_memcg_sock check flushed sock stats
selftests: cgroup: skip test_memcg_sock under cgroup.memory=nosocket
selftests/cgroup: Free the paths returned by cg_control()
selftests: memcg: Don't close an uninitialized fd
cgroup: Track the effective css in each cgroup
cgroup/cpuset: Move cpuset_update_flag() to cpuset-v1.c
selftests: cgroup: Preserve command arguments in with_stress.sh
selftests: cgroup: Enable the cpu controller in test_cpu
cgroup/cpuset: Use cpuset_v2() in cpuset_num_cpus()
selftests/cgroup: add settings file with a longer timeout
cgroup/cpuset: Remove CS_CPU_EXCLUSIVE handling code from v2
cgroup/cpuset: Run SCHED_DEADLINE shrink test on valid partition root only
docs: cgroup-v2: Describe effective CPUs of partition roots
docs: cgroup-v2: Describe boot-isolated CPUs in cpuset.cpus.isolated
cgroup/cpuset: Remove redundant sched domain rebuild from update_prstate()
selftests/cgroup: don't crash on a truncated mount entry in cg_find_root()
selftests/cgroup: read the entire file in read_text()
blk-cgroup: skip rstat flush for cgroups without blkgs
cgroup: use assign_bit() where applicable
...
|
|
Pull workqueue updates from Tejun Heo:
- Flushing a workqueue now visits only the queues used since the last
flush instead of one per possible CPU. Idle flushes get 10 to 100
times faster on large machines, which XFS hits on every log force.
- Per-cpu workqueues are built through the same attribute path as
unbound ones and get a max_active of their own, continuing the work
to turn them into an affinity scope of unbound workqueues.
- New tracepoints for work items turning CPU-intensive, rescuer mayday
and rescue events, and BH workers yielding with work pending.
- A KCSAN annotation and small cleanups
* tag 'wq-for-7.4' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/wq:
workqueue: mark pool->nr_running as __data_racy
workqueue: BUG_ON() a pwq release before workqueue_init()
workqueue: Derive the standard attrs from the workqueue flags
workqueue: Give percpu workqueues their own max_active
workqueue: Make flush_workqueue() visit only pwqs active since the last flush
workqueue: Maintain pwq->total_in_flight
workqueue: Add for_each_node_with_fallback()
workqueue: Fix typo "upto" in comment
workqueue: Add workqueue_bh_budget_yield tracepoint
workqueue: Add workqueue_mayday and workqueue_rescued tracepoints
workqueue: Add workqueue_cpu_intensive tracepoint
workqueue: rename the pwq slot helpers shared with percpu
workqueue: build percpu pwqs through the attrs path
workqueue: make the default pwq optional
workqueue: resolve the backing pool in alloc_pwq()
workqueue: move the unbound-only attrs check to apply_workqueue_attrs()
|
|
git://git.kernel.org/pub/scm/linux/kernel/git/jarkko/linux-tpmdd
Pull keys updates from Jarkko Sakkinen:
"Highlight:
- Don't leak local kernel addresses (and complement the ongoing
rhashtable migration) (Kyle Zeng)
The index value for the associative array has been calculated with
the following formula:
mult_64x32_and_fold(description + type address + domain address)
By creating a sequence of dummy keys (e.g., "A", "B", "C", ...), it
is trivial to form a group of equations with a predictable hash
function, and ultimately break KASLR.
Kyle's solution is based on an ephemeral SipHash key and an atomic
64-bit counter, which is encapsulated to a key_index_id(). This
function is then used to assign identifiers for types and domains,
and since the IDs are unique for each power on, they are as unique
as memory addresses are.
With these ingredients the index value calculation can be changed
into form, which is not leaking any kernel addresses:
SipHash(description + type id + domain id)
Features and improvements:
- TPM fields were moved from trusted_key_options to the TPM backend.
They cost memory for non-TPM backends.
- A TPM trusted key now caches tpm_is_tpm2() at the root of each call
chain, and passes the result as a parameter. This decreases the
amount of I/O traffic given that tpm_is_tpm2() starts and stops the
chip via tpm_try_get_ops() and tpm_put_ops().
Bugfixes:
- A TPM trusted key corrupted the return value of a failed key
unsealing operation if the pcrlock feature was used.
- A TPM 2 trusted key allocated an off-by-four too large buffer for
the decoded ASN.1 blob coming from keyctl add trusted.
- Sometimes a TPM 2 trusted key rejected created keys based on the
TPM2_Create response size, treating them as too large. Now it
correctly checks the extracted TPM2 key blob size.
- The keyctl reject operation raced with keyctl restrict_keyring
because keyring->sem was not held in key_reject_and_link() before
accessing keyring->restrict_link.
- keyctl_describe_key() was not holding key->sem while accessing its
fields, which can lead to use-after-free of a retired key type.
- find_keyring_by_name() and procfs code were reading the UID from
key->user->uid instead of key->uid. The latter is the cached value
and is meant to protect against a use-after-free caused by keyctl
chown.
- search_process_keyrings_rcu() did not properly RCU-dereference the
authorization key payload, which could cause a null dereference if
the payload was revoked.
- keyctl_read_key() checked key->type->read without holding key->sem,
which can lead to use-after-free if the type is retired. Based on
my suggestion, this was addressed in __keyctl_read_key(), which
already did take key->sem"
* tag 'keys-v7.4-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/jarkko/linux-tpmdd:
keys/trusted_keys: reuse TPM version in option handling
security: keys: Fix comment of search_process_keyrings_rcu()
keys/trusted/tpm2: Validate TPM2_Create object sizes separately
keys/trusted_keys: move TPM-specific fields into struct trusted_key_tpm
keys: Protect the read method check against type removal
keys: Avoid owner account dereferences in /proc/keys
keys: make keyring indexes independent of kernel addresses
keys: Check the authorization payload in process keyring searches
keys: Avoid the owner account dereference in named keyring lookup
keys: Protect the type name while describing a key
KEYS: Fix key_reject_and_link() race with keyring restriction
KEYS: trusted: Fix blob allocation size in tpm2_key_decode()
keys/trusted_keys: return immediately after TPM unseal failure
|
|
git://git.kernel.org/pub/scm/linux/kernel/git/mic/linux
Pull Landlock update from Mickaël Salaün:
"The main change adds composable Landlock controls for namespace types
and Linux capabilities, thanks to new LSM hooks (merged via the LSM
tree). A umount race condition is also fixed"
* tag 'landlock-7.4-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/mic/linux:
landlock: Fix superblock use-after-free in release_inode()
selftests/landlock: Fix snprintf truncation checks in test files
landlock: Add documentation for capability and namespace restrictions
samples/landlock: Add capability and namespace restriction support
selftests/landlock: Add capability restriction tests
selftests/landlock: Add namespace restriction tests
landlock: Enforce capability restrictions
landlock: Enforce namespace use restrictions
landlock: Wrap per-layer access masks in struct layer_config
landlock: Rename quiet_masks to quiet_access
|
|
git://git.kernel.org/pub/scm/linux/kernel/git/wufan/ipe
Pull IPE updates from Fan Wu:
- Fix an extra empty audit record on enforcement changes
ipe_audit_enforce() started an audit buffer but logged the state
change with audit_log(), which emits its own record. Ending the
unused buffer produced an additional empty AUDIT_MAC_STATUS record
every time the enforcement state was changed.
- Keep the name and token tables in sync with their enums
The audit name tables now use designated initializers, so each name
stays bound to its enum value, and static assertions on the policy
parser token tables break the build if an enum value is added without
a matching token.
- Constify token_default() and correct a comment about policy text
ownership, with no functional changes
- Fix an invalid sgid value in an audit event example in the docs
- Point the docs to the new IPE website and test suite repository
* tag 'ipe-pr-20261019' of git://git.kernel.org/pub/scm/linux/kernel/git/wufan/ipe:
ipe: update the project and test suite links
ipe: fix enforcement audit
ipe: correct policy text ownership comment
ipe: check parser token table sizes
ipe: use designated initializers for audit name tables
ipe: constify token_default()
ipe: fix invalid sgid value in audit event documentation
|
|
git://git.kernel.org/pub/scm/linux/kernel/git/zohar/linux-integrity
Pull IMA updates from Mimi Zohar:
"Cleanup:
- Update ima_audit_msg() to report errno directly, revert making it a
wrapper for ima_audit_message(), and remove ima_audit_message()
Two bug fixes when carrying the IMA measurement list across kexec:
- Restore the number of violations in the IMA measurement list
- Reject restoring IMA measurement list record(s) beyond the expected
buffer size (out-of-bounds)"
* tag 'integrity-v7.4' of git://git.kernel.org/pub/scm/linux/kernel/git/zohar/linux-integrity:
ima: reject a kexec buffer whose declared size exceeds the buffer
ima: recover number of violations after kexec
integrity: Replace integrity_audit_message() with integrity_audit_msg()
integrity: Report error code in integrity_audit_msg() call sites
|
|
git://git.kernel.org/pub/scm/linux/kernel/git/herbert/crypto-2.6
Pull crypto updates from Herbert Xu:
"API:
- Fix algif_skcipher source SG overrun
- Allow hmac(sha512) for non-root users
Algorithms:
- Add wrapper for zeroing AES key context
- Avoid redundant stream initialisations in zstd
Drivers:
- Remove hisilicon/sec.
