commit da3ea35007d0af457a0afc87e84fddaebc4e0b63 Author: Linus Torvalds Date: Sun Sep 8 14:50:28 2024 -0700 Linux 6.11-rc7 Makefile | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 89f5e14d05b4852db5ecdf222dc6a13edc633658 Merge: e20398877b62 342123d6913c Author: Linus Torvalds Date: Sun Sep 8 10:25:25 2024 -0700 Merge tag 'timers_urgent_for_v6.11_rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull timer fixes from Borislav Petkov: - Remove percpu irq related code in the timer-of initialization routine as it is broken but also unused (Daniel Lezcano) - Fix return -ETIME when delta exceeds INT_MAX and the next event not taking effect sometimes (Jacky Bai) * tag 'timers_urgent_for_v6.11_rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: clocksource/drivers/imx-tpm: Fix next event not taking effect sometime clocksource/drivers/imx-tpm: Fix return -ETIME when delta exceeds INT_MAX clocksource/drivers/timer-of: Remove percpu irq related code commit e20398877b6216023ac311053baf2f50965cbf27 Merge: 5dadc1be8fc5 2ab9d830262c Author: Linus Torvalds Date: Sun Sep 8 10:20:44 2024 -0700 Merge tag 'perf_urgent_for_v6.11_rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull perf fixes from Borislav Petkov: - Fix perf's AUX buffer serialization - Prevent uninitialized struct members in perf's uprobes handling * tag 'perf_urgent_for_v6.11_rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: perf/aux: Fix AUX buffer serialization uprobes: Use kzalloc to allocate xol area commit 5dadc1be8fc5355034a8515e021ed557acf5fd17 Merge: 51c4d5f10da4 48b9a8dabcc3 Author: Linus Torvalds Date: Sun Sep 8 10:13:39 2024 -0700 Merge tag 'char-misc-6.11-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc Pull char/misc driver fixes from Greg KH: "Here are some small char/misc/other driver fixes for 6.11-rc7. It's nothing huge, just a bunch of small fixes of reported problems, including: - lots of tiny iio driver fixes - nvmem driver fixex - binder UAF bugfix - uio driver crash fix - other small fixes All of these have been in linux-next this week with no reported problems" * tag 'char-misc-6.11-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc: (21 commits) VMCI: Fix use-after-free when removing resource in vmci_resource_remove() Drivers: hv: vmbus: Fix rescind handling in uio_hv_generic uio_hv_generic: Fix kernel NULL pointer dereference in hv_uio_rescind misc: keba: Fix sysfs group creation dt-bindings: nvmem: Use soc-nvmem node name instead of nvmem nvmem: Fix return type of devm_nvmem_device_get() in kerneldoc nvmem: u-boot-env: error if NVMEM device is too small misc: fastrpc: Fix double free of 'buf' in error path binder: fix UAF caused by offsets overwrite iio: imu: inv_mpu6050: fix interrupt status read for old buggy chips iio: adc: ad7173: fix GPIO device info iio: adc: ad7124: fix DT configuration parsing iio: adc: ad_sigma_delta: fix irq_flags on irq request iio: adc: ads1119: Fix IRQ flags iio: fix scale application in iio_convert_raw_to_processed_unlocked iio: adc: ad7124: fix config comparison iio: adc: ad7124: fix chip ID mismatch iio: adc: ad7173: Fix incorrect compatible string iio: buffer-dmaengine: fix releasing dma channel on error iio: adc: ad7606: remove frstdata check for serial mode ... commit 51c4d5f10da4434d63790a679f54e68abc7170e7 Merge: d1f2d51b711a 87eb3cb4ec61 Author: Linus Torvalds Date: Sun Sep 8 10:07:28 2024 -0700 Merge tag 'usb-6.11-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb Pull USB fixes from Greg KH: "Here are a handful of small USB fixes for 6.11-rc7. Included in here are: - dwc3 driver fixes for two reported problems - two typec ucsi driver fixes - cdns2 controller reset fix All of these have been in linux-next this week with no reported problems" * tag 'usb-6.11-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb: usb: typec: ucsi: Fix cable registration usb: typec: ucsi: Fix the partner PD revision usb: cdns2: Fix controller reset issue usb: dwc3: core: update LC timer as per USB Spec V3.2 usb: dwc3: Avoid waking up gadget during startxfer commit d1f2d51b711a3b7f1ae1b46701c769c1d580fa7f Merge: 37d4cc69876f 71c03a8cb213 Author: Linus Torvalds Date: Sat Sep 7 11:29:13 2024 -0700 Merge tag 'clk-fixes-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/clk/linux Pull clk fixes from Stephen Boyd: "A pile of Qualcomm clk driver fixes with two main themes: the alpha PLL driver and shared RCGs, and one fix for the Starfive JH7110 SoC. - The Alpha PLL clk_ops had multiple problems around setting rates. There are a handful of patches here that fix masks and skip enabling the clk from set_rate() when the PLL is disabled. The PLLs are crucial to operation of the system as almost all frequencies in the system are derived from them. - Parking shared RCGs at a slow always on clk at registration time breaks stuff. USB host mode can't handle such a slow frequency and the serial console gets all garbled when the UART clk is handed over to the kernel. There's a few patches that don't use the shared clk_ops for the UART clks and another one to skip parking the USB clk at registration time. - The Starfive PLL driver used for the CPU was busted causing cpufreq to fail because the clk didn't change to a safe parent during set_rate(). The fix is to register a notifier and switch to a safe parent so the PLL can change rate in a glitch free manner" * tag 'clk-fixes-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/clk/linux: clk: qcom: gcc-sc8280xp: don't use parking clk_ops for QUPs clk: starfive: jh7110-sys: Add notifier for PLL0 clock clk: qcom: gcc-sm8650: Don't use shared clk_ops for QUPs clk: qcom: gcc-sm8550: Don't park the USB RCG at registration time clk: qcom: gcc-sm8550: Don't use parking clk_ops for QUPs clk: qcom: gcc-x1e80100: Don't use parking clk_ops for QUPs clk: qcom: ipq9574: Update the alpha PLL type for GPLLs clk: qcom: gcc-x1e80100: Fix USB 0 and 1 PHY GDSC pwrsts flags clk: qcom: clk-alpha-pll: Update set_rate for Zonda PLL clk: qcom: clk-alpha-pll: Fix zonda set_rate failure when PLL is disabled clk: qcom: clk-alpha-pll: Fix the trion pll postdiv set rate API clk: qcom: clk-alpha-pll: Fix the pll post div mask commit 37d4cc69876f6ed981b54b07f0d07fc4d4bd9f13 Merge: 872765620781 0f9592ae26ff Author: Linus Torvalds Date: Sat Sep 7 10:25:39 2024 -0700 Merge tag 'scsi-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi Pull SCSI fix from James Bottomley: "Single ufs driver fix quirking around another device spec violation" * tag 'scsi-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi: scsi: ufs: ufs-mediatek: Add UFSHCD_QUIRK_BROKEN_LSDBS_CAP commit 872765620781607809fddbfdc2823ab7f769b698 Merge: b31c44928842 602cb14e310a Author: Linus Torvalds Date: Sat Sep 7 09:59:57 2024 -0700 Merge tag 'pinctrl-v6.11-3' of git://git.kernel.org/pub/scm/linux/kernel/git/linusw/linux-pinctrl Pull pin control fix from Linus Walleij: "A single fix for Qualcomm laptops that are affected by missing wakeup IRQs" * tag 'pinctrl-v6.11-3' of git://git.kernel.org/pub/scm/linux/kernel/git/linusw/linux-pinctrl: pinctrl: qcom: x1e80100: Bypass PDC wakeup parent for now commit b31c4492884252a8360f312a0ac2049349ddf603 Merge: 487ee43bac84 12cb32a52eb6 Author: Linus Torvalds Date: Fri Sep 6 17:48:24 2024 -0700 Merge tag 'linux_kselftest-kunit-fixes-6.11-rc7-2' of git://git.kernel.org/pub/scm/linux/kernel/git/shuah/linux-kselftest PullKUnit fix from Shuah Khan: "Fix to a missing function parameter warning found during documentation build in linux-next" * tag 'linux_kselftest-kunit-fixes-6.11-rc7-2' of git://git.kernel.org/pub/scm/linux/kernel/git/shuah/linux-kselftest: kunit: Fix missing kerneldoc comment commit 487ee43bac846446fb3e832436bdedd7acb4fe46 Merge: a86b83f77797 8f62819aaace Author: Linus Torvalds Date: Fri Sep 6 17:38:50 2024 -0700 Merge tag 'pci-v6.11-fixes-3' of git://git.kernel.org/pub/scm/linux/kernel/git/pci/pci Pull pci fixes from Bjorn Helgaas: - Unregister platform devices for child nodes when stopping a PCI device, even if the PCI core has already cleared the OF_POPULATED bit and of_platform_depopulate() doesn't do anything (Bartosz Golaszewski) - Rescan the bus from a separate thread so we don't deadlock when triggering rescan from sysfs (Bartosz Golaszewski) * tag 'pci-v6.11-fixes-3' of git://git.kernel.org/pub/scm/linux/kernel/git/pci/pci: PCI/pwrctl: Rescan bus on a separate thread PCI: Don't rely on of_platform_depopulate() for reused OF-nodes commit a86b83f77797ad1289601beb9a9ea61ad9f593cc Merge: 9d4c304001cf ab8521891072 Author: Linus Torvalds Date: Fri Sep 6 17:30:33 2024 -0700 Merge tag 'v6.11-rc6-cifs-client-fixes' of git://git.samba.org/sfrench/cifs-2.6 Pull smb client fixes from Steve French: - fix potential mount hang - fix retry problem in two types of compound operations - important netfs integration fix in SMB1 read paths - fix potential uninitialized zero point of inode - minor patch to improve debugging for potential crediting problems * tag 'v6.11-rc6-cifs-client-fixes' of git://git.samba.org/sfrench/cifs-2.6: netfs, cifs: Improve some debugging bits cifs: Fix SMB1 readv/writev callback in the same way as SMB2/3 cifs: Fix zero_point init on inode initialisation smb: client: fix double put of @cfile in smb2_set_path_size() smb: client: fix double put of @cfile in smb2_rename_path() smb: client: fix hang in wait_for_response() for negproto commit 9d4c304001cf44d24c643211a1673cf49ecaf287 Author: Linus Torvalds Date: Fri Sep 6 15:23:33 2024 -0700 KVM: x86: don't fall through case statements without annotations clang warns on this because it has an unannotated fall-through between cases: arch/x86/kvm/x86.c:4819:2: error: unannotated fall-through between switch labels [-Werror,-Wimplicit-fallthrough] and while we could annotate it as a fallthrough, the proper fix is to just add the break for this case, instead of falling through to the default case and the break there. gcc also has that warning, but it looks like gcc only warns for the cases where they fall through to "real code", rather than to just a break. Odd. Fixes: d30d9ee94cc0 ("KVM: x86: Only advertise KVM_CAP_READONLY_MEM when supported by VM") Cc: Paolo Bonzini Cc: Tom Dohrmann Signed-off-by: Linus Torvalds arch/x86/kvm/x86.c | 1 + 1 file changed, 1 insertion(+) commit 6b8ff511e412af4a367a8d3d4f323715a9357aa0 Merge: 890daedec4f4 c060f93253ca Author: Linus Torvalds Date: Fri Sep 6 13:08:38 2024 -0700 Merge tag 'arm64-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux Pull arm64 fix from Catalin Marinas: "Fix the arm64 usage of ftrace_graph_ret_addr() to pass the &state->graph_idx pointer instead of NULL, otherwise this function just returns early" * tag 'arm64-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux: arm64: stacktrace: fix the usage of ftrace_graph_ret_addr() commit 890daedec4f483bcb5cea0a4ce290830d12d78b2 Merge: a78d7dce1e71 1ff95eb2bebd Author: Linus Torvalds Date: Fri Sep 6 13:00:59 2024 -0700 Merge tag 'riscv-for-linus-6.11-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/riscv/linux Pull RISC-V fixes from Palmer Dabbelt: - A revert for the mmap() change that ties the allocation range to the hint adress, as what we tried to do ended up regressing on other userspace workloads. - A fix to avoid a kernel memory leak when emulating misaligned accesses from userspace. - A Kconfig fix for toolchain vector detection, which now correctly detects vector support on toolchains where the V extension depends on the M extension. - A fix to avoid failing the linear mapping bootmem bounds check on NOMMU systems. - A fix for early alternatives on relocatable kernels. * tag 'riscv-for-linus-6.11-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/riscv/linux: riscv: Fix RISCV_ALTERNATIVE_EARLY riscv: Do not restrict memory size because of linear mapping on nommu riscv: Fix toolchain vector detection riscv: misaligned: Restrict user access to kernel memory riscv: mm: Do not restrict mmap address based on hint riscv: selftests: Remove mmap hint address checks Revert "RISC-V: mm: Document mmap changes" commit a78d7dce1e71231cef671ccf5ab48b31606fe352 Merge: d45111e52b81 734ad0af3609 Author: Linus Torvalds Date: Fri Sep 6 12:50:03 2024 -0700 Merge tag 'powerpc-6.11-3' of git://git.kernel.org/pub/scm/linux/kernel/git/powerpc/linux Pull powerpc fixes from Michael Ellerman: - Fix a deadlock in the powerpc qspinlock MCS queue logic - Fix the return type of pgd_val() to not truncate 64-bit PTEs on 85xx - Allow the check for dynamic relocations in the VDSO to work correctly - Make mmu_pte_psize static to fix a build error Thanks to Christophe Leroy, Nysal Jan K.A., Nicholas Piggin, Geetika Moolchandani, Jijo Varghese, and Vaishnavi Bhat. * tag 'powerpc-6.11-3' of git://git.kernel.org/pub/scm/linux/kernel/git/powerpc/linux: powerpc/qspinlock: Fix deadlock in MCS queue powerpc/mm: Fix return type of pgd_val() powerpc/vdso: Don't discard rela sections powerpc/64e: Define mmu_pte_psize static commit d45111e52b81e0da6307bde9de8f2a5ac72d9ca9 Merge: 788220eee30d 59cbd4eea48f Author: Linus Torvalds Date: Fri Sep 6 12:45:43 2024 -0700 Merge tag 'for-linus' of git://git.kernel.org/pub/scm/virt/kvm/kvm Pull x86 kvm fixes from Paolo Bonzini: "Many small fixes that accumulated while I was on vacation... - Fixup missed comments from the REMOVED_SPTE => FROZEN_SPTE rename - Ensure a root is successfully loaded when pre-faulting SPTEs - Grab kvm->srcu when handling KVM_SET_VCPU_EVENTS to guard against accessing memslots if toggling SMM happens to force a VM-Exit - Emulate MSR_{FS,GS}_BASE on SVM even though interception is always disabled, so that KVM does the right thing if KVM's emulator encounters {RD,WR}MSR - Explicitly clear BUS_LOCK_DETECT from KVM's caps on AMD, as KVM doesn't yet virtualize BUS_LOCK_DETECT on AMD - Cleanup the help message for CONFIG_KVM_AMD_SEV, and call out that KVM now supports SEV-SNP too - Specialize return value of KVM_CHECK_EXTENSION(KVM_CAP_READONLY_MEM), based on VM type - Remove unnecessary dependency on CONFIG_HIGH_RES_TIMERS - Note an RCU quiescent state on guest exit. This avoids a call to rcu_core() if there was a grace period request while guest was running" * tag 'for-linus' of git://git.kernel.org/pub/scm/virt/kvm/kvm: KVM: Remove HIGH_RES_TIMERS dependency kvm: Note an RCU quiescent state on guest exit KVM: x86: Only advertise KVM_CAP_READONLY_MEM when supported by VM KVM: SEV: Update KVM_AMD_SEV Kconfig entry and mention SEV-SNP KVM: SVM: Don't advertise Bus Lock Detect to guest if SVM support is missing KVM: SVM: fix emulation of msr reads/writes of MSR_FS_BASE and MSR_GS_BASE KVM: x86: Acquire kvm->srcu when handling KVM_SET_VCPU_EVENTS KVM: x86/mmu: Check that root is valid/loaded when pre-faulting SPTEs KVM: x86/mmu: Fixup comments missed by the REMOVED_SPTE=>FROZEN_SPTE rename commit 788220eee30d67a485a13c34c02f51a82485f337 Merge: b66f0b119c96 b02d2cf5b220 Author: Linus Torvalds Date: Fri Sep 6 12:17:44 2024 -0700 Merge tag 'pm-6.11-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm Pull power management fix from Rafael Wysocki: "Fix an incorrect warning emitted by the amd-pstate driver on processors that don't support X86_FEATURE_CPPC (Gautham Shenoy)" * tag 'pm-6.11-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm: cpufreq/amd-pstate: Remove warning for X86_FEATURE_CPPC on certain Zen models commit b66f0b119c96dbb6b976f1d75b7bf69960069bde Merge: 703896be3015 4ba032bc71da Author: Linus Torvalds Date: Fri Sep 6 12:04:06 2024 -0700 Merge tag 'block-6.11-20240906' of git://git.kernel.dk/linux Pull block fixes from Jens Axboe: "Mostly just some fixlets for NVMe, but also a bug fix for the ublk driver and an integrity fix" * tag 'block-6.11-20240906' of git://git.kernel.dk/linux: bio-integrity: don't restrict the size of integrity metadata ublk_drv: fix NULL pointer dereference in ublk_ctrl_start_recovery() nvmet: Identify-Active Namespace ID List command should reject invalid nsid nvme: set BLK_FEAT_ZONED for ZNS multipath disks nvme-pci: Add sleep quirk for Samsung 990 Evo nvme-pci: allocate tagset on reset if necessary nvmet-tcp: fix kernel crash if commands allocation fails nvme: use better description for async reset reason nvmet: Make nvmet_debugfs static commit 703896be3015db7f8fd8822b18909a5914209a70 Merge: c3af2256adda c491b044cf5f Author: Linus Torvalds Date: Fri Sep 6 11:56:03 2024 -0700 Merge tag 'sound-6.11-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound Pull sound fixes from Takashi Iwai: "Hopefully the last PR for 6.11, at least for this level of amount. In addition to the usual HD-audio quirks, there are more changes in ASoC, but all look small and device-specific fixes, and nothing stands out. The only slightly big change is sunxi I2S fix, which looks quite safe to apply, too" * tag 'sound-6.11-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound: (21 commits) ALSA: hda/realtek - Fix inactive headset mic jack for ASUS Vivobook 15 X1504VAP ALSA: hda/realtek: Support mute LED on HP Laptop 14-dq2xxx ALSA: hda/realtek: Enable Mute Led for HP Victus 15-fb1xxx ALSA: hda/realtek: extend quirks for Clevo V5[46]0 ASoC: codecs: lpass-va-macro: set the default codec version for sm8250 ALSA: hda: add HDMI codec ID for Intel PTL ALSA: hda/realtek: add patch for internal mic in Lenovo V145 ASoC: sunxi: sun4i-i2s: fix LRCLK polarity in i2s mode ASoC: amd: yc: Add a quirk for MSI Bravo 17 (D7VEK) ASoC: mediatek: mt8188-mt6359: Modify key ASoc: SOF: topology: Clear SOF link platform name upon unload ALSA: hda/conexant: Add pincfg quirk to enable top speakers on Sirius devices ASoC: SOF: ipc: replace "enum sof_comp_type" field with "uint32_t" ASoC: fix module autoloading ASoC: tda7419: fix module autoloading ASoC: google: fix module autoloading ASoC: intel: fix module autoloading ASoC: tegra: Fix CBB error during probe() ASoC: dapm: Fix UAF for snd_soc_pcm_runtime object ASoC: Intel: soc-acpi-cht: Make Lenovo Yoga Tab 3 X90F DMI match less strict ... commit c3af2256adda212e3c3ff4773623a19a972eaf39 Merge: 0de82f0dc433 aea62c744a9a Author: Linus Torvalds Date: Fri Sep 6 11:50:55 2024 -0700 Merge tag 'mmc-v6.11-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/ulfh/mmc Pull MMC fixes from Ulf Hansson: "MMC core: - Apply SD quirks earlier during probe so they become relevant MMC host: - cqhci: Fix checking of CQHCI_HALT state - dw_mmc: Fix IDMAC operation with pages bigger than 4K - sdhci-of-aspeed: Fix module autoloading" * tag 'mmc-v6.11-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/ulfh/mmc: mmc: cqhci: Fix checking of CQHCI_HALT state mmc: dw_mmc: Fix IDMAC operation with pages bigger than 4K mmc: sdhci-of-aspeed: fix module autoloading mmc: core: apply SD quirks earlier during probe commit 0de82f0dc433a89841c3f6ffe0e496d580ad43af Merge: 2125a725545f a5135526426d Author: Linus Torvalds Date: Fri Sep 6 11:40:42 2024 -0700 Merge tag 'gpio-fixes-for-v6.11-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/brgl/linux Pull gpio fixes from Bartosz Golaszewski: - fix an OF node reference leak in gpio-rockchip - add the missing module device table to gpio-modepin * tag 'gpio-fixes-for-v6.11-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/brgl/linux: gpio: modepin: Enable module autoloading gpio: rockchip: fix OF node leak in probe() commit 2125a725545fbfcbda3f99d4bb4849a04e7c07a9 Merge: 8654fa5ca351 9ec87c5957ea Author: Linus Torvalds Date: Fri Sep 6 11:32:30 2024 -0700 Merge tag 'pmdomain-v6.11-rc2-2' of git://git.kernel.org/pub/scm/linux/kernel/git/ulfh/linux-pm Pull pmdomain fix from Ulf Hansson: - Fix support for required OPPs for multiple PM domains * tag 'pmdomain-v6.11-rc2-2' of git://git.kernel.org/pub/scm/linux/kernel/git/ulfh/linux-pm: OPP: Fix support for required OPPs for multiple PM domains commit 8654fa5ca3514263a079886b57521bcb20ee7cfd Merge: ea462f0fa438 10c48e9a8fd5 Author: Linus Torvalds Date: Fri Sep 6 11:28:14 2024 -0700 Merge tag 'pwm/for-6.11-rc7-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/ukleinek/linux Pull pwm fix from Uwe Kleine-König: "Fix an off-by-one in the stm32 driver. Hardware engineers tend to start counting at 1 while the software guys usually start with 0. This isn't so nice because that results in drivers where pwm device #2 needs to use the hardware registers with index 3. This was noticed by Fabrice Gasnier. A small patch fixing that mismatch is the only change included here" * tag 'pwm/for-6.11-rc7-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/ukleinek/linux: pwm: stm32: Use the right CCxNP bit in stm32_pwm_enable() commit ea462f0fa438381e0d420f94193c075e2a114894 Merge: 4e32c25b58b9 141bb6bc73cf Author: Linus Torvalds Date: Fri Sep 6 11:15:40 2024 -0700 Merge tag 'drm-fixes-2024-09-06' of https://gitlab.freedesktop.org/drm/kernel Pull drm fixes from Dave Airlie: "This has a fair few patches in it, but I reviewed them all and they seem like real things, amdgpu, i915 and xe each have a bunch of fixes for various things, then there is a some bridge suspend/resume ordering fixes for a recent rework, and then some single driver changes in a few others. Nothing looks too serious, hopefully next week is quiet. amdgpu: - IPS workaround - Fix compatibility with older MES firmware - Fix CPU spikes when clearing VRAM - Backlight fix - PMO fix - Revert SWSMU change to fix regression xe: - GSC loading fix - PCODE mutex fix - Suspend/Resume fixes - RPM fixes i915: - Do not attempt to load the GSC multiple times - Fix readout degamma_lut mismatch on ilk/snb - Mark debug_fence_init_onstack() with __maybe_unused - fence: Mark debug_fence_free() with __maybe_unused - display: Add mechanism to use sink model when applying quirk - display: Increase Fast Wake Sync length as a quirk komeda: - zpos normalization fix nouveau: - incorrect register fix imagination: - memory leak fix bridge: - hdmi/bridge rework fixes panthor: - cache coherency fix - hi priority access fix panel: - change of compatible string fbdev: - deferred-io init with no struct page fix" * tag 'drm-fixes-2024-09-06' of https://gitlab.freedesktop.org/drm/kernel: (29 commits) Revert "drm/amdgpu: align pp_power_profile_mode with kernel docs" drm/fbdev-dma: Only install deferred I/O if necessary drm/panthor: flush FW AS caches in slow reset path drm: panel: nv3052c: Correct WL-355608-A8 panel compatible dt-bindings: display: panel: Rename WL-355608-A8 panel to rg35xx-*-panel drm/panthor: Restrict high priorities on group_create drm/xe/display: Avoid encoder_suspend at runtime suspend drm/xe: Suspend/resume user access only during system s/r drm/xe/display: Match i915 driver suspend/resume sequences better drm/xe: Add missing runtime reference to wedged upon gt_reset drm/xe/pcode: Treat pcode as per-tile rather than per-GT drm/xe/gsc: Do not attempt to load the GSC multiple times drm/bridge-connector: reset the HDMI connector state drm/bridge-connector: move to DRM_DISPLAY_HELPER module drm/display: stop depending on DRM_DISPLAY_HELPER drm/i915/display: Increase Fast Wake Sync length as a quirk drm/i915/display: Add mechanism to use sink model when applying quirk drm/amd/display: Block timing sync for different signals in PMO drm/amd/display: Lock DC and exit IPS when changing backlight drm/amdgpu: always allocate cleared VRAM for GEM allocations ... commit 4e32c25b58b945f976435bbe51f39b32d714052e Author: Christian Brauner Date: Fri Sep 6 18:22:22 2024 +0200 libfs: fix get_stashed_dentry() get_stashed_dentry() tries to optimistically retrieve a stashed dentry from a provided location. It needs to ensure to hold rcu lock before it dereference the stashed location to prevent UAF issues. Use rcu_dereference() instead of READ_ONCE() it's effectively equivalent with some lockdep bells and whistles and it communicates clearly that this expects rcu protection. Link: https://lore.kernel.org/r/20240906-vfs-hotfix-5959800ffa68@brauner Fixes: 07fd7c329839 ("libfs: add path_from_stashed()") Reported-by: syzbot+f82b36bffae7ef78b6a7@syzkaller.appspotmail.com Fixes: syzbot+f82b36bffae7ef78b6a7@syzkaller.appspotmail.com Reported-by: syzbot+cbe4b96e1194b0e34db6@syzkaller.appspotmail.com Fixes: syzbot+cbe4b96e1194b0e34db6@syzkaller.appspotmail.com Signed-off-by: Christian Brauner Signed-off-by: Linus Torvalds fs/libfs.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) commit c491b044cf5f8236742887ba59b30032036e4ac8 Merge: a83e4c97ddd7 77212f300bfd Author: Takashi Iwai Date: Fri Sep 6 08:24:56 2024 +0200 Merge tag 'asoc-fix-v6.11-rc6' of https://git.kernel.org/pub/scm/linux/kernel/git/broonie/sound into for-linus ASoC: Fixes for v6.11 A larger set of fixes than I'd like at this point, but mainly due to people working on fixing module autoloading by adding missing exports of ID tables rather than anything particularly concerning. There are some other runtime fixes and quirks, and a tweak to the ABI definition for SOF which ensures that a struct layout doesn't vary depending on the architecture of the host. commit b831f83e40a24f07c8dcba5be408d93beedc820f Merge: d759ee240d3c 5390f315fc8c Author: Linus Torvalds Date: Thu Sep 5 20:10:53 2024 -0700 Merge tag 'bpf-6.11-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf Pull bpf fixes from Alexei Starovoitov: - Fix crash when btf_parse_base() returns an error (Martin Lau) - Fix out of bounds access in btf_name_valid_section() (Jeongjun Park) * tag 'bpf-6.11-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf: selftests/bpf: Add a selftest to check for incorrect names bpf: add check for invalid name in btf_name_valid_section() bpf: Fix a crash when btf_parse_base() returns an error pointer commit 141bb6bc73cf45e8b742d6fafa6734b6d5f82b77 Merge: ca10367a5abe 1a8d84547094 Author: Dave Airlie Date: Fri Sep 6 11:30:53 2024 +1000 Merge tag 'amd-drm-fixes-6.11-2024-09-05' of https://gitlab.freedesktop.org/agd5f/linux into drm-fixes amd-drm-fixes-6.11-2024-09-05: amdgpu: - IPS workaround - Fix compatibility with older MES firmware - Fix CPU spikes when clearing VRAM - Backlight fix - PMO fix - Revert SWSMU change to fix regression Signed-off-by: Dave Airlie From: Alex Deucher Link: https://patchwork.freedesktop.org/patch/msgid/20240905190533.854116-1-alexander.deucher@amd.com commit ca10367a5abe5f04df1374b227a10439ef686b90 Merge: 4de4a0f160cf 5a498d4d06d6 Author: Dave Airlie Date: Fri Sep 6 11:25:38 2024 +1000 Merge tag 'drm-misc-fixes-2024-09-05' of https://gitlab.freedesktop.org/drm/misc/kernel into drm-fixes A zpos normalization fix for komeda, a register bitmask fix for nouveau, a memory leak fix for imagination, three fixes for the recent bridge HDMI work, a potential DoS fix and a cache coherency for panthor, a change of panel compatible and a deferred-io fix when used with non-highmem memory. Signed-off-by: Dave Airlie From: Maxime Ripard Link: https://patchwork.freedesktop.org/patch/msgid/20240905-original-radical-guan-e7a2ae@houat commit 4de4a0f160cf8ccf29a9a70f00403e6948e7e108 Merge: f2064ae33e2a 4bfc9c553f5e Author: Dave Airlie Date: Fri Sep 6 11:12:42 2024 +1000 Merge tag 'drm-xe-fixes-2024-09-05' of https://gitlab.freedesktop.org/drm/xe/kernel into drm-fixes - GSC loading fix (Daniele) - PCODE mutex fix (Matt) - Suspend/Resume fixes (Maarten, Imre) - RPM fixes (Rodrigo) Signed-off-by: Dave Airlie From: Rodrigo Vivi Link: https://patchwork.freedesktop.org/patch/msgid/ZtmyFvDfFLPbuf6A@intel.com commit d759ee240d3c0c4a19f4d984eb21c36da76bc6ce Merge: f95359996ac3 031ae72825ce Author: Linus Torvalds Date: Thu Sep 5 17:08:01 2024 -0700 Merge tag 'net-6.11-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net Pull networking fixes from Jakub Kicinski: "Including fixes from can, bluetooth and wireless. No known regressions at this point. Another calm week, but chances are that has more to do with vacation season than the quality of our work. Current release - new code bugs: - smc: prevent NULL pointer dereference in txopt_get - eth: ti: am65-cpsw: number of XDP-related fixes Previous releases - regressions: - Revert "Bluetooth: MGMT/SMP: Fix address type when using SMP over BREDR/LE", it breaks existing user space - Bluetooth: qca: if memdump doesn't work, re-enable IBS to avoid later problems with suspend - can: mcp251x: fix deadlock if an interrupt occurs during mcp251x_open - eth: r8152: fix the firmware communication error due to use of bulk write - ptp: ocp: fix serial port information export - eth: igb: fix not clearing TimeSync interrupts for 82580 - Revert "wifi: ath11k: support hibernation", fix suspend on Lenovo Previous releases - always broken: - eth: intel: fix crashes and bugs when reconfiguration and resets happening in parallel - wifi: ath11k: fix NULL dereference in ath11k_mac_get_eirp_power() Misc: - docs: netdev: document guidance on cleanup.h" * tag 'net-6.11-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net: (61 commits) ila: call nf_unregister_net_hooks() sooner tools/net/ynl: fix cli.py --subscribe feature MAINTAINERS: fix ptp ocp driver maintainers address selftests: net: enable bind tests net: dsa: vsc73xx: fix possible subblocks range of CAPT block sched: sch_cake: fix bulk flow accounting logic for host fairness docs: netdev: document guidance on cleanup.h net: xilinx: axienet: Fix race in axienet_stop net: bridge: br_fdb_external_learn_add(): always set EXT_LEARN r8152: fix the firmware doesn't work fou: Fix null-ptr-deref in GRO. bareudp: Fix device stats updates. net: mana: Fix error handling in mana_create_txq/rxq's NAPI cleanup bpf, net: Fix a potential race in do_sock_getsockopt() net: dqs: Do not use extern for unused dql_group sch/netem: fix use after free in netem_dequeue usbnet: modern method to get random MAC MAINTAINERS: wifi: cw1200: add net-cw1200.h ice: do not bring the VSI up, if it was down before the XDP setup ice: remove ICE_CFG_BUSY locking from AF_XDP code ... commit f95359996ac35206ff24e378052ce564d5bfdc94 Merge: 2a66044754a7 c9ca76e82398 Author: Linus Torvalds Date: Thu Sep 5 16:49:10 2024 -0700 Merge tag 'spi-fix-v6.11-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/spi Pull spi fixes from Mark Brown: "A few small driver specific fixes (including some of the widespread work on fixing missing ID tables for module autoloading and the revert of some problematic PM work in spi-rockchip), some improvements to the MAINTAINERS information for the NXP drivers and the addition of a new device ID to spidev" * tag 'spi-fix-v6.11-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/spi: MAINTAINERS: SPI: Add mailing list imx@lists.linux.dev for nxp spi drivers MAINTAINERS: SPI: Add freescale lpspi maintainer information spi: spi-fsl-lpspi: Fix off-by-one in prescale max spi: spidev: Add missing spi_device_id for jg10309-01 spi: bcm63xx: Enable module autoloading spi: intel: Add check devm_kasprintf() returned value spi: spidev: Add an entry for elgin,jg10309-01 spi: rockchip: Resolve unbalanced runtime PM / system PM handling commit f2064ae33e2a6781a6b2049dc63b9cb216abe796 Merge: 431c1646e1f8 a13494de5325 Author: Dave Airlie Date: Fri Sep 6 09:45:52 2024 +1000 Merge tag 'drm-intel-fixes-2024-09-05' of https://gitlab.freedesktop.org/drm/i915/kernel into drm-fixes - drm/i915: Do not attempt to load the GSC multiple times (Daniele Ceraolo Spurio) - drm/i915: Fix readout degamma_lut mismatch on ilk/snb (Ville Syrjälä) - drm/i915/fence: Mark debug_fence_init_onstack() with __maybe_unused (Andy Shevchenko) - drm/i915/fence: Mark debug_fence_free() with __maybe_unused (Andy Shevchenko) - drm/i915/display: Add mechanism to use sink model when applying quirk [display] (Jouni Högander) - drm/i915/display: Increase Fast Wake Sync length as a quirk [display] (Jouni Högander) Signed-off-by: Dave Airlie From: Tvrtko Ursulin Link: https://patchwork.freedesktop.org/patch/msgid/Ztlo2hVO4SBvfAnq@linux commit 2a66044754a7b1f2784031f679fb25ba465595b2 Merge: 6c5b3e30e585 1a5caec7f80c Author: Linus Torvalds Date: Thu Sep 5 16:41:16 2024 -0700 Merge tag 'regulator-fix-v6.11-stub' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/regulator Pull regulator fix from Mark Brown: "A fix from Doug Anderson for a missing stub, required to fix the build for some newly added users of devm_regulator_bulk_get_const() in !REGULATOR configurations" * tag 'regulator-fix-v6.11-stub' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/regulator: regulator: core: Stub devm_regulator_bulk_get_const() if !CONFIG_REGULATOR commit 6c5b3e30e5854f121d2e2cbb2d5ff7350ef7fdfb Merge: e4b42053b788 cff56ff737e2 Author: Linus Torvalds Date: Thu Sep 5 16:35:57 2024 -0700 Merge tag 'rust-fixes-6.11-2' of https://github.com/Rust-for-Linux/linux Pull Rust fixes from Miguel Ojeda: "Toolchain and infrastructure: - Fix builds for nightly compiler users now that 'new_uninit' was split into new features by using an alternative approach for the code that used what is now called the 'box_uninit_write' feature - Allow the 'stable_features' lint to preempt upcoming warnings about them, since soon there will be unstable features that will become stable in nightly compilers - Export bss symbols too 'kernel' crate: - 'block' module: fix wrong usage of lockdep API 'macros' crate: - Provide correct provenance when constructing 'THIS_MODULE' Documentation: - Remove unintended indentation (blockquotes) in generated output - Fix a couple typos MAINTAINERS: - Remove Wedson as Rust maintainer - Update Andreas' email" * tag 'rust-fixes-6.11-2' of https://github.com/Rust-for-Linux/linux: MAINTAINERS: update Andreas Hindborg's email address MAINTAINERS: Remove Wedson as Rust maintainer rust: macros: provide correct provenance when constructing THIS_MODULE rust: allow `stable_features` lint docs: rust: remove unintended blockquote in Quick Start rust: alloc: eschew `Box>::write` rust: kernel: fix typos in code comments docs: rust: remove unintended blockquote in Coding Guidelines rust: block: fix wrong usage of lockdep API rust: kbuild: fix export of bss symbols commit e4b42053b788a81bfec7455308c5c1ead4a171cd Merge: ad618736883b 5bfbcd1ee57b Author: Linus Torvalds Date: Thu Sep 5 16:29:41 2024 -0700 Merge tag 'trace-v6.11-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace Pull tracing fixes from Steven Rostedt: - Fix adding a new fgraph callback after function graph tracing has already started. If the new caller does not initialize its hash before registering the fgraph_ops, it can cause a NULL pointer dereference. Fix this by adding a new parameter to ftrace_graph_enable_direct() passing in the newly added gops directly and not rely on using the fgraph_array[], as entries in the fgraph_array[] must be initialized. Assign the new gops to the fgraph_array[] after it goes through ftrace_startup_subops() as that will properly initialize the gops->ops and initialize its hashes. - Fix a memory leak in fgraph storage memory test. If the "multiple fgraph storage on a function" boot up selftest fails in the registering of the function graph tracer, it will not free the memory it allocated for the filter. Break the loop up into two where it allocates the filters first and then registers the functions where any errors will do the appropriate clean ups. - Only clear the timerlat timers if it has an associated kthread. In the rtla tool that uses timerlat, if it was killed just as it was shutting down, the signals can free the kthread and the timer. But the closing of the timerlat files could cause the hrtimer_cancel() to be called on the already freed timer. As the kthread variable is is set to NULL when the kthreads are stopped and the timers are freed it can be used to know not to call hrtimer_cancel() on the timer if the kthread variable is NULL. - Use a cpumask to keep track of osnoise/timerlat kthreads The timerlat tracer can use user space threads for its analysis. With the killing of the rtla tool, the kernel can get confused between if it is using a user space thread to analyze or one of its own kernel threads. When this confusion happens, kthread_stop() can be called on a user space thread and bad things happen. As the kernel threads are per-cpu, a bitmask can be used to know when a kernel thread is used or when a user space thread is used. - Add missing interface_lock to osnoise/timerlat stop_kthread() The stop_kthread() function in osnoise/timerlat clears the osnoise kthread variable, and if it was a user space thread does a put_task on it. But this can race with the closing of the timerlat files that also does a put_task on the kthread, and if the race happens the task will have put_task called on it twice and oops. - Add cond_resched() to the tracing_iter_reset() loop. The latency tracers keep writing to the ring buffer without resetting when it issues a new "start" event (like interrupts being disabled). When reading the buffer with an iterator, the tracing_iter_reset() sets its pointer to that start event by walking through all the events in the buffer until it gets to the time stamp of the start event. In the case of a very large buffer, the loop that looks for the start event has been reported taking a very long time with a non preempt kernel that it can trigger a soft lock up warning. Add a cond_resched() into that loop to make sure that doesn't happen. - Use list_del_rcu() for eventfs ei->list variable It was reported that running loops of creating and deleting kprobe events could cause a crash due to the eventfs list iteration hitting a LIST_POISON variable. This is because the list is protected by SRCU but when an item is deleted from the list, it was using list_del() which poisons the "next" pointer. This is what list_del_rcu() was to prevent. * tag 'trace-v6.11-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace: tracing/timerlat: Add interface_lock around clearing of kthread in stop_kthread() tracing/timerlat: Only clear timer if a kthread exists tracing/osnoise: Use a cpumask to know what threads are kthreads eventfs: Use list_del_rcu() for SRCU protected list variable tracing: Avoid possible softlockup in tracing_iter_reset() tracing: Fix memory leak in fgraph storage selftest tracing: fgraph: Fix to add new fgraph_ops to array after ftrace_startup_subops() commit 031ae72825cef43e4650140b800ad58bf7a6a466 Author: Eric Dumazet Date: Wed Sep 4 14:44:18 2024 +0000 ila: call nf_unregister_net_hooks() sooner syzbot found an use-after-free Read in ila_nf_input [1] Issue here is that ila_xlat_exit_net() frees the rhashtable, then call nf_unregister_net_hooks(). It should be done in the reverse way, with a synchronize_rcu(). This is a good match for a pre_exit() method. [1] BUG: KASAN: use-after-free in rht_key_hashfn include/linux/rhashtable.h:159 [inline] BUG: KASAN: use-after-free in __rhashtable_lookup include/linux/rhashtable.h:604 [inline] BUG: KASAN: use-after-free in rhashtable_lookup include/linux/rhashtable.h:646 [inline] BUG: KASAN: use-after-free in rhashtable_lookup_fast+0x77a/0x9b0 include/linux/rhashtable.h:672 Read of size 4 at addr ffff888064620008 by task ksoftirqd/0/16 CPU: 0 UID: 0 PID: 16 Comm: ksoftirqd/0 Not tainted 6.11.0-rc4-syzkaller-00238-g2ad6d23f465a #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/06/2024 Call Trace: __dump_stack lib/dump_stack.c:93 [inline] dump_stack_lvl+0x241/0x360 lib/dump_stack.c:119 print_address_description mm/kasan/report.c:377 [inline] print_report+0x169/0x550 mm/kasan/report.c:488 kasan_report+0x143/0x180 mm/kasan/report.c:601 rht_key_hashfn include/linux/rhashtable.h:159 [inline] __rhashtable_lookup include/linux/rhashtable.h:604 [inline] rhashtable_lookup include/linux/rhashtable.h:646 [inline] rhashtable_lookup_fast+0x77a/0x9b0 include/linux/rhashtable.h:672 ila_lookup_wildcards net/ipv6/ila/ila_xlat.c:132 [inline] ila_xlat_addr net/ipv6/ila/ila_xlat.c:652 [inline] ila_nf_input+0x1fe/0x3c0 net/ipv6/ila/ila_xlat.c:190 nf_hook_entry_hookfn include/linux/netfilter.h:154 [inline] nf_hook_slow+0xc3/0x220 net/netfilter/core.c:626 nf_hook include/linux/netfilter.h:269 [inline] NF_HOOK+0x29e/0x450 include/linux/netfilter.h:312 __netif_receive_skb_one_core net/core/dev.c:5661 [inline] __netif_receive_skb+0x1ea/0x650 net/core/dev.c:5775 process_backlog+0x662/0x15b0 net/core/dev.c:6108 __napi_poll+0xcb/0x490 net/core/dev.c:6772 napi_poll net/core/dev.c:6841 [inline] net_rx_action+0x89b/0x1240 net/core/dev.c:6963 handle_softirqs+0x2c4/0x970 kernel/softirq.c:554 run_ksoftirqd+0xca/0x130 kernel/softirq.c:928 smpboot_thread_fn+0x544/0xa30 kernel/smpboot.c:164 kthread+0x2f0/0x390 kernel/kthread.c:389 ret_from_fork+0x4b/0x80 arch/x86/kernel/process.c:147 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244 The buggy address belongs to the physical page: page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x64620 flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff) page_type: 0xbfffffff(buddy) raw: 00fff00000000000 ffffea0000959608 ffffea00019d9408 0000000000000000 raw: 0000000000000000 0000000000000003 00000000bfffffff 0000000000000000 page dumped because: kasan: bad access detected page_owner tracks the page as freed page last allocated via order 3, migratetype Unmovable, gfp_mask 0x52dc0(GFP_KERNEL|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_ZERO), pid 5242, tgid 5242 (syz-executor), ts 73611328570, free_ts 618981657187 set_page_owner include/linux/page_owner.h:32 [inline] post_alloc_hook+0x1f3/0x230 mm/page_alloc.c:1493 prep_new_page mm/page_alloc.c:1501 [inline] get_page_from_freelist+0x2e4c/0x2f10 mm/page_alloc.c:3439 __alloc_pages_noprof+0x256/0x6c0 mm/page_alloc.c:4695 __alloc_pages_node_noprof include/linux/gfp.h:269 [inline] alloc_pages_node_noprof include/linux/gfp.h:296 [inline] ___kmalloc_large_node+0x8b/0x1d0 mm/slub.c:4103 __kmalloc_large_node_noprof+0x1a/0x80 mm/slub.c:4130 __do_kmalloc_node mm/slub.c:4146 [inline] __kmalloc_node_noprof+0x2d2/0x440 mm/slub.c:4164 __kvmalloc_node_noprof+0x72/0x190 mm/util.c:650 bucket_table_alloc lib/rhashtable.c:186 [inline] rhashtable_init_noprof+0x534/0xa60 lib/rhashtable.c:1071 ila_xlat_init_net+0xa0/0x110 net/ipv6/ila/ila_xlat.c:613 ops_init+0x359/0x610 net/core/net_namespace.c:139 setup_net+0x515/0xca0 net/core/net_namespace.c:343 copy_net_ns+0x4e2/0x7b0 net/core/net_namespace.c:508 create_new_namespaces+0x425/0x7b0 kernel/nsproxy.c:110 unshare_nsproxy_namespaces+0x124/0x180 kernel/nsproxy.c:228 ksys_unshare+0x619/0xc10 kernel/fork.c:3328 __do_sys_unshare kernel/fork.c:3399 [inline] __se_sys_unshare kernel/fork.c:3397 [inline] __x64_sys_unshare+0x38/0x40 kernel/fork.c:3397 page last free pid 11846 tgid 11846 stack trace: reset_page_owner include/linux/page_owner.h:25 [inline] free_pages_prepare mm/page_alloc.c:1094 [inline] free_unref_page+0xd22/0xea0 mm/page_alloc.c:2612 __folio_put+0x2c8/0x440 mm/swap.c:128 folio_put include/linux/mm.h:1486 [inline] free_large_kmalloc+0x105/0x1c0 mm/slub.c:4565 kfree+0x1c4/0x360 mm/slub.c:4588 rhashtable_free_and_destroy+0x7c6/0x920 lib/rhashtable.c:1169 ila_xlat_exit_net+0x55/0x110 net/ipv6/ila/ila_xlat.c:626 ops_exit_list net/core/net_namespace.c:173 [inline] cleanup_net+0x802/0xcc0 net/core/net_namespace.c:640 process_one_work kernel/workqueue.c:3231 [inline] process_scheduled_works+0xa2c/0x1830 kernel/workqueue.c:3312 worker_thread+0x86d/0xd40 kernel/workqueue.c:3390 kthread+0x2f0/0x390 kernel/kthread.c:389 ret_from_fork+0x4b/0x80 arch/x86/kernel/process.c:147 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244 Memory state around the buggy address: ffff88806461ff00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc ffff88806461ff80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc >ffff888064620000: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ^ ffff888064620080: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ffff888064620100: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff Fixes: 7f00feaf1076 ("ila: Add generic ILA translation facility") Reported-by: syzbot Signed-off-by: Eric Dumazet Cc: Tom Herbert Reviewed-by: Florian Westphal Link: https://patch.msgid.link/20240904144418.1162839-1-edumazet@google.com Signed-off-by: Jakub Kicinski net/ipv6/ila/ila.h | 1 + net/ipv6/ila/ila_main.c | 6 ++++++ net/ipv6/ila/ila_xlat.c | 13 +++++++++---- 3 files changed, 16 insertions(+), 4 deletions(-) commit 6fda63c45fe8a0870226c13dcce1cc21b7c4d508 Author: Arkadiusz Kubalewski Date: Wed Sep 4 15:50:34 2024 +0200 tools/net/ynl: fix cli.py --subscribe feature Execution of command: ./tools/net/ynl/cli.py --spec Documentation/netlink/specs/dpll.yaml / --subscribe "monitor" --sleep 10 fails with: File "/repo/./tools/net/ynl/cli.py", line 109, in main ynl.check_ntf() File "/repo/tools/net/ynl/lib/ynl.py", line 924, in check_ntf op = self.rsp_by_value[nl_msg.cmd()] KeyError: 19 Parsing Generic Netlink notification messages performs lookup for op in the message. The message was not yet decoded, and is not yet considered GenlMsg, thus msg.cmd() returns Generic Netlink family id (19) instead of proper notification command id (i.e.: DPLL_CMD_PIN_CHANGE_NTF=13). Allow the op to be obtained within NetlinkProtocol.decode(..) itself if the op was not passed to the decode function, thus allow parsing of Generic Netlink notifications without causing the failure. Suggested-by: Donald Hunter Link: https://lore.kernel.org/netdev/m2le0n5xpn.fsf@gmail.com/ Fixes: 0a966d606c68 ("tools/net/ynl: Fix extack decoding for directional ops") Signed-off-by: Arkadiusz Kubalewski Reviewed-by: Donald Hunter Link: https://patch.msgid.link/20240904135034.316033-1-arkadiusz.kubalewski@intel.com Signed-off-by: Jakub Kicinski tools/net/ynl/lib/ynl.py | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) commit 20d664ebd212a85ad9c134e557619402bee6987f Author: Vadim Fedorenko Date: Wed Sep 4 13:18:55 2024 +0000 MAINTAINERS: fix ptp ocp driver maintainers address While checking the latest series for ptp_ocp driver I realised that MAINTAINERS file has wrong item about email on linux.dev domain. Fixes: 795fd9342c62 ("ptp_ocp: adjust MAINTAINERS and mailmap") Signed-off-by: Vadim Fedorenko Reviewed-by: Simon Horman Link: https://patch.msgid.link/20240904131855.559078-1-vadim.fedorenko@linux.dev Signed-off-by: Jakub Kicinski MAINTAINERS | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit e4af74a53b7aa865e7fcc104630ebb7a9129b71f Author: Jamie Bainbridge Date: Wed Sep 4 16:12:26 2024 +1000 selftests: net: enable bind tests bind_wildcard is compiled but not run, bind_timewait is not compiled. These two tests complete in a very short time, use the test harness properly, and seem reasonable to enable. The author of the tests confirmed via email that these were intended to be run. Enable these two tests. Fixes: 13715acf8ab5 ("selftest: Add test for bind() conflicts.") Fixes: 2c042e8e54ef ("tcp: Add selftest for bind() and TIME_WAIT.") Signed-off-by: Jamie Bainbridge Reviewed-by: Eric Dumazet Reviewed-by: Kuniyuki Iwashima Link: https://patch.msgid.link/5a009b26cf5fb1ad1512d89c61b37e2fac702323.1725430322.git.jamie.bainbridge@gmail.com Signed-off-by: Jakub Kicinski tools/testing/selftests/net/Makefile | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) commit 12cb32a52eb607dc4d0e45fe6f4cf946d08da0fd Author: David Gow Date: Thu Sep 5 10:47:55 2024 +0800 kunit: Fix missing kerneldoc comment Add a missing kerneldoc comment for the 'test' test context parameter, fixing the following warning: include/kunit/test.h:492: warning: Function parameter or struct member 'test' not described in 'kunit_kfree_const' Reported-by: Stephen Rothwell Closes: https://lore.kernel.org/lkml/20240827160631.67e121ed@canb.auug.org.au/ Fixes: f2c6dbd22017 ("kunit: Device wrappers should also manage driver name") Signed-off-by: David Gow Reviewed-by: Kees Cook Signed-off-by: Shuah Khan include/kunit/test.h | 1 + 1 file changed, 1 insertion(+) commit 1a8d845470941f1b6de1b392227530c097dc5e0c Author: Alex Deucher Date: Thu Sep 5 14:24:38 2024 -0400 Revert "drm/amdgpu: align pp_power_profile_mode with kernel docs" This reverts commit 8f614469de248a4bc55fb07e55d5f4c340c75b11. This breaks some manual setting of the profile mode in certain cases. Closes: https://gitlab.freedesktop.org/drm/amd/-/issues/3600 Signed-off-by: Alex Deucher (cherry picked from commit 7a199557643e993d4e7357860624b8aa5d8f4340) Cc: stable@vger.kernel.org drivers/gpu/drm/amd/pm/swsmu/amdgpu_smu.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) commit c9ca76e8239810ccb08825a7b847c39d367410a6 Author: Frank Li Date: Thu Sep 5 11:52:30 2024 -0400 MAINTAINERS: SPI: Add mailing list imx@lists.linux.dev for nxp spi drivers Add mailing list imx@lists.linux.dev for nxp spi drivers(qspi, fspi and dspi). Signed-off-by: Frank Li Reviewed-by: Stefan Wahren Link: https://patch.msgid.link/20240905155230.1901787-1-Frank.Li@nxp.com Signed-off-by: Mark Brown MAINTAINERS | 3 +++ 1 file changed, 3 insertions(+) commit fb9820c550cfc58684b612471cc50e4b5c305404 Author: Frank Li Date: Thu Sep 5 11:41:24 2024 -0400 MAINTAINERS: SPI: Add freescale lpspi maintainer information Add imx@lists.linux.dev and NXP maintainer information for lpspi driver (drivers/spi/spi-fsl-lpspi.c). Signed-off-by: Frank Li Reviewed-by: Stefan Wahren Link: https://patch.msgid.link/20240905154124.1901311-1-Frank.Li@nxp.com Signed-off-by: Mark Brown MAINTAINERS | 8 ++++++++ 1 file changed, 8 insertions(+) commit ad618736883b8970f66af799e34007475fe33a68 Merge: 120434e5b305 d34af755a533 Author: Linus Torvalds Date: Thu Sep 5 09:57:50 2024 -0700 Merge tag 'platform-drivers-x86-v6.11-6' of git://git.kernel.org/pub/scm/linux/kernel/git/pdx86/platform-drivers-x86 Pull x86 platform driver fixes from Ilpo Järvinen: - amd/pmf: ASUS GA403 quirk matching tweak - dell-smbios: Fix to the init function rollback path * tag 'platform-drivers-x86-v6.11-6' of git://git.kernel.org/pub/scm/linux/kernel/git/pdx86/platform-drivers-x86: platform/x86/amd: pmf: Make ASUS GA403 quirk generic platform/x86: dell-smbios: Fix error path in dell_smbios_init() commit 120434e5b305defa1fb1e7a38421ed08f93243d5 Merge: c763c4339688 f2c6dbd22017 Author: Linus Torvalds Date: Thu Sep 5 09:43:38 2024 -0700 Merge tag 'linux_kselftest-kunit-fixes-6.11-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/shuah/linux-kselftest Pull kunit fix fromShuah Khan: "One single fix to a use-after-free bug resulting from kunit_driver_create() failing to copy the driver name leaving it on the stack or freeing it" * tag 'linux_kselftest-kunit-fixes-6.11-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/shuah/linux-kselftest: kunit: Device wrappers should also manage driver name commit 59cbd4eea48fdbc68fc17a29ad71188fea74b28b Author: Steven Rostedt Date: Wed Aug 21 09:51:27 2024 -0400 KVM: Remove HIGH_RES_TIMERS dependency Commit 92b5265d38f6a ("KVM: Depend on HIGH_RES_TIMERS") added a dependency to high resolution timers with the comment: KVM lapic timer and tsc deadline timer based on hrtimer, setting a leftmost node to rb tree and then do hrtimer reprogram. If hrtimer not configured as high resolution, hrtimer_enqueue_reprogram do nothing and then make kvm lapic timer and tsc deadline timer fail. That was back in 2012, where hrtimer_start_range_ns() would do the reprogramming with hrtimer_enqueue_reprogram(). But as that was a nop with high resolution timers disabled, this did not work. But a lot has changed in the last 12 years. For example, commit 49a2a07514a3a ("hrtimer: Kick lowres dynticks targets on timer enqueue") modifies __hrtimer_start_range_ns() to work with low res timers. There's been lots of other changes that make low res work. ChromeOS has tested this before as well, and it hasn't seen any issues with running KVM with high res timers disabled. There could be problems, especially at low HZ, for guests that do not support kvmclock and rely on precise delivery of periodic timers to keep their clock running. This can be the APIC timer (provided by the kernel), the RTC (provided by userspace), or the i8254 (choice of kernel/userspace). These guests are few and far between these days, and in the case of the APIC timer + Intel hosts we can use the preemption timer (which is TSC-based and has better latency _and_ accuracy). In KVM, only x86 is requiring CONFIG_HIGH_RES_TIMERS; perhaps a "depends on HIGH_RES_TIMERS || EXPERT" could be added to virt/kvm, or a pr_warn could be added to kvm_init if HIGH_RES_TIMERS are not enabled. But in general, it seems that there must be other code in the kernel (maybe sound/?) that is relying on having high-enough HZ or hrtimers but that's not documented anywhere. Whenever you disable it you probably need to know what you're doing and what your workload is; so the dependency is not particularly interesting, and we can just remove it. Signed-off-by: Steven Rostedt (Google) Message-ID: <20240821095127.45d17b19@gandalf.local.home> [Added the last two paragraphs to the commit message. - Paolo] Signed-off-by: Paolo Bonzini arch/x86/kvm/Kconfig | 1 - 1 file changed, 1 deletion(-) commit 5bfbcd1ee57b607fd29e4645c7f350dd385dd9ad Author: Steven Rostedt Date: Thu Sep 5 11:33:59 2024 -0400 tracing/timerlat: Add interface_lock around clearing of kthread in stop_kthread() The timerlat interface will get and put the task that is part of the "kthread" field of the osn_var to keep it around until all references are released. But here's a race in the "stop_kthread()" code that will call put_task_struct() on the kthread if it is not a kernel thread. This can race with the releasing of the references to that task struct and the put_task_struct() can be called twice when it should have been called just once. Take the interface_lock() in stop_kthread() to synchronize this change. But to do so, the function stop_per_cpu_kthreads() needs to change the loop from for_each_online_cpu() to for_each_possible_cpu() and remove the cpu_read_lock(), as the interface_lock can not be taken while the cpu locks are held. The only side effect of this change is that it may do some extra work, as the per_cpu variables of the offline CPUs would not be set anyway, and would simply be skipped in the loop. Remove unneeded "return;" in stop_kthread(). Cc: stable@vger.kernel.org Cc: Masami Hiramatsu Cc: Mathieu Desnoyers Cc: Tomas Glozar Cc: John Kacur Cc: "Luis Claudio R. Goncalves" Link: https://lore.kernel.org/20240905113359.2b934242@gandalf.local.home Fixes: e88ed227f639e ("tracing/timerlat: Add user-space interface") Signed-off-by: Steven Rostedt (Google) kernel/trace/trace_osnoise.c | 13 ++++++------- 1 file changed, 6 insertions(+), 7 deletions(-) commit e6a53481da292d970d1edf0d8831121d1c5e2f0d Author: Steven Rostedt Date: Thu Sep 5 08:53:30 2024 -0400 tracing/timerlat: Only clear timer if a kthread exists The timerlat tracer can use user space threads to check for osnoise and timer latency. If the program using this is killed via a SIGTERM, the threads are shutdown one at a time and another tracing instance can start up resetting the threads before they are fully closed. That causes the hrtimer assigned to the kthread to be shutdown and freed twice when the dying thread finally closes the file descriptors, causing a use-after-free bug. Only cancel the hrtimer if the associated thread is still around. Also add the interface_lock around the resetting of the tlat_var->kthread. Note, this is just a quick fix that can be backported to stable. A real fix is to have a better synchronization between the shutdown of old threads and the starting of new ones. Link: https://lore.kernel.org/all/20240820130001.124768-1-tglozar@redhat.com/ Cc: stable@vger.kernel.org Cc: Masami Hiramatsu Cc: Mathieu Desnoyers Cc: "Luis Claudio R. Goncalves" Link: https://lore.kernel.org/20240905085330.45985730@gandalf.local.home Fixes: e88ed227f639e ("tracing/timerlat: Add user-space interface") Reported-by: Tomas Glozar Signed-off-by: Steven Rostedt (Google) kernel/trace/trace_osnoise.c | 19 +++++++++++++------ 1 file changed, 13 insertions(+), 6 deletions(-) commit 177e1cc2f41235c145041eed03ef5bab18f32328 Author: Steven Rostedt Date: Wed Sep 4 10:34:28 2024 -0400 tracing/osnoise: Use a cpumask to know what threads are kthreads The start_kthread() and stop_thread() code was not always called with the interface_lock held. This means that the kthread variable could be unexpectedly changed causing the kthread_stop() to be called on it when it should not have been, leading to: while true; do rtla timerlat top -u -q & PID=$!; sleep 5; kill -INT $PID; sleep 0.001; kill -TERM $PID; wait $PID; done Causing the following OOPS: Oops: general protection fault, probably for non-canonical address 0xdffffc0000000002: 0000 [#1] PREEMPT SMP KASAN PTI KASAN: null-ptr-deref in range [0x0000000000000010-0x0000000000000017] CPU: 5 UID: 0 PID: 885 Comm: timerlatu/5 Not tainted 6.11.0-rc4-test-00002-gbc754cc76d1b-dirty #125 a533010b71dab205ad2f507188ce8c82203b0254 Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 RIP: 0010:hrtimer_active+0x58/0x300 Code: 48 c1 ee 03 41 54 48 01 d1 48 01 d6 55 53 48 83 ec 20 80 39 00 0f 85 30 02 00 00 49 8b 6f 30 4c 8d 75 10 4c 89 f0 48 c1 e8 03 <0f> b6 3c 10 4c 89 f0 83 e0 07 83 c0 03 40 38 f8 7c 09 40 84 ff 0f RSP: 0018:ffff88811d97f940 EFLAGS: 00010202 RAX: 0000000000000002 RBX: ffff88823c6b5b28 RCX: ffffed10478d6b6b RDX: dffffc0000000000 RSI: ffffed10478d6b6c RDI: ffff88823c6b5b28 RBP: 0000000000000000 R08: ffff88823c6b5b58 R09: ffff88823c6b5b60 R10: ffff88811d97f957 R11: 0000000000000010 R12: 00000000000a801d R13: ffff88810d8b35d8 R14: 0000000000000010 R15: ffff88823c6b5b28 FS: 0000000000000000(0000) GS:ffff88823c680000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000561858ad7258 CR3: 000000007729e001 CR4: 0000000000170ef0 Call Trace: ? die_addr+0x40/0xa0 ? exc_general_protection+0x154/0x230 ? asm_exc_general_protection+0x26/0x30 ? hrtimer_active+0x58/0x300 ? __pfx_mutex_lock+0x10/0x10 ? __pfx_locks_remove_file+0x10/0x10 hrtimer_cancel+0x15/0x40 timerlat_fd_release+0x8e/0x1f0 ? security_file_release+0x43/0x80 __fput+0x372/0xb10 task_work_run+0x11e/0x1f0 ? _raw_spin_lock+0x85/0xe0 ? __pfx_task_work_run+0x10/0x10 ? poison_slab_object+0x109/0x170 ? do_exit+0x7a0/0x24b0 do_exit+0x7bd/0x24b0 ? __pfx_migrate_enable+0x10/0x10 ? __pfx_do_exit+0x10/0x10 ? __pfx_read_tsc+0x10/0x10 ? ktime_get+0x64/0x140 ? _raw_spin_lock_irq+0x86/0xe0 do_group_exit+0xb0/0x220 get_signal+0x17ba/0x1b50 ? vfs_read+0x179/0xa40 ? timerlat_fd_read+0x30b/0x9d0 ? __pfx_get_signal+0x10/0x10 ? __pfx_timerlat_fd_read+0x10/0x10 arch_do_signal_or_restart+0x8c/0x570 ? __pfx_arch_do_signal_or_restart+0x10/0x10 ? vfs_read+0x179/0xa40 ? ksys_read+0xfe/0x1d0 ? __pfx_ksys_read+0x10/0x10 syscall_exit_to_user_mode+0xbc/0x130 do_syscall_64+0x74/0x110 ? __pfx___rseq_handle_notify_resume+0x10/0x10 ? __pfx_ksys_read+0x10/0x10 ? fpregs_restore_userregs+0xdb/0x1e0 ? fpregs_restore_userregs+0xdb/0x1e0 ? syscall_exit_to_user_mode+0x116/0x130 ? do_syscall_64+0x74/0x110 ? do_syscall_64+0x74/0x110 ? do_syscall_64+0x74/0x110 entry_SYSCALL_64_after_hwframe+0x71/0x79 RIP: 0033:0x7ff0070eca9c Code: Unable to access opcode bytes at 0x7ff0070eca72. RSP: 002b:00007ff006dff8c0 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 RAX: 0000000000000000 RBX: 0000000000000005 RCX: 00007ff0070eca9c RDX: 0000000000000400 RSI: 00007ff006dff9a0 RDI: 0000000000000003 RBP: 00007ff006dffde0 R08: 0000000000000000 R09: 00007ff000000ba0 R10: 00007ff007004b08 R11: 0000000000000246 R12: 0000000000000003 R13: 00007ff006dff9a0 R14: 0000000000000007 R15: 0000000000000008 Modules linked in: snd_hda_intel snd_intel_dspcfg snd_intel_sdw_acpi snd_hda_codec snd_hwdep snd_hda_core ---[ end trace 0000000000000000 ]--- This is because it would mistakenly call kthread_stop() on a user space thread making it "exit" before it actually exits. Since kthreads are created based on global behavior, use a cpumask to know when kthreads are running and that they need to be shutdown before proceeding to do new work. Link: https://lore.kernel.org/all/20240820130001.124768-1-tglozar@redhat.com/ This was debugged by using the persistent ring buffer: Link: https://lore.kernel.org/all/20240823013902.135036960@goodmis.org/ Note, locking was originally used to fix this, but that proved to cause too many deadlocks to work around: https://lore.kernel.org/linux-trace-kernel/20240823102816.5e55753b@gandalf.local.home/ Cc: stable@vger.kernel.org Cc: Masami Hiramatsu Cc: Mathieu Desnoyers Cc: "Luis Claudio R. Goncalves" Link: https://lore.kernel.org/20240904103428.08efdf4c@gandalf.local.home Fixes: e88ed227f639e ("tracing/timerlat: Add user-space interface") Reported-by: Tomas Glozar Signed-off-by: Steven Rostedt (Google) kernel/trace/trace_osnoise.c | 18 +++++++++++++++--- 1 file changed, 15 insertions(+), 3 deletions(-) commit 4ba032bc71dad8d604d308afffaa16b81816c751 Merge: b858a36fe9a1 899d2e5a4e3d Author: Jens Axboe Date: Thu Sep 5 08:45:54 2024 -0600 Merge tag 'nvme-6.11-2024-09-05' of git://git.infradead.org/nvme into block-6.11 Pull NVMe fixes from Keith: "nvme fixes for Linux 6.11 - Sparse fix on static symbol (Jinjie) - Misleading warning message fix (Keith) - TCP command allocation handling fix (Maurizio) - PCI tagset allocation handling fix (Keith) - Low-power quirk for Samsung (Georg) - Queue limits fix for zone devices (Christoph) - Target protocol behavior fix (Maurizio)" * tag 'nvme-6.11-2024-09-05' of git://git.infradead.org/nvme: nvmet: Identify-Active Namespace ID List command should reject invalid nsid nvme: set BLK_FEAT_ZONED for ZNS multipath disks nvme-pci: Add sleep quirk for Samsung 990 Evo nvme-pci: allocate tagset on reset if necessary nvmet-tcp: fix kernel crash if commands allocation fails nvme: use better description for async reset reason nvmet: Make nvmet_debugfs static commit a83e4c97ddd7473406ec5e1df8d5e7b24bd7e892 Author: Vasiliy Kovalev Date: Thu Sep 5 17:02:11 2024 +0300 ALSA: hda/realtek - Fix inactive headset mic jack for ASUS Vivobook 15 X1504VAP When the headset is connected, there is no automatic switching of the capture source - you can only manually select the headset microphone in pavucontrol. This patch fixes/activates the inactive microphone of the headset. Signed-off-by: Vasiliy Kovalev Cc: Link: https://patch.msgid.link/20240905140211.937385-1-kovalev@altlinux.org Signed-off-by: Takashi Iwai sound/pci/hda/patch_realtek.c | 1 + 1 file changed, 1 insertion(+) commit d2603279c7d645bf0d11fa253b23f1ab48fc8d3c Author: Steven Rostedt Date: Wed Sep 4 13:16:05 2024 -0400 eventfs: Use list_del_rcu() for SRCU protected list variable Chi Zhiling reported: We found a null pointer accessing in tracefs[1], the reason is that the variable 'ei_child' is set to LIST_POISON1, that means the list was removed in eventfs_remove_rec. so when access the ei_child->is_freed, the panic triggered. by the way, the following script can reproduce this panic loop1 (){ while true do echo "p:kp submit_bio" > /sys/kernel/debug/tracing/kprobe_events echo "" > /sys/kernel/debug/tracing/kprobe_events done } loop2 (){ while true do tree /sys/kernel/debug/tracing/events/kprobes/ done } loop1 & loop2 [1]: [ 1147.959632][T17331] Unable to handle kernel paging request at virtual address dead000000000150 [ 1147.968239][T17331] Mem abort info: [ 1147.971739][T17331] ESR = 0x0000000096000004 [ 1147.976172][T17331] EC = 0x25: DABT (current EL), IL = 32 bits [ 1147.982171][T17331] SET = 0, FnV = 0 [ 1147.985906][T17331] EA = 0, S1PTW = 0 [ 1147.989734][T17331] FSC = 0x04: level 0 translation fault [ 1147.995292][T17331] Data abort info: [ 1147.998858][T17331] ISV = 0, ISS = 0x00000004, ISS2 = 0x00000000 [ 1148.005023][T17331] CM = 0, WnR = 0, TnD = 0, TagAccess = 0 [ 1148.010759][T17331] GCS = 0, Overlay = 0, DirtyBit = 0, Xs = 0 [ 1148.016752][T17331] [dead000000000150] address between user and kernel address ranges [ 1148.024571][T17331] Internal error: Oops: 0000000096000004 [#1] SMP [ 1148.030825][T17331] Modules linked in: team_mode_loadbalance team nlmon act_gact cls_flower sch_ingress bonding tls macvlan dummy ib_core bridge stp llc veth amdgpu amdxcp mfd_core gpu_sched drm_exec drm_buddy radeon crct10dif_ce video drm_suballoc_helper ghash_ce drm_ttm_helper sha2_ce ttm sha256_arm64 i2c_algo_bit sha1_ce sbsa_gwdt cp210x drm_display_helper cec sr_mod cdrom drm_kms_helper binfmt_misc sg loop fuse drm dm_mod nfnetlink ip_tables autofs4 [last unloaded: tls] [ 1148.072808][T17331] CPU: 3 PID: 17331 Comm: ls Tainted: G W ------- ---- 6.6.43 #2 [ 1148.081751][T17331] Source Version: 21b3b386e948bedd29369af66f3e98ab01b1c650 [ 1148.088783][T17331] Hardware name: Greatwall GW-001M1A-FTF/GW-001M1A-FTF, BIOS KunLun BIOS V4.0 07/16/2020 [ 1148.098419][T17331] pstate: 20000005 (nzCv daif -PAN -UAO -TCO -DIT -SSBS BTYPE=--) [ 1148.106060][T17331] pc : eventfs_iterate+0x2c0/0x398 [ 1148.111017][T17331] lr : eventfs_iterate+0x2fc/0x398 [ 1148.115969][T17331] sp : ffff80008d56bbd0 [ 1148.119964][T17331] x29: ffff80008d56bbf0 x28: ffff001ff5be2600 x27: 0000000000000000 [ 1148.127781][T17331] x26: ffff001ff52ca4e0 x25: 0000000000009977 x24: dead000000000100 [ 1148.135598][T17331] x23: 0000000000000000 x22: 000000000000000b x21: ffff800082645f10 [ 1148.143415][T17331] x20: ffff001fddf87c70 x19: ffff80008d56bc90 x18: 0000000000000000 [ 1148.151231][T17331] x17: 0000000000000000 x16: 0000000000000000 x15: ffff001ff52ca4e0 [ 1148.159048][T17331] x14: 0000000000000000 x13: 0000000000000000 x12: 0000000000000000 [ 1148.166864][T17331] x11: 0000000000000000 x10: 0000000000000000 x9 : ffff8000804391d0 [ 1148.174680][T17331] x8 : 0000000180000000 x7 : 0000000000000018 x6 : 0000aaab04b92862 [ 1148.182498][T17331] x5 : 0000aaab04b92862 x4 : 0000000080000000 x3 : 0000000000000068 [ 1148.190314][T17331] x2 : 000000000000000f x1 : 0000000000007ea8 x0 : 0000000000000001 [ 1148.198131][T17331] Call trace: [ 1148.201259][T17331] eventfs_iterate+0x2c0/0x398 [ 1148.205864][T17331] iterate_dir+0x98/0x188 [ 1148.210036][T17331] __arm64_sys_getdents64+0x78/0x160 [ 1148.215161][T17331] invoke_syscall+0x78/0x108 [ 1148.219593][T17331] el0_svc_common.constprop.0+0x48/0xf0 [ 1148.224977][T17331] do_el0_svc+0x24/0x38 [ 1148.228974][T17331] el0_svc+0x40/0x168 [ 1148.232798][T17331] el0t_64_sync_handler+0x120/0x130 [ 1148.237836][T17331] el0t_64_sync+0x1a4/0x1a8 [ 1148.242182][T17331] Code: 54ffff6c f9400676 910006d6 f9000676 (b9405300) [ 1148.248955][T17331] ---[ end trace 0000000000000000 ]--- The issue is that list_del() is used on an SRCU protected list variable before the synchronization occurs. This can poison the list pointers while there is a reader iterating the list. This is simply fixed by using list_del_rcu() that is specifically made for this purpose. Link: https://lore.kernel.org/linux-trace-kernel/20240829085025.3600021-1-chizhiling@163.com/ Cc: stable@vger.kernel.org Cc: Masami Hiramatsu Cc: Mathieu Desnoyers Link: https://lore.kernel.org/20240904131605.640d42b1@gandalf.local.home Fixes: 43aa6f97c2d03 ("eventfs: Get rid of dentry pointers without refcounts") Reported-by: Chi Zhiling Tested-by: Chi Zhiling Signed-off-by: Steven Rostedt (Google) fs/tracefs/event_inode.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 49aa8a1f4d6800721c7971ed383078257f12e8f9 Author: Zheng Yejian Date: Tue Aug 27 20:46:54 2024 +0800 tracing: Avoid possible softlockup in tracing_iter_reset() In __tracing_open(), when max latency tracers took place on the cpu, the time start of its buffer would be updated, then event entries with timestamps being earlier than start of the buffer would be skipped (see tracing_iter_reset()). Softlockup will occur if the kernel is non-preemptible and too many entries were skipped in the loop that reset every cpu buffer, so add cond_resched() to avoid it. Cc: stable@vger.kernel.org Fixes: 2f26ebd549b9a ("tracing: use timestamp to determine start of latency traces") Link: https://lore.kernel.org/20240827124654.3817443-1-zhengyejian@huaweicloud.com Suggested-by: Steven Rostedt Signed-off-by: Zheng Yejian Signed-off-by: Steven Rostedt (Google) kernel/trace/trace.c | 2 ++ 1 file changed, 2 insertions(+) commit c060f93253cad63ea9d41b5b1186a1da32541dec Author: Puranjay Mohan Date: Tue Jun 18 16:23:42 2024 +0000 arm64: stacktrace: fix the usage of ftrace_graph_ret_addr() ftrace_graph_ret_addr() takes an 'idx' integer pointer that is used to optimize the stack unwinding process. arm64 currently passes `NULL` for this parameter which stops it from utilizing these optimizations. Further, the current code for ftrace_graph_ret_addr() will just return the passed in return address if it is NULL which will break this usage. Pass a valid integer pointer to ftrace_graph_ret_addr() similar to x86_64's stack unwinder. Signed-off-by: Puranjay Mohan Fixes: 29c1c24a2707 ("function_graph: Fix up ftrace_graph_ret_addr()") Acked-by: Steven Rostedt (Google) Acked-by: Will Deacon Reviewed-by: Mark Rutland Tested-by: Mark Rutland Reviewed-by: Steven Rostedt (Google) Link: https://lore.kernel.org/r/20240618162342.28275-1-puranjay@kernel.org Signed-off-by: Catalin Marinas arch/arm64/kernel/stacktrace.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) commit ff949d981c775332be94be70397ee1df20bc68e5 Author: Stefan Wahren Date: Thu Sep 5 13:15:37 2024 +0200 spi: spi-fsl-lpspi: Fix off-by-one in prescale max The commit 783bf5d09f86 ("spi: spi-fsl-lpspi: limit PRESCALE bit in TCR register") doesn't implement the prescaler maximum as intended. The maximum allowed value for i.MX93 should be 1 and for i.MX7ULP it should be 7. So this needs also a adjustment of the comparison in the scldiv calculation. Fixes: 783bf5d09f86 ("spi: spi-fsl-lpspi: limit PRESCALE bit in TCR register") Signed-off-by: Stefan Wahren Link: https://patch.msgid.link/20240905111537.90389-1-wahrenst@gmx.net Signed-off-by: Mark Brown drivers/spi/spi-fsl-lpspi.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) commit b02d2cf5b220872cd10afe610348b9ec41b9ac05 Merge: 431c1646e1f8 9c68a3b03e81 Author: Rafael J. Wysocki Date: Thu Sep 5 12:41:41 2024 +0200 Merge tag 'amd-pstate-v6.11-2024-09-04' of ssh://gitolite.kernel.org/pub/scm/linux/kernel/git/superm1/linux Pull an amd-pstate fix for 6.11 from Mario Limonciello: "second round of amd-pstate fixes for 6.11: * Fix an incorrect warning emitted on processors that don't support X86_FEATURE_CPPC." * tag 'amd-pstate-v6.11-2024-09-04' of ssh://gitolite.kernel.org/pub/scm/linux/kernel/git/superm1/linux: cpufreq/amd-pstate: Remove warning for X86_FEATURE_CPPC on certain Zen models commit 8e69c96df771ab469cec278edb47009351de4da6 Author: Pawel Dembicki Date: Tue Sep 3 22:33:41 2024 +0200 net: dsa: vsc73xx: fix possible subblocks range of CAPT block CAPT block (CPU Capture Buffer) have 7 sublocks: 0-3, 4, 6, 7. Function 'vsc73xx_is_addr_valid' allows to use only block 0 at this moment. This patch fix it. Fixes: 05bd97fc559d ("net: dsa: Add Vitesse VSC73xx DSA router driver") Signed-off-by: Pawel Dembicki Reviewed-by: Florian Fainelli Link: https://patch.msgid.link/20240903203340.1518789-1-paweldembicki@gmail.com Signed-off-by: Paolo Abeni drivers/net/dsa/vitesse-vsc73xx-core.c | 10 ++++++++-- 1 file changed, 8 insertions(+), 2 deletions(-) commit 546ea84d07e3e324644025e2aae2d12ea4c5896e Author: Toke Høiland-Jørgensen Date: Tue Sep 3 18:08:45 2024 +0200 sched: sch_cake: fix bulk flow accounting logic for host fairness In sch_cake, we keep track of the count of active bulk flows per host, when running in dst/src host fairness mode, which is used as the round-robin weight when iterating through flows. The count of active bulk flows is updated whenever a flow changes state. This has a peculiar interaction with the hash collision handling: when a hash collision occurs (after the set-associative hashing), the state of the hash bucket is simply updated to match the new packet that collided, and if host fairness is enabled, that also means assigning new per-host state to the flow. For this reason, the bulk flow counters of the host(s) assigned to the flow are decremented, before new state is assigned (and the counters, which may not belong to the same host anymore, are incremented again). Back when this code was introduced, the host fairness mode was always enabled, so the decrement was unconditional. When the configuration flags were introduced the *increment* was made conditional, but the *decrement* was not. Which of course can lead to a spurious decrement (and associated wrap-around to U16_MAX). AFAICT, when host fairness is disabled, the decrement and wrap-around happens as soon as a hash collision occurs (which is not that common in itself, due to the set-associative hashing). However, in most cases this is harmless, as the value is only used when host fairness mode is enabled. So in order to trigger an array overflow, sch_cake has to first be configured with host fairness disabled, and while running in this mode, a hash collision has to occur to cause the overflow. Then, the qdisc has to be reconfigured to enable host fairness, which leads to the array out-of-bounds because the wrapped-around value is retained and used as an array index. It seems that syzbot managed to trigger this, which is quite impressive in its own right. This patch fixes the issue by introducing the same conditional check on decrement as is used on increment. The original bug predates the upstreaming of cake, but the commit listed in the Fixes tag touched that code, meaning that this patch won't apply before that. Fixes: 712639929912 ("sch_cake: Make the dual modes fairer") Reported-by: syzbot+7fe7b81d602cc1e6b94d@syzkaller.appspotmail.com Signed-off-by: Toke Høiland-Jørgensen Link: https://patch.msgid.link/20240903160846.20909-1-toke@redhat.com Signed-off-by: Paolo Abeni net/sched/sch_cake.c | 11 +++++++---- 1 file changed, 7 insertions(+), 4 deletions(-) commit 10c48e9a8fd5e524d37559cf4a06039b4c25db48 Author: Uwe Kleine-König Date: Thu Sep 5 11:06:24 2024 +0200 pwm: stm32: Use the right CCxNP bit in stm32_pwm_enable() The pwm devices for a pwm_chip are numbered starting at 0, the first hw channel however has the number 1. While introducing a parametrised macro to simplify register bit usage and making that offset explicit, one of the usages was converted wrongly. This is fixed here. Fixes: 7cea05ae1d4e ("pwm-stm32: Make use of parametrised register definitions") Signed-off-by: Uwe Kleine-König Link: https://lore.kernel.org/r/20240905090627.197536-2-u.kleine-koenig@baylibre.com Signed-off-by: Uwe Kleine-König drivers/pwm/pwm-stm32.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 5a498d4d06d6d9bad76d8a50a7f8fe01670ad46f Author: Thomas Zimmermann Date: Wed Sep 4 14:36:54 2024 +0200 drm/fbdev-dma: Only install deferred I/O if necessary Deferred I/O requires struct page for framebuffer memory, which is not guaranteed for all DMA ranges. We thus only install deferred I/O if we have a framebuffer that requires it. A reported bug affected the ipu-v3 and pl111 drivers, which have video memory in either Normal or HighMem zones [ 0.000000] Zone ranges: [ 0.000000] Normal [mem 0x0000000010000000-0x000000003fffffff] [ 0.000000] HighMem [mem 0x0000000040000000-0x000000004fffffff] where deferred I/O only works correctly with HighMem. See the Closes tags for bug reports. v2: - test if screen_buffer supports deferred I/O (Sima) Signed-off-by: Thomas Zimmermann Fixes: 808a40b69468 ("drm/fbdev-dma: Implement damage handling and deferred I/O") Reported-by: Alexander Stein Closes: https://lore.kernel.org/all/23636953.6Emhk5qWAg@steina-w/ Reported-by: Linus Walleij Closes: https://lore.kernel.org/dri-devel/CACRpkdb+hb9AGavbWpY-=uQQ0apY9en_tWJioPKf_fAbXMP4Hg@mail.gmail.com/ Tested-by: Alexander Stein Tested-by: Linus Walleij Cc: Thomas Zimmermann Cc: Javier Martinez Canillas Cc: Maarten Lankhorst Cc: Maxime Ripard Reviewed-by: Simona Vetter Reviewed-by: Linus Walleij Link: https://patchwork.freedesktop.org/patch/msgid/20240904123750.31206-1-tzimmermann@suse.de drivers/gpu/drm/drm_fbdev_dma.c | 83 +++++++++++++++++++++++++++++++---------- 1 file changed, 64 insertions(+), 19 deletions(-) commit c82299fbbccecf5866bdc3fa9cc46d5c6f5005ad Author: Jakub Kicinski Date: Fri Aug 30 10:14:42 2024 -0700 docs: netdev: document guidance on cleanup.h Document what was discussed multiple times on list and various virtual / in-person conversations. guard() being okay in functions <= 20 LoC is a bit of my own invention. If the function is trivial it should be fine, but feel free to disagree :) We'll obviously revisit this guidance as time passes and we and other subsystems get more experience. Reviewed-by: Eric Dumazet Reviewed-by: Nikolay Aleksandrov Reviewed-by: Andrew Lunn Signed-off-by: Jakub Kicinski Link: https://patch.msgid.link/20240830171443.3532077-1-kuba@kernel.org Signed-off-by: Paolo Abeni Documentation/process/maintainer-netdev.rst | 16 ++++++++++++++++ 1 file changed, 16 insertions(+) commit 7de295d1a1a1b84e57b348e8bfd0fab5aab3ce69 Author: Adrián Larumbe Date: Mon Sep 2 14:02:35 2024 +0100 drm/panthor: flush FW AS caches in slow reset path In the off-chance that waiting for the firmware to signal its booted status timed out in the fast reset path, one must flush the cache lines for the entire FW VM address space before reloading the regions, otherwise stale values eventually lead to a scheduler job timeout. Fixes: 647810ec2476 ("drm/panthor: Add the MMU/VM logical block") Cc: stable@vger.kernel.org Signed-off-by: Adrián Larumbe Acked-by: Liviu Dudau Reviewed-by: Steven Price Reviewed-by: Boris Brezillon Signed-off-by: Boris Brezillon Link: https://patchwork.freedesktop.org/patch/msgid/20240902130237.3440720-1-adrian.larumbe@collabora.com drivers/gpu/drm/panthor/panthor_fw.c | 8 +++++++- drivers/gpu/drm/panthor/panthor_mmu.c | 21 ++++++++++++++++++--- drivers/gpu/drm/panthor/panthor_mmu.h | 1 + 3 files changed, 26 insertions(+), 4 deletions(-) commit 76dce2a96c0f48295e92acf7a8f3fa46ea0ee524 Author: Ryan Walklin Date: Wed Sep 4 13:23:22 2024 +1200 drm: panel: nv3052c: Correct WL-355608-A8 panel compatible As per the previous dt-binding commit, update the WL-355608-A8 panel compatible to reflect the the integrating device vendor and name as the panel OEM is unknown. Fixes: 62ea2eeba7bf ("drm: panel: nv3052c: Add WL-355608-A8 panel") Signed-off-by: Ryan Walklin Signed-off-by: Maxime Ripard Link: https://patchwork.freedesktop.org/patch/msgid/20240904012456.35429-3-ryan@testtoast.com drivers/gpu/drm/panel/panel-newvision-nv3052c.