- Handle digest-only authenc requests in atmel
- Handle zero-length skcipher requests in mxs-dcp
- Lower the default priority of caam/qi2
Others:
- Optimise key comparison in rhashtable lookup that uses constant
parameters"
* tag 'v7.4-p1' of git://git.kernel.org/pub/scm/linux/kernel/git/herbert/crypto-2.6: (146 commits)
crypto: atmel-tdes - consolidate error paths in atmel_tdes_dma_init()
crypto: atmel-tdes - reuse fast in atmel_tdes_crypt_start()
crypto: atmel-tdes - use separate DMA scatterlists
MAINTAINERS: delete entry for John Allen
hwrng: amd - use PMBASE_OFFSET consistently
hwrng: cctrng - simplify cctrng_probe()
hwrng: intel - simplify intel_rng_mod_init()
crypto: qat - fix use of destroyed vf2pf_lock on VF restart
crypto: qat - initialise state_lock on every path in adf_devmgr_add_dev()
hwrng: imx-rngc - Use optional clock
crypto: talitos - init tasklets before requesting IRQs
crypto: algif_skcipher - rewind rounded output bytes
crypto: algif_hash - Allow hmac(sha512) for unpriviledged users
crypto: sa2ul - Remove unused fields
hwrng: stm32 - use devm_platform_ioremap_resource() in stm32_rng_probe()
hwrng: stm32 - drop redundant initializations
hwrng: amd - simplify control flow in amd_rng_mod_init()
hwrng: stm32 - reuse clock rate in stm32_rng_clock_freq_restrain()
hwrng: stm32 - use swap() in stm32_rng_probe()
hwrng: cctrng - drop redundant initializations
...
|
|
git://git.kernel.org/pub/scm/linux/kernel/git/shuah/linux-kselftest
Pull kunit update from Shuah Khan:
"A single fix to kunit_run_all_tests() to return void since callers
don't check the return value and the integer return type is a remnant
from when the function was executed as initcall which is no longer the
case"
* tag 'linux_kselftest-kunit-7.4-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/shuah/linux-kselftest:
kunit: Return void from kunit_run_all_tests()
|
|
git://git.kernel.org/pub/scm/linux/kernel/git/shuah/linux-kselftest
Pull kselftest updates from Shuah Khan:
- Improve selftest build, run-time, and install framework
Install even when some modules fail to build, print summary of test
results at the end of the default test run, keep the build status
from wrapping to success so build errors are reported, and optionally
record per-suite build and install results.
- Add LLVM support to kselftest_deps.sh
- Fix resctrl, breakpoints suspend, ftrace, and tracing tests
- Fix and enhance resctrl test
* tag 'linux_kselftest-next-7.4-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/shuah/linux-kselftest:
selftests: breakpoints: Skip step_after_suspend_test on systems without a wakeup capable RTC
selftests: optionally record per-suite build and install results
selftests: keep the build status from wrapping to success
selftests/ftrace: Add nice dependency
selftests: kselftest_deps.sh: Support LLVM
selftests: lib.mk: Don't fail install if no modules were built
selftests/ftrace: Avoid unlink error on first run
tracing/selftests: Fix incorrect invocation of exit_fail
selftests/lib.mk: run_tests: print summary at the end
selftests/ftrace: skip gcov symbols when picking a function to probe
selftests/resctrl: Enable dynamic management of IMC counters via linked list
selftests/resctrl: Replace counter index references with pointers
selftests/resctrl: Introduce linked list management for IMC counters
selftests/resctrl: Skip L3_CAT when no exclusive cache portion exists
|
|
git://git.kernel.org/pub/scm/linux/kernel/git/uml/linux
Pull UML updates from Johannes Berg:
- NOMMU support, mostly for mm/ testing
The only bigger change, we added support for building with
!CONFIG_MMU, mostly for testing, e.g. via kunit. Some new
selftests targetted to NOMMU are moving elsewhere, but are
runnable on ARCH=um without MMU.
- Tighter page permissions
Tighten page permissions to catch more bugs (ARCH=um is,
after all, often used for testing), and also mark __init
memory inaccessible for the same reason.
- Various maintenance/cleanups
Fix build on really old hosts, fix leaks, make the code a
bit more robust, header cleanups, typo fixes, the usual.
* tag 'uml-for-7.4' of git://git.kernel.org/pub/scm/linux/kernel/git/uml/linux: (38 commits)
um: place large BSS inputs in an output section
um: fix shutdown __inittext access
um: time-travel: fix sched_yield() behaviour
um: require MMU for UML PCI support
um: vector: avoid NULL queue dereference in legacy RX mode
um: use %pB to print functions in stack traces
um: mprotect() __init memory
um: move init text between __init_begin/end
um: improve checking for --no-warn-rwx-segments
um: make stub compilation more robust
um: link .lbss/.ldata/.lrodata correctly
um: add perf-event support
x86/um: remove unused <asm/required-features.h> header
um: fix typo "hander" in comment
um: Add definition of __NR_close_range for older host OSs
um: virtio_uml: switch to dynamic root device
um: Tighten exec permissions on page mappings
Documentation: um: document nommu UML
um: allow deselecting CONFIG_MMU
um: nommu: add userspace runner processes
...
|
|
git://git.kernel.org/pub/scm/linux/kernel/git/powerpc/linux
Pull powerpc updates from Madhavan Srinivasan:
- powerpc/numa: Support coregroup on PowerNV
- powerpc/irq: Move __softirq_pending out of irq_stat
- powerpc/512x: Remove pdm360ng platform setup in favor of mpc512x_generic
- powerpc/ps3: Simplify control flow in ps3_{virq,irq_plug}_setup()
- KVM: PPC: Book3S HV: Add preempt_disable() around virtual-mode HPTE bit-lock users
- powerpc/syscall: Avoid atomic test_and_clear_thread_flag on fast path
- pseries/plpks cleanup and fixes
- Misc fixes and cleanup
Thanks to Abhishek Dubey, Amit Machhiwal, Anushree Mathur, Bui Nguyen
Nhu Quynh, Christophe Leroy (CS GROUP), Dmitry Torokhov, Gaurav Batra,
Gautam Menghani, Geert Uytterhoeven, Greg Joyce, Hari Bathini, Harsh
Prateek Bora, Karl Mehltretter, Link Mauve, Michal Suchánek, Mukesh
Kumar Chaurasiya (IBM), Nayna Jain, Ritesh Harjani (IBM), R Nageswara
Sastry, Saket Kumar Bhaskar, Samir Mulani, Shivang Upadhyay, Shrikanth
Hegde, Sourabh Jain, Srikar Dronamraju, Srish Srinivasan, Thorsten Blum,
Vaibhav Jain (IBM), Venkat Rao Bagalkote, and Yeswanth Krishna Tellakula
* tag 'powerpc-7.4-1' of git://git.kernel.org/pub/scm/linux/kernel/git/powerpc/linux: (44 commits)
powerpc/numa: Support coregroup on PowerNV
powerpc/numa: Allow cpu_to_coregroup_id without PPC_SPLPAR
powerpc/numa: Simplify find_primary_domain_index
powerpc/fadump: collect dump when CPU_STATE_DATA is less than reserved
powerpc/syscall: Avoid atomic test_and_clear_thread_flag on fast path
powerpc/kasan: fix r2 corruption in mem*() on GENERIC_ENTRY with old compilers
powerpc: fix NMI exit ordering: restore soft masks after irqentry_nmi_exit()
powerpc/pseries/iommu: Add TCEs for 16GB pages when RAM is pre-mapped
KVM: PPC: Book3S HV: Free the queue pages in error path
KVM: PPC: Book3S HV: Add missing mappings for tracing exits
powerpc/interrupt: Use early_radix_enabled() in NMI real-mode guard
KVM: PPC: Fix get_d_signext() 12-bit displacement for paired-single D-form
KVM: PPC: Book3S HV: Add preempt_disable() around virtual-mode HPTE bit-lock users
KVM: PPC: Book3S HV: Add SRCU protection for virtual-mode HPT hcalls
pseries/plpks: update PKS documentation and MAINTAINERS entry
pseries/plpks: rename the default wrapping key macro
pseries/plpks: make narrowing conversions explicit
pseries/plpks: hide wrapping_features when unsupported
pseries/plpks: fix self-reference in plpks_var initializer
pseries/plpks: clear SED key data after use
...
|
|
git://git.kernel.org/pub/scm/linux/kernel/git/mattst88/alpha
Pull alpha floating point emulation fix from Matt Turner:
"Make the FP emulation determine tininess after rounding, as the
hardware does.
soft-fp always determined it before rounding, so an operation that
trapped for software completion could report an underflow the same
operation would not report when it did not trap. glibc's math
testsuite catches the disagreement.
This adds _FP_TININESS_AFTER_ROUNDING to the shared soft-fp code in
include/math-emu/, as glibc's copy already has, and sets it only for
alpha. It defaults to zero, so powerpc, sh and sparc are unchanged.
This is the last patch of a three-patch series; the first two were
merged for v7.3"
* tag 'alpha-fixes-v7.4' of git://git.kernel.org/pub/scm/linux/kernel/git/mattst88/alpha:
alpha: determine tininess after rounding in the FP emulation
|
|
Pull ARM updates from Russell King:
- remove supersection support
- set "current" earlier to avoid KASAN issues
- fix a couple of corner cases in the alignment handler
- fix wrong free function in iommu allocation path
- cacheinfo updates
- properly align hugetlb mappings
- always set endianness on xscale
- fix clang backtracer
- avoid replacing active_asids if already 0
* tag 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/rmk/linux:
ARM: 9493/1: asid: Do not replace active_asids if already 0
ARM: 9490/1: backtrace-clang: fix wrong sp usage for unwinding
ARM: 9482/5: decompressor: always set endianess on xscale
ARM: 9524/1: mm: align hugetlb mappings to the huge page size
ARM: 9523/1: topology: allocate the cacheinfo early on the boot CPU
ARM: 9522/1: cacheinfo: guard the CLIDR read in populate_cache_leaves()
ARM: 9521/1: cacheinfo: count external caches in early_cache_level()
ARM: 9520/1: cacheinfo: avoid out-of-bounds write in populate_cache_leaves()
ARM: 9519/1: dma-mapping: Fix wrong free function in __iommu_alloc_simple() error path
ARM: 9492/1: alignment: fix LSR #32 and ASR #32 offset decoding
ARM: 9491/1: alignment: restore uaccess state on emulation fault
ARM: 9488/1: smp: set current pointer in assembly before jumping into C
ARM: 9486/1: set !LPAE MAX_PHYSMEM_BITS to 32 and remove supersection mappings
|
|
Pull ARM SoC board file updates from Arnd Bergmann:
"These are mostly smaller cleanups for the remaining platform code in
arch/arm/, the most notable one being the conversion of the
s3c/crag6410 board to use software nodes for GPIO references in place
of plain GPIO numbers.
The earlier plan was to drop the deprecated (since 7.3) board files
here, which would have been a much larger set of changes, but that is
now deferred to 7.5"
* tag 'soc-arm-7.4' of git://git.kernel.org/pub/scm/linux/kernel/git/soc/soc:
MAINTAINERS: Drop arm64 dts/intel path from ARM/SOCFPGA ARCHITECTURE
ARM: tegra: Fix Trun -> Turn typo
ARM: vexpress: fix device_node refcount leak in vexpress_smp_dt_prepare_cpus()
ARM: vexpress: fix device_node refcount leak in vexpress_flags_set()
MAINTAINERS: Change ARM Visconti5 architecture maintenance status to Odd Fixes
ARM: mvebu: fix Cortex-A9 errata selection for Armada 38x
ARM: OMAP2+: remove unused ctrl_module_wkup_44xx.h header
ARM: EXYNOS: Replace __ASSEMBLY__ with __ASSEMBLER__
ARM: s3c: crag6410: use software nodes/properties to set up GPIO keys
Input: samsung-keypad - remove support for platform data
ARM: s3c: crag6410: switch keypad device to software properties
ARM: s3c: register and attach software nodes for Samsung gpio_chips
Input: samsung-keypad - handle compact binding
dt-bindings: input: samsung,s3c6410-keypad: introduce compact binding
ARM: imx6q: remove KSZ9021 PHY fixup
ARM: imx: Fix suspend/resume crash with Clang CFI
ARM: OMAP2+: Replace __ASSEMBLY__ with __ASSEMBLER__
soc: imx: Replace __ASSEMBLY__ with __ASSEMBLER__ in header file
ARM: imx: Replace __ASSEMBLY__ with __ASSEMBLER__
MAINTAINERS: Add git tree for TI K3 ARCHITECTURE
|
|
git://git.kernel.org/pub/scm/linux/kernel/git/soc/soc
Pull SoC defconfig updates from Arnd Bergmann:
"Only a few new drivers get enabled this time.
The size of the defconfigs actually shrinks here, though that is only
the result of all the Qualcomm clock drivers now being configured as
modules by default when the corresponding platforms are enabled"
* tag 'soc-defconfig-7.4' of git://git.kernel.org/pub/scm/linux/kernel/git/soc/soc:
arm64: defconfig: Update coreboot firmware symbols
arm64: defconfig: Enable I3C and SPD5118 hwmon
arm64: defconfig: Enable EMC2305 and PCA963x drivers
arm64: defconfig: Switch Qualcomm SDM845, SM8150 and SM8250 drivers to modules
ARM/arm64: defconfig: Drop redundant Qualcomm clock entries
arm64: configs: defconfig: Convert TISCI to modules
arm64: defconfig: Enable PMIC5 Gen3 ADC thermal monitor
arm64: defconfig: Enable QMP PCIe Multi-PHY driver
ARM: shmobile: defconfig: Refresh for v7.3-rc1
arm: multi_v7_defconfig: Enable SND_ALOOP
arm64: defconfig: enable the necessary drivers for the Ayaneo Pocket S2
ARM: omap2plus_defconfig: Support for compressed firmware
ARM: omap2plus_defconfig: Enable SND_ALOOP
|
|
git://git.kernel.org/pub/scm/linux/kernel/git/soc/soc
Pull SoC driver updates from Arnd Bergmann:
"There are lots of minor updates for driver subsystems managed through
the soc tree (turris-omnia platform, cache driver, tee drivers,
arm-cci, bus, memory) as well as soc vendor specific drivers
(starfive, xilinx, microchip, nxp, amlogic, imx, renesas, samsung, ti,
nvidia).
The more notable changes are:
- Larger updates for Qualcomm SoCs including support for SM8950
(Maili) SM8975 (Hawi), Glymur, Shikra, and IPQ5424
- Added SoC support for Exynos5515, Tegra264, Tegra410, R8A774A3, and
MT8167 in existing drivers
- Arm SCMI firmware driver support for ACPI PCC transport and module
autoloading of protocol specific drivers
- Apple crash log support for CrgA embedded controller"
* tag 'soc-drivers-7.4' of git://git.kernel.org/pub/scm/linux/kernel/git/soc/soc: (176 commits)
platform: cznic: turris-omnia-mcu: stop button emulation producers
cache: Make cpu_cache_invalidate_memregion() error out if there are no handlers
soc: mpfs: use kref cleanup on probe failure
arm64: enable HAVE_SHARED_GPIOS for all ARM64 platforms
bus: arm-cci: Drop cci-control-port node reference in __cci_ace_get_port()
bus: arm-cci: Drop CPU node reference in cci_ace_init_ports()
soc: fsl: dpio: Free the IRQ before releasing the I/O object
soc: fsl: dpio: Fix cleanup on IRQ registration failure
bus: fsl-mc: Annotate fsl_mc_io.portal_virt_addr with __counted_by_ptr
bus: fsl-mc: drop the fwnode links of the dpmacs nodes
soc: fsl: cpm1: tsa: Fix clock leak in tsa_of_parse_tdms()
soc: qcom: geni-se: Drop unused icc_ddr parameter from geni_icc_get()
firmware: qcom: scm: Allow QSEECOM on ThinkPad T14s Gen 7
dt-bindings: mailbox: qcom: Document Maili CPUCP mailbox controller
dt-bindings: spmi: glymur-spmi-pmic-arb: Add compatible for Qualcomm Maili SoC
soc: qcom: pmic_pdcharger_ulog: prevent work requeue during remove
ASoC: dt-bindings: qcom,apr: Add modem_apps GLINK channel for shikra
firmware: qcom: tzmem: disable SHM bridge for SM7125 platform
soc: qcom: ubwc: Add Kalambo UBWC config
firmware: qcom: scm: Allow QSEECOM on Kalambo CRD
...
|
|
Pull SoC devicetree updates from Arnd Bergmann:
"This is a rather large update of over 1000 non-merge commits touching
devicetree files and bindings.
A few notable SoC were added this time:
- Apple M4 and A18 Pro are used in laptops, these follow the M3 model
added in 7.2.
- Google Laguna (aka Tensor G5) is used last year's Pixel phone
generation. Unlike the earlier Tensor chips, this is not based on
Samsung's Exynos family design but starts a new chip family.
- Qualcomm's Hawi and Nord SoCs are two powerful chips using the
custom Oryon cores. Product names and applications are so far not
known, which means that Qualcomm is doing something right by
upstreaming kernel support early.
The ST stm32mp23xc/stm32mp25xc SoC support was previously removed
because there were no users upstream, but they are back now that
boards have shown up. Renesas RZ/G2M v3.0 (R8A774A3) is just a minor
variation of the already supported SoC.
In total, there are 81 new dts files for individual boards, and they
are all over the place. Only one riscv based machine is added, the
Milk-V Meles SBC using the T-Head th1520 chip. For 32-bit Arm, we have
13 new boards. About half are industrial embedded boards using NXP
i.MX6/7 chips, the rest are older products: two Amazon tablets, two
Motorola phones and two SoM boards.