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit d682eef93ebfbcd107c1a339ef24a0dcc4681fbc Author: Ryan Walklin Date: Wed Sep 4 13:23:21 2024 +1200 dt-bindings: display: panel: Rename WL-355608-A8 panel to rg35xx-*-panel The WL-355608-A8 is a 3.5" 640x480@60Hz RGB LCD display from an unknown OEM used in a number of handheld gaming devices made by Anbernic. Previously committed using the OEM serial without a vendor prefix, however following subsequent discussion the preference is to use the integrating device vendor and name where the OEM is unknown. There are 4 RG35XX series devices from Anbernic based on an Allwinner H700 SoC using this panel, with the -Plus variant introduced first. Therefore the -Plus is used as the fallback for the subsequent -H, -2024, and -SP devices. Alter the filename and compatible string to reflect the convention. Fixes: 45b888a8980a ("dt-bindings: display: panel: Add WL-355608-A8 panel") Signed-off-by: Ryan Walklin Acked-by: Rob Herring (Arm) Signed-off-by: Maxime Ripard Link: https://patchwork.freedesktop.org/patch/msgid/20240904012456.35429-2-ryan@testtoast.com ...{wl-355608-a8.yaml => anbernic,rg35xx-plus-panel.yaml} | 15 +++++++++++---- 1 file changed, 11 insertions(+), 4 deletions(-) commit 5f7762042f8a5377bd8a32844db353c0311a7369 Author: Mary Guillemard Date: Tue Sep 3 16:49:55 2024 +0200 drm/panthor: Restrict high priorities on group_create We were allowing any users to create a high priority group without any permission checks. As a result, this was allowing possible denial of service. We now only allow the DRM master or users with the CAP_SYS_NICE capability to set higher priorities than PANTHOR_GROUP_PRIORITY_MEDIUM. As the sole user of that uAPI lives in Mesa and hardcode a value of MEDIUM [1], this should be safe to do. Additionally, as those checks are performed at the ioctl level, panthor_group_create now only check for priority level validity. [1]https://gitlab.freedesktop.org/mesa/mesa/-/blob/f390835074bdf162a63deb0311d1a6de527f9f89/src/gallium/drivers/panfrost/pan_csf.c#L1038 Signed-off-by: Mary Guillemard Fixes: de8548813824 ("drm/panthor: Add the scheduler logical block") Cc: stable@vger.kernel.org Reviewed-by: Boris Brezillon Signed-off-by: Boris Brezillon Link: https://patchwork.freedesktop.org/patch/msgid/20240903144955.144278-2-mary.guillemard@collabora.com drivers/gpu/drm/panthor/panthor_drv.c | 23 +++++++++++++++++++++++ drivers/gpu/drm/panthor/panthor_sched.c | 2 +- include/uapi/drm/panthor_drm.h | 6 +++++- 3 files changed, 29 insertions(+), 2 deletions(-) commit f0417c50fddd628e534c336d87932e7e1e883df3 Merge: 2603d3152b1f 04c7e14e5b0b Author: Jakub Kicinski Date: Wed Sep 4 17:37:37 2024 -0700 Merge branch '100GbE' of git://git.kernel.org/pub/scm/linux/kernel/git/tnguy/net-queue Tony Nguyen says: ==================== ice: fix synchronization between .ndo_bpf() and reset Larysa Zaremba says: PF reset can be triggered asynchronously, by tx_timeout or by a user. With some unfortunate timings both ice_vsi_rebuild() and .ndo_bpf will try to access and modify XDP rings at the same time, causing system crash. The first patch factors out rtnl-locked code from VSI rebuild code to avoid deadlock. The following changes lock rebuild and .ndo_bpf() critical sections with an internal mutex as well and provide complementary fixes. * '100GbE' of git://git.kernel.org/pub/scm/linux/kernel/git/tnguy/net-queue: ice: do not bring the VSI up, if it was down before the XDP setup ice: remove ICE_CFG_BUSY locking from AF_XDP code ice: check ICE_VSI_DOWN under rtnl_lock when preparing for reset ice: check for XDP rings instead of bpf program when unconfiguring ice: protect XDP configuration with a mutex ice: move netif_queue_set_napi to rtnl-protected sections ==================== Link: https://patch.msgid.link/20240903183034.3530411-1-anthony.l.nguyen@intel.com Signed-off-by: Jakub Kicinski commit 2603d3152b1f646b0ef81a748fb703b799fcf9c3 Merge: 858430db28a5 5872b47ce18e Author: Jakub Kicinski Date: Wed Sep 4 17:14:11 2024 -0700 Merge tag 'wireless-2024-09-04' of git://git.kernel.org/pub/scm/linux/kernel/git/wireless/wireless Kalle Valo says: ==================== wireless fixes for v6.11 Hopefully final fixes for v6.11 and this time only fixes to ath11k driver. We need to revert hibernation support due to reported regressions and we have a fix for kernel crash introduced in v6.11-rc1. * tag 'wireless-2024-09-04' of git://git.kernel.org/pub/scm/linux/kernel/git/wireless/wireless: MAINTAINERS: wifi: cw1200: add net-cw1200.h Revert "wifi: ath11k: support hibernation" Revert "wifi: ath11k: restore country code during resume" wifi: ath11k: fix NULL pointer dereference in ath11k_mac_get_eirp_power() ==================== Link: https://patch.msgid.link/20240904135906.5986EC4CECA@smtp.kernel.org Signed-off-by: Jakub Kicinski commit 858430db28a5f5a11f8faa3a6fa805438e6f0851 Author: Sean Anderson Date: Tue Sep 3 13:51:41 2024 -0400 net: xilinx: axienet: Fix race in axienet_stop axienet_dma_err_handler can race with axienet_stop in the following manner: CPU 1 CPU 2 ====================== ================== axienet_stop() napi_disable() axienet_dma_stop() axienet_dma_err_handler() napi_disable() axienet_dma_stop() axienet_dma_start() napi_enable() cancel_work_sync() free_irq() Fix this by setting a flag in axienet_stop telling axienet_dma_err_handler not to bother doing anything. I chose not to use disable_work_sync to allow for easier backporting. Signed-off-by: Sean Anderson Fixes: 8a3b7a252dca ("drivers/net/ethernet/xilinx: added Xilinx AXI Ethernet driver") Link: https://patch.msgid.link/20240903175141.4132898-1-sean.anderson@linux.dev Signed-off-by: Jakub Kicinski drivers/net/ethernet/xilinx/xilinx_axienet.h | 3 +++ drivers/net/ethernet/xilinx/xilinx_axienet_main.c | 8 ++++++++ 2 files changed, 11 insertions(+) commit bee2ef946d3184e99077be526567d791c473036f Author: Jonas Gorski Date: Tue Sep 3 10:19:57 2024 +0200 net: bridge: br_fdb_external_learn_add(): always set EXT_LEARN When userspace wants to take over a fdb entry by setting it as EXTERN_LEARNED, we set both flags BR_FDB_ADDED_BY_EXT_LEARN and BR_FDB_ADDED_BY_USER in br_fdb_external_learn_add(). If the bridge updates the entry later because its port changed, we clear the BR_FDB_ADDED_BY_EXT_LEARN flag, but leave the BR_FDB_ADDED_BY_USER flag set. If userspace then wants to take over the entry again, br_fdb_external_learn_add() sees that BR_FDB_ADDED_BY_USER and skips setting the BR_FDB_ADDED_BY_EXT_LEARN flags, thus silently ignores the update. Fix this by always allowing to set BR_FDB_ADDED_BY_EXT_LEARN regardless if this was a user fdb entry or not. Fixes: 710ae7287737 ("net: bridge: Mark FDB entries that were added by user as such") Signed-off-by: Jonas Gorski Acked-by: Nikolay Aleksandrov Reviewed-by: Ido Schimmel Link: https://patch.msgid.link/20240903081958.29951-1-jonas.gorski@bisdn.de Signed-off-by: Jakub Kicinski net/bridge/br_fdb.c | 6 ++---- 1 file changed, 2 insertions(+), 4 deletions(-) commit 8487b4af59d4d7feda4b119dc2d92c67ca25c27e Author: Hayes Wang Date: Tue Sep 3 14:33:33 2024 +0800 r8152: fix the firmware doesn't work generic_ocp_write() asks the parameter "size" must be 4 bytes align. Therefore, write the bp would fail, if the mac->bp_num is odd. Align the size to 4 for fixing it. The way may write an extra bp, but the rtl8152_is_fw_mac_ok() makes sure the value must be 0 for the bp whose index is more than mac->bp_num. That is, there is no influence for the firmware. Besides, I check the return value of generic_ocp_write() to make sure everything is correct. Fixes: e5c266a61186 ("r8152: set bp in bulk") Signed-off-by: Hayes Wang Link: https://patch.msgid.link/20240903063333.4502-1-hayeswang@realtek.com Signed-off-by: Jakub Kicinski drivers/net/usb/r8152.c | 17 +++++++++++++---- 1 file changed, 13 insertions(+), 4 deletions(-) commit 7e4196935069947d8b70b09c1660b67b067e75cb Author: Kuniyuki Iwashima Date: Mon Sep 2 10:39:27 2024 -0700 fou: Fix null-ptr-deref in GRO. We observed a null-ptr-deref in fou_gro_receive() while shutting down a host. [0] The NULL pointer is sk->sk_user_data, and the offset 8 is of protocol in struct fou. When fou_release() is called due to netns dismantle or explicit tunnel teardown, udp_tunnel_sock_release() sets NULL to sk->sk_user_data. Then, the tunnel socket is destroyed after a single RCU grace period. So, in-flight udp4_gro_receive() could find the socket and execute the FOU GRO handler, where sk->sk_user_data could be NULL. Let's use rcu_dereference_sk_user_data() in fou_from_sock() and add NULL checks in FOU GRO handlers. [0]: BUG: kernel NULL pointer dereference, address: 0000000000000008 PF: supervisor read access in kernel mode PF: error_code(0x0000) - not-present page PGD 80000001032f4067 P4D 80000001032f4067 PUD 103240067 PMD 0 SMP PTI CPU: 0 PID: 0 Comm: swapper/0 Not tainted 5.10.216-204.855.amzn2.x86_64 #1 Hardware name: Amazon EC2 c5.large/, BIOS 1.0 10/16/2017 RIP: 0010:fou_gro_receive (net/ipv4/fou.c:233) [fou] Code: 41 5f c3 cc cc cc cc e8 e7 2e 69 f4 0f 1f 80 00 00 00 00 0f 1f 44 00 00 49 89 f8 41 54 48 89 f7 48 89 d6 49 8b 80 88 02 00 00 <0f> b6 48 08 0f b7 42 4a 66 25 fd fd 80 cc 02 66 89 42 4a 0f b6 42 RSP: 0018:ffffa330c0003d08 EFLAGS: 00010297 RAX: 0000000000000000 RBX: ffff93d9e3a6b900 RCX: 0000000000000010 RDX: ffff93d9e3a6b900 RSI: ffff93d9e3a6b900 RDI: ffff93dac2e24d08 RBP: ffff93d9e3a6b900 R08: ffff93dacbce6400 R09: 0000000000000002 R10: 0000000000000000 R11: ffffffffb5f369b0 R12: ffff93dacbce6400 R13: ffff93dac2e24d08 R14: 0000000000000000 R15: ffffffffb4edd1c0 FS: 0000000000000000(0000) GS:ffff93daee800000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000000000000008 CR3: 0000000102140001 CR4: 00000000007706f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 PKRU: 55555554 Call Trace: ? show_trace_log_lvl (arch/x86/kernel/dumpstack.c:259) ? __die_body.cold (arch/x86/kernel/dumpstack.c:478 arch/x86/kernel/dumpstack.c:420) ? no_context (arch/x86/mm/fault.c:752) ? exc_page_fault (arch/x86/include/asm/irqflags.h:49 arch/x86/include/asm/irqflags.h:89 arch/x86/mm/fault.c:1435 arch/x86/mm/fault.c:1483) ? asm_exc_page_fault (arch/x86/include/asm/idtentry.h:571) ? fou_gro_receive (net/ipv4/fou.c:233) [fou] udp_gro_receive (include/linux/netdevice.h:2552 net/ipv4/udp_offload.c:559) udp4_gro_receive (net/ipv4/udp_offload.c:604) inet_gro_receive (net/ipv4/af_inet.c:1549 (discriminator 7)) dev_gro_receive (net/core/dev.c:6035 (discriminator 4)) napi_gro_receive (net/core/dev.c:6170) ena_clean_rx_irq (drivers/amazon/net/ena/ena_netdev.c:1558) [ena] ena_io_poll (drivers/amazon/net/ena/ena_netdev.c:1742) [ena] napi_poll (net/core/dev.c:6847) net_rx_action (net/core/dev.c:6917) __do_softirq (arch/x86/include/asm/jump_label.h:25 include/linux/jump_label.h:200 include/trace/events/irq.h:142 kernel/softirq.c:299) asm_call_irq_on_stack (arch/x86/entry/entry_64.S:809) do_softirq_own_stack (arch/x86/include/asm/irq_stack.h:27 arch/x86/include/asm/irq_stack.h:77 arch/x86/kernel/irq_64.c:77) irq_exit_rcu (kernel/softirq.c:393 kernel/softirq.c:423 kernel/softirq.c:435) common_interrupt (arch/x86/kernel/irq.c:239) asm_common_interrupt (arch/x86/include/asm/idtentry.h:626) RIP: 0010:acpi_idle_do_entry (arch/x86/include/asm/irqflags.h:49 arch/x86/include/asm/irqflags.h:89 drivers/acpi/processor_idle.c:114 drivers/acpi/processor_idle.c:575) Code: 8b 15 d1 3c c4 02 ed c3 cc cc cc cc 65 48 8b 04 25 40 ef 01 00 48 8b 00 a8 08 75 eb 0f 1f 44 00 00 0f 00 2d d5 09 55 00 fb f4 c3 cc cc cc cc e9 be fc ff ff 66 66 2e 0f 1f 84 00 00 00 00 00 RSP: 0018:ffffffffb5603e58 EFLAGS: 00000246 RAX: 0000000000004000 RBX: ffff93dac0929c00 RCX: ffff93daee833900 RDX: ffff93daee800000 RSI: ffff93daee87dc00 RDI: ffff93daee87dc64 RBP: 0000000000000001 R08: ffffffffb5e7b6c0 R09: 0000000000000044 R10: ffff93daee831b04 R11: 00000000000001cd R12: 0000000000000001 R13: ffffffffb5e7b740 R14: 0000000000000001 R15: 0000000000000000 ? sched_clock_cpu (kernel/sched/clock.c:371) acpi_idle_enter (drivers/acpi/processor_idle.c:712 (discriminator 3)) cpuidle_enter_state (drivers/cpuidle/cpuidle.c:237) cpuidle_enter (drivers/cpuidle/cpuidle.c:353) cpuidle_idle_call (kernel/sched/idle.c:158 kernel/sched/idle.c:239) do_idle (kernel/sched/idle.c:302) cpu_startup_entry (kernel/sched/idle.c:395 (discriminator 1)) start_kernel (init/main.c:1048) secondary_startup_64_no_verify (arch/x86/kernel/head_64.S:310) Modules linked in: udp_diag tcp_diag inet_diag nft_nat ipip tunnel4 dummy fou ip_tunnel nft_masq nft_chain_nat nf_nat wireguard nft_ct curve25519_x86_64 libcurve25519_generic nf_conntrack libchacha20poly1305 nf_defrag_ipv6 nf_defrag_ipv4 nft_objref chacha_x86_64 nft_counter nf_tables nfnetlink poly1305_x86_64 ip6_udp_tunnel udp_tunnel libchacha crc32_pclmul ghash_clmulni_intel aesni_intel crypto_simd cryptd glue_helper mousedev psmouse button ena ptp pps_core crc32c_intel CR2: 0000000000000008 Fixes: d92283e338f6 ("fou: change to use UDP socket GRO") Reported-by: Alphonse Kurian Signed-off-by: Kuniyuki Iwashima Link: https://patch.msgid.link/20240902173927.62706-1-kuniyu@amazon.com Signed-off-by: Jakub Kicinski net/ipv4/fou_core.c | 29 ++++++++++++++++++++++++----- 1 file changed, 24 insertions(+), 5 deletions(-) commit 4963d2343af81f493519f9c3ea9f2169eaa7353a Author: Guillaume Nault Date: Fri Aug 30 17:31:07 2024 +0200 bareudp: Fix device stats updates. Bareudp devices update their stats concurrently. Therefore they need proper atomic increments. Fixes: 571912c69f0e ("net: UDP tunnel encapsulation module for tunnelling different protocols like MPLS, IP, NSH etc.") Signed-off-by: Guillaume Nault Reviewed-by: Willem de Bruijn Link: https://patch.msgid.link/04b7b9d0b480158eb3ab4366ec80aa2ab7e41fcb.1725031794.git.gnault@redhat.com Signed-off-by: Jakub Kicinski drivers/net/bareudp.c | 22 +++++++++++----------- 1 file changed, 11 insertions(+), 11 deletions(-) commit c763c43396883456ef57e5e78b64d3c259c4babc Merge: 2adad548f74c 53f6619554fb Author: Linus Torvalds Date: Wed Sep 4 13:54:47 2024 -0700 Merge tag 'bcachefs-2024-09-04' of git://evilpiepirate.org/bcachefs Pull bcachefs fixes from Kent Overstreet: - Fix a typo in the rebalance accounting changes - BCH_SB_MEMBER_INVALID: small on disk format feature which will be needed for full erasure coding support; this is only the minimum so that 6.11 can handle future versions without barfing. * tag 'bcachefs-2024-09-04' of git://evilpiepirate.org/bcachefs: bcachefs: BCH_SB_MEMBER_INVALID bcachefs: fix rebalance accounting commit 5390f315fc8c9b9f48105a0d88b56bc59fa2b3e0 Merge: b408473ea01b 743070894724 Author: Alexei Starovoitov Date: Wed Sep 4 11:56:34 2024 -0700 Merge branch 'bpf-fix-incorrect-name-check-pass-logic-in-btf_name_valid_section' Jeongjun Park says: ==================== bpf: fix incorrect name check pass logic in btf_name_valid_section This patch was written to fix an issue where btf_name_valid_section() would not properly check names with certain conditions and would throw an OOB vuln. And selftest was added to verify this patch. ==================== Link: https://lore.kernel.org/r/20240831054525.364353-1-aha310510@gmail.com Signed-off-by: Alexei Starovoitov commit 743070894724bf5ee0b2c77a28f838f6244d19bd Author: Jeongjun Park Date: Sat Aug 31 14:47:42 2024 +0900 selftests/bpf: Add a selftest to check for incorrect names Add selftest for cases where btf_name_valid_section() does not properly check for certain types of names. Suggested-by: Eduard Zingerman Signed-off-by: Jeongjun Park Link: https://lore.kernel.org/r/20240831054742.364585-1-aha310510@gmail.com Signed-off-by: Alexei Starovoitov Acked-by: Eduard Zingerman tools/testing/selftests/bpf/prog_tests/btf.c | 34 ++++++++++++++++++++++++++++ 1 file changed, 34 insertions(+) commit 2adad548f74c30739c35994da419eb2318e6fbd1 Merge: 14a244a9095e e162cb25c410 Author: Linus Torvalds Date: Wed Sep 4 12:10:19 2024 -0700 Merge tag 'perf-tools-fixes-for-v6.11-2024-09-04' of git://git.kernel.org/pub/scm/linux/kernel/git/perf/perf-tools Pull perf tools fixes from Namhyung Kim: "A number of small fixes for the late cycle: - Two more build fixes on 32-bit archs - Fixed a segfault during perf test - Fixed spinlock/rwlock accounting bug in perf lock contention" * tag 'perf-tools-fixes-for-v6.11-2024-09-04' of git://git.kernel.org/pub/scm/linux/kernel/git/perf/perf-tools: perf daemon: Fix the build on more 32-bit architectures perf python: include "util/sample.h" perf lock contention: Fix spinlock and rwlock accounting perf test pmu: Set uninitialized PMU alias to null commit 14a244a9095e9034339c1c9a7b435f238f7d49df Merge: 1263a7bf8a0e a54da9df75cd Author: Linus Torvalds Date: Wed Sep 4 12:07:31 2024 -0700 Merge tag 'hwmon-for-v6.11-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/groeck/linux-staging Pull hwmon fixes from Guenter Roeck: - hp-wmi-sensors: Check if WMI event data exists before accessing it - ltc2991: fix register bits defines * tag 'hwmon-for-v6.11-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/groeck/linux-staging: hwmon: (hp-wmi-sensors) Check if WMI event data exists hwmon: ltc2991: fix register bits defines commit bb6705c3f93bed2af03d43691743d4c43e3c8e6f Author: Jeongjun Park Date: Sat Aug 31 14:47:02 2024 +0900 bpf: add check for invalid name in btf_name_valid_section() If the length of the name string is 1 and the value of name[0] is NULL byte, an OOB vulnerability occurs in btf_name_valid_section() and the return value is true, so the invalid name passes the check. To solve this, you need to check if the first position is NULL byte and if the first character is printable. Suggested-by: Eduard Zingerman Fixes: bd70a8fb7ca4 ("bpf: Allow all printable characters in BTF DATASEC names") Signed-off-by: Jeongjun Park Link: https://lore.kernel.org/r/20240831054702.364455-1-aha310510@gmail.com Signed-off-by: Alexei Starovoitov Acked-by: Eduard Zingerman kernel/bpf/btf.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) commit 1263a7bf8a0e77c6cda8f5a40509d99829216a45 Merge: d8abb73f5847 cd9253c23aed Author: Linus Torvalds Date: Wed Sep 4 11:53:47 2024 -0700 Merge tag 'for-6.11-rc6-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/kdave/linux Pull btrfs fixes from David Sterba: - followup fix for direct io and fsync under some conditions, reported by QEMU users - fix a potential leak when disabling quotas while some extent tracking work can still happen - in zoned mode handle unexpected change of zone write pointer in RAID1-like block groups, turn the zones to read-only * tag 'for-6.11-rc6-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/kdave/linux: btrfs: fix race between direct IO write and fsync when using same fd btrfs: zoned: handle broken write pointer on zones btrfs: qgroup: don't use extent changeset when not needed commit d8abb73f584772eaafa95a447c90f1c02dba0dec Merge: 4356ab331c8f 844436e045ac Author: Linus Torvalds Date: Wed Sep 4 09:41:51 2024 -0700 Merge tag 'v6.11-rc6-server-fixes' of git://git.samba.org/ksmbd Pull smb server fixes from Steve French: - Fix crash in session setup - Fix locking bug - Improve access bounds checking * tag 'v6.11-rc6-server-fixes' of git://git.samba.org/ksmbd: ksmbd: Unlock on in ksmbd_tcp_set_interfaces() ksmbd: unset the binding mark of a reused connection smb: Annotate struct xattr_smb_acl with __counted_by() commit 4356ab331c8f0dbed0f683abde345cd5503db1e4 Merge: c7fb1692dc01 72a6e22c604c Author: Linus Torvalds Date: Wed Sep 4 09:33:57 2024 -0700 Merge tag 'vfs-6.11-rc7.fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs Pull vfs fixes from Christian Brauner: "Two netfs fixes for this merge window: - Ensure that fscache_cookie_lru_time is deleted when the fscache module is removed to prevent UAF - Fix filemap_invalidate_inode() to use invalidate_inode_pages2_range() Before it used truncate_inode_pages_partial() which causes copy_file_range() to fail on cifs" * tag 'vfs-6.11-rc7.fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs: fscache: delete fscache_cookie_lru_timer when fscache exits to avoid UAF mm: Fix filemap_invalidate_inode() to use invalidate_inode_pages2_range() commit 4bfc9c553f5ea8cbfe085824f3283885cf173c20 Author: Rodrigo Vivi Date: Fri Aug 30 14:35:07 2024 -0400 drm/xe/display: Avoid encoder_suspend at runtime suspend Fix circular locking dependency on runtime suspend. <4> [74.952215] ====================================================== <4> [74.952217] WARNING: possible circular locking dependency detected <4> [74.952219] 6.10.0-rc7-xe #1 Not tainted <4> [74.952221] ------------------------------------------------------ <4> [74.952223] kworker/7:1/82 is trying to acquire lock: <4> [74.952226] ffff888120548488 (&dev->mode_config.mutex){+.+.}-{3:3}, at: drm_modeset_lock_all+0x40/0x1e0 [drm] <4> [74.952260] but task is already holding lock: <4> [74.952262] ffffffffa0ae59c0 (xe_pm_runtime_lockdep_map){+.+.}-{0:0}, at: xe_pm_runtime_suspend+0x2f/0x340 [xe] <4> [74.952322] which lock already depends on the new lock. The commit 'b1d90a86 ("drm/xe: Use the encoder suspend helper also used by the i915 driver")' didn't do anything wrong. It actually fixed a critical bug, because the encoder_suspend was never getting actually called because it was returning if (has_display(xe)) instead of if (!has_display(xe)). However, this ended up introducing the encoder suspend calls in the runtime routines as well, causing the circular locking dependency. Closes: https://gitlab.freedesktop.org/drm/xe/kernel/-/issues/2304 Fixes: b1d90a862c89 ("drm/xe: Use the encoder suspend helper also used by the i915 driver") Cc: Imre Deak Reviewed-by: Jonathan Cavitt Link: https://patchwork.freedesktop.org/patch/msgid/20240830183507.298351-2-rodrigo.vivi@intel.com Signed-off-by: Rodrigo Vivi (cherry picked from commit 8da19441d0a02b53e362df81843bb20db3a8006a) Signed-off-by: Rodrigo Vivi drivers/gpu/drm/xe/display/xe_display.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) commit 880b398288487029ef5062ec5d7fcfc90672f782 Author: Imre Deak Date: Fri Aug 23 14:21:46 2024 +0300 drm/xe: Suspend/resume user access only during system s/r Enable/Disable user access only during system suspend/resume. This should not happen during runtime s/r v2: rebased Reviewed-by: Arun R Murthy Signed-off-by: Imre Deak Signed-off-by: Vinod Govindapillai Link: https://patchwork.freedesktop.org/patch/msgid/20240823112148.327015-2-vinod.govindapillai@intel.com (cherry picked from commit a64e7e5b05e014dad9ae5858c9644d61400ec6ef) Signed-off-by: Rodrigo Vivi drivers/gpu/drm/xe/display/xe_display.c | 10 ++++++---- 1 file changed, 6 insertions(+), 4 deletions(-) commit 269a3f60843b9d2045e0c09d4bd34a91ed4222aa Author: Maarten Lankhorst Date: Tue Aug 6 12:50:43 2024 +0200 drm/xe/display: Match i915 driver suspend/resume sequences better Suspend fbdev sooner, and disable user access before suspending to prevent some races. I've noticed this when comparing xe suspend to i915's. Matches the following commits from i915: 24b412b1bfeb ("drm/i915: Disable intel HPD poll after DRM poll init/enable") 1ef28d86bea9 ("drm/i915: Suspend the framebuffer console earlier during system suspend") bd738d859e71 ("drm/i915: Prevent modesets during driver init/shutdown") Thanks to Imre for pointing me to those commits. Driver shutdown is currently missing, but I have some idea how to implement it next. Signed-off-by: Maarten Lankhorst Cc: Imre Deak Reviewed-by: Uma Shankar Link: https://patchwork.freedesktop.org/patch/msgid/20240806105044.596842-2-maarten.lankhorst@linux.intel.com Signed-off-by: Maarten Lankhorst,,, (cherry picked from commit 492be2a070f023c66aaef6ebd664567fda28c2a6) Signed-off-by: Rodrigo Vivi drivers/gpu/drm/xe/display/xe_display.c | 19 ++++++++++++++----- 1 file changed, 14 insertions(+), 5 deletions(-) commit 2ab9d830262c132ab5db2f571003d80850d56b2a Author: Peter Zijlstra Date: Mon Sep 2 10:14:24 2024 +0200 perf/aux: Fix AUX buffer serialization Ole reported that event->mmap_mutex is strictly insufficient to serialize the AUX buffer, add a per RB mutex to fully serialize it. Note that in the lock order comment the perf_event::mmap_mutex order was already wrong, that is, it nesting under mmap_lock is not new with this patch. Fixes: 45bfb2e50471 ("perf: Add AUX area to ring buffer for raw data streams") Reported-by: Ole Signed-off-by: Peter Zijlstra (Intel) Signed-off-by: Ingo Molnar kernel/events/core.c | 18 ++++++++++++------ kernel/events/internal.h | 1 + kernel/events/ring_buffer.c | 2 ++ 3 files changed, 15 insertions(+), 6 deletions(-) commit c7fb1692dc0139f95bd4131d3d5fa5eba2ba569e Merge: 962da4d1be82 0d437918fb64 Author: Linus Torvalds Date: Wed Sep 4 09:17:33 2024 -0700 Merge tag 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/rmk/linux Pull ARM fix from Russell King: - Fix a build issue with older binutils with LD dead code elimination disabled * tag 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/rmk/linux: ARM: 9414/1: Fix build issue with LD_DEAD_CODE_DATA_ELIMINATION commit 82122d1f54ec2244fb9c367ee2390b51ce08cf44 Author: Rodrigo Vivi Date: Fri Aug 30 14:35:06 2024 -0400 drm/xe: Add missing runtime reference to wedged upon gt_reset Fixes this missed case: xe 0000:00:02.0: [drm] Missing outer runtime PM protection WARNING: CPU: 99 PID: 1455 at drivers/gpu/drm/xe/xe_pm.c:564 xe_pm_runtime_get_noresume+0x48/0x60 [xe] Call Trace: ? show_regs+0x67/0x70 ? __warn+0x94/0x1b0 ? xe_pm_runtime_get_noresume+0x48/0x60 [xe] ? report_bug+0x1b7/0x1d0 ? handle_bug+0x46/0x80 ? exc_invalid_op+0x19/0x70 ? asm_exc_invalid_op+0x1b/0x20 ? xe_pm_runtime_get_noresume+0x48/0x60 [xe] xe_device_declare_wedged+0x91/0x280 [xe] gt_reset_worker+0xa2/0x250 [xe] v2: Also move get and get the right Fixes tag (Himal, Brost) Fixes: fb74b205cdd2 ("drm/xe: Introduce a simple wedged state") Cc: Himal Prasad Ghimiray Cc: Matthew Brost Reviewed-by: Jonathan Cavitt Reviewed-by: Himal Prasad Ghimiray Link: https://patchwork.freedesktop.org/patch/msgid/20240830183507.298351-1-rodrigo.vivi@intel.com Signed-off-by: Rodrigo Vivi (cherry picked from commit bc947d9a8c3ebd207e52c0e35cfc88f3e1abe54f) Signed-off-by: Rodrigo Vivi drivers/gpu/drm/xe/xe_gt.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) commit 962da4d1be82889af5b9cc0f718e5eccfd93cd2d Merge: 76c0f27d0630 213aa670153e Author: Linus Torvalds Date: Wed Sep 4 09:11:57 2024 -0700 Merge tag 'parisc-for-6.11-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/deller/parisc-linux Pull parisc architecture fix from Helge Deller: - Fix boot issue where boot memory is marked read-only too early * tag 'parisc-for-6.11-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/deller/parisc-linux: parisc: Delay write-protection until mark_rodata_ro() call commit 76c0f27d063079ce2c6e7fa971a185a38905d844 Merge: 88fac17500f4 052a45c1cb1b Author: Linus Torvalds Date: Wed Sep 4 08:37:33 2024 -0700 Merge tag 'mm-hotfixes-stable-2024-09-03-20-19' of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm Pull misc fixes from Andrew Morton: "17 hotfixes, 15 of which are cc:stable. Mostly MM, no identifiable theme. And a few nilfs2 fixups" * tag 'mm-hotfixes-stable-2024-09-03-20-19' of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm: alloc_tag: fix allocation tag reporting when CONFIG_MODULES=n mm: vmalloc: optimize vmap_lazy_nr arithmetic when purging each vmap_area mailmap: update entry for Jan Kuliga codetag: debug: mark codetags for poisoned page as empty mm/memcontrol: respect zswap.writeback setting from parent cg too scripts: fix gfp-translate after ___GFP_*_BITS conversion to an enum Revert "mm: skip CMA pages when they are not available" maple_tree: remove rcu_read_lock() from mt_validate() kexec_file: fix elfcorehdr digest exclusion when CONFIG_CRASH_HOTPLUG=y mm/slub: add check for s->flags in the alloc_tagging_slab_free_hook nilfs2: fix state management in error path of log writing function nilfs2: fix missing cleanup on rollforward recovery error nilfs2: protect references to superblock parameters exposed in sysfs userfaultfd: don't BUG_ON() if khugepaged yanks our page table userfaultfd: fix checks for huge PMDs mm: vmalloc: ensure vmap_block is initialised before adding to queue selftests: mm: fix build errors on armhf commit 593377036e50de89132bc1222800174fde0780ec Author: Leonardo Bras Date: Fri May 10 23:05:56 2024 -0300 kvm: Note an RCU quiescent state on guest exit As of today, KVM notes a quiescent state only in guest entry, which is good as it avoids the guest being interrupted for current RCU operations. While the guest vcpu runs, it can be interrupted by a timer IRQ that will check for any RCU operations waiting for this CPU. In case there are any of such, it invokes rcu_core() in order to sched-out the current thread and note a quiescent state. This occasional schedule work will introduce tens of microsseconds of latency, which is really bad for vcpus running latency-sensitive applications, such as real-time workloads. So, note a quiescent state in guest exit, so the interrupted guests is able to deal with any pending RCU operations before being required to invoke rcu_core(), and thus avoid the overhead of related scheduler work. Signed-off-by: Leonardo Bras Acked-by: Paul E. McKenney Acked-by: Sean Christopherson Message-ID: <20240511020557.1198200-1-leobras@redhat.com> Signed-off-by: Paolo Bonzini include/linux/context_tracking.h | 6 ++++-- include/linux/kvm_host.h | 10 +++++++++- 2 files changed, 13 insertions(+), 3 deletions(-) commit 0d437918fb6473d25fb83188c2d6040f47acfbcd Author: Yuntao Liu Date: Wed Aug 21 07:34:41 2024 +0100 ARM: 9414/1: Fix build issue with LD_DEAD_CODE_DATA_ELIMINATION There is a build issue with LD segmentation fault, while CONFIG_LD_DEAD_CODE_DATA_ELIMINATION is not enabled, as bellow. scripts/link-vmlinux.sh: line 49: 3796 Segmentation fault (core dumped) ${ld} ${ldflags} -o ${output} ${wl}--whole-archive ${objs} ${wl}--no-whole-archive ${wl}--start-group ${libs} ${wl}--end-group ${kallsymso} ${btf_vmlinux_bin_o} ${ldlibs} The error occurs in older versions of the GNU ld with version earlier than 2.36. It makes most sense to have a minimum LD version as a dependency for HAVE_LD_DEAD_CODE_DATA_ELIMINATION and eliminate the impact of ".reloc .text, R_ARM_NONE, ." when CONFIG_LD_DEAD_CODE_DATA_ELIMINATION is not enabled. Fixes: ed0f94102251 ("ARM: 9404/1: arm32: enable HAVE_LD_DEAD_CODE_DATA_ELIMINATION") Reported-by: Harith George Tested-by: Harith George Suggested-by: Arnd Bergmann Acked-by: Arnd Bergmann Signed-off-by: Yuntao Liu Link: https://lore.kernel.org/all/14e9aefb-88d1-4eee-8288-ef15d4a9b059@gmail.com/ Signed-off-by: Russell King (Oracle) arch/arm/Kconfig | 2 +- arch/arm/kernel/entry-armv.S | 12 +++++++++--- 2 files changed, 10 insertions(+), 4 deletions(-) commit b858a36fe9a1261dfd097aec855161ad135bed60 Author: Mikulas Patocka Date: Tue Sep 3 21:47:59 2024 +0200 bio-integrity: don't restrict the size of integrity metadata bio_integrity_add_page restricts the size of the integrity metadata to queue_max_hw_sectors(q). This restriction is not needed because oversized bios are split automatically. This restriction causes problems with dm-integrity 'inline' mode - if we send a large bio to dm-integrity and the bio's metadata are larger than queue_max_hw_sectors(q), bio_integrity_add_page fails and the bio is ended with BLK_STS_RESOURCE error. An example that triggers it: dd: error writing '/dev/mapper/in2': Cannot allocate memory 1+0 records in 0+0 records out 0 bytes copied, 0.00169291 s, 0.0 kB/s Signed-off-by: Mikulas Patocka Fixes: fb0987682c62 ("dm-integrity: introduce the Inline mode") Fixes: 0ece1d649b6d ("bio-integrity: create multi-page bvecs in bio_integrity_add_page()") Reviewed-by: Ming Lei Reviewed-by: Christoph Hellwig Tested-by: Anuj Gupta Link: https://lore.kernel.org/r/e41b3b8e-16c2-70cb-97cb-881234bb200d@redhat.com Signed-off-by: Jens Axboe block/bio-integrity.c | 4 ---- 1 file changed, 4 deletions(-) commit e58f5142f88320a5b1449f96a146f2f24615c5c7 Author: Li Nan Date: Wed Sep 4 11:13:48 2024 +0800 ublk_drv: fix NULL pointer dereference in ublk_ctrl_start_recovery() When two UBLK_CMD_START_USER_RECOVERY commands are submitted, the first one sets 'ubq->ubq_daemon' to NULL, and the second one triggers WARN in ublk_queue_reinit() and subsequently a NULL pointer dereference issue. Fix it by adding the check in ublk_ctrl_start_recovery() and return immediately in case of zero 'ub->nr_queues_ready'. BUG: kernel NULL pointer dereference, address: 0000000000000028 RIP: 0010:ublk_ctrl_start_recovery.constprop.0+0x82/0x180 Call Trace: ? __die+0x20/0x70 ? page_fault_oops+0x75/0x170 ? exc_page_fault+0x64/0x140 ? asm_exc_page_fault+0x22/0x30 ? ublk_ctrl_start_recovery.constprop.0+0x82/0x180 ublk_ctrl_uring_cmd+0x4f7/0x6c0 ? pick_next_task_idle+0x26/0x40 io_uring_cmd+0x9a/0x1b0 io_issue_sqe+0x193/0x3f0 io_wq_submit_work+0x9b/0x390 io_worker_handle_work+0x165/0x360 io_wq_worker+0xcb/0x2f0 ? finish_task_switch.isra.0+0x203/0x290 ? finish_task_switch.isra.0+0x203/0x290 ? __pfx_io_wq_worker+0x10/0x10 ret_from_fork+0x2d/0x50 ? __pfx_io_wq_worker+0x10/0x10 ret_from_fork_asm+0x1a/0x30 Fixes: c732a852b419 ("ublk_drv: add START_USER_RECOVERY and END_USER_RECOVERY support") Reported-and-tested-by: Changhui Zhong Closes: https://lore.kernel.org/all/CAGVVp+UvLiS+bhNXV-h2icwX1dyybbYHeQUuH7RYqUvMQf6N3w@mail.gmail.com Reviewed-by: Ming Lei Signed-off-by: Li Nan Link: https://lore.kernel.org/r/20240904031348.4139545-1-ming.lei@redhat.com Signed-off-by: Jens Axboe drivers/block/ublk_drv.c | 2 ++ 1 file changed, 2 insertions(+) commit 47a9e8dbb8d4713a9aac7cc6ce3c82dcc94217d8 Author: Maximilien Perreault Date: Tue Sep 3 20:10:13 2024 -0700 ALSA: hda/realtek: Support mute LED on HP Laptop 14-dq2xxx The mute LED on this HP laptop uses ALC236 and requires a quirk to function. This patch enables the existing quirk for the device. Signed-off-by: Maximilien Perreault Cc: Link: https://patch.msgid.link/20240904031013.21220-1-maximilienperreault@gmail.com Signed-off-by: Takashi Iwai sound/pci/hda/patch_realtek.c | 1 + 1 file changed, 1 insertion(+) commit b474f60f6a0c90f560190ac2cc6f20805f35d2c1 Author: Adam Queler Date: Tue Sep 3 16:24:19 2024 -0400 ALSA: hda/realtek: Enable Mute Led for HP Victus 15-fb1xxx The mute led is controlled by ALC245. This patch enables the already existing quirk for this device. Signed-off-by: Adam Queler Cc: Link: https://patch.msgid.link/20240903202419.31433-1-queler+k@gmail.com Signed-off-by: Takashi Iwai sound/pci/hda/patch_realtek.c | 1 + 1 file changed, 1 insertion(+) commit b6ecc662037694488bfff7c9fd21c405df8411f2 Author: Souradeep Chakrabarti Date: Mon Sep 2 05:43:47 2024 -0700 net: mana: Fix error handling in mana_create_txq/rxq's NAPI cleanup Currently napi_disable() gets called during rxq and txq cleanup, even before napi is enabled and hrtimer is initialized. It causes kernel panic. ? page_fault_oops+0x136/0x2b0 ? page_counter_cancel+0x2e/0x80 ? do_user_addr_fault+0x2f2/0x640 ? refill_obj_stock+0xc4/0x110 ? exc_page_fault+0x71/0x160 ? asm_exc_page_fault+0x27/0x30 ? __mmdrop+0x10/0x180 ? __mmdrop+0xec/0x180 ? hrtimer_active+0xd/0x50 hrtimer_try_to_cancel+0x2c/0xf0 hrtimer_cancel+0x15/0x30 napi_disable+0x65/0x90 mana_destroy_rxq+0x4c/0x2f0 mana_create_rxq.isra.0+0x56c/0x6d0 ? mana_uncfg_vport+0x50/0x50 mana_alloc_queues+0x21b/0x320 ? skb_dequeue+0x5f/0x80 Cc: stable@vger.kernel.org Fixes: e1b5683ff62e ("net: mana: Move NAPI from EQ to CQ") Signed-off-by: Souradeep Chakrabarti Reviewed-by: Haiyang Zhang Reviewed-by: Shradha Gupta Signed-off-by: David S. Miller drivers/net/ethernet/microsoft/mana/mana_en.c | 22 +++++++++++++--------- include/net/mana/mana.h | 2 ++ 2 files changed, 15 insertions(+), 9 deletions(-) commit 53f6619554fb1edf8d7599b560d44dbea085c730 Author: Kent Overstreet Date: Sun Sep 1 18:09:18 2024 -0400 bcachefs: BCH_SB_MEMBER_INVALID Create a sentinal value for "invalid device". This is needed for removing devices that have stripes on them (force removing, without evacuating); we need a sentinal value for the stripe pointers to the device being removed. Signed-off-by: Kent Overstreet fs/bcachefs/replicas.c | 3 ++- fs/bcachefs/sb-members.c | 3 ++- fs/bcachefs/sb-members_format.h | 5 +++++ 3 files changed, 9 insertions(+), 2 deletions(-) commit 8f62819aaace77dd85037ae766eb767f8c4417ce Author: Bartosz Golaszewski Date: Fri Aug 23 11:33:23 2024 +0200 PCI/pwrctl: Rescan bus on a separate thread If we trigger the bus rescan from sysfs, we'll try to lock the PCI rescan mutex recursively and deadlock - the platform device will be populated and probed on the same thread that handles the sysfs write. Add a workqueue to the pwrctl code on which we schedule the rescan for controlled PCI devices. While at it: add a new interface for initializing the pwrctl context where we'd now assign the parent device address and initialize the workqueue. Link: https://lore.kernel.org/r/20240823093323.33450-3-brgl@bgdev.pl Fixes: 4565d2652a37 ("PCI/pwrctl: Add PCI power control core code") Reported-by: Konrad Dybcio Signed-off-by: Bartosz Golaszewski Signed-off-by: Bjorn Helgaas Reviewed-by: Manivannan Sadhasivam drivers/pci/pwrctl/core.c | 26 +++++++++++++++++++++++--- drivers/pci/pwrctl/pci-pwrctl-pwrseq.c | 2 +- include/linux/pci-pwrctl.h | 3 +++ 3 files changed, 27 insertions(+), 4 deletions(-) commit f1536585588ba630c533b6ffbca8ad8424aa5c39 Author: Bartosz Golaszewski Date: Fri Aug 23 11:33:22 2024 +0200 PCI: Don't rely on of_platform_depopulate() for reused OF-nodes of_platform_depopulate() doesn't play nicely with reused OF nodes - it ignores the ones that are not marked explicitly as populated and it may happen that the PCI device goes away before the platform device in which case the PCI core clears the OF_POPULATED bit. Unconditionally unregister the platform devices for child nodes when stopping the PCI device. Link: https://lore.kernel.org/r/20240823093323.33450-2-brgl@bgdev.pl Fixes: 8fb18619d910 ("PCI/pwrctl: Create platform devices for child OF nodes of the port node") Signed-off-by: Bartosz Golaszewski Signed-off-by: Bjorn Helgaas Acked-by: Manivannan Sadhasivam drivers/pci/remove.c | 18 +++++++++++++++++- 1 file changed, 17 insertions(+), 1 deletion(-) commit cff56ff737e2da095ca9f228e2c5afc903bfca69 Author: Andreas Hindborg Date: Tue Sep 3 22:09:48 2024 +0200 MAINTAINERS: update Andreas Hindborg's email address Move away from corporate infrastructure for upstream work. Also update mailmap. Signed-off-by: Andreas Hindborg Link: https://lore.kernel.org/r/20240903200956.68231-1-a.hindborg@kernel.org [ Reworded title slightly. - Miguel ] Signed-off-by: Miguel Ojeda .mailmap | 1 + MAINTAINERS | 4 ++-- 2 files changed, 3 insertions(+), 2 deletions(-) commit 71c03a8cb213d267853e0d9f520c972480960544 Author: Johan Hovold Date: Mon Sep 2 09:08:30 2024 +0200 clk: qcom: gcc-sc8280xp: don't use parking clk_ops for QUPs A recent change started parking the RCG at an always on parent during registration, something which specifically breaks handover from an early serial console. Quoting Stephen Boyd who fixed this issue for SM8550 [1]: The QUPs aren't shared in a way that requires parking the RCG at an always on parent in case some other entity turns on the clk. The hardware is capable of setting a new frequency itself with the DFS mode, so parking is unnecessary. Furthermore, there aren't any GDSCs for these devices, so there isn't a possibility of the GDSC turning on the clks for housekeeping purposes. This wasn't a problem to mark these clks shared until we started parking shared RCGs at clk registration time in commit 01a0a6cc8cfd ("clk: qcom: Park shared RCGs upon registration"). Parking at init is actually harmful to the UART when earlycon is used. If the device is pumping out data while the frequency changes you'll see garbage on the serial console until the driver can probe and actually set a proper frequency. Fixes: 01a0a6cc8cfd ("clk: qcom: Park shared RCGs upon registration") Fixes: d65d005f9a6c ("clk: qcom: add sc8280xp GCC driver") Link: https://lore.kernel.org/all/20240819233628.2074654-2-swboyd@chromium.org/ [1] Signed-off-by: Johan Hovold Link: https://lore.kernel.org/r/20240902070830.8535-1-johan+linaro@kernel.org Signed-off-by: Stephen Boyd drivers/clk/qcom/gcc-sc8280xp.c | 48 ++++++++++++++++++++--------------------- 1 file changed, 24 insertions(+), 24 deletions(-) commit 88fac17500f4ea49c7bac136cf1b27e7b9980075 Merge: 67784a74e258 3ab394b363c5 Author: Linus Torvalds Date: Tue Sep 3 12:32:00 2024 -0700 Merge tag 'fuse-fixes-6.11-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/mszeredi/fuse Pull fuse fixes from Miklos Szeredi: - Fix EIO if splice and page stealing are enabled on the fuse device - Disable problematic combination of passthrough and writeback-cache - Other bug fixes found by code review * tag 'fuse-fixes-6.11-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/mszeredi/fuse: fuse: disable the combination of passthrough and writeback cache fuse: update stats for pages in dropped aux writeback list fuse: clear PG_uptodate when using a stolen page fuse: fix memory leak in fuse_create_open fuse: check aborted connection before adding requests to pending list for resending fuse: use unsigned type for getxattr/listxattr size truncation commit 33f339a1ba54e56bba57ee9a77c71e385ab4825c Author: Tze-nan Wu Date: Fri Aug 30 16:25:17 2024 +0800 bpf, net: Fix a potential race in do_sock_getsockopt() There's a potential race when `cgroup_bpf_enabled(CGROUP_GETSOCKOPT)` is false during the execution of `BPF_CGROUP_GETSOCKOPT_MAX_OPTLEN`, but becomes true when `BPF_CGROUP_RUN_PROG_GETSOCKOPT` is called. This inconsistency can lead to `BPF_CGROUP_RUN_PROG_GETSOCKOPT` receiving an "-EFAULT" from `__cgroup_bpf_run_filter_getsockopt(max_optlen=0)`. Scenario shown as below: `process A` `process B` ----------- ------------ BPF_CGROUP_GETSOCKOPT_MAX_OPTLEN enable CGROUP_GETSOCKOPT BPF_CGROUP_RUN_PROG_GETSOCKOPT (-EFAULT) To resolve this, remove the `BPF_CGROUP_GETSOCKOPT_MAX_OPTLEN` macro and directly uses `copy_from_sockptr` to ensure that `max_optlen` is always set before `BPF_CGROUP_RUN_PROG_GETSOCKOPT` is invoked. Fixes: 0d01da6afc54 ("bpf: implement getsockopt and setsockopt hooks") Co-developed-by: Yanghui Li Signed-off-by: Yanghui Li Co-developed-by: Cheng-Jui Wang Signed-off-by: Cheng-Jui Wang Signed-off-by: Tze-nan Wu Acked-by: Stanislav Fomichev Acked-by: Alexei Starovoitov Link: https://patch.msgid.link/20240830082518.23243-1-Tze-nan.Wu@mediatek.com Signed-off-by: Jakub Kicinski include/linux/bpf-cgroup.h | 9 --------- net/socket.c | 4 ++-- 2 files changed, 2 insertions(+), 11 deletions(-) commit 77461c10819103eaee7b33c744174b32a8c78b40 Author: Breno Leitao Date: Mon Sep 2 03:17:30 2024 -0700 net: dqs: Do not use extern for unused dql_group When CONFIG_DQL is not enabled, dql_group should be treated as a dead declaration. However, its current extern declaration assumes the linker will ignore it, which is generally true across most compiler and architecture combinations. But in certain cases, the linker still attempts to resolve the extern struct, even when the associated code is dead, resulting in a linking error. For instance the following error in loongarch64: >> loongarch64-linux-ld: net-sysfs.c:(.text+0x589c): undefined reference to `dql_group' Modify the declaration of the dead object to be an empty declaration instead of an extern. This change will prevent the linker from attempting to resolve an undefined reference. Reported-by: kernel test robot Closes: https://lore.kernel.org/oe-kbuild-all/202409012047.eCaOdfQJ-lkp@intel.com/ Fixes: 74293ea1c4db ("net: sysfs: Do not create sysfs for non BQL device") Signed-off-by: Breno Leitao Reviewed-by: Simon Horman Tested-by: Simon Horman # build-tested Link: https://patch.msgid.link/20240902101734.3260455-1-leitao@debian.org Signed-off-by: Jakub Kicinski net/core/net-sysfs.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 3b3a2a9c6349e25a025d2330f479bc33a6ccb54a Author: Stephen Hemminger Date: Sun Sep 1 11:16:07 2024 -0700 sch/netem: fix use after free in netem_dequeue If netem_dequeue() enqueues packet to inner qdisc and that qdisc returns __NET_XMIT_STOLEN. The packet is dropped but qdisc_tree_reduce_backlog() is not called to update the parent's q.qlen, leading to the similar use-after-free as Commit e04991a48dbaf382 ("netem: fix return value if duplicate enqueue fails") Commands to trigger KASAN UaF: ip link add type dummy ip link set lo up ip link set dummy0 up tc qdisc add dev lo parent root handle 1: drr tc filter add dev lo parent 1: basic classid 1:1 tc class add dev lo classid 1:1 drr tc qdisc add dev lo parent 1:1 handle 2: netem tc qdisc add dev lo parent 2: handle 3: drr tc filter add dev lo parent 3: basic classid 3:1 action mirred egress redirect dev dummy0 tc class add dev lo classid 3:1 drr ping -c1 -W0.01 localhost # Trigger bug tc class del dev lo classid 1:1 tc class add dev lo classid 1:1 drr ping -c1 -W0.01 localhost # UaF Fixes: 50612537e9ab ("netem: fix classful handling") Reported-by: Budimir Markovic Signed-off-by: Stephen Hemminger Link: https://patch.msgid.link/20240901182438.4992-1-stephen@networkplumber.org Signed-off-by: Jakub Kicinski net/sched/sch_netem.c | 9 ++++----- 1 file changed, 4 insertions(+), 5 deletions(-) commit bab8eb0dd4cb995caa4a0529d5655531c2ec5e8e Author: Oliver Neukum Date: Thu Aug 29 19:50:55 2024 +0200 usbnet: modern method to get random MAC The driver generates a random MAC once on load and uses it over and over, including on two devices needing a random MAC at the same time. Jakub suggested revamping the driver to the modern API for setting a random MAC rather than fixing the old stuff. The bug is as old as the driver. Signed-off-by: Oliver Neukum Reviewed-by: Simon Horman Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Link: https://patch.msgid.link/20240829175201.670718-1-oneukum@suse.com Signed-off-by: Jakub Kicinski drivers/net/usb/usbnet.c | 11 +++-------- 1 file changed, 3 insertions(+), 8 deletions(-) commit 5872b47ce18efad5862b74ad334cbdfffa7f8a0c Author: Simon Horman Date: Mon Sep 2 10:09:37 2024 +0100 MAINTAINERS: wifi: cw1200: add net-cw1200.h This is part of an effort [1] to assign a section in MAINTAINERS to header files that relate to Networking. In this case the files with "net" in their name. [1] https://lore.kernel.org/netdev/20240821-net-mnt-v2-0-59a5af38e69d@kernel.org/ It seems that net-cw1200.h is part of the CW1200 WLAN driver and this it is appropriate to add it to the section for that driver. Signed-off-by: Simon Horman Signed-off-by: Kalle Valo Link: https://patch.msgid.link/20240902-wifi-mnt-v2-1-f5ad1f36e993@kernel.org MAINTAINERS | 1 + 1 file changed, 1 insertion(+) commit cd9253c23aedd61eb5ff11f37a36247cd46faf86 Author: Filipe Manana Date: Thu Aug 29 18:25:49 2024 +0100 btrfs: fix race between direct IO write and fsync when using same fd If we have 2 threads that are using the same file descriptor and one of them is doing direct IO writes while the other is doing fsync, we have a race where we can end up either: 1) Attempt a fsync without holding the inode's lock, triggering an assertion failures when assertions are enabled; 2) Do an invalid memory access from the fsync task because the file private points to memory allocated on stack by the direct IO task and it may be used by the fsync task after the stack was destroyed. The race happens like this: 1) A user space program opens a file descriptor with O_DIRECT; 2) The program spawns 2 threads using libpthread for example; 3) One of the threads uses the file descriptor to do direct IO writes, while the other calls fsync using the same file descriptor. 4) Call task A the thread doing direct IO writes and task B the thread doing fsyncs; 5) Task A does a direct IO write, and at btrfs_direct_write() sets the file's private to an on stack allocated private with the member 'fsync_skip_inode_lock' set to true; 6) Task B enters btrfs_sync_file() and sees that there's a private structure associated to the file which has 'fsync_skip_inode_lock' set to true, so it skips locking the inode's VFS lock; 7) Task A completes the direct IO write, and resets the file's private to NULL since it had no prior private and our private was stack allocated. Then it unlocks the inode's VFS lock; 8) Task B enters btrfs_get_ordered_extents_for_logging(), then the assertion that checks the inode's VFS lock is held fails, since task B never locked it and task A has already unlocked it. The stack trace produced is the following: assertion failed: inode_is_locked(&inode->vfs_inode), in fs/btrfs/ordered-data.c:983 ------------[ cut here ]------------ kernel BUG at fs/btrfs/ordered-data.c:983! Oops: invalid opcode: 0000 [#1] PREEMPT SMP PTI CPU: 9 PID: 5072 Comm: worker Tainted: G U OE 6.10.5-1-default #1 openSUSE Tumbleweed 69f48d427608e1c09e60ea24c6c55e2ca1b049e8 Hardware name: Acer Predator PH315-52/Covini_CFS, BIOS V1.12 07/28/2020 RIP: 0010:btrfs_get_ordered_extents_for_logging.cold+0x1f/0x42 [btrfs] Code: 50 d6 86 c0 e8 (...) RSP: 0018:ffff9e4a03dcfc78 EFLAGS: 00010246 RAX: 0000000000000054 RBX: ffff9078a9868e98 RCX: 0000000000000000 RDX: 0000000000000000 RSI: ffff907dce4a7800 RDI: ffff907dce4a7800 RBP: ffff907805518800 R08: 0000000000000000 R09: ffff9e4a03dcfb38 R10: ffff9e4a03dcfb30 R11: 0000000000000003 R12: ffff907684ae7800 R13: 0000000000000001 R14: ffff90774646b600 R15: 0000000000000000 FS: 00007f04b96006c0(0000) GS:ffff907dce480000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f32acbfc000 CR3: 00000001fd4fa005 CR4: 00000000003726f0 Call Trace: ? __die_body.cold+0x14/0x24 ? die+0x2e/0x50 ? do_trap+0xca/0x110 ? do_error_trap+0x6a/0x90 ? btrfs_get_ordered_extents_for_logging.cold+0x1f/0x42 [btrfs bb26272d49b4cdc847cf3f7faadd459b62caee9a] ? exc_invalid_op+0x50/0x70 ? btrfs_get_ordered_extents_for_logging.cold+0x1f/0x42 [btrfs bb26272d49b4cdc847cf3f7faadd459b62caee9a] ? asm_exc_invalid_op+0x1a/0x20 ? btrfs_get_ordered_extents_for_logging.cold+0x1f/0x42 [btrfs bb26272d49b4cdc847cf3f7faadd459b62caee9a] ? btrfs_get_ordered_extents_for_logging.cold+0x1f/0x42 [btrfs bb26272d49b4cdc847cf3f7faadd459b62caee9a] btrfs_sync_file+0x21a/0x4d0 [btrfs bb26272d49b4cdc847cf3f7faadd459b62caee9a] ? __seccomp_filter+0x31d/0x4f0 __x64_sys_fdatasync+0x4f/0x90 do_syscall_64+0x82/0x160 ? do_futex+0xcb/0x190 ? __x64_sys_futex+0x10e/0x1d0 ? switch_fpu_return+0x4f/0xd0 ? syscall_exit_to_user_mode+0x72/0x220 ? do_syscall_64+0x8e/0x160 ? syscall_exit_to_user_mode+0x72/0x220 ? do_syscall_64+0x8e/0x160 ? syscall_exit_to_user_mode+0x72/0x220 ? do_syscall_64+0x8e/0x160 ? syscall_exit_to_user_mode+0x72/0x220 ? do_syscall_64+0x8e/0x160 entry_SYSCALL_64_after_hwframe+0x76/0x7e Another problem here is if task B grabs the private pointer and then uses it after task A has finished, since the private was allocated in the stack of task A, it results in some invalid memory access with a hard to predict result. This issue, triggering the assertion, was observed with QEMU workloads by two users in the Link tags below. Fix this by not relying on a file's private to pass information to fsync that it should skip locking the inode and instead pass this information through a special value stored in current->journal_info. This is safe because in the relevant section of the direct IO write path we are not holding a transaction handle, so current->journal_info is NULL. The following C program triggers the issue: $ cat repro.c /* Get the O_DIRECT definition. */ #ifndef _GNU_SOURCE #define _GNU_SOURCE #endif #include #include #include #include #include #include #include #include static int fd; static ssize_t do_write(int fd, const void *buf, size_t count, off_t offset) { while (count > 0) { ssize_t ret; ret = pwrite(fd, buf, count, offset); if (ret < 0) { if (errno == EINTR) continue; return ret; } count -= ret; buf += ret; } return 0; } static void *fsync_loop(void *arg) { while (1) { int ret; ret = fsync(fd); if (ret != 0) { perror("Fsync failed"); exit(6); } } } int main(int argc, char *argv[]) { long pagesize; void *write_buf; pthread_t fsyncer; int ret; if (argc != 2) { fprintf(stderr, "Use: %s \n", argv[0]); return 1; } fd = open(argv[1], O_WRONLY | O_CREAT | O_TRUNC | O_DIRECT, 0666); if (fd == -1) { perror("Failed to open/create file"); return 1; } pagesize = sysconf(_SC_PAGE_SIZE); if (pagesize == -1) { perror("Failed to get page size"); return 2; } ret = posix_memalign(&write_buf, pagesize, pagesize); if (ret) { perror("Failed to allocate buffer"); return 3; } ret = pthread_create(&fsyncer, NULL, fsync_loop, NULL); if (ret != 0) { fprintf(stderr, "Failed to create writer thread: %d\n", ret); return 4; } while (1) { ret = do_write(fd, write_buf, pagesize, 0); if (ret != 0) { perror("Write failed"); exit(5); } } return 0; } $ mkfs.btrfs -f /dev/sdi $ mount /dev/sdi /mnt/sdi $ timeout 10 ./repro /mnt/sdi/foo Usually the race is triggered within less than 1 second. A test case for fstests will follow soon. Reported-by: Paulo Dias Link: https://bugzilla.kernel.org/show_bug.cgi?id=219187 Reported-by: Andreas Jahn Link: https://bugzilla.kernel.org/show_bug.cgi?id=219199 Reported-by: syzbot+4704b3cc972bd76024f1@syzkaller.appspotmail.com Link: https://lore.kernel.org/linux-btrfs/00000000000044ff540620d7dee2@google.com/ Fixes: 939b656bc8ab ("btrfs: fix corruption after buffer fault in during direct IO append write") CC: stable@vger.kernel.org # 5.15+ Reviewed-by: Josef Bacik Signed-off-by: Filipe Manana Reviewed-by: David Sterba Signed-off-by: David Sterba fs/btrfs/ctree.h | 1 - fs/btrfs/direct-io.c | 16 +++------------- fs/btrfs/file.c | 9 +++++++-- fs/btrfs/transaction.h | 6 ++++++ 4 files changed, 16 insertions(+), 16 deletions(-) commit 87eb3cb4ec619299cd5572e1d5eb68aef4074ac2 Author: Heikki Krogerus Date: Tue Sep 3 16:09:44 2024 +0300 usb: typec: ucsi: Fix cable registration The Cable PD Revision field in GET_CABLE_PROPERTY was introduced in UCSI v2.1, so adding check for that. The cable properties are also not used anywhere after the cable is registered, so removing the cable_prop member from struct ucsi_connector while at it. Fixes: 38ca416597b0 ("usb: typec: ucsi: Register cables based on GET_CABLE_PROPERTY") Cc: stable@vger.kernel.org Signed-off-by: Heikki Krogerus Link: https://lore.kernel.org/r/20240903130945.3395291-1-heikki.krogerus@linux.intel.com Signed-off-by: Greg Kroah-Hartman drivers/usb/typec/ucsi/ucsi.c | 30 +++++++++++++++--------------- drivers/usb/typec/ucsi/ucsi.h | 1 - 2 files changed, 15 insertions(+), 16 deletions(-) commit 899d2e5a4e3d36689e8938e152f4b69a4bcc6b4d Author: Maurizio Lombardi Date: Thu Aug 29 11:52:14 2024 +0200 nvmet: Identify-Active Namespace ID List command should reject invalid nsid nsid values of 0xFFFFFFFE and 0XFFFFFFFF should be rejected with a status code of "Invalid Namespace or Format". See NVMe Base Specification, Active Namespace ID list (CNS 02h). Fixes: a07b4970f464 ("nvmet: add a generic NVMe target") Signed-off-by: Maurizio Lombardi Reviewed-by: Sagi Grimberg Signed-off-by: Keith Busch drivers/nvme/target/admin-cmd.c | 10 ++++++++++ 1 file changed, 10 insertions(+) commit 28982ad73d6a9605708631dc49a0c763cc398aa2 Author: Christoph Hellwig Date: Thu Aug 29 09:24:37 2024 +0300 nvme: set BLK_FEAT_ZONED for ZNS multipath disks The new stricter limits validation doesn't like a max_append_sectors value to be set without BLK_FEAT_ZONED. Set it before allocation the disk to fix this instead of just inheriting it later. Fixes: d690cb8ae14b ("block: add an API to atomically update queue limits") Signed-off-by: Christoph Hellwig Signed-off-by: Keith Busch drivers/nvme/host/multipath.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) commit e88b9ed3e03a6471bee131f201f6f2f87383e898 Merge: 094513f8a2fb 2f833e8948d6 Author: Kalle Valo Date: Tue Sep 3 19:54:15 2024 +0300 Merge tag 'ath-current-20240903' of git://git.kernel.org/pub/scm/linux/kernel/git/ath/ath ath.git patches for v6.11-rc7 We have three patch which address two issues in the ath11k driver which should be addressed for 6.11-rc7: One patch fixes a NULL pointer dereference while parsing transmit power envelope (TPE) information, and the other two patches revert the hibernation support since it is interfering with suspend on some platforms. Note the cause of the suspend wakeups is still being investigated, and it is hoped this can be addressed and hibernation support can be restored in the near future. commit 04c7e14e5b0b6227e7b00d7a96ca2f2426ab9171 Author: Larysa Zaremba Date: Fri Aug 23 11:59:31 2024 +0200 ice: do not bring the VSI up, if it was down before the XDP setup After XDP configuration is completed, we bring the interface up unconditionally, regardless of its state before the call to .ndo_bpf(). Preserve the information whether the interface had to be brought down and later bring it up only in such case. Fixes: efc2214b6047 ("ice: Add support for XDP") Reviewed-by: Wojciech Drewek Reviewed-by: Jacob Keller Tested-by: Chandan Kumar Rout Acked-by: Maciej Fijalkowski Signed-off-by: Larysa Zaremba Signed-off-by: Tony Nguyen drivers/net/ethernet/intel/ice/ice_main.c | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) commit 562755501d44cfbbe82703a62cb41502bd067bd1 Author: Marek Marczykowski-Górecki Date: Tue Sep 3 14:49:31 2024 +0200 ALSA: hda/realtek: extend quirks for Clevo V5[46]0 The mic in those laptops suffers too high gain resulting in mostly (fan or else) noise being recorded. In addition to the existing fixup about mic detection, apply also limiting its boost. While at it, extend the quirk to also V5[46]0TNE models, which have the same issue. Signed-off-by: Marek Marczykowski-Górecki Cc: Link: https://patch.msgid.link/20240903124939.6213-1-marmarek@invisiblethingslab.com Signed-off-by: Takashi Iwai sound/pci/hda/patch_realtek.c | 10 +++++++++- 1 file changed, 9 insertions(+), 1 deletion(-) commit 7e3b407ccbea3259b8583ccc34807622025e390f Author: Larysa Zaremba Date: Fri Aug 23 11:59:30 2024 +0200 ice: remove ICE_CFG_BUSY locking from AF_XDP code Locking used in ice_qp_ena() and ice_qp_dis() does pretty much nothing, because ICE_CFG_BUSY is a state flag that is supposed to be set in a PF state, not VSI one. Therefore it does not protect the queue pair from e.g. reset. Remove ICE_CFG_BUSY locking from ice_qp_dis() and ice_qp_ena(). Fixes: 2d4238f55697 ("ice: Add support for AF_XDP") Reviewed-by: Wojciech Drewek Reviewed-by: Jacob Keller Tested-by: Chandan Kumar Rout Reviewed-by: Maciej Fijalkowski Signed-off-by: Larysa Zaremba Signed-off-by: Tony Nguyen drivers/net/ethernet/intel/ice/ice_xsk.c | 9 --------- 1 file changed, 9 deletions(-) commit d8c40b9d3a6cef61eb5a0c58c34a3090ea938d89 Author: Larysa Zaremba Date: Fri Aug 23 11:59:29 2024 +0200 ice: check ICE_VSI_DOWN under rtnl_lock when preparing for reset Consider the following scenario: .ndo_bpf() | ice_prepare_for_reset() | ________________________|_______________________________________| rtnl_lock() | | ice_down() | | | test_bit(ICE_VSI_DOWN) - true | | ice_dis_vsi() returns | ice_up() | | | proceeds to rebuild a running VSI | .ndo_bpf() is not the only rtnl-locked callback that toggles the interface to apply new configuration. Another example is .set_channels(). To avoid the race condition above, act only after reading ICE_VSI_DOWN under rtnl_lock. Fixes: 0f9d5027a749 ("ice: Refactor VSI allocation, deletion and rebuild flow") Reviewed-by: Wojciech Drewek Reviewed-by: Jacob Keller Tested-by: Chandan Kumar Rout Signed-off-by: Larysa Zaremba Reviewed-by: Maciej Fijalkowski Signed-off-by: Tony Nguyen drivers/net/ethernet/intel/ice/ice_lib.c | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-) commit f50c68763436bc8f805712a7c5ceaf58cfcf5f07 Author: Larysa Zaremba Date: Fri Aug 23 11:59:28 2024 +0200 ice: check for XDP rings instead of bpf program when unconfiguring If VSI rebuild is pending, .ndo_bpf() can attach/detach the XDP program on VSI without applying new ring configuration. When unconfiguring the VSI, we can encounter the state in which there is an XDP program but no XDP rings to destroy or there will be XDP rings that need to be destroyed, but no XDP program to indicate their presence. When unconfiguring, rely on the presence of XDP rings rather then XDP program, as they better represent the current state that has to be destroyed. Reviewed-by: Wojciech Drewek Reviewed-by: Jacob Keller Tested-by: Chandan Kumar Rout Acked-by: Maciej Fijalkowski Signed-off-by: Larysa Zaremba Signed-off-by: Tony Nguyen drivers/net/ethernet/intel/ice/ice_lib.c | 4 ++-- drivers/net/ethernet/intel/ice/ice_main.c | 4 ++-- drivers/net/ethernet/intel/ice/ice_xsk.c | 6 +++--- 3 files changed, 7 insertions(+), 7 deletions(-) commit 2504b8405768a57a71e660dbfd5abd59f679a03f Author: Larysa Zaremba Date: Fri Aug 23 11:59:27 2024 +0200 ice: protect XDP configuration with a mutex The main threat to data consistency in ice_xdp() is a possible asynchronous PF reset. It can be triggered by a user or by TX timeout handler. XDP setup and PF reset code access the same resources in the following sections: * ice_vsi_close() in ice_prepare_for_reset() - already rtnl-locked * ice_vsi_rebuild() for the PF VSI - not protected * ice_vsi_open() - already rtnl-locked With an unfortunate timing, such accesses can result in a crash such as the one below: [ +1.999878] ice 0000:b1:00.0: Registered XDP mem model MEM_TYPE_XSK_BUFF_POOL on Rx ring 14 [ +2.002992] ice 0000:b1:00.0: Registered XDP mem model MEM_TYPE_XSK_BUFF_POOL on Rx ring 18 [Mar15 18:17] ice 0000:b1:00.0 ens801f0np0: NETDEV WATCHDOG: CPU: 38: transmit queue 14 timed out 80692736 ms [ +0.000093] ice 0000:b1:00.0 ens801f0np0: tx_timeout: VSI_num: 6, Q 14, NTC: 0x0, HW_HEAD: 0x0, NTU: 0x0, INT: 0x4000001 [ +0.000012] ice 0000:b1:00.0 ens801f0np0: tx_timeout recovery level 1, txqueue 14 [ +0.394718] ice 0000:b1:00.0: PTP reset successful [ +0.006184] BUG: kernel NULL pointer dereference, address: 0000000000000098 [ +0.000045] #PF: supervisor read access in kernel mode [ +0.000023] #PF: error_code(0x0000) - not-present page [ +0.000023] PGD 0 P4D 0 [ +0.000018] Oops: 0000 [#1] PREEMPT SMP NOPTI [ +0.000023] CPU: 38 PID: 7540 Comm: kworker/38:1 Not tainted 6.8.0-rc7 #1 [ +0.000031] Hardware name: Intel Corporation S2600WFT/S2600WFT, BIOS SE5C620.86B.02.01.0014.082620210524 08/26/2021 [ +0.000036] Workqueue: ice ice_service_task [ice] [ +0.000183] RIP: 0010:ice_clean_tx_ring+0xa/0xd0 [ice] [...] [ +0.000013] Call Trace: [ +0.000016] [ +0.000014] ? __die+0x1f/0x70 [ +0.000029] ? page_fault_oops+0x171/0x4f0 [ +0.000029] ? schedule+0x3b/0xd0 [ +0.000027] ? exc_page_fault+0x7b/0x180 [ +0.000022] ? asm_exc_page_fault+0x22/0x30 [ +0.000031] ? ice_clean_tx_ring+0xa/0xd0 [ice] [ +0.000194] ice_free_tx_ring+0xe/0x60 [ice] [ +0.000186] ice_destroy_xdp_rings+0x157/0x310 [ice] [ +0.000151] ice_vsi_decfg+0x53/0xe0 [ice] [ +0.000180] ice_vsi_rebuild+0x239/0x540 [ice] [ +0.000186] ice_vsi_rebuild_by_type+0x76/0x180 [ice] [ +0.000145] ice_rebuild+0x18c/0x840 [ice] [ +0.000145] ? delay_tsc+0x4a/0xc0 [ +0.000022] ? delay_tsc+0x92/0xc0 [ +0.000020] ice_do_reset+0x140/0x180 [ice] [ +0.000886] ice_service_task+0x404/0x1030 [ice] [ +0.000824] process_one_work+0x171/0x340 [ +0.000685] worker_thread+0x277/0x3a0 [ +0.000675] ? preempt_count_add+0x6a/0xa0 [ +0.000677] ? _raw_spin_lock_irqsave+0x23/0x50 [ +0.000679] ? __pfx_worker_thread+0x10/0x10 [ +0.000653] kthread+0xf0/0x120 [ +0.000635] ? __pfx_kthread+0x10/0x10 [ +0.000616] ret_from_fork+0x2d/0x50 [ +0.000612] ? __pfx_kthread+0x10/0x10 [ +0.000604] ret_from_fork_asm+0x1b/0x30 [ +0.000604] The previous way of handling this through returning -EBUSY is not viable, particularly when destroying AF_XDP socket, because the kernel proceeds with removal anyway. There is plenty of code between those calls and there is no need to create a large critical section that covers all of them, same as there is no need to protect ice_vsi_rebuild() with rtnl_lock(). Add xdp_state_lock mutex to protect ice_vsi_rebuild() and ice_xdp(). Leaving unprotected sections in between would result in two states that have to be considered: 1. when the VSI is closed, but not yet rebuild 2. when VSI is already rebuild, but not yet open The latter case is actually already handled through !netif_running() case, we just need to adjust flag checking a little. The former one is not as trivial, because between ice_vsi_close() and ice_vsi_rebuild(), a lot of hardware interaction happens, this can make adding/deleting rings exit with an error. Luckily, VSI rebuild is pending and can apply new configuration for us in a managed fashion. Therefore, add an additional VSI state flag ICE_VSI_REBUILD_PENDING to indicate that ice_xdp() can just hot-swap the program. Also, as ice_vsi_rebuild() flow is touched in this patch, make it more consistent by deconfiguring VSI when coalesce allocation fails. Fixes: 2d4238f55697 ("ice: Add support for AF_XDP") Fixes: efc2214b6047 ("ice: Add support for XDP") Reviewed-by: Wojciech Drewek Reviewed-by: Jacob Keller Tested-by: Chandan Kumar Rout Signed-off-by: Larysa Zaremba Reviewed-by: Maciej Fijalkowski Signed-off-by: Tony Nguyen drivers/net/ethernet/intel/ice/ice.h | 2 ++ drivers/net/ethernet/intel/ice/ice_lib.c | 34 +++++++++++++++++++------------ drivers/net/ethernet/intel/ice/ice_main.c | 19 ++++++++++++----- drivers/net/ethernet/intel/ice/ice_xsk.c | 3 ++- 4 files changed, 39 insertions(+), 19 deletions(-) commit 2a5dc090b92cfa5270e20056074241c6db5c9cdd Author: Larysa Zaremba Date: Fri Aug 23 11:59:26 2024 +0200 ice: move netif_queue_set_napi to rtnl-protected sections Currently, netif_queue_set_napi() is called from ice_vsi_rebuild() that is not rtnl-locked when called from the reset. This creates the need to take the rtnl_lock just for a single function and complicates the synchronization with .ndo_bpf. At the same time, there no actual need to fill napi-to-queue information at this exact point. Fill napi-to-queue information when opening the VSI and clear it when the VSI is being closed. Those routines are already rtnl-locked. Also, rewrite napi-to-queue assignment in a way that prevents inclusion of XDP queues, as this leads to out-of-bounds writes, such as one below. [ +0.000004] BUG: KASAN: slab-out-of-bounds in netif_queue_set_napi+0x1c2/0x1e0 [ +0.000012] Write of size 8 at addr ffff889881727c80 by task bash/7047 [ +0.000006] CPU: 24 PID: 7047 Comm: bash Not tainted 6.10.0-rc2+ #2 [ +0.000004] Hardware name: Intel Corporation S2600WFT/S2600WFT, BIOS SE5C620.86B.02.01.0014.082620210524 08/26/2021 [ +0.000003] Call Trace: [ +0.000003] [ +0.000002] dump_stack_lvl+0x60/0x80 [ +0.000007] print_report+0xce/0x630 [ +0.000007] ? __pfx__raw_spin_lock_irqsave+0x10/0x10 [ +0.000007] ? __virt_addr_valid+0x1c9/0x2c0 [ +0.000005] ? netif_queue_set_napi+0x1c2/0x1e0 [ +0.000003] kasan_report+0xe9/0x120 [ +0.000004] ? netif_queue_set_napi+0x1c2/0x1e0 [ +0.000004] netif_queue_set_napi+0x1c2/0x1e0 [ +0.000005] ice_vsi_close+0x161/0x670 [ice] [ +0.000114] ice_dis_vsi+0x22f/0x270 [ice] [ +0.000095] ice_pf_dis_all_vsi.constprop.0+0xae/0x1c0 [ice] [ +0.000086] ice_prepare_for_reset+0x299/0x750 [ice] [ +0.000087] pci_dev_save_and_disable+0x82/0xd0 [ +0.000006] pci_reset_function+0x12d/0x230 [ +0.000004] reset_store+0xa0/0x100 [ +0.000006] ? __pfx_reset_store+0x10/0x10 [ +0.000002] ? __pfx_mutex_lock+0x10/0x10 [ +0.000004] ? __check_object_size+0x4c1/0x640 [ +0.000007] kernfs_fop_write_iter+0x30b/0x4a0 [ +0.000006] vfs_write+0x5d6/0xdf0 [ +0.000005] ? fd_install+0x180/0x350 [ +0.000005] ? __pfx_vfs_write+0x10/0xA10 [ +0.000004] ? do_fcntl+0x52c/0xcd0 [ +0.000004] ? kasan_save_track+0x13/0x60 [ +0.000003] ? kasan_save_free_info+0x37/0x60 [ +0.000006] ksys_write+0xfa/0x1d0 [ +0.000003] ? __pfx_ksys_write+0x10/0x10 [ +0.000002] ? __x64_sys_fcntl+0x121/0x180 [ +0.000004] ? _raw_spin_lock+0x87/0xe0 [ +0.000005] do_syscall_64+0x80/0x170 [ +0.000007] ? _raw_spin_lock+0x87/0xe0 [ +0.000004] ? __pfx__raw_spin_lock+0x10/0x10 [ +0.000003] ? file_close_fd_locked+0x167/0x230 [ +0.000005] ? syscall_exit_to_user_mode+0x7d/0x220 [ +0.000005] ? do_syscall_64+0x8c/0x170 [ +0.000004] ? do_syscall_64+0x8c/0x170 [ +0.000003] ? do_syscall_64+0x8c/0x170 [ +0.000003] ? fput+0x1a/0x2c0 [ +0.000004] ? filp_close+0x19/0x30 [ +0.000004] ? do_dup2+0x25a/0x4c0 [ +0.000004] ? __x64_sys_dup2+0x6e/0x2e0 [ +0.000002] ? syscall_exit_to_user_mode+0x7d/0x220 [ +0.000004] ? do_syscall_64+0x8c/0x170 [ +0.000003] ? __count_memcg_events+0x113/0x380 [ +0.000005] ? handle_mm_fault+0x136/0x820 [ +0.000005] ? do_user_addr_fault+0x444/0xa80 [ +0.000004] ? clear_bhb_loop+0x25/0x80 [ +0.000004] ? clear_bhb_loop+0x25/0x80 [ +0.000002] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ +0.000005] RIP: 0033:0x7f2033593154 Fixes: 080b0c8d6d26 ("ice: Fix ASSERT_RTNL() warning during certain scenarios") Fixes: 91fdbce7e8d6 ("ice: Add support in the driver for associating queue with napi") Reviewed-by: Wojciech Drewek Reviewed-by: Jacob Keller Reviewed-by: Amritha Nambiar Signed-off-by: Larysa Zaremba Reviewed-by: Maciej Fijalkowski Tested-by: George Kuruvinakunnel Signed-off-by: Tony Nguyen drivers/net/ethernet/intel/ice/ice_base.c | 11 +-- drivers/net/ethernet/intel/ice/ice_lib.c | 129 +++++++----------------------- drivers/net/ethernet/intel/ice/ice_lib.h | 10 +-- drivers/net/ethernet/intel/ice/ice_main.c | 17 +++- 4 files changed, 49 insertions(+), 118 deletions(-) commit ab85218910729b95f9b0acfebab55c2cab5f8ee7 Author: David Howells Date: Fri Aug 23 14:36:39 2024 +0100 netfs, cifs: Improve some debugging bits Improve some debugging bits: (1) The netfslib _debug() macro doesn't need a newline in its format string. (2) Display the request debug ID and subrequest index in messages emitted in smb2_adjust_credits() to make it easier to reference in traces. Signed-off-by: David Howells cc: Steve French cc: Paulo Alcantara cc: Jeff Layton cc: linux-cifs@vger.kernel.org cc: netfs@lists.linux.dev cc: linux-fsdevel@vger.kernel.org Signed-off-by: Steve French fs/netfs/io.c | 2 +- fs/smb/client/smb2ops.c | 8 +++++--- 2 files changed, 6 insertions(+), 4 deletions(-) commit a68c74865f517e26728735aba0ae05055eaff76c Author: David Howells Date: Tue Sep 3 11:15:41 2024 +0100 cifs: Fix SMB1 readv/writev callback in the same way as SMB2/3 Port a number of SMB2/3 async readv/writev fixes to the SMB1 transport: commit a88d60903696c01de577558080ec4fc738a70475 cifs: Don't advance the I/O iterator before terminating subrequest commit ce5291e56081730ec7d87bc9aa41f3de73ff3256 cifs: Defer read completion commit 1da29f2c39b67b846b74205c81bf0ccd96d34727 netfs, cifs: Fix handling of short DIO read Fixes: 3ee1a1fc3981 ("cifs: Cut over to using netfslib") Signed-off-by: David Howells Reported-by: Steve French Reviewed-by: Paulo Alcantara cc: Jeff Layton cc: linux-cifs@vger.kernel.org cc: netfs@lists.linux.dev cc: linux-fsdevel@vger.kernel.org Signed-off-by: Steve French fs/smb/client/cifssmb.c | 54 +++++++++++++++++++++++++++++++++++++++++-------- 1 file changed, 46 insertions(+), 8 deletions(-) commit 517b58c1f9242a6b4ac9443d95569dee58bf6b8b Author: David Howells Date: Tue Sep 3 15:11:18 2024 +0100 cifs: Fix zero_point init on inode initialisation Fix cifs_fattr_to_inode() such that the ->zero_point tracking variable is initialised when the inode is initialised. Fixes: 3ee1a1fc3981 ("cifs: Cut over to using netfslib") Signed-off-by: David Howells Reviewed-by: Paulo Alcantara (Red Hat) cc: Jeff Layton cc: linux-cifs@vger.kernel.org cc: netfs@lists.linux.dev cc: linux-fsdevel@vger.kernel.org cc: linux-mm@kvack.org Signed-off-by: Steve French fs/smb/client/inode.c | 2 ++ 1 file changed, 2 insertions(+) commit f9c169b51b6ce20394594ef674d6b10efba31220 Author: Paulo Alcantara Date: Tue Sep 3 10:53:24 2024 -0300 smb: client: fix double put of @cfile in smb2_set_path_size() If smb2_compound_op() is called with a valid @cfile and returned -EINVAL, we need to call cifs_get_writable_path() before retrying it as the reference of @cfile was already dropped by previous call. This fixes the following KASAN splat when running fstests generic/013 against Windows Server 2022: CIFS: Attempting to mount //w22-fs0/scratch run fstests generic/013 at 2024-09-02 19:48:59 ================================================================== BUG: KASAN: slab-use-after-free in detach_if_pending+0xab/0x200 Write of size 8 at addr ffff88811f1a3730 by task kworker/3:2/176 CPU: 3 UID: 0 PID: 176 Comm: kworker/3:2 Not tainted 6.11.0-rc6 #2 Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-2.fc40 04/01/2014 Workqueue: cifsoplockd cifs_oplock_break [cifs] Call Trace: dump_stack_lvl+0x5d/0x80 ? detach_if_pending+0xab/0x200 print_report+0x156/0x4d9 ? detach_if_pending+0xab/0x200 ? __virt_addr_valid+0x145/0x300 ? __phys_addr+0x46/0x90 ? detach_if_pending+0xab/0x200 kasan_report+0xda/0x110 ? detach_if_pending+0xab/0x200 detach_if_pending+0xab/0x200 timer_delete+0x96/0xe0 ? __pfx_timer_delete+0x10/0x10 ? rcu_is_watching+0x20/0x50 try_to_grab_pending+0x46/0x3b0 __cancel_work+0x89/0x1b0 ? __pfx___cancel_work+0x10/0x10 ? kasan_save_track+0x14/0x30 cifs_close_deferred_file+0x110/0x2c0 [cifs] ? __pfx_cifs_close_deferred_file+0x10/0x10 [cifs] ? __pfx_down_read+0x10/0x10 cifs_oplock_break+0x4c1/0xa50 [cifs] ? __pfx_cifs_oplock_break+0x10/0x10 [cifs] ? lock_is_held_type+0x85/0xf0 ? mark_held_locks+0x1a/0x90 process_one_work+0x4c6/0x9f0 ? find_held_lock+0x8a/0xa0 ? __pfx_process_one_work+0x10/0x10 ? lock_acquired+0x220/0x550 ? __list_add_valid_or_report+0x37/0x100 worker_thread+0x2e4/0x570 ? __kthread_parkme+0xd1/0xf0 ? __pfx_worker_thread+0x10/0x10 kthread+0x17f/0x1c0 ? kthread+0xda/0x1c0 ? __pfx_kthread+0x10/0x10 ret_from_fork+0x31/0x60 ? __pfx_kthread+0x10/0x10 ret_from_fork_asm+0x1a/0x30 Allocated by task 1118: kasan_save_stack+0x30/0x50 kasan_save_track+0x14/0x30 __kasan_kmalloc+0xaa/0xb0 cifs_new_fileinfo+0xc8/0x9d0 [cifs] cifs_atomic_open+0x467/0x770 [cifs] lookup_open.isra.0+0x665/0x8b0 path_openat+0x4c3/0x1380 do_filp_open+0x167/0x270 do_sys_openat2+0x129/0x160 __x64_sys_creat+0xad/0xe0 do_syscall_64+0xbb/0x1d0 entry_SYSCALL_64_after_hwframe+0x77/0x7f Freed by task 83: kasan_save_stack+0x30/0x50 kasan_save_track+0x14/0x30 kasan_save_free_info+0x3b/0x70 poison_slab_object+0xe9/0x160 __kasan_slab_free+0x32/0x50 kfree+0xf2/0x300 process_one_work+0x4c6/0x9f0 worker_thread+0x2e4/0x570 kthread+0x17f/0x1c0 ret_from_fork+0x31/0x60 ret_from_fork_asm+0x1a/0x30 Last potentially related work creation: kasan_save_stack+0x30/0x50 __kasan_record_aux_stack+0xad/0xc0 insert_work+0x29/0xe0 __queue_work+0x5ea/0x760 queue_work_on+0x6d/0x90 _cifsFileInfo_put+0x3f6/0x770 [cifs] smb2_compound_op+0x911/0x3940 [cifs] smb2_set_path_size+0x228/0x270 [cifs] cifs_set_file_size+0x197/0x460 [cifs] cifs_setattr+0xd9c/0x14b0 [cifs] notify_change+0x4e3/0x740 do_truncate+0xfa/0x180 vfs_truncate+0x195/0x200 __x64_sys_truncate+0x109/0x150 do_syscall_64+0xbb/0x1d0 entry_SYSCALL_64_after_hwframe+0x77/0x7f Fixes: 71f15c90e785 ("smb: client: retry compound request without reusing lease") Cc: stable@vger.kernel.org Signed-off-by: Paulo Alcantara (Red Hat) Cc: David Howells Signed-off-by: Steve French fs/smb/client/smb2inode.c | 1 + 1 file changed, 1 insertion(+) commit 1ff95eb2bebda50c4c5406caaf201e0fcb24cc8f Author: Alexandre Ghiti Date: Thu Aug 29 18:50:48 2024 +0200 riscv: Fix RISCV_ALTERNATIVE_EARLY RISCV_ALTERNATIVE_EARLY will issue sbi_ecall() very early in the boot process, before the first memory mapping is setup so we can't have any instrumentation happening here. In addition, when the kernel is relocatable, we must also not issue any relocation this early since they would have been patched virtually only. So, instead of disabling instrumentation for the whole kernel/sbi.c file and compiling it with -fno-pie, simply move __sbi_ecall() and __sbi_base_ecall() into their own file where this is fixed. Reported-by: Conor Dooley Closes: https://lore.kernel.org/linux-riscv/20240813-pony-truck-3e7a83e9759e@spud/ Reported-by: syzbot+cfbcb82adf6d7279fd35@syzkaller.appspotmail.com Closes: https://lore.kernel.org/linux-riscv/00000000000065062c061fcec37b@google.com/ Fixes: 1745cfafebdf ("riscv: don't use global static vars to store alternative data") Signed-off-by: Alexandre Ghiti Link: https://lore.kernel.org/r/20240829165048.49756-1-alexghiti@rivosinc.com Signed-off-by: Palmer Dabbelt arch/riscv/include/asm/sbi.h | 20 +++++++++++++- arch/riscv/kernel/Makefile | 6 ++++- arch/riscv/kernel/sbi.c | 63 ------------------------------------------- arch/riscv/kernel/sbi_ecall.c | 48 +++++++++++++++++++++++++++++++++ 4 files changed, 72 insertions(+), 65 deletions(-) commit 5f771088a2b5edd6f2c5c9f34484ca18dc389f3e Author: Alexandre Ghiti Date: Tue Aug 27 08:52:30 2024 +0200 riscv: Do not restrict memory size because of linear mapping on nommu It makes no sense to restrict physical memory size because of linear mapping size constraints when there is no linear mapping, so only do that when mmu is enabled. Reported-by: Geert Uytterhoeven Closes: https://lore.kernel.org/linux-riscv/CAMuHMdW0bnJt5GMRtOZGkTiM7GK4UaLJCDMF_Ouq++fnDKi3_A@mail.gmail.com/ Fixes: 3b6564427aea ("riscv: Fix linear mapping checks for non-contiguous memory regions") Signed-off-by: Alexandre Ghiti Tested-by: Geert Uytterhoeven Link: https://lore.kernel.org/r/20240827065230.145021-1-alexghiti@rivosinc.com Signed-off-by: Palmer Dabbelt arch/riscv/mm/init.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 5ba7a75a53dffbf727e842b5847859bb482ac4aa Author: Anton Blanchard Date: Mon Aug 19 00:11:31 2024 +0000 riscv: Fix toolchain vector detection A recent change to gcc flags rv64iv as no longer valid: cc1: sorry, unimplemented: Currently the 'V' implementation requires the 'M' extension and as a result vector support is disabled. Fix this by adding m to our toolchain vector detection code. Signed-off-by: Anton Blanchard Fixes: fa8e7cce55da ("riscv: Enable Vector code to be built") Link: https://lore.kernel.org/r/20240819001131.1738806-1-antonb@tenstorrent.com Signed-off-by: Palmer Dabbelt arch/riscv/Kconfig | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) commit e240b0fde52f33670d1336697c22d90a4fe33c84 Author: Sven Schnelle Date: Tue Sep 3 12:23:12 2024 +0200 uprobes: Use kzalloc to allocate xol area To prevent unitialized members, use kzalloc to allocate the xol area. Fixes: b059a453b1cf1 ("x86/vdso: Add mremap hook to vm_special_mapping") Signed-off-by: Sven Schnelle Signed-off-by: Peter Zijlstra (Intel) Acked-by: Oleg Nesterov Link: https://lore.kernel.org/r/20240903102313.3402529-1-svens@linux.ibm.com kernel/events/uprobes.