Everything else is 64-bit Arm:
- many industrial embedded boards using NXP layerscape, NXP i.MX8/9,
Qualcomm Hamoa, ST stm32mp2, Rockchip rk35xx, and Renesas RZ/G2
SoCs
- Laptops and tablets using Apple M4, Qualcomm Snapdragon X2,
Snapdragon X1 Elite and Allwinner A133 chips
- Valve Steam Frame VR headset using Snapdragon 8 Gen 3
- Seven handheld game consoles using Qualcomm Dragonwing qcs8550
- Mobile phones using Google Tensor G5, Samsung Exynos 850, and
various Qualcomm Snapdragon chips
Aside from the new stuff, there is still a lot going on for existing
socs and boards, including GPU hardware support on MediaTek MT8173
based laptops. Most patches actually add features this time, as the
compile-time diagnostic changes are slowing down"
* tag 'soc-dt-7.4' of git://git.kernel.org/pub/scm/linux/kernel/git/soc/soc: (1022 commits)
arm64: dts: rockchip: Add Radxa E54C
dt-bindings: arm: rockchip: Add Radxa E54C
arm64: dts: rockchip: remove FRL GPIO for 100ASK DshanPi A1
arm64: dts: rockchip: fix M.2 E-key reset pinctrl on rk3588 rock-5-itx
arm64: dts: rockchip: add pcie30phy data-lanes on rk3588 coolpi-cm5-evb
arm64: dts: rockchip: Add the fan tachometers to Kobol Helios64
arm64: dts: rockchip: enable NPU on Radxa E52C
arm64: dts: rockchip: fix adc button voltage on Radxa E52C
riscv: dts: sophgo: sg2002-milkv-duo256m: drop reserved memory node
riscv: dts: sophgo: cv1800b-milkv-duo: drop reserved memory node
arm64: dts: nuvoton: npcm845-evb: Add peripheral nodes
arm64: dts: nuvoton: npcm845-evb: Fix DTS coding style
arm64: dts: nuvoton: npcm845: Add peripheral nodes
arm64: dts: nuvoton: npcm845: Split APB address ranges
riscv: dts: sophgo: cv180x: Fix internal ephy node name
riscv: dts: sophgo: add Milk-V Duo 256M ethernet support overlay
riscv: dts: sophgo: Limit SG2042 SPI NOR to 12.5 MHz
riscv: dts: sophgo: Enable SPI NOR on SRD3-10
riscv: dts: spacemit: set ETH MAC from eeprom for OrangePi
arm64: dts: allwinner: sun50i-h616: Add video engine
...
|
|
git://git.kernel.org/pub/scm/linux/kernel/git/jassibrar/mailbox
Pull mailbox updates from Jassi Brar:
- altera: shut down RX polling timer on channel teardown
- arm-mhu: timeout if receiver never comes up in mhuv2, keep combined
IRQ enabled during suspend in mhuv3, and drop redundant unregister on
probe failure in doorbell
- axiado: fix RX frame draining and error handling, and fix debugfs
name truncation warning
- bcm74110: cap rx_svc_init_list growth to prevent PMC-induced OOM
- hisilicon: convert Hi3660 and Hi6220 bindings to DT schema
- mtk-cmdq: fix runtime PM leak in cmdq_mbox_flush()
- pcc: free channel before unmapping shared memory and serialize
channel updates with teardown
- qcom: guard against NULL con_priv race in IPCC send_data, use
dev_name() for IRQ names, drop stray disable_irq_wake(), read 64-bit
register with readq() in CPUCP, drop redundant unregister on probe
failure, and add SDM670 and IPQ9650 APCS bindings
- rockchip: prefix register defines, simplify device variant handling,
and convert to use dev_err_probe()
- ti-msgmgr: add TDA54 main secure-proxy support and DT bindings, read
exact trailing bytes for non-word-aligned messages, and do not report
RX poll timeout as a send failure
- misc: use designated initializers for acpi_device_id across drivers
* tag 'mailbox-v7.4' of git://git.kernel.org/pub/scm/linux/kernel/git/jassibrar/mailbox: (27 commits)
mailbox: Use named initializers for acpi_device_id
mailbox: qcom-cpucp: read mbox hardware register using readq()
mailbox: qcom-ipcc: remove stray disable_irq_wake() call
mailbox: qcom-ipcc: Use dev_name() as IRQ name instead of a static counter
mailbox: qcom-ipcc: Guard against NULL con_priv in send_data()
mailbox: mtk-cmdq: Fix runtime PM leak in cmdq_mbox_flush()
mailbox: bcm74110: Cap rx_svc_init_list growth to prevent PMC-induced OOM
mailbox: arm_mhuv2: time out if the receiver never comes up
mailbox: altera: shut down RX polling timer on channel teardown
dt-bindings: mailbox: qcom: Add IPQ9650 APCS compatible
dt-bindings: mailbox: Convert hisilicon,hi6220-mbox to DT schema
dt-bindings: mailbox: Convert hisilicon,hi3660-mbox to DT schema
mailbox: ti-msgmgr: Read exact number of trailing message bytes
mailbox: ti-msgmgr: Do not report rx poll timeout as a send failure
mailbox: arm_mhuv3: Keep the combined IRQ enabled during system suspend
mailbox: arm_mhu_db: Remove redundant mbox_controller_unregister() on probe failure
mailbox: qcom-ipcc: Remove redundant mbox_controller_unregister() on probe failure
dt-bindings: mailbox: qcom: Add SDM670 APCS compatible
mailbox: rockchip: Convert to use dev_err_probe()
mailbox: rockchip: Simplify device variant handling
...
|
|
git://git.kernel.org/pub/scm/linux/kernel/git/hid/hid
Pull HID updates from Jiri Kosina:
"Core:
- OOB fix in s32ton() (Alan Stern)
- switch to named initializers for acpi_device_id (Pawel Zalewski)
- UAF fix in hiddev (Yousef Alhouseen)
AMD SFH:
- support for newer AMD SoCs (Basavaraj Natikar)
- sysfs attributes of operating-mode telemetry (Basavaraj Natikar)
Apple:
- power management fix for Apple Touch Bar (Andre Eikmeyer)
- fix for trackpad hanling on T2 Macs (Aditya Garg)
ASUS:
- power management fix for ROG Ally (Deni Benato)
- asus_work() hardening (Denis Benato)
Intel-THC:
- conversion of intel-thc-hid to hid_safe_input_report() (Even Xu)
Nintendo:
- support for Switch 2 controller (Vicki Pfau)
- support for PDP Afterglow controller (Aiman Najjar)
Roccat:
- fixes for proper handling of short reports (Jiale Yao)
Wacom:
- UAF fixes (Lee Jones)
.. other assorted fixes, device ID additions and code cleanups"
* tag 'hid-for-linus-2026102101' of git://git.kernel.org/pub/scm/linux/kernel/git/hid/hid: (80 commits)
HID: nintendo: introduce dependency in USB_HID
HID: asus: add keyboard dock of the ASUS Transformer Book T302CHI device ID
HID: wacom: fix wacom_intuos_irq NULL pen_input deref
HID: hid-lenovo-go-s: Use devm_kzalloc for drvdata
HID: hid-lenovo-go-s: Move static led_classdev_mc to drvdata struct
HID: hid-lenovo-go-s: Reorganize and rename hid_gos_cfg
HID: hid-lenovo-go-s: Move attribute init to after device query
HID: hid-lenovo-go-s: Add suspend function and gate access under bool.
HID: hid-lenovo-go-s: Add kobject_uevent notify during reset-resume
HID: hid-lenovo-go-s: Use pm_ptr for reset_resume callback
HID: hid-lenovo-go-s: Prevent deadlock if device removed during setup
HID: hid-lenovo-go-s: Bound stale reply window before reusing send_cmd_complete
HID: hid-lenovo-go-s: Return ret instead of 0 in mcu_property_out()
HID: logitech-hidpp: cancel reset_hi_res_work on probe failure
HID: apple: ignore the trackpad on T2 Macs
HID: usbhid: skip interrupt IN polling for devices with no input reports
HID: mcp2221: always initialize and cancel init_work
HID: magicmouse: fix null pointer dereference in magicmouse_event()
HID: core: Fix out-of-bounds left shift by 32 in s32ton()
HID: asus: add support for xgm led
...
|
|
git://git.kernel.org/pub/scm/linux/kernel/git/andy/linux-auxdisplay
Pull auxdisplay updates from Andy Shevchenko:
"A tiny batch of auxdisplay changes, which resided in Linux next for
more than enough without any regression reports:
- Fix ABI documentation formatting
- Miscellaneous cleanups"
* tag 'auxdisplay-v7.4-1' of git://git.kernel.org/pub/scm/linux/kernel/git/andy/linux-auxdisplay:
docs: ABI: auxdisplay: use literal blocks for commands
auxdisplay: panel: use assign_bit() where applicable
auxdisplay: arm-charlcd: Use DEFINE_SIMPLE_DEV_PM_OPS for power management
|
|
git://git.kernel.org/pub/scm/linux/kernel/git/andi.shyti/linux
Pull i2c updates from Andi Shyti:
"The main changes are the new Novatek NT72676 driver, the qcom-cci
clock and timing updates and a collection of smaller driver, core and
DT binding improvements.
Core and helpers:
- acpi: run ASUS and Dell touchpads at 100 kHz to avoid lag
- core: return bool from check_functionality() and update users
- smbus: limit block reads to the caller's buffer size
- acpi: mark I2C transfer buffers as DMA-safe
Drivers:
- qcom-geni: several firmware node and runtime PM improvements
- qcom-cci: several patches rework clock selection and timings
- qcom-cci: enable SCL clock stretching
- imx-lpi2c: fix DMA mapping device selection and cleanup
- designware: tune RX FIFO thresholds to reduce interrupts
- i801: respect SPD write protection when probing DDR5 modules
- bcm2835: fully initialize clock configuration data
Generic cleanups:
- mux: simplify channel lookup and firmware node handling
- core, busses: tidy up ACPI device ID tables
- docs: clarify adapter lookup and fix a client driver example
- xlnx: update maintainer for Xilinx IIC bindings
- ljca: remove redundant adapter deletion
New support and DT bindings:
- add DW compatibles for Synaptics SL2610 and UltraRISC DP1000
- allow six DMA channels for R-Car Gen5
- add Allwinner A733 compatible to mv64xxx bindings
- add support for Novatek NT72676 (new driver)"
* tag 'i2c-7.4-part1' of git://git.kernel.org/pub/scm/linux/kernel/git/andi.shyti/linux: (37 commits)
i2c: imx-lpi2c: remove dmaengine_desc_free()
i2c: busses: use named initializers for acpi_device_id
i2c: i2c-core-acpi: use named initializers for acpi_device_id
i2c: i801: Gate SPD instantiation on SPD Write Disable bit
i2c: acpi: Use I2C_M_DMA_SAFE in acpi_gsb_i2c_[read|write]_bytes()
dt-bindings: i2c: dw: Add Synaptics sl2610 i2c
i2c: designware: size the RX FIFO threshold to the queued transfer
i2c: imx-lpi2c: use dmaengine_get_dma_device() for DMA mapping
docs: i2c: writing-clients: Add missing end of command
i2c: qcom-cci: skip core clock rates the clock cannot provide
i2c: core: document preference for i2c_get_adapter_by_fwnode()
i2c: qcom-cci: always enable SCL clock stretching
MAINTAINERS: Add entry for Novatek NT72676 I2C controller driver
i2c: nt72676: Add Novatek NT72676 I2C controller driver
dt-bindings: i2c: Add Novatek NT72676 I2C controller
i2c: acpi: Force ASUE140D touchpads to 100 kHz
i2c: qcom-cci: Enforce the required CCI clock rate
i2c: qcom-cci: Share the timing table across CCI revisions
i2c: qcom-cci: Add 19.2 MHz timings for the v2 CCI
i2c: qcom-cci: Support per-mode CCI clock rates
...