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) commit 3523a3df03c6f04f7ea9c2e7050102657e331a4f Author: Paulo Alcantara Date: Tue Sep 3 10:53:23 2024 -0300 smb: client: fix double put of @cfile in smb2_rename_path() If smb2_set_path_attr() is called with a valid @cfile and returned -EINVAL, we need to call cifs_get_writable_path() again as the reference of @cfile was already dropped by previous smb2_compound_op() call. Fixes: 71f15c90e785 ("smb: client: retry compound request without reusing lease") Signed-off-by: Paulo Alcantara (Red Hat) Cc: David Howells Signed-off-by: Steve French fs/smb/client/smb2inode.c | 2 ++ 1 file changed, 2 insertions(+) commit fe13fd68337512da4b7aee6326c397e817a943c7 Author: Matt Roper Date: Thu Aug 29 15:06:21 2024 -0700 drm/xe/pcode: Treat pcode as per-tile rather than per-GT There's only one instance of the pcode per tile, and for GT-related accesses both the primary and media GT share the same register interface. Since Xe was using per-GT locking, the pcode mutex wasn't actually protecting everything that it should since concurrent accesses related to a tile's primary GT and media GT were possible. Fixes: dd08ebf6c352 ("drm/xe: Introduce a new DRM driver for Intel GPUs") Signed-off-by: Matt Roper Reviewed-by: Lucas De Marchi Link: https://patchwork.freedesktop.org/patch/msgid/20240829220619.789159-5-matthew.d.roper@intel.com (cherry picked from commit 3034cc8107b8d0c7d1b56584394e215dab57f8a3) Signed-off-by: Rodrigo Vivi .../gpu/drm/xe/compat-i915-headers/intel_pcode.h | 8 +- .../gpu/drm/xe/compat-i915-headers/intel_uncore.h | 7 ++ drivers/gpu/drm/xe/xe_device_types.h | 6 ++ drivers/gpu/drm/xe/xe_gt.c | 2 - drivers/gpu/drm/xe/xe_gt_types.h | 6 -- drivers/gpu/drm/xe/xe_guc_pc.c | 2 +- drivers/gpu/drm/xe/xe_hwmon.c | 4 +- drivers/gpu/drm/xe/xe_pcode.c | 104 ++++++++++----------- drivers/gpu/drm/xe/xe_pcode.h | 16 ++-- drivers/gpu/drm/xe/xe_tile.c | 3 + drivers/gpu/drm/xe/xe_vram_freq.c | 6 +- 11 files changed, 85 insertions(+), 79 deletions(-) commit 529bf8d1118bbaa1aa835563a22b0b5c64ca9d68 Author: Daniele Ceraolo Spurio Date: Wed Aug 28 14:51:54 2024 -0700 drm/xe/gsc: Do not attempt to load the GSC multiple times The GSC HW is only reset by driver FLR or D3cold entry. We don't support the former at runtime, while the latter is only supported on DGFX, for which we don't support GSC. Therefore, if GSC failed to load previously there is no need to try again because the HW is stuck in the error state. An assert has been added so that if we ever add DGFX support we'll know we need to handle the D3 case. v2: use "< 0" instead of "!= 0" in the FW state error check (Julia). Fixes: dd0e89e5edc2 ("drm/xe/gsc: GSC FW load") Signed-off-by: Daniele Ceraolo Spurio Cc: John Harrison Cc: Alan Previn Cc: # v6.8+ Reviewed-by: Julia Filipchuk Link: https://patchwork.freedesktop.org/patch/msgid/20240828215158.2743994-2-daniele.ceraolospurio@intel.com (cherry picked from commit 2160f6f6e3cf6893a83357c3b82ff8589bdc0f08) Signed-off-by: Rodrigo Vivi drivers/gpu/drm/xe/xe_gsc.c | 12 ++++++++++++ drivers/gpu/drm/xe/xe_uc_fw.h | 9 +++++++-- 2 files changed, 19 insertions(+), 2 deletions(-) commit d34af755a533271f39cc7d86e49c0e74fde63a37 Author: Luke D. Jones Date: Sat Aug 31 12:39:05 2024 +1200 platform/x86/amd: pmf: Make ASUS GA403 quirk generic The original quirk should match to GA403U so that the full range of GA403U models can benefit. Signed-off-by: Luke D. Jones Link: https://lore.kernel.org/r/20240831003905.1060977-1-luke@ljones.dev Reviewed-by: Ilpo Järvinen Signed-off-by: Ilpo Järvinen drivers/platform/x86/amd/pmf/pmf-quirks.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit cfd433cecef929b4d92685f570f1a480762ec260 Merge: 2560db6ede1a 40bec579d4c7 Author: Paolo Abeni Date: Tue Sep 3 15:37:49 2024 +0200 Merge branch 'ptp-ocp-fix-serial-port-information-export' Vadim Fedorenko says: ==================== ptp: ocp: fix serial port information export Starting v6.8 the serial port subsystem changed the hierarchy of devices and symlinks are not working anymore. Previous discussion made it clear that the idea of symlinks for tty devices was wrong by design [1]. This series implements additional attributes to expose the information and removes symlinks for tty devices. [1] https://lore.kernel.org/netdev/2024060503-subsonic-pupil-bbee@gregkh/ v6 -> v7: - fix issues with applying patches v5 -> v6: - split conversion to array to separate patch per Jiri's feedback - move changelog to cover letter v4 -> v5: - remove unused variable in ptp_ocp_tty_show v3 -> v4: - re-organize info printing to use ptp_ocp_tty_port_name() - keep uintptr_t to be consistent with other code v2 -> v3: - replace serial ports definitions with array and enum for index - replace pointer math with direct array access - nit in documentation spelling v1 -> v2: - add Documentation/ABI changes ==================== Link: https://patch.msgid.link/20240829183603.1156671-1-vadfed@meta.com Signed-off-by: Paolo Abeni commit 40bec579d4c718dabc3e3baf7d84c93a89e6bcce Author: Vadim Fedorenko Date: Thu Aug 29 11:36:03 2024 -0700 docs: ABI: update OCP TimeCard sysfs entries Update documentation according to the changes in the driver. New attributes group tty is exposed and ttyGNSS, ttyGNSS2, ttyMAC and ttyNMEA are moved to this group. Also, these attributes are no more links to the devices but rather simple text files containing names of tty devices. Signed-off-by: Vadim Fedorenko Reviewed-by: Greg Kroah-Hartman Signed-off-by: Paolo Abeni Documentation/ABI/testing/sysfs-timecard | 31 ++++++++++++++++++------------- 1 file changed, 18 insertions(+), 13 deletions(-) commit 82ace0c8fe9b025eaa273365e27057402cdaeb02 Author: Vadim Fedorenko Date: Thu Aug 29 11:36:02 2024 -0700 ptp: ocp: adjust sysfs entries to expose tty information Implement additional attribute group to expose serial port information. Fixes tag points to the commit which introduced the change in serial port subsystem and made it impossible to use symlinks. Fixes: b286f4e87e32 ("serial: core: Move tty and serdev to be children of serial core port device") Signed-off-by: Vadim Fedorenko Reviewed-by: Greg Kroah-Hartman Signed-off-by: Paolo Abeni drivers/ptp/ptp_ocp.c | 62 ++++++++++++++++++++++++++++++++++++++++++--------- 1 file changed, 51 insertions(+), 11 deletions(-) commit d7875b4b078f7e2d862e88aed99c3ea0381aa189 Author: Vadim Fedorenko Date: Thu Aug 29 11:36:01 2024 -0700 ptp: ocp: convert serial ports to array Simplify serial port management code by using array of ports and helpers to get the name of the port. This change is needed to make the next patch simplier. Signed-off-by: Vadim Fedorenko Reviewed-by: Greg Kroah-Hartman Signed-off-by: Paolo Abeni drivers/ptp/ptp_ocp.c | 120 ++++++++++++++++++++++++-------------------------- 1 file changed, 57 insertions(+), 63 deletions(-) commit 5478a4f7b94414def7b56d2f18bc2ed9b0f3f1f2 Author: Geert Uytterhoeven Date: Tue Sep 3 14:32:27 2024 +0200 spi: spidev: Add missing spi_device_id for jg10309-01 When the of_device_id entry for "elgin,jg10309-01" was added, the corresponding spi_device_id was forgotten, causing a warning message during boot-up: SPI driver spidev has no spi_device_id for elgin,jg10309-01 Fix module autoloading and shut up the warning by adding the missing entry. Fixes: 5f3eee1eef5d0edd ("spi: spidev: Add an entry for elgin,jg10309-01") Signed-off-by: Geert Uytterhoeven Link: https://patch.msgid.link/54bbb9d8a8db7e52d13e266f2d4a9bcd8b42a98a.1725366625.git.geert+renesas@glider.be Signed-off-by: Mark Brown drivers/spi/spidev.c | 1 + 1 file changed, 1 insertion(+) commit aea62c744a9ae2a8247c54ec42138405216414da Author: Seunghwan Baek Date: Thu Aug 29 15:18:22 2024 +0900 mmc: cqhci: Fix checking of CQHCI_HALT state To check if mmc cqe is in halt state, need to check set/clear of CQHCI_HALT bit. At this time, we need to check with &, not &&. Fixes: a4080225f51d ("mmc: cqhci: support for command queue enabled host") Cc: stable@vger.kernel.org Signed-off-by: Seunghwan Baek Reviewed-by: Ritesh Harjani Acked-by: Adrian Hunter Link: https://lore.kernel.org/r/20240829061823.3718-2-sh8267.baek@samsung.com Signed-off-by: Ulf Hansson drivers/mmc/host/cqhci-core.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 48b9a8dabcc3cf5f961b2ebcd8933bf9204babb7 Author: David Fernandez Gonzalez Date: Wed Aug 28 15:43:37 2024 +0000 VMCI: Fix use-after-free when removing resource in vmci_resource_remove() When removing a resource from vmci_resource_table in vmci_resource_remove(), the search is performed using the resource handle by comparing context and resource fields. It is possible though to create two resources with different types but same handle (same context and resource fields). When trying to remove one of the resources, vmci_resource_remove() may not remove the intended one, but the object will still be freed as in the case of the datagram type in vmci_datagram_destroy_handle(). vmci_resource_table will still hold a pointer to this freed resource leading to a use-after-free vulnerability. BUG: KASAN: use-after-free in vmci_handle_is_equal include/linux/vmw_vmci_defs.h:142 [inline] BUG: KASAN: use-after-free in vmci_resource_remove+0x3a1/0x410 drivers/misc/vmw_vmci/vmci_resource.c:147 Read of size 4 at addr ffff88801c16d800 by task syz-executor197/1592 Call Trace: __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0x82/0xa9 lib/dump_stack.c:106 print_address_description.constprop.0+0x21/0x366 mm/kasan/report.c:239 __kasan_report.cold+0x7f/0x132 mm/kasan/report.c:425 kasan_report+0x38/0x51 mm/kasan/report.c:442 vmci_handle_is_equal include/linux/vmw_vmci_defs.h:142 [inline] vmci_resource_remove+0x3a1/0x410 drivers/misc/vmw_vmci/vmci_resource.c:147 vmci_qp_broker_detach+0x89a/0x11b9 drivers/misc/vmw_vmci/vmci_queue_pair.c:2182 ctx_free_ctx+0x473/0xbe1 drivers/misc/vmw_vmci/vmci_context.c:444 kref_put include/linux/kref.h:65 [inline] vmci_ctx_put drivers/misc/vmw_vmci/vmci_context.c:497 [inline] vmci_ctx_destroy+0x170/0x1d6 drivers/misc/vmw_vmci/vmci_context.c:195 vmci_host_close+0x125/0x1ac drivers/misc/vmw_vmci/vmci_host.c:143 __fput+0x261/0xa34 fs/file_table.c:282 task_work_run+0xf0/0x194 kernel/task_work.c:164 tracehook_notify_resume include/linux/tracehook.h:189 [inline] exit_to_user_mode_loop+0x184/0x189 kernel/entry/common.c:187 exit_to_user_mode_prepare+0x11b/0x123 kernel/entry/common.c:220 __syscall_exit_to_user_mode_work kernel/entry/common.c:302 [inline] syscall_exit_to_user_mode+0x18/0x42 kernel/entry/common.c:313 do_syscall_64+0x41/0x85 arch/x86/entry/common.c:86 entry_SYSCALL_64_after_hwframe+0x6e/0x0 This change ensures the type is also checked when removing the resource from vmci_resource_table in vmci_resource_remove(). Fixes: bc63dedb7d46 ("VMCI: resource object implementation.") Cc: stable@vger.kernel.org Reported-by: George Kennedy Signed-off-by: David Fernandez Gonzalez Link: https://lore.kernel.org/r/20240828154338.754746-1-david.fernandez.gonzalez@oracle.com Signed-off-by: Greg Kroah-Hartman drivers/misc/vmw_vmci/vmci_resource.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) commit 213aa670153ed675a007c1f35c5db544b0fefc94 Author: Helge Deller Date: Sat Aug 31 14:02:06 2024 +0200 parisc: Delay write-protection until mark_rodata_ro() call Do not write-protect the kernel read-only and __ro_after_init sections earlier than before mark_rodata_ro() is called. This fixes a boot issue on parisc which is triggered by commit 91a1d97ef482 ("jump_label,module: Don't alloc static_key_mod for __ro_after_init keys"). That commit may modify static key contents in the __ro_after_init section at bootup, so this section needs to be writable at least until mark_rodata_ro() is called. Signed-off-by: Helge Deller Reported-by: matoro Reported-by: Christoph Biedl Tested-by: Christoph Biedl Link: https://lore.kernel.org/linux-parisc/096cad5aada514255cd7b0b9dbafc768@matoro.tk/#r Fixes: 91a1d97ef482 ("jump_label,module: Don't alloc static_key_mod for __ro_after_init keys") Cc: stable@vger.kernel.org # v6.10+ arch/parisc/mm/init.c | 16 +++++++++++----- 1 file changed, 11 insertions(+), 5 deletions(-) commit 2560db6ede1aaf162a73b2df43e0b6c5ed8819f7 Author: Jinjie Ruan Date: Fri Aug 30 10:20:25 2024 +0800 net: phy: Fix missing of_node_put() for leds The call of of_get_child_by_name() will cause refcount incremented for leds, if it succeeds, it should call of_node_put() to decrease it, fix it. Fixes: 01e5b728e9e4 ("net: phy: Add a binding for PHY LEDs") Reviewed-by: Jonathan Cameron Signed-off-by: Jinjie Ruan Reviewed-by: Andrew Lunn Link: https://patch.msgid.link/20240830022025.610844-1-ruanjinjie@huawei.com Signed-off-by: Paolo Abeni drivers/net/phy/phy_device.c | 2 ++ 1 file changed, 2 insertions(+) commit 6fd28941447bf2c8ca0f26fda612a1cabc41663f Author: Naman Jain Date: Thu Aug 29 12:43:12 2024 +0530 Drivers: hv: vmbus: Fix rescind handling in uio_hv_generic Rescind offer handling relies on rescind callbacks for some of the resources cleanup, if they are registered. It does not unregister vmbus device for the primary channel closure, when callback is registered. Without it, next onoffer does not come, rescind flag remains set and device goes to unusable state. Add logic to unregister vmbus for the primary channel in rescind callback to ensure channel removal and relid release, and to ensure that next onoffer can be received and handled properly. Cc: stable@vger.kernel.org Fixes: ca3cda6fcf1e ("uio_hv_generic: add rescind support") Signed-off-by: Naman Jain Reviewed-by: Saurabh Sengar Link: https://lore.kernel.org/r/20240829071312.1595-3-namjain@linux.microsoft.com Signed-off-by: Greg Kroah-Hartman drivers/hv/vmbus_drv.c | 1 + drivers/uio/uio_hv_generic.c | 8 ++++++++ 2 files changed, 9 insertions(+) commit fb1adbd7e50f3d2de56d0a2bb0700e2e819a329e Author: Saurabh Sengar Date: Thu Aug 29 12:43:11 2024 +0530 uio_hv_generic: Fix kernel NULL pointer dereference in hv_uio_rescind For primary VM Bus channels, primary_channel pointer is always NULL. This pointer is valid only for the secondary channels. Also, rescind callback is meant for primary channels only. Fix NULL pointer dereference by retrieving the device_obj from the parent for the primary channel. Cc: stable@vger.kernel.org Fixes: ca3cda6fcf1e ("uio_hv_generic: add rescind support") Signed-off-by: Saurabh Sengar Signed-off-by: Naman Jain Link: https://lore.kernel.org/r/20240829071312.1595-2-namjain@linux.microsoft.com Signed-off-by: Greg Kroah-Hartman drivers/uio/uio_hv_generic.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) commit 7d32e779eb9add47bfdb4731c4d4ff443a7f7fa6 Author: Gerhard Engleder Date: Mon Aug 19 21:26:45 2024 +0200 misc: keba: Fix sysfs group creation sysfs_create_group() races with userspace. Use dev_groups instead which prevents all the problems of sysfs_create_group(). Fixes: a1944676767e ("misc: keba: Add basic KEBA CP500 system FPGA support") Suggested-by: Greg Kroah-Hartman Signed-off-by: Gerhard Engleder Link: https://lore.kernel.org/r/20240819192645.50171-1-gerhard@engleder-embedded.com Signed-off-by: Greg Kroah-Hartman drivers/misc/keba/cp500.c | 14 ++++---------- 1 file changed, 4 insertions(+), 10 deletions(-) commit a759d1f25182f51210c8831d71ce7ee81e0930f4 Author: Michal Simek Date: Mon Sep 2 15:25:10 2024 +0100 dt-bindings: nvmem: Use soc-nvmem node name instead of nvmem Based on commit d8764d347bd7 ("dt-bindings: firmware: xilinx: Describe soc-nvmem subnode") soc-nvmem should be used instead of simple nvmem that's why also update example to have it described correctly everywhere. Fixes: c7f99cd8fb6b ("dt-bindings: nvmem: Convert xlnx,zynqmp-nvmem.txt to yaml") Cc: stable Signed-off-by: Michal Simek Acked-by: Rob Herring (Arm) Signed-off-by: Srinivas Kandagatla Acked-by: Conor Dooley Link: https://lore.kernel.org/r/20240902142510.71096-4-srinivas.kandagatla@linaro.org Signed-off-by: Greg Kroah-Hartman Documentation/devicetree/bindings/nvmem/xlnx,zynqmp-nvmem.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit c69f37f6559a8948d70badd2b179db7714dedd62 Author: Geert Uytterhoeven Date: Mon Sep 2 15:25:09 2024 +0100 nvmem: Fix return type of devm_nvmem_device_get() in kerneldoc devm_nvmem_device_get() returns an nvmem device, not an nvmem cell. Fixes: e2a5402ec7c6d044 ("nvmem: Add nvmem_device based consumer apis.") Cc: stable Signed-off-by: Geert Uytterhoeven Signed-off-by: Srinivas Kandagatla Link: https://lore.kernel.org/r/20240902142510.71096-3-srinivas.kandagatla@linaro.org Signed-off-by: Greg Kroah-Hartman drivers/nvmem/core.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) commit 8679e8b4a1ebdb40c4429e49368d29353e07b601 Author: John Thomson Date: Mon Sep 2 15:25:08 2024 +0100 nvmem: u-boot-env: error if NVMEM device is too small Verify data size before trying to parse it to avoid reading out of buffer. This could happen in case of problems at MTD level or invalid DT bindings. Signed-off-by: John Thomson Cc: stable Fixes: d5542923f200 ("nvmem: add driver handling U-Boot environment variables") [rmilecki: simplify commit description & rebase] Signed-off-by: Rafał Miłecki Signed-off-by: Srinivas Kandagatla Link: https://lore.kernel.org/r/20240902142510.71096-2-srinivas.kandagatla@linaro.org Signed-off-by: Greg Kroah-Hartman drivers/nvmem/u-boot-env.c | 7 +++++++ 1 file changed, 7 insertions(+) commit e8c276d4dc0e19ee48385f74426aebc855b49aaf Author: Sukrut Bellary Date: Mon Sep 2 15:14:09 2024 +0100 misc: fastrpc: Fix double free of 'buf' in error path smatch warning: drivers/misc/fastrpc.c:1926 fastrpc_req_mmap() error: double free of 'buf' In fastrpc_req_mmap() error path, the fastrpc buffer is freed in fastrpc_req_munmap_impl() if unmap is successful. But in the end, there is an unconditional call to fastrpc_buf_free(). So the above case triggers the double free of fastrpc buf. Fixes: 72fa6f7820c4 ("misc: fastrpc: Rework fastrpc_req_munmap") Reviewed-by: Shuah Khan Reviewed-by: Dan Carpenter Reviewed-by: Srinivas Kandagatla Signed-off-by: Sukrut Bellary Signed-off-by: Srinivas Kandagatla Cc: stable Link: https://lore.kernel.org/r/20240902141409.70371-2-srinivas.kandagatla@linaro.org Signed-off-by: Greg Kroah-Hartman drivers/misc/fastrpc.c | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-) commit 4df153652cc46545722879415937582028c18af5 Author: Carlos Llamas Date: Thu Aug 22 18:23:52 2024 +0000 binder: fix UAF caused by offsets overwrite Binder objects are processed and copied individually into the target buffer during transactions. Any raw data in-between these objects is copied as well. However, this raw data copy lacks an out-of-bounds check. If the raw data exceeds the data section size then the copy overwrites the offsets section. This eventually triggers an error that attempts to unwind the processed objects. However, at this point the offsets used to index these objects are now corrupted. Unwinding with corrupted offsets can result in decrements of arbitrary nodes and lead to their premature release. Other users of such nodes are left with a dangling pointer triggering a use-after-free. This issue is made evident by the following KASAN report (trimmed): ================================================================== BUG: KASAN: slab-use-after-free in _raw_spin_lock+0xe4/0x19c Write of size 4 at addr ffff47fc91598f04 by task binder-util/743 CPU: 9 UID: 0 PID: 743 Comm: binder-util Not tainted 6.11.0-rc4 #1 Hardware name: linux,dummy-virt (DT) Call trace: _raw_spin_lock+0xe4/0x19c binder_free_buf+0x128/0x434 binder_thread_write+0x8a4/0x3260 binder_ioctl+0x18f0/0x258c [...] Allocated by task 743: __kmalloc_cache_noprof+0x110/0x270 binder_new_node+0x50/0x700 binder_transaction+0x413c/0x6da8 binder_thread_write+0x978/0x3260 binder_ioctl+0x18f0/0x258c [...] Freed by task 745: kfree+0xbc/0x208 binder_thread_read+0x1c5c/0x37d4 binder_ioctl+0x16d8/0x258c [...] ================================================================== To avoid this issue, let's check that the raw data copy is within the boundaries of the data section. Fixes: 6d98eb95b450 ("binder: avoid potential data leakage when copying txn") Cc: Todd Kjos Cc: stable@vger.kernel.org Signed-off-by: Carlos Llamas Link: https://lore.kernel.org/r/20240822182353.2129600-1-cmllamas@google.com Signed-off-by: Greg Kroah-Hartman drivers/android/binder.c | 1 + 1 file changed, 1 insertion(+) commit 8cbec539593a7dc1cbcc2d839333353a47342c06 Merge: 47ac09b91bef 0a3b517c8089 Author: Greg Kroah-Hartman Date: Tue Sep 3 12:17:10 2024 +0200 Merge tag 'iio-fixes-for-6.11a' of ssh://gitolite.kernel.org/pub/scm/linux/kernel/git/jic23/iio into char-misc-linus Jonathan writes: IIO: 1st set of fixes for 6.11 The usual mixed bag of new issues and ancient ones. The fact so many are ADI is probably due to an uptick in upstreaming effort from Analog + Baylibre meaning existing code is getting more eyes on it. Hence it's a good sign not a reflection of inherent high bug incidence! Core and helper related ----------------------- in kernel interfaces - Fix missing application of scale to the integer part of IIO_INT_PLUS_XXX value pairs when using the iio_convert_raw_to_processed*() helper. buffer-dmaengine - Make sure to release DMA channel in error path. Driver related -------------- adi,ad-sigma-delta library - Check irq-flags for the correct irq if multiple are provided. adi,ad7124 - Wait after reset before reading the chip ID register. - Compare only the relevant field when looking for an existing config to reuse for a new channel. - Fix an off by one in which channel config is being filled from firmware. adi,ad7173 - Fix missing vendor prefix in compatible strings. - Fix wrong info for GPIO related bit positions for ad4114,ad4115 and ad4116. adi,ad7606 - Drop incorrect check on frstdata when in serial mode, it only applies to parallel mode. adi,ad9834 - Check userspace input for frequency parameter to avoid div by zero. invensense,mpu6050 - Avoid reading interrupt status on some older chips as it seems there is a hardware problem that surfaces as a result of adding wake on motion support to the driver (which these chips don't support). ti,ads1119 - Fix incorrect IRQ flag (new driver so no firmware compatibility regression issues with fixing this now). * tag 'iio-fixes-for-6.11a' of ssh://gitolite.kernel.org/pub/scm/linux/kernel/git/jic23/iio: iio: imu: inv_mpu6050: fix interrupt status read for old buggy chips iio: adc: ad7173: fix GPIO device info iio: adc: ad7124: fix DT configuration parsing iio: adc: ad_sigma_delta: fix irq_flags on irq request iio: adc: ads1119: Fix IRQ flags iio: fix scale application in iio_convert_raw_to_processed_unlocked iio: adc: ad7124: fix config comparison iio: adc: ad7124: fix chip ID mismatch iio: adc: ad7173: Fix incorrect compatible string iio: buffer-dmaengine: fix releasing dma channel on error iio: adc: ad7606: remove frstdata check for serial mode staging: iio: frequency: ad9834: Validate frequency parameter value commit c2eb0626536f49f25e544d9d178c047b544340bb Merge: 5517ae241919 624d3291484f Author: Paolo Abeni Date: Tue Sep 3 10:43:50 2024 +0200 Merge branch 'net-ethernet-ti-am65-cpsw-fix-xdp-implementation' Roger Quadros says: ==================== net: ethernet: ti: am65-cpsw: Fix XDP implementation The XDP implementation on am65-cpsw driver is broken in many ways and this series fixes it. Below are the current issues that are being fixed: 1) The following XDP_DROP test from [1] stalls the interface after 250 packets. ~# xdb-bench drop -m native eth0 This is because new RX requests are never queued. Fix that. 2) The below XDP_TX test from [1] fails with a warning [ 499.947381] XDP_WARN: xdp_update_frame_from_buff(line:277): Driver BUG: missing reserved tailroom ~# xdb-bench tx -m native eth0 Fix that by using PAGE_SIZE during xdp_init_buf(). 3) In XDP_REDIRECT case only 1 packet was processed in rx_poll. Fix it to process up to budget packets. ~# ./xdp-bench redirect -m native eth0 eth0 4) If number of TX queues are set to 1 we get a NULL pointer dereference during XDP_TX. ~# ethtool -L eth0 tx 1 ~# ./xdp-trafficgen udp -A -a eth0 -t 2 Transmitting on eth0 (ifindex 2) [ 241.135257] Unable to handle kernel NULL pointer dereference at virtual address 0000000000000030 5) Net statistics is broken for XDP_TX and XDP_REDIRECT [1] xdp-tools suite https://github.com/xdp-project/xdp-tools Signed-off-by: Roger Quadros Reviewed-by: Jacob Keller Acked-by: Julien Panis Reviewed-by: MD Danish Anwar --- ==================== Link: https://patch.msgid.link/20240829-am65-cpsw-xdp-v1-0-ff3c81054a5e@kernel.org Signed-off-by: Paolo Abeni commit 624d3291484f9cada10660f820db926c0bce7741 Author: Roger Quadros Date: Thu Aug 29 15:03:21 2024 +0300 net: ethernet: ti: am65-cpsw: Fix RX statistics for XDP_TX and XDP_REDIRECT We are not using ndev->stats for rx_packets and rx_bytes anymore. Instead, we use per CPU stats which are collated in am65_cpsw_nuss_ndo_get_stats(). Fix RX statistics for XDP_TX and XDP_REDIRECT cases. Fixes: 8acacc40f733 ("net: ethernet: ti: am65-cpsw: Add minimal XDP support") Signed-off-by: Roger Quadros Reviewed-by: Jacob Keller Acked-by: Julien Panis Reviewed-by: MD Danish Anwar Signed-off-by: Paolo Abeni drivers/net/ethernet/ti/am65-cpsw-nuss.c | 17 +++++++++++++---- 1 file changed, 13 insertions(+), 4 deletions(-) commit 0a50c35277f96481a5a6ed5faf347f282040c57d Author: Roger Quadros Date: Thu Aug 29 15:03:20 2024 +0300 net: ethernet: ti: am65-cpsw: Fix NULL dereference on XDP_TX If number of TX queues are set to 1 we get a NULL pointer dereference during XDP_TX. ~# ethtool -L eth0 tx 1 ~# ./xdp-trafficgen udp -A -a eth0 -t 2 Transmitting on eth0 (ifindex 2) [ 241.135257] Unable to handle kernel NULL pointer dereference at virtual address 0000000000000030 Fix this by using actual TX queues instead of max TX queues when picking the TX channel in am65_cpsw_ndo_xdp_xmit(). Fixes: 8acacc40f733 ("net: ethernet: ti: am65-cpsw: Add minimal XDP support") Signed-off-by: Roger Quadros Reviewed-by: Jacob Keller Acked-by: Julien Panis Reviewed-by: MD Danish Anwar Signed-off-by: Paolo Abeni drivers/net/ethernet/ti/am65-cpsw-nuss.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) commit 5e24db550bd6f484d2c7687ee488708260e1f84a Author: Roger Quadros Date: Thu Aug 29 15:03:19 2024 +0300 net: ethernet: ti: am65-cpsw: fix XDP_DROP, XDP_TX and XDP_REDIRECT The following XDP_DROP test from [1] stalls the interface after 250 packets. ~# xdb-bench drop -m native eth0 This is because new RX requests are never queued. Fix that. The below XDP_TX test from [1] fails with a warning [ 499.947381] XDP_WARN: xdp_update_frame_from_buff(line:277): Driver BUG: missing reserved tailroom ~# xdb-bench tx -m native eth0 Fix that by using PAGE_SIZE during xdp_init_buf(). In XDP_REDIRECT case only 1 packet was processed in rx_poll. Fix it to process up to budget packets. Fix all XDP error cases to call trace_xdp_exception() and drop the packet in am65_cpsw_run_xdp(). [1] xdp-tools suite https://github.com/xdp-project/xdp-tools Fixes: 8acacc40f733 ("net: ethernet: ti: am65-cpsw: Add minimal XDP support") Signed-off-by: Roger Quadros Reviewed-by: Jacob Keller Acked-by: Julien Panis Reviewed-by: MD Danish Anwar Signed-off-by: Paolo Abeni drivers/net/ethernet/ti/am65-cpsw-nuss.c | 62 +++++++++++++++++--------------- 1 file changed, 34 insertions(+), 28 deletions(-) commit 9a71cf8b6fa433a8f243626ba9930a3870584e38 Author: Dmitry Baryshkov Date: Tue Sep 3 05:01:58 2024 +0300 drm/bridge-connector: reset the HDMI connector state On HDMI connectors which use drm_bridge_connector and DRM_BRIDGE_OP_HDMI IGT chokes on the max_bpc property in several kms_properties tests due to the drm_bridge_connector failing to reset HDMI-related properties. Call __drm_atomic_helper_connector_hdmi_reset() if the drm_bridge_connector has bridge_hdmi. It is impossible to call this function from HDMI bridges, none of the bridge callbacks correspond to the drm_connector_funcs::reset(). Fixes: 6b4468b0c6ba ("drm/bridge-connector: implement glue code for HDMI connector") Reviewed-by: Maxime Ripard Acked-by: Maxime Ripard Reviewed-by: Abhinav Kumar Signed-off-by: Dmitry Baryshkov Link: https://patchwork.freedesktop.org/patch/msgid/20240903-drm-bridge-connector-fix-hdmi-reset-v5-3-daebde6d9857@linaro.org Signed-off-by: Maxime Ripard drivers/gpu/drm/display/Kconfig | 1 + drivers/gpu/drm/display/drm_bridge_connector.c | 13 ++++++++++++- 2 files changed, 13 insertions(+), 1 deletion(-) commit 9da7ec9b19d8c1ad4f44e459fa5f93ad7a117dcd Author: Dmitry Baryshkov Date: Tue Sep 3 05:01:57 2024 +0300 drm/bridge-connector: move to DRM_DISPLAY_HELPER module drm_bridge_connector is a "leaf" driver, belonging to the display helper, rather than the "CRTC" drm_kms_helper module. Move the driver to the drm/display and add necessary Kconfig selection clauses. Suggested-by: Maxime Ripard Acked-by: Maxime Ripard Signed-off-by: Dmitry Baryshkov Link: https://patchwork.freedesktop.org/patch/msgid/20240903-drm-bridge-connector-fix-hdmi-reset-v5-2-daebde6d9857@linaro.org Signed-off-by: Maxime Ripard MAINTAINERS | 2 +- drivers/gpu/drm/Makefile | 1 - drivers/gpu/drm/bridge/Kconfig | 1 + drivers/gpu/drm/display/Kconfig | 5 +++++ drivers/gpu/drm/display/Makefile | 2 ++ drivers/gpu/drm/{ => display}/drm_bridge_connector.c | 0 drivers/gpu/drm/imx/dcss/Kconfig | 2 ++ drivers/gpu/drm/imx/lcdc/Kconfig | 2 ++ drivers/gpu/drm/ingenic/Kconfig | 2 ++ drivers/gpu/drm/kmb/Kconfig | 2 ++ drivers/gpu/drm/mediatek/Kconfig | 2 ++ drivers/gpu/drm/meson/Kconfig | 2 ++ drivers/gpu/drm/msm/Kconfig | 1 + drivers/gpu/drm/omapdrm/Kconfig | 2 ++ drivers/gpu/drm/renesas/rcar-du/Kconfig | 2 ++ drivers/gpu/drm/renesas/rz-du/Kconfig | 2 ++ drivers/gpu/drm/renesas/shmobile/Kconfig | 2 ++ drivers/gpu/drm/rockchip/Kconfig | 4 ++++ drivers/gpu/drm/tegra/Kconfig | 1 + drivers/gpu/drm/tidss/Kconfig | 2 ++ drivers/gpu/drm/xlnx/Kconfig | 1 + 21 files changed, 38 insertions(+), 2 deletions(-) commit 466cb3c630a51b04995c6247d2fb73b5ce7bfd7f Author: Dmitry Baryshkov Date: Tue Sep 3 05:01:56 2024 +0300 drm/display: stop depending on DRM_DISPLAY_HELPER Kconfig symbols should not declare dependency on DRM_DISPLAY_HELPER. Move all parts of DRM_DISPLAY_HELPER to an if DRM_DISPLAY_HELPER block. It is not possible to make those symbols select DRM_DISPLAY_HELPER because of the link issues when a part of the helper is selected to be built-in, while other part is selected to be as module. In such a case the modular part doesn't get built at all, leading to undefined symbols. The only viable alternative is to split drm_display_helper.ko into several small modules, each of them having their own dependencies. Suggested-by: Maxime Ripard Signed-off-by: Dmitry Baryshkov Link: https://patchwork.freedesktop.org/patch/msgid/20240903-drm-bridge-connector-fix-hdmi-reset-v5-1-daebde6d9857@linaro.org Signed-off-by: Maxime Ripard drivers/gpu/drm/display/Kconfig | 18 ++++++++---------- 1 file changed, 8 insertions(+), 10 deletions(-) commit de3d7969f6a80aa5abbbc0f39897495ae35548d0 Author: Heikki Krogerus Date: Fri Aug 30 14:16:45 2024 +0300 usb: typec: ucsi: Fix the partner PD revision The Partner PD Revision field in GET_CONNECTOR_CAPABILITY data structure was introduced in UCSI v2.1. In ucsi_check_connector_capability() the version was assumed to be 2.0, and in ucsi_register_partner() the field is accessed completely unconditionally. Fixing the version in ucsi_check_connector_capability(), and replacing the unconditional pd_revision assignment with a direct call to ucsi_check_connector_capability() in ucsi_register_port(). After this the revision is also checked only if there is a PD contract. Fixes: b9fccfdb4ebb ("usb: typec: ucsi: Get PD revision for partner") Cc: stable@vger.kernel.org Signed-off-by: Heikki Krogerus Link: https://lore.kernel.org/r/20240830111645.2134301-1-heikki.krogerus@linux.intel.com Signed-off-by: Greg Kroah-Hartman drivers/usb/typec/ucsi/ucsi.c | 50 ++++++++++++++++++++++--------------------- 1 file changed, 26 insertions(+), 24 deletions(-) commit e2940928115e83d707b21bf00b0db7d6c15f8341 Author: Pawel Laszczak Date: Mon Sep 2 11:09:16 2024 +0000 usb: cdns2: Fix controller reset issue Patch fixes the procedure of resetting controller. The CPUCTRL register is write only and reading returns 0. Waiting for reset to complite is incorrect. Fixes: 3eb1f1efe204 ("usb: cdns2: Add main part of Cadence USBHS driver") cc: stable@vger.kernel.org Signed-off-by: Pawel Laszczak Link: https://lore.kernel.org/r/PH7PR07MB9538D56D75F1F399D0BB96F0DD922@PH7PR07MB9538.namprd07.prod.outlook.com Signed-off-by: Greg Kroah-Hartman drivers/usb/gadget/udc/cdns2/cdns2-gadget.c | 12 +++--------- drivers/usb/gadget/udc/cdns2/cdns2-gadget.h | 9 +++++++++ 2 files changed, 12 insertions(+), 9 deletions(-) commit 9149c9b0c7e046273141e41eebd8a517416144ac Author: Faisal Hassan Date: Thu Aug 29 15:15:02 2024 +0530 usb: dwc3: core: update LC timer as per USB Spec V3.2 This fix addresses STAR 9001285599, which only affects DWC_usb3 version 3.20a. The timer value for PM_LC_TIMER in DWC_usb3 3.20a for the Link ECN changes is incorrect. If the PM TIMER ECN is enabled via GUCTL2[19], the link compliance test (TD7.21) may fail. If the ECN is not enabled (GUCTL2[19] = 0), the controller will use the old timer value (5us), which is still acceptable for the link compliance test. Therefore, clear GUCTL2[19] to pass the USB link compliance test: TD 7.21. Cc: stable@vger.kernel.org Signed-off-by: Faisal Hassan Acked-by: Thinh Nguyen Link: https://lore.kernel.org/r/20240829094502.26502-1-quic_faisalh@quicinc.com Signed-off-by: Greg Kroah-Hartman drivers/usb/dwc3/core.c | 15 +++++++++++++++ drivers/usb/dwc3/core.h | 2 ++ 2 files changed, 17 insertions(+) commit 00dcf2fa449f23a263343d7fe051741bdde65d0b Author: Prashanth K Date: Wed Aug 28 12:13:02 2024 +0530 usb: dwc3: Avoid waking up gadget during startxfer When operating in High-Speed, it is observed that DSTS[USBLNKST] doesn't update link state immediately after receiving the wakeup interrupt. Since wakeup event handler calls the resume callbacks, there is a chance that function drivers can perform an ep queue, which in turn tries to perform remote wakeup from send_gadget_ep_cmd(STARTXFER). This happens because DSTS[[21:18] wasn't updated to U0 yet, it's observed that the latency of DSTS can be in order of milli-seconds. Hence avoid calling gadget_wakeup during startxfer to prevent unnecessarily issuing remote wakeup to host. Fixes: c36d8e947a56 ("usb: dwc3: gadget: put link to U0 before Start Transfer") Cc: stable@vger.kernel.org Suggested-by: Thinh Nguyen Signed-off-by: Prashanth K Acked-by: Thinh Nguyen Link: https://lore.kernel.org/r/20240828064302.3796315-1-quic_prashk@quicinc.com Signed-off-by: Greg Kroah-Hartman drivers/usb/dwc3/gadget.c | 41 +++++++++++++++++------------------------ 1 file changed, 17 insertions(+), 24 deletions(-) commit a13494de53258d8cf82ed3bcd69176bbf7f2640e Author: Jouni Högander Date: Mon Sep 2 09:42:41 2024 +0300 drm/i915/display: Increase Fast Wake Sync length as a quirk In commit "drm/i915/display: Increase number of fast wake precharge pulses" we were increasing Fast Wake sync pulse length to fix problems observed on Dell Precision 5490 laptop with AUO panel. Later we have observed this is causing problems on other panels. Fix these problems by increasing Fast Wake sync pulse length as a quirk applied for Dell Precision 5490 with problematic panel. Fixes: f77772866385 ("drm/i915/display: Increase number of fast wake precharge pulses") Cc: Ville Syrjälä Closes: http://gitlab.freedesktop.org/drm/i915/kernel/-/issues/9739 Closes: https://gitlab.freedesktop.org/drm/xe/kernel/-/issues/2246 Closes: https://gitlab.freedesktop.org/drm/i915/kernel/-/issues/11762 Signed-off-by: Jouni Högander Reviewed-by: Jani Nikula Cc: # v6.10+ Link: https://patchwork.freedesktop.org/patch/msgid/20240902064241.1020965-3-jouni.hogander@intel.com (cherry picked from commit fcba2ed66b39252210f4e739722ebcc5398c2197) Requires: 43cf50eb1408 ("drm/i915/display: Add mechanism to use sink model when applying quirk") Signed-off-by: Joonas Lahtinen drivers/gpu/drm/i915/display/intel_alpm.c | 2 +- drivers/gpu/drm/i915/display/intel_dp_aux.c | 16 +++++++++++----- drivers/gpu/drm/i915/display/intel_dp_aux.h | 2 +- drivers/gpu/drm/i915/display/intel_quirks.c | 19 ++++++++++++++++++- drivers/gpu/drm/i915/display/intel_quirks.h | 1 + 5 files changed, 32 insertions(+), 8 deletions(-) commit 43cf50eb1408ccb99cab01521263e8cb4cfdc023 Author: Jouni Högander Date: Mon Sep 2 09:42:40 2024 +0300 drm/i915/display: Add mechanism to use sink model when applying quirk Currently there is no way to apply quirk on device only if certain panel model is installed. This patch implements such mechanism by adding new quirk type intel_dpcd_quirk which contains also sink_oui and sink_device_id fields and using also them to figure out if applying quirk is needed. New intel_init_dpcd_quirks is added and called after drm_dp_read_desc with proper sink device identity read from dpcdc. v3: - !mem_is_zero fixed to mem_is_zero v2: - instead of using struct intel_quirk add new struct intel_dpcd_quirk Signed-off-by: Jouni Högander Reviewed-by: Jani Nikula Link: https://patchwork.freedesktop.org/patch/msgid/20240902064241.1020965-2-jouni.hogander@intel.com (cherry picked from commit b3b91369908ac63be6f64905448b8ba5cd151875) Signed-off-by: Joonas Lahtinen drivers/gpu/drm/i915/display/intel_display_types.h | 4 ++ drivers/gpu/drm/i915/display/intel_dp.c | 4 ++ drivers/gpu/drm/i915/display/intel_quirks.c | 51 ++++++++++++++++++++++ drivers/gpu/drm/i915/display/intel_quirks.h | 5 +++ 4 files changed, 64 insertions(+) commit 5517ae241919e0208b077c910b0a369b9dce3c11 Merge: 646f49684622 1e9683c9b6ca Author: Jakub Kicinski Date: Mon Sep 2 19:08:51 2024 -0700 Merge tag 'for-net-2024-08-30' of git://git.kernel.org/pub/scm/linux/kernel/git/bluetooth/bluetooth Luiz Augusto von Dentz says: ==================== bluetooth pull request for net: - qca: If memdump doesn't work, re-enable IBS - MGMT: Fix not generating command complete for MGMT_OP_DISCONNECT - Revert "Bluetooth: MGMT/SMP: Fix address type when using SMP over BREDR/LE" - MGMT: Ignore keys being loaded with invalid type * tag 'for-net-2024-08-30' of git://git.kernel.org/pub/scm/linux/kernel/git/bluetooth/bluetooth: Bluetooth: MGMT: Ignore keys being loaded with invalid type Revert "Bluetooth: MGMT/SMP: Fix address type when using SMP over BREDR/LE" Bluetooth: MGMT: Fix not generating command complete for MGMT_OP_DISCONNECT Bluetooth: hci_sync: Introduce hci_cmd_sync_run/hci_cmd_sync_run_once Bluetooth: qca: If memdump doesn't work, re-enable IBS ==================== Link: https://patch.msgid.link/20240830220300.1316772-1-luiz.dentz@gmail.com Signed-off-by: Jakub Kicinski commit 646f49684622d0eb87bbbff4313a453421dc4e3d Merge: ef4a99a0164e dd885d90c047 Author: Jakub Kicinski Date: Mon Sep 2 19:06:05 2024 -0700 Merge tag 'linux-can-fixes-for-6.11-20240830' of git://git.kernel.org/pub/scm/linux/kernel/git/mkl/linux-can Marc Kleine-Budde says: ==================== pull-request: can 2024-08-30 The first patch is by Kuniyuki Iwashima for the CAN BCM protocol that adds a missing proc entry removal when a device unregistered. Simon Horman fixes the cleanup in the error cleanup path of the m_can driver's open function. Markus Schneider-Pargmann contributes 7 fixes for the m_can driver, all related to the recently added IRQ coalescing support. The next 2 patches are by me, target the mcp251xfd driver and fix ring and coalescing configuration problems when switching from CAN-CC to CAN-FD mode. Simon Arlott's patch fixes a possible deadlock in the mcp251x driver. The last patch is by Martin Jocic for the kvaser_pciefd driver and fixes a problem with lost IRQs, which result in starvation, under high load situations. * tag 'linux-can-fixes-for-6.11-20240830' of git://git.kernel.org/pub/scm/linux/kernel/git/mkl/linux-can: can: kvaser_pciefd: Use a single write when releasing RX buffers can: mcp251x: fix deadlock if an interrupt occurs during mcp251x_open can: mcp251xfd: mcp251xfd_ring_init(): check TX-coalescing configuration can: mcp251xfd: fix ring configuration when switching from CAN-CC to CAN-FD mode can: m_can: Limit coalescing to peripheral instances can: m_can: Reset cached active_interrupts on start can: m_can: disable_all_interrupts, not clear active_interrupts can: m_can: Do not cancel timer from within timer can: m_can: Remove m_can_rx_peripheral indirection can: m_can: Remove coalesing disable in isr during suspend can: m_can: Reset coalescing during suspend/resume can: m_can: Release irq on error in m_can_open can: bcm: Remove proc entry when dev is unregistered. ==================== Link: https://patch.msgid.link/20240830215914.1610393-1-mkl@pengutronix.de Signed-off-by: Jakub Kicinski commit 7ccc1465465d78e6411b7bd730d06e7435802b5c Author: Paulo Alcantara Date: Sat Aug 31 21:40:28 2024 -0300 smb: client: fix hang in wait_for_response() for negproto Call cifs_reconnect() to wake up processes waiting on negotiate protocol to handle the case where server abruptly shut down and had no chance to properly close the socket. Simple reproducer: ssh 192.168.2.100 pkill -STOP smbd mount.cifs //192.168.2.100/test /mnt -o ... [never returns] Cc: Rickard Andersson Signed-off-by: Paulo Alcantara (Red Hat) Signed-off-by: Steve French fs/smb/client/connect.c | 14 +++++++++++++- 1 file changed, 13 insertions(+), 1 deletion(-) commit b1934cd6069538db2255dc94ba573771ecf3b560 Author: Naohiro Aota Date: Sat Aug 31 01:32:49 2024 +0900 btrfs: zoned: handle broken write pointer on zones Btrfs rejects to mount a FS if it finds a block group with a broken write pointer (e.g, unequal write pointers on two zones of RAID1 block group). Since such case can happen easily with a power-loss or crash of a system, we need to handle the case more gently. Handle such block group by making it unallocatable, so that there will be no writes into it. That can be done by setting the allocation pointer at the end of allocating region (= block_group->zone_capacity). Then, existing code handle zone_unusable properly. Having proper zone_capacity is necessary for the change. So, set it as fast as possible. We cannot handle RAID0 and RAID10 case like this. But, they are anyway unable to read because of a missing stripe. Fixes: 265f7237dd25 ("btrfs: zoned: allow DUP on meta-data block groups") Fixes: 568220fa9657 ("btrfs: zoned: support RAID0/1/10 on top of raid stripe tree") CC: stable@vger.kernel.org # 6.1+ Reported-by: HAN Yuwei Cc: Xuefer Signed-off-by: Naohiro Aota Signed-off-by: David Sterba fs/btrfs/zoned.c | 30 +++++++++++++++++++++++++----- 1 file changed, 25 insertions(+), 5 deletions(-) commit e162cb25c410afc42051a582c46a47dde597f51c Author: Arnaldo Carvalho de Melo Date: Mon Aug 19 21:43:01 2024 -0300 perf daemon: Fix the build on more 32-bit architectures FYI: I'm carrying this on perf-tools-next. The previous attempt fixed the build on debian:experimental-x-mipsel, but when building on a larger set of containers I noticed it broke the build on some other 32-bit architectures such as: 42 7.87 ubuntu:18.04-x-arm : FAIL gcc version 7.5.0 (Ubuntu/Linaro 7.5.0-3ubuntu1~18.04) builtin-daemon.c: In function 'cmd_session_list': builtin-daemon.c:692:16: error: format '%llu' expects argument of type 'long long unsigned int', but argument 4 has type 'long int' [-Werror=format=] fprintf(out, "%c%" PRIu64, ^~~~~ builtin-daemon.c:694:13: csv_sep, (curr - daemon->start) / 60); ~~~~~~~~~~~~~~~~~~~~~~~~~~~ In file included from builtin-daemon.c:3:0: /usr/arm-linux-gnueabihf/include/inttypes.h:105:34: note: format string is defined here # define PRIu64 __PRI64_PREFIX "u" So lets cast that time_t (32-bit/64-bit) to uint64_t to make sure it builds everywhere. Fixes: 4bbe6002931954bb ("perf daemon: Fix the build on 32-bit architectures") Signed-off-by: Arnaldo Carvalho de Melo Link: https://lore.kernel.org/r/ZsPmldtJ0D9Cua9_@x1 Signed-off-by: Namhyung Kim tools/perf/builtin-daemon.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) commit aee1d55922977bf9282398283a72d38fc5514540 Author: Xu Yang Date: Mon Aug 19 10:34:03 2024 +0800 perf python: include "util/sample.h" The 32-bit arm build system will complain: tools/perf/util/python.c:75:28: error: field ‘sample’ has incomplete type 75 | struct perf_sample sample; However, arm64 build system doesn't complain this. The root cause is arm64 define "HAVE_KVM_STAT_SUPPORT := 1" in tools/perf/arch/arm64/Makefile, but arm arch doesn't define this. This will lead to kvm-stat.h include other header files on arm64 build system, especially "util/sample.h" for util/python.c. This will try to directly include "util/sample.h" for "util/python.c" to avoid such build issue on arm platform. Signed-off-by: Xu Yang Cc: imx@lists.linux.dev Link: https://lore.kernel.org/r/20240819023403.201324-1-xu.yang_2@nxp.com Signed-off-by: Namhyung Kim tools/perf/util/python.c | 1 + 1 file changed, 1 insertion(+) commit 287bd5cf06e0f2c02293ce942777ad1f18059ed3 Author: Namhyung Kim Date: Tue Aug 27 22:29:53 2024 -0700 perf lock contention: Fix spinlock and rwlock accounting The spinlock and rwlock use a single-element per-cpu array to track current locks due to performance reason. But this means the key is always available and it cannot simply account lock stats in the array because some of them are invalid. In fact, the contention_end() program in the BPF invalidates the entry by setting the 'lock' value to 0 instead of deleting the entry for the hashmap. So it should skip entries with the lock value of 0 in the account_end_timestamp(). Otherwise, it'd have spurious high contention on an idle machine: $ sudo perf lock con -ab -Y spinlock sleep 3 contended total wait max wait avg wait type caller 8 4.72 s 1.84 s 590.46 ms spinlock rcu_core+0xc7 8 1.87 s 1.87 s 233.48 ms spinlock process_one_work+0x1b5 2 1.87 s 1.87 s 933.92 ms spinlock worker_thread+0x1a2 3 1.81 s 1.81 s 603.93 ms spinlock tmigr_update_events+0x13c 2 1.72 s 1.72 s 861.98 ms spinlock tick_do_update_jiffies64+0x25 6 42.48 us 13.02 us 7.08 us spinlock futex_q_lock+0x2a 1 13.03 us 13.03 us 13.03 us spinlock futex_wake+0xce 1 11.61 us 11.61 us 11.61 us spinlock rcu_core+0xc7 I don't believe it has contention on a spinlock longer than 1 second. After this change, it only reports some small contentions. $ sudo perf lock con -ab -Y spinlock sleep 3 contended total wait max wait avg wait type caller 4 133.51 us 43.29 us 33.38 us spinlock tick_do_update_jiffies64+0x25 4 69.06 us 31.82 us 17.27 us spinlock process_one_work+0x1b5 2 50.66 us 25.77 us 25.33 us spinlock rcu_core+0xc7 1 28.45 us 28.45 us 28.45 us spinlock rcu_core+0xc7 1 24.77 us 24.77 us 24.77 us spinlock tmigr_update_events+0x13c 1 23.34 us 23.34 us 23.34 us spinlock raw_spin_rq_lock_nested+0x15 Fixes: b5711042a1c8 ("perf lock contention: Use per-cpu array map for spinlocks") Reported-by: Xi Wang Cc: Song Liu Cc: bpf@vger.kernel.org Link: https://lore.kernel.org/r/20240828052953.1445862-1-namhyung@kernel.org Signed-off-by: Namhyung Kim tools/perf/util/bpf_lock_contention.c | 3 +++ 1 file changed, 3 insertions(+) commit 1c7fb536e899a2f66f9b1719a0234570dda2e634 Author: Veronika Molnarova Date: Thu Aug 8 12:37:49 2024 +0200 perf test pmu: Set uninitialized PMU alias to null Commit 3e0bf9fde2984469 ("perf pmu: Restore full PMU name wildcard support") adds a test case "PMU cmdline match" that covers PMU name wildcard support provided by function perf_pmu__match(). The test works with a wide range of supported combinations of PMU name matching but omits the case that if the perf_pmu__match() cannot match the PMU name to the wildcard, it tries to match its alias. However, this variable is not set up, causing the test case to fail when run with subprocesses or to segfault if run as a single process. ./perf test -vv 9 9: Sysfs PMU tests : 9.1: Parsing with PMU format directory : Ok 9.2: Parsing with PMU event : Ok 9.3: PMU event names : Ok 9.4: PMU name combining : Ok 9.5: PMU name comparison : Ok 9.6: PMU cmdline match : FAILED! ./perf test -F 9 9.1: Parsing with PMU format directory : Ok 9.2: Parsing with PMU event : Ok 9.3: PMU event names : Ok 9.4: PMU name combining : Ok 9.5: PMU name comparison : Ok Segmentation fault (core dumped) Initialize the PMU alias to null for all tests of perf_pmu__match() as this functionality is not being tested and the alias matching works exactly the same as the matching of the PMU name. ./perf test -F 9 9.1: Parsing with PMU format directory : Ok 9.2: Parsing with PMU event : Ok 9.3: PMU event names : Ok 9.4: PMU name combining : Ok 9.5: PMU name comparison : Ok 9.6: PMU cmdline match : Ok Fixes: 3e0bf9fde2984469 ("perf pmu: Restore full PMU name wildcard support") Signed-off-by: Veronika Molnarova Cc: james.clark@arm.com Cc: mpetlan@redhat.com Cc: rstoyano@redhat.com Link: https://lore.kernel.org/r/20240808103749.9356-1-vmolnaro@redhat.com Signed-off-by: Namhyung Kim tools/perf/tests/pmu.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) commit c346c629765ab982967017e2ae859156d0e235cf Author: Fedor Pchelkin Date: Wed Aug 28 19:14:11 2024 +0300 btrfs: qgroup: don't use extent changeset when not needed The local extent changeset is passed to clear_record_extent_bits() where it may have some additional memory dynamically allocated for ulist. When qgroup is disabled, the memory is leaked because in this case the changeset is not released upon __btrfs_qgroup_release_data() return. Since the recorded contents of the changeset are not used thereafter, just don't pass it. Found by Linux Verification Center (linuxtesting.org) with Syzkaller. Reported-by: syzbot+81670362c283f3dd889c@syzkaller.appspotmail.com Closes: https://lore.kernel.org/lkml/000000000000aa8c0c060ade165e@google.com Fixes: af0e2aab3b70 ("btrfs: qgroup: flush reservations during quota disable") CC: stable@vger.kernel.org # 6.10+ Reviewed-by: Boris Burkov Reviewed-by: Qu Wenruo Signed-off-by: Fedor Pchelkin Signed-off-by: David Sterba fs/btrfs/qgroup.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) commit 38e3285dbd07db44487bbaca8c383a5d7f3c11f3 Author: Dillon Varone Date: Thu Aug 22 17:52:57 2024 -0400 drm/amd/display: Block timing sync for different signals in PMO PMO assumes that like timings can be synchronized, but DC only allows this if the signal types match. Reviewed-by: Austin Zheng Signed-off-by: Dillon Varone Signed-off-by: Hamza Mahfooz Signed-off-by: Alex Deucher (cherry picked from commit 29d3d6af43135de7bec677f334292ca8dab53d67) Cc: stable@vger.kernel.org .../drm/amd/display/dc/dml2/dml21/src/dml2_pmo/dml2_pmo_dcn4_fams2.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) commit 53c3685f5307967a62517ace10e69d66520d0fc5 Author: Leo Li Date: Tue Aug 20 14:34:15 2024 -0400 drm/amd/display: Lock DC and exit IPS when changing backlight Backlight updates require aux and/or register access. Therefore, driver needs to disallow IPS beforehand. So, acquire the dc lock before calling into dc to update backlight - we should be doing this regardless of IPS. Then, while the lock is held, disallow IPS before calling into dc, then allow IPS afterwards (if it was previously allowed). Reviewed-by: Aurabindo Pillai Reviewed-by: Roman Li Signed-off-by: Leo Li Signed-off-by: Hamza Mahfooz Signed-off-by: Alex Deucher (cherry picked from commit 988fe2862635c1b1b40e41c85c24db44ab337c13) Cc: stable@vger.kernel.org # 6.10+ drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c | 13 ++++++++++++- 1 file changed, 12 insertions(+), 1 deletion(-) commit 4de34b04783628f14614badb0a1aa67ce3fcef5d Author: Alex Deucher Date: Tue Mar 26 11:28:29 2024 -0400 drm/amdgpu: always allocate cleared VRAM for GEM allocations This adds allocation latency, but aligns better with user expectations. The latency should improve with the drm buddy clearing patches that Arun has been working on. In addition this fixes the high CPU spikes seen when doing wipe on release. v2: always set AMDGPU_GEM_CREATE_VRAM_CLEARED (Christian) Closes: https://gitlab.freedesktop.org/drm/amd/-/issues/3528 Fixes: a68c7eaa7a8f ("drm/amdgpu: Enable clear page functionality") Acked-by: Arunpravin Paneer Selvam Reviewed-by: Michel Dänzer (v1) Signed-off-by: Alex Deucher Cc: Arunpravin Paneer Selvam Cc: Christian König (cherry picked from commit 6c0a7c3c693ac84f8b50269a9088af8f37446863) Cc: stable@vger.kernel.org # 6.10.x drivers/gpu/drm/amd/amdgpu/amdgpu_gem.c | 3 +++ 1 file changed, 3 insertions(+) commit 34c36a77f431b67803c68786fe41a05d007a9306 Author: Jack Xiao Date: Thu Aug 22 18:18:51 2024 +0800 drm/amdgpu/mes: add mes mapping legacy queue switch For mes11 old firmware has issue to map legacy queue, add a flag to switch mes to map legacy queue. Fixes: f9d8c5c7855d ("drm/amdgpu/gfx: enable mes to map legacy queue support") Reported-by: Andrew Worsley Link: https://lists.freedesktop.org/archives/amd-gfx/2024-August/112773.html Signed-off-by: Jack Xiao Reviewed-by: Alex Deucher Signed-off-by: Alex Deucher (cherry picked from commit 52491d97aadcde543986d596ed55f70bf2142851) drivers/gpu/drm/amd/amdgpu/amdgpu_gfx.c | 4 +-- drivers/gpu/drm/amd/amdgpu/amdgpu_mes.h | 1 + drivers/gpu/drm/amd/amdgpu/mes_v11_0.c | 49 +++++++++++++++++++++++---------- drivers/gpu/drm/amd/amdgpu/mes_v12_0.c | 9 ++++-- 4 files changed, 43 insertions(+), 20 deletions(-) commit 65444581a4aecf0e96b4691bb20fc75c602f5863 Author: Leo Li Date: Tue Aug 27 11:29:53 2024 -0400 drm/amd/display: Determine IPS mode by ASIC and PMFW versions [Why] DCN IPS interoperates with other system idle power features, such as Zstates. On DCN35, there is a known issue where system Z8 + DCN IPS2 causes a hard hang. We observe this on systems where the SBIOS allows Z8. Though there is a SBIOS fix, there's no guarantee that users will get it any time soon, or even install it. A workaround is needed to prevent this from rearing its head in the wild. [How] For DCN35, check the pmfw version to determine whether the SBIOS has the fix. If not, set IPS1+RCG as the deepest possible state in all cases except for s0ix and display off (DPMS). Otherwise, enable all IPS Signed-off-by: Leo Li Reviewed-by: Harry Wentland Signed-off-by: Alex Deucher (cherry picked from commit 28d43d0895896f84c038d906d244e0a95eb243ec) Cc: stable@vger.kernel.org drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c | 26 ++++++++++++++++++++++- 1 file changed, 25 insertions(+), 1 deletion(-) commit 2f833e8948d6c88a3a257d4e426c9897b4907d5a Author: Baochen Qiang Date: Fri Aug 30 15:34:20 2024 +0800 Revert "wifi: ath11k: support hibernation" This reverts commit 166a490f59ac10340ee5330e51c15188ce2a7f8f. There are several reports that this commit breaks system suspend on some specific Lenovo platforms. Since there is no fix available, for now revert this commit to make suspend work again on those platforms. Closes: https://bugzilla.kernel.org/show_bug.cgi?id=219196 Closes: https://bugzilla.redhat.com/show_bug.cgi?id=2301921 Cc: # 6.10.x: d3e154d7776b: Revert "wifi: ath11k: restore country code during resume" Cc: # 6.10.x Signed-off-by: Baochen Qiang Acked-by: Jeff Johnson Signed-off-by: Kalle Valo Link: https://patch.msgid.link/20240830073420.5790-3-quic_bqiang@quicinc.com drivers/net/wireless/ath/ath11k/ahb.c | 4 +- drivers/net/wireless/ath/ath11k/core.c | 107 ++++++++++----------------------- drivers/net/wireless/ath/ath11k/core.h | 4 -- drivers/net/wireless/ath/ath11k/hif.h | 12 +--- drivers/net/wireless/ath/ath11k/mhi.c | 12 +--- drivers/net/wireless/ath/ath11k/mhi.h | 3 +- drivers/net/wireless/ath/ath11k/pci.c | 44 +++----------- drivers/net/wireless/ath/ath11k/qmi.c | 2 +- 8 files changed, 49 insertions(+), 139 deletions(-) commit d3e154d7776ba57ab679fb816fb87b627fba21c9 Author: Baochen Qiang Date: Fri Aug 30 15:34:19 2024 +0800 Revert "wifi: ath11k: restore country code during resume" This reverts commit 7f0343b7b8710436c1e6355c71782d32ada47e0c. We are going to revert commit 166a490f59ac ("wifi: ath11k: support hibernation"), on which this commit depends. With that commit reverted, this one is not needed any more, so revert this commit first. Signed-off-by: Baochen Qiang Acked-by: Jeff Johnson Signed-off-by: Kalle Valo Link: https://patch.msgid.link/20240830073420.5790-2-quic_bqiang@quicinc.com drivers/net/wireless/ath/ath11k/core.c | 10 ---------- 1 file changed, 10 deletions(-) commit d30d9ee94cc0e7ae91da7251d9c280b8cf7e5e4d Author: Tom Dohrmann Date: Mon Sep 2 14:42:19 2024 +0000 KVM: x86: Only advertise KVM_CAP_READONLY_MEM when supported by VM Until recently, KVM_CAP_READONLY_MEM was unconditionally supported on x86, but this is no longer the case for SEV-ES and SEV-SNP VMs. When KVM_CHECK_EXTENSION is invoked on a VM, only advertise KVM_CAP_READONLY_MEM when it's actually supported. Fixes: 66155de93bcf ("KVM: x86: Disallow read-only memslots for SEV-ES and SEV-SNP (and TDX)") Cc: Sean Christopherson Cc: Paolo Bonzini Cc: Michael Roth Signed-off-by: Tom Dohrmann Message-ID: <20240902144219.3716974-1-erbse.13@gmx.de> Signed-off-by: Paolo Bonzini arch/x86/kvm/x86.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) commit 1ae99594fb7a7e78de7b1adf0feb4f681937a28e Merge: 66155de93bcf 5fa9f0480c79 Author: Paolo Bonzini Date: Mon Sep 2 10:55:27 2024 -0400 Merge tag 'kvm-x86-fixes-6.11-rcN' of https://github.com/kvm-x86/linux into kvm-master KVM x86 fixes for 6.11 - Fixup missed comments from the REMOVED_SPTE=>FROZEN_SPTE rename. - Ensure a root is successfully loaded when pre-faulting SPTEs. - Grab kvm->srcu when handling KVM_SET_VCPU_EVENTS to guard against accessing memslots if toggling SMM happens to force a VM-Exit. - Emulate MSR_{FS,GS}_BASE on SVM even though interception is always disabled, so that KVM does the right thing if KVM's emulator encounters {RD,WR}MSR. - Explicitly clear BUS_LOCK_DETECT from KVM's caps on AMD, as KVM doesn't yet virtualize BUS_LOCK_DETECT on AMD. - Cleanup the help message for CONFIG_KVM_AMD_SEV, and call out that KVM now supports SEV-SNP too. commit a54da9df75cd1b4b5028f6c60f9a211532680585 Author: Armin Wolf Date: Sun Sep 1 05:10:51 2024 +0200 hwmon: (hp-wmi-sensors) Check if WMI event data exists The BIOS can choose to return no event data in response to a WMI event, so the ACPI object passed to the WMI notify handler can be NULL. Check for such a situation and ignore the event in such a case. Fixes: 23902f98f8d4 ("hwmon: add HP WMI Sensors driver") Signed-off-by: Armin Wolf Reviewed-by: Ilpo Järvinen Message-ID: <20240901031055.3030-2-W_Armin@gmx.de> Signed-off-by: Guenter Roeck drivers/hwmon/hp-wmi-sensors.c | 2 ++ 1 file changed, 2 insertions(+) commit a5135526426df5319d5f4bcd15ae57c45a97714b Author: Liao Chen Date: Mon Sep 2 11:58:48 2024 +0000 gpio: modepin: Enable module autoloading Add MODULE_DEVICE_TABLE(), so modules could be properly autoloaded based on the alias from of_device_id table. Fixes: 7687a5b0ee93 ("gpio: modepin: Add driver support for modepin GPIO controller") Signed-off-by: Liao Chen Reviewed-by: Michal Simek Link: https://lore.kernel.org/r/20240902115848.904227-1-liaochen4@huawei.com Signed-off-by: Bartosz Golaszewski drivers/gpio/gpio-zynqmp-modepin.c | 1 + 1 file changed, 1 insertion(+) commit ef4a99a0164e3972abb421cbb1b09ea6c61414df Author: Dan Carpenter Date: Thu Aug 29 22:22:45 2024 +0300 igc: Unlock on error in igc_io_resume() Call rtnl_unlock() on this error path, before returning. Fixes: bc23aa949aeb ("igc: Add pcie error handler support") Signed-off-by: Dan Carpenter Reviewed-by: Gerhard Engleder Signed-off-by: David S. Miller drivers/net/ethernet/intel/igc/igc_main.c | 1 + 1 file changed, 1 insertion(+) commit adad2e460e505a556f5ea6f0dc16fe95e62d5d76 Author: Krzysztof Kozlowski Date: Mon Aug 26 17:08:32 2024 +0200 gpio: rockchip: fix OF node leak in probe() Driver code is leaking OF node reference from of_get_parent() in probe(). Fixes: 936ee2675eee ("gpio/rockchip: add driver for rockchip gpio") Signed-off-by: Krzysztof Kozlowski Reviewed-by: Heiko Stuebner Reviewed-by: Shawn Lin Link: https://lore.kernel.org/r/20240826150832.65657-1-krzysztof.kozlowski@linaro.org Signed-off-by: Bartosz Golaszewski drivers/gpio/gpio-rockchip.c | 1 + 1 file changed, 1 insertion(+) commit 709df70a20e990d262c473ad9899314039e8ec82 Author: Liao Chen Date: Sat Aug 31 09:42:31 2024 +0000 spi: bcm63xx: Enable module autoloading Add MODULE_DEVICE_TABLE(), so modules could be properly autoloaded based on the alias from of_device_id table. Signed-off-by: Liao Chen Link: https://patch.msgid.link/20240831094231.795024-1-liaochen4@huawei.com Signed-off-by: Mark Brown drivers/spi/spi-bcm63xx.c | 1 + 1 file changed, 1 insertion(+) commit f99999536128b14b5d765a9982763b5134efdd79 Author: Andy Shevchenko Date: Thu Aug 29 18:58:38 2024 +0300 drm/i915/fence: Mark debug_fence_free() with __maybe_unused When debug_fence_free() is unused (CONFIG_DRM_I915_SW_FENCE_DEBUG_OBJECTS=n), it prevents kernel builds with clang, `make W=1` and CONFIG_WERROR=y: .../i915_sw_fence.c:118:20: error: unused function 'debug_fence_free' [-Werror,-Wunused-function] 118 | static inline void debug_fence_free(struct i915_sw_fence *fence) | ^~~~~~~~~~~~~~~~ Fix this by marking debug_fence_free() with __maybe_unused. See also commit 6863f5643dd7 ("kbuild: allow Clang to find unused static inline functions for W=1 build"). Fixes: fc1584059d6c ("drm/i915: Integrate i915_sw_fence with debugobjects") Signed-off-by: Andy Shevchenko Reviewed-by: Jani Nikula Link: https://patchwork.freedesktop.org/patch/msgid/20240829155950.1141978-3-andriy.shevchenko@linux.intel.com Signed-off-by: Jani Nikula (cherry picked from commit 8be4dce5ea6f2368cc25edc71989c4690fa66964) Signed-off-by: Joonas Lahtinen drivers/gpu/drm/i915/i915_sw_fence.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) commit fcd9e8afd546f6ced378d078345a89bf346d065e Author: Andy Shevchenko Date: Thu Aug 29 18:58:37 2024 +0300 drm/i915/fence: Mark debug_fence_init_onstack() with __maybe_unused When debug_fence_init_onstack() is unused (CONFIG_DRM_I915_SELFTEST=n), it prevents kernel builds with clang, `make W=1` and CONFIG_WERROR=y: .../i915_sw_fence.c:97:20: error: unused function 'debug_fence_init_onstack' [-Werror,-Wunused-function] 97 | static inline void debug_fence_init_onstack(struct i915_sw_fence *fence) | ^~~~~~~~~~~~~~~~~~~~~~~~ Fix this by marking debug_fence_init_onstack() with __maybe_unused. See also commit 6863f5643dd7 ("kbuild: allow Clang to find unused static inline functions for W=1 build"). Fixes: 214707fc2ce0 ("drm/i915/selftests: Wrap a timer into a i915_sw_fence") Signed-off-by: Andy Shevchenko Reviewed-by: Jani Nikula Link: https://patchwork.freedesktop.org/patch/msgid/20240829155950.1141978-2-andriy.shevchenko@linux.intel.com Signed-off-by: Jani Nikula (cherry picked from commit 5bf472058ffb43baf6a4cdfe1d7f58c4c194c688) Signed-off-by: Joonas Lahtinen drivers/gpu/drm/i915/i915_sw_fence.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) commit e8705632435ae2f2253b65d3786da389982e8813 Author: Ville Syrjälä Date: Wed Jul 10 15:41:37 2024 +0300 drm/i915: Fix readout degamma_lut mismatch on ilk/snb On ilk/snb the pipe may be configured to place the LUT before or after the CSC depending on various factors, but as there is only one LUT (no split mode like on IVB+) we only advertise a gamma_lut and no degamma_lut in the uapi to avoid confusing userspace. This can cause a problem during readout if the VBIOS/GOP enabled the LUT in the pre CSC configuration. The current code blindly assigns the results of the readout to the degamma_lut, which will cause a failure during the next atomic_check() as we aren't expecting anything to be in degamma_lut since it's not visible to userspace. Fix the problem by assigning whatever LUT we read out from the hardware into gamma_lut. Cc: stable@vger.kernel.org Fixes: d2559299d339 ("drm/i915: Make ilk_read_luts() capable of degamma readout") Closes: https://gitlab.freedesktop.org/drm/i915/kernel/-/issues/11608 Signed-off-by: Ville Syrjälä Link: https://patchwork.freedesktop.org/patch/msgid/20240710124137.16773-1-ville.syrjala@linux.intel.com Reviewed-by: Uma Shankar (cherry picked from commit 33eca84db6e31091cef63584158ab64704f78462) Signed-off-by: Joonas Lahtinen drivers/gpu/drm/i915/display/intel_modeset_setup.c | 31 ++++++++++++++++++---- 1 file changed, 26 insertions(+), 5 deletions(-) commit 59d3cfdd7f9655a0400ac453bf92199204f8b2a1 Author: Daniele Ceraolo Spurio Date: Tue Aug 20 14:59:52 2024 -0700 drm/i915: Do not attempt to load the GSC multiple times If the GSC FW fails to load the GSC HW hangs permanently; the only ways to recover it are FLR or D3cold entry, with the former only being supported on driver unload and the latter only on DGFX, for which we don't need to load the GSC. Therefore, if GSC fails to load there is no need to try again because the HW is stuck in the error state and the submission to load the FW would just hang the GSCCS. Note that, due to wa_14015076503, on MTL the GuC escalates all GSCCS hangs to full GT resets, which would trigger a new attempt to load the GSC FW in the post-reset HW re-init; this issue is also fixed by not attempting to load the GSC FW after an error. Fixes: 15bd4a67e914 ("drm/i915/gsc: GSC firmware loading") Signed-off-by: Daniele Ceraolo Spurio Cc: Daniele Ceraolo Spurio Cc: Alan Previn Cc: John Harrison Cc: Rodrigo Vivi Cc: # v6.3+ Reviewed-by: Jonathan Cavitt Link: https://patchwork.freedesktop.org/patch/msgid/20240820215952.2290807-1-daniele.ceraolospurio@intel.com (cherry picked from commit 03ded4d432a1fb7bb6c44c5856d14115f6f6c3b9) Signed-off-by: Joonas Lahtinen drivers/gpu/drm/i915/gt/uc/intel_gsc_uc.c | 2 +- drivers/gpu/drm/i915/gt/uc/intel_uc_fw.h | 5 +++++ 2 files changed, 6 insertions(+), 1 deletion(-) commit 342123d6913c62be17e5ca1bb325758c5fd0db34 Merge: 5916be8a53de 3d5c2f8e75a5 Author: Thomas Gleixner Date: Mon Sep 2 11:56:59 2024 +0200 Merge tag 'timers-v6.11-rc7' of https://git.linaro.org/people/daniel.lezcano/linux into timers/urgent Pull clocksource driver fixes from Daniel Lezcano: - Remove percpu irq related code in the timer-of initialization routine as it is broken but also unused (Daniel Lezcano) - Fix return -ETIME when delta exceeds INT_MAX and the next event not taking effect sometimes (Jacky Bai) Link: https://lore.kernel.org/all/d0e93dbd-b796-4726-b38c-089b685591c9@linaro.org commit a3c1e45156ad39f225cd7ddae0f81230a3b1e657 Author: Jens Emil Schulz Østergaard Date: Thu Aug 29 11:52:54 2024 +0200 net: microchip: vcap: Fix use-after-free error in kunit test This is a clear use-after-free error. We remove it, and rely on checking the return code of vcap_del_rule. Reported-by: Dan Carpenter Closes: https://lore.kernel.org/kernel-janitors/7bffefc6-219a-4f71-baa0-ad4526e5c198@kili.mountain/ Fixes: c956b9b318d9 ("net: microchip: sparx5: Adding KUNIT tests of key/action values in VCAP API") Signed-off-by: Jens Emil Schulz Østergaard Signed-off-by: David S. Miller drivers/net/ethernet/microchip/vcap/vcap_api_kunit.c | 14 ++------------ 1 file changed, 2 insertions(+), 12 deletions(-) commit 376174f5a49ac8701df15a68e9d3269c5b62abed Author: Wedson Almeida Filho Date: Wed Aug 28 18:11:17 2024 -0300 MAINTAINERS: Remove Wedson as Rust maintainer I am retiring from the project, so removing myself from MAINTAINERS as I won't have time to dedicate to it. Signed-off-by: Wedson Almeida Filho Link: https://lore.kernel.org/r/20240828211117.9422-2-wedsonaf@gmail.com Signed-off-by: Miguel Ojeda MAINTAINERS | 1 - 1 file changed, 1 deletion(-) commit 602cb14e310a7a32c4f27d1f16c4614c790c7f6f Author: Stephan Gerhold Date: Fri Aug 30 11:09:07 2024 +0200 pinctrl: qcom: x1e80100: Bypass PDC wakeup parent for now On X1E80100, GPIO interrupts for wakeup-capable pins have been broken since the introduction of the pinctrl driver. This prevents keyboard and touchpad from working on most of the X1E laptops. So far we have worked around this by manually building a kernel with the "wakeup-parent" removed from the pinctrl node in the device tree, but we cannot expect all users to do that. Implement a similar workaround in the driver by clearing the wakeirq_map for X1E80100. This avoids using the PDC wakeup parent for all GPIOs and handles the interrupts directly in the pinctrl driver instead. The PDC driver needs additional changes to support X1E80100 properly. Adding a workaround separately first allows to land the necessary PDC changes through the normal release cycle, while still solving the more critical problem with keyboard and touchpad on the current stable kernel versions. Bypassing the PDC is enough for now, because we have not yet enabled the deep idle states where using the PDC becomes necessary. Cc: stable@vger.kernel.org Fixes: 05e4941d97ef ("pinctrl: qcom: Add X1E80100 pinctrl driver") Signed-off-by: Stephan Gerhold Reviewed-by: Johan Hovold Tested-by: Johan Hovold Reviewed-by: Konrad Dybcio Reviewed-by: Abel Vesa Link: https://lore.kernel.org/20240830-x1e80100-bypass-pdc-v1-1-d4c00be0c3e3@linaro.org Signed-off-by: Linus Walleij drivers/pinctrl/qcom/pinctrl-x1e80100.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) commit 3f6b2f60b4631cd0c368da6a1587ab55a696164d Author: Matt Coster Date: Mon Sep 2 09:48:48 2024 +0100 drm/imagination: Free pvr_vm_gpuva after unlink This caused a measurable memory leak. Although the individual allocations are small, the leaks occurs in a high-usage codepath (remapping or unmapping device memory) so they add up quickly. Fixes: ff5f643de0bf ("drm/imagination: Add GEM and VM related code") Cc: stable@vger.kernel.org Reviewed-by: Frank Binns Link: https://patchwork.freedesktop.org/patch/msgid/35867394-d8ce-4698-a8fd-919a018f1583@imgtec.com Signed-off-by: Matt Coster drivers/gpu/drm/imagination/pvr_vm.c | 4 ++++ 1 file changed, 4 insertions(+) commit 3d5c2f8e75a55cfb11a85086c71996af0354a1fb Author: Jacky Bai Date: Thu Jul 25 15:33:55 2024 -0400 clocksource/drivers/imx-tpm: Fix next event not taking effect sometime The value written into the TPM CnV can only be updated into the hardware when the counter increases. Additional writes to the CnV write buffer are ignored until the register has been updated. Therefore, we need to check if the CnV has been updated before continuing. This may require waiting for 1 counter cycle in the worst case. Cc: stable@vger.kernel.org Fixes: 059ab7b82eec ("clocksource/drivers/imx-tpm: Add imx tpm timer support") Signed-off-by: Jacky Bai Reviewed-by: Peng Fan Reviewed-by: Ye Li Reviewed-by: Jason Liu Signed-off-by: Frank Li Link: https://lore.kernel.org/r/20240725193355.1436005-2-Frank.Li@nxp.com Signed-off-by: Daniel Lezcano drivers/clocksource/timer-imx-tpm.c | 8 ++++++++ 1 file changed, 8 insertions(+) commit 5b8843fcd49827813da80c0f590a17ae4ce93c5d Author: Jacky Bai Date: Thu Jul 25 15:33:54 2024 -0400 clocksource/drivers/imx-tpm: Fix return -ETIME when delta exceeds INT_MAX In tpm_set_next_event(delta), return -ETIME by wrong cast to int when delta is larger than INT_MAX. For example: tpm_set_next_event(delta = 0xffff_fffe) { ... next = tpm_read_counter(); // assume next is 0x10 next += delta; // next will 0xffff_fffe + 0x10 = 0x1_0000_000e now = tpm_read_counter(); // now is 0x10 ... return (int)(next - now) <= 0 ? -ETIME : 0; ^^^^^^^^^^ 0x1_0000_000e - 0x10 = 0xffff_fffe, which is -2 when cast to int. So return -ETIME. } To fix this, introduce a 'prev' variable and check if 'now - prev' is larger than delta. Cc: stable@vger.kernel.org Fixes: 059ab7b82eec ("clocksource/drivers/imx-tpm: Add imx tpm timer support") Signed-off-by: Jacky Bai Reviewed-by: Peng Fan Reviewed-by: Ye Li Reviewed-by: Jason Liu Signed-off-by: Frank Li Link: https://lore.kernel.org/r/20240725193355.1436005-1-Frank.Li@nxp.com Signed-off-by: Daniel Lezcano drivers/clocksource/timer-imx-tpm.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) commit 471ef0b5a8aaca4296108e756b970acfc499ede4 Author: Daniel Lezcano Date: Mon Aug 19 12:03:35 2024 +0200 clocksource/drivers/timer-of: Remove percpu irq related code GCC's named address space checks errors out with: drivers/clocksource/timer-of.c: In function ‘timer_of_irq_exit’: drivers/clocksource/timer-of.c:29:46: error: passing argument 2 of ‘free_percpu_irq’ from pointer to non-enclosed address space 29 | free_percpu_irq(of_irq->irq, clkevt); | ^~~~~~ In file included from drivers/clocksource/timer-of.c:8: ./include/linux/interrupt.h:201:43: note: expected ‘__seg_gs void *’ but argument is of type ‘struct clock_event_device *’ 201 | extern void free_percpu_irq(unsigned int, void __percpu *); | ^~~~~~~~~~~~~~~ drivers/clocksource/timer-of.c: In function ‘timer_of_irq_init’: drivers/clocksource/timer-of.c:74:51: error: passing argument 4 of ‘request_percpu_irq’ from pointer to non-enclosed address space 74 | np->full_name, clkevt) : | ^~~~~~ ./include/linux/interrupt.h:190:56: note: expected ‘__seg_gs void *’ but argument is of type ‘struct clock_event_device *’ 190 | const char *devname, void __percpu *percpu_dev_id) Sparse warns about: timer-of.c:29:46: warning: incorrect type in argument 2 (different address spaces) timer-of.c:29:46: expected void [noderef] __percpu * timer-of.c:29:46: got struct clock_event_device *clkevt timer-of.c:74:51: warning: incorrect type in argument 4 (different address spaces) timer-of.c:74:51: expected void [noderef] __percpu *percpu_dev_id timer-of.c:74:51: got struct clock_event_device *clkevt It appears the code is incorrect as reported by Uros Bizjak: "The referred code is questionable as it tries to reuse the clkevent pointer once as percpu pointer and once as generic pointer, which should be avoided." This change removes the percpu related code as no drivers is using it. [Daniel: Fixed the description] Fixes: dc11bae785295 ("clocksource/drivers: Add timer-of common init routine") Reported-by: Uros Bizjak Tested-by: Uros Bizjak Link: https://lore.kernel.org/r/20240819100335.2394751-1-daniel.lezcano@linaro.org Signed-off-by: Daniel Lezcano drivers/clocksource/timer-of.c | 17 ++++------------- drivers/clocksource/timer-of.h | 1 - 2 files changed, 4 insertions(+), 14 deletions(-) commit a5a3c952e82c1ada12bf8c55b73af26f1a454bd2 Author: Boqun Feng Date: Wed Aug 28 11:01:29 2024 -0700 rust: macros: provide correct provenance when constructing THIS_MODULE Currently while defining `THIS_MODULE` symbol in `module!()`, the pointer used to construct `ThisModule` is derived from an immutable reference of `__this_module`, which means the pointer doesn't have the provenance for writing, and that means any write to that pointer is UB regardless of data races or not. However, the usage of `THIS_MODULE` includes passing this pointer to functions that may write to it (probably in unsafe code), and this will create soundness issues. One way to fix this is using `addr_of_mut!()` but that requires the unstable feature "const_mut_refs". So instead of `addr_of_mut()!`, an extern static `Opaque` is used here: since `Opaque` is transparent to `T`, an extern static `Opaque` will just wrap the C symbol (defined in a C compile unit) in an `Opaque`, which provides a pointer with writable provenance via `Opaque::get()`. This fix the potential UBs because of pointer provenance unmatched. Reported-by: Alice Ryhl Signed-off-by: Boqun Feng Reviewed-by: Alice Ryhl Reviewed-by: Trevor Gross Reviewed-by: Benno Lossin Reviewed-by: Gary Guo Closes: https://rust-for-linux.zulipchat.com/#narrow/stream/x/topic/x/near/465412664 Fixes: 1fbde52bde73 ("rust: add `macros` crate") Cc: stable@vger.kernel.org # 6.6.x: be2ca1e03965: ("rust: types: Make Opaque::get const") Link: https://lore.kernel.org/r/20240828180129.4046355-1-boqun.feng@gmail.com [ Fixed two typos, reworded title. - Miguel ] Signed-off-by: Miguel Ojeda rust/macros/module.rs | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) commit 67784a74e258a467225f0e68335df77acd67b7ab Merge: c9f016e72b5c 284b75a3d83c Author: Linus Torvalds Date: Sun Sep 1 19:59:59 2024 -0700 Merge tag 'ata-6.11-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/libata/linux Pull ata fix from Damien Le Moal: - Fix a potential memory leak in the ata host initialization code (from Zheng) * tag 'ata-6.11-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/libata/linux: ata: libata: Fix memory leak for error path in ata_host_alloc() commit 052a45c1cb1b32f05dd63a295d65496d8b403283 Author: Suren Baghdasaryan Date: Wed Aug 28 16:15:36 2024 -0700 alloc_tag: fix allocation tag reporting when CONFIG_MODULES=n codetag_module_init() is used to initialize sections containing allocation tags. This function is used to initialize module sections as well as core kernel sections, in which case the module parameter is set to NULL. This function has to be called even when CONFIG_MODULES=n to initialize core kernel allocation tag sections. When CONFIG_MODULES=n, this function is a NOP, which is wrong. This leads to /proc/allocinfo reported as empty. Fix this by making it independent of CONFIG_MODULES. Link: https://lkml.kernel.org/r/20240828231536.1770519-1-surenb@google.com Fixes: 916cc5167cc6 ("lib: code tagging framework") Signed-off-by: Suren Baghdasaryan Cc: David Hildenbrand Cc: Kees Cook Cc: Kent Overstreet Cc: Pasha Tatashin Cc: Sourav Panda Cc: Vlastimil Babka Cc: [6.10+] Signed-off-by: Andrew Morton lib/codetag.c | 17 +++++++++++------ 1 file changed, 11 insertions(+), 6 deletions(-) commit 409faf8c97d5abb0597ea43e99c8b3dd8dbe99e3 Author: Adrian Huang Date: Thu Aug 29 21:06:33 2024 +0800 mm: vmalloc: optimize vmap_lazy_nr arithmetic when purging each vmap_area When running the vmalloc stress on a 448-core system, observe the average latency of purge_vmap_node() is about 2 seconds by using the eBPF/bcc 'funclatency.py' tool [1]. # /your-git-repo/bcc/tools/funclatency.py -u purge_vmap_node & pid1=$! && sleep 8 && modprobe test_vmalloc nr_threads=$(nproc) run_test_mask=0x7; kill -SIGINT $pid1 usecs : count distribution 0 -> 1 : 0 | | 2 -> 3 : 29 | | 4 -> 7 : 19 | | 8 -> 15 : 56 | | 16 -> 31 : 483 |**** | 32 -> 63 : 1548 |************ | 64 -> 127 : 2634 |********************* | 128 -> 255 : 2535 |********************* | 256 -> 511 : 1776 |************** | 512 -> 1023 : 1015 |******** | 1024 -> 2047 : 573 |**** | 2048 -> 4095 : 488 |**** | 4096 -> 8191 : 1091 |********* | 8192 -> 16383 : 3078 |************************* | 16384 -> 32767 : 4821 |****************************************| 32768 -> 65535 : 3318 |*************************** | 65536 -> 131071 : 1718 |************** | 131072 -> 262143 : 2220 |****************** | 262144 -> 524287 : 1147 |********* | 524288 -> 1048575 : 1179 |********* | 1048576 -> 2097151 : 822 |****** | 2097152 -> 4194303 : 906 |******* | 4194304 -> 8388607 : 2148 |***************** | 8388608 -> 16777215 : 4497 |************************************* | 16777216 -> 33554431 : 289 |** | avg = 2041714 usecs, total: 78381401772 usecs, count: 38390 The worst case is over 16-33 seconds, so soft lockup is triggered [2]. [Root Cause] 1) Each purge_list has the long list. The following shows the number of vmap_area is purged. crash> p vmap_nodes vmap_nodes = $27 = (struct vmap_node *) 0xff2de5a900100000 crash> vmap_node 0xff2de5a900100000 128 | grep nr_purged nr_purged = 663070 ... nr_purged = 821670 nr_purged = 692214 nr_purged = 726808 ... 2) atomic_long_sub() employs the 'lock' prefix to ensure the atomic operation when purging each vmap_area. However, the iteration is over 600000 vmap_area (See 'nr_purged' above). Here is objdump output: $ objdump -D vmlinux ffffffff813e8c80 : ... ffffffff813e8d70: f0 48 29 2d 68 0c bb lock sub %rbp,0x2bb0c68(%rip) ... Quote from "Instruction tables" pdf file [3]: Instructions with a LOCK prefix have a long latency that depends on cache organization and possibly RAM speed. If there are multiple processors or cores or direct memory access (DMA) devices, then all locked instructions will lock a cache line for exclusive access, which may involve RAM access. A LOCK prefix typically costs more than a hundred clock cycles, even on single-processor systems. That's why the latency of purge_vmap_node() dramatically increases on a many-core system: One core is busy on purging each vmap_area of the *long* purge_list and executing atomic_long_sub() for each vmap_area, while other cores free vmalloc allocations and execute atomic_long_add_return() in free_vmap_area_noflush(). [Solution] Employ a local variable to record the total purged pages, and execute atomic_long_sub() after the traversal of the purge_list is done. The experiment result shows the latency improvement is 99%. [Experiment Result] 1) System Configuration: Three servers (with HT-enabled) are tested. * 72-core server: 3rd Gen Intel Xeon Scalable Processor*1 * 192-core server: 5th Gen Intel Xeon Scalable Processor*2 * 448-core server: AMD Zen 4 Processor*2 2) Kernel Config * CONFIG_KASAN is disabled 3) The data in column "w/o patch" and "w/ patch" * Unit: micro seconds (us) * Each data is the average of 3-time measurements System w/o patch (us) w/ patch (us) Improvement (%) --------------- -------------- ------------- ------------- 72-core server 2194 14 99.36% 192-core server 143799 1139 99.21% 448-core server 1992122 6883 99.65% [1] https://github.com/iovisor/bcc/blob/master/tools/funclatency.py [2] https://gist.github.com/AdrianHuang/37c15f67b45407b83c2d32f918656c12 [3] https://www.agner.org/optimize/instruction_tables.pdf Link: https://lkml.kernel.org/r/20240829130633.2184-1-ahuang12@lenovo.com Signed-off-by: Adrian Huang Reviewed-by: Uladzislau Rezki (Sony) Cc: Christoph Hellwig Cc: Signed-off-by: Andrew Morton mm/vmalloc.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) commit 4f295229b279145bdc667c58f62e89f5968e12fb Author: Jan Kuliga Date: Fri Aug 30 11:56:58 2024 +0200 mailmap: update entry for Jan Kuliga Soon I won't be able to use my current email address. Link: https://lkml.kernel.org/r/20240830095658.1203198-1-jankul@alatek.krakow.pl Signed-off-by: Jan Kuliga Cc: David S. Miller Cc: Matthieu Baerts (NGI0) Signed-off-by: Andrew Morton .mailmap | 1 + 1 file changed, 1 insertion(+) commit 5e9784e997620af7c1399029282f5d6964b41942 Author: Hao Ge Date: Mon Aug 26 00:36:49 2024 +0800 codetag: debug: mark codetags for poisoned page as empty When PG_hwpoison pages are freed they are treated differently in free_pages_prepare() and instead of being released they are isolated. Page allocation tag counters are decremented at this point since the page is considered not in use. Later on when such pages are released by unpoison_memory(), the allocation tag counters will be decremented again and the following warning gets reported: [ 113.930443][ T3282] ------------[ cut here ]------------ [ 113.931105][ T3282] alloc_tag was not set [ 113.931576][ T3282] WARNING: CPU: 2 PID: 3282 at ./include/linux/alloc_tag.h:130 pgalloc_tag_sub.part.66+0x154/0x164 [ 113.932866][ T3282] Modules linked in: hwpoison_inject fuse ip6t_rpfilter ip6t_REJECT nf_reject_ipv6 ipt_REJECT nf_reject_ipv4 xt_conntrack ebtable_nat ebtable_broute ip6table_nat ip6table_man4 [ 113.941638][ T3282] CPU: 2 UID: 0 PID: 3282 Comm: madvise11 Kdump: loaded Tainted: G W 6.11.0-rc4-dirty #18 [ 113.943003][ T3282] Tainted: [W]=WARN [ 113.943453][ T3282] Hardware name: QEMU KVM Virtual Machine, BIOS unknown 2/2/2022 [ 113.944378][ T3282] pstate: 40400005 (nZcv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--) [ 113.945319][ T3282] pc : pgalloc_tag_sub.part.66+0x154/0x164 [ 113.946016][ T3282] lr : pgalloc_tag_sub.part.66+0x154/0x164 [ 113.946706][ T3282] sp : ffff800087093a10 [ 113.947197][ T3282] x29: ffff800087093a10 x28: ffff0000d7a9d400 x27: ffff80008249f0a0 [ 113.948165][ T3282] x26: 0000000000000000 x25: ffff80008249f2b0 x24: 0000000000000000 [ 113.949134][ T3282] x23: 0000000000000001 x22: 0000000000000001 x21: 0000000000000000 [ 113.950597][ T3282] x20: ffff0000c08fcad8 x19: ffff80008251e000 x18: ffffffffffffffff [ 113.952207][ T3282] x17: 0000000000000000 x16: 0000000000000000 x15: ffff800081746210 [ 113.953161][ T3282] x14: 0000000000000000 x13: 205d323832335420 x12: 5b5d353031313339 [ 113.954120][ T3282] x11: ffff800087093500 x10: 000000000000005d x9 : 00000000ffffffd0 [ 113.955078][ T3282] x8 : 7f7f7f7f7f7f7f7f x7 : ffff80008236ba90 x6 : c0000000ffff7fff [ 113.956036][ T3282] x5 : ffff000b34bf4dc8 x4 : ffff8000820aba90 x3 : 0000000000000001 [ 113.956994][ T3282] x2 : ffff800ab320f000 x1 : 841d1e35ac932e00 x0 : 0000000000000000 [ 113.957962][ T3282] Call trace: [ 113.958350][ T3282] pgalloc_tag_sub.part.66+0x154/0x164 [ 113.959000][ T3282] pgalloc_tag_sub+0x14/0x1c [ 113.959539][ T3282] free_unref_page+0xf4/0x4b8 [ 113.960096][ T3282] __folio_put+0xd4/0x120 [ 113.960614][ T3282] folio_put+0x24/0x50 [ 113.961103][ T3282] unpoison_memory+0x4f0/0x5b0 [ 113.961678][ T3282] hwpoison_unpoison+0x30/0x48 [hwpoison_inject] [ 113.962436][ T3282] simple_attr_write_xsigned.isra.34+0xec/0x1cc [ 113.963183][ T3282] simple_attr_write+0x38/0x48 [ 113.963750][ T3282] debugfs_attr_write+0x54/0x80 [ 113.964330][ T3282] full_proxy_write+0x68/0x98 [ 113.964880][ T3282] vfs_write+0xdc/0x4d0 [ 113.965372][ T3282] ksys_write+0x78/0x100 [ 113.965875][ T3282] __arm64_sys_write+0x24/0x30 [ 113.966440][ T3282] invoke_syscall+0x7c/0x104 [ 113.966984][ T3282] el0_svc_common.constprop.1+0x88/0x104 [ 113.967652][ T3282] do_el0_svc+0x2c/0x38 [ 113.968893][ T3282] el0_svc+0x3c/0x1b8 [ 113.969379][ T3282] el0t_64_sync_handler+0x98/0xbc [ 113.969980][ T3282] el0t_64_sync+0x19c/0x1a0 [ 113.970511][ T3282] ---[ end trace 0000000000000000 ]--- To fix this, clear the page tag reference after the page got isolated and accounted for. Link: https://lkml.kernel.org/r/20240825163649.33294-1-hao.ge@linux.dev Fixes: d224eb0287fb ("codetag: debug: mark codetags for reserved pages as empty") Signed-off-by: Hao Ge Reviewed-by: Miaohe Lin Acked-by: Suren Baghdasaryan Cc: David Hildenbrand Cc: Hao Ge Cc: Kent Overstreet Cc: Naoya Horiguchi Cc: Pasha Tatashin Cc: [6.10+] Signed-off-by: Andrew Morton mm/page_alloc.c | 7 +++++++ 1 file changed, 7 insertions(+) commit e399257349098bf7c84343f99efb2bc9c22eb9fd Author: Mike Yuan Date: Fri Aug 23 16:27:06 2024 +0000 mm/memcontrol: respect zswap.writeback setting from parent cg too Currently, the behavior of zswap.writeback wrt. the cgroup hierarchy seems a bit odd. Unlike zswap.max, it doesn't honor the value from parent cgroups. This surfaced when people tried to globally disable zswap writeback, i.e. reserve physical swap space only for hibernation [1] - disabling zswap.writeback only for the root cgroup results in subcgroups with zswap.writeback=1 still performing writeback. The inconsistency became more noticeable after I introduced the MemoryZSwapWriteback= systemd unit setting [2] for controlling the knob. The patch assumed that the kernel would enforce the value of parent cgroups. It could probably be workarounded from systemd's side, by going up the slice unit tree and inheriting the value. Yet I think it's more sensible to make it behave consistently with zswap.max and friends. [1] https://wiki.archlinux.org/title/Power_management/Suspend_and_hibernate#Disable_zswap_writeback_to_use_the_swap_space_only_for_hibernation [2] https://github.com/systemd/systemd/pull/31734 Link: https://lkml.kernel.org/r/20240823162506.12117-1-me@yhndnzj.com Fixes: 501a06fe8e4c ("zswap: memcontrol: implement zswap writeback disabling") Signed-off-by: Mike Yuan Reviewed-by: Nhat Pham Acked-by: Yosry Ahmed Cc: Johannes Weiner Cc: Michal Hocko Cc: Michal Koutný Cc: Muchun Song Cc: Roman Gushchin Cc: Shakeel Butt Cc: Signed-off-by: Andrew Morton Documentation/admin-guide/cgroup-v2.rst | 7 ++++--- mm/memcontrol.c | 12 +++++++++--- 2 files changed, 13 insertions(+), 6 deletions(-) commit a3f6a89c834a4cba0f881da21307b26de3796133 Author: Marc Zyngier Date: Fri Aug 23 17:38:50 2024 +0100 scripts: fix gfp-translate after ___GFP_*_BITS conversion to an enum Richard reports that since 772dd0342727c ("mm: enumerate all gfp flags"), gfp-translate is broken, as the bit numbers are implicit, leaving the shell script unable to extract them. Even more, some bits are now at a variable location, making it double extra hard to parse using a simple shell script. Use a brute-force approach to the problem by generating a small C stub that will use the enum to dump the interesting bits. As an added bonus, we are now able to identify invalid bits for a given configuration. As an added drawback, we cannot parse include files that predate this change anymore. Tough luck. Link: https://lkml.kernel.org/r/20240823163850.3791201-1-maz@kernel.org Fixes: 772dd0342727 ("mm: enumerate all gfp flags") Signed-off-by: Marc Zyngier Reported-by: Richard Weinberger Cc: Petr Tesařík Cc: Suren Baghdasaryan Signed-off-by: Andrew Morton scripts/gfp-translate | 66 ++++++++++++++++++++++++++++++++++++++------------- 1 file changed, 49 insertions(+), 17 deletions(-) commit bfe0857c20c663fcc1592fa4e3a61ca12b07dac9 Author: Usama Arif Date: Wed Aug 21 20:26:07 2024 +0100 Revert "mm: skip CMA pages when they are not available" This reverts commit 5da226dbfce3 ("mm: skip CMA pages when they are not available") and b7108d66318a ("Multi-gen LRU: skip CMA pages when they are not eligible"). lruvec->lru_lock is highly contended and is held when calling isolate_lru_folios. If the lru has a large number of CMA folios consecutively, while the allocation type requested is not MIGRATE_MOVABLE, isolate_lru_folios can hold the lock for a very long time while it skips those. For FIO workload, ~150million order=0 folios were skipped to isolate a few ZONE_DMA folios [1]. This can cause lockups [1] and high memory pressure for extended periods of time [2]. Remove skipping CMA for MGLRU as well, as it was introduced in sort_folio for the same resaon as 5da226dbfce3a2f44978c2c7cf88166e69a6788b. [1] https://lore.kernel.org/all/CAOUHufbkhMZYz20aM_3rHZ3OcK4m2puji2FGpUpn_-DevGk3Kg@mail.gmail.com/ [2] https://lore.kernel.org/all/ZrssOrcJIDy8hacI@gmail.com/ [usamaarif642@gmail.com: also revert b7108d66318a, per Johannes] Link: https://lkml.kernel.org/r/9060a32d-b2d7-48c0-8626-1db535653c54@gmail.com Link: https://lkml.kernel.org/r/357ac325-4c61-497a-92a3-bdbd230d5ec9@gmail.com Link: https://lkml.kernel.org/r/9060a32d-b2d7-48c0-8626-1db535653c54@gmail.com Fixes: 5da226dbfce3 ("mm: skip CMA pages when they are not available") Signed-off-by: Usama Arif Acked-by: Johannes Weiner Cc: Bharata B Rao Cc: Breno Leitao Cc: David Hildenbrand Cc: Matthew Wilcox Cc: Rik van Riel Cc: Vlastimil Babka Cc: Yu Zhao Cc: Zhaoyang Huang Cc: Zhaoyang Huang Cc: Signed-off-by: Andrew Morton mm/vmscan.c | 24 ++---------------------- 1 file changed, 2 insertions(+), 22 deletions(-) commit f806de88d8f7f8191afd0fd9b94db4cd058e7d4f Author: Liam R. Howlett Date: Tue Aug 20 13:54:17 2024 -0400 maple_tree: remove rcu_read_lock() from mt_validate() The write lock should be held when validating the tree to avoid updates racing with checks. Holding the rcu read lock during a large tree validation may also cause a prolonged rcu read window and "rcu_preempt detected stalls" warnings. Link: https://lore.kernel.org/all/0000000000001d12d4062005aea1@google.com/ Link: https://lkml.kernel.org/r/20240820175417.2782532-1-Liam.Howlett@oracle.com Fixes: 54a611b60590 ("Maple Tree: add new data structure") Signed-off-by: Liam R. Howlett Reported-by: syzbot+036af2f0c7338a33b0cd@syzkaller.appspotmail.com Cc: Hillf Danton Cc: Matthew Wilcox Cc: "Paul E. McKenney" Cc: Signed-off-by: Andrew Morton lib/maple_tree.c | 7 ++----- 1 file changed, 2 insertions(+), 5 deletions(-) commit 6dacd79d28842ff01f18b4900d897741aac5999e Author: Petr Tesarik Date: Mon Aug 5 17:07:50 2024 +0200 kexec_file: fix elfcorehdr digest exclusion when CONFIG_CRASH_HOTPLUG=y Fix the condition to exclude the elfcorehdr segment from the SHA digest calculation. The j iterator is an index into the output sha_regions[] array, not into the input image->segment[] array. Once it reaches image->elfcorehdr_index, all subsequent segments are excluded. Besides, if the purgatory segment precedes the elfcorehdr segment, the elfcorehdr may be wrongly included in the calculation. Link: https://lkml.kernel.org/r/20240805150750.170739-1-petr.tesarik@suse.com Fixes: f7cc804a9fd4 ("kexec: exclude elfcorehdr from the segment digest") Signed-off-by: Petr Tesarik Acked-by: Baoquan He Cc: Eric Biederman Cc: Hari Bathini Cc: Sourabh Jain Cc: Eric DeVolder Cc: Signed-off-by: Andrew Morton kernel/kexec_file.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit ab7ca09520e9c41c219a4427fe0dae24024bfe7f Author: Hao Ge Date: Fri Aug 16 09:33:36 2024 +0800 mm/slub: add check for s->flags in the alloc_tagging_slab_free_hook When enable CONFIG_MEMCG & CONFIG_KFENCE & CONFIG_KMEMLEAK, the following warning always occurs,This is because the following call stack occurred: mem_pool_alloc kmem_cache_alloc_noprof slab_alloc_node kfence_alloc Once the kfence allocation is successful,slab->obj_exts will not be empty, because it has already been assigned a value in kfence_init_pool. Since in the prepare_slab_obj_exts_hook function,we perform a check for s->flags & (SLAB_NO_OBJ_EXT | SLAB_NOLEAKTRACE),the alloc_tag_add function will not be called as a result.Therefore,ref->ct remains NULL. However,when we call mem_pool_free,since obj_ext is not empty, it eventually leads to the alloc_tag_sub scenario being invoked. This is where the warning occurs. So we should add corresponding checks in the alloc_tagging_slab_free_hook. For __GFP_NO_OBJ_EXT case,I didn't see the specific case where it's using kfence,so I won't add the corresponding check in alloc_tagging_slab_free_hook for now. [ 3.734349] ------------[ cut here ]------------ [ 3.734807] alloc_tag was not set [ 3.735129] WARNING: CPU: 4 PID: 40 at ./include/linux/alloc_tag.h:130 kmem_cache_free+0x444/0x574 [ 3.735866] Modules linked in: autofs4 [ 3.736211] CPU: 4 UID: 0 PID: 40 Comm: ksoftirqd/4 Tainted: G W 6.11.0-rc3-dirty #1 [ 3.736969] Tainted: [W]=WARN [ 3.737258] Hardware name: QEMU KVM Virtual Machine, BIOS unknown 2/2/2022 [ 3.737875] pstate: 60400005 (nZCv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--) [ 3.738501] pc : kmem_cache_free+0x444/0x574 [ 3.738951] lr : kmem_cache_free+0x444/0x574 [ 3.739361] sp : ffff80008357bb60 [ 3.739693] x29: ffff80008357bb70 x28: 0000000000000000 x27: 0000000000000000 [ 3.740338] x26: ffff80008207f000 x25: ffff000b2eb2fd60 x24: ffff0000c0005700 [ 3.740982] x23: ffff8000804229e4 x22: ffff800082080000 x21: ffff800081756000 [ 3.741630] x20: fffffd7ff8253360 x19: 00000000000000a8 x18: ffffffffffffffff [ 3.742274] x17: ffff800ab327f000 x16: ffff800083398000 x15: ffff800081756df0 [ 3.742919] x14: 0000000000000000 x13: 205d344320202020 x12: 5b5d373038343337 [ 3.743560] x11: ffff80008357b650 x10: 000000000000005d x9 : 00000000ffffffd0 [ 3.744231] x8 : 7f7f7f7f7f7f7f7f x7 : ffff80008237bad0 x6 : c0000000ffff7fff [ 3.744907] x5 : ffff80008237ba78 x4 : ffff8000820bbad0 x3 : 0000000000000001 [ 3.745580] x2 : 68d66547c09f7800 x1 : 68d66547c09f7800 x0 : 0000000000000000 [ 3.746255] Call trace: [ 3.746530] kmem_cache_free+0x444/0x574 [ 3.746931] mem_pool_free+0x44/0xf4 [ 3.747306] free_object_rcu+0xc8/0xdc [ 3.747693] rcu_do_batch+0x234/0x8a4 [ 3.748075] rcu_core+0x230/0x3e4 [ 3.748424] rcu_core_si+0x14/0x1c [ 3.748780] handle_softirqs+0x134/0x378 [ 3.749189] run_ksoftirqd+0x70/0x9c [ 3.749560] smpboot_thread_fn+0x148/0x22c [ 3.749978] kthread+0x10c/0x118 [ 3.750323] ret_from_fork+0x10/0x20 [ 3.750696] ---[ end trace 0000000000000000 ]--- Link: https://lkml.kernel.org/r/20240816013336.17505-1-hao.ge@linux.dev Fixes: 4b8736964640 ("mm/slab: add allocation accounting into slab allocation and free paths") Signed-off-by: Hao Ge Cc: Christoph Lameter Cc: David Rientjes Cc: Hyeonggon Yoo <42.hyeyoo@gmail.com> Cc: Joonsoo Kim Cc: Kees Cook Cc: Kent Overstreet Cc: Pekka Enberg Cc: Roman Gushchin Cc: Suren Baghdasaryan Cc: Vlastimil Babka Cc: Signed-off-by: Andrew Morton mm/slub.c | 4 ++++ 1 file changed, 4 insertions(+) commit 6576dd6695f2afca3f4954029ac4a64f82ba60ab Author: Ryusuke Konishi Date: Wed Aug 14 19:11:19 2024 +0900 nilfs2: fix state management in error path of log writing function After commit a694291a6211 ("nilfs2: separate wait function from nilfs_segctor_write") was applied, the log writing function nilfs_segctor_do_construct() was able to issue I/O requests continuously even if user data blocks were split into multiple logs across segments, but two potential flaws were introduced in its error handling. First, if nilfs_segctor_begin_construction() fails while creating the second or subsequent logs, the log writing function returns without calling nilfs_segctor_abort_construction(), so the writeback flag set on pages/folios will remain uncleared. This causes page cache operations to hang waiting for the writeback flag. For example, truncate_inode_pages_final(), which is called via nilfs_evict_inode() when an inode is evicted from memory, will hang. Second, the NILFS_I_COLLECTED flag set on normal inodes remain uncleared. As a result, if the next log write involves checkpoint creation, that's fine, but if a partial log write is performed that does not, inodes with NILFS_I_COLLECTED set are erroneously removed from the "sc_dirty_files" list, and their data and b-tree blocks may not be written to the device, corrupting the block mapping. Fix these issues by uniformly calling nilfs_segctor_abort_construction() on failure of each step in the loop in nilfs_segctor_do_construct(), having it clean up logs and segment usages according to progress, and correcting the conditions for calling nilfs_redirty_inodes() to ensure that the NILFS_I_COLLECTED flag is cleared. Link: https://lkml.kernel.org/r/20240814101119.4070-1-konishi.ryusuke@gmail.com Fixes: a694291a6211 ("nilfs2: separate wait function from nilfs_segctor_write") Signed-off-by: Ryusuke Konishi Tested-by: Ryusuke Konishi Cc: Signed-off-by: Andrew Morton fs/nilfs2/segment.c | 10 ++++++---- 1 file changed, 6 insertions(+), 4 deletions(-) commit 5787fcaab9eb5930f5378d6a1dd03d916d146622 Author: Ryusuke Konishi Date: Sat Aug 10 15:52:42 2024 +0900 nilfs2: fix missing cleanup on rollforward recovery error In an error injection test of a routine for mount-time recovery, KASAN found a use-after-free bug. It turned out that if data recovery was performed using partial logs created by dsync writes, but an error occurred before starting the log writer to create a recovered checkpoint, the inodes whose data had been recovered were left in the ns_dirty_files list of the nilfs object and were not freed. Fix this issue by cleaning up inodes that have read the recovery data if the recovery routine fails midway before the log writer starts. Link: https://lkml.kernel.org/r/20240810065242.3701-1-konishi.ryusuke@gmail.com Fixes: 0f3e1c7f23f8 ("nilfs2: recovery functions") Signed-off-by: Ryusuke Konishi Tested-by: Ryusuke Konishi Cc: Signed-off-by: Andrew Morton fs/nilfs2/recovery.c | 35 +++++++++++++++++++++++++++++++++-- 1 file changed, 33 insertions(+), 2 deletions(-) commit 683408258917541bdb294cd717c210a04381931e Author: Ryusuke Konishi Date: Sun Aug 11 19:03:20 2024 +0900 nilfs2: protect references to superblock parameters exposed in sysfs The superblock buffers of nilfs2 can not only be overwritten at runtime for modifications/repairs, but they are also regularly swapped, replaced during resizing, and even abandoned when degrading to one side due to backing device issues. So, accessing them requires mutual exclusion using the reader/writer semaphore "nilfs->ns_sem". Some sysfs attribute show methods read this superblock buffer without the necessary mutual exclusion, which can cause problems with pointer dereferencing and memory access, so fix it. Link: https://lkml.kernel.org/r/20240811100320.9913-1-konishi.ryusuke@gmail.com Fixes: da7141fb78db ("nilfs2: add /sys/fs/nilfs2/ group") Signed-off-by: Ryusuke Konishi Cc: Signed-off-by: Andrew Morton fs/nilfs2/sysfs.c | 43 +++++++++++++++++++++++++++++++++---------- 1 file changed, 33 insertions(+), 10 deletions(-) commit 4828d207dc5161dc7ddf9a4f6dcfd80c7dd7d20a Author: Jann Horn Date: Tue Aug 13 22:25:22 2024 +0200 userfaultfd: don't BUG_ON() if khugepaged yanks our page table Since khugepaged was changed to allow retracting page tables in file mappings without holding the mmap lock, these BUG_ON()s are wrong - get rid of them. We could also remove the preceding "if (unlikely(...))" block, but then we could reach pte_offset_map_lock() with transhuge pages not just for file mappings but also for anonymous mappings - which would probably be fine but I think is not necessarily expected. Link: https://lkml.kernel.org/r/20240813-uffd-thp-flip-fix-v2-2-5efa61078a41@google.com Fixes: 1d65b771bc08 ("mm/khugepaged: retract_page_tables() without mmap or vma lock") Signed-off-by: Jann Horn Reviewed-by: Qi Zheng Acked-by: David Hildenbrand Cc: Andrea Arcangeli Cc: Hugh Dickins Cc: Pavel Emelyanov Cc: Signed-off-by: Andrew Morton mm/userfaultfd.c | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) commit 71c186efc1b2cf1aeabfeff3b9bd5ac4c5ac14d8 Author: Jann Horn Date: Tue Aug 13 22:25:21 2024 +0200 userfaultfd: fix checks for huge PMDs Patch series "userfaultfd: fix races around pmd_trans_huge() check", v2. The pmd_trans_huge() code in mfill_atomic() is wrong in three different ways depending on kernel version: 1. The pmd_trans_huge() check is racy and can lead to a BUG_ON() (if you hit the right two race windows) - I've tested this in a kernel build with some extra mdelay() calls. See the commit message for a description of the race scenario. On older kernels (before 6.5), I think the same bug can even theoretically lead to accessing transhuge page contents as a page table if you hit the right 5 narrow race windows (I haven't tested this case). 2. As pointed out by Qi Zheng, pmd_trans_huge() is not sufficient for detecting PMDs that don't point to page tables. On older kernels (before 6.5), you'd just have to win a single fairly wide race to hit this. I've tested this on 6.1 stable by racing migration (with a mdelay() patched into try_to_migrate()) against UFFDIO_ZEROPAGE - on my x86 VM, that causes a kernel oops in ptlock_ptr(). 3. On newer kernels (>=6.5), for shmem mappings, khugepaged is allowed to yank page tables out from under us (though I haven't tested that), so I think the BUG_ON() checks in mfill_atomic() are just wrong. I decided to write two separate fixes for these (one fix for bugs 1+2, one fix for bug 3), so that the first fix can be backported to kernels affected by bugs 1+2. This patch (of 2): This fixes two issues. I discovered that the following race can occur: mfill_atomic other thread ============ ============ pmdp_get_lockless() [reads none pmd] __pte_alloc [no-op] BUG_ON(pmd_none(*dst_pmd)) I have experimentally verified this in a kernel with extra mdelay() calls; the BUG_ON(pmd_none(*dst_pmd)) triggers. On kernels newer than commit 0d940a9b270b ("mm/pgtable: allow pte_offset_map[_lock]() to fail"), this can't lead to anything worse than a BUG_ON(), since the page table access helpers are actually designed to deal with page tables concurrently disappearing; but on older kernels (<=6.4), I think we could probably theoretically race past the two BUG_ON() checks and end up treating a hugepage as a page table. The second issue is that, as Qi Zheng pointed out, there are other types of huge PMDs that pmd_trans_huge() can't catch: devmap PMDs and swap PMDs (in particular, migration PMDs). On <=6.4, this is worse than the first issue: If mfill_atomic() runs on a PMD that contains a migration entry (which just requires winning a single, fairly wide race), it will pass the PMD to pte_offset_map_lock(), which assumes that the PMD points to a page table. Breakage follows: First, the kernel tries to take the PTE lock (which will crash or maybe worse if there is no "struct page" for the address bits in the migration entry PMD - I think at least on X86 there usually is no corresponding "struct page" thanks to the PTE inversion mitigation, amd64 looks different). If that didn't crash, the kernel would next try to write a PTE into what it wrongly thinks is a page table. As part of fixing these issues, get rid of the check for pmd_trans_huge() before __pte_alloc() - that's redundant, we're going to have to check for that after the __pte_alloc() anyway. Backport note: pmdp_get_lockless() is pmd_read_atomic() in older kernels. Link: https://lkml.kernel.org/r/20240813-uffd-thp-flip-fix-v2-0-5efa61078a41@google.com Link: https://lkml.kernel.org/r/20240813-uffd-thp-flip-fix-v2-1-5efa61078a41@google.com Fixes: c1a4de99fada ("userfaultfd: mcopy_atomic|mfill_zeropage: UFFDIO_COPY|UFFDIO_ZEROPAGE preparation") Signed-off-by: Jann Horn Acked-by: David Hildenbrand Cc: Andrea Arcangeli Cc: Hugh Dickins Cc: Jann Horn Cc: Pavel Emelyanov Cc: Qi Zheng Cc: Signed-off-by: Andrew Morton mm/userfaultfd.c | 22 ++++++++++++---------- 1 file changed, 12 insertions(+), 10 deletions(-) commit 3e3de7947c751509027d26b679ecd243bc9db255 Author: Will Deacon Date: Mon Aug 12 18:16:06 2024 +0100 mm: vmalloc: ensure vmap_block is initialised before adding to queue Commit 8c61291fd850 ("mm: fix incorrect vbq reference in purge_fragmented_block") extended the 'vmap_block' structure to contain a 'cpu' field which is set at allocation time to the id of the initialising CPU. When a new 'vmap_block' is being instantiated by new_vmap_block(), the partially initialised structure is added to the local 'vmap_block_queue' xarray before the 'cpu' field has been initialised. If another CPU is concurrently walking the xarray (e.g. via vm_unmap_aliases()), then it may perform an out-of-bounds access to the remote queue thanks to an uninitialised index. This has been observed as UBSAN errors in Android: | Internal error: UBSAN: array index out of bounds: 00000000f2005512 [#1] PREEMPT SMP | | Call trace: | purge_fragmented_block+0x204/0x21c | _vm_unmap_aliases+0x170/0x378 | vm_unmap_aliases+0x1c/0x28 | change_memory_common+0x1dc/0x26c | set_memory_ro+0x18/0x24 | module_enable_ro+0x98/0x238 | do_init_module+0x1b0/0x310 Move the initialisation of 'vb->cpu' in new_vmap_block() ahead of the addition to the xarray. Link: https://lkml.kernel.org/r/20240812171606.17486-1-will@kernel.org Fixes: 8c61291fd850 ("mm: fix incorrect vbq reference in purge_fragmented_block") Signed-off-by: Will Deacon Reviewed-by: Baoquan He Reviewed-by: Uladzislau Rezki (Sony) Cc: Zhaoyang Huang Cc: Hailong.Liu Cc: Christoph Hellwig Cc: Lorenzo Stoakes Cc: Thomas Gleixner Cc: Signed-off-by: Andrew Morton mm/vmalloc.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit b808f629215685c1941b1cd567c7b7ccb3c90278 Author: Muhammad Usama Anjum Date: Fri Aug 9 13:25:11 2024 +0500 selftests: mm: fix build errors on armhf The __NR_mmap isn't found on armhf. The mmap() is commonly available system call and its wrapper is present on all architectures. So it should be used directly. It solves problem for armhf and doesn't create problem for other architectures. Remove sys_mmap() functions as they aren't doing anything else other than calling mmap(). There is no need to set errno = 0 manually as glibc always resets it. For reference errors are as following: CC seal_elf seal_elf.c: In function 'sys_mmap': seal_elf.c:39:33: error: '__NR_mmap' undeclared (first use in this function) 39 | sret = (void *) syscall(__NR_mmap, addr, len, prot, | ^~~~~~~~~ mseal_test.c: In function 'sys_mmap': mseal_test.c:90:33: error: '__NR_mmap' undeclared (first use in this function) 90 | sret = (void *) syscall(__NR_mmap, addr, len, prot, | ^~~~~~~~~ Link: https://lkml.kernel.org/r/20240809082511.497266-1-usama.anjum@collabora.com Fixes: 4926c7a52de7 ("selftest mm/mseal memory sealing") Signed-off-by: Muhammad Usama Anjum Cc: Jeff Xu Cc: Kees Cook Cc: Liam R. Howlett Cc: Shuah Khan Cc: Signed-off-by: Andrew Morton tools/testing/selftests/mm/mseal_test.c | 37 ++++++++++++--------------------- tools/testing/selftests/mm/seal_elf.c | 13 +----------- 2 files changed, 14 insertions(+), 36 deletions(-) commit c9f016e72b5cc7d4d68fac51f8e72c8c7a69c06e Merge: 3df9427f351a a547a5880cba Author: Linus Torvalds Date: Sun Sep 1 14:43:08 2024 -0700 Merge tag 'x86-urgent-2024-09-01' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull x86 fixes from Thomas Gleixner: - x2apic_disable() clears x2apic_state and x2apic_mode unconditionally, even when the state is X2APIC_ON_LOCKED, which prevents the kernel to disable it thereby creating inconsistent state. Reorder the logic so it actually works correctly - The XSTATE logic for handling LBR is incorrect as it assumes that XSAVES supports LBR when the CPU supports LBR. In fact both conditions need to be true. Otherwise the enablement of LBR in the IA32_XSS MSR fails and subsequently the machine crashes on the next XRSTORS operation because IA32_XSS is not initialized. Cache the XSTATE support bit during init and make the related functions use this cached information and the LBR CPU feature bit to cure this. - Cure a long standing bug in KASLR KASLR uses the full address space between PAGE_OFFSET and vaddr_end to randomize the starting points of the direct map, vmalloc and vmemmap regions. It thereby limits the size of the direct map by using the installed memory size plus an extra configurable margin for hot-plug memory. This limitation is done to gain more randomization space because otherwise only the holes between the direct map, vmalloc, vmemmap and vaddr_end would be usable for randomizing. The limited direct map size is not exposed to the rest of the kernel, so the memory hot-plug and resource management related code paths still operate under the assumption that the available address space can be determined with MAX_PHYSMEM_BITS. request_free_mem_region() allocates from (1 << MAX_PHYSMEM_BITS) - 1 downwards. That means the first allocation happens past the end of the direct map and if unlucky this address is in the vmalloc space, which causes high_memory to become greater than VMALLOC_START and consequently causes iounmap() to fail for valid ioremap addresses. Cure this by exposing the end of the direct map via PHYSMEM_END and use that for the memory hot-plug and resource management related places instead of relying on MAX_PHYSMEM_BITS. In the KASLR case PHYSMEM_END maps to a variable which is initialized by the KASLR initialization and otherwise it is based on MAX_PHYSMEM_BITS as before. - Prevent a data leak in mmio_read(). The TDVMCALL exposes the value of an initialized variabled on the stack to the VMM. The variable is only required as output value, so it does not have to exposed to the VMM in the first place. - Prevent an array overrun in the resource control code on systems with Sub-NUMA Clustering enabled because the code failed to adjust the index by the number of SNC nodes per L3 cache. * tag 'x86-urgent-2024-09-01' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: x86/resctrl: Fix arch_mbm_* array overrun on SNC x86/tdx: Fix data leak in mmio_read() x86/kaslr: Expose and use the end of the physical memory address space x86/fpu: Avoid writing LBR bit to IA32_XSS unless supported x86/apic: Make x2apic_disable() work correctly commit 3df9427f351a9cb8aee0eea13d185f0d78340a70 Merge: 51859c5aa6da 25dfc9e357af Author: Linus Torvalds Date: Sun Sep 1 14:33:31 2024 -0700 Merge tag 'perf-urgent-2024-09-01' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull perf fix from Thomas Gleixner: "A single fix for x86 performance monitoring. Haswell PMUs suffer from several errata and require a limit the minimal period for counter events, otherwise they suffer from endless loops in the PMU interrupt" * tag 'perf-urgent-2024-09-01' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: perf/x86/intel: Limit the period on Haswell commit 51859c5aa6daa96340a81a1ea2de1b48ccadccf1 Merge: 9a754292e88f d33d26036a02 Author: Linus Torvalds Date: Sun Sep 1 14:26:33 2024 -0700 Merge tag 'locking-urgent-2024-08-25' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull locking fix from Thomas Gleixner: "A single fix for rt_mutex. The deadlock detection code drops into an infinite scheduling loop while still holding rt_mutex::wait_lock, which rightfully triggers a 'scheduling in atomic' warning. Unlock it before that" * tag 'locking-urgent-2024-08-25' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: rtmutex: Drop rt_mutex::wait_lock before scheduling commit 9a754292e88f81acaf26cc5e0cec56b3276029de Merge: 431c1646e1f8 880799fc7a3a Author: Linus Torvalds Date: Sun Sep 1 14:19:00 2024 -0700 Merge tag 'irq-urgent-2024-08-25' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull irq fixes from Thomas Gleixner: "A set of fixes for interrupt chip drivers: - Unbreak the PLIC driver for Allwinner D1 systems The recent conversion of the PLIC driver to a platform driver broke Allwinnder D1 systems due to the deferred probing of platform drivers. Due to that the only timer available on D1 systems cannot get an interrupt, which causes the system to hang at boot. Other RISCV platforms are not affected because they provide the architected SBI timer which uses the built in core interrupt controller. Cure this by probing PLIC early on D1 systems - Cure a regression in ARM/GIC-V3 on 32-bit ARM systems caused by the recent addition of a initialization function, which accesses system registers before they are enabled. On 64-bit ARM they are enabled prior to that by sheer luck. Ensure they are enabled. - Cure a use before check problem in the MSI library. The existing NULL pointer check is too late. - Cure a lock order inversion in the ARM/GIC-V4 driver - Fix a IS_ERR() vs. NULL pointer check issue in the RISCV APLIC driver - Plug a reference count leak in the ARM/GIC-V2 driver" * tag 'irq-urgent-2024-08-25' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: irqchip/irq-msi-lib: Check for NULL ops in msi_lib_irq_domain_select() irqchip/gic-v3: Init SRE before poking sysregs irqchip/gic-v2m: Fix refcount leak in gicv2m_of_init() irqchip/riscv-aplic: Fix an IS_ERR() vs NULL bug in probe() irqchip/gic-v4: Fix ordering between vmapp and vpe locks irqchip/sifive-plic: Probe plic driver early for Allwinner D1 platform commit 7f12a963b65872fda1219f065c1cc1b1b9a806e8 Author: Kent Overstreet Date: Sun Sep 1 15:53:03 2024 -0400 bcachefs: fix rebalance accounting Fixes: 49aa7830396b ("bcachefs: Fix rebalance_work accounting") Signed-off-by: Kent Overstreet fs/bcachefs/buckets.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 9b0874286768d7f380b08e4f1fa9b96c526b0bad Merge: fe1910f9337b f962e8361adf Author: David S. Miller Date: Sun Sep 1 18:14:02 2024 +0100 Merge branch 'mctp-serial-tx-escapes' Matt Johnston says: ==================== net: mctp-serial: Fix for missing tx escapes The mctp-serial code to add escape characters was incorrect due to an off-by-one error. This series adds a test for the chunking which splits by escape characters, and fixes the bug. v2: Fix kunit param const pointer ==================== Signed-off-by: David S. Miller commit f962e8361adfa84e8252d3fc3e5e6bb879f029b1 Author: Matt Johnston Date: Thu Aug 29 15:43:46 2024 +0800 net: mctp-serial: Fix missing escapes on transmit 0x7d and 0x7e bytes are meant to be escaped in the data portion of frames, but this didn't occur since next_chunk_len() had an off-by-one error. That also resulted in the final byte of a payload being written as a separate tty write op. The chunk prior to an escaped byte would be one byte short, and the next call would never test the txpos+1 case, which is where the escaped byte was located. That meant it never hit the escaping case in mctp_serial_tx_work(). Example Input: 01 00 08 c8 7e 80 02 Previous incorrect chunks from next_chunk_len(): 01 00 08 c8 7e 80 02 With this fix: 01 00 08 c8 7e 80 02 Cc: stable@vger.kernel.org Fixes: a0c2ccd9b5ad ("mctp: Add MCTP-over-serial transport binding") Signed-off-by: Matt Johnston Signed-off-by: David S. Miller drivers/net/mctp/mctp-serial.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) commit 4fa9c5181cfe083d0beefb5157a643560e7bd152 Author: Matt Johnston Date: Thu Aug 29 15:43:45 2024 +0800 net: mctp-serial: Add kunit test for next_chunk_len() Test various edge cases of inputs that contain characters that need escaping. This adds a new kunit suite for mctp-serial. Signed-off-by: Matt Johnston Signed-off-by: David S. Miller drivers/net/mctp/Kconfig | 5 ++ drivers/net/mctp/mctp-serial.c | 109 +++++++++++++++++++++++++++++++++++++++++ 2 files changed, 114 insertions(+) commit 6a422a96bc84cf9b9f0ff741f293a1f9059e0883 Author: Pawel Dembicki Date: Fri Aug 30 13:13:50 2024 +0200 hwmon: ltc2991: fix register bits defines In the LTC2991, V5 and V6 channels use the low nibble of the "V5, V6, V7, and V8 Control Register" for configuration, but currently, the high nibble is defined. This patch changes the defines to use the low nibble. Fixes: 2b9ea4262ae9 ("hwmon: Add driver for ltc2991") Signed-off-by: Pawel Dembicki Message-ID: <20240830111349.30531-1-paweldembicki@gmail.com> Signed-off-by: Guenter Roeck drivers/hwmon/ltc2991.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) commit 72a6e22c604c95ddb3b10b5d3bb85b6ff4dbc34f Author: Baokun Li Date: Mon Aug 26 19:20:56 2024 +0800 fscache: delete fscache_cookie_lru_timer when fscache exits to avoid UAF The fscache_cookie_lru_timer is initialized when the fscache module is inserted, but is not deleted when the fscache module is removed. If timer_reduce() is called before removing the fscache module, the fscache_cookie_lru_timer will be added to the timer list of the current cpu. Afterwards, a use-after-free will be triggered in the softIRQ after removing the fscache module, as follows: ================================================================== BUG: unable to handle page fault for address: fffffbfff803c9e9 PF: supervisor read access in kernel mode PF: error_code(0x0000) - not-present page PGD 21ffea067 P4D 21ffea067 PUD 21ffe6067 PMD 110a7c067 PTE 0 Oops: Oops: 0000 [#1] PREEMPT SMP KASAN PTI CPU: 1 UID: 0 PID: 0 Comm: swapper/1 Tainted: G W 6.11.0-rc3 #855 Tainted: [W]=WARN RIP: 0010:__run_timer_base.part.0+0x254/0x8a0 Call Trace: tmigr_handle_remote_up+0x627/0x810 __walk_groups.isra.0+0x47/0x140 tmigr_handle_remote+0x1fa/0x2f0 handle_softirqs+0x180/0x590 irq_exit_rcu+0x84/0xb0 sysvec_apic_timer_interrupt+0x6e/0x90 asm_sysvec_apic_timer_interrupt+0x1a/0x20 RIP: 0010:default_idle+0xf/0x20 default_idle_call+0x38/0x60 do_idle+0x2b5/0x300 cpu_startup_entry+0x54/0x60 start_secondary+0x20d/0x280 common_startup_64+0x13e/0x148 Modules linked in: [last unloaded: netfs] ================================================================== Therefore delete fscache_cookie_lru_timer when removing the fscahe module. Fixes: 12bb21a29c19 ("fscache: Implement cookie user counting and resource pinning") Cc: stable@kernel.org Signed-off-by: Baokun Li Link: https://lore.kernel.org/r/20240826112056.2458299-1-libaokun@huaweicloud.com Acked-by: David Howells Signed-off-by: Christian Brauner fs/netfs/fscache_main.c | 1 + 1 file changed, 1 insertion(+) commit 431c1646e1f86b949fa3685efc50b660a364c2b6 Author: Linus Torvalds Date: Sun Sep 1 19:46:02 2024 +1200 Linux 6.11-rc6 Makefile | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 6b9ffc4595ab936b10834167037acb992ebac34a Merge: a4c763129fbc 91d1dfae4649 Author: Linus Torvalds Date: Sun Sep 1 15:49:26 2024 +1200 Merge tag 'v6.11-rc5-smb-client-fixes' of git://git.samba.org/sfrench/cifs-2.6 Pull smb client fixes from Steve French: - copy_file_range fix - two read fixes including read past end of file rc fix and read retry crediting fix - falloc zero range fix * tag 'v6.11-rc5-smb-client-fixes' of git://git.samba.org/sfrench/cifs-2.6: cifs: Fix FALLOC_FL_ZERO_RANGE to preflush buffered part of target region cifs: Fix copy offload to flush destination region netfs, cifs: Fix handling of short DIO read cifs: Fix lack of credit renegotiation on read retry commit a4c763129fbcc7da5d3134ea95f9577f25bc637d Merge: 6cd90e5ea72f 3d3020c46193 Author: Linus Torvalds Date: Sun Sep 1 15:23:20 2024 +1200 Merge tag 'bcachefs-2024-08-21' of https://github.com/koverstreet/bcachefs Push bcachefs fixes from Kent Overstreet: "The data corruption in the buffered write path is troubling; inode lock should not have been able to cause that... - Fix a rare data corruption in the rebalance path, caught as a nonce inconsistency on encrypted filesystems - Revert lockless buffered write path - Mark more errors as autofix" * tag 'bcachefs-2024-08-21' of https://github.com/koverstreet/bcachefs: bcachefs: Mark more errors as autofix bcachefs: Revert lockless buffered IO path bcachefs: Fix bch2_extents_match() false positive bcachefs: Fix failure to return error in data_update_index_update() commit b686ecdeacf6658e1348c1a32a08e2e72f7c0f00 Author: Samuel Holland Date: Wed Aug 14 17:57:03 2024 -0700 riscv: misaligned: Restrict user access to kernel memory raw_copy_{to,from}_user() do not call access_ok(), so this code allowed userspace to access any virtual memory address. Cc: stable@vger.kernel.org Fixes: 7c83232161f6 ("riscv: add support for misaligned trap handling in S-mode") Fixes: 441381506ba7 ("riscv: misaligned: remove CONFIG_RISCV_M_MODE specific code") Signed-off-by: Samuel Holland Reviewed-by: Alexandre Ghiti Link: https://lore.kernel.org/r/20240815005714.1163136-1-samuel.holland@sifive.com Signed-off-by: Palmer Dabbelt arch/riscv/kernel/traps_misaligned.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) commit 3d3020c461936009dc58702e267ff67b0076cbf2 Author: Kent Overstreet Date: Thu Aug 22 11:47:32 2024 -0400 bcachefs: Mark more errors as autofix errors that are known to always be safe to fix should be autofix: this should be most errors even at this point, but that will need some thorough review. note that errors are still logged in the superblock, so we'll still know that they happened. Signed-off-by: Kent Overstreet fs/bcachefs/sb-errors_format.h | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) commit e3e6940940910c2287fe962bdf72015efd4fee81 Author: Kent Overstreet Date: Sat Aug 31 17:44:51 2024 -0400 bcachefs: Revert lockless buffered IO path We had a report of data corruption on nixos when building installer images. https://github.com/NixOS/nixpkgs/pull/321055#issuecomment-2184131334 It seems that writes are being dropped, but only when issued by QEMU, and possibly only in snapshot mode. It's undetermined if it's write calls are being dropped or dirty folios. Further testing, via minimizing the original patch to just the change that skips the inode lock on non appends/truncates, reveals that it really is just not taking the inode lock that causes the corruption: it has nothing to do with the other logic changes for preserving write atomicity in corner cases. It's also kernel config dependent: it doesn't reproduce with the minimal kernel config that ktest uses, but it does reproduce with nixos's distro config. Bisection the kernel config initially pointer the finger at page migration or compaction, but it appears that was erroneous; we haven't yet determined what kernel config option actually triggers it. Sadly it appears this will have to be reverted since we're getting too close to release and my plate is full, but we'd _really_ like to fully debug it. My suspicion is that this patch is exposing a preexisting bug - the inode lock actually covers very little in IO paths, and we have a different lock (the pagecache add lock) that guards against races with truncate here. Fixes: 7e64c86cdc6c ("bcachefs: Buffered write path now can avoid the inode lock") Signed-off-by: Kent Overstreet fs/bcachefs/errcode.h | 1 - fs/bcachefs/fs-io-buffered.c | 149 ++++++++++++------------------------------- 2 files changed, 40 insertions(+), 110 deletions(-) commit 6cd90e5ea72f35fa40f971c419e16142cd8272bf Merge: 8463be84486c 98c0cc48e27e Author: Linus Torvalds Date: Sun Sep 1 09:18:48 2024 +1200 Merge branch 'fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/groeck/linux-staging Pull misc fixes from Guenter Roeck. These are fixes for regressions that Guenther has been reporting, and the maintainers haven't picked up and sent in. With rc6 fairly imminent, I'm taking them directly from Guenter. * 'fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/groeck/linux-staging: apparmor: fix policy_unpack_test on big endian systems Revert "MIPS: csrc-r4k: Apply verification clocksource flags" microblaze: don't treat zero reserved memory regions as error commit 8463be84486c19221198a76436d9177f395bb2eb Merge: e8784b0aef62 d8b762070c3f Author: Linus Torvalds Date: Sun Sep 1 09:07:44 2024 +1200 Merge tag 'pwrseq-fixes-for-v6.11-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/brgl/linux Pull power sequencing fix from Bartosz Golaszewski: "A follow-up fix for the power sequencing subsystem. It turned out the previous fix for this driver was incomplete and broke the WLAN support on some platforms. This addresses the issue. - set the direction of the wlan-enable GPIO to output after requesting it as-is" * tag 'pwrseq-fixes-for-v6.11-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/brgl/linux: power: sequencing: qcom-wcn: set the wlan-enable GPIO to output commit d8b762070c3fde224f8b9ea3cf59bc41a5a3eb57 Author: Bartosz Golaszewski Date: Fri Aug 23 13:55:00 2024 +0200 power: sequencing: qcom-wcn: set the wlan-enable GPIO to output Commit a9aaf1ff88a8 ("power: sequencing: request the WLAN enable GPIO as-is") broke WLAN on boards on which the wlan-enable GPIO enabling the wifi module isn't in output mode by default. We need to set direction to output while retaining the value that was already set to keep the ath module on if it's already started. Fixes: a9aaf1ff88a8 ("power: sequencing: request the WLAN enable GPIO as-is") Link: https://lore.kernel.org/r/20240823115500.37280-1-brgl@bgdev.pl Signed-off-by: Bartosz Golaszewski drivers/power/sequencing/pwrseq-qcom-wcn.c | 7 +++++++ 1 file changed, 7 insertions(+) commit e8784b0aef62cd6117e1c93c64d060e4c7314a1f Merge: 770b0ffe28b4 58c2fa54257d Author: Linus Torvalds Date: Sun Sep 1 07:06:28 2024 +1200 Merge tag 'usb-6.11-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb Pull USB fixes from Greg KH: "Here are some small USB fixes for 6.11-rc6. Included in here are: - dwc3 driver fixes for reported issues - MAINTAINER file update, marking a driver as unsupported :( - cdnsp driver fixes - USB gadget driver fix - USB sysfs fix - other tiny fixes - new device ids for usb serial driver All of these have been in linux-next this week with no reported issues" * tag 'usb-6.11-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb: USB: serial: option: add MeiG Smart SRM825L usb: cdnsp: fix for Link TRB with TC usb: dwc3: st: add missing depopulate in probe error path usb: dwc3: st: fix probed platform device ref count on probe error path usb: dwc3: ep0: Don't reset resource alloc flag (including ep0) usb: core: sysfs: Unmerge @usb3_hardware_lpm_attr_group in remove_power_attributes() usb: typec: fsa4480: Relax CHIP_ID check usb: dwc3: xilinx: add missing depopulate in probe error path usb: dwc3: omap: add missing depopulate in probe error path dt-bindings: usb: microchip,usb2514: Fix reference USB device schema usb: gadget: uvc: queue pump work in uvcg_video_enable() cdc-acm: Add DISABLE_ECHO quirk for GE HealthCare UI Controller usb: cdnsp: fix incorrect index in cdnsp_get_hw_deq function usb: dwc3: core: Prevent USB core invalid event buffer address access MAINTAINERS: Mark UVC gadget driver as orphan commit 770b0ffe28b4f1a18a90e9093148b8a74bdfdd84 Merge: 6a2fcc51a7a1 4f9eedfa27ae Author: Linus Torvalds Date: Sun Sep 1 07:00:38 2024 +1200 Merge tag 'scsi-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi Pull SCSI fixes from James Bottomley: "Minor fixes only. The sd.c one ignores a sync cache request if format is in progress which can happen if formatting a drive across suspend/resume" * tag 'scsi-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi: scsi: sd: Ignore command SYNCHRONIZE CACHE error if format in progress scsi: aacraid: Fix double-free on probe failure scsi: lpfc: Fix overflow build issue commit 6a2fcc51a7a1e92984350e7dd94122db5b8927f2 Merge: 0efdc097965b 40927f3d0972 Author: Linus Torvalds Date: Sun Sep 1 06:55:47 2024 +1200 Merge tag 'nfsd-6.11-3' of git://git.kernel.org/pub/scm/linux/kernel/git/cel/linux Pull nfsd fix from Chuck Lever: - One more write delegation fix * tag 'nfsd-6.11-3' of git://git.kernel.org/pub/scm/linux/kernel/git/cel/linux: nfsd: fix nfsd4_deleg_getattr_conflict in presence of third party lease commit 0efdc097965bcf60d1db62f100ef544714714e88 Merge: 35667a2969d8 a24cae8fc1f1 Author: Linus Torvalds Date: Sun Sep 1 06:48:37 2024 +1200 Merge tag 'xfs-6.11-fixes-4' of git://git.kernel.org/pub/scm/fs/xfs/xfs-linux Pull xfs fixes from Chandan Babu: - Do not call out v1 inodes with non-zero di_nlink field as being corrupt - Change xfs_finobt_count_blocks() to count "free inode btree" blocks rather than "inode btree" blocks - Don't report the number of trimmed bytes via FITRIM because the underlying storage isn't required to do anything and failed discard IOs aren't reported to the caller anyway - Fix incorrect setting of rm_owner field in an rmap query - Report missing disk offset range in an fsmap query - Obtain m_growlock when extending realtime section of the filesystem - Reset rootdir extent size hint after extending realtime section of the filesystem * tag 'xfs-6.11-fixes-4' of git://git.kernel.org/pub/scm/fs/xfs/xfs-linux: xfs: reset rootdir extent size hint after growfsrt xfs: take m_growlock when running growfsrt xfs: Fix missing interval for missing_owner in xfs fsmap xfs: use XFS_BUF_DADDR_NULL for daddrs in getfsmap code xfs: Fix the owner setting issue for rmap query in xfs fsmap xfs: don't bother reporting blocks trimmed via FITRIM xfs: xfs_finobt_count_blocks() walks the wrong btree xfs: fix folio dirtying for XFILE_ALLOC callers xfs: fix di_onlink checking for V1/V2 inodes commit 35667a2969d80a08b1df4066cbf282fc5d875cc4 Merge: 1934261d8974 9cc7b1705141 Author: Linus Torvalds Date: Sun Sep 1 06:42:13 2024 +1200 Merge tag 'arm-fixes-6.11-2' of git://git.kernel.org/pub/scm/linux/kernel/git/soc/soc Pull ARM SoC fixes from Arnd Bergmann: "There is a fairly large number of bug fixes for Qualcomm platforms, most of them addressing issues with the devicetree files for the newly added Snapdragon X1 based laptops to make them more reliable. The Qualcomm driver changes address a few build-time issues as well as runtime problems in the tzmem and scm firmware, the USB Type-C driver, and the cmd-db and pmic_glink soc drivers. The NXP i.MX usually gets a bunch of devicetree fixes that is proportional to the number of supported machines. This includes both warning fixes and correctness for the 64-bit i.MX9, i.MX8 and layerscape platforms, as well as a single fix for a 32-bit i.MX6 based board. The other changes are the usual minor changes, including an update to the MAINTAINERS file, an omap3 dts file and a SoC driver for mpfs (risc-v)" * tag 'arm-fixes-6.11-2' of git://git.kernel.org/pub/scm/linux/kernel/git/soc/soc: (50 commits) firmware: microchip: fix incorrect error report of programming:timeout on success soc: qcom: pd-mapper: Fix singleton refcount firmware: qcom: tzmem: disable sdm670 platform soc: qcom: pmic_glink: Actually communicate when remote goes down usb: typec: ucsi: Move unregister out of atomic section soc: qcom: pmic_glink: Fix race during initialization firmware: qcom: qseecom: remove unused functions firmware: qcom: tzmem: fix virtual-to-physical address conversion firmware: qcom: scm: Mark get_wq_ctx() as atomic call arm64: dts: qcom: x1e80100: Fix Adreno SMMU global interrupt arm64: dts: qcom: disable GPU on x1e80100 by default arm64: dts: imx8mm-phygate: fix typo pinctrcl-0 arm64: dts: imx95: correct L3Cache cache-sets arm64: dts: imx95: correct a55 power-domains arm64: dts: freescale: imx93-tqma9352-mba93xxla: fix typo arm64: dts: freescale: imx93-tqma9352: fix CMA alloc-ranges ARM: dts: imx6dl-yapp43: Increase LED current to match the yapp4 HW design arm64: dts: imx93: update default value for snps,clk-csr arm64: dts: freescale: tqma9352: Fix watchdog reset arm64: dts: imx8mp-beacon-kit: Fix Stereo Audio on WM8962 ... commit 1934261d897467a924e2afd1181a74c1cbfa2c1d Merge: 8101b2766d5b c472d33bcbf7 Author: Linus Torvalds Date: Sat Aug 31 15:32:38 2024 +1200 Merge tag 'input-for-v6.11-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input Pull input fix from Dmitry Torokhov: - a fix for Cypress PS/2 touchpad for regression introduced in 6.11 merge window where a timeout condition is incorrectly reported for all extended Cypress commands * tag 'input-for-v6.11-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input: Input: cypress_ps2 - fix waiting for command response commit 8101b2766d5bfee43a4de737107b9592db251470 Merge: 216d163165a9 150b572a7c1d Author: Linus Torvalds Date: Sat Aug 31 14:54:11 2024 +1200 Merge tag 'pci-v6.11-fixes-2' of git://git.kernel.org/pub/scm/linux/kernel/git/pci/pci Pull pci fixes from Bjorn Helgaas: - Add Manivannan Sadhasivam as PCI native host bridge and endpoint driver reviewer (Manivannan Sadhasivam) - Disable MHI RAM data parity error interrupt for qcom SA8775P SoC to work around hardware erratum that causes a constant stream of interrupts (Manivannan Sadhasivam) - Don't try to fall back to qcom Operating Performance Points (OPP) support unless the platform actually supports OPP (Manivannan Sadhasivam) - Add imx@lists.linux.dev mailing list to MAINTAINERS for NXP layerscape and imx6 PCI controller drivers (Frank Li) * tag 'pci-v6.11-fixes-2' of git://git.kernel.org/pub/scm/linux/kernel/git/pci/pci: MAINTAINERS: PCI: Add NXP PCI controller mailing list imx@lists.linux.dev PCI: qcom: Use OPP only if the platform supports it PCI: qcom-ep: Disable MHI RAM data parity error interrupt for SA8775P SoC MAINTAINERS: Add Manivannan Sadhasivam as Reviewer for PCI native host bridge and endpoint drivers commit 216d163165a937ee9c1d0e9c26fe7a6f7d27ac4c Merge: ad246d9f04aa e33a97a830b2 Author: Linus Torvalds Date: Sat Aug 31 13:54:05 2024 +1200 Merge tag 'block-6.11-20240830' of git://git.kernel.dk/linux Pull block fix from Jens Axboe: "Fix for a single regression for WRITE_SAME introduced in the 6.11 merge window" * tag 'block-6.11-20240830' of git://git.kernel.dk/linux: block: fix detection of unsupported WRITE SAME in blkdev_issue_write_zeroes commit ad246d9f04aa037f8e8bbf8573c9af527114cead Merge: fb24560f31f9 f274495aea7b Author: Linus Torvalds Date: Sat Aug 31 13:51:27 2024 +1200 Merge tag 'io_uring-6.11-20240830' of git://git.kernel.dk/linux Pull io_uring fixes from Jens Axboe: - A fix for a regression that happened in 6.11 merge window, where the copying of iovecs for compat mode applications got broken for certain cases. - Fix for a bug introduced in 6.10, where if using recv/send bundles with classic provided buffers, the recv/send would fail to set the right iovec count. This caused 0 byte send/recv results. Found via code coverage testing and writing a test case to exercise it. * tag 'io_uring-6.11-20240830' of git://git.kernel.dk/linux: io_uring/kbuf: return correct iovec count from classic buffer peek io_uring/rsrc: ensure compat iovecs are copied correctly commit f33b9ab0495b7e3bb01bf6d76045f078e20ada65 Author: Dave Airlie Date: Wed Aug 28 12:37:19 2024 +1000 nouveau: fix the fwsec sb verification register. This aligns with what open gpu does, the 0x15 hex is just to trick you. Fixes: 176fdcbddfd2 ("drm/nouveau/gsp/r535: add support for booting GSP-RM") Reviewed-by: Ben Skeggs Signed-off-by: Dave Airlie Signed-off-by: Danilo Krummrich Link: https://patchwork.freedesktop.org/patch/msgid/20240828023720.1596602-1-airlied@gmail.com drivers/gpu/drm/nouveau/nvkm/subdev/gsp/fwsec.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 1e9683c9b6ca88cc9340cdca85edd6134c8cffe3 Author: Luiz Augusto von Dentz Date: Tue Aug 27 15:01:34 2024 -0400 Bluetooth: MGMT: Ignore keys being loaded with invalid type Due to 59b047bc98084f8af2c41483e4d68a5adf2fa7f7 there could be keys stored with the wrong address type so this attempt to detect it and ignore them instead of just failing to load all keys. Cc: stable@vger.kernel.org Link: https://github.com/bluez/bluez/issues/875 Fixes: 59b047bc9808 ("Bluetooth: MGMT/SMP: Fix address type when using SMP over BREDR/LE") Signed-off-by: Luiz Augusto von Dentz net/bluetooth/mgmt.c | 37 +++++++++++++++++++------------------ 1 file changed, 19 insertions(+), 18 deletions(-) commit 532f8bcd1c2c4e8112f62e1922fd1703bc0ffce0 Author: Luiz Augusto von Dentz Date: Tue Aug 27 14:37:22 2024 -0400 Revert "Bluetooth: MGMT/SMP: Fix address type when using SMP over BREDR/LE" This reverts commit 59b047bc98084f8af2c41483e4d68a5adf2fa7f7 which breaks compatibility with commands like: bluetoothd[46328]: @ MGMT Command: Load.. (0x0013) plen 74 {0x0001} [hci0] Keys: 2 BR/EDR Address: C0:DC:DA:A5:E5:47 (Samsung Electronics Co.,Ltd) Key type: Authenticated key from P-256 (0x03) Central: 0x00 Encryption size: 16 Diversifier[2]: 0000 Randomizer[8]: 0000000000000000 Key[16]: 6ed96089bd9765be2f2c971b0b95f624 LE Address: D7:2A:DE:1E:73:A2 (Static) Key type: Unauthenticated key from P-256 (0x02) Central: 0x00 Encryption size: 16 Diversifier[2]: 0000 Randomizer[8]: 0000000000000000 Key[16]: 87dd2546ededda380ffcdc0a8faa4597 @ MGMT Event: Command Status (0x0002) plen 3 {0x0001} [hci0] Load Long Term Keys (0x0013) Status: Invalid Parameters (0x0d) Cc: stable@vger.kernel.org Link: https://github.com/bluez/bluez/issues/875 Fixes: 59b047bc9808 ("Bluetooth: MGMT/SMP: Fix address type when using SMP over BREDR/LE") Signed-off-by: Luiz Augusto von Dentz include/net/bluetooth/hci_core.h | 5 ----- net/bluetooth/mgmt.c | 25 +++++++------------------ net/bluetooth/smp.c | 7 ------- 3 files changed, 7 insertions(+), 30 deletions(-) commit 227a0cdf4a028a73dc256d0f5144b4808d718893 Author: Luiz Augusto von Dentz Date: Mon Aug 26 16:14:04 2024 -0400 Bluetooth: MGMT: Fix not generating command complete for MGMT_OP_DISCONNECT MGMT_OP_DISCONNECT can be called while mgmt_device_connected has not been called yet, which will cause the connection procedure to be aborted, so mgmt_device_disconnected shall still respond with command complete to MGMT_OP_DISCONNECT and just not emit MGMT_EV_DEVICE_DISCONNECTED since MGMT_EV_DEVICE_CONNECTED was never sent. To fix this MGMT_OP_DISCONNECT is changed to work similarly to other command which do use hci_cmd_sync_queue and then use hci_conn_abort to disconnect and returns the result, in order for hci_conn_abort to be used from hci_cmd_sync context it now uses hci_cmd_sync_run_once. Link: https://github.com/bluez/bluez/issues/932 Fixes: 12d4a3b2ccb3 ("Bluetooth: Move check for MGMT_CONNECTED flag into mgmt.c") Signed-off-by: Luiz Augusto von Dentz net/bluetooth/hci_conn.c | 6 +++- net/bluetooth/mgmt.c | 84 ++++++++++++++++++++++++------------------------ 2 files changed, 47 insertions(+), 43 deletions(-) commit c898f6d7b093bd71e66569cd6797c87d4056f44b Author: Luiz Augusto von Dentz Date: Mon Aug 26 15:47:30 2024 -0400 Bluetooth: hci_sync: Introduce hci_cmd_sync_run/hci_cmd_sync_run_once This introduces hci_cmd_sync_run/hci_cmd_sync_run_once which acts like hci_cmd_sync_queue/hci_cmd_sync_queue_once but runs immediately when already on hdev->cmd_sync_work context. Signed-off-by: Luiz Augusto von Dentz include/net/bluetooth/hci_sync.h | 4 ++++ net/bluetooth/hci_sync.c | 42 ++++++++++++++++++++++++++++++++++++++-- 2 files changed, 44 insertions(+), 2 deletions(-) commit 8ae22de9d2eae3c432de64bf2b3a5a69cf1d1124 Author: Douglas Anderson Date: Wed Aug 21 15:43:40 2024 -0700 Bluetooth: qca: If memdump doesn't work, re-enable IBS On systems in the field, we are seeing this sometimes in the kernel logs: Bluetooth: qca_controller_memdump() hci0: hci_devcd_init Return:-95 This means that _something_ decided that it wanted to get a memdump but then hci_devcd_init() returned -EOPNOTSUPP (AKA -95). The cleanup code in qca_controller_memdump() when we get back an error from hci_devcd_init() undoes most things but forgets to clear QCA_IBS_DISABLED. One side effect of this is that, during the next suspend, qca_suspend() will always get a timeout. Let's fix it so that we clear the bit. Fixes: 06d3fdfcdf5c ("Bluetooth: hci_qca: Add qcom devcoredump support") Reviewed-by: Guenter Roeck Reviewed-by: Stephen Boyd Signed-off-by: Douglas Anderson Signed-off-by: Luiz Augusto von Dentz drivers/bluetooth/hci_qca.c | 1 + 1 file changed, 1 insertion(+) commit dd885d90c047dbdd2773c1d33954cbd8747d81e2 Author: Martin Jocic Date: Fri Aug 30 17:31:13 2024 +0200 can: kvaser_pciefd: Use a single write when releasing RX buffers Kvaser's PCIe cards uses the KCAN FPGA IP block which has dual 4K buffers for incoming messages shared by all (currently up to eight) channels. While the driver processes messages in one buffer, new incoming messages are stored in the other and so on. The design of KCAN is such that a buffer must be fully read and then released. Releasing a buffer will make the FPGA switch buffers. If the other buffer contains at least one incoming message the FPGA will also instantly issue a new interrupt, if not the interrupt will be issued after receiving the first new message. With IRQx interrupts, it takes a little time for the interrupt to happen, enough for any previous ISR call to do it's business and return, but MSI interrupts are way faster so this time is reduced to almost nothing. So with MSI, releasing the buffer HAS to be the very last action of the ISR before returning, otherwise the new interrupt might be "masked" by the kernel because the previous ISR call hasn't returned. And the interrupts are edge-triggered so we cannot loose one, or the ping-pong reading process will stop. This is why this patch modifies the driver to use a single write to the SRB_CMD register before returning. Signed-off-by: Martin Jocic Reviewed-by: Vincent Mailhol Link: https://patch.msgid.link/20240830153113.2081440-1-martin.jocic@kvaser.com Fixes: 26ad340e582d ("can: kvaser_pciefd: Add driver for Kvaser PCIEcan devices") Signed-off-by: Marc Kleine-Budde drivers/net/can/kvaser_pciefd.c | 18 ++++++++---------- 1 file changed, 8 insertions(+), 10 deletions(-) commit 9cc7b1705141d1a077493dc107ed626e8dc84681 Merge: 3536c01d6577 e9408fa234fb Author: Arnd Bergmann Date: Fri Aug 30 19:52:28 2024 +0000 Merge tag 'at91-fixes-6.11' of https://git.kernel.org/pub/scm/linux/kernel/git/at91/linux into arm/fixes Microchip AT91 fixes for v6.11 It contains: - DTS directory update to match all entries not only those starting with at91 or sama commit fb24560f31f9dff2c97707cfed6029bfebebaf1c Merge: fb1a804535ad 76a0e79bc84f Author: Linus Torvalds Date: Sat Aug 31 06:33:59 2024 +1200 Merge tag 'lsm-pr-20240830' of git://git.kernel.org/pub/scm/linux/kernel/git/pcmoore/lsm Pull lsm fix from Paul Moore: "One small patch to correct a NFS permissions problem with SELinux and Smack" * tag 'lsm-pr-20240830' of git://git.kernel.org/pub/scm/linux/kernel/git/pcmoore/lsm: selinux,smack: don't bypass permissions check in inode_setsecctx hook commit fb1a804535adf538532a2f6a27b1c7775efe5368 Merge: 922842a3bfbe 15d75184a86f Author: Linus Torvalds Date: Sat Aug 31 06:25:34 2024 +1200 Merge tag 'pm-6.11-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm Pull power management fixes from Rafael Wysocki: "These fix three issues in the amd-pstate cpufreq driver. Specifics: - Remove checks for highest performance match on preferred cores when updating preferred core ranking in amd-pstate (Mario Limonciello) - Make amd-pstate call topology_logical_package_id() instead of logical_die_id() to get a socked ID for a CPU (Gautham Shenoy) - Fix uninitialized variable in amd_pstate_cpu_boost_update() (Dan Carpenter)" * tag 'pm-6.11-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm: cpufreq/amd-pstate-ut: Don't check for highest perf matching on prefcore cpufreq/amd-pstate: Use topology_logical_package_id() instead of logical_die_id() cpufreq: amd-pstate: Fix uninitialized variable in amd_pstate_cpu_boost_update() commit 922842a3bfbeff64dfebe7f01ce1f2ab01e4509d Merge: 32fafaf2ab18 9f646ff25c09 Author: Linus Torvalds Date: Sat Aug 31 06:20:48 2024 +1200 Merge tag 'dmaengine-fix-6.11' of git://git.kernel.org/pub/scm/linux/kernel/git/vkoul/dmaengine Pull dmaengine fixes from Vinod Koul: - A bunch of dw driver changes to fix the src/dst addr width config - Omap driver fix for sglen initialization - stm32-dma3 driver lli_size init fix - dw edma driver fixes for watermark interrupts and unmasking STOP and ABORT interrupts * tag 'dmaengine-fix-6.11' of git://git.kernel.org/pub/scm/linux/kernel/git/vkoul/dmaengine: dmaengine: dw-edma: Do not enable watermark interrupts for HDMA dmaengine: dw-edma: Fix unmasking STOP and ABORT interrupts for HDMA dmaengine: stm32-dma3: Set lli_size after allocation dmaengine: ti: omap-dma: Initialize sglen after allocation dmaengine: dw: Unify ret-val local variables naming dmaengine: dw: Simplify max-burst calculation procedure dmaengine: dw: Define encode_maxburst() above prepare_ctllo() callbacks dmaengine: dw: Simplify prepare CTL_LO methods dmaengine: dw: Add memory bus width verification dmaengine: dw: Add peripheral bus width verification commit 32fafaf2ab185d26337f79d3ae558b4cb2b4a5d4 Merge: 8d80c9903e3f 5af9b304bc60 Author: Linus Torvalds Date: Sat Aug 31 06:18:07 2024 +1200 Merge tag 'phy-fixes-6.11' of git://git.kernel.org/pub/scm/linux/kernel/git/phy/linux-phy Pull phy fixes from Vinod Koul: - Qualcomm QMP X1E80100 PCIe Gen4 PHY initialisation fix - Freescale imx8mq tuning parameter name fix - Samsung exynos5 fir for error code in probe() - Xilinx Zynqmp SGMII linkup failure fix * tag 'phy-fixes-6.11' of git://git.kernel.org/pub/scm/linux/kernel/git/phy/linux-phy: phy: xilinx: phy-zynqmp: Fix SGMII linkup failure on resume phy: exynos5-usbdrd: fix error code in probe() phy: fsl-imx8mq-usb: fix tuning parameter name phy: qcom: qmp-pcie: Fix X1E80100 PCIe Gen4 PHY initialisation commit 8d80c9903e3f6f9a99e8fd4374c2cf0745d0b708 Merge: 13c6bba601ac ab8d66d132bc Author: Linus Torvalds Date: Sat Aug 31 06:15:02 2024 +1200 Merge tag 'soundwire-6.11-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/vkoul/soundwire Pull soundwire fix from Vinod Koul: - Single fix for non-continous port map programming * tag 'soundwire-6.11-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/vkoul/soundwire: soundwire: stream: fix programming slave ports for non-continous port maps commit 13c6bba601ac2928e330e14e178c7ebfabb19392 Merge: 20371ba12063 51eeef9a482b Author: Linus Torvalds Date: Sat Aug 31 06:11:34 2024 +1200 Merge tag 'iommu-fixes-v6.11-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/iommu/linux Pull iommu fixes from Joerg Roedel: - Fix a device-stall problem in bad io-page-fault setups (faults received from devices with no supporting domain attached). - Context flush fix for Intel VT-d. - Do not allow non-read+non-write mapping through iommufd as most implementations can not handle that. - Fix a possible infinite-loop issue in map_pages() path. - Add Jean-Philippe as reviewer for SMMUv3 SVA support * tag 'iommu-fixes-v6.11-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/iommu/linux: MAINTAINERS: Add Jean-Philippe as SMMUv3 SVA reviewer iommu: Do not return 0 from map_pages if it doesn't do anything iommufd: Do not allow creating areas without READ or WRITE iommu/vt-d: Fix incorrect domain ID in context flush helper iommu: Handle iommu faults for a bad iopf setup commit fe1910f9337bd46a9343967b547ccab26b4b2c6e Author: Cong Wang Date: Tue Aug 20 20:07:44 2024 -0700 tcp_bpf: fix return value of tcp_bpf_sendmsg() When we cork messages in psock->cork, the last message triggers the flushing will result in sending a sk_msg larger than the current message size. In this case, in tcp_bpf_send_verdict(), 'copied' becomes negative at least in the following case: 468 case __SK_DROP: 469 default: 470 sk_msg_free_partial(sk, msg, tosend); 471 sk_msg_apply_bytes(psock, tosend); 472 *copied -= (tosend + delta); // <==== HERE 473 return -EACCES; Therefore, it could lead to the following BUG with a proper value of 'copied' (thanks to syzbot). We should not use negative 'copied' as a return value here. ------------[ cut here ]------------ kernel BUG at net/socket.c:733! Internal error: Oops - BUG: 00000000f2000800 [#1] PREEMPT SMP Modules linked in: CPU: 0 UID: 0 PID: 3265 Comm: syz-executor510 Not tainted 6.11.0-rc3-syzkaller-00060-gd07b43284ab3 #0 Hardware name: linux,dummy-virt (DT) pstate: 61400009 (nZCv daif +PAN -UAO -TCO +DIT -SSBS BTYPE=--) pc : sock_sendmsg_nosec net/socket.c:733 [inline] pc : sock_sendmsg_nosec net/socket.c:728 [inline] pc : __sock_sendmsg+0x5c/0x60 net/socket.c:745 lr : sock_sendmsg_nosec net/socket.c:730 [inline] lr : __sock_sendmsg+0x54/0x60 net/socket.c:745 sp : ffff800088ea3b30 x29: ffff800088ea3b30 x28: fbf00000062bc900 x27: 0000000000000000 x26: ffff800088ea3bc0 x25: ffff800088ea3bc0 x24: 0000000000000000 x23: f9f00000048dc000 x22: 0000000000000000 x21: ffff800088ea3d90 x20: f9f00000048dc000 x19: ffff800088ea3d90 x18: 0000000000000001 x17: 0000000000000000 x16: 0000000000000000 x15: 000000002002ffaf x14: 0000000000000000 x13: 0000000000000000 x12: 0000000000000000 x11: 0000000000000000 x10: ffff8000815849c0 x9 : ffff8000815b49c0 x8 : 0000000000000000 x7 : 000000000000003f x6 : 0000000000000000 x5 : 00000000000007e0 x4 : fff07ffffd239000 x3 : fbf00000062bc900 x2 : 0000000000000000 x1 : 0000000000000000 x0 : 00000000fffffdef Call trace: sock_sendmsg_nosec net/socket.c:733 [inline] __sock_sendmsg+0x5c/0x60 net/socket.c:745 ____sys_sendmsg+0x274/0x2ac net/socket.c:2597 ___sys_sendmsg+0xac/0x100 net/socket.c:2651 __sys_sendmsg+0x84/0xe0 net/socket.c:2680 __do_sys_sendmsg net/socket.c:2689 [inline] __se_sys_sendmsg net/socket.c:2687 [inline] __arm64_sys_sendmsg+0x24/0x30 net/socket.c:2687 __invoke_syscall arch/arm64/kernel/syscall.c:35 [inline] invoke_syscall+0x48/0x110 arch/arm64/kernel/syscall.c:49 el0_svc_common.constprop.0+0x40/0xe0 arch/arm64/kernel/syscall.c:132 do_el0_svc+0x1c/0x28 arch/arm64/kernel/syscall.c:151 el0_svc+0x34/0xec arch/arm64/kernel/entry-common.c:712 el0t_64_sync_handler+0x100/0x12c arch/arm64/kernel/entry-common.c:730 el0t_64_sync+0x19c/0x1a0 arch/arm64/kernel/entry.S:598 Code: f9404463 d63f0060 3108441f 54fffe81 (d4210000) ---[ end trace 0000000000000000 ]--- Fixes: 4f738adba30a ("bpf: create tcp_bpf_ulp allowing BPF to monitor socket TX/RX data") Reported-by: syzbot+58c03971700330ce14d8@syzkaller.appspotmail.com Cc: Jakub Sitnicki Signed-off-by: Cong Wang Reviewed-by: John Fastabend Acked-by: Martin KaFai Lau Link: https://patch.msgid.link/20240821030744.320934-1-xiyou.wangcong@gmail.com Signed-off-by: Jakub Kicinski net/ipv4/tcp_bpf.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 150b572a7c1df30f5d32d87ad96675200cca7b80 Author: Frank Li Date: Mon Aug 26 16:27:39 2024 -0400 MAINTAINERS: PCI: Add NXP PCI controller mailing list imx@lists.linux.dev Add imx mailing list imx@lists.linux.dev for PCI controller of NXP chips (Layerscape and iMX). Link: https://lore.kernel.org/r/20240826202740.970015-1-Frank.Li@nxp.com Signed-off-by: Frank Li Signed-off-by: Bjorn Helgaas Acked-by: Richard Zhu MAINTAINERS | 2 ++ 1 file changed, 2 insertions(+) commit b408473ea01b2e499d23503e2bf898416da9d7ac Author: Martin KaFai Lau Date: Thu Aug 29 18:22:14 2024 -0700 bpf: Fix a crash when btf_parse_base() returns an error pointer The pointer returned by btf_parse_base could be an error pointer. IS_ERR() check is needed before calling btf_free(base_btf). Fixes: 8646db238997 ("libbpf,bpf: Share BTF relocate-related code with kernel") Signed-off-by: Martin KaFai Lau Signed-off-by: Andrii Nakryiko Reviewed-by: Alan Maguire Acked-by: Eduard Zingerman Link: https://lore.kernel.org/bpf/20240830012214.1646005-1-martin.lau@linux.dev kernel/bpf/btf.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit f274495aea7b15225b3d83837121b22ef96e560c Author: Jens Axboe Date: Fri Aug 30 10:45:54 2024 -0600 io_uring/kbuf: return correct iovec count from classic buffer peek io_provided_buffers_select() returns 0 to indicate success, but it should be returning 1 to indicate that 1 vec was mapped. This causes peeking to fail with classic provided buffers, and while that's not a use case that anyone should use, it should still work correctly. The end result is that no buffer will be selected, and hence a completion with '0' as the result will be posted, without a buffer attached. Fixes: 35c8711c8fc4 ("io_uring/kbuf: add helpers for getting/peeking multiple buffers") Signed-off-by: Jens Axboe io_uring/kbuf.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 40927f3d0972bf86357a32a5749be71a551241b6 Author: NeilBrown Date: Thu Aug 29 09:06:28 2024 +1000 nfsd: fix nfsd4_deleg_getattr_conflict in presence of third party lease It is not safe to dereference fl->c.flc_owner without first confirming fl->fl_lmops is the expected manager. nfsd4_deleg_getattr_conflict() tests fl_lmops but largely ignores the result and assumes that flc_owner is an nfs4_delegation anyway. This is wrong. With this patch we restore the "!= &nfsd_lease_mng_ops" case to behave as it did before the change mentioned below. This is the same as the current code, but without any reference to a possible delegation. Fixes: c5967721e106 ("NFSD: handle GETATTR conflict with write delegation") Signed-off-by: NeilBrown Reviewed-by: Jeff Layton Signed-off-by: Chuck Lever fs/nfsd/nfs4state.c | 11 +++++++++-- 1 file changed, 9 insertions(+), 2 deletions(-) commit 1a5caec7f80ca2e659c03f45378ee26915f4eda2 Author: Douglas Anderson Date: Fri Aug 30 07:35:12 2024 -0700 regulator: core: Stub devm_regulator_bulk_get_const() if !CONFIG_REGULATOR When adding devm_regulator_bulk_get_const() I missed adding a stub for when CONFIG_REGULATOR is not enabled. Under certain conditions (like randconfig testing) this can cause the compiler to reports errors like: error: implicit declaration of function 'devm_regulator_bulk_get_const'; did you mean 'devm_regulator_bulk_get_enable'? Add the stub. Fixes: 1de452a0edda ("regulator: core: Allow drivers to define their init data as const") Reported-by: kernel test robot Closes: https://lore.kernel.org/oe-kbuild-all/202408301813.TesFuSbh-lkp@intel.com/ Cc: Neil Armstrong Signed-off-by: Douglas Anderson Link: https://patch.msgid.link/20240830073511.1.Ib733229a8a19fad8179213c05e1af01b51e42328@changeid Signed-off-by: Mark Brown include/linux/regulator/consumer.h | 8 ++++++++ 1 file changed, 8 insertions(+) commit 1c47c0d6014c832ad8e2ba04fc2c5b7070d999f7 Author: Jens Axboe Date: Wed Aug 28 09:42:33 2024 -0600 io_uring/rsrc: ensure compat iovecs are copied correctly For buffer registration (or updates), a userspace iovec is copied in and updated. If the application is within a compat syscall, then the iovec type is compat_iovec rather than iovec. However, the type used in __io_sqe_buffers_update() and io_sqe_buffers_register() is always struct iovec, and hence the source is incremented by the size of a non-compat iovec in the loop. This misses every other iovec in the source, and will run into garbage half way through the copies and return -EFAULT to the application. Maintain the source address separately and assign to our user vec pointer, so that copies always happen from the right source address. While in there, correct a bad placement of __user which triggered the following sparse warning prior to this fix: io_uring/rsrc.c:981:33: warning: cast removes address space '__user' of expression io_uring/rsrc.c:981:30: warning: incorrect type in assignment (different address spaces) io_uring/rsrc.c:981:30: expected struct iovec const [noderef] __user *uvec io_uring/rsrc.c:981:30: got struct iovec *[noderef] __user Fixes: f4eaf8eda89e ("io_uring/rsrc: Drop io_copy_iov in favor of iovec API") Reviewed-by: Gabriel Krisman Bertazi Signed-off-by: Jens Axboe io_uring/rsrc.c | 19 +++++++++++++++---- 1 file changed, 15 insertions(+), 4 deletions(-) commit 58c2fa54257d640c83137b44e12c174fd660a485 Merge: 740f2e2791b9 9a471de516c3 Author: Greg Kroah-Hartman Date: Fri Aug 30 15:41:18 2024 +0200 Merge tag 'usb-serial-6.11-rc6' of ssh://gitolite.kernel.org/pub/scm/linux/kernel/git/johan/usb-serial into usb-linus Johan writes: USB-serial device id for 6.11-rc6 Here's a new modem device id. This one has been in linux-next with no reported issues. * tag 'usb-serial-6.11-rc6' of ssh://gitolite.kernel.org/pub/scm/linux/kernel/git/johan/usb-serial: USB: serial: option: add MeiG Smart SRM825L commit c26096ee0278c5e765009c5eee427bbafe6dc090 Author: David Howells Date: Wed Aug 28 22:02:45 2024 +0100 mm: Fix filemap_invalidate_inode() to use invalidate_inode_pages2_range() Fix filemap_invalidate_inode() to use invalidate_inode_pages2_range() rather than truncate_inode_pages_range(). The latter clears the invalidated bit of a partial pages rather than discarding it entirely. This causes copy_file_range() to fail on cifs because the partial pages at either end of the destination range aren't evicted and reread, but rather just partly cleared. This causes generic/075 and generic/112 xfstests to fail. Fixes: 74e797d79cf1 ("mm: Provide a means of invalidation without using launder_folio") Signed-off-by: David Howells Link: https://lore.kernel.org/r/20240828210249.1078637-5-dhowells@redhat.com cc: Matthew Wilcox cc: Miklos Szeredi cc: Trond Myklebust cc: Christoph Hellwig cc: Andrew Morton cc: Alexander Viro cc: Christian Brauner cc: Jeff Layton cc: linux-mm@kvack.org cc: linux-fsdevel@vger.kernel.org cc: netfs@lists.linux.dev cc: v9fs@lists.linux.dev cc: linux-afs@lists.infradead.org cc: ceph-devel@vger.kernel.org cc: linux-cifs@vger.kernel.org cc: linux-nfs@vger.kernel.org cc: devel@lists.orangefs.org Signed-off-by: Christian Brauner mm/filemap.