|
|
git://git.kernel.org/pub/scm/linux/kernel/git/pateldipen1984/linux
Pull hte updates from Dipen Patel:
- prevent releasing GPIO before time expires in the test code
- initialize spin lock before registering the chip in the provider
driver
* tag 'for-7.4-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/pateldipen1984/linux:
hte: tegra194-test: shut down timer before GPIO release
hte: tegra194: Initialize slice locks before registering chip
hte: tegra194: Remove redundant dev_err()
|
|
git://git.kernel.org/pub/scm/linux/kernel/git/groeck/linux-staging
Pull watchdog updates from Guenter Roeck:
"Core/generic:
- Replace __MODULE_STRING() with __stringify()
- Use assign_bit() where applicable
- Use DEFINE_SIMPLE_DEV_PM_OPS and pm_sleep_ptr for dev_pm_ops
- Fix repeated words and typos in comments
- Differentiate scenarios when watchdog is closed
Added device support in existing drivers:
- mtk_wdt: Support for MediaTek MT8167 and MT8127
- apple_wdt: Support for T8140
- s3c2410_wdt: Support for Exynos 5515
Various other minor bug fixes and improvements"
* tag 'watchdog-for-v7.4' of git://git.kernel.org/pub/scm/linux/kernel/git/groeck/linux-staging: (22 commits)
watchdog: mediatek: Apply the driver's mode to a watchdog left running
dt-bindings: watchdog: apple,wdt: Add t8140 compatible
watchdog: Replace __MODULE_STRING() with __stringify()
watchdog: use assign_bit() where applicable
watchdog: mediatek: Add support for mt8167 toprgu/watchdog
dt-bindings: watchdog: Add compatible for MediaTek mt8167
watchdog: sp805_wdt: fix suspend/resume handling of HW_RUNNING watchdog
watchdog: PM: use DEFINE_SIMPLE_DEV_PM_OPS and pm_sleep_ptr for dev_pm_ops
watchdog: mediatek: Add wdt/toprgu resets for mt6589
watchdog: msc313e: Replace commas with semicolons in probe()
watchdog: sp805: Replace SIMPLE_DEV_PM_OPS with DEFINE_SIMPLE_DEV_PM_OPS
watchdog: fix repeated words in comments
watchdog: fix typos in comments
watchdog: i6300esb: do not stop an already running watchdog
dt-bindings: watchdog: mediatek: Add MT8127
watchdog: Differentiate scenarios when watchdog is closed
dt-bindings: watchdog: renesas,r9a09g057-wdt: Add CPG/MSSR syscon support
watchdog: mediatek: acknowledge pretimeout interrupt
watchdog: s3c2410_wdt: Add exynos5515-wdt compatible data
dt-bindings: watchdog: samsung-wdt: Add exynos5515-wdt compatible
...
|
|
git://git.kernel.org/pub/scm/linux/kernel/git/ulfh/linux-pm
Pull pmdomain updates from Ulf Hansson:
"pmdomain core:
- Add a genpd config to support unknown initial status
- Add support system wide resume latency constraints
- Enable a non-CPU device in a CPU PM domain to do power on
- Fall back to use device node name for domain idle states
pmdomain providers:
- cpuidle-psci: Initialize the PM domains in powered off state for OSI
- cpuidle-psci: Move initialization a bit earlier in the boot sequence
- qcom: Add NMXC power domain for Nord
- qcom: Add support for SM7250, Kuno and MSM8952 power domains
- renesas: Add support for r8a774a3 SYSC power domains
- renesas: Fix lockdep false positive for r8a78000
- riscv: Add RPMI device power service
- st: Add the actual power domains on U8500
- st: Convert Ux500 PM domains to schema
pm qos:
- Add a flag for system wide latency constraints
- Add lockless read for flags"
* tag 'pmdomain-v7.4' of git://git.kernel.org/pub/scm/linux/kernel/git/ulfh/linux-pm: (36 commits)
dt-bindings: arm: Add the actual power domains on U8500
dt-bindings: arm: ux500: Drop NR_DOMAINS
dt-bindings: power: Convert Ux500 PM domains to schema
dt-bindings: power: rpmpd: Add MSM8952 power domains
pmdomain: rockchip: drop duplicated errno from supply failure message
pmdomain: core: add support system-wide resume latency constraints
pmdomain: core: add genpd_for_each_child() helper
PM / QoS: add lockless read for flags
PM / QoS: add flag to indicate latency applies system-wide
pmdomain: renesas: rcar-sys: Add r8a774a3 support
dt-bindings: power: Add r8a774a3 SYSC power domain definitions
dt-bindings: power: renesas,rcar-sysc: Document vendor-prefixed header paths
pmdomain: imx93-blk-ctrl: Use pm_runtime_resume_and_get()
pmdomain: imx8m-blk-ctrl: Use pm_runtime_resume_and_get()
pmdomain: imx: gpcv2: Use pm_runtime_resume_and_get()
pmdomain: rockchip: Fix domain check in rockchip_pm_add_one_domain()
pmdomain: core: Fall back to node name for idle states
pmdomain: renesas: r8a78000: Fix lockdep false positive
pmdomain: fix typo "releated" in comment
pmdomain: imx: Propagate SCU provider registration failures
...
|
|
Pull MMC updates from Ulf Hansson:
"MMC core:
- Add a power-off-delay-us DT property to support HW specific delays
- Add mmc_send_tuning_timeout() to allow hosts to specify a timeout
- Enable hosts to control the re-programming of the crypto keys
MMC host:
- dw_mmc: Add a common watchdog and convert the various timeouts to use it
- dw_mmc: Expose the watchdog state in debugfs
- dw_mmc-rockchip: Use a tighter per command tuning timeout
- greybus-sdio: Convert to devm_mmc_alloc_host()
- meson-gx: Enable the bus pipeline clock on T7
- rtsx_usb_sdmmc: Start card power-up at 3.3V
- sdhci-cadence: Add Altera Agilex5 SD6HC support
- sdhci-cadence: Add Cadence SD6HC support
- sdhci-msm: Add support for the MSM8952 and Maili variants
- sdhci-msm: Use pm ops to better manage restoring of crypto keys
- sdhci-of-dwcmshc: Disable CQE error halt request for Rockchip
- sdhci-pxav3: Disable clock inversion for SD HS cards
- sunplus: Fixup initialization for DDR modes
- sunxi: Add support for Allwinner B288
- vub300: Remove the driver for the obsolete HW"
* tag 'mmc-v7.4' of git://git.kernel.org/pub/scm/linux/kernel/git/ulfh/mmc: (43 commits)
dt-bindings: mmc: sun4i-a10-mmc: add Allwinner B288
mmc: dw_mmc-rockchip: use a tighter per-command tuning timeout
mmc: core: add mmc_send_tuning_timeout()
mmc: sdhci-of-dwcmshc: Disable CQE error halt request for Rockchip
dt-bindings: mmc: sdhci-msm: Add MSM8952 compatible
mmc: use assign_bit() where applicable
mmc: sdhci-pci: Replace deprecated PCI functions
mmc: sunplus: initialise rd_crc_dly=1 for DDR modes
mmc: core: fix stale mmc_start_req() references in comments
docs: mmc: fix stale async request documentation
docs: mmc: document eMMC health status support in mmc-tools
mmc: cavium-thunderx: Drop redundant calls to get|put_device()
mmc: core: Turn mmc_alloc|free_host() into static functions
staging: greybus: sdio: Convert to devm_mmc_alloc_host()
mmc: vub300: Remove the driver for the obsolete HW
mmc: dw_mmc: remove unused slot member
mmc: sdhci-pxav3: avoid of_node
CREDITS: Add Pierre Ossman
mmc: fix typos in comments
mmc: meson-gx: enable the bus pipeline clock on T7
...
|
|
git://git.kernel.org/pub/scm/linux/kernel/git/broonie/regmap
Pull regmap updates from Mark Brown:
"This is a relatively busy release, mostly due to the general cleanup
work which people have been doing throughout the kernel - for regmap
that's mostly been some work from Peng Fan.
I also added some more tests for the sparse caches to catch some
gotchas people might run into trying to improve the maple cache.