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 77212f300bfd6fb3edaabd1daf863cabb521854a Author: Srinivas Kandagatla Date: Fri Aug 16 10:12:10 2024 +0100 ASoC: codecs: lpass-va-macro: set the default codec version for sm8250 sm8250 and sc7280 have lpass codec version 1.0, as these are very old platforms, they do not have a reliable way to get the codec version from core_id registers. On codec versions below 2.0, even though the core_id registers are available to read, the values of these registers are not unique to be able to determine the version of the codec dynamically. Add the version info into of_data, so that driver does not need to use core_id registers to get version number for such situations. Fixes: 378918d59181 ("ASoC: codecs: lpass-macro: add helpers to get codec version") Signed-off-by: Srinivas Kandagatla Tested-by: Amit Pundir Reviewed-by: Dmitry Baryshkov Tested-by: Bryan O'Donoghue Link: https://patch.msgid.link/20240816091210.50172-1-srinivas.kandagatla@linaro.org Signed-off-by: Mark Brown sound/soc/codecs/lpass-va-macro.c | 11 ++++++++++- 1 file changed, 10 insertions(+), 1 deletion(-) commit 258905cb9a6414be5c9ca4aa20ef855f8dc894d4 Author: hongchi.peng Date: Mon Aug 26 10:45:17 2024 +0800 drm: komeda: Fix an issue related to normalized zpos We use komeda_crtc_normalize_zpos to normalize zpos of affected planes to their blending zorder in CU. If there's only one slave plane in affected planes and its layer_split property is enabled, order++ for its split layer, so that when calculating the normalized_zpos of master planes, the split layer of the slave plane is included, but the max_slave_zorder does not include the split layer and keep zero because there's only one slave plane in affacted planes, although we actually use two slave layers in this commit. In most cases, this bug does not result in a commit failure, but assume the following situation: slave_layer 0: zpos = 0, layer split enabled, normalized_zpos = 0;(use slave_layer 2 as its split layer) master_layer 0: zpos = 2, layer_split enabled, normalized_zpos = 2;(use master_layer 2 as its split layer) master_layer 1: zpos = 4, normalized_zpos = 4; master_layer 3: zpos = 5, normalized_zpos = 5; kcrtc_st->max_slave_zorder = 0; When we use master_layer 3 as a input of CU in function komeda_compiz_set_input and check it with function komeda_component_check_input, the parameter idx is equal to normailzed_zpos minus max_slave_zorder, the value of idx is 5 and is euqal to CU's max_active_inputs, so that komeda_component_check_input returns a -EINVAL value. To fix the bug described above, when calculating the max_slave_zorder with the layer_split enabled, count the split layer in this calculation directly. Signed-off-by: hongchi.peng Acked-by: Liviu Dudau Signed-off-by: Liviu Dudau Link: https://patchwork.freedesktop.org/patch/msgid/20240826024517.3739-1-hongchi.peng@siengine.com drivers/gpu/drm/arm/display/komeda/komeda_kms.c | 10 +++++++--- 1 file changed, 7 insertions(+), 3 deletions(-) commit 98d4435efcbf37801a3246fb53856c4b934a2613 Author: Jeongjun Park Date: Thu Aug 29 12:56:48 2024 +0900 net/smc: prevent NULL pointer dereference in txopt_get Since smc_inet6_prot does not initialize ipv6_pinfo_offset, inet6_create() copies an incorrect address value, sk + 0 (offset), to inet_sk(sk)->pinet6. In addition, since inet_sk(sk)->pinet6 and smc_sk(sk)->clcsock practically point to the same address, when smc_create_clcsk() stores the newly created clcsock in smc_sk(sk)->clcsock, inet_sk(sk)->pinet6 is corrupted into clcsock. This causes NULL pointer dereference and various other memory corruptions. To solve this problem, you need to initialize ipv6_pinfo_offset, add a smc6_sock structure, and then add ipv6_pinfo as the second member of the smc_sock structure. Reported-by: syzkaller Fixes: d25a92ccae6b ("net/smc: Introduce IPPROTO_SMC") Signed-off-by: Jeongjun Park Reviewed-by: Eric Dumazet Signed-off-by: David S. Miller net/smc/smc.h | 3 +++ net/smc/smc_inet.c | 8 +++++++- 2 files changed, 10 insertions(+), 1 deletion(-) commit 2920294686ec23211637998f3ec386dfd3d784a6 Author: Charles Han Date: Fri Aug 30 15:41:06 2024 +0800 spi: intel: Add check devm_kasprintf() returned value intel_spi_populate_chip() use devm_kasprintf() to set pdata->name. This can return a NULL pointer on failure but this returned value is not checked. Fixes: e58db3bcd93b ("spi: intel: Add default partition and name to the second chip") Signed-off-by: Charles Han Reviewed-by: Mika Westerberg Link: https://patch.msgid.link/20240830074106.8744-1-hanchunchao@inspur.com Signed-off-by: Mark Brown drivers/spi/spi-intel.c | 3 +++ 1 file changed, 3 insertions(+) commit ffc17e1479e8e9459b7afa80e5d9d40d0dd78abb Author: Aleksandr Mishin Date: Fri Aug 30 09:54:28 2024 +0300 platform/x86: dell-smbios: Fix error path in dell_smbios_init() In case of error in build_tokens_sysfs(), all the memory that has been allocated is freed at end of this function. But then free_group() is called which performs memory deallocation again. Also, instead of free_group() call, there should be exit_dell_smbios_smm() and exit_dell_smbios_wmi() calls, since there is initialization, but there is no release of resources in case of an error. Fix these issues by replacing free_group() call with exit_dell_smbios_wmi() and exit_dell_smbios_smm(). Found by Linux Verification Center (linuxtesting.org) with SVACE. Fixes: 33b9ca1e53b4 ("platform/x86: dell-smbios: Add a sysfs interface for SMBIOS tokens") Signed-off-by: Aleksandr Mishin Link: https://lore.kernel.org/r/20240830065428.9544-1-amishin@t-argos.ru Reviewed-by: Ilpo Järvinen Signed-off-by: Ilpo Järvinen drivers/platform/x86/dell/dell-smbios-base.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) commit e9481d9b83f8d9b3251aa428b02d8eba89d839ff Author: Kai Vehmanen Date: Fri Aug 30 15:24:58 2024 +0800 ALSA: hda: add HDMI codec ID for Intel PTL Add HDMI codec ID for Intel Panther Lake platform. Signed-off-by: Kai Vehmanen Reviewed-by: Péter Ujfalusi Reviewed-by: Ranjani Sridharan Signed-off-by: Bard Liao Link: https://patch.msgid.link/20240830072458.110831-1-yung-chuan.liao@linux.intel.com Signed-off-by: Takashi Iwai sound/pci/hda/patch_hdmi.c | 1 + 1 file changed, 1 insertion(+) commit ef27e89e7f3015be2b3c124833fbd6d2e4686561 Author: Terry Cheong Date: Fri Aug 30 04:11:53 2024 +0800 ALSA: hda/realtek: add patch for internal mic in Lenovo V145 Lenovo V145 is having phase inverted dmic but simply applying inverted dmic fixups does not work. Chaining up verb fixes for ALC283 enables inverting dmic fixup to work properly. Signed-off-by: Terry Cheong Cc: Link: https://patch.msgid.link/20240830-lenovo-v145-fixes-v3-1-f7b7265068fa@chromium.org Signed-off-by: Takashi Iwai sound/pci/hda/patch_realtek.c | 9 +++++++++ 1 file changed, 9 insertions(+) commit 20371ba120635d9ab7fc7670497105af8f33eb08 Merge: 1b5fe53681d9 27f5b729cb56 Author: Linus Torvalds Date: Fri Aug 30 14:17:30 2024 +1200 Merge tag 'drm-fixes-2024-08-30' of https://gitlab.freedesktop.org/drm/kernel Pull drm fixes from Dave Airlie: "Another week, another set of GPU fixes. amdgpu and vmwgfx leading the charge, then i915 and xe changes along with v3d and some other bits. The TTM revert is due to some stuttering graphical apps probably due to longer stalls while prefaulting. Seems pretty much where I'd expect things, ttm: - revert prefault change, caused stutters aperture: - handle non-VGA devices bettter amdgpu: - SWSMU gaming stability fix - SMU 13.0.7 fix - SWSMU documentation alignment fix - SMU 14.0.x fixes - GC 12.x fix - Display fix - IP discovery fix - SMU 13.0.6 fix i915: - Fix #11195: The external display connect via USB type-C dock stays blank after re-connect the dock - Make DSI backlight work for 2G version of Lenovo Yoga Tab 3 X90F - Move ARL GuC firmware to correct version xe: - Invalidate media_gt TLBs - Fix HWMON i1 power setup write command vmwgfx: - prevent unmapping active read buffers - fix prime with external buffers - disable coherent dumb buffers without 3d v3d: - disable preemption while updating GPU stats" * tag 'drm-fixes-2024-08-30' of https://gitlab.freedesktop.org/drm/kernel: drm/xe/hwmon: Fix WRITE_I1 param from u32 to u16 drm/v3d: Disable preemption while updating GPU stats drm/amd/pm: Drop unsupported features on smu v14_0_2 drm/amd/pm: Add support for new P2S table revision drm/amdgpu: support for gc_info table v1.3 drm/amd/display: avoid using null object of framebuffer drm/amdgpu/gfx12: set UNORD_DISPATCH in compute MQDs drm/amd/pm: update message interface for smu v14.0.2/3 drm/amdgpu/swsmu: always force a state reprogram on init drm/amdgpu/smu13.0.7: print index for profiles drm/amdgpu: align pp_power_profile_mode with kernel docs drm/i915/dp_mst: Fix MST state after a sink reset drm/xe: Invalidate media_gt TLBs drm/i915: ARL requires a newer GSC firmware drm/i915/dsi: Make Lenovo Yoga Tab 3 X90F DMI match less strict video/aperture: optionally match the device in sysfb_disable() drm/vmwgfx: Disable coherent dumb buffers without 3d drm/vmwgfx: Fix prime with external buffers drm/vmwgfx: Prevent unmapping active read buffers Revert "drm/ttm: increase ttm pre-fault value to PMD size" commit 1bb3c548e4e3567749d7313e037a934cbadec8ee Merge: b57d643a673c d11a67634227 Author: Jakub Kicinski Date: Thu Aug 29 19:13:30 2024 -0700 Merge branch '1GbE' of git://git.kernel.org/pub/scm/linux/kernel/git/tnguy/net-queue Tony Nguyen says: ==================== Intel Wired LAN Driver Updates 2024-08-28 (igb, ice) This series contains updates to igb and ice drivers. Daiwei Li restores writing the TSICR (TimeSync Interrupt Cause) register on 82850 devices to workaround a hardware issue for igb. Dawid detaches netdev device for reset to avoid ethtool accesses during reset causing NULL pointer dereferences on ice. * '1GbE' of git://git.kernel.org/pub/scm/linux/kernel/git/tnguy/net-queue: ice: Add netif_device_attach/detach into PF reset flow igb: Fix not clearing TimeSync interrupts for 82580 ==================== Link: https://patch.msgid.link/20240828225444.645154-1-anthony.l.nguyen@intel.com Signed-off-by: Jakub Kicinski commit 844436e045ac2ab7895d8b281cb784a24de1d14d Author: Dan Carpenter Date: Thu Aug 29 22:22:35 2024 +0300 ksmbd: Unlock on in ksmbd_tcp_set_interfaces() Unlock before returning an error code if this allocation fails. Fixes: 0626e6641f6b ("cifsd: add server handler for central processing and tranport layers") Cc: stable@vger.kernel.org # v5.15+ Signed-off-by: Dan Carpenter Acked-by: Namjae Jeon Signed-off-by: Steve French fs/smb/server/transport_tcp.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) commit 78c5a6f1f630172b19af4912e755e1da93ef0ab5 Author: Namjae Jeon Date: Tue Aug 27 21:44:41 2024 +0900 ksmbd: unset the binding mark of a reused connection Steve French reported null pointer dereference error from sha256 lib. cifs.ko can send session setup requests on reused connection. If reused connection is used for binding session, conn->binding can still remain true and generate_preauth_hash() will not set sess->Preauth_HashValue and it will be NULL. It is used as a material to create an encryption key in ksmbd_gen_smb311_encryptionkey. ->Preauth_HashValue cause null pointer dereference error from crypto_shash_update(). BUG: kernel NULL pointer dereference, address: 0000000000000000 #PF: supervisor read access in kernel mode #PF: error_code(0x0000) - not-present page PGD 0 P4D 0 Oops: 0000 [#1] PREEMPT SMP PTI CPU: 8 PID: 429254 Comm: kworker/8:39 Hardware name: LENOVO 20MAS08500/20MAS08500, BIOS N2CET69W (1.52 ) Workqueue: ksmbd-io handle_ksmbd_work [ksmbd] RIP: 0010:lib_sha256_base_do_update.isra.0+0x11e/0x1d0 [sha256_ssse3] ? show_regs+0x6d/0x80 ? __die+0x24/0x80 ? page_fault_oops+0x99/0x1b0 ? do_user_addr_fault+0x2ee/0x6b0 ? exc_page_fault+0x83/0x1b0 ? asm_exc_page_fault+0x27/0x30 ? __pfx_sha256_transform_rorx+0x10/0x10 [sha256_ssse3] ? lib_sha256_base_do_update.isra.0+0x11e/0x1d0 [sha256_ssse3] ? __pfx_sha256_transform_rorx+0x10/0x10 [sha256_ssse3] ? __pfx_sha256_transform_rorx+0x10/0x10 [sha256_ssse3] _sha256_update+0x77/0xa0 [sha256_ssse3] sha256_avx2_update+0x15/0x30 [sha256_ssse3] crypto_shash_update+0x1e/0x40 hmac_update+0x12/0x20 crypto_shash_update+0x1e/0x40 generate_key+0x234/0x380 [ksmbd] generate_smb3encryptionkey+0x40/0x1c0 [ksmbd] ksmbd_gen_smb311_encryptionkey+0x72/0xa0 [ksmbd] ntlm_authenticate.isra.0+0x423/0x5d0 [ksmbd] smb2_sess_setup+0x952/0xaa0 [ksmbd] __process_request+0xa3/0x1d0 [ksmbd] __handle_ksmbd_work+0x1c4/0x2f0 [ksmbd] handle_ksmbd_work+0x2d/0xa0 [ksmbd] process_one_work+0x16c/0x350 worker_thread+0x306/0x440 ? __pfx_worker_thread+0x10/0x10 kthread+0xef/0x120 ? __pfx_kthread+0x10/0x10 ret_from_fork+0x44/0x70 ? __pfx_kthread+0x10/0x10 ret_from_fork_asm+0x1b/0x30 Fixes: f5a544e3bab7 ("ksmbd: add support for SMB3 multichannel") Cc: stable@vger.kernel.org # v5.15+ Signed-off-by: Namjae Jeon Signed-off-by: Steve French fs/smb/server/smb2pdu.c | 4 ++++ 1 file changed, 4 insertions(+) commit 8d8d244726c8436c50f84092616c92bf551ea89a Author: Thorsten Blum Date: Fri Aug 23 13:47:05 2024 +0200 smb: Annotate struct xattr_smb_acl with __counted_by() Add the __counted_by compiler attribute to the flexible array member entries to improve access bounds-checking via CONFIG_UBSAN_BOUNDS and CONFIG_FORTIFY_SOURCE. Signed-off-by: Thorsten Blum Acked-by: Namjae Jeon Signed-off-by: Steve French fs/smb/server/xattr.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 27f5b729cb56e46d8beca47c227c0edf1e958fbb Merge: dde72a5d4fdf 9d824c7fce58 Author: Dave Airlie Date: Fri Aug 30 11:28:00 2024 +1000 Merge tag 'drm-misc-fixes-2024-08-29' of https://gitlab.freedesktop.org/drm/misc/kernel into drm-fixes A revert for a previous TTM commit causing stuttering, 3 fixes for vmwgfx related to buffer operations, a fix for video/aperture with non-VGA primary devices, and a preemption status fix for v3d Signed-off-by: Dave Airlie From: Maxime Ripard Link: https://patchwork.freedesktop.org/patch/msgid/20240829-efficient-swift-from-lemuria-f60c05@houat commit dde72a5d4fdf2e18fedb4b2abfba5f7e86bcb7c8 Merge: 9941b5bcfeb2 59d237c8a241 Author: Dave Airlie Date: Fri Aug 30 11:07:55 2024 +1000 Merge tag 'drm-xe-fixes-2024-08-29' of https://gitlab.freedesktop.org/drm/xe/kernel into drm-fixes - Invalidate media_gt TLBs (Brost) - Fix HWMON i1 power setup write command (Karthik) Signed-off-by: Dave Airlie From: Rodrigo Vivi Link: https://patchwork.freedesktop.org/patch/msgid/ZtB-t5f4uXMrKgnV@intel.com commit 1b5fe53681d9c388f1600310fe3488091701d4d0 Merge: 04c8abae1b7b c6a09e342f8e Author: Linus Torvalds Date: Fri Aug 30 12:32:53 2024 +1200 Merge tag 'execve-v6.11-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/kees/linux Pull execve fix from Kees Cook: - binfmt_elf_fdpic: fix AUXV size with ELF_HWCAP2 (Max Filippov) * tag 'execve-v6.11-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/kees/linux: binfmt_elf_fdpic: fix AUXV size calculation when ELF_HWCAP2 is defined commit 04c8abae1b7b2abeb638a3d5d5950fa2a031c244 Author: Stephen Brennan Date: Thu Aug 29 11:20:49 2024 -0700 dcache: keep dentry_hashtable or d_hash_shift even when not used The runtime constant feature removes all the users of these variables, allowing the compiler to optimize them away. It's quite difficult to extract their values from the kernel text, and the memory saved by removing them is tiny, and it was never the point of this optimization. Since the dentry_hashtable is a core data structure, it's valuable for debugging tools to be able to read it easily. For instance, scripts built on drgn, like the dentrycache script[1], rely on it to be able to perform diagnostics on the contents of the dcache. Annotate it as used, so the compiler doesn't discard it. Link: https://github.com/oracle-samples/drgn-tools/blob/3afc56146f54d09dfd1f6d3c1b7436eda7e638be/drgn_tools/dentry.py#L325-L355 [1] Fixes: e3c92e81711d ("runtime constants: add x86 architecture support") Signed-off-by: Stephen Brennan Signed-off-by: Linus Torvalds fs/dcache.c | 9 +++++++-- 1 file changed, 7 insertions(+), 2 deletions(-) commit 9941b5bcfeb25c5192c8d4c8307d3680c04d4021 Merge: bd3755c1cf2a a2ccc33b88e2 Author: Dave Airlie Date: Fri Aug 30 09:02:27 2024 +1000 Merge tag 'drm-intel-fixes-2024-08-29' of https://gitlab.freedesktop.org/drm/i915/kernel into drm-fixes - Fix #11195: The external display connect via USB type-C dock stays blank after re-connect the dock - Make DSI backlight work for 2G version of Lenovo Yoga Tab 3 X90F . Move ARL GuC firmware to correct version - Signed-off-by: Dave Airlie From: Joonas Lahtinen Link: https://patchwork.freedesktop.org/patch/msgid/ZtAd8WTw1xiSu_TS@jlahtine-mobl.ger.corp.intel.com commit b57d643a673ce54bc1437d1cca25e1909f553a7e Author: Jakub Kicinski Date: Wed Aug 28 10:58:21 2024 -0700 MAINTAINERS: exclude bluetooth and wireless DT bindings from netdev ML We exclude wireless drivers from the netdev@ traffic, to delegate it to linux-wireless@, and avoid overwhelming netdev@. Bluetooth drivers are implicitly excluded because they live under drivers/bluetooth, not drivers/net. In both cases DT bindings sit under Documentation/devicetree/bindings/net/ and aren't excluded. So if a patch series touches DT bindings netdev@ ends up getting CCed, and these are usually fairly boring series. Reviewed-by: Simon Horman Link: https://patch.msgid.link/20240828175821.2960423-1-kuba@kernel.org Signed-off-by: Jakub Kicinski MAINTAINERS | 2 ++ 1 file changed, 2 insertions(+) commit 538d5477b25289ac5d46ca37b9e5b4d685cbe019 Author: Xingyu Wu Date: Mon Aug 26 16:04:29 2024 +0800 clk: starfive: jh7110-sys: Add notifier for PLL0 clock Add notifier function for PLL0 clock. In the function, the cpu_root clock should be operated by saving its current parent and setting a new safe parent (osc clock) before setting the PLL0 clock rate. After setting PLL0 rate, it should be switched back to the original parent clock. Fixes: e2c510d6d630 ("riscv: dts: starfive: Add cpu scaling for JH7110 SoC") Cc: stable@vger.kernel.org Reviewed-by: Emil Renner Berthing Signed-off-by: Xingyu Wu Link: https://lore.kernel.org/r/20240826080430.179788-2-xingyu.wu@starfivetech.com Reviewed-by: Hal Feng Tested-by: Michael Jeanson Signed-off-by: Stephen Boyd drivers/clk/starfive/clk-starfive-jh7110-sys.c | 31 +++++++++++++++++++++++++- drivers/clk/starfive/clk-starfive-jh71x0.h | 2 ++ 2 files changed, 32 insertions(+), 1 deletion(-) commit 3b9dfd9e59367eff5f65ef2a850f2df674f1f1c5 Merge: 0dd5dd63ba91 7bbc079531fc Author: Linus Torvalds Date: Fri Aug 30 06:22:35 2024 +1200 Merge tag 'hwmon-for-v6.11-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/groeck/linux-staging Pull hwmon fixes from Guenter Roeck: - pt5161l: Fix invalid temperature reading of bad ADC values - asus-ec-sensors: Remove unsupported VRM temperature from X570-E GAMING * tag 'hwmon-for-v6.11-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/groeck/linux-staging: hwmon: (pt5161l) Fix invalid temperature reading hwmon: (asus-ec-sensors) remove VRM temp X570-E GAMING commit 0dd5dd63ba91d7bee9d0fbc2a6dc73e595391b4c Merge: d5d547aa7b51 febccb39255f Author: Linus Torvalds Date: Fri Aug 30 06:14:39 2024 +1200 Merge tag 'net-6.11-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net Pull networking fixes from Paolo Abeni: "Including fixes from bluetooth, wireless and netfilter. No known outstanding regressions. Current release - regressions: - wifi: iwlwifi: fix hibernation - eth: ionic: prevent tx_timeout due to frequent doorbell ringing Previous releases - regressions: - sched: fix sch_fq incorrect behavior for small weights - wifi: - iwlwifi: take the mutex before running link selection - wfx: repair open network AP mode - netfilter: restore IP sanity checks for netdev/egress - tcp: fix forever orphan socket caused by tcp_abort - mptcp: close subflow when receiving TCP+FIN - bluetooth: fix random crash seen while removing btnxpuart driver Previous releases - always broken: - mptcp: more fixes for the in-kernel PM - eth: bonding: change ipsec_lock from spin lock to mutex - eth: mana: fix race of mana_hwc_post_rx_wqe and new hwc response Misc: - documentation: drop special comment style for net code" * tag 'net-6.11-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net: (57 commits) nfc: pn533: Add poll mod list filling check mailmap: update entry for Sriram Yagnaraman selftests: mptcp: join: check re-re-adding ID 0 signal mptcp: pm: ADD_ADDR 0 is not a new address selftests: mptcp: join: validate event numbers mptcp: avoid duplicated SUB_CLOSED events selftests: mptcp: join: check re-re-adding ID 0 endp mptcp: pm: fix ID 0 endp usage after multiple re-creations mptcp: pm: do not remove already closed subflows selftests: mptcp: join: no extra msg if no counter selftests: mptcp: join: check re-adding init endp with != id mptcp: pm: reset MPC endp ID when re-added mptcp: pm: skip connecting to already established sf mptcp: pm: send ACK on an active subflow selftests: mptcp: join: check removing ID 0 endpoint mptcp: pm: fix RM_ADDR ID for the initial subflow mptcp: pm: reuse ID 0 after delete and re-add net: busy-poll: use ktime_get_ns() instead of local_clock() sctp: fix association labeling in the duplicate COOKIE-ECHO case mptcp: pr_debug: add missing \n at the end ... commit aa2eb2c4356affa2799efd95a4ee2d239ca630f8 Author: Neil Armstrong Date: Thu Aug 29 10:44:30 2024 +0200 clk: qcom: gcc-sm8650: Don't use shared clk_ops for QUPs The QUPs aren't shared in a way that requires parking the RCG at an always on parent in case some other entity turns on the clk. The hardware is capable of setting a new frequency itself with the DFS mode, so parking is unnecessary. Furthermore, there aren't any GDSCs for these devices, so there isn't a possibility of the GDSC turning on the clks for housekeeping purposes. Like for the SM8550 GCC QUP clocks at [1], do not use shared clk_ops for QUPs. [1] https://lore.kernel.org/all/20240827231237.1014813-3-swboyd@chromium.org/ Signed-off-by: Neil Armstrong Link: https://lore.kernel.org/r/20240829-topic-sm8650-upstream-fix-qup-clk-rcg-shared-v1-1-7ecdbc672187@linaro.org Signed-off-by: Stephen Boyd drivers/clk/qcom/gcc-sm8650.c | 56 +++++++++++++++++++++---------------------- 1 file changed, 28 insertions(+), 28 deletions(-) commit 7b6dfa1bbe7f727315d2e05a2fc8e4cfeb779156 Author: Stephen Boyd Date: Mon Aug 19 16:36:27 2024 -0700 clk: qcom: gcc-sm8550: Don't park the USB RCG at registration time Amit Pundir reports that audio and USB-C host mode stops working if the gcc_usb30_prim_master_clk_src clk is registered and clk_rcg2_shared_init() parks it on XO. Skip parking this clk at registration time to fix those issues. Partially revert commit 01a0a6cc8cfd ("clk: qcom: Park shared RCGs upon registration") by skipping the parking bit for this clk, but keep the part where we cache the config register. That's still necessary to figure out the true parent of the clk at registration time. Fixes: 01a0a6cc8cfd ("clk: qcom: Park shared RCGs upon registration") Fixes: 929c75d57566 ("clk: qcom: gcc-sm8550: Mark RCGs shared where applicable") Cc: Konrad Dybcio Cc: Bjorn Andersson Cc: Taniya Das Reported-by: Amit Pundir Closes: https://lore.kernel.org/CAMi1Hd1KQBE4kKUdAn8E5FV+BiKzuv+8FoyWQrrTHPDoYTuhgA@mail.gmail.com Signed-off-by: Stephen Boyd Link: https://lore.kernel.org/r/20240819233628.2074654-3-swboyd@chromium.org Tested-by: Amit Pundir Signed-off-by: Stephen Boyd drivers/clk/qcom/clk-rcg.h | 1 + drivers/clk/qcom/clk-rcg2.c | 30 ++++++++++++++++++++++++++++++ drivers/clk/qcom/gcc-sm8550.c | 2 +- 3 files changed, 32 insertions(+), 1 deletion(-) commit d10eeb75168b84ed9559c58efe2756c2e0bc052a Author: Stephen Boyd Date: Mon Aug 19 16:36:26 2024 -0700 clk: qcom: gcc-sm8550: Don't use parking clk_ops for QUPs The QUPs aren't shared in a way that requires parking the RCG at an always on parent in case some other entity turns on the clk. The hardware is capable of setting a new frequency itself with the DFS mode, so parking is unnecessary. Furthermore, there aren't any GDSCs for these devices, so there isn't a possibility of the GDSC turning on the clks for housekeeping purposes. This wasn't a problem to mark these clks shared until we started parking shared RCGs at clk registration time in commit 01a0a6cc8cfd ("clk: qcom: Park shared RCGs upon registration"). Parking at init is actually harmful to the UART when earlycon is used. If the device is pumping out data while the frequency changes you'll see garbage on the serial console until the driver can probe and actually set a proper frequency. Revert the QUP part of commit 929c75d57566 ("clk: qcom: gcc-sm8550: Mark RCGs shared where applicable") so that the QUPs don't get parked during clk registration and break UART operations. Fixes: 01a0a6cc8cfd ("clk: qcom: Park shared RCGs upon registration") Fixes: 929c75d57566 ("clk: qcom: gcc-sm8550: Mark RCGs shared where applicable") Cc: Konrad Dybcio Cc: Bjorn Andersson Cc: Taniya Das Reported-by: Amit Pundir Closes: https://lore.kernel.org/CAMi1Hd1KQBE4kKUdAn8E5FV+BiKzuv+8FoyWQrrTHPDoYTuhgA@mail.gmail.com Signed-off-by: Stephen Boyd Link: https://lore.kernel.org/r/20240819233628.2074654-2-swboyd@chromium.org Tested-by: Amit Pundir Tested-by: Neil Armstrong # on SM8550-QRD Signed-off-by: Stephen Boyd drivers/clk/qcom/gcc-sm8550.c | 52 +++++++++++++++++++++---------------------- 1 file changed, 26 insertions(+), 26 deletions(-) commit c472d33bcbf7a1ed3710efe93822b5e94eabe18c Author: Dmitry Torokhov Date: Thu Aug 29 08:38:54 2024 -0700 Input: cypress_ps2 - fix waiting for command response Commit 8bccf667f62a ("Input: cypress_ps2 - report timeouts when reading command status") uncovered an existing problem with cypress_ps2 driver: it tries waiting on a PS/2 device waitqueue without using the rest of libps2. Unfortunately without it nobody signals wakeup for the waiting process, and each "extended" command was timing out. But the rest of the code simply did not notice it. Fix this by switching from homegrown way of sending request to get command response and reading it to standard ps2_command() which does the right thing. Reported-by: Woody Suwalski Tested-by: Woody Suwalski Fixes: 8bccf667f62a ("Input: cypress_ps2 - report timeouts when reading command status") Link: https://lore.kernel.org/r/a8252e0f-dab4-ef5e-2aa1-407a6f4c7204@gmail.com Signed-off-by: Dmitry Torokhov drivers/input/mouse/cypress_ps2.c | 58 +++++++++------------------------------ 1 file changed, 13 insertions(+), 45 deletions(-) commit 3e83957e8dd7433a69116780d9bad217b00913ea Author: Matteo Martelli Date: Thu Aug 1 14:07:19 2024 +0200 ASoC: sunxi: sun4i-i2s: fix LRCLK polarity in i2s mode This fixes the LRCLK polarity for sun8i-h3 and sun50i-h6 in i2s mode which was wrongly inverted. The LRCLK was being set in reversed logic compared to the DAI format: inverted LRCLK for SND_SOC_DAIFMT_IB_NF and SND_SOC_DAIFMT_NB_NF; normal LRCLK for SND_SOC_DAIFMT_IB_IF and SND_SOC_DAIFMT_NB_IF. Such reversed logic applies properly for DSP_A, DSP_B, LEFT_J and RIGHT_J modes but not for I2S mode, for which the LRCLK signal results reversed to what expected on the bus. The issue is due to a misinterpretation of the LRCLK polarity bit of the H3 and H6 i2s controllers. Such bit in this case does not mean "0 => normal" or "1 => inverted" according to the expected bus operation, but it means "0 => frame starts on low edge" and "1 => frame starts on high edge" (from the User Manuals). This commit fixes the LRCLK polarity by setting the LRCLK polarity bit according to the selected bus mode and renames the LRCLK polarity bit definition to avoid further confusion. Fixes: dd657eae8164 ("ASoC: sun4i-i2s: Fix the LRCK polarity") Fixes: 73adf87b7a58 ("ASoC: sun4i-i2s: Add support for H6 I2S") Signed-off-by: Matteo Martelli Link: https://patch.msgid.link/20240801-asoc-fix-sun4i-i2s-v2-1-a8e4e9daa363@gmail.com Signed-off-by: Mark Brown sound/soc/sunxi/sun4i-i2s.c | 143 ++++++++++++++++++++++---------------------- 1 file changed, 73 insertions(+), 70 deletions(-) commit 59d237c8a241168c7ae34c48244059b7bafaff38 Author: Karthik Poosa Date: Tue Aug 27 21:23:01 2024 +0530 drm/xe/hwmon: Fix WRITE_I1 param from u32 to u16 WRITE_I1 sub-command of the POWER_SETUP pcode command accepts a u16 parameter instead of u32. This change prevents potential illegal sub-command errors. v2: Mask uval instead of changing the prototype. (Badal) v3: Rephrase commit message. (Badal) Signed-off-by: Karthik Poosa Fixes: 92d44a422d0d ("drm/xe/hwmon: Expose card reactive critical power") Reviewed-by: Badal Nilawar Link: https://patchwork.freedesktop.org/patch/msgid/20240827155301.183383-1-karthik.poosa@intel.com Signed-off-by: Rodrigo Vivi (cherry picked from commit a7f657097e96d8fa745c74bb1a239ebd5a8c971c) Signed-off-by: Rodrigo Vivi drivers/gpu/drm/xe/xe_hwmon.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 84cfab9a1805f8e300e945f26e3fdff6d125bc20 Merge: 32d5f7add080 2116988d5372 Author: Palmer Dabbelt Date: Thu Aug 29 06:03:32 2024 -0700 Merge patch series "riscv: mm: Do not restrict mmap address based on hint" Charlie Jenkins says: There have been a couple of reports that using the hint address to restrict the address returned by mmap hint address has caused issues in applications. A different solution for restricting addresses returned by mmap is necessary to avoid breakages. [Palmer: This also just wasn't doing the right thing in the first place, as it didn't handle the sv39 cases we were trying to deal with.] * b4-shazam-merge: riscv: mm: Do not restrict mmap address based on hint riscv: selftests: Remove mmap hint address checks Revert "RISC-V: mm: Document mmap changes" Link: https://lore.kernel.org/r/20240826-riscv_mmap-v1-0-cd8962afe47f@rivosinc.com Signed-off-by: Palmer Dabbelt commit 283844c35529300c8e10f7a263e35e3c5d3580ac Author: Markuss Broks Date: Thu Aug 29 16:03:05 2024 +0300 ASoC: amd: yc: Add a quirk for MSI Bravo 17 (D7VEK) MSI Bravo 17 (D7VEK), like other laptops from the family, has broken ACPI tables and needs a quirk for internal mic to work. Signed-off-by: Markuss Broks Link: https://patch.msgid.link/20240829130313.338508-1-markuss.broks@gmail.com Signed-off-by: Mark Brown sound/soc/amd/yc/acp6x-mach.c | 7 +++++++ 1 file changed, 7 insertions(+) commit 2116988d5372aec51f8c4fb85bf8e305ecda47a0 Author: Charlie Jenkins Date: Mon Aug 26 09:36:47 2024 -0700 riscv: mm: Do not restrict mmap address based on hint The hint address should not forcefully restrict the addresses returned by mmap as this causes mmap to report ENOMEM when there is memory still available. Signed-off-by: Charlie Jenkins Fixes: b5b4287accd7 ("riscv: mm: Use hint address in mmap if available") Fixes: add2cc6b6515 ("RISC-V: mm: Restrict address space for sv39,sv48,sv57") Closes: https://lore.kernel.org/linux-kernel/ZbxTNjQPFKBatMq+@ghost/T/#mccb1890466bf5a488c9ce7441e57e42271895765 Link: https://lore.kernel.org/r/20240826-riscv_mmap-v1-3-cd8962afe47f@rivosinc.com Signed-off-by: Palmer Dabbelt arch/riscv/include/asm/processor.h | 26 ++------------------------ 1 file changed, 2 insertions(+), 24 deletions(-) commit 83dae72ac0382693540a055ec6210dd3691a8df6 Author: Charlie Jenkins Date: Mon Aug 26 09:36:46 2024 -0700 riscv: selftests: Remove mmap hint address checks The mmap behavior that restricts the addresses returned by mmap caused unexpected behavior, so get rid of the test cases that check that behavior. Signed-off-by: Charlie Jenkins Fixes: 73d05262a2ca ("selftests: riscv: Generalize mm selftests") Link: https://lore.kernel.org/r/20240826-riscv_mmap-v1-2-cd8962afe47f@rivosinc.com Signed-off-by: Palmer Dabbelt tools/testing/selftests/riscv/mm/mmap_bottomup.c | 2 - tools/testing/selftests/riscv/mm/mmap_default.c | 2 - tools/testing/selftests/riscv/mm/mmap_test.h | 67 ------------------------ 3 files changed, 71 deletions(-) commit 954260ff5a4657eb97ad7e1618505074f1610acc Author: Charlie Jenkins Date: Mon Aug 26 09:36:45 2024 -0700 Revert "RISC-V: mm: Document mmap changes" This mmap behavior caused unintended breakages so the behavior has been changed. Signed-off-by: Charlie Jenkins Link: https://lore.kernel.org/r/20240826-riscv_mmap-v1-1-cd8962afe47f@rivosinc.com Signed-off-by: Palmer Dabbelt Documentation/arch/riscv/vm-layout.rst | 16 ---------------- 1 file changed, 16 deletions(-) commit 5f3eee1eef5d0edd23d8ac0974f56283649a1512 Author: Fabio Estevam Date: Wed Aug 28 15:00:56 2024 -0300 spi: spidev: Add an entry for elgin,jg10309-01 The rv1108-elgin-r1 board has an LCD controlled via SPI in userspace. The marking on the LCD is JG10309-01. Add the "elgin,jg10309-01" compatible string. Signed-off-by: Fabio Estevam Reviewed-by: Heiko Stuebner Link: https://patch.msgid.link/20240828180057.3167190-2-festevam@gmail.com Signed-off-by: Mark Brown drivers/spi/spidev.c | 1 + 1 file changed, 1 insertion(+) commit febccb39255f9df35527b88c953b2e0deae50e53 Author: Aleksandr Mishin Date: Tue Aug 27 11:48:22 2024 +0300 nfc: pn533: Add poll mod list filling check In case of im_protocols value is 1 and tm_protocols value is 0 this combination successfully passes the check 'if (!im_protocols && !tm_protocols)' in the nfc_start_poll(). But then after pn533_poll_create_mod_list() call in pn533_start_poll() poll mod list will remain empty and dev->poll_mod_count will remain 0 which lead to division by zero. Normally no im protocol has value 1 in the mask, so this combination is not expected by driver. But these protocol values actually come from userspace via Netlink interface (NFC_CMD_START_POLL operation). So a broken or malicious program may pass a message containing a "bad" combination of protocol parameter values so that dev->poll_mod_count is not incremented inside pn533_poll_create_mod_list(), thus leading to division by zero. Call trace looks like: nfc_genl_start_poll() nfc_start_poll() ->start_poll() pn533_start_poll() Add poll mod list filling check. Found by Linux Verification Center (linuxtesting.org) with SVACE. Fixes: dfccd0f58044 ("NFC: pn533: Add some polling entropy") Signed-off-by: Aleksandr Mishin Acked-by: Krzysztof Kozlowski Link: https://patch.msgid.link/20240827084822.18785-1-amishin@t-argos.ru Signed-off-by: Paolo Abeni drivers/nfc/pn533/pn533.c | 5 +++++ 1 file changed, 5 insertions(+) commit 3ab394b363c5fd14b231e335fb6746ddfb93aaaa Author: Bernd Schubert Date: Wed Jul 3 19:30:20 2024 +0200 fuse: disable the combination of passthrough and writeback cache Current design and handling of passthrough is without fuse caching and with that FUSE_WRITEBACK_CACHE is conflicting. Fixes: 7dc4e97a4f9a ("fuse: introduce FUSE_PASSTHROUGH capability") Cc: stable@kernel.org # v6.9 Signed-off-by: Bernd Schubert Acked-by: Amir Goldstein Reviewed-by: Josef Bacik Signed-off-by: Miklos Szeredi fs/fuse/inode.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) commit 0240bceb0dd567d8e129d965f57a40dccef8c953 Merge: 6213dcc752f5 70c261d50095 Author: Paolo Abeni Date: Thu Aug 29 11:35:54 2024 +0200 Merge tag 'nf-24-08-28' of git://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf Pablo Neira Ayuso says: ==================== Netfilter fixes for net The following patchset contains Netfilter fixes for net: Patch #1 sets on NFT_PKTINFO_L4PROTO for UDP packets less than 4 bytes payload from netdev/egress by subtracting skb_network_offset() when validating IPv4 packet length, otherwise 'meta l4proto udp' never matches. Patch #2 subtracts skb_network_offset() when validating IPv6 packet length for netdev/egress. netfilter pull request 24-08-28 * tag 'nf-24-08-28' of git://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf: netfilter: nf_tables_ipv6: consider network offset in netdev/egress validation netfilter: nf_tables: restore IP sanity checks for netdev/egress ==================== Link: https://patch.msgid.link/20240828214708.619261-1-pablo@netfilter.org Signed-off-by: Paolo Abeni commit 6213dcc752f5d605cc50e08597f47fcbe658a40e Author: Sriram Yagnaraman Date: Wed Aug 28 09:24:17 2024 +0200 mailmap: update entry for Sriram Yagnaraman Link my old est.tech address to my active mail address Signed-off-by: Sriram Yagnaraman Reviewed-by: Kurt Kanzenbach Link: https://patch.msgid.link/20240828072417.4111996-1-sriram.yagnaraman@ericsson.com Signed-off-by: Paolo Abeni .mailmap | 1 + 1 file changed, 1 insertion(+) commit b666a651d0db4b5a50616a52ac5d00adc858d9d7 Merge: 0870b0d8b393 f18fa2abf810 Author: Paolo Abeni Date: Thu Aug 29 10:39:52 2024 +0200 Merge branch 'mptcp-more-fixes-for-the-in-kernel-pm' Matthieu Baerts says: ==================== mptcp: more fixes for the in-kernel PM Here is a new batch of fixes for the MPTCP in-kernel path-manager: Patch 1 ensures the address ID is set to 0 when the path-manager sends an ADD_ADDR for the address of the initial subflow. The same fix is applied when a new subflow is created re-using this special address. A fix for v6.0. Patch 2 is similar, but for the case where an endpoint is removed: if this endpoint was used for the initial address, it is important to send a RM_ADDR with this ID set to 0, and look for existing subflows with the ID set to 0. A fix for v6.0 as well. Patch 3 validates the two previous patches. Patch 4 makes the PM selecting an "active" path to send an address notification in an ACK, instead of taking the first path in the list. A fix for v5.11. Patch 5 fixes skipping the establishment of a new subflow if a previous subflow using the same pair of addresses is being closed. A fix for v5.13. Patch 6 resets the ID linked to the initial subflow when the linked endpoint is re-added, possibly with a different ID. A fix for v6.0. Patch 7 validates the three previous patches. Patch 8 is a small fix for the MPTCP Join selftest, when being used with older subflows not supporting all MIB counters. A fix for a commit introduced in v6.4, but backported up to v5.10. Patch 9 avoids the PM to try to close the initial subflow multiple times, and increment counters while nothing happened. A fix for v5.10. Patch 10 stops incrementing local_addr_used and add_addr_accepted counters when dealing with the address ID 0, because these counters are not taking into account the initial subflow, and are then not decremented when the linked addresses are removed. A fix for v6.0. Patch 11 validates the previous patch. Patch 12 avoids the PM to send multiple SUB_CLOSED events for the initial subflow. A fix for v5.12. Patch 13 validates the previous patch. Patch 14 stops treating the ADD_ADDR 0 as a new address, and accepts it in order to re-create the initial subflow if it has been closed, even if the limit for *new* addresses -- not taking into account the address of the initial subflow -- has been reached. A fix for v5.10. Patch 15 validates the previous patch. Signed-off-by: Matthieu Baerts (NGI0) --- Matthieu Baerts (NGI0) (15): mptcp: pm: reuse ID 0 after delete and re-add mptcp: pm: fix RM_ADDR ID for the initial subflow selftests: mptcp: join: check removing ID 0 endpoint mptcp: pm: send ACK on an active subflow mptcp: pm: skip connecting to already established sf mptcp: pm: reset MPC endp ID when re-added selftests: mptcp: join: check re-adding init endp with != id selftests: mptcp: join: no extra msg if no counter mptcp: pm: do not remove already closed subflows mptcp: pm: fix ID 0 endp usage after multiple re-creations selftests: mptcp: join: check re-re-adding ID 0 endp mptcp: avoid duplicated SUB_CLOSED events selftests: mptcp: join: validate event numbers mptcp: pm: ADD_ADDR 0 is not a new address selftests: mptcp: join: check re-re-adding ID 0 signal net/mptcp/pm.c | 4 +- net/mptcp/pm_netlink.c | 87 ++++++++++---- net/mptcp/protocol.c | 6 + net/mptcp/protocol.h | 5 +- tools/testing/selftests/net/mptcp/mptcp_join.sh | 153 ++++++++++++++++++++---- tools/testing/selftests/net/mptcp/mptcp_lib.sh | 4 + 6 files changed, 209 insertions(+), 50 deletions(-) --- base-commit: 3a0504d54b3b57f0d7bf3d9184a00c9f8887f6d7 change-id: 20240826-net-mptcp-more-pm-fix-ffa61a36f817 Best regards, ==================== Link: https://patch.msgid.link/20240828-net-mptcp-more-pm-fix-v2-0-7f11b283fff7@kernel.org Signed-off-by: Paolo Abeni commit f18fa2abf81099d822d842a107f8c9889c86043c Author: Matthieu Baerts (NGI0) Date: Wed Aug 28 08:14:38 2024 +0200 selftests: mptcp: join: check re-re-adding ID 0 signal This test extends "delete re-add signal" to validate the previous commit: when the 'signal' endpoint linked to the initial subflow (ID 0) is re-added multiple times, it will re-send the ADD_ADDR with id 0. The client should still be able to re-create this subflow, even if the add_addr_accepted limit has been reached as this special address is not considered as a new address. The 'Fixes' tag here below is the same as the one from the previous commit: this patch here is not fixing anything wrong in the selftests, but it validates the previous fix for an issue introduced by this commit ID. Fixes: d0876b2284cf ("mptcp: add the incoming RM_ADDR support") Cc: stable@vger.kernel.org Reviewed-by: Mat Martineau Signed-off-by: Matthieu Baerts (NGI0) Signed-off-by: Paolo Abeni tools/testing/selftests/net/mptcp/mptcp_join.sh | 32 ++++++++++++++++--------- 1 file changed, 21 insertions(+), 11 deletions(-) commit 57f86203b41c98b322119dfdbb1ec54ce5e3369b Author: Matthieu Baerts (NGI0) Date: Wed Aug 28 08:14:37 2024 +0200 mptcp: pm: ADD_ADDR 0 is not a new address The ADD_ADDR 0 with the address from the initial subflow should not be considered as a new address: this is not something new. If the host receives it, it simply means that the address is available again. When receiving an ADD_ADDR for the ID 0, the PM already doesn't consider it as new by not incrementing the 'add_addr_accepted' counter. But the 'accept_addr' might not be set if the limit has already been reached: this can be bypassed in this case. But before, it is important to check that this ADD_ADDR for the ID 0 is for the same address as the initial subflow. If not, it is not something that should happen, and the ADD_ADDR can be ignored. Note that if an ADD_ADDR is received while there is already a subflow opened using the same address, this ADD_ADDR is ignored as well. It means that if multiple ADD_ADDR for ID 0 are received, there will not be any duplicated subflows created by the client. Fixes: d0876b2284cf ("mptcp: add the incoming RM_ADDR support") Cc: stable@vger.kernel.org Reviewed-by: Mat Martineau Signed-off-by: Matthieu Baerts (NGI0) Signed-off-by: Paolo Abeni net/mptcp/pm.c | 4 +++- net/mptcp/pm_netlink.c | 9 +++++++++ net/mptcp/protocol.h | 2 ++ 3 files changed, 14 insertions(+), 1 deletion(-) commit 20ccc7c5f7a3aa48092441a4b182f9f40418392e Author: Matthieu Baerts (NGI0) Date: Wed Aug 28 08:14:36 2024 +0200 selftests: mptcp: join: validate event numbers This test extends "delete and re-add" and "delete re-add signal" to validate the previous commit: the number of MPTCP events are checked to make sure there are no duplicated or unexpected ones. A new helper has been introduced to easily check these events. The missing events have been added to the lib. The 'Fixes' tag here below is the same as the one from the previous commit: this patch here is not fixing anything wrong in the selftests, but it validates the previous fix for an issue introduced by this commit ID. Fixes: b911c97c7dc7 ("mptcp: add netlink event support") Cc: stable@vger.kernel.org Reviewed-by: Mat Martineau Signed-off-by: Matthieu Baerts (NGI0) Signed-off-by: Paolo Abeni tools/testing/selftests/net/mptcp/mptcp_join.sh | 74 ++++++++++++++++++++++++- tools/testing/selftests/net/mptcp/mptcp_lib.sh | 4 ++ 2 files changed, 75 insertions(+), 3 deletions(-) commit d82809b6c5f2676b382f77a5cbeb1a5d91ed2235 Author: Matthieu Baerts (NGI0) Date: Wed Aug 28 08:14:35 2024 +0200 mptcp: avoid duplicated SUB_CLOSED events The initial subflow might have already been closed, but still in the connection list. When the worker is instructed to close the subflows that have been marked as closed, it might then try to close the initial subflow again. A consequence of that is that the SUB_CLOSED event can be seen twice: # ip mptcp endpoint 1.1.1.1 id 1 subflow dev eth0 2.2.2.2 id 2 subflow dev eth1 # ip mptcp monitor & [ CREATED] remid=0 locid=0 saddr4=1.1.1.1 daddr4=9.9.9.9 [ ESTABLISHED] remid=0 locid=0 saddr4=1.1.1.1 daddr4=9.9.9.9 [ SF_ESTABLISHED] remid=0 locid=2 saddr4=2.2.2.2 daddr4=9.9.9.9 # ip mptcp endpoint delete id 1 [ SF_CLOSED] remid=0 locid=0 saddr4=1.1.1.1 daddr4=9.9.9.9 [ SF_CLOSED] remid=0 locid=0 saddr4=1.1.1.1 daddr4=9.9.9.9 The first one is coming from mptcp_pm_nl_rm_subflow_received(), and the second one from __mptcp_close_subflow(). To avoid doing the post-closed processing twice, the subflow is now marked as closed the first time. Note that it is not enough to check if we are dealing with the first subflow and check its sk_state: the subflow might have been reset or closed before calling mptcp_close_ssk(). Fixes: b911c97c7dc7 ("mptcp: add netlink event support") Cc: stable@vger.kernel.org Tested-by: Arınç ÜNAL Reviewed-by: Mat Martineau Signed-off-by: Matthieu Baerts (NGI0) Signed-off-by: Paolo Abeni net/mptcp/protocol.c | 6 ++++++ net/mptcp/protocol.h | 3 ++- 2 files changed, 8 insertions(+), 1 deletion(-) commit d397d7246c11ca36c33c932bc36d38e3a79e9aa0 Author: Matthieu Baerts (NGI0) Date: Wed Aug 28 08:14:34 2024 +0200 selftests: mptcp: join: check re-re-adding ID 0 endp This test extends "delete and re-add" to validate the previous commit: when the endpoint linked to the initial subflow (ID 0) is re-added multiple times, it was no longer being used, because the internal linked counters are not decremented for this special endpoint: it is not an additional endpoint. Here, the "del/add id 0" steps are done 3 times to unsure this case is validated. The 'Fixes' tag here below is the same as the one from the previous commit: this patch here is not fixing anything wrong in the selftests, but it validates the previous fix for an issue introduced by this commit ID. Fixes: 3ad14f54bd74 ("mptcp: more accurate MPC endpoint tracking") Cc: stable@vger.kernel.org Reviewed-by: Mat Martineau Signed-off-by: Matthieu Baerts (NGI0) Signed-off-by: Paolo Abeni tools/testing/selftests/net/mptcp/mptcp_join.sh | 27 ++++++++++++++----------- 1 file changed, 15 insertions(+), 12 deletions(-) commit 9366922adc6a71378ca01f898c41be295309f044 Author: Matthieu Baerts (NGI0) Date: Wed Aug 28 08:14:33 2024 +0200 mptcp: pm: fix ID 0 endp usage after multiple re-creations 'local_addr_used' and 'add_addr_accepted' are decremented for addresses not related to the initial subflow (ID0), because the source and destination addresses of the initial subflows are known from the beginning: they don't count as "additional local address being used" or "ADD_ADDR being accepted". It is then required not to increment them when the entrypoint used by the initial subflow is removed and re-added during a connection. Without this modification, this entrypoint cannot be removed and re-added more than once. Reported-by: Arınç ÜNAL Closes: https://github.com/multipath-tcp/mptcp_net-next/issues/512 Fixes: 3ad14f54bd74 ("mptcp: more accurate MPC endpoint tracking") Reported-by: syzbot+455d38ecd5f655fc45cf@syzkaller.appspotmail.com Closes: https://lore.kernel.org/00000000000049861306209237f4@google.com Cc: stable@vger.kernel.org Tested-by: Arınç ÜNAL Reviewed-by: Mat Martineau Signed-off-by: Matthieu Baerts (NGI0) Signed-off-by: Paolo Abeni net/mptcp/pm_netlink.c | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) commit 58e1b66b4e4b8a602d3f2843e8eba00a969ecce2 Author: Matthieu Baerts (NGI0) Date: Wed Aug 28 08:14:32 2024 +0200 mptcp: pm: do not remove already closed subflows It is possible to have in the list already closed subflows, e.g. the initial subflow has been already closed, but still in the list. No need to try to close it again, and increments the related counters again. Fixes: 0ee4261a3681 ("mptcp: implement mptcp_pm_remove_subflow") Cc: stable@vger.kernel.org Reviewed-by: Mat Martineau Signed-off-by: Matthieu Baerts (NGI0) Signed-off-by: Paolo Abeni net/mptcp/pm_netlink.c | 2 ++ 1 file changed, 2 insertions(+) commit 76a2d8394cc183df872adf04bf636eaf42746449 Author: Matthieu Baerts (NGI0) Date: Wed Aug 28 08:14:31 2024 +0200 selftests: mptcp: join: no extra msg if no counter The checksum and fail counters might not be available. Then no need to display an extra message with missing info. While at it, fix the indentation around, which is wrong since the same commit. Fixes: 47867f0a7e83 ("selftests: mptcp: join: skip check if MIB counter not supported") Cc: stable@vger.kernel.org Reviewed-by: Geliang Tang Signed-off-by: Matthieu Baerts (NGI0) Signed-off-by: Paolo Abeni tools/testing/selftests/net/mptcp/mptcp_join.sh | 16 ++++++++-------- 1 file changed, 8 insertions(+), 8 deletions(-) commit 1c2326fcae4f0c5de8ad0d734ced43a8e5f17dac Author: Matthieu Baerts (NGI0) Date: Wed Aug 28 08:14:30 2024 +0200 selftests: mptcp: join: check re-adding init endp with != id The initial subflow has a special local ID: 0. It is specific per connection. When a global endpoint is deleted and re-added later, it can have a different ID, but the kernel should still use the ID 0 if it corresponds to the initial address. This test validates this behaviour: the endpoint linked to the initial subflow is removed, and re-added with a different ID. Note that removing the initial subflow will not decrement the 'subflows' counters, which corresponds to the *additional* subflows. On the other hand, when the same endpoint is re-added, it will increment this counter, as it will be seen as an additional subflow this time. The 'Fixes' tag here below is the same as the one from the previous commit: this patch here is not fixing anything wrong in the selftests, but it validates the previous fix for an issue introduced by this commit ID. Fixes: 3ad14f54bd74 ("mptcp: more accurate MPC endpoint tracking") Cc: stable@vger.kernel.org Reviewed-by: Mat Martineau Signed-off-by: Matthieu Baerts (NGI0) Signed-off-by: Paolo Abeni tools/testing/selftests/net/mptcp/mptcp_join.sh | 21 ++++++++++++++++----- 1 file changed, 16 insertions(+), 5 deletions(-) commit dce1c6d1e92535f165219695a826caedcca4e9b9 Author: Matthieu Baerts (NGI0) Date: Wed Aug 28 08:14:29 2024 +0200 mptcp: pm: reset MPC endp ID when re-added The initial subflow has a special local ID: 0. It is specific per connection. When a global endpoint is deleted and re-added later, it can have a different ID -- most services managing the endpoints automatically don't force the ID to be the same as before. It is then important to track these modifications to be consistent with the ID being used for the address used by the initial subflow, not to confuse the other peer or to send the ID 0 for the wrong address. Now when removing an endpoint, msk->mpc_endpoint_id is reset if it corresponds to this endpoint. When adding a new endpoint, the same variable is updated if the address match the one of the initial subflow. Fixes: 3ad14f54bd74 ("mptcp: more accurate MPC endpoint tracking") Cc: stable@vger.kernel.org Reviewed-by: Mat Martineau Signed-off-by: Matthieu Baerts (NGI0) Signed-off-by: Paolo Abeni net/mptcp/pm_netlink.c | 13 +++++++++++-- 1 file changed, 11 insertions(+), 2 deletions(-) commit bc19ff57637ff563d2bdf2b385b48c41e6509e0d Author: Matthieu Baerts (NGI0) Date: Wed Aug 28 08:14:28 2024 +0200 mptcp: pm: skip connecting to already established sf The lookup_subflow_by_daddr() helper checks if there is already a subflow connected to this address. But there could be a subflow that is closing, but taking time due to some reasons: latency, losses, data to process, etc. If an ADD_ADDR is received while the endpoint is being closed, it is better to try connecting to it, instead of rejecting it: the peer which has sent the ADD_ADDR will not be notified that the ADD_ADDR has been rejected for this reason, and the expected subflow will not be created at the end. This helper should then only look for subflows that are established, or going to be, but not the ones being closed. Fixes: d84ad04941c3 ("mptcp: skip connecting the connected address") Cc: stable@vger.kernel.org Reviewed-by: Mat Martineau Signed-off-by: Matthieu Baerts (NGI0) Signed-off-by: Paolo Abeni net/mptcp/pm_netlink.c | 9 ++++++--- 1 file changed, 6 insertions(+), 3 deletions(-) commit c07cc3ed895f9bfe0c53b5ed6be710c133b4271c Author: Matthieu Baerts (NGI0) Date: Wed Aug 28 08:14:27 2024 +0200 mptcp: pm: send ACK on an active subflow Taking the first one on the list doesn't work in some cases, e.g. if the initial subflow is being removed. Pick another one instead of not sending anything. Fixes: 84dfe3677a6f ("mptcp: send out dedicated ADD_ADDR packet") Cc: stable@vger.kernel.org Reviewed-by: Mat Martineau Signed-off-by: Matthieu Baerts (NGI0) Signed-off-by: Paolo Abeni net/mptcp/pm_netlink.c | 9 ++++++--- 1 file changed, 6 insertions(+), 3 deletions(-) commit 5f94b08c001290acda94d9d8868075590931c198 Author: Matthieu Baerts (NGI0) Date: Wed Aug 28 08:14:26 2024 +0200 selftests: mptcp: join: check removing ID 0 endpoint Removing the endpoint linked to the initial subflow should trigger a RM_ADDR for the right ID, and the removal of the subflow. That's what is now being verified in the "delete and re-add" test. Note that removing the initial subflow will not decrement the 'subflows' counters, which corresponds to the *additional* subflows. On the other hand, when the same endpoint is re-added, it will increment this counter, as it will be seen as an additional subflow this time. The 'Fixes' tag here below is the same as the one from the previous commit: this patch here is not fixing anything wrong in the selftests, but it validates the previous fix for an issue introduced by this commit ID. Fixes: 3ad14f54bd74 ("mptcp: more accurate MPC endpoint tracking") Cc: stable@vger.kernel.org Reviewed-by: Mat Martineau Signed-off-by: Matthieu Baerts (NGI0) Signed-off-by: Paolo Abeni tools/testing/selftests/net/mptcp/mptcp_join.sh | 25 ++++++++++++++++++------- 1 file changed, 18 insertions(+), 7 deletions(-) commit 87b5896f3f7848130095656739b05881904e2697 Author: Matthieu Baerts (NGI0) Date: Wed Aug 28 08:14:25 2024 +0200 mptcp: pm: fix RM_ADDR ID for the initial subflow The initial subflow has a special local ID: 0. When an endpoint is being deleted, it is then important to check if its address is not linked to the initial subflow to send the right ID. If there was an endpoint linked to the initial subflow, msk's mpc_endpoint_id field will be set. We can then use this info when an endpoint is being removed to see if it is linked to the initial subflow. So now, the correct IDs are passed to mptcp_pm_nl_rm_addr_or_subflow(), it is no longer needed to use mptcp_local_id_match(). Fixes: 3ad14f54bd74 ("mptcp: more accurate MPC endpoint tracking") Cc: stable@vger.kernel.org Reviewed-by: Mat Martineau Signed-off-by: Matthieu Baerts (NGI0) Signed-off-by: Paolo Abeni net/mptcp/pm_netlink.c | 28 +++++++++++++++------------- 1 file changed, 15 insertions(+), 13 deletions(-) commit 8b8ed1b429f8fa7ebd5632555e7b047bc0620075 Author: Matthieu Baerts (NGI0) Date: Wed Aug 28 08:14:24 2024 +0200 mptcp: pm: reuse ID 0 after delete and re-add When the endpoint used by the initial subflow is removed and re-added later, the PM has to force the ID 0, it is a special case imposed by the MPTCP specs. Note that the endpoint should then need to be re-added reusing the same ID. Fixes: 3ad14f54bd74 ("mptcp: more accurate MPC endpoint tracking") Cc: stable@vger.kernel.org Reviewed-by: Mat Martineau Signed-off-by: Matthieu Baerts (NGI0) Signed-off-by: Paolo Abeni net/mptcp/pm_netlink.c | 10 ++++++++++ 1 file changed, 10 insertions(+) commit bd3755c1cf2a605604b0d7630ab84d083b9bc5d7 Merge: 5be63fc19fca 849f0d5880b7 Author: Dave Airlie Date: Thu Aug 29 15:32:03 2024 +1000 Merge tag 'amd-drm-fixes-6.11-2024-08-28' of https://gitlab.freedesktop.org/agd5f/linux into drm-fixes amd-drm-fixes-6.11-2024-08-28: amdgpu: - SWSMU gaming stability fix - SMU 13.0.7 fix - SWSMU documentation alignment fix - SMU 14.0.x fixes - GC 12.x fix - Display fix - IP discovery fix - SMU 13.0.6 fix Signed-off-by: Dave Airlie From: Alex Deucher Link: https://patchwork.freedesktop.org/patch/msgid/20240828184908.125387-1-alexander.deucher@amd.com commit 734ad0af3609464f8f93e00b6c0de1e112f44559 Author: Nysal Jan K.A. Date: Thu Aug 29 07:58:27 2024 +0530 powerpc/qspinlock: Fix deadlock in MCS queue If an interrupt occurs in queued_spin_lock_slowpath() after we increment qnodesp->count and before node->lock is initialized, another CPU might see stale lock values in get_tail_qnode(). If the stale lock value happens to match the lock on that CPU, then we write to the "next" pointer of the wrong qnode. This causes a deadlock as the former CPU, once it becomes the head of the MCS queue, will spin indefinitely until it's "next" pointer is set by its successor in the queue. Running stress-ng on a 16 core (16EC/16VP) shared LPAR, results in occasional lockups similar to the following: $ stress-ng --all 128 --vm-bytes 80% --aggressive \ --maximize --oomable --verify --syslog \ --metrics --times --timeout 5m watchdog: CPU 15 Hard LOCKUP ...... NIP [c0000000000b78f4] queued_spin_lock_slowpath+0x1184/0x1490 LR [c000000001037c5c] _raw_spin_lock+0x6c/0x90 Call Trace: 0xc000002cfffa3bf0 (unreliable) _raw_spin_lock+0x6c/0x90 raw_spin_rq_lock_nested.part.135+0x4c/0xd0 sched_ttwu_pending+0x60/0x1f0 __flush_smp_call_function_queue+0x1dc/0x670 smp_ipi_demux_relaxed+0xa4/0x100 xive_muxed_ipi_action+0x20/0x40 __handle_irq_event_percpu+0x80/0x240 handle_irq_event_percpu+0x2c/0x80 handle_percpu_irq+0x84/0xd0 generic_handle_irq+0x54/0x80 __do_irq+0xac/0x210 __do_IRQ+0x74/0xd0 0x0 do_IRQ+0x8c/0x170 hardware_interrupt_common_virt+0x29c/0x2a0 --- interrupt: 500 at queued_spin_lock_slowpath+0x4b8/0x1490 ...... NIP [c0000000000b6c28] queued_spin_lock_slowpath+0x4b8/0x1490 LR [c000000001037c5c] _raw_spin_lock+0x6c/0x90 --- interrupt: 500 0xc0000029c1a41d00 (unreliable) _raw_spin_lock+0x6c/0x90 futex_wake+0x100/0x260 do_futex+0x21c/0x2a0 sys_futex+0x98/0x270 system_call_exception+0x14c/0x2f0 system_call_vectored_common+0x15c/0x2ec The following code flow illustrates how the deadlock occurs. For the sake of brevity, assume that both locks (A and B) are contended and we call the queued_spin_lock_slowpath() function. CPU0 CPU1 ---- ---- spin_lock_irqsave(A) | spin_unlock_irqrestore(A) | spin_lock(B) | | | ▼ | id = qnodesp->count++; | (Note that nodes[0].lock == A) | | | ▼ | Interrupt | (happens before "nodes[0].lock = B") | | | ▼ | spin_lock_irqsave(A) | | | ▼ | id = qnodesp->count++ | nodes[1].lock = A | | | ▼ | Tail of MCS queue | | spin_lock_irqsave(A) ▼ | Head of MCS queue ▼ | CPU0 is previous tail ▼ | Spin indefinitely ▼ (until "nodes[1].next != NULL") prev = get_tail_qnode(A, CPU0) | ▼ prev == &qnodes[CPU0].nodes[0] (as qnodes[CPU0].nodes[0].lock == A) | ▼ WRITE_ONCE(prev->next, node) | ▼ Spin indefinitely (until nodes[0].locked == 1) Thanks to Saket Kumar Bhaskar for help with recreating the issue Fixes: 84990b169557 ("powerpc/qspinlock: add mcs queueing for contended waiters") Cc: stable@vger.kernel.org # v6.2+ Reported-by: Geetika Moolchandani Reported-by: Vaishnavi Bhat Reported-by: Jijo Varghese Signed-off-by: Nysal Jan K.A. Reviewed-by: Nicholas Piggin Signed-off-by: Michael Ellerman Link: https://msgid.link/20240829022830.1164355-1-nysal@linux.ibm.com arch/powerpc/lib/qspinlock.c | 10 +++++++++- 1 file changed, 9 insertions(+), 1 deletion(-) commit d5d547aa7b51467b15d9caa86b116f8c2507c72a Merge: 928f79a188aa 28f5df210d06 Author: Linus Torvalds Date: Thu Aug 29 13:59:18 2024 +1200 Merge tag 'random-6.11-rc6-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/crng/random Pull random number generator fix from Jason Donenfeld: "Reject invalid flags passed to vgetrandom() in the same way that getrandom() does, so that the behavior is the same, from Yann. The flags argument to getrandom() only has a behavioral effect on the function if the RNG isn't initialized yet, so vgetrandom() falls back to the syscall in that case. But if the RNG is initialized, all of the flags behave the same way, so vgetrandom() didn't bother checking them, and just ignored them entirely. But that doesn't account for invalid flags passed in, which need to be rejected so we can use them later" * tag 'random-6.11-rc6-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/crng/random: random: vDSO: reject unknown getrandom() flags commit 0f9592ae26ffe044cfb2b2d071ccf4427be57ed4 Author: Mary Guillemard Date: Mon Aug 19 00:24:42 2024 +0200 scsi: ufs: ufs-mediatek: Add UFSHCD_QUIRK_BROKEN_LSDBS_CAP MT8183 implements the UFSHCI 2.1 spec but reports a bogus value of 1 in the reserved part for the Legacy Single Doorbell Support (LSDBS) capability. Set UFSHCD_QUIRK_BROKEN_LSDBS_CAP when MCQ support is explicitly disabled, allowing the device to be properly registered. Signed-off-by: Mary Guillemard Link: https://lore.kernel.org/r/20240818222442.44990-3-mary@mary.zone Reviewed-by: Peter Wang Signed-off-by: Martin K. Petersen drivers/ufs/host/ufs-mediatek.c | 3 +++ 1 file changed, 3 insertions(+) commit 0870b0d8b393dde53106678a1e2cec9dfa52f9b7 Author: Eric Dumazet Date: Tue Aug 27 11:49:16 2024 +0000 net: busy-poll: use ktime_get_ns() instead of local_clock() Typically, busy-polling durations are below 100 usec. When/if the busy-poller thread migrates to another cpu, local_clock() can be off by +/-2msec or more for small values of HZ, depending on the platform. Use ktimer_get_ns() to ensure deterministic behavior, which is the whole point of busy-polling. Fixes: 060212928670 ("net: add low latency socket poll") Fixes: 9a3c71aa8024 ("net: convert low latency sockets to sched_clock()") Fixes: 37089834528b ("sched, net: Fixup busy_loop_us_clock()") Signed-off-by: Eric Dumazet Cc: Mina Almasry Cc: Willem de Bruijn Reviewed-by: Joe Damato Link: https://patch.msgid.link/20240827114916.223377-1-edumazet@google.com Signed-off-by: Jakub Kicinski include/net/busy_poll.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 41901c227e00ca6cd1a42d1d59a51f3a5af1621b Merge: 3a0504d54b3b 094513f8a2fb Author: Jakub Kicinski Date: Wed Aug 28 16:54:44 2024 -0700 Merge tag 'wireless-2024-08-28' of git://git.kernel.org/pub/scm/linux/kernel/git/wireless/wireless Johannes Berg says: ==================== Regressions: * wfx: fix for open network connection * iwlwifi: fix for hibernate (due to fast resume feature) * iwlwifi: fix for a few warnings that were recently added (had previously been messages not warnings) Previously broken: * mwifiex: fix static structures used for per-device data * iwlwifi: some harmless FW related messages were tagged too high priority * iwlwifi: scan buffers weren't checked correctly * mac80211: SKB leak on beacon error path * iwlwifi: fix ACPI table interop with certain BIOSes * iwlwifi: fix locking for link selection * mac80211: fix SSID comparison in beacon validation * tag 'wireless-2024-08-28' of git://git.kernel.org/pub/scm/linux/kernel/git/wireless/wireless: wifi: iwlwifi: clear trans->state earlier upon error wifi: wfx: repair open network AP mode wifi: mac80211: free skb on error path in ieee80211_beacon_get_ap() wifi: iwlwifi: mvm: don't wait for tx queues if firmware is dead wifi: iwlwifi: mvm: allow 6 GHz channels in MLO scan wifi: iwlwifi: mvm: pause TCM when the firmware is stopped wifi: iwlwifi: fw: fix wgds rev 3 exact size wifi: iwlwifi: mvm: take the mutex before running link selection wifi: iwlwifi: mvm: fix iwl_mvm_max_scan_ie_fw_cmd_room() wifi: iwlwifi: mvm: fix iwl_mvm_scan_fits() calculation wifi: iwlwifi: lower message level for FW buffer destination wifi: iwlwifi: mvm: fix hibernation wifi: mac80211: fix beacon SSID mismatch handling wifi: mwifiex: duplicate static structs used in driver instances ==================== Link: https://patch.msgid.link/20240828100151.23662-3-johannes@sipsolutions.net Signed-off-by: Jakub Kicinski commit 76a0e79bc84f466999fa501fce5bf7a07641b8a7 Author: Scott Mayhew Date: Wed Aug 28 15:51:29 2024 -0400 selinux,smack: don't bypass permissions check in inode_setsecctx hook Marek Gresko reports that the root user on an NFS client is able to change the security labels on files on an NFS filesystem that is exported with root squashing enabled. The end of the kerneldoc comment for __vfs_setxattr_noperm() states: * This function requires the caller to lock the inode's i_mutex before it * is executed. It also assumes that the caller will make the appropriate * permission checks. nfsd_setattr() does do permissions checking via fh_verify() and nfsd_permission(), but those don't do all the same permissions checks that are done by security_inode_setxattr() and its related LSM hooks do. Since nfsd_setattr() is the only consumer of security_inode_setsecctx(), simplest solution appears to be to replace the call to __vfs_setxattr_noperm() with a call to __vfs_setxattr_locked(). This fixes the above issue and has the added benefit of causing nfsd to recall conflicting delegations on a file when a client tries to change its security label. Cc: stable@kernel.org Reported-by: Marek Gresko Link: https://bugzilla.kernel.org/show_bug.cgi?id=218809 Signed-off-by: Scott Mayhew Tested-by: Stephen Smalley Reviewed-by: Stephen Smalley Reviewed-by: Chuck Lever Reviewed-by: Jeff Layton Acked-by: Casey Schaufler Signed-off-by: Paul Moore security/selinux/hooks.c | 4 ++-- security/smack/smack_lsm.c | 4 ++-- 2 files changed, 4 insertions(+), 4 deletions(-) commit d11a67634227f9f9da51938af085fb41a733848f Author: Dawid Osuchowski Date: Wed Aug 21 18:06:40 2024 +0200 ice: Add netif_device_attach/detach into PF reset flow Ethtool callbacks can be executed while reset is in progress and try to access deleted resources, e.g. getting coalesce settings can result in a NULL pointer dereference seen below. Reproduction steps: Once the driver is fully initialized, trigger reset: # echo 1 > /sys/class/net//device/reset when reset is in progress try to get coalesce settings using ethtool: # ethtool -c BUG: kernel NULL pointer dereference, address: 0000000000000020 PGD 0 P4D 0 Oops: Oops: 0000 [#1] PREEMPT SMP PTI CPU: 11 PID: 19713 Comm: ethtool Tainted: G S 6.10.0-rc7+ #7 RIP: 0010:ice_get_q_coalesce+0x2e/0xa0 [ice] RSP: 0018:ffffbab1e9bcf6a8 EFLAGS: 00010206 RAX: 000000000000000c RBX: ffff94512305b028 RCX: 0000000000000000 RDX: 0000000000000000 RSI: ffff9451c3f2e588 RDI: ffff9451c3f2e588 RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 R10: ffff9451c3f2e580 R11: 000000000000001f R12: ffff945121fa9000 R13: ffffbab1e9bcf760 R14: 0000000000000013 R15: ffffffff9e65dd40 FS: 00007faee5fbe740(0000) GS:ffff94546fd80000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000000000000020 CR3: 0000000106c2e005 CR4: 00000000001706f0 Call Trace: ice_get_coalesce+0x17/0x30 [ice] coalesce_prepare_data+0x61/0x80 ethnl_default_doit+0xde/0x340 genl_family_rcv_msg_doit+0xf2/0x150 genl_rcv_msg+0x1b3/0x2c0 netlink_rcv_skb+0x5b/0x110 genl_rcv+0x28/0x40 netlink_unicast+0x19c/0x290 netlink_sendmsg+0x222/0x490 __sys_sendto+0x1df/0x1f0 __x64_sys_sendto+0x24/0x30 do_syscall_64+0x82/0x160 entry_SYSCALL_64_after_hwframe+0x76/0x7e RIP: 0033:0x7faee60d8e27 Calling netif_device_detach() before reset makes the net core not call the driver when ethtool command is issued, the attempt to execute an ethtool command during reset will result in the following message: netlink error: No such device instead of NULL pointer dereference. Once reset is done and ice_rebuild() is executing, the netif_device_attach() is called to allow for ethtool operations to occur again in a safe manner. Fixes: fcea6f3da546 ("ice: Add stats and ethtool support") Suggested-by: Jakub Kicinski Reviewed-by: Igor Bagnucki Signed-off-by: Dawid Osuchowski Tested-by: Pucha Himasekhar Reddy (A Contingent worker at Intel) Reviewed-by: Michal Schmidt Signed-off-by: Tony Nguyen drivers/net/ethernet/intel/ice/ice_main.c | 7 +++++++ 1 file changed, 7 insertions(+) commit ba8cf80724dbc09825b52498e4efacb563935408 Author: Daiwei Li Date: Tue Aug 13 21:55:53 2024 -0700 igb: Fix not clearing TimeSync interrupts for 82580 82580 NICs have a hardware bug that makes it necessary to write into the TSICR (TimeSync Interrupt Cause) register to clear it: https://lore.kernel.org/all/CDCB8BE0.1EC2C%25matthew.vick@intel.com/ Add a conditional so only for 82580 we write into the TSICR register, so we don't risk losing events for other models. Without this change, when running ptp4l with an Intel 82580 card, I get the following output: > timed out while polling for tx timestamp increasing tx_timestamp_timeout or > increasing kworker priority may correct this issue, but a driver bug likely > causes it This goes away with this change. This (partially) reverts commit ee14cc9ea19b ("igb: Fix missing time sync events"). Fixes: ee14cc9ea19b ("igb: Fix missing time sync events") Closes: https://lore.kernel.org/intel-wired-lan/CAN0jFd1kO0MMtOh8N2Ztxn6f7vvDKp2h507sMryobkBKe=xk=w@mail.gmail.com/ Tested-by: Daiwei Li Suggested-by: Vinicius Costa Gomes Signed-off-by: Daiwei Li Acked-by: Vinicius Costa Gomes Reviewed-by: Kurt Kanzenbach Tested-by: Pucha Himasekhar Reddy (A Contingent worker at Intel) Signed-off-by: Tony Nguyen drivers/net/ethernet/intel/igb/igb_main.c | 10 ++++++++++ 1 file changed, 10 insertions(+) commit 91d1dfae464987aaf6c79ff51d8674880fb3be77 Author: David Howells Date: Wed Aug 28 21:08:25 2024 +0100 cifs: Fix FALLOC_FL_ZERO_RANGE to preflush buffered part of target region Under certain conditions, the range to be cleared by FALLOC_FL_ZERO_RANGE may only be buffered locally and not yet have been flushed to the server. For example: xfs_io -f -t -c "pwrite -S 0x41 0 4k" \ -c "pwrite -S 0x42 4k 4k" \ -c "fzero 0 4k" \ -c "pread -v 0 8k" /xfstest.test/foo will write two 4KiB blocks of data, which get buffered in the pagecache, and then fallocate() is used to clear the first 4KiB block on the server - but we don't flush the data first, which means the EOF position on the server is wrong, and so the FSCTL_SET_ZERO_DATA RPC fails (and xfs_io ignores the error), but then when we try to read it, we see the old data. Fix this by preflushing any part of the target region that above the server's idea of the EOF position to force the server to update its EOF position. Note, however, that we don't want to simply expand the file by moving the EOF before doing the FSCTL_SET_ZERO_DATA[*] because someone else might see the zeroed region or if the RPC fails we then have to try to clean it up or risk getting corruption. [*] And we have to move the EOF first otherwise FSCTL_SET_ZERO_DATA won't do what we want. This fixes the generic/008 xfstest. [!] Note: A better way to do this might be to split the operation into two parts: we only do FSCTL_SET_ZERO_DATA for the part of the range below the server's EOF and then, if that worked, invalidate the buffered pages for the part above the range. Fixes: 6b69040247e1 ("cifs/smb3: Fix data inconsistent when zero file range") Signed-off-by: David Howells cc: Steve French cc: Zhang Xiaoxu cc: Pavel Shilovsky cc: Paulo Alcantara cc: Shyam Prasad N cc: Rohith Surabattula cc: Jeff Layton cc: linux-cifs@vger.kernel.org cc: linux-mm@kvack.org Signed-off-by: Steve French fs/smb/client/smb2ops.c | 16 ++++++++++++++-- 1 file changed, 14 insertions(+), 2 deletions(-) commit 5325b96769a5b282e330023e1d0881018e89e266 Author: Zhang Yi Date: Fri Aug 16 19:49:21 2024 +0800 ASoC: mediatek: mt8188-mt6359: Modify key In order to get the correct keys when using the ES8326.We will associate SND_JACK_BTN_1 to KEY_VOLUMEUP and SND_JACK_BTN_2 to KEY_VOLUMEDOWN when the ES8326 flag is recognized. Signed-off-by: Zhang Yi Link: https://patch.msgid.link/20240816114921.48913-1-zhangyi@everest-semi.com Signed-off-by: Mark Brown sound/soc/mediatek/mt8188/mt8188-mt6359.c | 17 +++++++++++++---- 1 file changed, 13 insertions(+), 4 deletions(-) commit 3536c01d6577ce4612617ced32dbc891f39f9d64 Merge: ec57571b5dda 591940e22e28 Author: Arnd Bergmann Date: Wed Aug 28 20:28:51 2024 +0000 Merge tag 'riscv-soc-fixes-for-v6.11-rc6' of https://git.kernel.org/pub/scm/linux/kernel/git/conor/linux into arm/fixes RISC-V soc fixes for v6.11-rc6 Prevent an erroneous unconditional report of a timeout during firmware upload in the mpfs-auto-update driver. Signed-off-by: Conor Dooley * tag 'riscv-soc-fixes-for-v6.11-rc6' of https://git.kernel.org/pub/scm/linux/kernel/git/conor/linux: firmware: microchip: fix incorrect error report of programming:timeout on success Link: https://lore.kernel.org/r/20240828-fidelity-almighty-18d5434aaef0@spud Signed-off-by: Arnd Bergmann commit ec57571b5dda1fdd68b572e1e980c52d1edb0b0d Merge: 015a00ef55e7 dfbe93f32c12 Author: Arnd Bergmann Date: Wed Aug 28 20:28:15 2024 +0000 Merge tag 'qcom-arm64-fixes-for-6.11' of https://git.kernel.org/pub/scm/linux/kernel/git/qcom/linux into arm/fixes Qualcomm Arm64 DeviceTree fixes for v6.11 On X1E the GPU node is disabled by default, to be enabled in the individual devices once the developers install the required firmware. The generic EDP panel driver used on the X1E CRD is replaced with the Samsung ATNA45AF01 driver, in order to ensure backlight is brought back up after being turned off. The pin configuration for PCIe-related pins are corrected across all the X1E targets. The PCIe controllers gain a minimum OPP vote, and PCIe domain numbers are corrected. WiFi calibration variant information is added to the Lenovo Yoga Slim 7x, to pick the right data from the firmware packages. The incorrect Adreno SMMU global interrupt is corrected. For IPQ5332, the IRQ triggers for the USB controller are corrected. * tag 'qcom-arm64-fixes-for-6.11' of https://git.kernel.org/pub/scm/linux/kernel/git/qcom/linux: (23 commits) arm64: dts: qcom: x1e80100: Fix Adreno SMMU global interrupt arm64: dts: qcom: disable GPU on x1e80100 by default arm64: dts: qcom: x1e80100-crd: Fix backlight arm64: dts: qcom: x1e80100-yoga-slim7x: fix missing PCIe4 gpios arm64: dts: qcom: x1e80100-yoga-slim7x: disable PCIe6a perst pull down arm64: dts: qcom: x1e80100-yoga-slim7x: fix up PCIe6a pinctrl node arm64: dts: qcom: x1e80100-yoga-slim7x: fix PCIe4 PHY supply arm64: dts: qcom: x1e80100-vivobook-s15: fix missing PCIe4 gpios arm64: dts: qcom: x1e80100-vivobook-s15: disable PCIe6a perst pull down arm64: dts: qcom: x1e80100-vivobook-s15: fix up PCIe6a pinctrl node arm64: dts: qcom: x1e80100-vivobook-s15: fix PCIe4 PHY supply arm64: dts: qcom: x1e80100-qcp: fix missing PCIe4 gpios arm64: dts: qcom: x1e80100-qcp: disable PCIe6a perst pull down arm64: dts: qcom: x1e80100-qcp: fix up PCIe6a pinctrl node arm64: dts: qcom: x1e80100-qcp: fix PCIe4 PHY supply arm64: dts: qcom: x1e80100-crd: fix missing PCIe4 gpios arm64: dts: qcom: x1e80100-crd: disable PCIe6a perst pull down arm64: dts: qcom: x1e80100-crd: fix up PCIe6a pinctrl node arm64: dts: qcom: x1e80100: add missing PCIe minimum OPP arm64: dts: qcom: x1e80100: fix PCIe domain numbers ... Link: https://lore.kernel.org/r/20240826152426.1648383-1-andersson@kernel.org Signed-off-by: Arnd Bergmann commit 015a00ef55e78470d7a0d190ecfe89c4590a3035 Merge: d8f2638b835c 10f98bb9d981 Author: Arnd Bergmann Date: Wed Aug 28 20:28:00 2024 +0000 Merge tag 'qcom-arm64-defconfig-fixes-for-6.11' of https://git.kernel.org/pub/scm/linux/kernel/git/qcom/linux into arm/fixes Qualcomm Arm64 defconfig fix for 6.11 Enable the Samsung ATNA33XC20 display panel driver, as we switched from the generic EDP panel for some of the X1E devices in v6.11. * tag 'qcom-arm64-defconfig-fixes-for-6.11' of https://git.kernel.org/pub/scm/linux/kernel/git/qcom/linux: arm64: defconfig: Add CONFIG_DRM_PANEL_SAMSUNG_ATNA33XC20 Link: https://lore.kernel.org/r/20240826145736.1646729-1-andersson@kernel.org Signed-off-by: Arnd Bergmann commit d8f2638b835c9c7fd40c64828b576d3b809b399e Merge: 27795c50160d c158ceb82606 Author: Arnd Bergmann Date: Wed Aug 28 20:27:37 2024 +0000 Merge tag 'qcom-drivers-fixes-for-6.11' of https://git.kernel.org/pub/scm/linux/kernel/git/qcom/linux into arm/fixes Qualcomm driver fixes for v6.11 This corrects the tzmem virt-to-phys conversion, which caused issues for the uefisecapp implementation of EFI variable access. SDM670 is excluded from tzmem usage due to reported issues. The SCM get wait queue context call is corrected to be marked ATOMIC and some dead code in qseecom, following the tzmem conversion, is removed. The memory backing command DB is remapped writecombined, to avoid XPU violations when Linux runs without the Qualcomm hypervisor. Two compile fixes are added for pd-mapper, and the broken reference count is corrected, to make pd-mapper deal with remoteprocs going away. In pmic_glink a race condition where the client callbacks might be called before we returned the client handle is corrected. The broken conditions for when to signal that the firmware is going down is also corrected. In the pmic_glink UCSI driver, the ucsi_unregister() is moved out of the pdr callback, as this is being invoked in atomic context. Konrad's email address is updated in MAINTAINERS, and related mailmap entries are added. * tag 'qcom-drivers-fixes-for-6.11' of https://git.kernel.org/pub/scm/linux/kernel/git/qcom/linux: soc: qcom: pd-mapper: Fix singleton refcount firmware: qcom: tzmem: disable sdm670 platform soc: qcom: pmic_glink: Actually communicate when remote goes down usb: typec: ucsi: Move unregister out of atomic section soc: qcom: pmic_glink: Fix race during initialization firmware: qcom: qseecom: remove unused functions firmware: qcom: tzmem: fix virtual-to-physical address conversion firmware: qcom: scm: Mark get_wq_ctx() as atomic call MAINTAINERS: Update Konrad Dybcio's email address mailmap: Add an entry for Konrad Dybcio soc: qcom: pd-mapper: mark qcom_pdm_domains as __maybe_unused soc: qcom: cmd-db: Map shared memory as WC, not WB soc: qcom: pd-mapper: Depend on ARCH_QCOM || COMPILE_TEST Link: https://lore.kernel.org/r/20240826145209.1646159-1-andersson@kernel.org Signed-off-by: Arnd Bergmann commit 27795c50160d34b7503dd61d0644374a952cfea4 Merge: 0351a9841ba1 f149be46e4c1 Author: Arnd Bergmann Date: Wed Aug 28 20:27:24 2024 +0000 Merge tag 'imx-fixes-6.11' of https://git.kernel.org/pub/scm/linux/kernel/git/shawnguo/linux into arm/fixes i.MX fixes for 6.11: - One imx8mp-beacon-kit change from Adam Ford to fix the broken WM8962 audio support - One pinctrl property typo fix for imx8mm-phygate - One layerscape fix from Krzysztof Kozlowski to get thermal nodes correct name length - A couple of imx93-tqma9352 fixes from Markus Niebel, one on CMA alloc-ranges and the other on SD-Card cd-gpios typo - One change from Michal Vokáč to fix imx6dl-yapp43 LED current to match the HW design - A couple of imx95 fixes from Peng Fan, one to correct a55 power domains and the other to correct L3Cache cache-sets - One tqma9352 watchdog reset fix from Sascha Hauer - One imx93 change from Shenwei Wang to fix the default value for STMMAC EQOS snps,clk-csr * tag 'imx-fixes-6.11' of https://git.kernel.org/pub/scm/linux/kernel/git/shawnguo/linux: arm64: dts: imx8mm-phygate: fix typo pinctrcl-0 arm64: dts: imx95: correct L3Cache cache-sets arm64: dts: imx95: correct a55 power-domains arm64: dts: freescale: imx93-tqma9352-mba93xxla: fix typo arm64: dts: freescale: imx93-tqma9352: fix CMA alloc-ranges ARM: dts: imx6dl-yapp43: Increase LED current to match the yapp4 HW design arm64: dts: imx93: update default value for snps,clk-csr arm64: dts: freescale: tqma9352: Fix watchdog reset arm64: dts: imx8mp-beacon-kit: Fix Stereo Audio on WM8962 arm64: dts: layerscape: fix thermal node names length Link: https://lore.kernel.org/r/ZrtsTO1+jXhJ6GSM@dragon Signed-off-by: Arnd Bergmann commit 0351a9841ba1c8e299a9350e7e57668079dcf158 Merge: 47ac09b91bef 5062d9c0cbbc Author: Arnd Bergmann Date: Wed Aug 28 20:27:11 2024 +0000 Merge tag 'omap-for-v6.11/fixes-signed' of https://git.kernel.org/pub/scm/linux/kernel/git/khilman/linux-omap into arm/fixes OMAP fixes for v6.11-rc - omap3-n900: fix accelerometer orientation * tag 'omap-for-v6.11/fixes-signed' of https://git.kernel.org/pub/scm/linux/kernel/git/khilman/linux-omap: ARM: dts: omap3-n900: correct the accelerometer orientation Link: https://lore.kernel.org/r/7h4j7eyhyh.fsf@baylibre.com Signed-off-by: Arnd Bergmann commit be721b451affbecc4ba4eaac3b71cdbdcade1b1b Author: Brian Norris Date: Tue Aug 27 10:11:16 2024 -0700 spi: rockchip: Resolve unbalanced runtime PM / system PM handling Commit e882575efc77 ("spi: rockchip: Suspend and resume the bus during NOIRQ_SYSTEM_SLEEP_PM ops") stopped respecting runtime PM status and simply disabled clocks unconditionally when suspending the system. This causes problems when the device is already runtime suspended when we go to sleep -- in which case we double-disable clocks and produce a WARNing. Switch back to pm_runtime_force_{suspend,resume}(), because that still seems like the right thing to do, and the aforementioned commit makes no explanation why it stopped using it. Also, refactor some of the resume() error handling, because it's not actually a good idea to re-disable clocks on failure. Fixes: e882575efc77 ("spi: rockchip: Suspend and resume the bus during NOIRQ_SYSTEM_SLEEP_PM ops") Cc: stable@vger.kernel.org Reported-by: Ondřej Jirman Closes: https://lore.kernel.org/lkml/20220621154218.sau54jeij4bunf56@core/ Signed-off-by: Brian Norris Link: https://patch.msgid.link/20240827171126.1115748-1-briannorris@chromium.org Signed-off-by: Mark Brown drivers/spi/spi-rockchip.c | 23 +++++++---------------- 1 file changed, 7 insertions(+), 16 deletions(-) commit 928f79a188aacc057ba36c85b36b6d1e99c8f595 Merge: f9a59dd09749 4956e07f05e2 Author: Linus Torvalds Date: Thu Aug 29 07:15:41 2024 +1200 Merge tag 'loongarch-fixes-6.11-2' of git://git.kernel.org/pub/scm/linux/kernel/git/chenhuacai/linux-loongson Pull LoongArch fixes from Huacai Chen: "Remove the unused dma-direct.h, and some bug & warning fixes" * tag 'loongarch-fixes-6.11-2' of git://git.kernel.org/pub/scm/linux/kernel/git/chenhuacai/linux-loongson: LoongArch: KVM: Invalidate guest steal time address on vCPU reset LoongArch: Add ifdefs to fix LSX and LASX related warnings LoongArch: Define ARCH_IRQ_INIT_FLAGS as IRQ_NOPROBE LoongArch: Remove the unused dma-direct.h commit f9a59dd09749c6303821e5d6cdff1affdb5917dd Merge: a18093afa393 a3379eca24a7 Author: Linus Torvalds Date: Thu Aug 29 07:12:02 2024 +1200 Merge tag 'platform-drivers-x86-v6.11-5' of git://git.kernel.org/pub/scm/linux/kernel/git/pdx86/platform-drivers-x86 Pull x86 platform drivers fixes from Ilpo Järvinen: - platform/x86/amd/pmc: AMD 1Ah model 60h series support (2nd attempt) - asus-wmi: Prevent spurious rfkill on Asus Zenbook Duo - x86-android-tablets: Relax DMI match to cover another model * tag 'platform-drivers-x86-v6.11-5' of git://git.kernel.org/pub/scm/linux/kernel/git/pdx86/platform-drivers-x86: platform/x86: x86-android-tablets: Make Lenovo Yoga Tab 3 X90F DMI match less strict platform/x86: asus-wmi: Fix spurious rfkill on UX8406MA platform/x86/amd/pmc: Extend support for PMC features on new AMD platform platform/x86/amd/pmc: Fix SMU command submission path on new AMD platform commit a18093afa393d03599cbe42da2eb00d84a1c9a34 Merge: 2840526875c7 7e8ae8486e44 Author: Linus Torvalds Date: Thu Aug 29 06:20:44 2024 +1200 Merge tag 'nfsd-6.11-2' of git://git.kernel.org/pub/scm/linux/kernel/git/cel/linux Pull nfsd fixes from Chuck Lever: - Fix a number of crashers - Update email address for an NFSD reviewer * tag 'nfsd-6.11-2' of git://git.kernel.org/pub/scm/linux/kernel/git/cel/linux: fs/nfsd: fix update of inode attrs in CB_GETATTR nfsd: fix potential UAF in nfsd4_cb_getattr_release nfsd: hold reference to delegation when updating it for cb_getattr MAINTAINERS: Update Olga Kornievskaia's email address nfsd: prevent panic for nfsv4.0 closed files in nfs4_show_open nfsd: ensure that nfsd4_fattr_args.context is zeroed out commit 2840526875c7e3bcfb3364420b70efa203bad428 Merge: 86987d84b968 ecb54277cb63 Author: Linus Torvalds Date: Thu Aug 29 06:17:46 2024 +1200 Merge tag 'for-6.11-rc5-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/kdave/linux Pull btrfs fixes from David Sterba: - fix use-after-free when submitting bios for read, after an error and partially submitted bio the original one is freed while it can be still be accessed again - fix fstests case btrfs/301, with enabled quotas wait for delayed iputs when flushing delalloc - fix periodic block group reclaim, an unitialized value can be returned if there are no block groups to reclaim - fix build warning (-Wmaybe-uninitialized) * tag 'for-6.11-rc5-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/kdave/linux: btrfs: fix uninitialized return value from btrfs_reclaim_sweep() btrfs: fix a use-after-free when hitting errors inside btrfs_submit_chunk() btrfs: initialize last_extent_end to fix -Wmaybe-uninitialized warning in extent_fiemap() btrfs: run delayed iputs when flushing delalloc commit f7790d67785302b3116bbbfda62a5a44524601a3 Author: Joanne Koong Date: Mon Aug 26 14:19:04 2024 -0700 fuse: update stats for pages in dropped aux writeback list In the case where the aux writeback list is dropped (e.g. the pages have been truncated or the connection is broken), the stats for its pages and backing device info need to be updated as well. Fixes: e2653bd53a98 ("fuse: fix leaked aux requests") Signed-off-by: Joanne Koong Reviewed-by: Josef Bacik Cc: # v5.1 Signed-off-by: Miklos Szeredi fs/fuse/file.c | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-) commit 76a51ac00ca2a72fe3e168b7fb0e70f75ba6f512 Author: Miklos Szeredi Date: Wed Aug 28 15:55:17 2024 +0200 fuse: clear PG_uptodate when using a stolen page Originally when a stolen page was inserted into fuse's page cache by fuse_try_move_page(), it would be marked uptodate. Then fuse_readpages_end() would call SetPageUptodate() again on the already uptodate page. Commit 413e8f014c8b ("fuse: Convert fuse_readpages_end() to use folio_end_read()") changed that by replacing the SetPageUptodate() + unlock_page() combination with folio_end_read(), which does mostly the same, except it sets the uptodate flag with an xor operation, which in the above scenario resulted in the uptodate flag being cleared, which in turn resulted in EIO being returned on the read. Fix by clearing PG_uptodate instead of setting it in fuse_try_move_page(), conforming to the expectation of folio_end_read(). Reported-by: Jürg Billeter Debugged-by: Matthew Wilcox Fixes: 413e8f014c8b ("fuse: Convert fuse_readpages_end() to use folio_end_read()") Cc: # v6.10 Signed-off-by: Miklos Szeredi fs/fuse/dev.c | 5 +---- 1 file changed, 1 insertion(+), 4 deletions(-) commit 3002240d16494d798add0575e8ba1f284258ab34 Author: yangyun Date: Fri Aug 23 16:51:46 2024 +0800 fuse: fix memory leak in fuse_create_open The memory of struct fuse_file is allocated but not freed when get_create_ext return error. Fixes: 3e2b6fdbdc9a ("fuse: send security context of inode on file") Cc: stable@vger.kernel.org # v5.17 Signed-off-by: yangyun Signed-off-by: Miklos Szeredi fs/fuse/dir.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 97f30876c94382d1b01d45c2c76be8911b196527 Author: Joanne Koong Date: Thu Jul 25 10:53:34 2024 -0700 fuse: check aborted connection before adding requests to pending list for resending There is a race condition where inflight requests will not be aborted if they are in the middle of being re-sent when the connection is aborted. If fuse_resend has already moved all the requests in the fpq->processing lists to its private queue ("to_queue") and then the connection starts and finishes aborting, these requests will be added to the pending queue and remain on it indefinitely. Fixes: 760eac73f9f6 ("fuse: Introduce a new notification type for resend pending requests") Signed-off-by: Joanne Koong Reviewed-by: Josef Bacik Reviewed-by: Jingbo Xu Cc: # v6.9 Signed-off-by: Miklos Szeredi fs/fuse/dev.c | 9 +++++++++ 1 file changed, 9 insertions(+) commit b18915248a15eae7d901262f108d6ff0ffb4ffc1 Author: Jann Horn Date: Mon Aug 19 19:52:30 2024 +0200 fuse: use unsigned type for getxattr/listxattr size truncation The existing code uses min_t(ssize_t, outarg.size, XATTR_LIST_MAX) when parsing the FUSE daemon's response to a zero-length getxattr/listxattr request. On 32-bit kernels, where ssize_t and outarg.size are the same size, this is wrong: The min_t() will pass through any size values that are negative when interpreted as signed. fuse_listxattr() will then return this userspace-supplied negative value, which callers will treat as an error value. This kind of bug pattern can lead to fairly bad security bugs because of how error codes are used in the Linux kernel. If a caller were to convert the numeric error into an error pointer, like so: struct foo *func(...) { int len = fuse_getxattr(..., NULL, 0); if (len < 0) return ERR_PTR(len); ... } then it would end up returning this userspace-supplied negative value cast to a pointer - but the caller of this function wouldn't recognize it as an error pointer (IS_ERR_VALUE() only detects values in the narrow range in which legitimate errno values are), and so it would just be treated as a kernel pointer. I think there is at least one theoretical codepath where this could happen, but that path would involve virtio-fs with submounts plus some weird SELinux configuration, so I think it's probably not a concern in practice. Cc: stable@vger.kernel.org # v4.9 Fixes: 63401ccdb2ca ("fuse: limit xattr returned size") Signed-off-by: Jann Horn Signed-off-by: Miklos Szeredi fs/fuse/xattr.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) commit 8396c793ffdf28bb8aee7cfe0891080f8cab7890 Author: Sam Protsenko Date: Wed Mar 6 17:20:52 2024 -0600 mmc: dw_mmc: Fix IDMAC operation with pages bigger than 4K Commit 616f87661792 ("mmc: pass queue_limits to blk_mq_alloc_disk") [1] revealed the long living issue in dw_mmc.c driver, existing since the time when it was first introduced in commit f95f3850f7a9 ("mmc: dw_mmc: Add Synopsys DesignWare mmc host driver."), also making kernel boot broken on platforms using dw_mmc driver with 16K or 64K pages enabled, with this message in dmesg: mmcblk: probe of mmc0:0001 failed with error -22 That's happening because mmc_blk_probe() fails when it calls blk_validate_limits() consequently, which returns the error due to failed max_segment_size check in this code: /* * The maximum segment size has an odd historic 64k default that * drivers probably should override. Just like the I/O size we * require drivers to at least handle a full page per segment. */ ... if (WARN_ON_ONCE(lim->max_segment_size < PAGE_SIZE)) return -EINVAL; In case when IDMAC (Internal DMA Controller) is used, dw_mmc.c always sets .max_seg_size to 4 KiB: mmc->max_seg_size = 0x1000; The comment in the code above explains why it's incorrect. Arnd suggested setting .max_seg_size to .max_req_size to fix it, which is also what some other drivers are doing: $ grep -rl 'max_seg_size.*=.*max_req_size' drivers/mmc/host/ | \ wc -l 18 This change is not only fixing the boot with 16K/64K pages, but also leads to a better MMC performance. The linear write performance was tested on E850-96 board (eMMC only), before commit [1] (where it's possible to boot with 16K/64K pages without this fix, to be able to do a comparison). It was tested with this command: # dd if=/dev/zero of=somefile bs=1M count=500 oflag=sync Test results are as follows: - 4K pages, .max_seg_size = 4 KiB: 94.2 MB/s - 4K pages, .max_seg_size = .max_req_size = 512 KiB: 96.9 MB/s - 16K pages, .max_seg_size = 4 KiB: 126 MB/s - 16K pages, .max_seg_size = .max_req_size = 2 MiB: 128 MB/s - 64K pages, .max_seg_size = 4 KiB: 138 MB/s - 64K pages, .max_seg_size = .max_req_size = 8 MiB: 138 MB/s Unfortunately, SD card controller is not enabled in E850-96 yet, so it wasn't possible for me to run the test on some cheap SD cards to check this patch's impact on those. But it's possible that this change might also reduce the writes count, thus improving SD/eMMC longevity. All credit for the analysis and the suggested solution goes to Arnd. [1] https://lore.kernel.org/all/20240215070300.2200308-18-hch@lst.de/ Fixes: f95f3850f7a9 ("mmc: dw_mmc: Add Synopsys DesignWare mmc host driver.") Suggested-by: Arnd Bergmann Reported-by: Linux Kernel Functional Testing Closes: https://lore.kernel.org/all/CA+G9fYtddf2Fd3be+YShHP6CmSDNcn0ptW8qg+stUKW+Cn0rjQ@mail.gmail.com/ Signed-off-by: Sam Protsenko Cc: stable@vger.kernel.org Link: https://lore.kernel.org/r/20240306232052.21317-1-semen.protsenko@linaro.org Signed-off-by: Ulf Hansson drivers/mmc/host/dw_mmc.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) commit 9c68a3b03e8109f3917fd35f39043499897d4a79 Author: Gautham R. Shenoy Date: Wed Aug 28 15:40:35 2024 +0530 cpufreq/amd-pstate: Remove warning for X86_FEATURE_CPPC on certain Zen models commit bff7d13c190a ("cpufreq: amd-pstate: add debug message while CPPC is supported and disabled by SBIOS") issues a warning on plaforms where the X86_FEATURE_CPPC is expected to be enabled, but is not due to it being disabled in the BIOS. This feature bit corresponds to CPUID 0x80000008.ebx[27] which is a reserved bit on the Zen1 processors and a reserved bit on Zen2 based models 0x70-0x7F, and is expected to be cleared on these platforms. Thus printing the warning message for these models when X86_FEATURE_CPPC is unavailable is incorrect. Fix this. Modify some of the comments, and use switch-case for model range checking for improved readability while at it. Fixes: bff7d13c190a ("cpufreq: amd-pstate: add debug message while CPPC is supported and disabled by SBIOS") Cc: Xiaojian Du Reported-by: David Wang <00107082@163.com> Closes: https://lore.kernel.org/lkml/20240730140111.4491-1-00107082@163.com/ Signed-off-by: Gautham R. Shenoy Acked-by: Mario Limonciello Signed-off-by: Mario Limonciello drivers/cpufreq/amd-pstate.c | 34 ++++++++++++++++++++++++---------- 1 file changed, 24 insertions(+), 10 deletions(-) commit 6e540da4c1db7b840e347c4dfe48359b18b7e376 Author: Liao Chen Date: Mon Aug 26 12:48:51 2024 +0000 mmc: sdhci-of-aspeed: fix module autoloading Add MODULE_DEVICE_TABLE(), so modules could be properly autoloaded based on the alias from of_device_id table. Signed-off-by: Liao Chen Acked-by: Andrew Jeffery Fixes: bb7b8ec62dfb ("mmc: sdhci-of-aspeed: Add support for the ASPEED SD controller") Cc: stable@vger.kernel.org Link: https://lore.kernel.org/r/20240826124851.379759-1-liaochen4@huawei.com Signed-off-by: Ulf Hansson drivers/mmc/host/sdhci-of-aspeed.c | 1 + 1 file changed, 1 insertion(+) commit e33a97a830b230b79a98dbbb4121d4741a2be619 Author: Darrick J. Wong Date: Tue Aug 27 10:53:40 2024 -0700 block: fix detection of unsupported WRITE SAME in blkdev_issue_write_zeroes On error, blkdev_issue_write_zeroes used to recheck the block device's WRITE SAME queue limits after submitting WRITE SAME bios. As stated in the comment, the purpose of this was to collapse all IO errors to EOPNOTSUPP if the effect of issuing bios was that WRITE SAME got turned off in the queue limits. Therefore, it does not make sense to reuse the zeroes limit that was read earlier in the function because we only care about the queue limit *now*, not what it was at the start of the function. Found by running generic/351 from fstests. Fixes: 64b582ca88ca1 ("block: Read max write zeroes once for __blkdev_issue_write_zeroes()") Signed-off-by: Darrick J. Wong Reviewed-by: Christoph Hellwig Reviewed-by: John Garry Link: https://lore.kernel.org/r/20240827175340.GB1977952@frogsfrogsfrogs Signed-off-by: Jens Axboe block/blk-lib.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 9d824c7fce58f59982228aa85b0376b113cdfa35 Author: Tvrtko Ursulin Date: Tue Aug 13 11:25:04 2024 +0100 drm/v3d: Disable preemption while updating GPU stats We forgot to disable preemption around the write_seqcount_begin/end() pair while updating GPU stats: [ ] WARNING: CPU: 2 PID: 12 at include/linux/seqlock.h:221 __seqprop_assert.isra.0+0x128/0x150 [v3d] [ ] Workqueue: v3d_bin drm_sched_run_job_work [gpu_sched] <...snip...> [ ] Call trace: [ ] __seqprop_assert.isra.0+0x128/0x150 [v3d] [ ] v3d_job_start_stats.isra.0+0x90/0x218 [v3d] [ ] v3d_bin_job_run+0x23c/0x388 [v3d] [ ] drm_sched_run_job_work+0x520/0x6d0 [gpu_sched] [ ] process_one_work+0x62c/0xb48 [ ] worker_thread+0x468/0x5b0 [ ] kthread+0x1c4/0x1e0 [ ] ret_from_fork+0x10/0x20 Fix it. Cc: Maíra Canal Cc: stable@vger.kernel.org # v6.10+ Fixes: 6abe93b621ab ("drm/v3d: Fix race-condition between sysfs/fdinfo and interrupt handler") Signed-off-by: Tvrtko Ursulin Acked-by: Maíra Canal Signed-off-by: Maíra Canal Link: https://patchwork.freedesktop.org/patch/msgid/20240813102505.80512-1-tursulin@igalia.com drivers/gpu/drm/v3d/v3d_sched.c | 6 ++++++ 1 file changed, 6 insertions(+) commit 849f0d5880b7494030c4ee1e4fbaf2ca5422bca9 Author: Candice Li Date: Wed Aug 21 13:10:58 2024 +0800 drm/amd/pm: Drop unsupported features on smu v14_0_2 Drop unsupported features on smu v14_0_2. Signed-off-by: Candice Li Reviewed-by: Yang Wang Acked-by: Alex Deucher Signed-off-by: Alex Deucher (cherry picked from commit 3376f922bfe070eff762164b3fc66981e3079417) .../gpu/drm/amd/pm/swsmu/smu14/smu_v14_0_2_ppt.c | 47 ---------------------- 1 file changed, 47 deletions(-) commit badfdc6211f27803bc805fb56629f7d418670870 Author: Lijo Lazar Date: Fri Aug 16 14:34:17 2024 +0530 drm/amd/pm: Add support for new P2S table revision Add p2s table support for a new revision of SMUv13.0.6. Signed-off-by: Lijo Lazar Reviewed-by: Hawking Zhang Reviewed-by: Asad Kamal Acked-by: Alex Deucher Signed-off-by: Alex Deucher (cherry picked from commit 010cc730ace807c6d267481b5fb6ff99acc35c46) drivers/gpu/drm/amd/pm/swsmu/smu13/smu_v13_0_6_ppt.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) commit 6d5064c379557d92832b51d247b385bb8bd6aa5b Author: Likun Gao Date: Thu Aug 22 11:44:12 2024 +0800 drm/amdgpu: support for gc_info table v1.3 Add gc_info table v1.3 for IP discovery. Signed-off-by: Likun Gao Reviewed-by: Hawking Zhang Signed-off-by: Alex Deucher (cherry picked from commit 875ff9a7ee8824200885384effa7743892a34ed6) drivers/gpu/drm/amd/amdgpu/amdgpu_discovery.c | 11 +++++++ drivers/gpu/drm/amd/amdgpu/amdgpu_gfx.h | 6 ++++ drivers/gpu/drm/amd/include/discovery.h | 42 +++++++++++++++++++++++++++ 3 files changed, 59 insertions(+) commit 3b9a33235c773c7a3768060cf1d2cf8a9153bc37 Author: Ma Ke Date: Wed Aug 21 12:27:24 2024 +0800 drm/amd/display: avoid using null object of framebuffer Instead of using state->fb->obj[0] directly, get object from framebuffer by calling drm_gem_fb_get_obj() and return error code when object is null to avoid using null object of framebuffer. Fixes: 5d945cbcd4b1 ("drm/amd/display: Create a file dedicated to planes") Signed-off-by: Ma Ke Signed-off-by: Alex Deucher (cherry picked from commit 73dd0ad9e5dad53766ea3e631303430116f834b3) drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_plane.c | 9 +++++++-- 1 file changed, 7 insertions(+), 2 deletions(-) commit 959fc102ff4c39f5ab021da311c2cfd1d5602a0c Author: Alex Deucher Date: Tue Aug 20 13:11:22 2024 -0400 drm/amdgpu/gfx12: set UNORD_DISPATCH in compute MQDs This needs to be set to 1 to avoid a potential deadlock in the GC 10.x and newer. On GC 9.x and older, this needs to be set to 0. This can lead to hangs in some mixed graphics and compute workloads. Closes: https://gitlab.freedesktop.org/drm/amd/-/issues/3575 Reviewed-by: Hawking Zhang Signed-off-by: Alex Deucher (cherry picked from commit 40318a2406bd426c6f4591269669c04e8eda571d) drivers/gpu/drm/amd/amdgpu/gfx_v12_0.c | 2 +- drivers/gpu/drm/amd/amdkfd/kfd_mqd_manager_v12.c | 1 + 2 files changed, 2 insertions(+), 1 deletion(-) commit 37a45fb8db2619e03d26de59dbdb4ae2b0b02d7d Author: Kenneth Feng Date: Tue Aug 20 08:57:15 2024 +0800 drm/amd/pm: update message interface for smu v14.0.2/3 update message interface for smu v14.0.2/3 Signed-off-by: Kenneth Feng Reviewed-by: Yang Wang Signed-off-by: Alex Deucher (cherry picked from commit 01bfabc2d1d8aaffe5268f8df0843a6d916dcbaa) .../drm/amd/pm/swsmu/inc/pmfw_if/smu_v14_0_2_ppsmc.h | 18 ++++++++++++++---- drivers/gpu/drm/amd/pm/swsmu/smu14/smu_v14_0_2_ppt.c | 1 - 2 files changed, 14 insertions(+), 5 deletions(-) commit d420c857d85777663e8d16adfc24463f5d5c2dbc Author: Alex Deucher Date: Thu Aug 22 21:54:24 2024 -0400 drm/amdgpu/swsmu: always force a state reprogram on init Always reprogram the hardware state on init. This ensures the PMFW state is explicitly programmed and we are not relying on the default PMFW state. Closes: https://gitlab.freedesktop.org/drm/amd/-/issues/3131 Reviewed-by: Kenneth Feng Signed-off-by: Alex Deucher (cherry picked from commit c50fe289ed7207f71df3b5f1720512a9620e84fb) Cc: stable@vger.kernel.org drivers/gpu/drm/amd/pm/swsmu/amdgpu_smu.c | 15 +++++++++------ 1 file changed, 9 insertions(+), 6 deletions(-) commit 948f279dc48a6db17204f9b23f76b67abcd5d702 Author: Alex Deucher Date: Thu Aug 22 16:20:10 2024 -0400 drm/amdgpu/smu13.0.7: print index for profiles Print the index for the profiles. Closes: https://gitlab.freedesktop.org/drm/amd/-/issues/3543 Reviewed-by: Kenneth Feng Signed-off-by: Alex Deucher (cherry picked from commit b86a6a57b8ad1699ba8b1c270a79678383baf632) drivers/gpu/drm/amd/pm/swsmu/smu13/smu_v13_0_7_ppt.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) commit 8f614469de248a4bc55fb07e55d5f4c340c75b11 Author: Alex Deucher Date: Wed Aug 21 14:32:02 2024 -0400 drm/amdgpu: align pp_power_profile_mode with kernel docs The kernel doc says you need to select manual mode to adjust this, but the code only allows you to adjust it when manual mode is not selected. Remove the manual mode check. Reviewed-by: Kenneth Feng Signed-off-by: Alex Deucher (cherry picked from commit bbb05f8a9cd87f5046d05a0c596fddfb714ee457) Cc: stable@vger.kernel.org drivers/gpu/drm/amd/pm/swsmu/amdgpu_smu.c | 6 ++---- 1 file changed, 2 insertions(+), 4 deletions(-) commit 9f646ff25c09c52cebe726601db27a60f876f15e Author: Mrinmay Sarkar Date: Mon Aug 26 17:41:01 2024 +0530 dmaengine: dw-edma: Do not enable watermark interrupts for HDMA DW_HDMA_V0_LIE and DW_HDMA_V0_RIE are initialized as BIT(3) and BIT(4) respectively in dw_hdma_control enum. But as per HDMA register these bits are corresponds to LWIE and RWIE bit i.e local watermark interrupt enable and remote watermarek interrupt enable. In linked list mode LWIE and RWIE bits only enable the local and remote watermark interrupt. Since the watermark interrupts are not used but enabled, this leads to spurious interrupts getting generated. So remove the code that enables them to avoid generating spurious watermark interrupts. And also rename DW_HDMA_V0_LIE to DW_HDMA_V0_LWIE and DW_HDMA_V0_RIE to DW_HDMA_V0_RWIE as there is no LIE and RIE bits in HDMA and those bits are corresponds to LWIE and RWIE bits. Fixes: e74c39573d35 ("dmaengine: dw-edma: Add support for native HDMA") cc: stable@vger.kernel.org Signed-off-by: Mrinmay Sarkar Reviewed-by: Manivannan Sadhasivam Reviewed-by: Serge Semin Link: https://lore.kernel.org/r/1724674261-3144-3-git-send-email-quic_msarkar@quicinc.com Signed-off-by: Vinod Koul drivers/dma/dw-edma/dw-hdma-v0-core.c | 17 +++-------------- 1 file changed, 3 insertions(+), 14 deletions(-) commit 383baf5c8f062091af34c63f28d37642a8f188ae Author: Mrinmay Sarkar Date: Mon Aug 26 17:41:00 2024 +0530 dmaengine: dw-edma: Fix unmasking STOP and ABORT interrupts for HDMA The current logic is enabling both STOP_INT_MASK and ABORT_INT_MASK bit. This is apparently masking those particular interrupts rather than unmasking the same. If the interrupts are masked, they would never get triggered. So fix the issue by unmasking the STOP and ABORT interrupts properly. Fixes: e74c39573d35 ("dmaengine: dw-edma: Add support for native HDMA") cc: stable@vger.kernel.org Signed-off-by: Mrinmay Sarkar Reviewed-by: Manivannan Sadhasivam Link: https://lore.kernel.org/r/1724674261-3144-2-git-send-email-quic_msarkar@quicinc.com Signed-off-by: Vinod Koul drivers/dma/dw-edma/dw-hdma-v0-core.c | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-) commit 8101d6e112e2524e967368f920c404ae445a9757 Author: David Howells Date: Tue Aug 27 15:47:27 2024 +0100 cifs: Fix copy offload to flush destination region Fix cifs_file_copychunk_range() to flush the destination region before invalidating it to avoid potential loss of data should the copy fail, in whole or in part, in some way. Fixes: 7b2404a886f8 ("cifs: Fix flushing, invalidation and file size with copy_file_range()") Signed-off-by: David Howells cc: Steve French cc: Paulo Alcantara cc: Shyam Prasad N cc: Rohith Surabattula cc: Matthew Wilcox cc: Jeff Layton cc: linux-cifs@vger.kernel.org cc: linux-mm@kvack.org cc: linux-fsdevel@vger.kernel.org Signed-off-by: Steve French fs/smb/client/cifsfs.c | 21 ++++----------------- 1 file changed, 4 insertions(+), 17 deletions(-) commit 1da29f2c39b67b846b74205c81bf0ccd96d34727 Author: David Howells Date: Thu Aug 22 23:06:49 2024 +0100 netfs, cifs: Fix handling of short DIO read Short DIO reads, particularly in relation to cifs, are not being handled correctly by cifs and netfslib. This can be tested by doing a DIO read of a file where the size of read is larger than the size of the file. When it crosses the EOF, it gets a short read and this gets retried, and in the case of cifs, the retry read fails, with the failure being translated to ENODATA. Fix this by the following means: (1) Add a flag, NETFS_SREQ_HIT_EOF, for the filesystem to set when it detects that the read did hit the EOF. (2) Make the netfslib read assessment stop processing subrequests when it encounters one with that flag set. (3) Return rreq->transferred, the accumulated contiguous amount read to that point, to userspace for a DIO read. (4) Make cifs set the flag and clear the error if the read RPC returned ENODATA. (5) Make cifs set the flag and clear the error if a short read occurred without error and the read-to file position is now at the remote inode size. Fixes: 69c3c023af25 ("cifs: Implement netfslib hooks") Signed-off-by: David Howells cc: Steve French cc: Paulo Alcantara cc: Jeff Layton cc: linux-cifs@vger.kernel.org cc: netfs@lists.linux.dev cc: linux-fsdevel@vger.kernel.org Signed-off-by: Steve French fs/netfs/io.c | 17 +++++++++++------ fs/smb/client/smb2pdu.c | 13 +++++++++---- include/linux/netfs.h | 1 + 3 files changed, 21 insertions(+), 10 deletions(-) commit 6a5dcd487791e0c2d86622064602a5c7459941ed Author: David Howells Date: Thu Aug 22 23:06:48 2024 +0100 cifs: Fix lack of credit renegotiation on read retry When netfslib asks cifs to issue a read operation, it prefaces this with a call to ->clamp_length() which cifs uses to negotiate credits, providing receive capacity on the server; however, in the event that a read op needs reissuing, netfslib doesn't call ->clamp_length() again as that could shorten the subrequest, leaving a gap. This causes the retried read to be done with zero credits which causes the server to reject it with STATUS_INVALID_PARAMETER. This is a problem for a DIO read that is requested that would go over the EOF. The short read will be retried, causing EINVAL to be returned to the user when it fails. Fix this by making cifs_req_issue_read() negotiate new credits if retrying (NETFS_SREQ_RETRYING now gets set in the read side as well as the write side in this instance). This isn't sufficient, however: the new credits might not be sufficient to complete the remainder of the read, so also add an additional field, rreq->actual_len, that holds the actual size of the op we want to perform without having to alter subreq->len. We then rely on repeated short reads being retried until we finish the read or reach the end of file and make a zero-length read. Also fix a couple of places where the subrequest start and length need to be altered by the amount so far transferred when being used. Fixes: 69c3c023af25 ("cifs: Implement netfslib hooks") Signed-off-by: David Howells cc: Steve French cc: Paulo Alcantara cc: Jeff Layton cc: linux-cifs@vger.kernel.org cc: netfs@lists.linux.dev cc: linux-fsdevel@vger.kernel.org Signed-off-by: Steve French fs/netfs/io.c | 2 ++ fs/smb/client/cifsglob.h | 1 + fs/smb/client/file.c | 37 +++++++++++++++++++++++++++++++++---- fs/smb/client/smb2ops.c | 2 +- fs/smb/client/smb2pdu.c | 28 +++++++++++++++++----------- fs/smb/client/trace.h | 1 + 6 files changed, 55 insertions(+), 16 deletions(-) commit 5fa9f0480c7985e44e6ec32def0a395b768599cc Author: Vitaly Kuznetsov Date: Wed Aug 28 14:21:11 2024 +0200 KVM: SEV: Update KVM_AMD_SEV Kconfig entry and mention SEV-SNP SEV-SNP support is present since commit 1dfe571c12cf ("KVM: SEV: Add initial SEV-SNP support") but Kconfig entry wasn't updated and still mentions SEV and SEV-ES only. Add SEV-SNP there and, while on it, expand 'SEV' in the description as 'Encrypted VMs' is not what 'SEV' stands for. No functional change. Signed-off-by: Vitaly Kuznetsov Link: https://lore.kernel.org/r/20240828122111.160273-1-vkuznets@redhat.com Signed-off-by: Sean Christopherson arch/x86/kvm/Kconfig | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) commit e0be875c5bf03a9676a6bfed9e0f1766922a7dbd Author: Chen-Yu Tsai Date: Wed Aug 21 12:10:04 2024 +0800 ASoc: SOF: topology: Clear SOF link platform name upon unload The SOF topology loading function sets the device name for the platform component link. This should be unset when unloading the topology, otherwise a machine driver unbind/bind or reprobe would complain about an invalid component as having both its component name and of_node set: mt8186_mt6366 sound: ASoC: Both Component name/of_node are set for AFE_SOF_DL1 mt8186_mt6366 sound: error -EINVAL: Cannot register card mt8186_mt6366 sound: probe with driver mt8186_mt6366 failed with error -22 This happens with machine drivers that set the of_node separately. Clear the SOF link platform name in the topology unload callback. Fixes: 311ce4fe7637 ("ASoC: SOF: Add support for loading topologies") Signed-off-by: Chen-Yu Tsai Link: https://patch.msgid.link/20240821041006.2618855-1-wenst@chromium.org Signed-off-by: Mark Brown sound/soc/sof/topology.c | 2 ++ 1 file changed, 2 insertions(+) commit a547a5880cba6f287179135381f1b484b251be31 Author: Peter Newman Date: Thu Aug 22 12:02:11 2024 -0700 x86/resctrl: Fix arch_mbm_* array overrun on SNC When using resctrl on systems with Sub-NUMA Clustering enabled, monitoring groups may be allocated RMID values which would overrun the arch_mbm_{local,total} arrays. This is due to inconsistencies in whether the SNC-adjusted num_rmid value or the unadjusted value in resctrl_arch_system_num_rmid_idx() is used. The num_rmid value for the L3 resource is currently: resctrl_arch_system_num_rmid_idx() / snc_nodes_per_l3_cache As a simple fix, make resctrl_arch_system_num_rmid_idx() return the SNC-adjusted, L3 num_rmid value on x86. Fixes: e13db55b5a0d ("x86/resctrl: Introduce snc_nodes_per_l3_cache") Signed-off-by: Peter Newman Signed-off-by: Borislav Petkov (AMD) Reviewed-by: Reinette Chatre Link: https://lore.kernel.org/r/20240822190212.1848788-1-peternewman@google.com arch/x86/include/asm/resctrl.h | 6 ------ arch/x86/kernel/cpu/resctrl/core.c | 8 ++++++++ include/linux/resctrl.h | 1 + 3 files changed, 9 insertions(+), 6 deletions(-) commit a2ccc33b88e2953a6bf0b309e7e8849cc5320018 Author: Imre Deak Date: Fri Aug 23 19:29:18 2024 +0300 drm/i915/dp_mst: Fix MST state after a sink reset In some cases the sink can reset itself after it was configured into MST mode, without the driver noticing the disconnected state. For instance the reset may happen in the middle of a modeset, or the (long) HPD pulse generated may be not long enough for the encoder detect handler to observe the HPD's deasserted state. In this case the sink's DPCD register programmed to enable MST will be reset, while the driver still assumes MST is still enabled. Detect this condition, which will tear down and recreate/re-enable the MST topology. v2: - Add a code comment about adjusting the expected DP_MSTM_CTRL register value for SST + SideBand. (Suraj, Jani) - Print a debug message about detecting the link reset. (Jani) - Verify the DPCD MST state only if it wasn't already determined that the sink is disconnected. Cc: stable@vger.kernel.org Cc: Jani Nikula Closes: https://gitlab.freedesktop.org/drm/i915/kernel/-/issues/11195 Reviewed-by: Suraj Kandpal (v1) Signed-off-by: Imre Deak Link: https://patchwork.freedesktop.org/patch/msgid/20240823162918.1211875-1-imre.deak@intel.com (cherry picked from commit 594cf78dc36f31c0c7e0de4567e644f406d46bae) Signed-off-by: Joonas Lahtinen drivers/gpu/drm/i915/display/intel_dp.c | 12 +++++++++ drivers/gpu/drm/i915/display/intel_dp_mst.c | 40 +++++++++++++++++++++++++++++ drivers/gpu/drm/i915/display/intel_dp_mst.h | 1 + 3 files changed, 53 insertions(+) commit 4178d78cd7a86510ba68d203f26fc01113c7f126 Author: Christoffer Sandberg Date: Tue Aug 27 12:25:40 2024 +0200 ALSA: hda/conexant: Add pincfg quirk to enable top speakers on Sirius devices The Sirius notebooks have two sets of speakers 0x17 (sides) and 0x1d (top center). The side speakers are active by default but the top speakers aren't. This patch provides a pincfg quirk to activate the top speakers. Signed-off-by: Christoffer Sandberg Signed-off-by: Werner Sembach Cc: stable@vger.kernel.org Link: https://patch.msgid.link/20240827102540.9480-1-wse@tuxedocomputers.com Signed-off-by: Takashi Iwai sound/pci/hda/patch_conexant.c | 11 +++++++++++ 1 file changed, 11 insertions(+) commit 86987d84b968b69a610fd00ab9006c13db193b4e Merge: 46d22bfdf0bc 416871f4fb84 Author: Linus Torvalds Date: Wed Aug 28 15:05:02 2024 +1200 Merge tag 'v6.11-rc5-client-fixes' of git://git.samba.org/sfrench/cifs-2.6 Pull smb client fixes from Steve French: - two RDMA/smbdirect fixes and a minor cleanup - punch hole fix * tag 'v6.11-rc5-client-fixes' of git://git.samba.org/sfrench/cifs-2.6: cifs: Fix FALLOC_FL_PUNCH_HOLE support smb/client: fix rdma usage in smb2_async_writev() smb/client: remove unused rq_iter_size from struct smb_rqst smb/client: avoid dereferencing rdata=NULL in smb2_new_read_req() commit 46d22bfdf0bc76429f596c58ca74a8f67d0f6251 Merge: 3ec3f5fc4a91 08d08e2e9f0a Author: Linus Torvalds Date: Wed Aug 28 14:55:48 2024 +1200 Merge tag 'tpmdd-next-6.11-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/jarkko/linux-tpmdd Pull TPM fix from Jarkko Sakkinen: "A bug fix for tpm_ibmvtpm driver so that it will take the bus encryption into use" * tag 'tpmdd-next-6.11-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/jarkko/linux-tpmdd: tpm: ibmvtpm: Call tpm2_sessions_init() to initialize session support commit 3a0504d54b3b57f0d7bf3d9184a00c9f8887f6d7 Author: Ondrej Mosnacek Date: Mon Aug 26 15:07:11 2024 +0200 sctp: fix association labeling in the duplicate COOKIE-ECHO case sctp_sf_do_5_2_4_dupcook() currently calls security_sctp_assoc_request() on new_asoc, but as it turns out, this association is always discarded and the LSM labels never get into the final association (asoc). This can be reproduced by having two SCTP endpoints try to initiate an association with each other at approximately the same time and then peel off the association into a new socket, which exposes the unitialized labels and triggers SELinux denials. Fix it by calling security_sctp_assoc_request() on asoc instead of new_asoc. Xin Long also suggested limit calling the hook only to cases A, B, and D, since in cases C and E the COOKIE ECHO chunk is discarded and the association doesn't enter the ESTABLISHED state, so rectify that as well. One related caveat with SELinux and peer labeling: When an SCTP connection is set up simultaneously in this way, we will end up with an association that is initialized with security_sctp_assoc_request() on both sides, so the MLS component of the security context of the association will get swapped between the peers, instead of just one side setting it to the other's MLS component. However, at that point security_sctp_assoc_request() had already been called on both sides in sctp_sf_do_unexpected_init() (on a temporary association) and thus if the exchange didn't fail before due to MLS, it won't fail now either (most likely both endpoints have the same MLS range). Tested by: - reproducer from https://src.fedoraproject.org/tests/selinux/pull-request/530 - selinux-testsuite (https://github.com/SELinuxProject/selinux-testsuite/) - sctp-tests (https://github.com/sctp/sctp-tests) - no tests failed that wouldn't fail also without the patch applied Fixes: c081d53f97a1 ("security: pass asoc to sctp_assoc_request and sctp_sk_clone") Suggested-by: Xin Long Signed-off-by: Ondrej Mosnacek Acked-by: Xin Long Acked-by: Paul Moore (LSM/SELinux) Link: https://patch.msgid.link/20240826130711.141271-1-omosnace@redhat.com Signed-off-by: Jakub Kicinski net/sctp/sm_statefuns.c | 22 ++++++++++++++++------ 1 file changed, 16 insertions(+), 6 deletions(-) commit 237c3851dc81f418ef735bb71ef482e126f78ea0 Merge: bac76cf89816 cb41b195e634 Author: Jakub Kicinski Date: Tue Aug 27 14:45:18 2024 -0700 Merge branch 'mptcp-close-subflow-when-receiving-tcp-fin-and-misc' Matthieu Baerts says: ==================== mptcp: close subflow when receiving TCP+FIN and misc. Here are different fixes: Patch 1 closes the subflow after having received a FIN, instead of leaving it half-closed until the end of the MPTCP connection. A fix for v5.12. Patch 2 validates the previous patch. Patch 3 is a fix for a recent fix to check both directions for the backup flag. It can follow the 'Fixes' commit and be backported up to v5.7. Patch 4 adds a missing \n at the end of pr_debug(), causing debug messages to be displayed with a delay, which confuses the debugger. A fix for v5.6. ==================== Link: https://patch.msgid.link/20240826-net-mptcp-close-extra-sf-fin-v1-0-905199fe1172@kernel.org Signed-off-by: Jakub Kicinski commit cb41b195e634d3f1ecfcd845314e64fd4bb3c7aa Author: Matthieu Baerts (NGI0) Date: Mon Aug 26 19:11:21 2024 +0200 mptcp: pr_debug: add missing \n at the end pr_debug() have been added in various places in MPTCP code to help developers to debug some situations. With the dynamic debug feature, it is easy to enable all or some of them, and asks users to reproduce issues with extra debug. Many of these pr_debug() don't end with a new line, while no 'pr_cont()' are used in MPTCP code. So the goal was not to display multiple debug messages on one line: they were then not missing the '\n' on purpose. Not having the new line at the end causes these messages to be printed with a delay, when something else needs to be printed. This issue is not visible when many messages need to be printed, but it is annoying and confusing when only specific messages are expected, e.g. # echo "func mptcp_pm_add_addr_echoed +fmp" \ > /sys/kernel/debug/dynamic_debug/control # ./mptcp_join.sh "signal address"; \ echo "$(awk '{print $1}' /proc/uptime) - end"; \ sleep 5s; \ echo "$(awk '{print $1}' /proc/uptime) - restart"; \ ./mptcp_join.sh "signal address" 013 signal address (...) 10.75 - end 15.76 - restart 013 signal address [ 10.367935] mptcp:mptcp_pm_add_addr_echoed: MPTCP: msk=(...) (...) => a delay of 5 seconds: printed with a 10.36 ts, but after 'restart' which was printed at the 15.76 ts. The 'Fixes' tag here below points to the first pr_debug() used without '\n' in net/mptcp. This patch could be split in many small ones, with different Fixes tag, but it doesn't seem worth it, because it is easy to re-generate this patch with this simple 'sed' command: git grep -l pr_debug -- net/mptcp | xargs sed -i "s/\(pr_debug(\".*[^n]\)\(\"[,)]\)/\1\\\n\2/g" So in case of conflicts, simply drop the modifications, and launch this command. Fixes: f870fa0b5768 ("mptcp: Add MPTCP socket stubs") Cc: stable@vger.kernel.org Reviewed-by: Geliang Tang Signed-off-by: Matthieu Baerts (NGI0) Link: https://patch.msgid.link/20240826-net-mptcp-close-extra-sf-fin-v1-4-905199fe1172@kernel.org Signed-off-by: Jakub Kicinski net/mptcp/fastopen.c | 4 ++-- net/mptcp/options.c | 50 ++++++++++++++++++++++++------------------------ net/mptcp/pm.c | 28 +++++++++++++-------------- net/mptcp/pm_netlink.c | 20 +++++++++---------- net/mptcp/protocol.c | 52 +++++++++++++++++++++++++------------------------- net/mptcp/protocol.h | 4 ++-- net/mptcp/sched.c | 4 ++-- net/mptcp/sockopt.c | 4 ++-- net/mptcp/subflow.c | 48 +++++++++++++++++++++++----------------------- 9 files changed, 107 insertions(+), 107 deletions(-) commit 2a1f596ebb23eadc0f9b95a8012e18ef76295fc8 Author: Matthieu Baerts (NGI0) Date: Mon Aug 26 19:11:20 2024 +0200 mptcp: sched: check both backup in retrans The 'mptcp_subflow_context' structure has two items related to the backup flags: - 'backup': the subflow has been marked as backup by the other peer - 'request_bkup': the backup flag has been set by the host Looking only at the 'backup' flag can make sense in some cases, but it is not the behaviour of the default packet scheduler when selecting paths. As explained in the commit b6a66e521a20 ("mptcp: sched: check both directions for backup"), the packet scheduler should look at both flags, because that was the behaviour from the beginning: the 'backup' flag was set by accident instead of the 'request_bkup' one. Now that the latter has been fixed, get_retrans() needs to be adapted as well. Fixes: b6a66e521a20 ("mptcp: sched: check both directions for backup") Cc: stable@vger.kernel.org Reviewed-by: Mat Martineau Signed-off-by: Matthieu Baerts (NGI0) Link: https://patch.msgid.link/20240826-net-mptcp-close-extra-sf-fin-v1-3-905199fe1172@kernel.org Signed-off-by: Jakub Kicinski net/mptcp/protocol.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit e93681afcb96864ec26c3b2ce94008ce93577373 Author: Matthieu Baerts (NGI0) Date: Mon Aug 26 19:11:19 2024 +0200 selftests: mptcp: join: cannot rm sf if closed Thanks to the previous commit, the MPTCP subflows are now closed on both directions even when only the MPTCP path-manager of one peer asks for their closure. In the two tests modified here -- "userspace pm add & remove address" and "userspace pm create destroy subflow" -- one peer is controlled by the userspace PM, and the other one by the in-kernel PM. When the userspace PM sends a RM_ADDR notification, the in-kernel PM will automatically react by closing all subflows using this address. Now, thanks to the previous commit, the subflows are properly closed on both directions, the userspace PM can then no longer closes the same subflows if they are already closed. Before, it was OK to do that, because the subflows were still half-opened, still OK to send a RM_ADDR. In other words, thanks to the previous commit closing the subflows, an error will be returned to the userspace if it tries to close a subflow that has already been closed. So no need to run this command, which mean that the linked counters will then not be incremented. These tests are then no longer sending both a RM_ADDR, then closing the linked subflow just after. The test with the userspace PM on the server side is now removing one subflow linked to one address, then sending a RM_ADDR for another address. The test with the userspace PM on the client side is now only removing the subflow that was previously created. Fixes: 4369c198e599 ("selftests: mptcp: test userspace pm out of transfer") Cc: stable@vger.kernel.org Reviewed-by: Mat Martineau Signed-off-by: Matthieu Baerts (NGI0) Link: https://patch.msgid.link/20240826-net-mptcp-close-extra-sf-fin-v1-2-905199fe1172@kernel.org Signed-off-by: Jakub Kicinski tools/testing/selftests/net/mptcp/mptcp_join.sh | 11 ++++------- 1 file changed, 4 insertions(+), 7 deletions(-) commit f09b0ad55a1196f5891663f8888463c0541059cb Author: Matthieu Baerts (NGI0) Date: Mon Aug 26 19:11:18 2024 +0200 mptcp: close subflow when receiving TCP+FIN When a peer decides to close one subflow in the middle of a connection having multiple subflows, the receiver of the first FIN should accept that, and close the subflow on its side as well. If not, the subflow will stay half closed, and would even continue to be used until the end of the MPTCP connection or a reset from the network. The issue has not been seen before, probably because the in-kernel path-manager always sends a RM_ADDR before closing the subflow. Upon the reception of this RM_ADDR, the other peer will initiate the closure on its side as well. On the other hand, if the RM_ADDR is lost, or if the path-manager of the other peer only closes the subflow without sending a RM_ADDR, the subflow would switch to TCP_CLOSE_WAIT, but that's it, leaving the subflow half-closed. So now, when the subflow switches to the TCP_CLOSE_WAIT state, and if the MPTCP connection has not been closed before with a DATA_FIN, the kernel owning the subflow schedules its worker to initiate the closure on its side as well. This issue can be easily reproduced with packetdrill, as visible in [1], by creating an additional subflow, injecting a FIN+ACK before sending the DATA_FIN, and expecting a FIN+ACK in return. Fixes: 40947e13997a ("mptcp: schedule worker when subflow is closed") Cc: stable@vger.kernel.org Link: https://github.com/multipath-tcp/packetdrill/pull/154 [1] Reviewed-by: Mat Martineau Signed-off-by: Matthieu Baerts (NGI0) Link: https://patch.msgid.link/20240826-net-mptcp-close-extra-sf-fin-v1-1-905199fe1172@kernel.org Signed-off-by: Jakub Kicinski net/mptcp/protocol.c | 5 ++++- net/mptcp/subflow.c | 8 ++++++-- 2 files changed, 10 insertions(+), 3 deletions(-) commit bac76cf89816bff06c4ec2f3df97dc34e150a1c4 Author: Xueming Feng Date: Mon Aug 26 18:23:27 2024 +0800 tcp: fix forever orphan socket caused by tcp_abort We have some problem closing zero-window fin-wait-1 tcp sockets in our environment. This patch come from the investigation. Previously tcp_abort only sends out reset and calls tcp_done when the socket is not SOCK_DEAD, aka orphan. For orphan socket, it will only purging the write queue, but not close the socket and left it to the timer. While purging the write queue, tp->packets_out and sk->sk_write_queue is cleared along the way. However tcp_retransmit_timer have early return based on !tp->packets_out and tcp_probe_timer have early return based on !sk->sk_write_queue. This caused ICSK_TIME_RETRANS and ICSK_TIME_PROBE0 not being resched and socket not being killed by the timers, converting a zero-windowed orphan into a forever orphan. This patch removes the SOCK_DEAD check in tcp_abort, making it send reset to peer and close the socket accordingly. Preventing the timer-less orphan from happening. According to Lorenzo's email in the v1 thread, the check was there to prevent force-closing the same socket twice. That situation is handled by testing for TCP_CLOSE inside lock, and returning -ENOENT if it is already closed. The -ENOENT code comes from the associate patch Lorenzo made for iproute2-ss; link attached below, which also conform to RFC 9293. At the end of the patch, tcp_write_queue_purge(sk) is removed because it was already called in tcp_done_with_error(). p.s. This is the same patch with v2. Resent due to mis-labeled "changes requested" on patchwork.kernel.org. Link: https://patchwork.ozlabs.org/project/netdev/patch/1450773094-7978-3-git-send-email-lorenzo@google.com/ Fixes: c1e64e298b8c ("net: diag: Support destroying TCP sockets.") Signed-off-by: Xueming Feng Tested-by: Lorenzo Colitti Reviewed-by: Jason Xing Reviewed-by: Eric Dumazet Link: https://patch.msgid.link/20240826102327.1461482-1-kuro@kuroa.me Signed-off-by: Jakub Kicinski net/ipv4/tcp.c | 18 +++++++++++------- 1 file changed, 11 insertions(+), 7 deletions(-) commit defd8b3c37b0f9cb3e0f60f47d3d78d459d57fda Author: Cong Wang Date: Sun Aug 25 12:16:38 2024 -0700 gtp: fix a potential NULL pointer dereference When sockfd_lookup() fails, gtp_encap_enable_socket() returns a NULL pointer, but its callers only check for error pointers thus miss the NULL pointer case. Fix it by returning an error pointer with the error code carried from sockfd_lookup(). (I found this bug during code inspection.) Fixes: 1e3a3abd8b28 ("gtp: make GTP sockets in gtp_newlink optional") Cc: Andreas Schultz Cc: Harald Welte Signed-off-by: Cong Wang Reviewed-by: Simon Horman Reviewed-by: Pablo Neira Ayuso Link: https://patch.msgid.link/20240825191638.146748-1-xiyou.wangcong@gmail.com Signed-off-by: Jakub Kicinski drivers/net/gtp.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 8e95e53ca379a03d7f5bfc567a610baa85e15424 Author: Miguel Ojeda Date: Tue Aug 27 12:04:03 2024 +0200 rust: allow `stable_features` lint Support for several Rust compiler versions started in commit 63b27f4a0074 ("rust: start supporting several compiler versions"). Since we currently need to use a number of unstable features in the kernel, it is a matter of time until one gets stabilized and the `stable_features` lint warns. For instance, the `new_uninit` feature may become stable soon, which would give us multiple warnings like the following: warning: the feature `new_uninit` has been stable since 1.82.0-dev and no longer requires an attribute to enable --> rust/kernel/lib.rs:17:12 | 17 | #![feature(new_uninit)] | ^^^^^^^^^^ | = note: `#[warn(stable_features)]` on by default Thus allow the `stable_features` lint to avoid such warnings. This is the simplest approach -- we do not have that many cases (and the goal is to stop using unstable features anyway) and cleanups can be easily done when we decide to update the minimum version. An alternative would be to conditionally enable them based on the compiler version (with the upcoming `RUSTC_VERSION` or maybe with the unstable `cfg(version(...))`, but that one apparently will not work for the nightly case). However, doing so is more complex and may not work well for different nightlies of the same version, unless we do not care about older nightlies. Another alternative is using explicit tests of the feature calling `rustc`, but that is also more complex and slower. Reviewed-by: Alice Ryhl Link: https://lore.kernel.org/r/20240827100403.376389-1-ojeda@kernel.org Signed-off-by: Miguel Ojeda Makefile | 1 + 1 file changed, 1 insertion(+) commit 7d2fc5a4038df307393769e198a8b1bf189fd6e5 Author: Jon Mulder Date: Mon Aug 26 17:10:32 2024 -0400 docs: rust: remove unintended blockquote in Quick Start Remove indentation within the "Hacking" section of the Rust Quick Start guide, i.e. remove a `
` HTML element from the rendered documentation. Reported-by: Miguel Ojeda Closes: https://github.com/Rust-for-Linux/linux/issues/1103 Fixes: d07479b211b7 ("docs: add Rust documentation") Signed-off-by: Jon Mulder Link: https://lore.kernel.org/r/20240826-pr-docs-rust-remove-quickstart-blockquote-v1-1-c51317d8d71a@gmail.com [ Added Fixes tag, reworded slightly and matched title to a previous, similar commit. - Miguel ] Signed-off-by: Miguel Ojeda Documentation/rust/quick-start.rst | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) commit 2fecbf75c40aca51ae35accbaa6ea051bb2340c4 Merge: 65a3cce43d5b 2aeeef906d5a Author: Jakub Kicinski Date: Tue Aug 27 13:11:39 2024 -0700 Merge branch 'fixes-for-ipsec-over-bonding' Jianbo Liu says: ==================== Fixes for IPsec over bonding This patchset provides bug fixes for IPsec over bonding driver. It adds the missing xdo_dev_state_free API, and fixes "scheduling while atomic" by using mutex lock instead. Series generated against: commit c07ff8592d57 ("netem: fix return value if duplicate enqueue fails") ==================== Link: https://patch.msgid.link/20240823031056.110999-1-jianbol@nvidia.com Signed-off-by: Jakub Kicinski commit 2aeeef906d5a526dc60cf4af92eda69836c39b1f Author: Jianbo Liu Date: Fri Aug 23 06:10:56 2024 +0300 bonding: change ipsec_lock from spin lock to mutex In the cited commit, bond->ipsec_lock is added to protect ipsec_list, hence xdo_dev_state_add and xdo_dev_state_delete are called inside this lock. As ipsec_lock is a spin lock and such xfrmdev ops may sleep, "scheduling while atomic" will be triggered when changing bond's active slave. [ 101.055189] BUG: scheduling while atomic: bash/902/0x00000200 [ 101.055726] Modules linked in: [ 101.058211] CPU: 3 PID: 902 Comm: bash Not tainted 6.9.0-rc4+ #1 [ 101.058760] Hardware name: [ 101.059434] Call Trace: [ 101.059436] [ 101.060873] dump_stack_lvl+0x51/0x60 [ 101.061275] __schedule_bug+0x4e/0x60 [ 101.061682] __schedule+0x612/0x7c0 [ 101.062078] ? __mod_timer+0x25c/0x370 [ 101.062486] schedule+0x25/0xd0 [ 101.062845] schedule_timeout+0x77/0xf0 [ 101.063265] ? asm_common_interrupt+0x22/0x40 [ 101.063724] ? __bpf_trace_itimer_state+0x10/0x10 [ 101.064215] __wait_for_common+0x87/0x190 [ 101.064648] ? usleep_range_state+0x90/0x90 [ 101.065091] cmd_exec+0x437/0xb20 [mlx5_core] [ 101.065569] mlx5_cmd_do+0x1e/0x40 [mlx5_core] [ 101.066051] mlx5_cmd_exec+0x18/0x30 [mlx5_core] [ 101.066552] mlx5_crypto_create_dek_key+0xea/0x120 [mlx5_core] [ 101.067163] ? bonding_sysfs_store_option+0x4d/0x80 [bonding] [ 101.067738] ? kmalloc_trace+0x4d/0x350 [ 101.068156] mlx5_ipsec_create_sa_ctx+0x33/0x100 [mlx5_core] [ 101.068747] mlx5e_xfrm_add_state+0x47b/0xaa0 [mlx5_core] [ 101.069312] bond_change_active_slave+0x392/0x900 [bonding] [ 101.069868] bond_option_active_slave_set+0x1c2/0x240 [bonding] [ 101.070454] __bond_opt_set+0xa6/0x430 [bonding] [ 101.070935] __bond_opt_set_notify+0x2f/0x90 [bonding] [ 101.071453] bond_opt_tryset_rtnl+0x72/0xb0 [bonding] [ 101.071965] bonding_sysfs_store_option+0x4d/0x80 [bonding] [ 101.072567] kernfs_fop_write_iter+0x10c/0x1a0 [ 101.073033] vfs_write+0x2d8/0x400 [ 101.073416] ? alloc_fd+0x48/0x180 [ 101.073798] ksys_write+0x5f/0xe0 [ 101.074175] do_syscall_64+0x52/0x110 [ 101.074576] entry_SYSCALL_64_after_hwframe+0x4b/0x53 As bond_ipsec_add_sa_all and bond_ipsec_del_sa_all are only called from bond_change_active_slave, which requires holding the RTNL lock. And bond_ipsec_add_sa and bond_ipsec_del_sa are xfrm state xdo_dev_state_add and xdo_dev_state_delete APIs, which are in user context. So ipsec_lock doesn't have to be spin lock, change it to mutex, and thus the above issue can be resolved. Fixes: 9a5605505d9c ("bonding: Add struct bond_ipesc to manage SA") Signed-off-by: Jianbo Liu Signed-off-by: Tariq Toukan Reviewed-by: Hangbin Liu Acked-by: Jay Vosburgh Link: https://patch.msgid.link/20240823031056.110999-4-jianbol@nvidia.com Signed-off-by: Jakub Kicinski drivers/net/bonding/bond_main.c | 79 ++++++++++++++++++++++------------------- include/net/bonding.h | 2 +- 2 files changed, 44 insertions(+), 37 deletions(-) commit 907ed83a7583e8ffede88c5ac088392701a7d458 Author: Jianbo Liu Date: Fri Aug 23 06:10:55 2024 +0300 bonding: extract the use of real_device into local variable Add a local variable for slave->dev, to prepare for the lock change in the next patch. There is no functionality change. Fixes: 9a5605505d9c ("bonding: Add struct bond_ipesc to manage SA") Signed-off-by: Jianbo Liu Reviewed-by: Cosmin Ratiu Signed-off-by: Tariq Toukan Reviewed-by: Hangbin Liu Acked-by: Jay Vosburgh Link: https://patch.msgid.link/20240823031056.110999-3-jianbol@nvidia.com Signed-off-by: Jakub Kicinski drivers/net/bonding/bond_main.c | 58 +++++++++++++++++++++++------------------ 1 file changed, 33 insertions(+), 25 deletions(-) commit ec13009472f4a756288eb4e18e20a7845da98d10 Author: Jianbo Liu Date: Fri Aug 23 06:10:54 2024 +0300 bonding: implement xdo_dev_state_free and call it after deletion Add this implementation for bonding, so hardware resources can be freed from the active slave after xfrm state is deleted. The netdev used to invoke xdo_dev_state_free callback, is saved in the xfrm state (xs->xso.real_dev), which is also the bond's active slave. To prevent it from being freed, acquire netdev reference before leaving RCU read-side critical section, and release it after callback is done. And call it when deleting all SAs from old active real interface while switching current active slave. Fixes: 9a5605505d9c ("bonding: Add struct bond_ipesc to manage SA") Signed-off-by: Jianbo Liu Signed-off-by: Tariq Toukan Reviewed-by: Hangbin Liu Acked-by: Jay Vosburgh Link: https://patch.msgid.link/20240823031056.110999-2-jianbol@nvidia.com Signed-off-by: Jakub Kicinski drivers/net/bonding/bond_main.c | 36 ++++++++++++++++++++++++++++++++++++ 1 file changed, 36 insertions(+) commit 65a3cce43d5b4c53cf16b0be1a03991f665a0806 Author: Petr Machata Date: Mon Aug 26 19:15:11 2024 +0200 selftests: forwarding: local_termination: Down ports on cleanup This test neglects to put ports down on cleanup. Fix it. Fixes: 90b9566aa5cd ("selftests: forwarding: add a test for local_termination.sh") Signed-off-by: Petr Machata Link: https://patch.msgid.link/bf9b79f45de378f88344d44550f0a5052b386199.1724692132.git.petrm@nvidia.com Signed-off-by: Jakub Kicinski tools/testing/selftests/net/forwarding/local_termination.sh | 4 ++++ 1 file changed, 4 insertions(+) commit e8497d6951ee8541d73784f9aac9942a7f239980 Author: Petr Machata Date: Fri Aug 23 18:25:37 2024 +0200 selftests: forwarding: no_forwarding: Down ports on cleanup This test neglects to put ports down on cleanup. Fix it. Fixes: 476a4f05d9b8 ("selftests: forwarding: add a no_forwarding.sh test") Signed-off-by: Petr Machata Reviewed-by: Simon Horman Link: https://patch.msgid.link/0baf91dc24b95ae0cadfdf5db05b74888e6a228a.1724430120.git.petrm@nvidia.com Signed-off-by: Jakub Kicinski tools/testing/selftests/net/forwarding/no_forwarding.sh | 3 +++ 1 file changed, 3 insertions(+) commit 61aa894e7a2fda4ee026523b01d07e83ce2abb72 Author: Georg Gottleuber Date: Tue Aug 27 12:41:33 2024 +0200 nvme-pci: Add sleep quirk for Samsung 990 Evo On some TUXEDO platforms, a Samsung 990 Evo NVMe leads to a high power consumption in s2idle sleep (2-3 watts). This patch applies 'Force No Simple Suspend' quirk to achieve a sleep with a lower power consumption, typically around 0.5 watts. Signed-off-by: Georg Gottleuber Signed-off-by: Werner Sembach Cc: Signed-off-by: Keith Busch drivers/nvme/host/pci.c | 11 +++++++++++ 1 file changed, 11 insertions(+) commit 15d75184a86fdd8ba56e17606c3088ac60150ab3 Merge: 5be63fc19fca 9983a9cd4d42 Author: Rafael J. Wysocki Date: Tue Aug 27 20:40:10 2024 +0200 Merge tag 'amd-pstate-v6.11-2024-08-26' of ssh://gitolite.kernel.org/pub/scm/linux/kernel/git/superm1/linux Merge amd-pstate driver fixes for 6.11-rc6 from Mario Limonciello: "amd-pstate fixes for 6.11-rc - Fix to unit test coverage - Fix bug with enabling CPPC on hetero designs - Fix uninitialized variable" * tag 'amd-pstate-v6.11-2024-08-26' of ssh://gitolite.kernel.org/pub/scm/linux/kernel/git/superm1/linux: cpufreq/amd-pstate-ut: Don't check for highest perf matching on prefcore cpufreq/amd-pstate: Use topology_logical_package_id() instead of logical_die_id() cpufreq: amd-pstate: Fix uninitialized variable in amd_pstate_cpu_boost_update() commit 3ec3f5fc4a91e389ea56b111a73d97ffc94f19c6 Merge: 41594663c3fb 052f3951640f Author: Linus Torvalds Date: Wed Aug 28 06:34:08 2024 +1200 Merge tag 'livepatching-for-6.11-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/livepatching/livepatching Pull livepatching fix from Petr Mladek: "Selftest regression fix" * tag 'livepatching-for-6.11-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/livepatching/livepatching: selftests/livepatch: wait for atomic replace to occur commit 41594663c3fb565940ec2b947bd7e623e3f0e600 Merge: 6ace1c7ea297 128f71fe014f Author: Linus Torvalds Date: Wed Aug 28 06:26:32 2024 +1200 Merge tag 'pinctrl-v6.11-2' of git://git.kernel.org/pub/scm/linux/kernel/git/linusw/linux-pinctrl Pull pin control fixes from Linus Walleij: - Fix the hwirq map and pin offsets in the Qualcomm X1E80100 driver - Fix the pin range handling in the AT91 driver so it works again - Fix a NULL-dereference risk in pinctrl single - Fix a serious biasing bug in the Mediatek driver - Fix the level trigged IRQ in the StarFive JH7110 - Fix the iomux width in the Rockchip GPIO2-B pin handling * tag 'pinctrl-v6.11-2' of git://git.kernel.org/pub/scm/linux/kernel/git/linusw/linux-pinctrl: pinctrl: rockchip: correct RK3328 iomux width flag for GPIO2-B pins pinctrl: starfive: jh7110: Correct the level trigger configuration of iev register pinctrl: qcom: x1e80100: Fix special pin offsets pinctrl: mediatek: common-v2: Fix broken bias-disable for PULL_PU_PD_RSEL_TYPE pinctrl: single: fix potential NULL dereference in pcs_get_function() pinctrl: at91: make it work with current gpiolib pinctrl: qcom: x1e80100: Update PDC hwirq map commit 6ace1c7ea2972bb3d8bfd5ca3d1a1b2bbc41687e Merge: 3e9bff3bbe13 28b329f431ce Author: Linus Torvalds Date: Wed Aug 28 06:24:22 2024 +1200 Merge tag 'sound-6.11-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound Pull sound fixes from Takashi Iwai: "It became a bit larger collection of fixes than wished at this time, but all changes are small and mostly device-specific fixes that should be fairly safe to apply. Majority of fixes are about ASoC for AMD SOF, Cirrus codecs, lpass, etc, in addition to the usual HD-audio quirks / fixes" * tag 'sound-6.11-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound: (22 commits) ALSA: hda: hda_component: Fix mutex crash if nothing ever binds ALSA: hda/realtek: support HP Pavilion Aero 13-bg0xxx Mute LED ALSA: hda/realtek: Fix the speaker output on Samsung Galaxy Book3 Ultra ASoC: cs-amp-lib: Ignore empty UEFI calibration entries ASoC: cs-amp-lib-test: Force test calibration blob entries to be valid ALSA: hda/realtek - FIxed ALC285 headphone no sound ALSA: hda/realtek - Fixed ALC256 headphone no sound ASoC: allow module autoloading for table board_ids ASoC: allow module autoloading for table db1200_pids ALSA: hda: cs35l56: Don't use the device index as a calibration index ALSA: seq: Skip event type filtering for UMP events ALSA: hda/realtek: Enable mute/micmute LEDs on HP Laptop 14-ey0xxx ASoC: SOF: amd: Fix for acp init sequence ASoC: amd: acp: fix module autoloading ASoC: mediatek: mt8188: Mark AFE_DAC_CON0 register as volatile ASoC: codecs: wcd937x: Fix missing de-assert of reset GPIO ASoC: SOF: mediatek: Add missing board compatible ASoC: MAINTAINERS: Drop Banajit Goswami from Qualcomm sound drivers ASoC: SOF: amd: Fix for incorrect acp error register offsets ASoC: SOF: amd: move iram-dram fence register programming sequence ... commit 08d08e2e9f0ad1af0044e4747723f66677c35ee9 Author: Stefan Berger Date: Mon Jul 29 09:29:34 2024 -0400 tpm: ibmvtpm: Call tpm2_sessions_init() to initialize session support Commit d2add27cf2b8 ("tpm: Add NULL primary creation") introduced CONFIG_TCG_TPM2_HMAC. When this option is enabled on ppc64 then the following message appears in the kernel log due to a missing call to tpm2_sessions_init(). [ 2.654549] tpm tpm0: auth session is not active Add the missing call to tpm2_session_init() to the ibmvtpm driver to resolve this issue. Cc: stable@vger.kernel.org # v6.10+ Fixes: d2add27cf2b8 ("tpm: Add NULL primary creation") Signed-off-by: Stefan Berger Reviewed-by: Jarkko Sakkinen Signed-off-by: Jarkko Sakkinen drivers/char/tpm/tpm_ibmvtpm.c | 4 ++++ 1 file changed, 4 insertions(+) commit ca082333b4356688be715ed9cc762fc5d3d5f4c5 Author: Bryan O'Donoghue Date: Fri Aug 23 13:58:56 2024 +0100 clk: qcom: gcc-x1e80100: Don't use parking clk_ops for QUPs Per Stephen Boyd's explanation in the link below, QUP RCG clocks do not need to be parked when switching frequency. A side-effect in parking to a lower frequency can be a momentary invalid clock driven on an in-use serial peripheral. This can cause "junk" to spewed out of a UART as a low-impact example. On the x1e80100-crd this serial port junk can be observed on linux-next. Apply a similar fix to the x1e80100 Global Clock controller to remediate. Link: https://lore.kernel.org/all/20240819233628.2074654-3-swboyd@chromium.org/ Fixes: 161b7c401f4b ("clk: qcom: Add Global Clock controller (GCC) driver for X1E80100") Fixes: 929c75d57566 ("clk: qcom: gcc-sm8550: Mark RCGs shared where applicable") Suggested-by: Neil Armstrong Signed-off-by: Bryan O'Donoghue Link: https://lore.kernel.org/r/20240823-x1e80100-clk-fix-v1-1-0b1b4f5a96e8@linaro.org Reviewed-by: Konrad Dybcio Signed-off-by: Stephen Boyd drivers/clk/qcom/gcc-x1e80100.c | 48 ++++++++++++++++++++--------------------- 1 file changed, 24 insertions(+), 24 deletions(-) commit 0f6eaf125e73fecb6a864fd22b131f23423bd0a7 Merge: 39a3396558fb 6357efe3abea Author: Stephen Boyd Date: Tue Aug 27 10:28:39 2024 -0700 Merge tag 'qcom-clk-fixes-for-6.11' of https://git.kernel.org/pub/scm/linux/kernel/git/qcom/linux into clk-fixes Pull Qualcomm clk driver fixes from Bjorn Andersson: This corrects several issues with the Alpha PLL clock driver. It updates IPQ9574 GCC driver to correctly use the EVO PLL registers for GPLL clocks. X1E USB GDSC flags are corrected to leave these in retention as the controllers are suspended. * tag 'qcom-clk-fixes-for-6.11' of https://git.kernel.org/pub/scm/linux/kernel/git/qcom/linux: clk: qcom: ipq9574: Update the alpha PLL type for GPLLs clk: qcom: gcc-x1e80100: Fix USB 0 and 1 PHY GDSC pwrsts flags clk: qcom: clk-alpha-pll: Update set_rate for Zonda PLL clk: qcom: clk-alpha-pll: Fix zonda set_rate failure when PLL is disabled clk: qcom: clk-alpha-pll: Fix the trion pll postdiv set rate API clk: qcom: clk-alpha-pll: Fix the pll post div mask commit 70c261d500951cf3ea0fcf32651aab9a65a91471 Author: Pablo Neira Ayuso Date: Mon Aug 26 15:03:23 2024 +0200 netfilter: nf_tables_ipv6: consider network offset in netdev/egress validation From netdev/egress, skb->len can include the ethernet header, therefore, subtract network offset from skb->len when validating IPv6 packet length. Fixes: 42df6e1d221d ("netfilter: Introduce egress hook") Signed-off-by: Pablo Neira Ayuso include/net/netfilter/nf_tables_ipv6.h | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) commit bc21000e99f92a6b5540d7267c6b22806c5c33d3 Author: Eric Dumazet Date: Sat Aug 24 18:19:01 2024 +0000 net_sched: sch_fq: fix incorrect behavior for small weights fq_dequeue() has a complex logic to find packets in one of the 3 bands. As Neal found out, it is possible that one band has a deficit smaller than its weight. fq_dequeue() can return NULL while some packets are elligible for immediate transmit. In this case, more than one iteration is needed to refill pband->credit. With default parameters (weights 589824 196608 65536) bug can trigger if large BIG TCP packets are sent to the lowest priority band. Bisected-by: John Sperbeck Diagnosed-by: Neal Cardwell Fixes: 29f834aa326e ("net_sched: sch_fq: add 3 bands and WRR scheduling") Signed-off-by: Eric Dumazet Reviewed-by: Neal Cardwell Link: https://patch.msgid.link/20240824181901.953776-1-edumazet@google.com Signed-off-by: Jakub Kicinski net/sched/sch_fq.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) commit 6f01bdbfef3b62955cf6503a8425d527b3a5cf94 Author: Keith Busch Date: Mon Aug 26 11:20:57 2024 -0700 nvme-pci: allocate tagset on reset if necessary If a drive is unable to create IO queues on the initial probe, a subsequent reset will need to allocate the tagset if IO queue creation is successful. Without this, blk_mq_update_nr_hw_queues will crash on a bad pointer due to the invalid tagset. Fixes: eac3ef262941f62 ("nvme-pci: split the initial probe from the rest path") Reviewed-by: Sagi Grimberg Reviewed-by: Christoph Hellwig Signed-off-by: Keith Busch drivers/nvme/host/pci.c | 6 ++++++ 1 file changed, 6 insertions(+) commit ecb54277cb63c273e8d74272e5b9bfd80c2185d9 Author: Filipe Manana Date: Tue Aug 27 11:30:10 2024 +0100 btrfs: fix uninitialized return value from btrfs_reclaim_sweep() The return variable 'ret' at btrfs_reclaim_sweep() is never assigned if none of the space infos is reclaimable (for example if periodic reclaim is disabled, which is the default), so we return an undefined value. This can be fixed my making btrfs_reclaim_sweep() not return any value as well as do_reclaim_sweep() because: 1) do_reclaim_sweep() always returns 0, so we can make it return void; 2) The only caller of btrfs_reclaim_sweep() (btrfs_reclaim_bgs()) doesn't care about its return value, and in its context there's nothing to do about any errors anyway. Therefore remove the return value from btrfs_reclaim_sweep() and do_reclaim_sweep(). Fixes: e4ca3932ae90 ("btrfs: periodic block_group reclaim") Reviewed-by: Josef Bacik Signed-off-by: Filipe Manana Reviewed-by: David Sterba Signed-off-by: David Sterba fs/btrfs/space-info.c | 17 +++++------------ fs/btrfs/space-info.h | 2 +- 2 files changed, 6 insertions(+), 13 deletions(-) commit 1eb52589a299f8b29df0f214206da6616e33a8b6 Author: Matthew Brost Date: Tue Aug 20 09:01:29 2024 -0700 drm/xe: Invalidate media_gt TLBs Testing on LNL has shown media TLBs need to be invalidated via the GuC, update xe_vm_invalidate_vma appropriately. v2: Fix 2 tile case v3: Include missing local change Fixes: 3330361543fc ("drm/xe/lnl: Add LNL platform definition") Signed-off-by: Matthew Brost Reviewed-by: Himal Prasad Ghimiray Link: https://patchwork.freedesktop.org/patch/msgid/20240820160129.986889-1-matthew.brost@intel.com (cherry picked from commit 77cc3f6c58b1b28cee73904946c46a1415187d04) Signed-off-by: Rodrigo Vivi drivers/gpu/drm/xe/xe_vm.c | 37 ++++++++++++++++++++++++------------- 1 file changed, 24 insertions(+), 13 deletions(-) commit a24cae8fc1f13f6f6929351309f248fd2e9351ce Author: Darrick J. Wong Date: Thu Aug 22 17:01:07 2024 -0700 xfs: reset rootdir extent size hint after growfsrt If growfsrt is run on a filesystem that doesn't have a rt volume, it's possible to change the rt extent size. If the root directory was previously set up with an inherited extent size hint and rtinherit, it's possible that the hint is no longer a multiple of the rt extent size. Although the verifiers don't complain about this, xfs_repair will, so if we detect this situation, log the root directory to clean it up. This is still racy, but it's better than nothing. Reviewed-by: Christoph Hellwig Signed-off-by: Darrick J. Wong Signed-off-by: Chandan Babu R fs/xfs/xfs_rtalloc.c | 40 ++++++++++++++++++++++++++++++++++++++++ 1 file changed, 40 insertions(+) commit 16e1fbdce9c8d084863fd63cdaff8fb2a54e2f88 Author: Darrick J. Wong Date: Thu Aug 22 17:00:51 2024 -0700 xfs: take m_growlock when running growfsrt Take the grow lock when we're expanding the realtime volume, like we do for the other growfs calls. Reviewed-by: Christoph Hellwig Signed-off-by: Darrick J. Wong Signed-off-by: Chandan Babu R fs/xfs/xfs_rtalloc.c | 38 +++++++++++++++++++++++++------------- 1 file changed, 25 insertions(+), 13 deletions(-) commit ca6448aed4f10ad88eba79055f181eb9a589a7b3 Author: Zizhi Wo Date: Thu Aug 22 17:00:35 2024 -0700 xfs: Fix missing interval for missing_owner in xfs fsmap In the fsmap query of xfs, there is an interval missing problem: [root@fedora ~]# xfs_io -c 'fsmap -vvvv' /mnt EXT: DEV BLOCK-RANGE OWNER FILE-OFFSET AG AG-OFFSET TOTAL 0: 253:16 [0..7]: static fs metadata 0 (0..7) 8 1: 253:16 [8..23]: per-AG metadata 0 (8..23) 16 2: 253:16 [24..39]: inode btree 0 (24..39) 16 3: 253:16 [40..47]: per-AG metadata 0 (40..47) 8 4: 253:16 [48..55]: refcount btree 0 (48..55) 8 5: 253:16 [56..103]: per-AG metadata 0 (56..103) 48 6: 253:16 [104..127]: free space 0 (104..127) 24 ...... BUG: [root@fedora ~]# xfs_io -c 'fsmap -vvvv -d 104 107' /mnt [root@fedora ~]# Normally, we should be able to get [104, 107), but we got nothing. The problem is caused by shifting. The query for the problem-triggered scenario is for the missing_owner interval (e.g. freespace in rmapbt/ unknown space in bnobt), which is obtained by subtraction (gap). For this scenario, the interval is obtained by info->last. However, rec_daddr is calculated based on the start_block recorded in key[1], which is converted by calling XFS_BB_TO_FSBT. Then if rec_daddr does not exceed info->next_daddr, which means keys[1].fmr_physical >> (mp)->m_blkbb_log <= info->next_daddr, no records will be displayed. In the above example, 104 >> (mp)->m_blkbb_log = 12 and 107 >> (mp)->m_blkbb_log = 12, so the two are reduced to 0 and the gap is ignored: before calculate ----------------> after shifting 104(st) 107(ed) 12(st/ed) |---------| | sector size block size Resolve this issue by introducing the "end_daddr" field in xfs_getfsmap_info. This records |key[1].fmr_physical + key[1].length| at the granularity of sector. If the current query is the last, the rec_daddr is end_daddr to prevent missing interval problems caused by shifting. We only need to focus on the last query, because xfs disks are internally aligned with disk blocksize that are powers of two and minimum 512, so there is no problem with shifting in previous queries. After applying this patch, the above problem have been solved: [root@fedora ~]# xfs_io -c 'fsmap -vvvv -d 104 107' /mnt EXT: DEV BLOCK-RANGE OWNER FILE-OFFSET AG AG-OFFSET TOTAL 0: 253:16 [104..106]: free space 0 (104..106) 3 Fixes: e89c041338ed ("xfs: implement the GETFSMAP ioctl") Signed-off-by: Zizhi Wo Reviewed-by: Darrick J. Wong [djwong: limit the range of end_addr correctly] Signed-off-by: Darrick J. Wong Signed-off-by: Chandan Babu R fs/xfs/xfs_fsmap.c | 24 +++++++++++++++++++++++- 1 file changed, 23 insertions(+), 1 deletion(-) commit 6b35cc8d9239569700cc7cc737c8ed40b8b9cfdb Author: Darrick J. Wong Date: Thu Aug 22 17:00:20 2024 -0700 xfs: use XFS_BUF_DADDR_NULL for daddrs in getfsmap code Use XFS_BUF_DADDR_NULL (instead of a magic sentinel value) to mean "this field is null" like the rest of xfs. Cc: wozizhi@huawei.com Fixes: e89c041338ed6 ("xfs: implement the GETFSMAP ioctl") Reviewed-by: Christoph Hellwig Signed-off-by: Darrick J. Wong Signed-off-by: Chandan Babu R fs/xfs/xfs_fsmap.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) commit 4786fe29f5a0dd74d9ccdce8c734bde1fb88cf37 Author: Brett Creeley Date: Thu Aug 22 12:25:57 2024 -0700 ionic: Prevent tx_timeout due to frequent doorbell ringing With recent work to the doorbell workaround code a small hole was introduced that could cause a tx_timeout. This happens if the rx dbell_deadline goes beyond the netdev watchdog timeout set by the driver (i.e. 2 seconds). Fix this by changing the netdev watchdog timeout to 5 seconds and reduce the max rx dbell_deadline to 4 seconds. The test that can reproduce the issue being fixed is a multi-queue send test via pktgen with the "burst" setting to 1. This causes the queue's doorbell to be rung on every packet sent to the driver, which may result in the device missing doorbells due to the high doorbell rate. Cc: stable@vger.kernel.org Fixes: 4ded136c78f8 ("ionic: add work item for missed-doorbell check") Signed-off-by: Brett Creeley Reviewed-by: Shannon Nelson Link: https://patch.msgid.link/20240822192557.9089-1-brett.creeley@amd.com Signed-off-by: Paolo Abeni drivers/net/ethernet/pensando/ionic/ionic_dev.h | 2 +- drivers/net/ethernet/pensando/ionic/ionic_lif.c | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) commit 2955ae8186c8a6f029e429f7890e0c7e5f6e215e Author: John Harrison Date: Thu Aug 1 20:10:51 2024 -0700 drm/i915: ARL requires a newer GSC firmware ARL and MTL share a single GSC firmware blob. However, ARL requires a newer version of it. So add differentiate of the PCI ids for ARL from MTL and create ARL as a sub-platform of MTL. That way, all the existing workarounds and such still treat ARL as MTL exactly as before. However, now the GSC code can check for ARL and do an extra version check on the firmware before committing to it. Also, the version extraction code has various ways of failing but the return code was being ignore and so the firmware load would attempt to continue anyway. Fix that by propagating the return code to the next level out. Signed-off-by: John Harrison Fixes: 213c43676beb ("drm/i915/mtl: Remove the 'force_probe' requirement for Meteor Lake") Reviewed-by: Daniele Ceraolo Spurio Acked-by: Rodrigo Vivi Link: https://patchwork.freedesktop.org/patch/msgid/20240802031051.3816392-1-John.C.Harrison@Intel.com Signed-off-by: Rodrigo Vivi (cherry picked from commit 67733d7a71503fd3e32eeada371f8aa2516c5c95) Signed-off-by: Joonas Lahtinen drivers/gpu/drm/i915/gt/uc/intel_gsc_fw.c | 31 +++++++++++++++++++++++++++++++ drivers/gpu/drm/i915/gt/uc/intel_uc_fw.c | 10 ++++++++-- drivers/gpu/drm/i915/i915_drv.h | 2 ++ drivers/gpu/drm/i915/intel_device_info.c | 7 +++++++ drivers/gpu/drm/i915/intel_device_info.h | 3 +++ include/drm/intel/i915_pciids.h | 11 +++++++---- 6 files changed, 58 insertions(+), 6 deletions(-) commit 7d058e6bac9afab6a406e34344ebbfd3068bb2d5 Author: Hans de Goede Date: Fri Aug 23 09:50:55 2024 +0200 drm/i915/dsi: Make Lenovo Yoga Tab 3 X90F DMI match less strict There are 2G and 4G RAM versions of the Lenovo Yoga Tab 3 X90F and it turns out that the 2G version has a DMI product name of "CHERRYVIEW D1 PLATFORM" where as the 4G version has "CHERRYVIEW C0 PLATFORM". The sys-vendor + product-version check are unique enough that the product-name check is not necessary. Drop the product-name check so that the existing DMI match for the 4G RAM version also matches the 2G RAM version. Fixes: f6f4a0862bde ("drm/i915/vlv_dsi: Add DMI quirk for backlight control issues on Lenovo Yoga Tab 3 (v2)") Cc: stable@vger.kernel.org Acked-by: Jani Nikula Signed-off-by: Hans de Goede Link: https://patchwork.freedesktop.org/patch/msgid/20240823075055.17198-1-hdegoede@redhat.com (cherry picked from commit a4dbe45c4c14edc316ae94b9af86a28f8c5d8123) Signed-off-by: Joonas Lahtinen drivers/gpu/drm/i915/display/vlv_dsi.c | 1 - 1 file changed, 1 deletion(-) commit 094513f8a2fbddee51b055d8035f995551f98fce Author: Emmanuel Grumbach Date: Sun Aug 25 19:17:01 2024 +0300 wifi: iwlwifi: clear trans->state earlier upon error When the firmware crashes, we first told the op_mode and only then, changed the transport's state. This is a problem if the op_mode's nic_error() handler needs to send a host command: it'll see that the transport's state still reflects that the firmware is alive. Today, this has no consequences since we set the STATUS_FW_ERROR bit and that will prevent sending host commands. iwl_fw_dbg_stop_restart_recording looks at this bit to know not to send a host command for example. To fix the hibernation, we needed to reset the firmware without having an error and checking STATUS_FW_ERROR to see whether the firmware is alive will no longer hold, so this change is necessary as well. Change the flow a bit. Change trans->state before calling the op_mode's nic_error() method and check trans->state instead of STATUS_FW_ERROR. This will keep the current behavior of iwl_fw_dbg_stop_restart_recording upon firmware error, and it'll allow us to call iwl_fw_dbg_stop_restart_recording safely even if STATUS_FW_ERROR is clear, but yet, the firmware is not alive. Signed-off-by: Emmanuel Grumbach Signed-off-by: Miri Korenblit Link: https://patch.msgid.link/20240825191257.9d7427fbdfd7.Ia056ca57029a382c921d6f7b6a6b28fc480f2f22@changeid [I missed this was a dependency for the hibernation fix, changed the commit message a bit accordingly] Signed-off-by: Johannes Berg drivers/net/wireless/intel/iwlwifi/fw/dbg.c | 2 +- drivers/net/wireless/intel/iwlwifi/iwl-trans.h | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) commit 6d30bb88f623526197c0e18a366e68a4254a2c83 Author: Alexander Sverdlin Date: Fri Aug 23 15:15:20 2024 +0200 wifi: wfx: repair open network AP mode RSN IE missing in beacon is normal in open networks. Avoid returning -EINVAL in this case. Steps to reproduce: $ cat /etc/wpa_supplicant.conf network={ ssid="testNet" mode=2 key_mgmt=NONE } $ wpa_supplicant -iwlan0 -c /etc/wpa_supplicant.conf nl80211: Beacon set failed: -22 (Invalid argument) Failed to set beacon parameters Interface initialization failed wlan0: interface state UNINITIALIZED->DISABLED wlan0: AP-DISABLED wlan0: Unable to setup interface. Failed to initialize AP interface After the change: $ wpa_supplicant -iwlan0 -c /etc/wpa_supplicant.conf Successfully initialized wpa_supplicant wlan0: interface state UNINITIALIZED->ENABLED wlan0: AP-ENABLED Cc: stable@vger.kernel.org Fixes: fe0a7776d4d1 ("wifi: wfx: fix possible NULL pointer dereference in wfx_set_mfp_ap()") Signed-off-by: Alexander Sverdlin Reviewed-by: Jérôme Pouiller Signed-off-by: Kalle Valo Link: https://patch.msgid.link/20240823131521.3309073-1-alexander.sverdlin@siemens.com drivers/net/wireless/silabs/wfx/sta.