- Test very high register numbers to help people avoid a nasty gotcha
trying to optimise the maple cache
- Make more use of scoped lock and allocation guards
- A couple of other smaller improvements and fixes"
* tag 'regmap-v7.4-2' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/regmap:
regmap: debugfs: Use __free(kfree) for regmap_reg_ranges_read_file
regmap: debugfs: Use guard to simplify code
regmap: debugfs: Use __free(kfree) in regmap_name_read_file()
regmap: fix potential double-free of map->reg_defaults on cache reinit
regmap: use krealloc_array() in regmap_register_patch()
regcache: simplify control flow and reduce nesting
regcache: extract __regcache_sync() to deduplicate sync dispatch
regcache: extract locked helpers to replace open-coded lock/unlock pairs
regmap: debugfs: use the regmap scoped lock guard
regcache: rbtree: use the regmap scoped lock guard
regcache: use the regmap scoped lock guard
regmap: convert lock/unlock to a scoped guard
regmap: fix typo "asynchrnous" in comment
regmap: Test rbtree and maple caches for very high register numbers
regmap: Allow a base register to be specified for the RAM regmap
|
|
git://git.kernel.org/pub/scm/linux/kernel/git/broonie/spi
Pull spi updates from Mark Brown:
"Quite a lot of work in the SPI subsystem this time around, almost all
in drivers rather than the core.
As well as the general cleanup/fix work we're seeing over most of the
kernel there's been some substantial performance work to two existing
drivers and support for a number of new devices including a couple of
new drivers. There was also a big overhaul of the spidev_test utility
from the Pengutronix people.
- Improvements for spidev_test to cover additional use cases, plus be
a bit easier to use.
- Substantial performance work in both DesignWare and Tegra210 QSPI
drivers, making their interrupt handling more efficient to drive up
hardware utilisation.
- Documentation clarifications.
- Fixes for some runtime PM and error handling issues.
- Support for Nuvoton MA35D1, Qualcomm QPIC SNAND v2, Renesas R-Car
Gen5 and X5H and Realtek RTD1625"
* tag 'spi-v7.4' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/spi: (136 commits)
spi: ch341: handle transfers without a TX or RX buffer
spi: dt-bindings: spi-qpic-snand: Add IPQ9650 compatible
spi: spi-pci1xxxx: quiesce DMA engines on transfer timeout
spi: amd: fix len==0 underflow and FIFO overflow
spi: tegra114: initialize native chip selects inactive
spi: bcm-qspi: reject oversized dummy bytes in mspi exec_mem_op
spi: npcm-fiu: limit UMA data_size to the 16-byte staging buffer
spi: omap2-mcspi: handle DMA setup failures
spi: jcore: fix divide-by-zero when speed_hz is zero
spi: cadence-xspi: fix stack buffer overflow in the Marvell b0 path
spi: cadence-xspi: reject SDMA transfers larger than the requested length
spi: meson-spicc: fix invalid DMA unmap on mapping failure
spi: s3c64xx: Use snprintf() instead of sprintf()
spi: omap2-mcspi: Use snprintf() instead of sprintf()
spi: tle62x0: Use kstrtoul() instead of simple_strtoul()
spi: lm70llp: Use strscpy() instead of strcpy()
spi: butterfly: Use strscpy() instead of strcpy()
spi: jcore: Use devm_platform_ioremap_resource()
spi: sh-hspi: Use devm_platform_ioremap_resource()
spi: ljca: validate the response length before copying the data
...
|
|
git://git.kernel.org/pub/scm/linux/kernel/git/broonie/regulator
Pull regulator updates from Mark Brown:
"This is quite a quiet release, especially given the general onslaught
of cleanup patches seen elsewhere. There is some of that, but not as
much as I'm seeing elsewhere relatively to the size of the subsystem.
We do have some new drivers as well, plus Linus Walleij has done a big
overhaul of the AB8500 driver including feature buildout.
- Substantial cleanups and feature additions for the ST Ericsson AB8500
- Overhaul of the configuration for the LP872x.
- A bunch of DT binding conversions
- Support for Maxim MAX20024, MPS MPQ4210, Nexperia NEX10000UB"
* tag 'regulator-v7.4' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/regulator: (60 commits)
regulator: rpi-panel-attiny: Fix probe failure after a host cold boot
regulator: lp872x: Use macro to fill regulator descriptor
regulator: lp872x: Add support for input and regulator power supplies
regulator: lp872x: Remove platform_data based probing
regulator: lp872x: Remove redundant regmap wrappers
regulator: lp872x: Fold driver header into driver file
regulator: dt-bindings: ti,lp872x: Document input supplies
regulator: dt-bindings: ti,lp872x: Deprecate ti,dvs-gpio and ti,update-config
regulator: dt-bindings: sy8827n: support standard properties
regulator: dt-bindings: Reference Tegra regulator coupling schema
regulator: dt-bindings: nvidia,tegra-regulators-coupling: Convert to DT schema
regulator: dt-bindings: ti,lp872x: Convert to DT schema
regulator: dt-bindings: Drop obsolete MAX8925 .txt binding
regulator: 88pm886: Add Vbus regulator
regulator: core: Export helpers used by regulator couplers
regulator: core: Fix coupled regulators reference leak on removal
regulator: dt-bindings: ti,tps6586x: Convert to DT schema
regulator: dt-bindings: Add MAX20024 sd4
regulator: dt-bindings: Convert mediatek,mt6380-regulator to DT schema
regulator: mp886x: fix pontential division by zero
...
|
|
Miguel had mentioned this rustfmt issue, but I overlooked this one when
doing the driver core merge.
Make rustfmt happy again.
Reminded-by: Miguel Ojeda <ojeda@kernel.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
|
|
git://git.kernel.org/pub/scm/linux/kernel/git/brgl/linux
Pull gpio updates from Bartosz Golaszewski:
"Nothing stands out as particularly interesting, it's been a calm
cycle. We have three new drivers, support for more models and lots of
updates across many modules (details are in the signed tag as usual).
There are also some minor changes and additions to the in-kernel GPIO
API.
GPIO core:
- provide a new controller API: gpiochip_generic_get_config()
- return -EOPNOTSUPP instead of -ENODEV to user-space if it requests
hardware timestamping on systems where it's unavailable (no
user-space regressions reported)
New drivers:
- add a driver for ROHM BD73800 PMIC GPIO controller
- add a driver for Axiado AX3005 SGPIO controller
- add a driver for Analog Devices AD7768 GPIO controller
New hardware support:
- extend gpio-rcar with support for R-Car X5H (R8A78000)
- extend gpio-tegra186 with support for Tegra 268
Driver changes:
- refactor and improve gpio-rtd1625: switch to modern or better
fitting interfaces and improve coding style
- improve error handling of return values of
platform_get_irq_optional() in several drivers
- normalize the return value of the gpio_chip::get() callback in
gpio-siox in order to not propagate invalid values up to the GPIO
core
- implement gpio_chip::get_direction() for gpio-pcf857x
- use managed variants of notifier registration functions in several
drivers
- remove legacy gpio_set_value_cansleep() as it has no more users
- add pinctrl support to gpio-realtek-otto
- add runtime PM support to the gpio-regmap helper module
- add more ACPI GPIO quirks for various hardware
- stop needlessly reading gpio_chip::base in gpio-pxa
- add support for tracking of direction of generic GPIO chips with no
direction registers via pinctrl backend to gpio-mmio (use the new
core API: gpiochip_generic_get_config())
- use the "safe" variants of debugfs_create_file() in
gpio-sloppy-analyzer
- use device name as GPIO chip label in gpio-omap
- refactor bit ops in gpio-dln2
- prepare gpio-it87 for upcoming kmalloc_obj() conversion
Devicetree bindings:
- document new model in gpio-pca95xx
- allow the gpio-hogs property in gpio-zynq and fsl,qoriq-gpio
- allow the gpio-ranges property in gpio-realtek-otto
Misc fixes:
- add missing MODULE_ALIAS() to gpio-crystalcove
- fix a comment typo in example GPIO tools
- fix unbalanced brackets in documentation
- add names to regmaps in gpio-mvebu to avoid collisions in debugfs
output
- fix GPIO lookup using relative paths in GPIO ACPI"
* tag 'gpio-updates-for-v7.4-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/brgl/linux: (63 commits)
gpiolib: acpi: Fix GPIO lookup using relative path
gpio: legacy: Kill gpio_set_value_cansleep()
dt-bindings: gpio: pca95xx: add onnn,pca9655 with nxp,pca9555 fallback
gpiolib: acpi: Ignore GPIO 11 interrupt on Acer Nitro V 16S AI
gpio: pxa: stop reading gpio_chip::base in direction callbacks
gpio: axiado: add AX3005 SGPIO controller support
dt-bindings: gpio: add Axiado AX3005 SGPIO controller
gpiolib: acpi: Add quirk for Lenovo IdeaPad Slim 3 15ABR8
MAINTAINERS: Add ROHM BD73800 PMIC files
gpio: bd73800: Support ROHM BD73800 PMIC GPIOs
clk: bd718x7: Support ROHM BD73800
regulator: bd71828: Support ROHM BD73800
rtc: bd70528: Support RTC on ROHM BD73800
mfd: Support for ROHM BD73800 PMIC core
dt-bindings: mfd: ROHM BD73800 PMIC
dt-bindings: regulator: ROHM BD73800 regulators
dt-bindings: rohm,bd*: Ref common ROHM bindings
dt-bindings: mfd: Common ROHM PMIC properties
gpio: siox: normalize return value of gpio_get()
gpio: dln2: use assign_bit() where applicable
...
|
|
git://git.kernel.org/pub/scm/linux/kernel/git/brgl/linux
Pull power sequencing updates from Bartosz Golaszewski:
"The bulk of added lines are kunit tests that comprehensively verify
the core functionality of the power sequencing framework.