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) commit 9a471de516c35219d1722c13367191ce1f120fe9 Author: ZHANG Yuntian Date: Sat Aug 3 15:46:07 2024 +0800 USB: serial: option: add MeiG Smart SRM825L Add support for MeiG Smart SRM825L which is based on Qualcomm 315 chip. T: Bus=04 Lev=01 Prnt=01 Port=00 Cnt=01 Dev#= 2 Spd=5000 MxCh= 0 D: Ver= 3.20 Cls=00(>ifc ) Sub=00 Prot=00 MxPS= 9 #Cfgs= 1 P: Vendor=2dee ProdID=4d22 Rev= 4.14 S: Manufacturer=MEIG S: Product=LTE-A Module S: SerialNumber=6f345e48 C:* #Ifs= 6 Cfg#= 1 Atr=80 MxPwr=896mA I:* If#= 0 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=30 Driver=option E: Ad=81(I) Atr=02(Bulk) MxPS=1024 Ivl=0ms E: Ad=01(O) Atr=02(Bulk) MxPS=1024 Ivl=0ms I:* If#= 1 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=40 Driver=option E: Ad=83(I) Atr=03(Int.) MxPS= 10 Ivl=32ms E: Ad=82(I) Atr=02(Bulk) MxPS=1024 Ivl=0ms E: Ad=02(O) Atr=02(Bulk) MxPS=1024 Ivl=0ms I:* If#= 2 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=40 Driver=option E: Ad=85(I) Atr=03(Int.) MxPS= 10 Ivl=32ms E: Ad=84(I) Atr=02(Bulk) MxPS=1024 Ivl=0ms E: Ad=03(O) Atr=02(Bulk) MxPS=1024 Ivl=0ms I:* If#= 3 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=60 Driver=option E: Ad=87(I) Atr=03(Int.) MxPS= 10 Ivl=32ms E: Ad=86(I) Atr=02(Bulk) MxPS=1024 Ivl=0ms E: Ad=04(O) Atr=02(Bulk) MxPS=1024 Ivl=0ms I:* If#= 4 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=42 Prot=01 Driver=(none) E: Ad=05(O) Atr=02(Bulk) MxPS=1024 Ivl=0ms E: Ad=88(I) Atr=02(Bulk) MxPS=1024 Ivl=0ms I:* If#= 5 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=50 Driver=qmi_wwan E: Ad=89(I) Atr=03(Int.) MxPS= 8 Ivl=32ms E: Ad=8e(I) Atr=02(Bulk) MxPS=1024 Ivl=0ms E: Ad=0f(O) Atr=02(Bulk) MxPS=1024 Ivl=0ms Signed-off-by: ZHANG Yuntian Link: https://lore.kernel.org/0041DFA5200EFB1B+20240803074619.563116-1-yt@radxa.com/ Cc: stable@vger.kernel.org Signed-off-by: Johan Hovold drivers/usb/serial/option.c | 5 +++++ 1 file changed, 5 insertions(+) commit 3e9bff3bbe1355805de919f688bef4baefbfd436 Merge: 5be63fc19fca e00e99ba6c6b Author: Linus Torvalds Date: Tue Aug 27 16:57:35 2024 +1200 Merge tag 'vfs-6.11-rc6.fixes' of gitolite.kernel.org:pub/scm/linux/kernel/git/vfs/vfs Pull vfs fixes from Christian Brauner: "VFS: - Ensure that backing files uses file->f_ops->splice_write() for splice netfs: - Revert the removal of PG_private_2 from netfs_release_folio() as cephfs still relies on this - When AS_RELEASE_ALWAYS is set on a mapping the folio needs to always be invalidated during truncation - Fix losing untruncated data in a folio by making letting netfs_release_folio() return false if the folio is dirty - Fix trimming of streaming-write folios in netfs_inval_folio() - Reset iterator before retrying a short read - Fix interaction of streaming writes with zero-point tracker afs: - During truncation afs currently calls truncate_setsize() which sets i_size, expands the pagecache and truncates it. The first two operations aren't needed because they will have already been done. So call truncate_pagecache() instead and skip the redundant parts overlayfs: - Fix checking of the number of allowed lower layers so 500 layers can actually be used instead of just 499 - Add missing '\n' to pr_err() output - Pass string to ovl_parse_layer() and thus allow it to be used for Opt_lowerdir as well pidfd: - Revert blocking the creation of pidfds for kthread as apparently userspace relies on this. Specifically, it breaks systemd during shutdown romfs: - Fix romfs_read_folio() to use the correct offset with folio_zero_tail()" * tag 'vfs-6.11-rc6.fixes' of gitolite.kernel.org:pub/scm/linux/kernel/git/vfs/vfs: netfs: Fix interaction of streaming writes with zero-point tracker netfs: Fix missing iterator reset on retry of short read netfs: Fix trimming of streaming-write folios in netfs_inval_folio() netfs: Fix netfs_release_folio() to say no if folio dirty afs: Fix post-setattr file edit to do truncation correctly mm: Fix missing folio invalidation calls during truncation ovl: ovl_parse_param_lowerdir: Add missed '\n' for pr_err ovl: fix wrong lowerdir number check for parameter Opt_lowerdir ovl: pass string to ovl_parse_layer() backing-file: convert to using fops->splice_write Revert "pidfd: prevent creation of pidfds for kthreads" romfs: fix romfs_read_folio() netfs, ceph: Partially revert "netfs: Replace PG_fscache by setting folio->private and marking dirty" commit 7bbc079531fc38d401e1c4088d4981435a8828e3 Author: Cosmo Chou Date: Mon Aug 19 18:46:30 2024 +0800 hwmon: (pt5161l) Fix invalid temperature reading The temperature reading function was using a signed long for the ADC code, which could lead to mishandling of invalid codes on 32-bit platforms. This allowed out-of-range ADC codes to be incorrectly interpreted as valid values and used in temperature calculations. Change adc_code to u32 to ensure that invalid ADC codes are correctly identified on all platforms. Fixes: 1b2ca93cd059 ("hwmon: Add driver for Astera Labs PT5161L retimer") Signed-off-by: Cosmo Chou Message-ID: <20240819104630.2375441-1-chou.cosmo@gmail.com> Signed-off-by: Guenter Roeck drivers/hwmon/pt5161l.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) commit d26935690c03fe8159d42358bed1c56252700cd1 Author: Kent Overstreet Date: Mon Aug 26 19:11:00 2024 -0400 bcachefs: Fix bch2_extents_match() false positive This was caught as a very rare nonce inconsistency, on systems with encryption and replication (and tiering, or some form of rebalance operation running): [Wed Jul 17 13:30:03 2024] about to insert invalid key in data update path [Wed Jul 17 13:30:03 2024] old: u64s 10 type extent 671283510:6392:U32_MAX len 16 ver 106595503: durability: 2 crc: c_size 8 size 16 offset 0 nonce 0 csum chacha20_poly1305_80 compress zstd ptr: 3:355968:104 gen 7 ptr: 4:513244:48 gen 6 rebalance: target hdd compression zstd [Wed Jul 17 13:30:03 2024] k: u64s 10 type extent 671283510:6400:U32_MAX len 16 ver 106595508: durability: 2 crc: c_size 8 size 16 offset 0 nonce 0 csum chacha20_poly1305_80 compress zstd ptr: 3:355968:112 gen 7 ptr: 4:513244:56 gen 6 rebalance: target hdd compression zstd [Wed Jul 17 13:30:03 2024] new: u64s 14 type extent 671283510:6392:U32_MAX len 8 ver 106595508: durability: 2 crc: c_size 8 size 16 offset 0 nonce 0 csum chacha20_poly1305_80 compress zstd ptr: 3:355968:112 gen 7 cached ptr: 4:513244:56 gen 6 cached rebalance: target hdd compression zstd crc: c_size 8 size 16 offset 8 nonce 0 csum chacha20_poly1305_80 compress zstd ptr: 1:10860085:32 gen 0 ptr: 0:17285918:408 gen 0 [Wed Jul 17 13:30:03 2024] bcachefs (cca5bc65-fe77-409d-a9fa-465a6e7f4eae): fatal error - emergency read only bch2_extents_match() was reporting true for extents that did not actually point to the same data. bch2_extent_match() iterates over pairs of pointers, looking for pointers that point to the same location on disk (with matching generation numbers). However one or both extents may have been trimmed (or merged) and they might not have the same disk offset: it corrects for this by subtracting the key offset and the checksum entry offset. However, this failed when an extent was immediately partially overwritten, and the new overwrite was allocated the next adjacent disk space. Normally, with compression off, this would never cause a bug, since the new extent would have to be immediately after the old extent for the pointer offsets to match, and the rebalance index update path is not looking for an extent outside the range of the extent it moved. However with compression enabled, extents take up less space on disk than they do in the btree index space - and spuriously matching after partial overwrite is possible. To fix this, add a secondary check, that strictly checks that the regions pointed to on disk overlap. https://github.com/koverstreet/bcachefs/issues/717 Signed-off-by: Kent Overstreet fs/bcachefs/extents.c | 23 ++++++++++++++++++++++- 1 file changed, 22 insertions(+), 1 deletion(-) commit 66927b89289974dab6d3b3cdd7706d0376034114 Author: Kent Overstreet Date: Mon Aug 26 15:11:38 2024 -0400 bcachefs: Fix failure to return error in data_update_index_update() This fixes an assertion pop in io_write.c - if we don't return an error we're supposed to have completed all the btree updates. Signed-off-by: Kent Overstreet fs/bcachefs/data_update.c | 1 + 1 file changed, 1 insertion(+) commit 10d9d8c3512f16cad47b2ff81ec6fc4b27d8ee10 Author: Qu Wenruo Date: Sat Aug 17 18:34:30 2024 +0930 btrfs: fix a use-after-free when hitting errors inside btrfs_submit_chunk() [BUG] There is an internal report that KASAN is reporting use-after-free, with the following backtrace: BUG: KASAN: slab-use-after-free in btrfs_check_read_bio+0xa68/0xb70 [btrfs] Read of size 4 at addr ffff8881117cec28 by task kworker/u16:2/45 CPU: 1 UID: 0 PID: 45 Comm: kworker/u16:2 Not tainted 6.11.0-rc2-next-20240805-default+ #76 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.2-3-gd478f380-rebuilt.opensuse.org 04/01/2014 Workqueue: btrfs-endio btrfs_end_bio_work [btrfs] Call Trace: dump_stack_lvl+0x61/0x80 print_address_description.constprop.0+0x5e/0x2f0 print_report+0x118/0x216 kasan_report+0x11d/0x1f0 btrfs_check_read_bio+0xa68/0xb70 [btrfs] process_one_work+0xce0/0x12a0 worker_thread+0x717/0x1250 kthread+0x2e3/0x3c0 ret_from_fork+0x2d/0x70 ret_from_fork_asm+0x11/0x20 Allocated by task 20917: kasan_save_stack+0x37/0x60 kasan_save_track+0x10/0x30 __kasan_slab_alloc+0x7d/0x80 kmem_cache_alloc_noprof+0x16e/0x3e0 mempool_alloc_noprof+0x12e/0x310 bio_alloc_bioset+0x3f0/0x7a0 btrfs_bio_alloc+0x2e/0x50 [btrfs] submit_extent_page+0x4d1/0xdb0 [btrfs] btrfs_do_readpage+0x8b4/0x12a0 [btrfs] btrfs_readahead+0x29a/0x430 [btrfs] read_pages+0x1a7/0xc60 page_cache_ra_unbounded+0x2ad/0x560 filemap_get_pages+0x629/0xa20 filemap_read+0x335/0xbf0 vfs_read+0x790/0xcb0 ksys_read+0xfd/0x1d0 do_syscall_64+0x6d/0x140 entry_SYSCALL_64_after_hwframe+0x4b/0x53 Freed by task 20917: kasan_save_stack+0x37/0x60 kasan_save_track+0x10/0x30 kasan_save_free_info+0x37/0x50 __kasan_slab_free+0x4b/0x60 kmem_cache_free+0x214/0x5d0 bio_free+0xed/0x180 end_bbio_data_read+0x1cc/0x580 [btrfs] btrfs_submit_chunk+0x98d/0x1880 [btrfs] btrfs_submit_bio+0x33/0x70 [btrfs] submit_one_bio+0xd4/0x130 [btrfs] submit_extent_page+0x3ea/0xdb0 [btrfs] btrfs_do_readpage+0x8b4/0x12a0 [btrfs] btrfs_readahead+0x29a/0x430 [btrfs] read_pages+0x1a7/0xc60 page_cache_ra_unbounded+0x2ad/0x560 filemap_get_pages+0x629/0xa20 filemap_read+0x335/0xbf0 vfs_read+0x790/0xcb0 ksys_read+0xfd/0x1d0 do_syscall_64+0x6d/0x140 entry_SYSCALL_64_after_hwframe+0x4b/0x53 [CAUSE] Although I cannot reproduce the error, the report itself is good enough to pin down the cause. The call trace is the regular endio workqueue context, but the free-by-task trace is showing that during btrfs_submit_chunk() we already hit a critical error, and is calling btrfs_bio_end_io() to error out. And the original endio function called bio_put() to free the whole bio. This means a double freeing thus causing use-after-free, e.g.: 1. Enter btrfs_submit_bio() with a read bio The read bio length is 128K, crossing two 64K stripes. 2. The first run of btrfs_submit_chunk() 2.1 Call btrfs_map_block(), which returns 64K 2.2 Call btrfs_split_bio() Now there are two bios, one referring to the first 64K, the other referring to the second 64K. 2.3 The first half is submitted. 3. The second run of btrfs_submit_chunk() 3.1 Call btrfs_map_block(), which by somehow failed Now we call btrfs_bio_end_io() to handle the error 3.2 btrfs_bio_end_io() calls the original endio function Which is end_bbio_data_read(), and it calls bio_put() for the original bio. Now the original bio is freed. 4. The submitted first 64K bio finished Now we call into btrfs_check_read_bio() and tries to advance the bio iter. But since the original bio (thus its iter) is already freed, we trigger the above use-after free. And even if the memory is not poisoned/corrupted, we will later call the original endio function, causing a double freeing. [FIX] Instead of calling btrfs_bio_end_io(), call btrfs_orig_bbio_end_io(), which has the extra check on split bios and do the proper refcounting for cloned bios. Furthermore there is already one extra btrfs_cleanup_bio() call, but that is duplicated to btrfs_orig_bbio_end_io() call, so remove that label completely. Reported-by: David Sterba Fixes: 852eee62d31a ("btrfs: allow btrfs_submit_bio to split bios") CC: stable@vger.kernel.org # 6.6+ Reviewed-by: Josef Bacik Signed-off-by: Qu Wenruo Reviewed-by: David Sterba Signed-off-by: David Sterba fs/btrfs/bio.c | 26 ++++++++++++++++++-------- 1 file changed, 18 insertions(+), 8 deletions(-) commit b49420d6a1aeb399e5b107fc6eb8584d0860fbd7 Author: Alex Deucher Date: Wed Aug 21 15:11:35 2024 -0400 video/aperture: optionally match the device in sysfb_disable() In aperture_remove_conflicting_pci_devices(), we currently only call sysfb_disable() on vga class devices. This leads to the following problem when the pimary device is not VGA compatible: 1. A PCI device with a non-VGA class is the boot display 2. That device is probed first and it is not a VGA device so sysfb_disable() is not called, but the device resources are freed by aperture_detach_platform_device() 3. Non-primary GPU has a VGA class and it ends up calling sysfb_disable() 4. NULL pointer dereference via sysfb_disable() since the resources have already been freed by aperture_detach_platform_device() when it was called by the other device. Fix this by passing a device pointer to sysfb_disable() and checking the device to determine if we should execute it or not. v2: Fix build when CONFIG_SCREEN_INFO is not set v3: Move device check into the mutex Drop primary variable in aperture_remove_conflicting_pci_devices() Drop __init on pci sysfb_pci_dev_is_enabled() Fixes: 5ae3716cfdcd ("video/aperture: Only remove sysfb on the default vga pci device") Cc: Javier Martinez Canillas Cc: Thomas Zimmermann Cc: Helge Deller Cc: Sam Ravnborg Cc: Daniel Vetter Signed-off-by: Alex Deucher Cc: stable@vger.kernel.org Reviewed-by: Javier Martinez Canillas Reviewed-by: Thomas Zimmermann Signed-off-by: Alex Deucher Link: https://patchwork.freedesktop.org/patch/msgid/20240821191135.829765-1-alexander.deucher@amd.com drivers/firmware/sysfb.c | 19 +++++++++++++------ drivers/of/platform.c | 2 +- drivers/video/aperture.c | 11 +++-------- include/linux/sysfb.h | 4 ++-- 4 files changed, 19 insertions(+), 17 deletions(-) commit 7e8ae8486e4471513e2111aba6ac29f2357bed2a Author: Jeff Layton Date: Mon Aug 26 10:32:34 2024 -0400 fs/nfsd: fix update of inode attrs in CB_GETATTR Currently, we copy the mtime and ctime to the in-core inode and then mark the inode dirty. This is fine for certain types of filesystems, but not all. Some require a real setattr to properly change these values (e.g. ceph or reexported NFS). Fix this code to call notify_change() instead, which is the proper way to effect a setattr. There is one problem though: In this case, the client is holding a write delegation and has sent us attributes to update our cache. We don't want to break the delegation for this since that would defeat the purpose. Add a new ATTR_DELEG flag that makes notify_change bypass the try_break_deleg call. Fixes: c5967721e106 ("NFSD: handle GETATTR conflict with write delegation") Reviewed-by: Christian Brauner Signed-off-by: Jeff Layton Signed-off-by: Chuck Lever fs/attr.c | 14 +++++++++++--- fs/nfsd/nfs4state.c | 18 +++++++++++++----- fs/nfsd/nfs4xdr.c | 2 +- fs/nfsd/state.h | 2 +- include/linux/fs.h | 1 + 5 files changed, 27 insertions(+), 10 deletions(-) commit 5572a55a6f830ee3f3a994b6b962a5c327d28cb3 Author: Maurizio Lombardi Date: Wed Aug 21 16:28:26 2024 +0200 nvmet-tcp: fix kernel crash if commands allocation fails If the commands allocation fails in nvmet_tcp_alloc_cmds() the kernel crashes in nvmet_tcp_release_queue_work() because of a NULL pointer dereference. nvmet: failed to install queue 0 cntlid 1 ret 6 Unable to handle kernel NULL pointer dereference at virtual address 0000000000000008 Fix the bug by setting queue->nr_cmds to zero in case nvmet_tcp_alloc_cmd() fails. Fixes: 872d26a391da ("nvmet-tcp: add NVMe over TCP target driver") Signed-off-by: Maurizio Lombardi Reviewed-by: Christoph Hellwig Signed-off-by: Keith Busch drivers/nvme/target/tcp.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) commit e846be0fba85603d2ad6fc8db6810958d7b6bed1 Author: MD Danish Anwar Date: Fri Aug 23 17:34:12 2024 +0530 net: ti: icssg-prueth: Fix 10M Link issue on AM64x Crash is seen on AM64x 10M link when connecting / disconnecting multiple times. The fix for this is to enable quirk_10m_link_issue for AM64x. Fixes: b256e13378a9 ("net: ti: icssg-prueth: Add AM64x icssg support") Signed-off-by: MD Danish Anwar Reviewed-by: Roger Quadros Link: https://patch.msgid.link/20240823120412.1262536-1-danishanwar@ti.com Signed-off-by: Jakub Kicinski drivers/net/ethernet/ti/icssg/icssg_prueth.c | 1 + 1 file changed, 1 insertion(+) commit 0903b9e2a46cb6252a13d6b19d0502da9be191cf Author: Jubilee Young Date: Thu Aug 22 22:03:59 2024 -0700 rust: alloc: eschew `Box>::write` Upstream Rust's libs-api team has consensus for stabilizing some of `feature(new_uninit)`, but not for `Box>::write`. Instead, we can use `MaybeUninit::write`, so Rust for Linux can drop the feature after stabilization. That will happen after merging, as the FCP has completed [1]. This is required before stabilization because remaining-unstable API will be divided into new features. This code doesn't know about those yet. It can't: they haven't landed, as the relevant PR is blocked on rustc's CI testing Rust-for-Linux without this patch. [ The PR has landed [2] and will be released in Rust 1.82.0 (expected on 2024-10-17), so we could conditionally enable the new unstable feature (`box_uninit_write` [3]) instead, but just for a single `unsafe` block it is probably not worth it. For the time being, I added it to the "nice to have" section of our unstable features list. - Miguel ] Link: https://github.com/rust-lang/rust/issues/63291#issuecomment-2183022955 [1] Link: https://github.com/rust-lang/rust/pull/129416 [2] Link: https://github.com/rust-lang/rust/issues/129397 [3] Signed-off-by: Jubilee Young Reviewed-by: Alice Ryhl Reviewed-by: Trevor Gross [ Reworded slightly. - Miguel ] Signed-off-by: Miguel Ojeda rust/kernel/alloc/box_ext.rs | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) commit 284b75a3d83c7631586d98f6dede1d90f128f0db Author: Zheng Qixing Date: Thu Aug 22 11:30:50 2024 +0800 ata: libata: Fix memory leak for error path in ata_host_alloc() In ata_host_alloc(), if devres_alloc() fails to allocate the device host resource data pointer, the already allocated ata_host structure is not freed before returning from the function. This results in a potential memory leak. Call kfree(host) before jumping to the error handling path to ensure that the ata_host structure is properly freed if devres_alloc() fails. Fixes: 2623c7a5f279 ("libata: add refcounting to ata_host") Cc: stable@vger.kernel.org Signed-off-by: Zheng Qixing Reviewed-by: Yu Kuai Signed-off-by: Damien Le Moal drivers/ata/libata-core.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) commit a699781c79ecf6cfe67fb00a0331b4088c7c8466 Author: Jamie Bainbridge Date: Fri Aug 23 16:26:58 2024 +1000 ethtool: check device is present when getting link settings A sysfs reader can race with a device reset or removal, attempting to read device state when the device is not actually present. eg: [exception RIP: qed_get_current_link+17] #8 [ffffb9e4f2907c48] qede_get_link_ksettings at ffffffffc07a994a [qede] #9 [ffffb9e4f2907cd8] __rh_call_get_link_ksettings at ffffffff992b01a3 #10 [ffffb9e4f2907d38] __ethtool_get_link_ksettings at ffffffff992b04e4 #11 [ffffb9e4f2907d90] duplex_show at ffffffff99260300 #12 [ffffb9e4f2907e38] dev_attr_show at ffffffff9905a01c #13 [ffffb9e4f2907e50] sysfs_kf_seq_show at ffffffff98e0145b #14 [ffffb9e4f2907e68] seq_read at ffffffff98d902e3 #15 [ffffb9e4f2907ec8] vfs_read at ffffffff98d657d1 #16 [ffffb9e4f2907f00] ksys_read at ffffffff98d65c3f #17 [ffffb9e4f2907f38] do_syscall_64 at ffffffff98a052fb crash> struct net_device.state ffff9a9d21336000 state = 5, state 5 is __LINK_STATE_START (0b1) and __LINK_STATE_NOCARRIER (0b100). The device is not present, note lack of __LINK_STATE_PRESENT (0b10). This is the same sort of panic as observed in commit 4224cfd7fb65 ("net-sysfs: add check for netdevice being present to speed_show"). There are many other callers of __ethtool_get_link_ksettings() which don't have a device presence check. Move this check into ethtool to protect all callers. Fixes: d519e17e2d01 ("net: export device speed and duplex via sysfs") Fixes: 4224cfd7fb65 ("net-sysfs: add check for netdevice being present to speed_show") Signed-off-by: Jamie Bainbridge Link: https://patch.msgid.link/8bae218864beaa44ed01628140475b9bf641c5b0.1724393671.git.jamie.bainbridge@gmail.com Signed-off-by: Jakub Kicinski net/core/net-sysfs.c | 2 +- net/ethtool/ioctl.c | 3 +++ 2 files changed, 4 insertions(+), 1 deletion(-) commit 1165e70a4a5d8b4da77002ac22b4c5397f30e00d Merge: 22652022c7ee 6ba20539ac6b Author: Mark Brown Date: Mon Aug 26 21:36:52 2024 +0100 ASoC: fix module autoloading Merge series from Liao Chen : This patchset aims to enable autoloading of some use modules. By registering MDT, the kernel is allowed to automatically bind modules to devices that match the specified compatible strings. commit c6a09e342f8e6d3cac7f7c5c14085236aca284b9 Author: Max Filippov Date: Sun Aug 25 20:27:45 2024 -0700 binfmt_elf_fdpic: fix AUXV size calculation when ELF_HWCAP2 is defined create_elf_fdpic_tables() does not correctly account the space for the AUX vector when an architecture has ELF_HWCAP2 defined. Prior to the commit 10e29251be0e ("binfmt_elf_fdpic: fix /proc//auxv") it resulted in the last entry of the AUX vector being set to zero, but with that change it results in a kernel BUG. Fix that by adding one to the number of AUXV entries (nitems) when ELF_HWCAP2 is defined. Fixes: 10e29251be0e ("binfmt_elf_fdpic: fix /proc//auxv") Cc: stable@vger.kernel.org Reported-by: Greg Ungerer Closes: https://lore.kernel.org/lkml/5b51975f-6d0b-413c-8b38-39a6a45e8821@westnet.com.au/ Signed-off-by: Max Filippov Tested-by: Greg Ungerer Link: https://lore.kernel.org/r/20240826032745.3423812-1-jcmvbkbc@gmail.com Signed-off-by: Kees Cook fs/binfmt_elf_fdpic.c | 3 +++ 1 file changed, 3 insertions(+) commit b6fb565a2d15277896583d471b21bc14a0c99661 Author: Kirill A. Shutemov Date: Mon Aug 26 15:53:04 2024 +0300 x86/tdx: Fix data leak in mmio_read() The mmio_read() function makes a TDVMCALL to retrieve MMIO data for an address from the VMM. Sean noticed that mmio_read() unintentionally exposes the value of an initialized variable (val) on the stack to the VMM. This variable is only needed as an output value. It did not need to be passed to the VMM in the first place. Do not send the original value of *val to the VMM. [ dhansen: clarify what 'val' is used for. ] Fixes: 31d58c4e557d ("x86/tdx: Handle in-kernel MMIO") Reported-by: Sean Christopherson Signed-off-by: Kirill A. Shutemov Signed-off-by: Dave Hansen Cc:stable@vger.kernel.org Link: https://lore.kernel.org/all/20240826125304.1566719-1-kirill.shutemov%40linux.intel.com arch/x86/coco/tdx/tdx.c | 1 - 1 file changed, 1 deletion(-) commit 22652022c7eef3c4ad6ab5f13a6dfc7f25f853d4 Author: Laurentiu Mihalcea Date: Mon Aug 26 14:24:42 2024 -0400 ASoC: SOF: ipc: replace "enum sof_comp_type" field with "uint32_t" Normally, the type of enums is "unsigned int" or "int". GCC has the "-fshort-enums" option, which instructs the compiler to use the smallest data type that can hold all the values in the enum (i.e: char, short, int or their unsigned variants). According to the GCC documentation, "-fshort-enums" may be default on some targets. This seems to be the case for SOF when built for a certain 32-bit ARM platform. On Linux, this is not the case (tested with "aarch64-linux-gnu-gcc") which means enums such as "enum sof_comp_type" will end up having different sizes on Linux and SOF. Since "enum sof_comp_type" is used in IPC-related structures such as "struct sof_ipc_comp", this means the fields of the structures will end up being placed at different offsets. This, in turn, leads to SOF not being able to properly interpret data passed from Linux. With this in mind, replace "enum sof_comp_type" from "struct sof_ipc_comp" with "uint32_t". Signed-off-by: Laurentiu Mihalcea Reviewed-by: Pierre-Louis Bossart Reviewed-by: Bard Liao Reviewed-by: Daniel Baluta Link: https://patch.msgid.link/20240826182442.6191-1-laurentiumihalcea111@gmail.com Signed-off-by: Mark Brown include/sound/sof/topology.h | 2 +- include/uapi/sound/sof/abi.h | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) commit 31a972959ae57691a1e4f539399b2674ae576086 Merge: 4186c8d9e6af 18b3256db76b Author: Jakub Kicinski Date: Mon Aug 26 08:53:44 2024 -0700 Merge tag 'for-net-2024-08-23' of git://git.kernel.org/pub/scm/linux/kernel/git/bluetooth/bluetooth Luiz Augusto von Dentz says: ==================== bluetooth pull request for net: - btintel: Allow configuring drive strength of BRI - hci_core: Fix not handling hibernation actions - btnxpuart: Fix random crash seen while removing driver * tag 'for-net-2024-08-23' of git://git.kernel.org/pub/scm/linux/kernel/git/bluetooth/bluetooth: Bluetooth: hci_core: Fix not handling hibernation actions Bluetooth: btnxpuart: Fix random crash seen while removing driver Bluetooth: btintel: Allow configuring drive strength of BRI ==================== Link: https://patch.msgid.link/20240823200008.65241-1-luiz.dentz@gmail.com Signed-off-by: Jakub Kicinski commit 1116e0e372eb16dd907ec571ce5d4af325c55c10 Author: Jeff Layton Date: Fri Aug 23 18:27:39 2024 -0400 nfsd: fix potential UAF in nfsd4_cb_getattr_release Once we drop the delegation reference, the fields embedded in it are no longer safe to access. Do that last. Fixes: c5967721e106 ("NFSD: handle GETATTR conflict with write delegation") Signed-off-by: Jeff Layton Signed-off-by: Chuck Lever fs/nfsd/nfs4state.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit da05ba23d4c8d3e8a45846b952e53dd76c4b5e36 Author: Jeff Layton Date: Fri Aug 23 18:27:38 2024 -0400 nfsd: hold reference to delegation when updating it for cb_getattr Once we've dropped the flc_lock, there is nothing that ensures that the delegation that was found will still be around later. Take a reference to it while holding the lock and then drop it when we've finished with the delegation. Fixes: c5967721e106 ("NFSD: handle GETATTR conflict with write delegation") Signed-off-by: Jeff Layton Signed-off-by: Chuck Lever fs/nfsd/nfs4state.c | 10 +++++++--- 1 file changed, 7 insertions(+), 3 deletions(-) commit f25d1b5f1be13a6de341b1d26e0cf4275e5908d2 Author: Chuck Lever Date: Sat Aug 17 11:33:27 2024 -0400 MAINTAINERS: Update Olga Kornievskaia's email address Signed-off-by: Chuck Lever MAINTAINERS | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 786c5be9ac29a39b6f37f1fdd2ea59d0fe35d525 Author: Dmitry Antipov Date: Mon Aug 5 17:20:35 2024 +0300 wifi: mac80211: free skb on error path in ieee80211_beacon_get_ap() In 'ieee80211_beacon_get_ap()', free allocated skb in case of error returned by 'ieee80211_beacon_protect()'. Compile tested only. Signed-off-by: Dmitry Antipov Link: https://patch.msgid.link/20240805142035.227847-1-dmantipov@yandex.ru Signed-off-by: Johannes Berg net/mac80211/tx.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) commit 3a84454f5204718ca5b4ad2c1f0bf2031e2403d1 Author: Emmanuel Grumbach Date: Sun Aug 25 19:17:04 2024 +0300 wifi: iwlwifi: mvm: don't wait for tx queues if firmware is dead There is a WARNING in iwl_trans_wait_tx_queues_empty() (that was recently converted from just a message), that can be hit if we wait for TX queues to become empty after firmware died. Clearly, we can't expect anything from the firmware after it's declared dead. Don't call iwl_trans_wait_tx_queues_empty() in this case. While it could be a good idea to stop the flow earlier, the flush functions do some maintenance work that is not related to the firmware, so keep that part of the code running even when the firmware is not running. Signed-off-by: Emmanuel Grumbach Signed-off-by: Miri Korenblit Link: https://patch.msgid.link/20240825191257.a7cbd794cee9.I44a739fbd4ffcc46b83844dd1c7b2eb0c7b270f6@changeid [edit commit message] Signed-off-by: Johannes Berg drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-) commit 454f6306a31248cf972f5f16d4c145ad5b33bfdc Author: Avraham Stern Date: Sun Aug 25 19:17:12 2024 +0300 wifi: iwlwifi: mvm: allow 6 GHz channels in MLO scan MLO internal scan may include 6 GHz channels. Since the 6 GHz scan indication is not set, the channel flags are set incorrectly, which leads to a firmware assert. Since the MLO scan may include 6 GHz and non 6 GHz channels in one request, add support for non-PSC 6 GHz channels (PSC channels are already supported) when the 6 GHz indication is not set. Fixes: 38b3998dfba3 ("wifi: iwlwifi: mvm: Introduce internal MLO passive scan") Signed-off-by: Avraham Stern Signed-off-by: Miri Korenblit Link: https://patch.msgid.link/20240825191257.04807f8213b2.Idd09d4366df92a74853649c1a520b7f0f752d1ac@changeid Signed-off-by: Johannes Berg drivers/net/wireless/intel/iwlwifi/mvm/scan.c | 11 +++++++++++ 1 file changed, 11 insertions(+) commit 0668ebc8c2282ca1e7eb96092a347baefffb5fe7 Author: Emmanuel Grumbach Date: Sun Aug 25 19:17:10 2024 +0300 wifi: iwlwifi: mvm: pause TCM when the firmware is stopped Not doing so will make us send a host command to the transport while the firmware is not alive, which will trigger a WARNING. bad state = 0 WARNING: CPU: 2 PID: 17434 at drivers/net/wireless/intel/iwlwifi/iwl-trans.c:115 iwl_trans_send_cmd+0x1cb/0x1e0 [iwlwifi] RIP: 0010:iwl_trans_send_cmd+0x1cb/0x1e0 [iwlwifi] Call Trace: iwl_mvm_send_cmd+0x40/0xc0 [iwlmvm] iwl_mvm_config_scan+0x198/0x260 [iwlmvm] iwl_mvm_recalc_tcm+0x730/0x11d0 [iwlmvm] iwl_mvm_tcm_work+0x1d/0x30 [iwlmvm] process_one_work+0x29e/0x640 worker_thread+0x2df/0x690 ? rescuer_thread+0x540/0x540 kthread+0x192/0x1e0 ? set_kthread_struct+0x90/0x90 ret_from_fork+0x22/0x30 Signed-off-by: Emmanuel Grumbach Signed-off-by: Miri Korenblit Link: https://patch.msgid.link/20240825191257.5abe71ca1b6b.I97a968cb8be1f24f94652d9b110ecbf6af73f89e@changeid Signed-off-by: Johannes Berg drivers/net/wireless/intel/iwlwifi/mvm/ops.c | 2 ++ 1 file changed, 2 insertions(+) commit 3ee22f07a35b76939c5b8d17d6af292f5fafb509 Author: Anjaneyulu Date: Sun Aug 25 19:17:08 2024 +0300 wifi: iwlwifi: fw: fix wgds rev 3 exact size Check size of WGDS revision 3 is equal to 8 entries size with some header, but doesn't depend on the number of used entries. Check that used entries are between min and max but allow more to be present than are used to fix operation with some BIOSes that have such data. Fixes: 97f8a3d1610b ("iwlwifi: ACPI: support revision 3 WGDS tables") Signed-off-by: Anjaneyulu Signed-off-by: Miri Korenblit Link: https://patch.msgid.link/20240825191257.cc71dfc67ec3.Ic27ee15ac6128b275c210b6de88f2145bd83ca7b@changeid [edit commit message] Signed-off-by: Johannes Berg drivers/net/wireless/intel/iwlwifi/fw/acpi.c | 13 ++++++++----- 1 file changed, 8 insertions(+), 5 deletions(-) commit cd6f46c2fdb82e80ca248549c1f3ebe08b4a63ab Author: Emmanuel Grumbach Date: Sun Aug 25 19:17:07 2024 +0300 wifi: iwlwifi: mvm: take the mutex before running link selection iwl_mvm_select_links is called by the link selection worker and it requires the mutex. Take it in the link selection worker. This logic used to run from iwl_mvm_rx_umac_scan_complete_notif which had the mvm->mutex held. This was changed to run in a worker holding the wiphy mutex, but we also need the mvm->mutex. Fixes: 2e194efa3809 ("wifi: iwlwifi: mvm: Fix race in scan completion") Signed-off-by: Emmanuel Grumbach Reviewed-by: Ilan Peer Signed-off-by: Miri Korenblit Link: https://patch.msgid.link/20240825191257.0cacecd5db1e.Iaca38a078592b69bdd06549daf63408ccf1810e4@changeid Signed-off-by: Johannes Berg drivers/net/wireless/intel/iwlwifi/mvm/ops.c | 2 ++ 1 file changed, 2 insertions(+) commit 916a5d9c5354c426220a0a6533a5e8ea1287d6ea Author: Daniel Gabay Date: Sun Aug 25 19:17:06 2024 +0300 wifi: iwlwifi: mvm: fix iwl_mvm_max_scan_ie_fw_cmd_room() Driver creates also the WFA TPC element, consider that in the calculation. Signed-off-by: Daniel Gabay Reviewed-by: Ilan Peer Signed-off-by: Miri Korenblit Link: https://patch.msgid.link/20240825191257.e710ce446b7f.I2715c6742e9c3d160e2ba41bc4b35de370d2ce34@changeid Signed-off-by: Johannes Berg drivers/net/wireless/intel/iwlwifi/mvm/scan.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) commit d44162280899c3fc2c6700e21e491e71c3c96e3d Author: Daniel Gabay Date: Sun Aug 25 19:17:05 2024 +0300 wifi: iwlwifi: mvm: fix iwl_mvm_scan_fits() calculation The calculation should consider also the 6GHz IE's len, fix that. In addition, in iwl_mvm_sched_scan_start() the scan_fits helper is called only in case non_psc_incldued is true, but it should be called regardless, fix that as well. Signed-off-by: Daniel Gabay Reviewed-by: Ilan Peer Signed-off-by: Miri Korenblit Link: https://patch.msgid.link/20240825191257.7db825442fd2.I99f4d6587709de02072fd57957ec7472331c6b1d@changeid Signed-off-by: Johannes Berg drivers/net/wireless/intel/iwlwifi/mvm/scan.c | 23 ++++++++++++----------- 1 file changed, 12 insertions(+), 11 deletions(-) commit f8a129c1e10256c785164ed5efa5d17d45fbd81b Author: Benjamin Berg Date: Sun Aug 25 19:17:13 2024 +0300 wifi: iwlwifi: lower message level for FW buffer destination An invalid buffer destination is not a problem for the driver and it does not make sense to report it with the KERN_ERR message level. As such, change the message to use IWL_DEBUG_FW. Reported-by: Len Brown Closes: https://lore.kernel.org/r/CAJvTdKkcxJss=DM2sxgv_MR5BeZ4_OC-3ad6tA40TYH2yqHCWw@mail.gmail.com Signed-off-by: Benjamin Berg Signed-off-by: Miri Korenblit Link: https://patch.msgid.link/20240825191257.20abf78f05bc.Ifbcecc2ae9fb40b9698302507dcba8b922c8d856@changeid Signed-off-by: Johannes Berg drivers/net/wireless/intel/iwlwifi/pcie/ctxt-info-gen3.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) commit cb347bd29d0d106213a0cf4f86b72dffd08d3454 Author: Emmanuel Grumbach Date: Sun Aug 25 19:17:02 2024 +0300 wifi: iwlwifi: mvm: fix hibernation Fast resume is a feature that was recently introduced to speed up the resume time. It basically keeps the firmware alive while the system is suspended and that avoids starting again the whole device. This flow can't work for hibernation, since when the system boots, before the frozen image is loaded, the kernel may touch the device. As a result, we can't assume the device is in the exact same state as before the hibernation. Detect that we are resuming from hibernation through the PCI device and forbid the fast resume flow. We also need to shut down the device cleanly when that happens. In addition, in case the device is power gated during S3, we won't be able to keep the device alive. Detect this situation with BE200 at least with the help of the CSR_FUNC_SCRATCH register and reset the device upon resume if it was power gated during S3. Fixes: e8bb19c1d590 ("wifi: iwlwifi: support fast resume") Signed-off-by: Emmanuel Grumbach Signed-off-by: Miri Korenblit Link: https://patch.msgid.link/20240825191257.24eb3b19e74f.I3837810318dbef0a0a773cf4c4fcf89cdc6fdbd3@changeid Signed-off-by: Johannes Berg drivers/net/wireless/intel/iwlwifi/iwl-op-mode.h | 12 +++++++ drivers/net/wireless/intel/iwlwifi/mvm/d3.c | 10 ++++++ drivers/net/wireless/intel/iwlwifi/mvm/ops.c | 17 +++++++++- drivers/net/wireless/intel/iwlwifi/pcie/drv.c | 41 ++++++++++++++++++++++-- 4 files changed, 76 insertions(+), 4 deletions(-) commit 3e9b4021fedf92c11233ae1a8615327d0cbbecd5 Author: Daniel Gabay Date: Fri Aug 23 10:55:46 2024 +0200 wifi: mac80211: fix beacon SSID mismatch handling Return false when memcmp with zero_ssid returns 0 to correctly handle hidden SSIDs case. Fixes: 9cc88678db5b ("wifi: mac80211: check SSID in beacon") Reviewed-by: Andrei Otcheretianski Reviewed-by: Miriam Rachel Korenblit Signed-off-by: Daniel Gabay Link: https://patch.msgid.link/20240823105546.7ab29ae287a6.I7f98e57e1ab6597614703fdd138cc88ad253d986@changeid Signed-off-by: Johannes Berg net/mac80211/mlme.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 4956e07f05e239b274d042618a250c9fa3e92629 Author: Bibo Mao Date: Mon Aug 26 23:11:32 2024 +0800 LoongArch: KVM: Invalidate guest steal time address on vCPU reset If ParaVirt steal time feature is enabled, there is a percpu gpa address passed from guest vCPU and host modifies guest memory space with this gpa address. When vCPU is reset normally, it will notify host and invalidate gpa address. However if VM is crashed and VMM reboots VM forcely, the vCPU reboot notification callback will not be called in VM. Host needs invalidate the gpa address, else host will modify guest memory during VM reboots. Here it is invalidated from the vCPU KVM_REG_LOONGARCH_VCPU_RESET ioctl interface. Also funciton kvm_reset_timer() is removed at vCPU reset stage, since SW emulated timer is only used in vCPU block state. When a vCPU is removed from the block waiting queue, kvm_restore_timer() is called and SW timer is cancelled. And the timer register is also cleared at VMM when a vCPU is reset. Signed-off-by: Bibo Mao Signed-off-by: Huacai Chen arch/loongarch/include/asm/kvm_vcpu.h | 1 - arch/loongarch/kvm/timer.c | 7 ------- arch/loongarch/kvm/vcpu.c | 2 +- 3 files changed, 1 insertion(+), 9 deletions(-) commit 80376323e2b6a4559f86b2b4d864848ac25cb054 Author: Tiezhu Yang Date: Mon Aug 26 23:11:32 2024 +0800 LoongArch: Add ifdefs to fix LSX and LASX related warnings There exist some warnings when building kernel if CONFIG_CPU_HAS_LBT is set but CONFIG_CPU_HAS_LSX and CONFIG_CPU_HAS_LASX are not set. In this case, there are no definitions of _restore_lsx & _restore_lasx and there are also no definitions of kvm_restore_lsx & kvm_restore_lasx in fpu.S and switch.S respectively, just add some ifdefs to fix these warnings. AS arch/loongarch/kernel/fpu.o arch/loongarch/kernel/fpu.o: warning: objtool: unexpected relocation symbol type in .rela.discard.func_stack_frame_non_standard: 0 arch/loongarch/kernel/fpu.o: warning: objtool: unexpected relocation symbol type in .rela.discard.func_stack_frame_non_standard: 0 AS [M] arch/loongarch/kvm/switch.o arch/loongarch/kvm/switch.o: warning: objtool: unexpected relocation symbol type in .rela.discard.func_stack_frame_non_standard: 0 arch/loongarch/kvm/switch.o: warning: objtool: unexpected relocation symbol type in .rela.discard.func_stack_frame_non_standard: 0 MODPOST Module.symvers ERROR: modpost: "kvm_restore_lsx" [arch/loongarch/kvm/kvm.ko] undefined! ERROR: modpost: "kvm_restore_lasx" [arch/loongarch/kvm/kvm.ko] undefined! Cc: stable@vger.kernel.org # 6.9+ Fixes: cb8a2ef0848c ("LoongArch: Add ORC stack unwinder support") Reported-by: kernel test robot Closes: https://lore.kernel.org/oe-kbuild-all/202408120955.qls5oNQY-lkp@intel.com/ Signed-off-by: Tiezhu Yang Signed-off-by: Huacai Chen arch/loongarch/kernel/fpu.S | 4 ++++ arch/loongarch/kvm/switch.S | 4 ++++ 2 files changed, 8 insertions(+) commit 274ea3563e5ab9f468c15bfb9d2492803a66d9be Author: Huacai Chen Date: Mon Aug 26 23:11:32 2024 +0800 LoongArch: Define ARCH_IRQ_INIT_FLAGS as IRQ_NOPROBE Currently we call irq_set_noprobe() in a loop for all IRQs, but indeed it only works for IRQs below NR_IRQS_LEGACY because at init_IRQ() only legacy interrupts have been allocated. Instead, we can define ARCH_IRQ_INIT_FLAGS as IRQ_NOPROBE in asm/hwirq.h and the core will automatically set the flag for all interrupts. Reviewed-by: Thomas Gleixner Signed-off-by: Huacai Chen Signed-off-by: Tianyang Zhang arch/loongarch/include/asm/hw_irq.h | 2 ++ arch/loongarch/kernel/irq.c | 3 --- 2 files changed, 2 insertions(+), 3 deletions(-) commit 33f58a0480bb9e2479ccdf556f61363723a50d47 Author: David Sterba Date: Wed Aug 21 01:19:57 2024 +0200 btrfs: initialize last_extent_end to fix -Wmaybe-uninitialized warning in extent_fiemap() There's a warning (probably on some older compiler version): fs/btrfs/fiemap.c: warning: 'last_extent_end' may be used uninitialized in this function [-Wmaybe-uninitialized]: => 822:19 Initialize the variable to 0 although it's not necessary as it's either properly set or not used after an error. The called function is in the same file so this is a false alert but we want to fix all -Wmaybe-uninitialized reports. Link: https://lore.kernel.org/all/20240819070639.2558629-1-geert@linux-m68k.org/ Reported-by: Geert Uytterhoeven Signed-off-by: David Sterba fs/btrfs/fiemap.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 6ba20539ac6b12ea757b3bfe11adf8de1672d7b8 Author: Liao Chen Date: Mon Aug 26 08:49:24 2024 +0000 ASoC: fix module autoloading Add MODULE_DEVICE_TABLE(), so modules could be properly autoloaded based on the alias from of_device_id table. Signed-off-by: Liao Chen Link: https://patch.msgid.link/20240826084924.368387-5-liaochen4@huawei.com Signed-off-by: Mark Brown sound/soc/codecs/chv3-codec.c | 1 + 1 file changed, 1 insertion(+) commit 934b44589da9aa300201a00fe139c5c54f421563 Author: Liao Chen Date: Mon Aug 26 08:49:23 2024 +0000 ASoC: tda7419: fix module autoloading Add MODULE_DEVICE_TABLE(), so modules could be properly autoloaded based on the alias from of_device_id table. Signed-off-by: Liao Chen Link: https://patch.msgid.link/20240826084924.368387-4-liaochen4@huawei.com Signed-off-by: Mark Brown sound/soc/codecs/tda7419.c | 1 + 1 file changed, 1 insertion(+) commit 8e1bb4a41aa78d6105e59186af3dcd545fc66e70 Author: Liao Chen Date: Mon Aug 26 08:49:22 2024 +0000 ASoC: google: fix module autoloading Add MODULE_DEVICE_TABLE(), so modules could be properly autoloaded based on the alias from of_device_id table. Signed-off-by: Liao Chen Link: https://patch.msgid.link/20240826084924.368387-3-liaochen4@huawei.com Signed-off-by: Mark Brown sound/soc/google/chv3-i2s.c | 1 + 1 file changed, 1 insertion(+) commit ae61a3391088d29aa8605c9f2db84295ab993a49 Author: Liao Chen Date: Mon Aug 26 08:49:21 2024 +0000 ASoC: intel: fix module autoloading Add MODULE_DEVICE_TABLE(), so modules could be properly autoloaded based on the alias from of_device_id table. Signed-off-by: Liao Chen Link: https://patch.msgid.link/20240826084924.368387-2-liaochen4@huawei.com Signed-off-by: Mark Brown sound/soc/intel/keembay/kmb_platform.c | 1 + 1 file changed, 1 insertion(+) commit 4186c8d9e6af57bab0687b299df10ebd47534a0a Author: Jacky Chou Date: Thu Aug 22 15:30:06 2024 +0800 net: ftgmac100: Ensure tx descriptor updates are visible The driver must ensure TX descriptor updates are visible before updating TX pointer and TX clear pointer. This resolves TX hangs observed on AST2600 when running iperf3. Signed-off-by: Jacky Chou Signed-off-by: David S. Miller drivers/net/ethernet/faraday/ftgmac100.c | 26 ++++++++++++++++++-------- 1 file changed, 18 insertions(+), 8 deletions(-) commit f2c6dbd220170c2396fb019ead67fbada1e23ebd Author: David Gow Date: Fri Aug 16 12:51:22 2024 +0800 kunit: Device wrappers should also manage driver name kunit_driver_create() accepts a name for the driver, but does not copy it, so if that name is either on the stack, or otherwise freed, we end up with a use-after-free when the driver is cleaned up. Instead, strdup() the name, and manage it as another KUnit allocation. As there was no existing kunit_kstrdup(), we add one. Further, add a kunit_ variant of strdup_const() and kfree_const(), so we don't need to allocate and manage the string in the majority of cases where it's a constant. However, these are inline functions, and is_kernel_rodata() only works for built-in code. This causes problems in two cases: - If kunit is built as a module, __{start,end}_rodata is not defined. - If a kunit test using these functions is built as a module, it will suffer the same fate. This fixes a KASAN splat with overflow.overflow_allocation_test, when built as a module. Restrict the is_kernel_rodata() case to when KUnit is built as a module, which fixes the first case, at the cost of losing the optimisation. Also, make kunit_{kstrdup,kfree}_const non-inline, so that other modules using them will not accidentally depend on is_kernel_rodata(). If KUnit is built-in, they'll benefit from the optimisation, if KUnit is not, they won't, but the string will be properly duplicated. Fixes: d03c720e03bd ("kunit: Add APIs for managing devices") Reported-by: Nico Pache Closes: https://groups.google.com/g/kunit-dev/c/81V9b9QYON0 Reviewed-by: Kees Cook Reviewed-by: Maxime Ripard Reviewed-by: Rae Moar Signed-off-by: David Gow Tested-by: Rae Moar Signed-off-by: Shuah Khan include/kunit/test.h | 48 ++++++++++++++++++++++++++++++++++++++++++++++++ lib/kunit/device.c | 7 +++++-- lib/kunit/test.c | 19 +++++++++++++++++++ 3 files changed, 72 insertions(+), 2 deletions(-) commit 052f3951640fd96d2e777b3272a925ec6c0c8100 Author: Ryan Sullivan Date: Thu Aug 22 13:31:22 2024 -0400 selftests/livepatch: wait for atomic replace to occur On some machines with a large number of CPUs there is a sizable delay between an atomic replace occurring and when sysfs updates accordingly. This fix uses 'loop_until' to wait for the atomic replace to unload all previous livepatches. Reported-by: CKI Project Closes: https://datawarehouse.cki-project.org/kcidb/tests/redhat:1413102084-x86_64-kernel_upt_28 Signed-off-by: Ryan Sullivan Reviewed-by: Petr Mladek Acked-by: Joe Lawrence Link: https://lore.kernel.org/r/20240822173122.14760-1-rysulliv@redhat.com Signed-off-by: Petr Mladek tools/testing/selftests/livepatch/test-livepatch.sh | 7 ++----- 1 file changed, 2 insertions(+), 5 deletions(-) commit a3379eca24a7da5118a7d090da6f8eb8611acac8 Author: Hans de Goede Date: Sun Aug 25 15:24:15 2024 +0200 platform/x86: x86-android-tablets: Make Lenovo Yoga Tab 3 X90F DMI match less strict There are 2G and 4G RAM versions of the Lenovo Yoga Tab 3 X90F and it turns out that the 2G version has a DMI product name of "CHERRYVIEW D1 PLATFORM" where as the 4G version has "CHERRYVIEW C0 PLATFORM". The sys-vendor + product-version check are unique enough that the product-name check is not necessary. Drop the product-name check so that the existing DMI match for the 4G RAM version also matches the 2G RAM version. Signed-off-by: Hans de Goede Link: https://lore.kernel.org/r/20240825132415.8307-1-hdegoede@redhat.com Reviewed-by: Ilpo Järvinen Signed-off-by: Ilpo Järvinen drivers/platform/x86/x86-android-tablets/dmi.c | 1 - 1 file changed, 1 deletion(-) commit 9286dfd5735b9cceb6a14bdf15e13400ccb60fe7 Author: Mathieu Fenniak Date: Fri Aug 23 15:56:28 2024 +0200 platform/x86: asus-wmi: Fix spurious rfkill on UX8406MA The Asus Zenbook Duo (UX8406MA) has a keyboard which can be placed on the laptop to connect it via USB, or can be removed from the laptop to reveal a hidden secondary display in which case the keyboard operates via Bluetooth. When it is placed on the secondary display to connect via USB, it emits a keypress for a wireless disable. This causes the rfkill system to be activated disconnecting the current wifi connection, which doesn't reflect the user's true intention. Detect this hardware and suppress any wireless switches from the keyboard; this keyboard does not have a wireless toggle capability so these presses are always spurious. Signed-off-by: Mathieu Fenniak Reviewed-by: Ilpo Järvinen Link: https://lore.kernel.org/r/20240823135630.128447-1-mathieu@fenniak.net Signed-off-by: Ilpo Järvinen drivers/platform/x86/asus-nb-wmi.c | 20 +++++++++++++++++++- drivers/platform/x86/asus-wmi.h | 1 + 2 files changed, 20 insertions(+), 1 deletion(-) commit 469e5e4713989fdd5e3e502b922e7be0da2464b9 Author: Jonathan Bell Date: Wed Aug 21 08:06:31 2024 +0900 mmc: core: apply SD quirks earlier during probe Applying MMC_QUIRK_BROKEN_SD_CACHE is broken, as the card's SD quirks are referenced in sd_parse_ext_reg_perf() prior to the quirks being initialized in mmc_blk_probe(). To fix this problem, let's split out an SD-specific list of quirks and apply in mmc_sd_init_card() instead. In this way, sd_read_ext_regs() to has the available information for not assigning the SD_EXT_PERF_CACHE as one of the (un)supported features, which in turn allows mmc_sd_init_card() to properly skip execution of sd_enable_cache(). Fixes: c467c8f08185 ("mmc: Add MMC_QUIRK_BROKEN_SD_CACHE for Kingston Canvas Go Plus from 11/2019") Signed-off-by: Jonathan Bell Co-developed-by: Keita Aihara Signed-off-by: Keita Aihara Reviewed-by: Dragan Simic Reviewed-by: Avri Altman Cc: stable@vger.kernel.org Link: https://lore.kernel.org/r/20240820230631.GA436523@sony.com Signed-off-by: Ulf Hansson drivers/mmc/core/quirks.h | 22 +++++++++++++--------- drivers/mmc/core/sd.c | 4 ++++ 2 files changed, 17 insertions(+), 9 deletions(-) commit 5fd0628918977a0afdc2e6bc562d8751b5d3b8c5 Author: Pablo Neira Ayuso Date: Mon Aug 26 12:45:22 2024 +0200 netfilter: nf_tables: restore IP sanity checks for netdev/egress Subtract network offset to skb->len before performing IPv4 header sanity checks, then adjust transport offset from offset from mac header. Jorge Ortiz says: When small UDP packets (< 4 bytes payload) are sent from eth0, `meta l4proto udp` condition is not met because `NFT_PKTINFO_L4PROTO` is not set. This happens because there is a comparison that checks if the transport header offset exceeds the total length. This comparison does not take into account the fact that the skb network offset might be non-zero in egress mode (e.g., 14 bytes for Ethernet header). Fixes: 0ae8e4cca787 ("netfilter: nf_tables: set transport offset from mac header for netdev/egress") Reported-by: Jorge Ortiz Signed-off-by: Pablo Neira Ayuso include/net/netfilter/nf_tables_ipv4.h | 10 ++++++---- 1 file changed, 6 insertions(+), 4 deletions(-) commit 28b329f431cef840fddd9a9b493bc3eff1aa06c0 Author: Richard Fitzgerald Date: Mon Aug 26 10:49:40 2024 +0100 ALSA: hda: hda_component: Fix mutex crash if nothing ever binds Move the initialization of parent->mutex into hda_component_manager_init() so that it is always valid. In hda_component_manager_bind() do not clear the parent information. Only zero-fill the per-component data ready for it to be filled in by the components as they bind. Previously parent->mutex was being initialized only in hda_component_manager_bind(). This meant that it was only initialized if all components appeared and there was a bind callback. If there wasn't a bind the mutex object was not valid when the Realtek driver called any of the other functions. Signed-off-by: Richard Fitzgerald Fixes: 047b9cbbaa8e ("ALSA: hda: hda_component: Protect shared data with a mutex") Link: https://patch.msgid.link/20240826094940.45563-1-rf@opensource.cirrus.com Signed-off-by: Takashi Iwai sound/pci/hda/hda_component.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) commit 2dc43c5e212036458ed7c5586fb82ee183fee504 Author: Hendrik Borghorst Date: Sun Aug 25 19:43:47 2024 +0200 ALSA: hda/realtek: support HP Pavilion Aero 13-bg0xxx Mute LED This patch adds the HP Pavilion Aero 13 (13-bg0xxx) (year 2024) to list of quirks for keyboard LED mute indication. The laptop has two LEDs (one for speaker and one for mic mute). The pre-existing quirk ALC245_FIXUP_HP_X360_MUTE_LEDS chains both the quirk for mic and speaker mute. Tested on 6.11.0-rc4 with the aforementioned laptop. Signed-off-by: Hendrik Borghorst Cc: Link: https://patch.msgid.link/20240825174351.5687-1-hendrikborghorst@gmail.com Signed-off-by: Takashi Iwai sound/pci/hda/patch_realtek.c | 1 + 1 file changed, 1 insertion(+) commit 28f5df210d06beb5920cf80446f1c27456c14b92 Author: Yann Droneaud Date: Sun Aug 25 16:47:50 2024 +0200 random: vDSO: reject unknown getrandom() flags Like the getrandom() syscall, vDSO getrandom() must also reject unknown flags. [1] It would be possible to return -EINVAL from vDSO itself, but in the possible case that a new flag is added to getrandom() syscall in the future, it would be easier to get the behavior from the syscall, instead of erroring until the vDSO is extended to support the new flag or explicitly falling back. [1] Designing the API: Planning for Extension https://docs.kernel.org/process/adding-syscalls.html#designing-the-api-planning-for-extension Signed-off-by: Yann Droneaud [Jason: reworded commit message] Signed-off-by: Jason A. Donenfeld lib/vdso/getrandom.c | 4 ++++ 1 file changed, 4 insertions(+) commit 51eeef9a482bcb00f6f75eda4de9bd013092b76f Author: Will Deacon Date: Fri Aug 23 17:54:54 2024 +0100 MAINTAINERS: Add Jean-Philippe as SMMUv3 SVA reviewer Add Jean-Philippe as a reviewer for the Arm SMMUv3 SVA support, since he's been a consistent contributor to that code over the years and understands the relevant parts of the architecture much better than me. Cc: Robin Murphy Cc: Jean-Philippe Brucker Cc: Mostafa Saleh Signed-off-by: Will Deacon Link: https://lore.kernel.org/r/20240823165454.1064-1-will@kernel.org Signed-off-by: Joerg Roedel MAINTAINERS | 4 ++++ 1 file changed, 4 insertions(+) commit 6093cd582f8e027117a8d4ad5d129a1aacdc53d2 Author: Jason Gunthorpe Date: Thu Aug 22 11:45:55 2024 -0300 iommu: Do not return 0 from map_pages if it doesn't do anything These three implementations of map_pages() all succeed if a mapping is requested with no read or write. Since they return back to __iommu_map() leaving the mapped output as 0 it triggers an infinite loop. Therefore nothing is using no-access protection bits. Further, VFIO and iommufd rely on iommu_iova_to_phys() to get back PFNs stored by map, if iommu_map() succeeds but iommu_iova_to_phys() fails that will create serious bugs. Thus remove this never used "nothing to do" concept and just fail map immediately. Fixes: e5fc9753b1a8 ("iommu/io-pgtable: Add ARMv7 short descriptor support") Fixes: e1d3c0fd701d ("iommu: add ARM LPAE page table allocator") Fixes: 745ef1092bcf ("iommu/io-pgtable: Move Apple DART support to its own file") Signed-off-by: Jason Gunthorpe Acked-by: Will Deacon Reviewed-by: Kevin Tian Link: https://lore.kernel.org/r/2-v1-1211e1294c27+4b1-iommu_no_prot_jgg@nvidia.com Signed-off-by: Joerg Roedel drivers/iommu/io-pgtable-arm-v7s.c | 3 +-- drivers/iommu/io-pgtable-arm.c | 3 +-- drivers/iommu/io-pgtable-dart.c | 3 +-- 3 files changed, 3 insertions(+), 6 deletions(-) commit 996dc53ac289b81957aa70d62ccadc6986d26a87 Author: Jason Gunthorpe Date: Thu Aug 22 11:45:54 2024 -0300 iommufd: Do not allow creating areas without READ or WRITE This results in passing 0 or just IOMMU_CACHE to iommu_map(). Most of the page table formats don't like this: amdv1 - -EINVAL armv7s - returns 0, doesn't update mapped arm-lpae - returns 0 doesn't update mapped dart - returns 0, doesn't update mapped VT-D - returns -EINVAL Unfortunately the three formats that return 0 cause serious problems: - Returning ret = but not uppdating mapped from domain->map_pages() causes an infinite loop in __iommu_map() - Not writing ioptes means that VFIO/iommufd have no way to recover them and we will have memory leaks and worse during unmap Since almost nothing can support this, and it is a useless thing to do, block it early in iommufd. Cc: stable@kernel.org Fixes: aad37e71d5c4 ("iommufd: IOCTLs for the io_pagetable") Signed-off-by: Jason Gunthorpe Reviewed-by: Nicolin Chen Reviewed-by: Kevin Tian Link: https://lore.kernel.org/r/1-v1-1211e1294c27+4b1-iommu_no_prot_jgg@nvidia.com Signed-off-by: Joerg Roedel drivers/iommu/iommufd/ioas.c | 8 ++++++++ tools/testing/selftests/iommu/iommufd.c | 6 +++--- 2 files changed, 11 insertions(+), 3 deletions(-) commit 7af6c720417f21f015f46baa33e182f349ddc93b Author: Lu Baolu Date: Thu Aug 15 20:48:57 2024 +0800 iommu/vt-d: Fix incorrect domain ID in context flush helper The helper intel_context_flush_present() is designed to flush all related caches when a context entry with the present bit set is modified. It currently retrieves the domain ID from the context entry and uses it to flush the IOTLB and context caches. This is incorrect when the context entry transitions from present to non-present, as the domain ID field is cleared before calling the helper. Fix it by passing the domain ID programmed in the context entry before the change to intel_context_flush_present(). This ensures that the correct domain ID is used for cache invalidation. Fixes: f90584f4beb8 ("iommu/vt-d: Add helper to flush caches for context change") Reported-by: Alex Williamson Closes: https://lore.kernel.org/linux-iommu/20240814162726.5efe1a6e.alex.williamson@redhat.com/ Signed-off-by: Lu Baolu Tested-by: Alex Williamson Reviewed-by: Alex Williamson Reviewed-by: Jerry Snitselaar Reviewed-by: Jacob Pan Link: https://lore.kernel.org/r/20240815124857.70038-1-baolu.lu@linux.intel.com Signed-off-by: Joerg Roedel drivers/iommu/intel/iommu.c | 8 ++++++-- drivers/iommu/intel/iommu.h | 2 +- drivers/iommu/intel/pasid.c | 7 ++++--- 3 files changed, 11 insertions(+), 6 deletions(-) commit 68415b349f3f16904f006275757f4fcb34b8ee43 Author: Zizhi Wo Date: Thu Aug 22 17:00:04 2024 -0700 xfs: Fix the owner setting issue for rmap query in xfs fsmap I notice a rmap query bug in xfs_io fsmap: [root@fedora ~]# xfs_io -c 'fsmap -vvvv' /mnt EXT: DEV BLOCK-RANGE OWNER FILE-OFFSET AG AG-OFFSET TOTAL 0: 253:16 [0..7]: static fs metadata 0 (0..7) 8 1: 253:16 [8..23]: per-AG metadata 0 (8..23) 16 2: 253:16 [24..39]: inode btree 0 (24..39) 16 3: 253:16 [40..47]: per-AG metadata 0 (40..47) 8 4: 253:16 [48..55]: refcount btree 0 (48..55) 8 5: 253:16 [56..103]: per-AG metadata 0 (56..103) 48 6: 253:16 [104..127]: free space 0 (104..127) 24 ...... Bug: [root@fedora ~]# xfs_io -c 'fsmap -vvvv -d 0 3' /mnt [root@fedora ~]# Normally, we should be able to get one record, but we got nothing. The root cause of this problem lies in the incorrect setting of rm_owner in the rmap query. In the case of the initial query where the owner is not set, __xfs_getfsmap_datadev() first sets info->high.rm_owner to ULLONG_MAX. This is done to prevent any omissions when comparing rmap items. However, if the current ag is detected to be the last one, the function sets info's high_irec based on the provided key. If high->rm_owner is not specified, it should continue to be set to ULLONG_MAX; otherwise, there will be issues with interval omissions. For example, consider "start" and "end" within the same block. If high->rm_owner == 0, it will be smaller than the founded record in rmapbt, resulting in a query with no records. The main call stack is as follows: xfs_ioc_getfsmap xfs_getfsmap xfs_getfsmap_datadev_rmapbt __xfs_getfsmap_datadev info->high.rm_owner = ULLONG_MAX if (pag->pag_agno == end_ag) xfs_fsmap_owner_to_rmap // set info->high.rm_owner = 0 because fmr_owner == -1ULL dest->rm_owner = 0 // get nothing xfs_getfsmap_datadev_rmapbt_query The problem can be resolved by simply modify the xfs_fsmap_owner_to_rmap function internal logic to achieve. After applying this patch, the above problem have been solved: [root@fedora ~]# xfs_io -c 'fsmap -vvvv -d 0 3' /mnt EXT: DEV BLOCK-RANGE OWNER FILE-OFFSET AG AG-OFFSET TOTAL 0: 253:16 [0..7]: static fs metadata 0 (0..7) 8 Fixes: e89c041338ed ("xfs: implement the GETFSMAP ioctl") Signed-off-by: Zizhi Wo Reviewed-by: Darrick J. Wong Signed-off-by: Darrick J. Wong Signed-off-by: Chandan Babu R fs/xfs/xfs_fsmap.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 410e8a18f8e9311c6bf29ae47f32ad46f0219569 Author: Darrick J. Wong Date: Thu Aug 22 16:59:48 2024 -0700 xfs: don't bother reporting blocks trimmed via FITRIM Don't bother reporting the number of bytes that we "trimmed" because the underlying storage isn't required to do anything(!) and failed discard IOs aren't reported to the caller anyway. It's not like userspace can use the reported value for anything useful like adjusting the offset parameter of the next call, and it's not like anyone ever wrote a manpage about FITRIM's out parameters. Signed-off-by: Darrick J. Wong Reviewed-by: Christoph Hellwig Tested-by: Christoph Hellwig Signed-off-by: Chandan Babu R fs/xfs/xfs_discard.c | 36 +++++++++++------------------------- 1 file changed, 11 insertions(+), 25 deletions(-) commit 95179935beadccaf0f0bb461adb778731e293da4 Author: Dave Chinner Date: Thu Aug 22 16:59:33 2024 -0700 xfs: xfs_finobt_count_blocks() walks the wrong btree As a result of the factoring in commit 14dd46cf31f4 ("xfs: split xfs_inobt_init_cursor"), mount started taking a long time on a user's filesystem. For Anders, this made mount times regress from under a second to over 15 minutes for a filesystem with only 30 million inodes in it. Anders bisected it down to the above commit, but even then the bug was not obvious. In this commit, over 20 calls to xfs_inobt_init_cursor() were modified, and some we modified to call a new function named xfs_finobt_init_cursor(). If that takes you a moment to reread those function names to see what the rename was, then you have realised why this bug wasn't spotted during review. And it wasn't spotted on inspection even after the bisect pointed at this commit - a single missing "f" isn't the easiest thing for a human eye to notice.... The result is that xfs_finobt_count_blocks() now incorrectly calls xfs_inobt_init_cursor() so it is now walking the inobt instead of the finobt. Hence when there are lots of allocated inodes in a filesystem, mount takes a -long- time run because it now walks a massive allocated inode btrees instead of the small, nearly empty free inode btrees. It also means all the finobt space reservations are wrong, so mount could potentially given ENOSPC on kernel upgrade. In hindsight, commit 14dd46cf31f4 should have been two commits - the first to convert the finobt callers to the new API, the second to modify the xfs_inobt_init_cursor() API for the inobt callers. That would have made the bug very obvious during review. Fixes: 14dd46cf31f4 ("xfs: split xfs_inobt_init_cursor") Reported-by: Anders Blomdell Signed-off-by: Dave Chinner Reviewed-by: Christoph Hellwig Reviewed-by: Darrick J. Wong Signed-off-by: Darrick J. Wong Signed-off-by: Chandan Babu R fs/xfs/libxfs/xfs_ialloc_btree.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 5335affcff91b53cfc45694171f911cb23257c8b Author: Darrick J. Wong Date: Thu Aug 22 16:59:17 2024 -0700 xfs: fix folio dirtying for XFILE_ALLOC callers willy pointed out that folio_mark_dirty is the correct function to use to mark an xfile folio dirty because it calls out to the mapping's aops to mark it dirty. For tmpfs this likely doesn't matter much since it currently uses nop_dirty_folio, but let's use the abstractions properly. Reported-by: willy@infradead.org Fixes: 6907e3c00a40 ("xfs: add file_{get,put}_folio") Signed-off-by: Darrick J. Wong Reviewed-by: Christoph Hellwig Signed-off-by: Chandan Babu R fs/xfs/scrub/xfile.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit e21fea4ac3cf12eba1921fbbf7764bf69c6d4b2c Author: Darrick J. Wong Date: Thu Aug 22 16:59:01 2024 -0700 xfs: fix di_onlink checking for V1/V2 inodes "KjellR" complained on IRC that an old V4 filesystem suddenly stopped mounting after upgrading from 6.9.11 to 6.10.3, with the following splat when trying to read the rt bitmap inode: 00000000: 49 4e 80 00 01 02 00 01 00 00 00 00 00 00 00 00 IN.............. 00000010: 00 00 00 01 00 00 00 00 00 00 00 00 00 00 00 00 ................ 00000020: 00 00 00 00 00 00 00 00 43 d2 a9 da 21 0f d6 30 ........C...!..0 00000030: 43 d2 a9 da 21 0f d6 30 00 00 00 00 00 00 00 00 C...!..0........ 00000040: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 00000050: 00 00 00 02 00 00 00 00 00 00 00 04 00 00 00 00 ................ 00000060: ff ff ff ff 00 00 00 00 00 00 00 00 00 00 00 00 ................ 00000070: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ As Dave Chinner points out, this is a V1 inode with both di_onlink and di_nlink set to 1 and di_flushiter == 0. In other words, this inode was formatted this way by mkfs and hasn't been touched since then. Back in the old days of xfsprogs 3.2.3, I observed that libxfs_ialloc would set di_nlink, but if the filesystem didn't have NLINK, it would then set di_version = 1. libxfs_iflush_int later sees the V1 inode and copies the value of di_nlink to di_onlink without zeroing di_onlink. Eventually this filesystem must have been upgraded to support NLINK because 6.10 doesn't support !NLINK filesystems, which is how we tripped over this old behavior. The filesystem doesn't have a realtime section, so that's why the rtbitmap inode has never been touched. Fix this by removing the di_onlink/di_nlink checking for all V1/V2 inodes because this is a muddy mess. The V3 inode handling code has always supported NLINK and written di_onlink==0 so keep that check. The removal of the V1 inode handling code when we dropped support for !NLINK obscured this old behavior. Reported-by: kjell.m.randa@gmail.com Fixes: 40cb8613d612 ("xfs: check unused nlink fields in the ondisk inode") Signed-off-by: Darrick J. Wong Reviewed-by: Christoph Hellwig Signed-off-by: Chandan Babu R fs/xfs/libxfs/xfs_inode_buf.c | 14 ++++++++++---- 1 file changed, 10 insertions(+), 4 deletions(-) commit e9fd436bb8fb9b9d31fdf07bbcdba6d30290c5e4 Author: Zack Rusin Date: Fri Aug 16 14:32:07 2024 -0400 drm/vmwgfx: Disable coherent dumb buffers without 3d Coherent surfaces make only sense if the host renders to them using accelerated apis. Without 3d the entire content of dumb buffers stays in the guest making all of the extra work they're doing to synchronize between guest and host useless. Configurations without 3d also tend to run with very low graphics memory limits. The pinned console fb, mob cursors and graphical login manager tend to run out of 16MB graphics memory that those guests use. Fix it by making sure the coherent dumb buffers are only used on configs with 3d enabled. Signed-off-by: Zack Rusin Fixes: d6667f0ddf46 ("drm/vmwgfx: Fix handling of dumb buffers") Reported-by: Christian Heusel Closes: https://lore.kernel.org/all/0d0330f3-2ac0-4cd5-8075-7f1cbaf72a8e@heusel.eu Cc: Broadcom internal kernel review list Cc: dri-devel@lists.freedesktop.org Cc: # v6.9+ Link: https://patchwork.freedesktop.org/patch/msgid/20240816183332.31961-4-zack.rusin@broadcom.com Reviewed-by: Martin Krastev Reviewed-by: Maaz Mombasawala Tested-by: Benjamin Coddington drivers/gpu/drm/vmwgfx/vmwgfx_surface.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) commit 50f1199250912568606b3778dc56646c10cb7b04 Author: Zack Rusin Date: Fri Aug 16 14:32:06 2024 -0400 drm/vmwgfx: Fix prime with external buffers Make sure that for external buffers mapping goes through the dma_buf interface instead of trying to access pages directly. External buffers might not provide direct access to readable/writable pages so to make sure the bo's created from external dma_bufs can be read dma_buf interface has to be used. Fixes crashes in IGT's kms_prime with vgem. Regular desktop usage won't trigger this due to the fact that virtual machines will not have multiple GPUs but it enables better test coverage in IGT. Signed-off-by: Zack Rusin Fixes: b32233acceff ("drm/vmwgfx: Fix prime import/export") Cc: # v6.6+ Cc: Broadcom internal kernel review list Cc: dri-devel@lists.freedesktop.org Cc: # v6.9+ Link: https://patchwork.freedesktop.org/patch/msgid/20240816183332.31961-3-zack.rusin@broadcom.com Reviewed-by: Martin Krastev Reviewed-by: Maaz Mombasawala drivers/gpu/drm/vmwgfx/vmwgfx_blit.c | 114 +++++++++++++++++++++++++++++++++-- drivers/gpu/drm/vmwgfx/vmwgfx_drv.h | 4 +- drivers/gpu/drm/vmwgfx/vmwgfx_stdu.c | 12 ++-- 3 files changed, 118 insertions(+), 12 deletions(-) commit aba07b9a0587f50e5d3346eaa19019cf3f86c0ea Author: Zack Rusin Date: Fri Aug 16 14:32:05 2024 -0400 drm/vmwgfx: Prevent unmapping active read buffers The kms paths keep a persistent map active to read and compare the cursor buffer. These maps can race with each other in simple scenario where: a) buffer "a" mapped for update b) buffer "a" mapped for compare c) do the compare d) unmap "a" for compare e) update the cursor f) unmap "a" for update At step "e" the buffer has been unmapped and the read contents is bogus. Prevent unmapping of active read buffers by simply keeping a count of how many paths have currently active maps and unmap only when the count reaches 0. Fixes: 485d98d472d5 ("drm/vmwgfx: Add support for CursorMob and CursorBypass 4") Cc: Broadcom internal kernel review list Cc: dri-devel@lists.freedesktop.org Cc: # v5.19+ Signed-off-by: Zack Rusin Link: https://patchwork.freedesktop.org/patch/msgid/20240816183332.31961-2-zack.rusin@broadcom.com Reviewed-by: Martin Krastev Reviewed-by: Maaz Mombasawala drivers/gpu/drm/vmwgfx/vmwgfx_bo.c | 13 +++++++++++-- drivers/gpu/drm/vmwgfx/vmwgfx_bo.h | 3 +++ 2 files changed, 14 insertions(+), 2 deletions(-) commit 98c0cc48e27e9d269a3e4db2acd72b486c88ec77 Author: Guenter Roeck Date: Thu Aug 8 08:50:03 2024 -0700 apparmor: fix policy_unpack_test on big endian systems policy_unpack_test fails on big endian systems because data byte order is expected to be little endian but is generated in host byte order. This results in test failures such as: # policy_unpack_test_unpack_array_with_null_name: EXPECTATION FAILED at security/apparmor/policy_unpack_test.c:150 Expected array_size == (u16)16, but array_size == 4096 (0x1000) (u16)16 == 16 (0x10) # policy_unpack_test_unpack_array_with_null_name: pass:0 fail:1 skip:0 total:1 not ok 3 policy_unpack_test_unpack_array_with_null_name # policy_unpack_test_unpack_array_with_name: EXPECTATION FAILED at security/apparmor/policy_unpack_test.c:164 Expected array_size == (u16)16, but array_size == 4096 (0x1000) (u16)16 == 16 (0x10) # policy_unpack_test_unpack_array_with_name: pass:0 fail:1 skip:0 total:1 Add the missing endianness conversions when generating test data. Fixes: 4d944bcd4e73 ("apparmor: add AppArmor KUnit tests for policy unpack") Cc: Brendan Higgins Cc: Kees Cook Signed-off-by: Guenter Roeck security/apparmor/policy_unpack_test.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) commit 5a4c785905fd9361d067127b42564c08893f2a6f Author: Guenter Roeck Date: Mon Aug 5 18:13:41 2024 -0700 Revert "MIPS: csrc-r4k: Apply verification clocksource flags" This reverts commit 7190401fc56fb5f02ee3d04476778ab000bbaf32. Verifying the clock source sometimes deems the MIPS clock to be unstable, at least in qemu. clocksource: timekeeping watchdog on CPU0: Marking clocksource 'MIPS' as unstable because the skew is too large: clocksource: 'jiffies' wd_nsec: 500000000 wd_now: ffff8bde wd_last: ffff8bac mask: ffffffff clocksource: 'MIPS' cs_nsec: 940634468 cs_now: 310181c4 cs_last: 28090a09 mask: ffffffff clocksource: Clocksource 'MIPS' skewed 440634468 ns (440 ms) over watchdog 'jiffies' interval of 500000000 ns (500 ms) clocksource: 'MIPS' is current clocksource. If this happens, network interfaces fail to come online. Signed-off-by: Guenter Roeck arch/mips/kernel/csrc-r4k.c | 4 +--- 1 file changed, 1 insertion(+), 3 deletions(-) commit 0075df288dd8a7abfe03b3766176c393063591dd Author: Mike Rapoport Date: Mon Jul 29 08:33:27 2024 +0300 microblaze: don't treat zero reserved memory regions as error Before commit 721f4a6526da ("mm/memblock: remove empty dummy entry") the check for non-zero of memblock.reserved.cnt in mmu_init() would always be true either because memblock.reserved.cnt is initialized to 1 or because there were memory reservations earlier. The removal of dummy empty entry in memblock caused this check to fail because now memblock.reserved.cnt is initialized to 0. Remove the check for non-zero of memblock.reserved.cnt because it's perfectly fine to have an empty memblock.reserved array that early in boot. Reported-by: Guenter Roeck Signed-off-by: Mike Rapoport Reviewed-by: Wei Yang Tested-by: Guenter Roeck Link: https://lore.kernel.org/r/20240729053327.4091459-1-rppt@kernel.org Signed-off-by: Guenter Roeck arch/microblaze/mm/init.c | 5 ----- 1 file changed, 5 deletions(-) commit 9efaebc0072b8e95505544bf385c20ee8a29d799 Author: Ross Brown Date: Tue Jul 30 08:21:42 2024 +0200 hwmon: (asus-ec-sensors) remove VRM temp X570-E GAMING X570-E GAMING does not have VRM temperature sensor. Signed-off-by: Ross Brown Signed-off-by: Eugene Shalygin Link: https://lore.kernel.org/r/20240730062320.5188-2-eugene.shalygin@gmail.com Signed-off-by: Guenter Roeck drivers/hwmon/asus-ec-sensors.