Other than that, we have another pwrseq driver: Renesas RZ/G3L Power
Ready and support for more models in pwrseq-pcie-m2. We also added a
new consumer-facing API in the form of pwrseq_is_controllable()
function which allows consumers to check if a given target resource is
actually host-controllable.
Summary:
Power sequencing core:
- add a suite of kunit test cases for the power sequencing core
functionalities
- provide a new consumer API: pwrseq_is_controllable()
New Drivers:
- add the Renesas RZ/G3L Power Ready driver which provides
information on power readiness for various IPs on RZ/G3L
Driver changes:
- use pwrseq_is_controllable() to report controllability to consumers
in pwrseq-qcom-wcn and pwrseq-pcie-m2
- add support for PCIe switch topologies to pwrseq-pcie-m2
- add the PCI ID for Foxconn WCN7850 to pwrseq-pcie-m2"
* tag 'pwrseq-updates-for-v7.4-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/brgl/linux:
power: sequencing: pcie-m2: Add Foxconn WCN7850 subsystem PCI ID
power: sequencing: qcom-wcn: Report power controllability
power: sequencing: pcie-m2: Report power controllability
power: sequencing: Add pwrseq_is_controllable() API
power: sequencing: add kunit test cases
power: sequencing: pwrseq-pcie-m2: Support PCIe switch topologies
power: sequencing: Add Renesas RZ/G3L Power Ready driver
|
|
git://git.kernel.org/pub/scm/linux/kernel/git/ukleinek/linux
Pull pwm updates from Uwe Kleine-König:
"The usual mix of fixes for older issues, devicetree changes and
cleanups.
Part of this is a shared branch that introduces device-managed
variants of atomic_notifier_chain_register() and
blocking_notifier_chain_register()"
* tag 'pwm/for-7.4-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/ukleinek/linux:
dt-bindings: pwm: Add IPQ5210 binding
pwm: tiehrpwm: Clear period on disable to allow reconfiguration
pwm: Allow 32-bit tasks to use the character device
pwm: lp3943: fix NULL pointer dereference for an unconfigured channel
pwm: mtk-disp: Fix period readback
pwm: ipq: Prevent potential 32-bit integer overflow in hi_div calculation
pwm: loongson: Reload PWM configuration through counter reset
pwm: Fix typos in comments
dt-bindings: pwm: Convert TI PWM Subsystem to DT schema
docs: pwm: Fix bracket and punctuation
pwm: iqs620a: Use devm_blocking_notifier_chain_register()
pwm: renesas-tpu: Fix runtime PM reference leak
notifier: add device-managed registration APIs
|
|
New knobs should default to 'n'. The mentioned one depends on
BT_HCIBTUSB, but the latter is enabled on most systems.
Acked-by: Jakub Kicinski <kuba@kernel.org>
Reviewed-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
|
|
With Dan's passing Alexey, Aneesh and Jason have volunteered to take this
on, with the support of their employers.
Reviewed-by: Dave Hansen <dave.hansen@linux.intel.com>
Reviewed-by: Leon Romanovsky <leon@kernel.org>
Reviewed-by: Lukas Wunner <lukas@wunner.de>
Acked-by: Aneesh Kumar K.V (Arm) <aneesh.kumar@kernel.org>
Acked-by: Suzuki K Poulose <suzuki.poulose@arm.com>
Acked-by: Mathieu Poirier <mathieu.poirier@linaro.org>
Acked-by: Jonathan Cameron <jonathan.cameron@oss.qualcomm.com>
Acked-by: Dave Jiang <dave.jiang@intel.com>
Acked-by: Ankit Agrawal <ankita@nvidia.com>
Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
|
|
Merge in late fixes in preparation for the net-next PR.
Conflicts:
net/netfilter/nf_conntrack_netlink.c
cd37ab22a74e0 ("netfilter: nf_conntrack_netlink: fix inverted IPv6 tuple filter")
1ae2d094b0200 ("netfilter: ctnetlink: fix inverted IPv6 address match in dump filter")
Adjacent changes:
drivers/net/ethernet/marvell/octeontx2/af/rvu_nix.c
8830e65ed46de ("net: use assign_bit() where applicable")
07bd391eb957 ("octeontx2-af: Fix CQ enable state tracking after AQ writes")
net/core/sock.c
31c5ea8a3296 ("ipv6: Remove IPV6_ADDRFORM.")
31b564f70d88 ("net: use the full socket in sk_mc_loop()")
net/mptcp/protocol.h
0cb6910130a3 ("mptcp: remove thmac from subflow ctx")
7538fa33bb2f ("mptcp: fix subflow bitfield misuse")
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
|
|
TIPC group broadcast senders are blocked while a replicast still has
outstanding member acks: tipc_group_bc_cong() returns true as long as
grp->bc_ackers is non-zero, and clears *grp->open, which is what
tipc_poll() uses to report EPOLLOUT (via tsk->group_is_open).
When the last outstanding acker departs before acking,
tipc_group_delete_member() decrements grp->bc_ackers to zero but
never restores *grp->open. As a result poll(EPOLLOUT) never fires
again. A writer blocked in sendmsg() is only released if some other
wakeup happens after the deletion: with TIPC_GROUP_MEMBER_EVTS the
leave event delivery calls sk_data_ready() and wakes it, but without
member events nothing does and it sleeps indefinitely, since the
default send timeout is MAX_SCHEDULE_TIMEOUT.
Commit 99cc2a62e07a ("tipc: reject invalid and unexpected
GRP_ACK_MSG to prevent bc_ackers underflow") already calls this out
in its changelog as a pre-existing issue.
Restore the open state exactly on the 1->0 transition in the delete
path, mirroring the GRP_ACK_MSG completion path, and invoke
sk->sk_write_space() from tipc_sk_filter_rcv() when the group just
became writable again.
Also make the ack accounting precise. The delete path used to test
less(m->bc_acked, grp->bc_snd_nxt - 1), which also matches members
that were never counted for the current replicast (JOINING/LEAVING
members keep a stale bc_acked), and the GRP_ACK_MSG handler accepted
an ack from any member whose bc_acked differed from the expected
value. Either could zero bc_ackers on behalf of a member that owes
nothing and silently void an ack still owed by a real acker. Track
whether a member owes an ack for the current replicast in a new
per-member bc_pending flag, set when the member is counted and
cleared when its ack arrives, and use it both to accept an ack and
to decide on deletion. bc_acked has no remaining user and is
removed. Suggested by Tung Quang Nguyen.
This issue was discovered by Tencent CodeBuddy Security.
Cc: stable@vger.kernel.org
Fixes: 2f487712b893 ("tipc: guarantee that group broadcast doesn't bypass group unicast")
Signed-off-by: Henry Martin <bsdhenrymartin@gmail.com>
Reviewed-by: Tung Nguyen <tung.quang.nguyen@est.tech>
Link: https://patch.msgid.link/20261019115859.3471295-1-bsdhenrymartin@gmail.com
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
|
|
When the last reference to a tipc_node is dropped, the node itself is
deferred to the RCU callback tipc_node_free(), but the nested broadcast
reception link, n->bc_entry.link, is kfree()d synchronously in
tipc_node_kref_release(), before call_rcu(), and the pointer is never
cleared. Readers that obtained the node from node_list and then
dereference bc_entry.link deep into the link (tipc_link_name() in
tipc_nl_node_reset_link_stats(), bcl->name/stats in
tipc_nl_add_bc_link() on the link dump path) therefore touch freed
memory although the enclosing node stays alive for a full grace period.
The sibling per-bearer links get "kfree + NULL" under the node write
lock in tipc_node_clear_links(); the broadcast entry was missed.
The race is reachable through the node cleanup timer: once a peer has
been unreachable for NODE_CLEANUP_AFTER (300 s), tipc_node_timeout() ->
tipc_node_cleanup() unlinks the node under the write lock, and the
final tipc_node_put() at the caller runs outside node_list_lock, so the
kfree executes in timer softirq context, concurrently with genl dump/
reset walkers that hold only rcu_read_lock(). (A netlink "peer remove"
cannot race those walkers itself: tipc_genl_family has no parallel_ops,
so all doit/dumpit calls serialize on the global genl lock.)
Reproduced in a QEMU/KVM guest running v7.3.0 with KASAN and
PREEMPT(full): 10 TIPC peer namespaces on veth bearers, bearer removal
staggered so the 300 s node cleanup timers expire while other tasks
loop link dumps with the broadcast filter and reset-link-stats lookups.
KASAN hit within two cleanup cycles:
BUG: KASAN: slab-use-after-free in strlen+0x85/0xa0
Read of size 1 at addr ffff88800b54a004 by task poc_eth/371
strlen+0x85/0xa0
tipc_nl_add_bc_link+0x2f9/0xd40
__tipc_nl_add_node_links+0x10c/0x140
tipc_nl_node_dump_link+0x8d5/0xd50
Freed by task 0:
kfree+0x121/0x380
tipc_node_timeout+0xa33/0xcf0
run_timer_softirq+0x144/0x250
sysvec_apic_timer_interrupt
with the freed object being the kmalloc-1k tipc_link allocated by
tipc_link_bc_create() during peer discovery. The same defect fires in
strcmp() called from tipc_nl_node_reset_link_stats().
Move the kfree of n->bc_entry.link into the tipc_node_free() RCU
callback so the broadcast link lives exactly as long as the enclosing
node. All readers are covered: the netlink walkers are inside
rcu_read_lock(), and the packet reception path reaches the node via
tipc_node_find(), whose kref defers kref_release itself.
Found during a static-analysis-assisted audit: candidate sites were
surfaced by a Coccinelle rule, and the reader/writer paths were
confirmed by LLM-assisted (GLM-5.3) code inspection.
Fixes: d25a01257e42 ("tipc: fix crash during node removal")
Assisted-by: GLM-5.3 coccinelle
Signed-off-by: Binbin Deng <18983559317@163.com>
Reviewed-by: Simon Horman <horms@kernel.org>
Reviewed-by: Tung Nguyen <tung.quang.nguyen@est.tech>
Link: https://patch.msgid.link/20261019104352.488347-1-18983559317@163.com
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
|
|
git://git.kernel.org/pub/scm/linux/kernel/git/driver-core/driver-core
Pull driver core updates from Danilo Krummrich:
"Core:
- Add TAINT_FORCED_BIND to taint the kernel and driver module before
manual sysfs bind/unbind operations; make add_taint_module()
available to driver core and update taint decoding tools and
documentation
- Constify device_show/store_*() attribute parameters and adapt x86
MCE and perf users to prepare for const dev_ext_attribute instances
- Fix UAF in NUMA access node registration failure handling by
dropping the device reference with put_device() instead of directly
freeing the node
debugfs:
- Make debugfs_create_str() read-only to eliminate double-free races
between concurrent writers; reject writable modes; convert
interconnect and SoundWire users to local file operations with
mutex-protected strings
kobject:
- Fix out-of-bounds access in kobject_action_type() when parsing
action strings containing embedded NUL bytes
- Fix the kobject_set_name() reference in kset_register() kernel-doc
Rust:
- DMA:
- Tie Coherent, CoherentBox and CoherentHandle to the device's
bound lifetime to prevent retaining DMA allocations beyond
driver unbind; propagate the lifetime through nova-core and the
DMA sample driver
- I/O:
- Require explicit base types for registers and replace relative
registers with typed subregion projections; reimplement
register!() as a proc macro, support registers using existing
types without inline bitfields, and convert nova-core, Tyr and
the PCI sample; add AsRepr/AsReprMut and transmute helpers with
deferred size checks for representation conversions
- Wrap ResourceSize in a transparent newtype with explicit
conversions, including checked conversion to usize
- PCI:
- Add typed PCIe extended capability lookup and SR-IOV accessors
for the First VF Offset and decoded VF BAR addresses and widths,
keeping raw SR-IOV registers private to preserve PCI core
ownership of their state
- scatterlist:
- Honor the device's maximum segment size as well as the DMA
mapping limit when constructing SG tables
- Return u32 from SGEntry::dma_len() to match the C segment length
type
- misc:
- Validate auxiliary DeviceId name length explicitly to improve
compile-time diagnostics for oversized device ID table entries
- Drop unnecessary 'static bounds from debugfs ScopedDir file
creation methods to support data containing non-'static
references, including DMA buffers
Misc:
- Add Johan Hovold as driver core maintainer
- Simplify platform_device_alloc() by returning early on allocation
failure
- Fix typos in driver core and kernfs comments"
* tag 'driver-core-7.4-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/driver-core/driver-core: (41 commits)
rust: pci: add extended capability and SR-IOV support
kobject: Fix the kobj_set_name reference in kset_register() kernel-doc
rust: io: convert ResourceSize into a transparent newtype
rust: scatterlist: return u32 from SGEntry::dma_len()
MAINTAINERS: add myself as driver core maintainer
debugfs: make debugfs_create_str() read-only
soundwire: debugfs: replace writable string helper
interconnect: debugfs: replace writable string helper
docs: admin-guide: Handle TAINT_FORCED_BIND when parsing /proc/sys/kernel/tainted
driver core: platform: Simplify platform_device_alloc()
kobject: fix out-of-bounds access in kobject_action_type()
rust: scatterlist: honor the device's maximum segment size
driver core: add TAINT_FORCED_BIND for when userspace manually messes with devices and drivers
module: fix up documentation for add_taint() and add_taint_module()
module: pull out add_taint_module() to be public
driver core: Constify the signature of device_show/store_*()
drivers: perf: Use __DEVICE_ATTR() macro to initialize dev_ext_attribute
x86/mce: Use __DEVICE_ATTR() macro to initialize dev_ext_attribute
rust: auxiliary: validate DeviceId name length
driver core: fix typos in comments
...
|
|
Commit 3cdeaef1754a ("r8169: disable EEE on RTL8168h/8111h") disables
EEE on RTL_GIGA_MAC_VER_46 with phy_disable_eee() but keeps the version
EEE-capable, so that link up still calls rtl_enable_tx_lpi(tp, false)
and clears the MAC TX-LPI bits (ERI 0x1b0[1:0]). rtl_hw_start_8168h_1()
does not clear them, so a warm reboot from an EEE-active state could
otherwise leave TX-LPI asserted while the PHY no longer negotiates EEE.
In net-next, commit 8a3c76523e44 ("r8169: add support for phylink")
moved link handling to phylink, and rtl_mac_link_up() does not touch
the TX-LPI bits. The merge of net into net-next kept the
phy_disable_eee() quirk and its comment, but not the link-up clear it
depends on. The only remaining clear is rtl_mac_disable_tx_lpi(), which
phylink calls from phylink_deactivate_lpi() only after
phylink_activate_lpi() has enabled LPI. With EEE disabled on this chip
that never happens, so the bits are never cleared and the comment in
r8169_mdio_register() no longer holds.
Clear TX-LPI explicitly in rtl_mac_link_up() for RTL_GIGA_MAC_VER_46.
Fixes: f49defea7668 ("Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net")
Link: https://lore.kernel.org/all/0e0b727e94d046b19ad463e7a1a9fe68@realsil.com.cn/
Signed-off-by: Sasha Levin <sashal@kernel.org>
Link: https://patch.msgid.link/20261020161543.3712208-1-sashal@kernel.org
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
|
|
Twenty years ago I made creating a tuntap device require CAP_NET_ADMIN
in commit ca6bb5d7ab22 ("[NET]: Require CAP_NET_ADMIN to create tuntap
devices.")
The idea was to allow the permissions on /dev/net/tun to be relaxed to
0666 and thus allow owners of tun devices assigned with TUNSETOWNER to
actually open it and get at their devices.
What we missed at the time was that persistent devices with *no* owner
were already essentially world-consumable, and anyone who could open
the device node could also attach to those.
Even then, using persistent devices with no explicitly set owner — on
the (false) presumption that CAP_NET_ADMIN would be required to open
them — wasn't an egregious userspace bug. There are cases where it does
make sense to separate the creation/configuration of the netdevice, from
the process which shovels packets into it.
Since then, TUNSETGROUP was added a year later in commit 8c644623fe7e
("[NET]: Allow group ownership of TUN/TAP devices."). Its commit message
noted that if both uid and gid are set, both have to match (in itself a
bizarre choice) — but still not that with *neither* set, no permission
at all was required.
Then in 2012 commit c8d68e6be1c3 ("tuntap: multiqueue support") allowed
new queues to be attached to a device from the moment of its creation,
with no way for userspace to close the race between creation and a
subsequent TUNSET{OWNER,GROUP}.
In 2024, commit 3ca459eaba1bf ("tun: fix group permission check") tried
to fix things to be saner: only require the user *or* the group to
match, in line with standard POSIX permissions, and require
CAP_NET_ADMIN if neither the user nor group authorised the access
(although it put the CAP_NET_ADMIN check first, and would wrongly have
reported the capability as having been used even when it was not).
That fix was reverted in commit a70c7b3cbc06 ("tun: revert fix group
permission check") due to allegedly causing a regression in an selinux
test suite which *expected* the attachment to succeed when authorised
by none of user, group, nor CAP_NET_ADMIN:
https://lore.kernel.org/netdev/CAFqZXNtkCBT4f+PwyVRmQGoT3p1eVa01fCG_aNtpt6dakXncUg@mail.gmail.com/
We should not break UAPI. But we don't have to consider an selinux test
case which deliberately exercises a security flaw to be UAPI worth
preserving either. To which end, I have fixed it in selinux-testsuite
commit b2f894f0016b ("tests/tun_tap: set an owner on the device for the
relabel tests").
So: fix the lack of CAP_NET_ADMIN check on devices which *haven't* been
assigned an owner or group, while leaving the weird tun ownership model
as it was (user *and* group have to match, if both are set). If someone
still wants to fix the latter (which wasn't actually the reason the
previous attempt was reverted), they can do it under separate cover.
Permit attaching to an existing device only if an owner and/or group was
set and the caller matches all that were set, or if the caller has
CAP_NET_ADMIN. The only behavioural change is that a device with no
owner or group now requires CAP_NET_ADMIN to attach — precisely the
loophole we want to close.
And put the CAP_NET_ADMIN check in the right place this time.
Fixes: ca6bb5d7ab22 ("[NET]: Require CAP_NET_ADMIN to create tuntap devices.")
Reported-by: Andrew Lutomirski <luto@kernel.org>
Signed-off-by: David Woodhouse <dwmw@amazon.co.uk>
Cc: stable@vger.kernel.org
Reviewed-by: Willem de Bruijn <willemb@google.com>
Link: https://patch.msgid.link/3c77f88acff5b3c2617b22d64faad15f6212619c.camel@infradead.org
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
|