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 2d3447261031503b181dacc549fe65ffe2d93d65 Author: Josef Bacik Date: Wed Aug 21 15:53:18 2024 -0400 btrfs: run delayed iputs when flushing delalloc We have transient failures with btrfs/301, specifically in the part where we do for i in $(seq 0 10); do write 50m to file rm -f file done Sometimes this will result in a transient quota error, and it's because sometimes we start writeback on the file which results in a delayed iput, and thus the rm doesn't actually clean the file up. When we're flushing the quota space we need to run the delayed iputs to make sure all the unlinks that we think have completed have actually completed. This removes the small window where we could fail to find enough space in our quota. CC: stable@vger.kernel.org # 5.15+ Reviewed-by: Qu Wenruo Signed-off-by: Josef Bacik Signed-off-by: David Sterba fs/btrfs/qgroup.c | 2 ++ 1 file changed, 2 insertions(+) commit 25dfc9e357af8aed1ca79b318a73f2c59c1f0b2b Author: Kan Liang Date: Mon Aug 19 11:30:04 2024 -0700 perf/x86/intel: Limit the period on Haswell Running the ltp test cve-2015-3290 concurrently reports the following warnings. perfevents: irq loop stuck! WARNING: CPU: 31 PID: 32438 at arch/x86/events/intel/core.c:3174 intel_pmu_handle_irq+0x285/0x370 Call Trace: ? __warn+0xa4/0x220 ? intel_pmu_handle_irq+0x285/0x370 ? __report_bug+0x123/0x130 ? intel_pmu_handle_irq+0x285/0x370 ? __report_bug+0x123/0x130 ? intel_pmu_handle_irq+0x285/0x370 ? report_bug+0x3e/0xa0 ? handle_bug+0x3c/0x70 ? exc_invalid_op+0x18/0x50 ? asm_exc_invalid_op+0x1a/0x20 ? irq_work_claim+0x1e/0x40 ? intel_pmu_handle_irq+0x285/0x370 perf_event_nmi_handler+0x3d/0x60 nmi_handle+0x104/0x330 Thanks to Thomas Gleixner's analysis, the issue is caused by the low initial period (1) of the frequency estimation algorithm, which triggers the defects of the HW, specifically erratum HSW11 and HSW143. (For the details, please refer https://lore.kernel.org/lkml/87plq9l5d2.ffs@tglx/) The HSW11 requires a period larger than 100 for the INST_RETIRED.ALL event, but the initial period in the freq mode is 1. The erratum is the same as the BDM11, which has been supported in the kernel. A minimum period of 128 is enforced as well on HSW. HSW143 is regarding that the fixed counter 1 may overcount 32 with the Hyper-Threading is enabled. However, based on the test, the hardware has more issues than it tells. Besides the fixed counter 1, the message 'interrupt took too long' can be observed on any counter which was armed with a period < 32 and two events expired in the same NMI. A minimum period of 32 is enforced for the rest of the events. The recommended workaround code of the HSW143 is not implemented. Because it only addresses the issue for the fixed counter. It brings extra overhead through extra MSR writing. No related overcounting issue has been reported so far. Fixes: 3a632cb229bf ("perf/x86/intel: Add simple Haswell PMU support") Reported-by: Li Huafei Suggested-by: Thomas Gleixner Signed-off-by: Kan Liang Signed-off-by: Thomas Gleixner Cc: stable@vger.kernel.org Link: https://lore.kernel.org/all/20240819183004.3132920-1-kan.liang@linux.intel.com Closes: https://lore.kernel.org/lkml/20240729223328.327835-1-lihuafei1@huawei.com/ arch/x86/events/intel/core.c | 23 +++++++++++++++++++++-- 1 file changed, 21 insertions(+), 2 deletions(-) commit 44ceabdec12f4e5938f5668c5a691aa3aac703d7 Author: YOUNGJIN JOO Date: Sun Aug 25 18:25:15 2024 +0900 ALSA: hda/realtek: Fix the speaker output on Samsung Galaxy Book3 Ultra 144d:c1cc requires the same workaround to enable the speaker amp as other Samsung models with the ALC298 codec. Signed-off-by: YOUNGJIN JOO Cc: Link: https://patch.msgid.link/20240825092515.28728-1-neoelec@gmail.com Signed-off-by: Takashi Iwai sound/pci/hda/patch_realtek.c | 1 + 1 file changed, 1 insertion(+) commit 58aec91efb93338d1cc7acc0a93242613a2a4e5f Author: Miao Wang Date: Sun Aug 25 22:17:39 2024 +0800 LoongArch: Remove the unused dma-direct.h dma-direct.h is introduced in commit d4b6f1562a3c3284 ("LoongArch: Add Non-Uniform Memory Access (NUMA) support"). In commit c78c43fe7d42524c ("LoongArch: Use acpi_arch_dma_setup() and remove ARCH_HAS_PHYS_TO_DMA"), ARCH_HAS_PHYS_TO_DMA was deselected and the coresponding phys_to_dma()/ dma_to_phys() functions were removed. However, the unused dma-direct.h was left behind, which is removed by this patch. Cc: Fixes: c78c43fe7d42 ("LoongArch: Use acpi_arch_dma_setup() and remove ARCH_HAS_PHYS_TO_DMA") Signed-off-by: Miao Wang Signed-off-by: Huacai Chen arch/loongarch/include/asm/dma-direct.h | 11 ----------- 1 file changed, 11 deletions(-) commit 416871f4fb84bc96822562e654941d5625a25bf8 Author: David Howells Date: Fri Aug 23 14:22:42 2024 +0100 cifs: Fix FALLOC_FL_PUNCH_HOLE support The cifs filesystem doesn't quite emulate FALLOC_FL_PUNCH_HOLE correctly (note that due to lack of protocol support, it can't actually implement it directly). Whilst it will (partially) invalidate dirty folios in the pagecache, it doesn't write them back first, and so the EOF marker on the server may be lower than inode->i_size. This presents a problem, however, as if the punched hole invalidates the tail of the locally cached dirty data, writeback won't know it needs to move the EOF over to account for the hole punch (which isn't supposed to move the EOF). We could just write zeroes over the punched out region of the pagecache and write that back - but this is supposed to be a deallocatory operation. Fix this by manually moving the EOF over on the server after the operation if the hole punched would corrupt it. Note that the FSCTL_SET_ZERO_DATA RPC and the setting of the EOF should probably be compounded to stop a third party interfering (or, at least, massively reduce the chance). This was reproducible occasionally by using fsx with the following script: truncate 0x0 0x375e2 0x0 punch_hole 0x2f6d3 0x6ab5 0x375e2 truncate 0x0 0x3a71f 0x375e2 mapread 0xee05 0xcf12 0x3a71f write 0x2078e 0x5604 0x3a71f write 0x3ebdf 0x1421 0x3a71f * punch_hole 0x379d0 0x8630 0x40000 * mapread 0x2aaa2 0x85b 0x40000 fallocate 0x1b401 0x9ada 0x40000 read 0x15f2 0x7d32 0x40000 read 0x32f37 0x7a3b 0x40000 * The second "write" should extend the EOF to 0x40000, and the "punch_hole" should operate inside of that - but that depends on whether the VM gets in and writes back the data first. If it doesn't, the file ends up 0x3a71f in size, not 0x40000. Fixes: 31742c5a3317 ("enable fallocate punch hole ("fallocate -p") for SMB3") Signed-off-by: David Howells cc: Steve French cc: Paulo Alcantara cc: Shyam Prasad N cc: Jeff Layton cc: linux-cifs@vger.kernel.org cc: netfs@lists.linux.dev Signed-off-by: Steve French fs/smb/client/smb2ops.c | 22 ++++++++++++++++++++++ 1 file changed, 22 insertions(+) commit 017d1701743657fbfaea74397727a9d2b81846b7 Author: Stefan Metzmacher Date: Wed Aug 21 16:31:39 2024 +0200 smb/client: fix rdma usage in smb2_async_writev() rqst.rq_iter needs to be truncated otherwise we'll also send the bytes into the stream socket... This is the logic behind rqst.rq_npages = 0, which was removed in "cifs: Change the I/O paths to use an iterator rather than a page list" (d08089f649a0cfb2099c8551ac47eef0cc23fdf2). Cc: stable@vger.kernel.org Fixes: d08089f649a0 ("cifs: Change the I/O paths to use an iterator rather than a page list") Reviewed-by: David Howells Signed-off-by: Stefan Metzmacher Signed-off-by: Steve French fs/smb/client/smb2pdu.c | 40 ++++++++++++++++++++-------------------- 1 file changed, 20 insertions(+), 20 deletions(-) commit b608e2c318789aeba49055747166e13bee57df4a Author: Stefan Metzmacher Date: Wed Aug 21 15:59:12 2024 +0200 smb/client: remove unused rq_iter_size from struct smb_rqst Reviewed-by: David Howells Fixes: d08089f649a0 ("cifs: Change the I/O paths to use an iterator rather than a page list") Signed-off-by: Stefan Metzmacher Signed-off-by: Steve French fs/smb/client/cifsglob.h | 1 - fs/smb/client/cifssmb.c | 1 - fs/smb/client/smb2ops.c | 2 -- fs/smb/client/smb2pdu.c | 2 -- 4 files changed, 6 deletions(-) commit c724b2ab6a46435b4e7d58ad2fbbdb7a318823cf Author: Stefan Metzmacher Date: Wed Aug 21 17:18:23 2024 +0200 smb/client: avoid dereferencing rdata=NULL in smb2_new_read_req() This happens when called from SMB2_read() while using rdma and reaching the rdma_readwrite_threshold. Cc: stable@vger.kernel.org Fixes: a6559cc1d35d ("cifs: split out smb3_use_rdma_offload() helper") Reviewed-by: David Howells Signed-off-by: Stefan Metzmacher Signed-off-by: Steve French fs/smb/client/smb2pdu.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 5be63fc19fcaa4c236b307420483578a56986a37 Author: Linus Torvalds Date: Sun Aug 25 19:07:11 2024 +1200 Linux 6.11-rc5 Makefile | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 72bea05cb1ad486b1a850f584cc93b651579ad2f Merge: 780bdc1ba776 49aa7830396b Author: Linus Torvalds Date: Sun Aug 25 17:20:48 2024 +1200 Merge tag 'bcachefs-2024-08-24' of git://evilpiepirate.org/bcachefs Pull bcachefs fixes from Kent Overstreet: - assorted syzbot fixes - some upgrade fixes for old (pre 1.0) filesystems - fix for moving data off a device that was switched to durability=0 after data had been written to it. - nocow deadlock fix - fix for new rebalance_work accounting * tag 'bcachefs-2024-08-24' of git://evilpiepirate.org/bcachefs: (28 commits) bcachefs: Fix rebalance_work accounting bcachefs: Fix failure to flush moves before sleeping in copygc bcachefs: don't use rht_bucket() in btree_key_cache_scan() bcachefs: add missing inode_walker_exit() bcachefs: clear path->should_be_locked in bch2_btree_key_cache_drop() bcachefs: Fix double assignment in check_dirent_to_subvol() bcachefs: Fix refcounting in discard path bcachefs: Fix compat issue with old alloc_v4 keys bcachefs: Fix warning in bch2_fs_journal_stop() fs/super.c: improve get_tree() error message bcachefs: Fix missing validation in bch2_sb_journal_v2_validate() bcachefs: Fix replay_now_at() assert bcachefs: Fix locking in bch2_ioc_setlabel() bcachefs: fix failure to relock in btree_node_fill() bcachefs: fix failure to relock in bch2_btree_node_mem_alloc() bcachefs: unlock_long() before resort in journal replay bcachefs: fix missing bch2_err_str() bcachefs: fix time_stats_to_text() bcachefs: Fix bch2_bucket_gens_init() bcachefs: Fix bch2_trigger_alloc assert ... commit 780bdc1ba77646c3461f1988b12c42c60f836d77 Merge: 48fb4b3d9b43 2b7e0573a490 Author: Linus Torvalds Date: Sun Aug 25 12:15:04 2024 +1200 Merge tag '6.11-rc5-server-fixes' of git://git.samba.org/ksmbd Pull smb server fixes from Steve French: - query directory flex array fix - fix potential null ptr reference in open - fix error message in some open cases - two minor cleanups * tag '6.11-rc5-server-fixes' of git://git.samba.org/ksmbd: smb/server: update misguided comment of smb2_allocate_rsp_buf() smb/server: remove useless assignment of 'file_present' in smb2_open() smb/server: fix potential null-ptr-deref of lease_ctx_info in smb2_open() smb/server: fix return value of smb2_open() ksmbd: the buffer of smb2 query dir response has at least 1 byte commit 48fb4b3d9b43ea8f81de06f12f83912f8c1d5a15 Merge: 891e811ad604 1642285e511c Author: Linus Torvalds Date: Sun Aug 25 12:05:23 2024 +1200 Merge tag 's390-6.11-4' of git://git.kernel.org/pub/scm/linux/kernel/git/s390/linux Pull s390 fixes from Vasily Gorbik: - Fix KASLR base offset to account for symbol offsets in the vmlinux ELF file, preventing tool breakages like the drgn debugger - Fix potential memory corruption of physmem_info during kernel physical address randomization - Fix potential memory corruption due to overlap between the relocated lowcore and identity mapping by correctly reserving lowcore memory - Fix performance regression and avoid randomizing identity mapping base by default - Fix unnecessary delay of AP bus binding complete uevent to prevent startup lag in KVM guests using AP * tag 's390-6.11-4' of git://git.kernel.org/pub/scm/linux/kernel/git/s390/linux: s390/boot: Fix KASLR base offset off by __START_KERNEL bytes s390/boot: Avoid possible physmem_info segment corruption s390/ap: Refine AP bus bindings complete processing s390/mm: Pin identity mapping base to zero s390/mm: Prevent lowcore vs identity mapping overlap commit 891e811ad604805b2c706f85480e38961b706a70 Merge: d2bafcf224f3 cbaac68987b8 Author: Linus Torvalds Date: Sun Aug 25 12:00:16 2024 +1200 Merge tag 'scsi-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi Pull SCSI fixes from James Bottomley: "The important core fix is another tweak to our discard discovery issues. The off by 512 in logical block count seems bad, but in fact the inline was only ever used in debug prints, which is why no-one noticed" * tag 'scsi-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi: scsi: sd: Do not attempt to configure discard unless LBPME is set scsi: MAINTAINERS: Add header files to SCSI SUBSYSTEM scsi: ufs: qcom: Add UFSHCD_QUIRK_BROKEN_LSDBS_CAP for SM8550 SoC scsi: ufs: core: Add a quirk for handling broken LSDBS field in controller capabilities register scsi: core: Fix the return value of scsi_logical_block_count() scsi: MAINTAINERS: Update HiSilicon SAS controller driver maintainer commit 128f71fe014fc91efa1407ce549f94a9a9f1072c Author: Huang-Huang Bao Date: Tue Jul 9 18:54:28 2024 +0800 pinctrl: rockchip: correct RK3328 iomux width flag for GPIO2-B pins The base iomux offsets for each GPIO pin line are accumulatively calculated based off iomux width flag in rockchip_pinctrl_get_soc_data. If the iomux width flag is one of IOMUX_WIDTH_4BIT, IOMUX_WIDTH_3BIT or IOMUX_WIDTH_2BIT, the base offset for next pin line would increase by 8 bytes, otherwise it would increase by 4 bytes. Despite most of GPIO2-B iomux have 2-bit data width, which can be fit into 4 bytes space with write mask, it actually take 8 bytes width for whole GPIO2-B line. Commit e8448a6c817c ("pinctrl: rockchip: fix pinmux bits for RK3328 GPIO2-B pins") wrongly set iomux width flag to 0, causing all base iomux offset for line after GPIO2-B to be calculated wrong. Fix the iomux width flag to IOMUX_WIDTH_2BIT so the offset after GPIO2-B is correctly increased by 8, matching the actual width of GPIO2-B iomux. Fixes: e8448a6c817c ("pinctrl: rockchip: fix pinmux bits for RK3328 GPIO2-B pins") Cc: stable@vger.kernel.org Reported-by: Richard Kojedzinszky Closes: https://lore.kernel.org/linux-rockchip/4f29b743202397d60edfb3c725537415@kojedz.in/ Tested-by: Richard Kojedzinszky Signed-off-by: Huang-Huang Bao Reviewed-by: Heiko Stuebner Tested-by: Daniel Golle Tested-by: Trevor Woerner Link: https://lore.kernel.org/20240709105428.1176375-1-i@eh5.me Signed-off-by: Linus Walleij drivers/pinctrl/pinctrl-rockchip.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 49aa7830396bce33b00fa7ee734c35de36521138 Author: Kent Overstreet Date: Fri Aug 23 15:35:22 2024 -0400 bcachefs: Fix rebalance_work accounting rebalance_work was keying off of the presence of rebelance_opts in the extent - but that was incorrect, we keep those around after rebalance for indirect extents since the inode's options are not directly available Fixes: 20ac515a9cc7 ("bcachefs: bch_acct_rebalance_work") Signed-off-by: Kent Overstreet fs/bcachefs/bcachefs_format.h | 3 +- fs/bcachefs/buckets.c | 74 ++++++++++++++++++++++++++++--------------- fs/bcachefs/extents.c | 39 +++++++++++++++++++++++ fs/bcachefs/extents.h | 1 + fs/bcachefs/sb-downgrade.c | 8 ++++- 5 files changed, 98 insertions(+), 27 deletions(-) commit d3204616a67e53fdcad14c7026869330fb382fd4 Author: Kent Overstreet Date: Fri Aug 23 17:38:41 2024 -0400 bcachefs: Fix failure to flush moves before sleeping in copygc This fixes an apparent deadlock - rebalance would get stuck trying to take nocow locks because they weren't being released by copygc. Signed-off-by: Kent Overstreet fs/bcachefs/movinggc.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit e00e99ba6c6b8e5239e75cd6684a6827d93c39a2 Author: David Howells Date: Sat Aug 24 12:56:53 2024 +0100 netfs: Fix interaction of streaming writes with zero-point tracker When a folio that is marked for streaming write (dirty, but not uptodate, with partial content specified in the private data) is written back, the folio is effectively switched to the blank state upon completion of the write. This means that if we want to read it in future, we need to reread the whole folio. However, if the folio is above the zero_point position, when it is read back, it will just be cleared and the read skipped, leading to apparent local corruption. Fix this by increasing the zero_point to the end of the dirty data in the folio when clearing the folio state after writeback. This is analogous to the folio having ->release_folio() called upon it. This was causing the config.log generated by configuring a cpython tree on a cifs share to get corrupted because the scripts involved were appending text to the file in small pieces. Fixes: 288ace2f57c9 ("netfs: New writeback implementation") Signed-off-by: David Howells Link: https://lore.kernel.org/r/563286.1724500613@warthog.procyon.org.uk cc: Steve French cc: Paulo Alcantara cc: Jeff Layton cc: linux-cifs@vger.kernel.org cc: netfs@lists.linux.dev cc: linux-fsdevel@vger.kernel.org Signed-off-by: Christian Brauner fs/netfs/write_collect.c | 7 +++++++ 1 file changed, 7 insertions(+) commit 950b03d0f664a54389a555d79215348ed413161f Author: David Howells Date: Fri Aug 23 21:08:13 2024 +0100 netfs: Fix missing iterator reset on retry of short read Fix netfs_rreq_perform_resubmissions() to reset before retrying a short read, otherwise the wrong part of the output buffer will be used. Fixes: 92b6cc5d1e7c ("netfs: Add iov_iters to (sub)requests to describe various buffers") Signed-off-by: David Howells Link: https://lore.kernel.org/r/20240823200819.532106-6-dhowells@redhat.com cc: Steve French cc: Paulo Alcantara cc: Jeff Layton cc: linux-cifs@vger.kernel.org cc: netfs@lists.linux.dev cc: linux-fsdevel@vger.kernel.org Signed-off-by: Christian Brauner fs/netfs/io.c | 1 + 1 file changed, 1 insertion(+) commit cce6bfa6ca0e30af9927b0074c97fe6a92f28092 Author: David Howells Date: Fri Aug 23 21:08:12 2024 +0100 netfs: Fix trimming of streaming-write folios in netfs_inval_folio() When netfslib writes to a folio that it doesn't have data for, but that data exists on the server, it will make a 'streaming write' whereby it stores data in a folio that is marked dirty, but not uptodate. When it does this, it attaches a record to folio->private to track the dirty region. When truncate() or fallocate() wants to invalidate part of such a folio, it will call into ->invalidate_folio(), specifying the part of the folio that is to be invalidated. netfs_invalidate_folio(), on behalf of the filesystem, must then determine how to trim the streaming write record. In a couple of cases, however, it does this incorrectly (the reduce-length and move-start cases are switched over and don't, in any case, calculate the value correctly). Fix this by making the logic tree more obvious and fixing the cases. Fixes: 9ebff83e6481 ("netfs: Prep to use folio->private for write grouping and streaming write") Signed-off-by: David Howells Link: https://lore.kernel.org/r/20240823200819.532106-5-dhowells@redhat.com cc: Matthew Wilcox (Oracle) cc: Pankaj Raghav cc: Jeff Layton cc: Marc Dionne cc: linux-afs@lists.infradead.org cc: netfs@lists.linux.dev cc: linux-mm@kvack.org cc: linux-fsdevel@vger.kernel.org Signed-off-by: Christian Brauner fs/netfs/misc.c | 50 +++++++++++++++++++++++++++++++++++--------------- 1 file changed, 35 insertions(+), 15 deletions(-) commit 7dfc8f0c6144c290dbeb01835a67e81b34dda8cd Author: David Howells Date: Fri Aug 23 21:08:11 2024 +0100 netfs: Fix netfs_release_folio() to say no if folio dirty Fix netfs_release_folio() to say no (ie. return false) if the folio is dirty (analogous with iomap's behaviour). Without this, it will say yes to the release of a dirty page by split_huge_page_to_list_to_order(), which will result in the loss of untruncated data in the folio. Without this, the generic/075 and generic/112 xfstests (both fsx-based tests) fail with minimum folio size patches applied[1]. Fixes: c1ec4d7c2e13 ("netfs: Provide invalidate_folio and release_folio calls") Signed-off-by: David Howells Link: https://lore.kernel.org/r/20240815090849.972355-1-kernel@pankajraghav.com/ [1] Link: https://lore.kernel.org/r/20240823200819.532106-4-dhowells@redhat.com cc: Matthew Wilcox (Oracle) cc: Pankaj Raghav cc: Jeff Layton cc: Marc Dionne cc: linux-afs@lists.infradead.org cc: netfs@lists.linux.dev cc: linux-mm@kvack.org cc: linux-fsdevel@vger.kernel.org Signed-off-by: Christian Brauner fs/netfs/misc.c | 3 +++ 1 file changed, 3 insertions(+) commit a74ee0e878e262c0276966528d72d4e887174410 Author: David Howells Date: Fri Aug 23 21:08:10 2024 +0100 afs: Fix post-setattr file edit to do truncation correctly At the end of an kAFS RPC operation, there is an "edit" phase (originally intended for post-directory modification ops to edit the local image) that the setattr VFS op uses to fix up the pagecache if the RPC that requested truncation of a file was successful. afs_setattr_edit_file() calls truncate_setsize() which sets i_size, expands the pagecache if needed and truncates the pagecache. The first two of those, however, are redundant as they've already been done by afs_setattr_success() under the io_lock and the first is also done under the callback lock (cb_lock). Fix afs_setattr_edit_file() to call truncate_pagecache() instead (which is called by truncate_setsize(), thereby skipping the redundant parts. Fixes: 100ccd18bb41 ("netfs: Optimise away reads above the point at which there can be no data") Signed-off-by: David Howells Link: https://lore.kernel.org/r/20240823200819.532106-3-dhowells@redhat.com cc: Matthew Wilcox (Oracle) cc: Pankaj Raghav cc: Jeff Layton cc: Marc Dionne cc: linux-afs@lists.infradead.org cc: netfs@lists.linux.dev cc: linux-mm@kvack.org cc: linux-fsdevel@vger.kernel.org Signed-off-by: Christian Brauner fs/afs/inode.c | 11 ++++++++--- 1 file changed, 8 insertions(+), 3 deletions(-) commit 0aa2e1b2fb7a75aa4b5b4347055ccfea6f091769 Author: David Howells Date: Fri Aug 23 21:08:09 2024 +0100 mm: Fix missing folio invalidation calls during truncation When AS_RELEASE_ALWAYS is set on a mapping, the ->release_folio() and ->invalidate_folio() calls should be invoked even if PG_private and PG_private_2 aren't set. This is used by netfslib to keep track of the point above which reads can be skipped in favour of just zeroing pagecache locally. There are a couple of places in truncation in which invalidation is only called when folio_has_private() is true. Fix these to check folio_needs_release() instead. Without this, the generic/075 and generic/112 xfstests (both fsx-based tests) fail with minimum folio size patches applied[1]. Fixes: b4fa966f03b7 ("mm, netfs, fscache: stop read optimisation when folio removed from pagecache") Signed-off-by: David Howells Link: https://lore.kernel.org/r/20240815090849.972355-1-kernel@pankajraghav.com/ [1] Link: https://lore.kernel.org/r/20240823200819.532106-2-dhowells@redhat.com Reviewed-by: Matthew Wilcox (Oracle) cc: Matthew Wilcox (Oracle) cc: Pankaj Raghav cc: Jeff Layton cc: Marc Dionne cc: linux-afs@lists.infradead.org cc: netfs@lists.linux.dev cc: linux-mm@kvack.org cc: linux-fsdevel@vger.kernel.org Signed-off-by: Christian Brauner mm/truncate.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) commit d10771d51b28f73aeb4e533207a294c1c1d45690 Merge: 996b37da1e0f 441e36ef5b34 Author: Christian Brauner Date: Fri Aug 23 19:57:13 2024 +0200 Merge patch series "ovl: simplify ovl_parse_param_lowerdir()" Simplify and fix overlayfs layer parsing so the maximum of 500 layers can be used. * patches from https://lore.kernel.org/r/20240705011510.794025-1-chengzhihao1@huawei.com: ovl: ovl_parse_param_lowerdir: Add missed '\n' for pr_err ovl: fix wrong lowerdir number check for parameter Opt_lowerdir ovl: pass string to ovl_parse_layer() Link: https://lore.kernel.org/r/20240705011510.794025-1-chengzhihao1@huawei.com Signed-off-by: Christian Brauner commit d2bafcf224f3911b183113b2fcb536c9e90684a3 Merge: cb2c84b38082 ff0ce721ec21 Author: Linus Torvalds Date: Sat Aug 24 10:39:18 2024 +0800 Merge tag 'cgroup-for-6.11-rc4-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/cgroup Pull cgroup fixes from Tejun Heo: "Three patches addressing cpuset corner cases" * tag 'cgroup-for-6.11-rc4-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/cgroup: cgroup/cpuset: Eliminate unncessary sched domains rebuilds in hotplug cgroup/cpuset: Clear effective_xcpus on cpus_allowed clearing only if cpus.exclusive not set cgroup/cpuset: fix panic caused by partcmd_update commit cb2c84b38082f8bd052bf909c7da344b83578ace Merge: 5bd6cf007407 c4c8f369b6a6 Author: Linus Torvalds Date: Sat Aug 24 10:35:57 2024 +0800 Merge tag 'wq-for-6.11-rc4-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/wq Pull workqueue fixes from Tejun Heo: "Nothing too interesting. One patch to remove spurious warning and others to address static checker warnings" * tag 'wq-for-6.11-rc4-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/wq: workqueue: Correct declaration of cpu_pwq in struct workqueue_struct workqueue: Fix spruious data race in __flush_work() workqueue: Remove incorrect "WARN_ON_ONCE(!list_empty(&worker->entry));" from dying worker workqueue: Fix UBSAN 'subtraction overflow' error in shift_and_mask() workqueue: doc: Fix function name, remove markers commit 5bd6cf00740765c47b5684e2d75ac90d3371659a Merge: a8a8dcbd679e 50f2b98dc83d Author: Linus Torvalds Date: Sat Aug 24 10:10:43 2024 +0800 Merge tag 'mips-fixes_6.11_1' of git://git.kernel.org/pub/scm/linux/kernel/git/mips/linux Pull MIPS fixes from Thomas Bogendoerfer: - Set correct timer mode on Loongson64 - Only request r4k clockevent interrupt on one CPU * tag 'mips-fixes_6.11_1' of git://git.kernel.org/pub/scm/linux/kernel/git/mips/linux: MIPS: cevt-r4k: Don't call get_c0_compare_int if timer irq is installed MIPS: Loongson64: Set timer mode in cpu-probe commit 740f2e2791b98e47288b3814c83a3f566518fed2 Author: Pawel Laszczak Date: Wed Aug 21 06:07:42 2024 +0000 usb: cdnsp: fix for Link TRB with TC Stop Endpoint command on LINK TRB with TC bit set to 1 causes that internal cycle bit can have incorrect state after command complete. In consequence empty transfer ring can be incorrectly detected when EP is resumed. NOP TRB before LINK TRB avoid such scenario. Stop Endpoint command is then on NOP TRB and internal cycle bit is not changed and have correct value. Fixes: 3d82904559f4 ("usb: cdnsp: cdns3 Add main part of Cadence USBSSP DRD Driver") cc: Signed-off-by: Pawel Laszczak Reviewed-by: Peter Chen Link: https://lore.kernel.org/r/PH7PR07MB953878279F375CCCE6C6F40FDD8E2@PH7PR07MB9538.namprd07.prod.outlook.com Signed-off-by: Greg Kroah-Hartman drivers/usb/cdns3/cdnsp-gadget.h | 3 +++ drivers/usb/cdns3/cdnsp-ring.c | 28 ++++++++++++++++++++++++++++ 2 files changed, 31 insertions(+) commit a8a8dcbd679e223cfdfec304d55287e07e4d0054 Merge: 60f0560f53e3 75c8f387dd16 Author: Linus Torvalds Date: Sat Aug 24 10:03:03 2024 +0800 Merge tag 'arm64-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux Pull arm64 kvm fixes from Catalin Marinas: - Don't drop references on LPIs that weren't visited by the vgic-debug iterator - Cure lock ordering issue when unregistering vgic redistributors - Fix for misaligned stage-2 mappings when VMs are backed by hugetlb pages - Treat SGI registers as UNDEFINED if a VM hasn't been configured for GICv3 * tag 'arm64-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux: KVM: arm64: Make ICC_*SGI*_EL1 undef in the absence of a vGICv3 KVM: arm64: Ensure canonical IPA is hugepage-aligned when handling fault KVM: arm64: vgic: Don't hold config_lock while unregistering redistributors KVM: arm64: vgic-debug: Don't put unmarked LPIs commit 60f0560f53e395adf4bce7282d8d4bc94a4952ac Merge: 66ace9a8f9b4 f92214e4c312 Author: Linus Torvalds Date: Sat Aug 24 09:03:25 2024 +0800 Merge tag 'nfs-for-6.11-2' of git://git.linux-nfs.org/projects/anna/linux-nfs Pull NFS client fixes from Anna Schumaker: - Fix rpcrdma refcounting in xa_alloc - Fix rpcrdma usage of XA_FLAGS_ALLOC - Fix requesting FATTR4_WORD2_OPEN_ARGUMENTS - Fix attribute bitmap decoder to handle a 3rd word - Add reschedule points when returning delegations to avoid soft lockups - Fix clearing layout segments in layoutreturn - Avoid unnecessary rescanning of the per-server delegation list * tag 'nfs-for-6.11-2' of git://git.linux-nfs.org/projects/anna/linux-nfs: NFS: Avoid unnecessary rescanning of the per-server delegation list NFSv4: Fix clearing of layout segments in layoutreturn NFSv4: Add missing rescheduling points in nfs_client_return_marked_delegations nfs: fix bitmap decoder to handle a 3rd word nfs: fix the fetch of FATTR4_OPEN_ARGUMENTS rpcrdma: Trace connection registration and unregistration rpcrdma: Use XA_FLAGS_ALLOC instead of XA_FLAGS_ALLOC1 rpcrdma: Device kref is over-incremented on error from xa_alloc commit 66ace9a8f9b4dedc44045c1e47accf148c7cb5fa Merge: 7eb61cc674ee 5e51224d2afb Author: Linus Torvalds Date: Sat Aug 24 08:50:21 2024 +0800 Merge tag 'v6.11-rc4-client-fixes' of git://git.samba.org/sfrench/cifs-2.6 Pull smb client fixes from Steve French: - fix refcount leak (can cause rmmod fail) - fix byte range locking problem with cached reads - fix for mount failure if reparse point unrecognized - minor typo * tag 'v6.11-rc4-client-fixes' of git://git.samba.org/sfrench/cifs-2.6: smb/client: fix typo: GlobalMid_Sem -> GlobalMid_Lock smb: client: ignore unhandled reparse tags smb3: fix problem unloading module due to leaked refcount on shutdown smb3: fix broken cached reads when posix locks commit 7eb61cc674ee0f597e7954d38e4e08fe8c5b19ba Merge: 79a899e3d643 4e870e6bbec5 Author: Linus Torvalds Date: Sat Aug 24 08:15:21 2024 +0800 Merge tag 'input-for-v6.11-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input Pull input fixes from Dmitry Torokhov: - a tweak to uinput interface to reject requests with abnormally large number of slots. 100 slots/contacts should be enough for real devices - support for FocalTech FT8201 added to the edt-ft5x06 driver - tweaks to i8042 to handle more devices that have issue with its emulation - Synaptics touchpad switched to native SMbus/RMI mode on HP Elitebook 840 G2 - other minor fixes * tag 'input-for-v6.11-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input: Input: himax_hx83112b - fix incorrect size when reading product ID Input: i8042 - use new forcenorestore quirk to replace old buggy quirk combination Input: i8042 - add forcenorestore quirk to leave controller untouched even on s3 Input: i8042 - add Fujitsu Lifebook E756 to i8042 quirk table Input: uinput - reject requests with unreasonable number of slots Input: edt-ft5x06 - add support for FocalTech FT8201 dt-bindings: input: touchscreen: edt-ft5x06: Document FT8201 support Input: adc-joystick - fix optional value handling Input: synaptics - enable SMBus for HP Elitebook 840 G2 Input: ads7846 - ratelimit the spi_sync error message commit 79a899e3d643a256b120d3e9cbf518b55e6f3686 Merge: d5afaf917e80 76f461867800 Author: Linus Torvalds Date: Sat Aug 24 08:10:17 2024 +0800 Merge tag 'drm-fixes-2024-08-24' of https://gitlab.freedesktop.org/drm/kernel Pull drm fixes from Dave Airlie: "Weekly fixes. xe and msm are the major groups, with amdgpu/i915/nouveau having smaller bits. xe has a bunch of hw workaround fixes that were found to be missing, so that is why there are a bunch of scattered fixes, and one larger one. But overall size doesn't look too out of the ordinary. msm: - virtual plane fixes: - drop yuv on hw where not supported - csc vs yuv format fix - rotation fix - fix fb cleanup on close - reset phy before link training - fix visual corruption at 4K - fix NULL ptr crash on hotplug - simplify debug macros - sc7180 fix - adreno firmware name error path fix amdgpu: - GFX10 firmware loading fix - SDMA 5.2 fix - Debugfs parameter validation fix - eGPU hotplug fix i915: - fix HDCP timeouts nouveau: - fix SG_DEBUG crash xe: - Fix OA format masks which were breaking build with gcc-5 - Fix opregion leak (Lucas) - Fix OA sysfs entry (Ashutosh) - Fix VM dma-resv lock (Brost) - Fix tile fini sequence (Brost) - Prevent UAF around preempt fence (Auld) - Fix DGFX display suspend/resume (Maarten) - Many Xe/Xe2 critical workarounds (Auld, Ngai-Mint, Bommu, Tejas, Daniele) - Fix devm/drmm issues (Daniele) - Fix missing workqueue destroy in xe_gt_pagefault (Stuart) - Drop HW fence pointer to HW fence ctx (Brost) - Free job before xe_exec_queue_put (Brost)" * tag 'drm-fixes-2024-08-24' of https://gitlab.freedesktop.org/drm/kernel: (35 commits) drm/xe: Free job before xe_exec_queue_put drm/xe: Drop HW fence pointer to HW fence ctx drm/xe: Fix missing workqueue destroy in xe_gt_pagefault drm/amdgpu: fix eGPU hotplug regression drm/amdgpu: Validate TA binary size drm/amdgpu/sdma5.2: limit wptr workaround to sdma 5.2.1 drm/amdgpu: fixing rlc firmware loading failure issue drm/xe/uc: Use devm to register cleanup that includes exec_queues drm/xe: use devm instead of drmm for managed bo drm/xe/xe2hpg: Add Wa_14021821874 drm/xe: fix WA 14018094691 drm/xe/xe2: Add Wa_15015404425 drm/xe/xe2: Make subsequent L2 flush sequential drm/xe/xe2lpg: Extend workaround 14021402888 drm/xe/xe2lpm: Extend Wa_16021639441 drm/xe/bmg: implement Wa_16023588340 drm/xe/oa/uapi: Make bit masks unsigned drm/xe/display: Make display suspend/resume work on discrete drm/xe: prevent UAF around preempt fence drm/xe: Fix tile fini sequence ... commit d5afaf917e802665d67673991974f5bc204dfa11 Merge: 489270f44c3f e6b09a173870 Author: Linus Torvalds Date: Sat Aug 24 07:49:14 2024 +0800 Merge tag 'block-6.11-20240823' of git://git.kernel.dk/linux Pull block fixes from Jens Axboe: - NVMe pull request via Keith - Remove unused struct field (Nilay) - Fix fabrics keep-alive teardown order (Ming) - Write zeroes fixes (John) * tag 'block-6.11-20240823' of git://git.kernel.dk/linux: nvme: Remove unused field nvme: move stopping keep-alive into nvme_uninit_ctrl() block: Drop NULL check in bdev_write_zeroes_sectors() block: Read max write zeroes once for __blkdev_issue_write_zeroes() commit 489270f44c3fc2fb8d0e5d102ea08a90e93ca135 Merge: b09f6ca99c46 e0ee967630c8 Author: Linus Torvalds Date: Sat Aug 24 07:45:08 2024 +0800 Merge tag 'io_uring-6.11-20240823' of git://git.kernel.dk/linux Pull io_uring fix from Jens Axboe: "Just a single fix for provided buffer validation" * tag 'io_uring-6.11-20240823' of git://git.kernel.dk/linux: io_uring/kbuf: sanitize peek buffer setup commit b09f6ca99c46e4a561ac943253aca9beae8c1146 Merge: 6ae4e48b67ea 5c7bb62cb8f5 Author: Linus Torvalds Date: Sat Aug 24 07:39:35 2024 +0800 Merge tag 'acpi-6.11-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm Pull ACPI fix from Rafael Wysocki: "Fix backlight control on a Dell All In One system where a backlight controller board is attached to a UART port and the dell-uart backlight driver binds to it, but the backlight is actually controlled by other means (Hans de Goede)" * tag 'acpi-6.11-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm: ACPI: video: Add backlight=native quirk for Dell OptiPlex 7760 AIO platform/x86: dell-uart-backlight: Use acpi_video_get_backlight_type() ACPI: video: Add Dell UART backlight controller detection commit 6ae4e48b67eaf8a140ac3a6f0f8ea2627a174aca Merge: f76a30a96cb8 c0a1ef9c5be7 Author: Linus Torvalds Date: Sat Aug 24 07:26:28 2024 +0800 Merge tag 'thermal-6.11-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm Pull thermal control fixes from Rafael Wysocki: "These fix error handling in the thermal debug code and OF node reference leaks in the thermal OF driver. Specifics: - Use IS_ERR() in checks of debugfs_create_dir() return value instead of checking it against NULL in the thermal debug code (Yang Ruibin) - Fix three OF node reference leaks in thermal_of (Krzysztof Kozlowski)" * tag 'thermal-6.11-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm: thermal: of: Fix OF node leak in of_thermal_zone_find() error paths thermal: of: Fix OF node leak in thermal_of_zone_register() thermal: of: Fix OF node leak in thermal_of_trips_init() error path thermal/debugfs: Fix the NULL vs IS_ERR() confusion in debugfs_create_dir() commit f76a30a96cb855e025c5f15f3ed939950828c136 Merge: c2a905a6d6fa a1e627af32ed Author: Linus Torvalds Date: Sat Aug 24 06:58:04 2024 +0800 Merge tag 'mmc-v6.11-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/ulfh/mmc Pull mmc fixes from Ulf Hansson: "MMC core: - Fix NULL dereference for mmc_test on allocation failure MMC host: - dw_mmc: Fix support for deferred probe for biu/ciu clocks - mtk-sd: Fix CMD8 support when fragile tuning settings" * tag 'mmc-v6.11-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/ulfh/mmc: mmc: mmc_test: Fix NULL dereference on allocation failure mmc: dw_mmc: allow biu and ciu clocks to defer mmc: mtk-sd: receive cmd8 data when hs400 tuning fail commit c2a905a6d6faa34991c993a321a01e8454934622 Merge: 3d5f968a177d e17465f78eb9 Author: Linus Torvalds Date: Sat Aug 24 06:56:06 2024 +0800 Merge tag 'spi-fix-v6.11-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/spi Pull spi fixes from Mark Brown: "A small collection of fixes here, all driver specific and none of them too serious. For whatever reason runtime PM seems to have been causing a bunch of issues recently" * tag 'spi-fix-v6.11-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/spi: spi: pxa2xx: Move PM runtime handling to the glue drivers spi: pxa2xx: Do not override dev->platform_data on probe spi: spi-fsl-lpspi: limit PRESCALE bit in TCR register spi: spi-cadence-quadspi: Fix OSPI NOR failures during system resume spi: zynqmp-gqspi: Scale timeout by data size commit 6781b962d97bc52715a8db8cc17278cc3c23ebe8 Author: Mohan Kumar Date: Fri Aug 23 14:43:42 2024 +0000 ASoC: tegra: Fix CBB error during probe() When Tegra audio drivers are built as part of the kernel image, TIMEOUT_ERR is observed from cbb-fabric. Following is seen on Jetson AGX Orin during boot: [ 8.012482] ************************************** [ 8.017423] CPU:0, Error:cbb-fabric, Errmon:2 [ 8.021922] Error Code : TIMEOUT_ERR [ 8.025966] Overflow : Multiple TIMEOUT_ERR [ 8.030644] [ 8.032175] Error Code : TIMEOUT_ERR [ 8.036217] MASTER_ID : CCPLEX [ 8.039722] Address : 0x290a0a8 [ 8.043318] Cache : 0x1 -- Bufferable [ 8.047630] Protection : 0x2 -- Unprivileged, Non-Secure, Data Access [ 8.054628] Access_Type : Write [ 8.106130] WARNING: CPU: 0 PID: 124 at drivers/soc/tegra/cbb/tegra234-cbb.c:604 tegra234_cbb_isr+0x134/0x178 [ 8.240602] Call trace: [ 8.243126] tegra234_cbb_isr+0x134/0x178 [ 8.247261] __handle_irq_event_percpu+0x60/0x238 [ 8.252132] handle_irq_event+0x54/0xb8 These errors happen when MVC device, which is a child of AHUB device, tries to access its device registers. This happens as part of call tegra210_mvc_reset_vol_settings() in MVC device probe(). The root cause of this problem is, the child MVC device gets probed before the AHUB clock gets enabled. The AHUB clock is enabled in runtime PM resume of parent AHUB device and due to the wrong sequence of pm_runtime_enable() in AHUB driver, runtime PM resume doesn't happen for AHUB device when MVC makes register access. Fix this by calling pm_runtime_enable() for parent AHUB device before of_platform_populate() in AHUB driver. This ensures that clock becomes available when MVC makes register access. Fixes: 16e1bcc2caf4 ("ASoC: tegra: Add Tegra210 based AHUB driver") Signed-off-by: Mohan Kumar Signed-off-by: Ritu Chaudhary Signed-off-by: Sameer Pujar Link: https://patch.msgid.link/20240823144342.4123814-3-spujar@nvidia.com Signed-off-by: Mark Brown sound/soc/tegra/tegra210_ahub.c | 10 ++++++---- 1 file changed, 6 insertions(+), 4 deletions(-) commit b4a90b543d9f62d3ac34ec1ab97fc5334b048565 Author: robelin Date: Fri Aug 23 14:43:41 2024 +0000 ASoC: dapm: Fix UAF for snd_soc_pcm_runtime object When using kernel with the following extra config, - CONFIG_KASAN=y - CONFIG_KASAN_GENERIC=y - CONFIG_KASAN_INLINE=y - CONFIG_KASAN_VMALLOC=y - CONFIG_FRAME_WARN=4096 kernel detects that snd_pcm_suspend_all() access a freed 'snd_soc_pcm_runtime' object when the system is suspended, which leads to a use-after-free bug: [ 52.047746] BUG: KASAN: use-after-free in snd_pcm_suspend_all+0x1a8/0x270 [ 52.047765] Read of size 1 at addr ffff0000b9434d50 by task systemd-sleep/2330 [ 52.047785] Call trace: [ 52.047787] dump_backtrace+0x0/0x3c0 [ 52.047794] show_stack+0x34/0x50 [ 52.047797] dump_stack_lvl+0x68/0x8c [ 52.047802] print_address_description.constprop.0+0x74/0x2c0 [ 52.047809] kasan_report+0x210/0x230 [ 52.047815] __asan_report_load1_noabort+0x3c/0x50 [ 52.047820] snd_pcm_suspend_all+0x1a8/0x270 [ 52.047824] snd_soc_suspend+0x19c/0x4e0 The snd_pcm_sync_stop() has a NULL check on 'substream->runtime' before making any access. So we need to always set 'substream->runtime' to NULL everytime we kfree() it. Fixes: a72706ed8208 ("ASoC: codec2codec: remove ephemeral variables") Signed-off-by: robelin Signed-off-by: Sameer Pujar Link: https://patch.msgid.link/20240823144342.4123814-2-spujar@nvidia.com Signed-off-by: Mark Brown sound/soc/soc-dapm.c | 1 + 1 file changed, 1 insertion(+) commit 18b3256db76bd1130965acd99fbd38f87c3e6950 Author: Luiz Augusto von Dentz Date: Wed Aug 21 14:41:52 2024 -0400 Bluetooth: hci_core: Fix not handling hibernation actions This fixes not handling hibernation actions on suspend notifier so they are treated in the same way as regular suspend actions. Fixes: 9952d90ea288 ("Bluetooth: Handle PM_SUSPEND_PREPARE and PM_POST_SUSPEND") Signed-off-by: Luiz Augusto von Dentz net/bluetooth/hci_core.c | 10 ++++++++-- 1 file changed, 8 insertions(+), 2 deletions(-) commit 35237475384ab3622f63c3c09bdf6af6dacfe9c3 Author: Neeraj Sanjay Kale Date: Fri Aug 16 15:51:13 2024 +0530 Bluetooth: btnxpuart: Fix random crash seen while removing driver This fixes the random kernel crash seen while removing the driver, when running the load/unload test over multiple iterations. 1) modprobe btnxpuart 2) hciconfig hci0 reset 3) hciconfig (check hci0 interface up with valid BD address) 4) modprobe -r btnxpuart Repeat steps 1 to 4 The ps_wakeup() call in btnxpuart_close() schedules the psdata->work(), which gets scheduled after module is removed, causing a kernel crash. This hidden issue got highlighted after enabling Power Save by default in 4183a7be7700 (Bluetooth: btnxpuart: Enable Power Save feature on startup) The new ps_cleanup() deasserts UART break immediately while closing serdev device, cancels any scheduled ps_work and destroys the ps_lock mutex. [ 85.884604] Unable to handle kernel paging request at virtual address ffffd4a61638f258 [ 85.884624] Mem abort info: [ 85.884625] ESR = 0x0000000086000007 [ 85.884628] EC = 0x21: IABT (current EL), IL = 32 bits [ 85.884633] SET = 0, FnV = 0 [ 85.884636] EA = 0, S1PTW = 0 [ 85.884638] FSC = 0x07: level 3 translation fault [ 85.884642] swapper pgtable: 4k pages, 48-bit VAs, pgdp=0000000041dd0000 [ 85.884646] [ffffd4a61638f258] pgd=1000000095fff003, p4d=1000000095fff003, pud=100000004823d003, pmd=100000004823e003, pte=0000000000000000 [ 85.884662] Internal error: Oops: 0000000086000007 [#1] PREEMPT SMP [ 85.890932] Modules linked in: algif_hash algif_skcipher af_alg overlay fsl_jr_uio caam_jr caamkeyblob_desc caamhash_desc caamalg_desc crypto_engine authenc libdes crct10dif_ce polyval_ce polyval_generic snd_soc_imx_spdif snd_soc_imx_card snd_soc_ak5558 snd_soc_ak4458 caam secvio error snd_soc_fsl_spdif snd_soc_fsl_micfil snd_soc_fsl_sai snd_soc_fsl_utils gpio_ir_recv rc_core fuse [last unloaded: btnxpuart(O)] [ 85.927297] CPU: 1 PID: 67 Comm: kworker/1:3 Tainted: G O 6.1.36+g937b1be4345a #1 [ 85.936176] Hardware name: FSL i.MX8MM EVK board (DT) [ 85.936182] Workqueue: events 0xffffd4a61638f380 [ 85.936198] pstate: 60000005 (nZCv daif -PAN -UAO -TCO -DIT -SSBS BTYPE=--) [ 85.952817] pc : 0xffffd4a61638f258 [ 85.952823] lr : 0xffffd4a61638f258 [ 85.952827] sp : ffff8000084fbd70 [ 85.952829] x29: ffff8000084fbd70 x28: 0000000000000000 x27: 0000000000000000 [ 85.963112] x26: ffffd4a69133f000 x25: ffff4bf1c8540990 x24: ffff4bf215b87305 [ 85.963119] x23: ffff4bf215b87300 x22: ffff4bf1c85409d0 x21: ffff4bf1c8540970 [ 85.977382] x20: 0000000000000000 x19: ffff4bf1c8540880 x18: 0000000000000000 [ 85.977391] x17: 0000000000000000 x16: 0000000000000133 x15: 0000ffffe2217090 [ 85.977399] x14: 0000000000000001 x13: 0000000000000133 x12: 0000000000000139 [ 85.977407] x11: 0000000000000001 x10: 0000000000000a60 x9 : ffff8000084fbc50 [ 85.977417] x8 : ffff4bf215b7d000 x7 : ffff4bf215b83b40 x6 : 00000000000003e8 [ 85.977424] x5 : 00000000410fd030 x4 : 0000000000000000 x3 : 0000000000000000 [ 85.977432] x2 : 0000000000000000 x1 : ffff4bf1c4265880 x0 : 0000000000000000 [ 85.977443] Call trace: [ 85.977446] 0xffffd4a61638f258 [ 85.977451] 0xffffd4a61638f3e8 [ 85.977455] process_one_work+0x1d4/0x330 [ 85.977464] worker_thread+0x6c/0x430 [ 85.977471] kthread+0x108/0x10c [ 85.977476] ret_from_fork+0x10/0x20 [ 85.977488] Code: bad PC value [ 85.977491] ---[ end trace 0000000000000000 ]--- Preset since v6.9.11 Fixes: 86d55f124b52 ("Bluetooth: btnxpuart: Deasset UART break before closing serdev device") Signed-off-by: Neeraj Sanjay Kale Reviewed-by: Paul Menzel Signed-off-by: Luiz Augusto von Dentz drivers/bluetooth/btnxpuart.c | 20 ++++++++++++++++++-- 1 file changed, 18 insertions(+), 2 deletions(-) commit eb9e749c0182affafadfbe5ded4503c4b5a9b57c Author: Kiran K Date: Thu Jul 18 20:18:04 2024 +0530 Bluetooth: btintel: Allow configuring drive strength of BRI BRI (Bluetooth Radio Interface) traffic from CNVr to CNVi was found causing cross talk step errors to WiFi. To avoid this potential issue OEM platforms can replace BRI resistor to adjust the BRI response line drive strength. During the *setup*, driver reads the drive strength value from uefi variable and passes it to the controller via vendor specific command with opcode 0xfc0a. dmesg: .. [21.982720] Bluetooth: hci0: Bootloader timestamp 2023.33 buildtype 1 build 45995 [21.984250] Bluetooth: hci0: Found device firmware: intel/ibt-0190-0291-iml.sfi [21.984255] Bluetooth: hci0: Boot Address: 0x30099000 [21.984256] Bluetooth: hci0: Firmware Version: 160-24.24 [22.011501] Bluetooth: hci0: Waiting for firmware download to complete [22.011518] Bluetooth: hci0: Firmware loaded in 26624 usecs [22.011584] Bluetooth: hci0: Waiting for device to boot [22.013546] Bluetooth: hci0: Malformed MSFT vendor event: 0x02 [22.013552] Bluetooth: hci0: Device booted in 1967 usecs ... [22.013792] Bluetooth: hci0: dsbr: enable: 0x01 value: 0x0b ... [22.015027] Bluetooth: hci0: Found device firmware: intel/ibt-0190-0291.sfi [22.015041] Bluetooth: hci0: Boot Address: 0x10000800 [22.015043] Bluetooth: hci0: Firmware Version: 160-24.24 [22.395821] Bluetooth: BNEP (Ethernet Emulation) ver 1.3 [22.395828] Bluetooth: BNEP filters: protocol multicast ... Signed-off-by: Kiran K Signed-off-by: Luiz Augusto von Dentz drivers/bluetooth/btintel.c | 124 ++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 124 insertions(+) commit 441e36ef5b347d9ab4f54f7b54853266be687556 Author: Zhihao Cheng Date: Fri Jul 5 09:15:10 2024 +0800 ovl: ovl_parse_param_lowerdir: Add missed '\n' for pr_err Add '\n' for pr_err in function ovl_parse_param_lowerdir(), which ensures that error message is displayed at once. Fixes: b36a5780cb44 ("ovl: modify layer parameter parsing") Signed-off-by: Zhihao Cheng Link: https://lore.kernel.org/r/20240705011510.794025-4-chengzhihao1@huawei.com Signed-off-by: Christian Brauner fs/overlayfs/params.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) commit ca76ac36bb6068866feca185045e7edf2a8f392f Author: Zhihao Cheng Date: Fri Jul 5 09:15:09 2024 +0800 ovl: fix wrong lowerdir number check for parameter Opt_lowerdir The max count of lowerdir is OVL_MAX_STACK[500], which is broken by commit 37f32f526438("ovl: fix memory leak in ovl_parse_param()") for parameter Opt_lowerdir. Since commit 819829f0319a("ovl: refactor layer parsing helpers") and commit 24e16e385f22("ovl: add support for appending lowerdirs one by one") added check ovl_mount_dir_check() in function ovl_parse_param_lowerdir(), the 'ctx->nr' should be smaller than OVL_MAX_STACK, after commit 37f32f526438("ovl: fix memory leak in ovl_parse_param()") is applied, the 'ctx->nr' is updated before the check ovl_mount_dir_check(), which leads the max count of lowerdir to become 499 for parameter Opt_lowerdir. Fix it by replacing lower layers parsing code with the existing helper function ovl_parse_layer(). Fixes: 37f32f526438 ("ovl: fix memory leak in ovl_parse_param()") Signed-off-by: Zhihao Cheng Link: https://lore.kernel.org/r/20240705011510.794025-3-chengzhihao1@huawei.com Reviewed-by: Amir Goldstein Signed-off-by: Christian Brauner fs/overlayfs/params.c | 40 +++++++--------------------------------- 1 file changed, 7 insertions(+), 33 deletions(-) commit 7eff3453cbd7e0bfc7524d59694119b5ca844778 Author: Christian Brauner Date: Fri Jul 5 09:15:08 2024 +0800 ovl: pass string to ovl_parse_layer() So it can be used for parsing the Opt_lowerdir. Signed-off-by: Zhihao Cheng Link: https://lore.kernel.org/r/20240705011510.794025-2-chengzhihao1@huawei.com Signed-off-by: Christian Brauner fs/overlayfs/params.c | 7 +++---- 1 file changed, 3 insertions(+), 4 deletions(-) commit 5a6d3a638c93881b7a7c13df870238b91399578a Author: Keith Busch Date: Thu Aug 22 08:18:08 2024 -0700 nvme: use better description for async reset reason The NVMe AER notification of a persistent internal error triggers a reset. The existing warning message just says "due to AER", which can be confused with the unrelated PCIe AER condition. Just say what the event was instead of the generic overloaded acronym. Reviewed-by: Christoph Hellwig Reviewed-by: Chaitanya Kulkarni Signed-off-by: Keith Busch drivers/nvme/host/core.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) commit f4bd3139933da65c2daa402b2a4d5fe469133aec Author: Jinjie Ruan Date: Thu Aug 22 15:19:16 2024 +0800 nvmet: Make nvmet_debugfs static The sparse tool complains as follows: drivers/nvme/target/debugfs.c:16:15: warning: symbol 'nvmet_debugfs' was not declared. Should it be static? This symbol is not used outside debugfs.c, so marks it static. Signed-off-by: Jinjie Ruan Reviewed-by: Chaitanya Kulkarni Reviewed-by: Christoph Hellwig Signed-off-by: Keith Busch drivers/nvme/target/debugfs.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit a204501e1743d695ca2930ed25a2be9f8ced96d3 Author: Olga Kornievskaia Date: Fri Aug 23 11:51:08 2024 -0400 nfsd: prevent panic for nfsv4.0 closed files in nfs4_show_open Prior to commit 3f29cc82a84c ("nfsd: split sc_status out of sc_type") states_show() relied on sc_type field to be of valid type before calling into a subfunction to show content of a particular stateid. From that commit, we split the validity of the stateid into sc_status and no longer changed sc_type to 0 while unhashing the stateid. This resulted in kernel oopsing for nfsv4.0 opens that stay around and in nfs4_show_open() would derefence sc_file which was NULL. Instead, for closed open stateids forgo displaying information that relies of having a valid sc_file. To reproduce: mount the server with 4.0, read and close a file and then on the server cat /proc/fs/nfsd/clients/2/states [ 513.590804] Call trace: [ 513.590925] _raw_spin_lock+0xcc/0x160 [ 513.591119] nfs4_show_open+0x78/0x2c0 [nfsd] [ 513.591412] states_show+0x44c/0x488 [nfsd] [ 513.591681] seq_read_iter+0x5d8/0x760 [ 513.591896] seq_read+0x188/0x208 [ 513.592075] vfs_read+0x148/0x470 [ 513.592241] ksys_read+0xcc/0x178 Fixes: 3f29cc82a84c ("nfsd: split sc_status out of sc_type") Signed-off-by: Olga Kornievskaia Reviewed-by: Jeff Layton Signed-off-by: Chuck Lever fs/nfsd/nfs4state.c | 21 ++++++++++++--------- 1 file changed, 12 insertions(+), 9 deletions(-) commit 639766ca10d1e218e257ae7eabe76814bae6ab89 Author: Hal Feng Date: Mon Aug 12 15:01:08 2024 +0800 pinctrl: starfive: jh7110: Correct the level trigger configuration of iev register A mistake was made in level trigger register configuration. Correct it. Fixes: 447976ab62c5 ("pinctrl: starfive: Add StarFive JH7110 sys controller driver") Signed-off-by: Hal Feng Link: https://lore.kernel.org/20240812070108.100923-1-hal.feng@starfivetech.com Signed-off-by: Linus Walleij drivers/pinctrl/starfive/pinctrl-starfive-jh7110.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) commit d3692d95cc4d88114b070ee63cffc976f00f207f Author: Konrad Dybcio Date: Fri Aug 9 02:22:04 2024 +0200 pinctrl: qcom: x1e80100: Fix special pin offsets Remove the erroneus 0x100000 offset to prevent the boards from crashing on pin state setting, as well as for the intended state changes to take effect. Fixes: 05e4941d97ef ("pinctrl: qcom: Add X1E80100 pinctrl driver") Signed-off-by: Konrad Dybcio Reviewed-by: Abel Vesa Reviewed-by: Bjorn Andersson Link: https://lore.kernel.org/20240809-topic-h_sdc-v1-1-bb421532c531@quicinc.com Signed-off-by: Linus Walleij drivers/pinctrl/qcom/pinctrl-x1e80100.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) commit 9983a9cd4d429dc9ca01770083c4c1f366214b65 Author: Mario Limonciello Date: Tue Jul 2 12:15:14 2024 -0500 cpufreq/amd-pstate-ut: Don't check for highest perf matching on prefcore If a system is using preferred cores the highest perf will be inconsistent as it can change from system events. Skip the checks for it. Fixes: e571a5e2068e ("cpufreq: amd-pstate: Update amd-pstate preferred core ranking dynamically") Reviewed-by: Gautham R. Shenoy Signed-off-by: Mario Limonciello drivers/cpufreq/amd-pstate-ut.c | 13 ++++++++----- 1 file changed, 8 insertions(+), 5 deletions(-) commit 166bf8af91225576f85208a31eaedbadd182d1ea Author: Nícolas F. R. A. Prado Date: Thu Aug 8 19:27:09 2024 -0400 pinctrl: mediatek: common-v2: Fix broken bias-disable for PULL_PU_PD_RSEL_TYPE Despite its name, commit fed74d75277d ("pinctrl: mediatek: common-v2: Fix bias-disable for PULL_PU_PD_RSEL_TYPE") actually broke bias-disable for PULL_PU_PD_RSEL_TYPE. mtk_pinconf_bias_set_combo() tries every bias method supported by the pin until one succeeds. For PULL_PU_PD_RSEL_TYPE pins, before the breaking commit, mtk_pinconf_bias_set_rsel() would be called first to try and set the RSEL value (as well as PU and PD), and if that failed, the only other valid option was that bias-disable was specified, which would then be handled by calling mtk_pinconf_bias_set_pu_pd() and disabling both PU and PD. The breaking commit misunderstood this logic and added an early "return 0" in mtk_pinconf_bias_set_rsel(). The result was that in the bias-disable case, the bias was left unchanged, since by returning success, mtk_pinconf_bias_set_combo() no longer tried calling mtk_pinconf_bias_set_pu_pd() to disable the bias. Since the logic for configuring bias-disable on PULL_PU_PD_RSEL_TYPE pins required mtk_pinconf_bias_set_rsel() to fail first, in that case, an error was printed to the log, eg: mt8195-pinctrl 10005000.pinctrl: Not support rsel value 0 Ohm for pin = 29 (GPIO29) This is what the breaking commit actually got rid of, and likely part of the reason why that commit was thought to be fixing functionality, while in reality it was breaking it. Instead of simply reverting that commit, restore the functionality but in a way that avoids the error from being printed and makes the code less confusing: * Return 0 explicitly if a bias method was successful * Introduce an extra function mtk_pinconf_bias_set_pu_pd_rsel() that calls both mtk_pinconf_bias_set_rsel() (only if needed) and mtk_pinconf_bias_set_pu_pd() * And analogously for the corresponding getters Fixes: fed74d75277d ("pinctrl: mediatek: common-v2: Fix bias-disable for PULL_PU_PD_RSEL_TYPE") Signed-off-by: Nícolas F. R. A. Prado Link: https://lore.kernel.org/20240808-mtk-rsel-bias-disable-fix-v1-1-1b4e85bf596c@collabora.com Signed-off-by: Linus Walleij drivers/pinctrl/mediatek/pinctrl-mtk-common-v2.c | 55 +++++++++++++----------- 1 file changed, 29 insertions(+), 26 deletions(-) commit 1c38a62f15e595346a1106025722869e87ffe044 Author: Ma Ke Date: Thu Aug 8 12:13:55 2024 +0800 pinctrl: single: fix potential NULL dereference in pcs_get_function() pinmux_generic_get_function() can return NULL and the pointer 'function' was dereferenced without checking against NULL. Add checking of pointer 'function' in pcs_get_function(). Found by code review. Cc: stable@vger.kernel.org Fixes: 571aec4df5b7 ("pinctrl: single: Use generic pinmux helpers for managing functions") Signed-off-by: Ma Ke Link: https://lore.kernel.org/20240808041355.2766009-1-make24@iscas.ac.cn Signed-off-by: Linus Walleij drivers/pinctrl/pinctrl-single.c | 2 ++ 1 file changed, 2 insertions(+) commit 752f387faaae0ae2e84d3f496922524785e77d60 Author: Thomas Blocher Date: Wed Jul 31 01:16:26 2024 +0200 pinctrl: at91: make it work with current gpiolib pinctrl-at91 currently does not support the gpio-groups devicetree property and has no pin-range. Because of this at91 gpios stopped working since patch commit 2ab73c6d8323fa1e ("gpio: Support GPIO controllers without pin-ranges") This was discussed in the patches commit fc328a7d1fcce263 ("gpio: Revert regression in sysfs-gpio (gpiolib.c)") commit 56e337f2cf132632 ("Revert "gpio: Revert regression in sysfs-gpio (gpiolib.c)"") As a workaround manually set pin-range via gpiochip_add_pin_range() until a) pinctrl-at91 is reworked to support devicetree gpio-groups b) another solution as mentioned in commit 56e337f2cf132632 ("Revert "gpio: Revert regression in sysfs-gpio (gpiolib.c)"") is found Signed-off-by: Thomas Blocher Link: https://lore.kernel.org/5b992862-355d-f0de-cd3d-ff99e67a4ff1@ek-dev.de Signed-off-by: Linus Walleij drivers/pinctrl/pinctrl-at91.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) commit c358a809cb58af944d496944391a240e02f5837a Author: Alex Deucher Date: Tue Aug 20 09:46:00 2024 -0400 Revert "drm/ttm: increase ttm pre-fault value to PMD size" This reverts commit 0ddd2ae586d28e521d37393364d989ce118802e0. This patch causes sluggishness and stuttering in graphical apps. Closes: https://gitlab.freedesktop.org/drm/amd/-/issues/3564 Link: https://www.spinics.net/lists/dri-devel/msg457005.html Signed-off-by: Alex Deucher Cc: Zhu Lingshan Cc: Christian König Reviewed-by: Christian König Signed-off-by: Alex Deucher Link: https://patchwork.freedesktop.org/patch/msgid/20240820134600.1909370-1-alexander.deucher@amd.com include/drm/ttm/ttm_bo.h | 4 ---- 1 file changed, 4 deletions(-) commit 8af174ea863c72f25ce31cee3baad8a301c0cf0f Author: Haiyang Zhang Date: Wed Aug 21 13:42:29 2024 -0700 net: mana: Fix race of mana_hwc_post_rx_wqe and new hwc response The mana_hwc_rx_event_handler() / mana_hwc_handle_resp() calls complete(&ctx->comp_event) before posting the wqe back. It's possible that other callers, like mana_create_txq(), start the next round of mana_hwc_send_request() before the posting of wqe. And if the HW is fast enough to respond, it can hit no_wqe error on the HW channel, then the response message is lost. The mana driver may fail to create queues and open, because of waiting for the HW response and timed out. Sample dmesg: [ 528.610840] mana 39d4:00:02.0: HWC: Request timed out! [ 528.614452] mana 39d4:00:02.0: Failed to send mana message: -110, 0x0 [ 528.618326] mana 39d4:00:02.0 enP14804s2: Failed to create WQ object: -110 To fix it, move posting of rx wqe before complete(&ctx->comp_event). Cc: stable@vger.kernel.org Fixes: ca9c54d2d6a5 ("net: mana: Add a driver for Microsoft Azure Network Adapter (MANA)") Signed-off-by: Haiyang Zhang Reviewed-by: Long Li Signed-off-by: David S. Miller drivers/net/ethernet/microsoft/mana/hw_channel.c | 62 +++++++++++++----------- 1 file changed, 34 insertions(+), 28 deletions(-) commit a24cd5cfd1d07712a9f192401af638e3c6cc1491 Author: Shyam Sundar S K Date: Thu Aug 22 15:23:57 2024 +0530 platform/x86/amd/pmc: Extend support for PMC features on new AMD platform PMC driver has capability to get the idle mask values and STB data from the PMFW. Extend this support to the platforms that belong to family 1Ah model 60h series. Co-developed-by: Sanket Goswami Signed-off-by: Sanket Goswami Signed-off-by: Shyam Sundar S K Reviewed-by: Mario Limonciello Link: https://lore.kernel.org/r/20240822095357.395808-2-Shyam-sundar.S-k@amd.com Reviewed-by: Ilpo Järvinen Signed-off-by: Ilpo Järvinen drivers/platform/x86/amd/pmc/pmc.c | 2 ++ 1 file changed, 2 insertions(+) commit ba7b6633e9afa6b5a788efd533c4bdc6fb1c606d Author: Shyam Sundar S K Date: Thu Aug 22 15:23:56 2024 +0530 platform/x86/amd/pmc: Fix SMU command submission path on new AMD platform The commit 426463d94d45 ("platform/x86/amd/pmc: Send OS_HINT command for new AMD platform") was introduced to enable sending mailbox commands to PMFW on newer platforms. However, it was later discovered that the commit did not configure the correct message port ID (i.e., S2D or PMC). Without this configuration, all command submissions to PMFW are treated as invalid, leading to command failures. To address this issue, the CPU ID association for the new platform needs to be added in amd_pmc_get_ip_info(). This ensures that the correct SMU port IDs are selected. Fixes: 426463d94d45 ("platform/x86/amd/pmc: Send OS_HINT command for new AMD platform") Co-developed-by: Sanket Goswami Signed-off-by: Sanket Goswami Signed-off-by: Shyam Sundar S K Reviewed-by: Mario Limonciello Link: https://lore.kernel.org/r/20240822095357.395808-1-Shyam-sundar.S-k@amd.com Reviewed-by: Ilpo Järvinen Signed-off-by: Ilpo Järvinen drivers/platform/x86/amd/pmc/pmc.c | 1 + 1 file changed, 1 insertion(+) commit 880799fc7a3a127c43143935c1a8767d77c19cae Author: Maxime Chevallier Date: Fri Aug 23 12:07:12 2024 +0200 irqchip/irq-msi-lib: Check for NULL ops in msi_lib_irq_domain_select() The irq_domain passed to msi_lib_irq_domain_select() may not have msi_parent_ops set. There is a NULL pointer check for it, but unfortunately there is a dereference of the parent ops pointer before that. Move the NULL pointer test before the first use of that pointer. This was found on a MacchiatoBin (Marvell Armada 8K SoC), which uses the irq-mvebu-sei driver. Fixes: 72e257c6f058 ("irqchip: Provide irq-msi-lib") Signed-off-by: Maxime Chevallier Signed-off-by: Thomas Gleixner Link: https://lore.kernel.org/all/20240823100733.1900666-1-maxime.chevallier@bootlin.com Closes: https://lore.kernel.org/all/20240821165034.1af97bad@fedora-3.home/ drivers/irqchip/irq-msi-lib.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) commit 996b37da1e0f51314d4186b326742c2a95a9f0dd Author: Ed Tsai Date: Mon Jul 8 15:22:06 2024 +0800 backing-file: convert to using fops->splice_write Filesystems may define their own splice write. Therefore, use the file fops instead of invoking iter_file_splice_write() directly. Signed-off-by: Ed Tsai Link: https://lore.kernel.org/r/20240708072208.25244-1-ed.tsai@mediatek.com Fixes: 5ca73468612d ("fuse: implement splice read/write passthrough") Reviewed-by: Amir Goldstein Signed-off-by: Christian Brauner fs/backing-file.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) commit 71c8e2a7c822ee557b07d9bb49028dd269c87b2e Author: Mark Rutland Date: Thu Aug 22 11:23:08 2024 +0100 irqchip/gic-v3: Init SRE before poking sysregs The GICv3 driver pokes GICv3 system registers in gic_prio_init() before gic_cpu_sys_reg_init() ensures that GICv3 system registers have been enabled by writing to ICC_SRE_EL1.SRE. On arm64 this is benign as has_useable_gicv3_cpuif() runs earlier during cpufeature detection, and this enables the GICv3 system registers. On 32-bit arm when booting on an FVP using the boot-wrapper, the accesses in gic_prio_init() end up being UNDEFINED and crashes the kernel during boot. This is a regression introduced by the addition of gic_prio_init(). Fix this by factoring out the SRE initialization into a new function and calling it early in the three paths where SRE may not have been initialized: (1) gic_init_bases(), before the primary CPU pokes GICv3 sysregs in gic_prio_init(). (2) gic_starting_cpu(), before secondary CPUs initialize GICv3 sysregs in gic_cpu_init(). (3) gic_cpu_pm_notifier(), before CPUs re-initialize GICv3 sysregs in gic_cpu_sys_reg_init(). Fixes: d447bf09a4013541 ("irqchip/gic-v3: Detect GICD_CTRL.DS and SCR_EL3.FIQ earlier") Signed-off-by: Mark Rutland Signed-off-by: Thomas Gleixner Reviewed-by: Marc Zyngier Cc: stable@vger.kernel.org drivers/irqchip/irq-gic-v3.c | 21 ++++++++++++++------- 1 file changed, 14 insertions(+), 7 deletions(-) commit 839a4ec06f75cec8fec2cc5fc14e921d0c3f7369 Author: Hans de Goede Date: Fri Aug 23 09:43:05 2024 +0200 ASoC: Intel: soc-acpi-cht: Make Lenovo Yoga Tab 3 X90F DMI match less strict There are 2G and 4G RAM versions of the Lenovo Yoga Tab 3 X90F and it turns out that the 2G version has a DMI product name of "CHERRYVIEW D1 PLATFORM" where as the 4G version has "CHERRYVIEW C0 PLATFORM". The sys-vendor + product-version check are unique enough that the product-name check is not necessary. Drop the product-name check so that the existing DMI match for the 4G RAM version also matches the 2G RAM version. Signed-off-by: Hans de Goede Reviewed-by: Pierre-Louis Bossart Link: https://patch.msgid.link/20240823074305.16873-1-hdegoede@redhat.com Signed-off-by: Mark Brown sound/soc/intel/common/soc-acpi-intel-cht-match.c | 1 - 1 file changed, 1 deletion(-) commit 0cc65482f5b03ac2b1c240bc34665e43ea2d71bb Author: Hans de Goede Date: Fri Aug 23 09:42:17 2024 +0200 ASoC: Intel: Boards: Fix NULL pointer deref in BYT/CHT boards harder Since commit 13f58267cda3 ("ASoC: soc.h: don't create dummy Component via COMP_DUMMY()") dummy codecs declared like this: SND_SOC_DAILINK_DEF(dummy, DAILINK_COMP_ARRAY(COMP_DUMMY())); expand to: static struct snd_soc_dai_link_component dummy[] = { }; Which means that dummy is a zero sized array and thus dais[i].codecs should not be dereferenced *at all* since it points to the address of the next variable stored in the data section as the "dummy" variable has an address but no size, so even dereferencing dais[0] is already an out of bounds array reference. Which means that the if (dais[i].codecs->name) check added in commit 7d99a70b6595 ("ASoC: Intel: Boards: Fix NULL pointer deref in BYT/CHT boards") relies on that the part of the next variable which the name member maps to just happens to be NULL. Which apparently so far it usually is, except when it isn't and then it results in crashes like this one: [ 28.795659] BUG: unable to handle page fault for address: 0000000000030011 ... [ 28.795780] Call Trace: [ 28.795787] ... [ 28.795862] ? strcmp+0x18/0x40 [ 28.795872] 0xffffffffc150c605 [ 28.795887] platform_probe+0x40/0xa0 ... [ 28.795979] ? __pfx_init_module+0x10/0x10 [snd_soc_sst_bytcr_wm5102] Really fix things this time around by checking dais.num_codecs != 0. Fixes: 7d99a70b6595 ("ASoC: Intel: Boards: Fix NULL pointer deref in BYT/CHT boards") Cc: stable@vger.kernel.org Signed-off-by: Hans de Goede Reviewed-by: Pierre-Louis Bossart Link: https://patch.msgid.link/20240823074217.14653-1-hdegoede@redhat.com Signed-off-by: Mark Brown sound/soc/intel/boards/bxt_rt298.c | 2 +- sound/soc/intel/boards/bytcht_cx2072x.c | 2 +- sound/soc/intel/boards/bytcht_da7213.c | 2 +- sound/soc/intel/boards/bytcht_es8316.c | 2 +- sound/soc/intel/boards/bytcr_rt5640.c | 2 +- sound/soc/intel/boards/bytcr_rt5651.c | 2 +- sound/soc/intel/boards/bytcr_wm5102.c | 2 +- sound/soc/intel/boards/cht_bsw_rt5645.c | 2 +- sound/soc/intel/boards/cht_bsw_rt5672.c | 2 +- 9 files changed, 9 insertions(+), 9 deletions(-) commit 9ec87c5957ea9bf68d36f5e098605b585b2571e4 Author: Ulf Hansson Date: Fri Aug 23 00:45:38 2024 +0200 OPP: Fix support for required OPPs for multiple PM domains It has turned out that having _set_required_opps() to recursively call dev_pm_opp_set_opp() to set the required OPPs, doesn't really work as well as we expected. More precisely, at each recursive call to dev_pm_opp_set_opp() we are changing an OPP for a required_dev that belongs to a required-OPP table. The problem with this, is that we may have several devices sharing the same required-OPP table, which leads to an incorrect behaviour in regards to aggregating the per device votes. To fix the problem for a required-OPP table belonging to a PM domain, which is the only existing usecase for now, let's simply replace the call to dev_pm_opp_set_opp() in _set_required_opps() by a call to _set_opp_level(). Moving forward we may potentially need to add support for other types of required-OPP tables. In this case, the aggregation needs to be thought of. Fixes: e37440e7e2c2 ("OPP: Call dev_pm_opp_set_opp() for required OPPs") Cc: stable@vger.kernel.org Signed-off-by: Ulf Hansson Acked-by: Viresh Kumar Link: https://lore.kernel.org/r/20240822224547.385095-2-ulf.hansson@linaro.org drivers/opp/core.c | 56 +++++++++++++++++++++--------------------------------- 1 file changed, 22 insertions(+), 34 deletions(-) commit 3d5f968a177d468cd13568ef901c5be84d83d32b Merge: 3902f60b5810 a9aaf1ff88a8 Author: Linus Torvalds Date: Fri Aug 23 17:48:27 2024 +0800 Merge tag 'pwrseq-fixes-for-v6.11-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/brgl/linux Pull power sequencing fix from Bartosz Golaszewski: - request the wlan-enable GPIO "as-is" to fix an issue with the wifi module being already powered up before linux boots * tag 'pwrseq-fixes-for-v6.11-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/brgl/linux: power: sequencing: request the WLAN enable GPIO as-is commit 3902f60b58101b67e01072f561d4e85eed8e47a1 Merge: b78b25f69a1d 52dd070c62e4 Author: Linus Torvalds Date: Fri Aug 23 17:43:34 2024 +0800 Merge tag 'pmdomain-v6.11-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/ulfh/linux-pm Pull pmdomain fixes from Ulf Hansson: - imx: Remove duplicated clocks for scu power domain - imx: Wait for SSAR to complete power-on for i.MX93 power domain * tag 'pmdomain-v6.11-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/ulfh/linux-pm: pmdomain: imx: wait SSAR when i.MX93 power domain on pmdomain: imx: scu-pd: Remove duplicated clocks commit 82b8000c28b56b014ce52a1f1581bef4af148681 Author: Johannes Berg Date: Mon Aug 19 11:09:43 2024 +0200 net: drop special comment style As we discussed in the room at netdevconf earlier this week, drop the requirement for special comment style for netdev. For checkpatch, the general check accepts both right now, so simply drop the special request there as well. Acked-by: Stephen Hemminger Signed-off-by: Johannes Berg Acked-by: Jakub Kicinski Signed-off-by: David S. Miller Documentation/process/coding-style.rst | 12 ------------ Documentation/process/maintainer-netdev.rst | 17 ----------------- scripts/checkpatch.pl | 10 ---------- 3 files changed, 39 deletions(-) commit b58b133e680b20d219940e0fdb6f6132c2b60f38 Author: Pranjal Shrivastava Date: Fri Aug 16 10:49:06 2024 +0000 iommu: Handle iommu faults for a bad iopf setup The iommu_report_device_fault function was updated to return void while assuming that drivers only need to call iommu_report_device_fault() for reporting an iopf. This implementation causes following problems: 1. The drivers rely on the core code to call it's page_reponse, however, when a fault is received and no fault capable domain is attached / iopf_param is NULL, the ops->page_response is NOT called causing the device to stall in case the fault type was PAGE_REQ. 2. The arm_smmu_v3 driver relies on the returned value to log errors returning void from iommu_report_device_fault causes these events to be missed while logging. Modify the iommu_report_device_fault function to return -EINVAL for cases where no fault capable domain is attached or iopf_param was NULL and calls back to the driver (ops->page_response) in case the fault type was IOMMU_FAULT_PAGE_REQ. The returned value can be used by the drivers to log the fault/event as needed. Reported-by: Kunkun Jiang Closes: https://lore.kernel.org/all/6147caf0-b9a0-30ca-795e-a1aa502a5c51@huawei.com/ Fixes: 3dfa64aecbaf ("iommu: Make iommu_report_device_fault() return void") Signed-off-by: Jason Gunthorpe Signed-off-by: Pranjal Shrivastava Reviewed-by: Jason Gunthorpe Reviewed-by: Lu Baolu Link: https://lore.kernel.org/r/20240816104906.1010626-1-praan@google.com Signed-off-by: Joerg Roedel drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.c | 2 +- drivers/iommu/io-pgfault.c | 121 +++++++++++++++++++--------- include/linux/iommu.h | 5 +- 3 files changed, 87 insertions(+), 41 deletions(-) commit 75c8f387dd16066a90c0928d00851edad0c8c519 Merge: f75c235565f9 3e6245ebe7ef Author: Catalin Marinas Date: Fri Aug 23 09:47:39 2024 +0100 Merge tag 'kvmarm-fixes-6.11-2' of git://git.kernel.org/pub/scm/linux/kernel/git/kvmarm/kvmarm into for-next/fixes KVM/arm64 fixes for 6.11, round #2 - Don't drop references on LPIs that weren't visited by the vgic-debug iterator - Cure lock ordering issue when unregistering vgic redistributors - Fix for misaligned stage-2 mappings when VMs are backed by hugetlb pages - Treat SGI registers as UNDEFINED if a VM hasn't been configured for GICv3 * tag 'kvmarm-fixes-6.11-2' of git://git.kernel.org/pub/scm/linux/kernel/git/kvmarm/kvmarm: KVM: arm64: Make ICC_*SGI*_EL1 undef in the absence of a vGICv3 KVM: arm64: Ensure canonical IPA is hugepage-aligned when handling fault KVM: arm64: vgic: Don't hold config_lock while unregistering redistributors KVM: arm64: vgic-debug: Don't put unmarked LPIs KVM: arm64: vgic: Hold config_lock while tearing down a CPU interface KVM: selftests: arm64: Correct feature test for S1PIE in get-reg-list KVM: arm64: Tidying up PAuth code in KVM KVM: arm64: vgic-debug: Exit the iterator properly w/o LPI KVM: arm64: Enforce dependency on an ARMv8.4-aware toolchain docs: KVM: Fix register ID of SPSR_FIQ KVM: arm64: vgic: fix unexpected unlock sparse warnings KVM: arm64: fix kdoc warnings in W=1 builds KVM: arm64: fix override-init warnings in W=1 builds KVM: arm64: free kvm->arch.nested_mmus with kvfree() commit b3c18a55e1a6cab791727fc91f798239f95e6bad Merge: 1fa7b099d60a bb4485562f59 Author: Takashi Iwai Date: Fri Aug 23 08:26:08 2024 +0200 Merge tag 'asoc-fix-v6.11-rc3' of https://git.kernel.org/pub/scm/linux/kernel/git/broonie/sound into for-linus ASoC: Fixes for v6.11 A relatively large collection of fixes here, all driver specific and none of them particularly major, plus one MAINTAINERS update. There's been a bunch of work on module autoloading from several people. commit b78b25f69a1dfa79798f684ad34707b1da10a48f Merge: aa0743a22936 d4bc0a264fb4 Author: Linus Torvalds Date: Fri Aug 23 10:25:29 2024 +0800 Merge tag 'ata-6.11-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/libata/linux Pull ata fixes from Damien Le Moal: - Fix the max segment size and max number of segments supported by the pata_macio driver to fix issues with BIO splitting leading to an overflow of the adapter DMA table (from Michael) - Related to the previous fix, change BUG_ON() calls for incorrect command buffer segmentation into WARN_ON() and an error return (from Michael) * tag 'ata-6.11-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/libata/linux: ata: pata_macio: Use WARN instead of BUG ata: pata_macio: Fix DMA table overflow commit 4f9eedfa27ae5806ed10906bcceee7bae49c8941 Author: Yihang Li Date: Mon Aug 19 17:09:34 2024 +0800 scsi: sd: Ignore command SYNCHRONIZE CACHE error if format in progress If formatting a suspended disk (such as formatting with different DIF type), the disk will be resuming first, and then the format command will submit to the disk through SG_IO ioctl. When the disk is processing the format command, the system does not submit other commands to the disk. Therefore, the system attempts to suspend the disk again and sends the SYNCHRONIZE CACHE command. However, the SYNCHRONIZE CACHE command will fail because the disk is in the formatting process. This will cause the runtime_status of the disk to error and it is difficult for user to recover it. Error info like: [ 669.925325] sd 6:0:6:0: [sdg] Synchronizing SCSI cache [ 670.202371] sd 6:0:6:0: [sdg] Synchronize Cache(10) failed: Result: hostbyte=0x00 driverbyte=DRIVER_OK [ 670.216300] sd 6:0:6:0: [sdg] Sense Key : 0x2 [current] [ 670.221860] sd 6:0:6:0: [sdg] ASC=0x4 ASCQ=0x4 To solve the issue, ignore the error and return success/0 when format is in progress. Cc: stable@vger.kernel.org Signed-off-by: Yihang Li Link: https://lore.kernel.org/r/20240819090934.2130592-1-liyihang9@huawei.com Reviewed-by: Bart Van Assche Reviewed-by: Damien Le Moal Signed-off-by: Martin K. Petersen drivers/scsi/sd.c | 12 +++++++----- 1 file changed, 7 insertions(+), 5 deletions(-) commit 919ddf8336f0b84c0453bac583808c9f165a85c2 Author: Ben Hutchings Date: Thu Aug 22 00:51:42 2024 +0200 scsi: aacraid: Fix double-free on probe failure aac_probe_one() calls hardware-specific init functions through the aac_driver_ident::init pointer, all of which eventually call down to aac_init_adapter(). If aac_init_adapter() fails after allocating memory for aac_dev::queues, it frees the memory but does not clear that member. After the hardware-specific init function returns an error, aac_probe_one() goes down an error path that frees the memory pointed to by aac_dev::queues, resulting.in a double-free. Reported-by: Michael Gordon Link: https://bugs.debian.org/1075855 Fixes: 8e0c5ebde82b ("[SCSI] aacraid: Newer adapter communication iterface support") Signed-off-by: Ben Hutchings Link: https://lore.kernel.org/r/ZsZvfqlQMveoL5KQ@decadent.org.uk Signed-off-by: Martin K. Petersen drivers/scsi/aacraid/comminit.c | 2 ++ 1 file changed, 2 insertions(+) commit 3417c9574e368f0330637505f00d3814ca8854d2 Author: Sherry Yang Date: Tue Aug 20 23:51:31 2024 -0700 scsi: lpfc: Fix overflow build issue Build failed while enabling "CONFIG_GCOV_KERNEL=y" and "CONFIG_GCOV_PROFILE_ALL=y" with following error: BUILDSTDERR: drivers/scsi/lpfc/lpfc_bsg.c: In function 'lpfc_get_cgnbuf_info': BUILDSTDERR: ./include/linux/fortify-string.h:114:33: error: '__builtin_memcpy' accessing 18446744073709551615 bytes at offsets 0 and 0 overlaps 9223372036854775807 bytes at offset -9223372036854775808 [-Werror=restrict] BUILDSTDERR: 114 | #define __underlying_memcpy __builtin_memcpy BUILDSTDERR: | ^ BUILDSTDERR: ./include/linux/fortify-string.h:637:9: note: in expansion of macro '__underlying_memcpy' BUILDSTDERR: 637 | __underlying_##op(p, q, __fortify_size); \ BUILDSTDERR: | ^~~~~~~~~~~~~ BUILDSTDERR: ./include/linux/fortify-string.h:682:26: note: in expansion of macro '__fortify_memcpy_chk' BUILDSTDERR: 682 | #define memcpy(p, q, s) __fortify_memcpy_chk(p, q, s, \ BUILDSTDERR: | ^~~~~~~~~~~~~~~~~~~~ BUILDSTDERR: drivers/scsi/lpfc/lpfc_bsg.c:5468:9: note: in expansion of macro 'memcpy' BUILDSTDERR: 5468 | memcpy(cgn_buff, cp, cinfosz); BUILDSTDERR: | ^~~~~~ This happens from the commit 06bb7fc0feee ("kbuild: turn on -Wrestrict by default"). Address this issue by using size_t type. Signed-off-by: Sherry Yang Link: https://lore.kernel.org/r/20240821065131.1180791-1-sherry.yang@oracle.com Reviewed-by: Justin Tee Signed-off-by: Martin K. Petersen drivers/scsi/lpfc/lpfc_bsg.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 979b581e4c69257acab1af415ddad6b2d78a2fa5 Author: Eric Dumazet Date: Wed Aug 21 17:53:39 2024 +0000 pktgen: use cpus_read_lock() in pg_net_init() I have seen the WARN_ON(smp_processor_id() != cpu) firing in pktgen_thread_worker() during tests. We must use cpus_read_lock()/cpus_read_unlock() around the for_each_online_cpu(cpu) loop. While we are at it use WARN_ON_ONCE() to avoid a possible syslog flood. Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Signed-off-by: Eric Dumazet Link: https://patch.msgid.link/20240821175339.1191779-1-edumazet@google.com Signed-off-by: Jakub Kicinski net/core/pktgen.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) commit aa0743a229366e8c1963f1b72a1c974a9d15f08f Merge: 3f44ae972ae5 0124fb0ebf3b Author: Linus Torvalds Date: Fri Aug 23 07:47:01 2024 +0800 Merge tag 'net-6.11-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net Pull networking fixes from Jakub Kicinski: "Including fixes from bluetooth and netfilter. Current release - regressions: - virtio_net: avoid crash on resume - move netdev_tx_reset_queue() call before RX napi enable Current release - new code bugs: - net/mlx5e: fix page leak and incorrect header release w/ HW GRO Previous releases - regressions: - udp: fix receiving fraglist GSO packets - tcp: prevent refcount underflow due to concurrent execution of tcp_sk_exit_batch() Previous releases - always broken: - ipv6: fix possible UAF when incrementing error counters on output - ip6: tunnel: prevent merging of packets with different L2 - mptcp: pm: fix IDs not being reusable - bonding: fix potential crashes in IPsec offload handling - Bluetooth: HCI: - MGMT: add error handling to pair_device() to avoid a crash - invert LE State quirk to be opt-out rather then opt-in - fix LE quote calculation - drv: dsa: VLAN fixes for Ocelot driver - drv: igb: cope with large MAX_SKB_FRAGS Kconfig settings - drv: ice: fi Rx data path on architectures with PAGE_SIZE >= 8192 Misc: - netpoll: do not export netpoll_poll_[disable|enable]() - MAINTAINERS: update the list of networking headers" * tag 'net-6.11-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net: (82 commits) s390/iucv: Fix vargs handling in iucv_alloc_device() net: ovs: fix ovs_drop_reasons error net: xilinx: axienet: Fix dangling multicast addresses net: xilinx: axienet: Always disable promiscuous mode MAINTAINERS: Mark JME Network Driver as Odd Fixes MAINTAINERS: Add header files to NETWORKING sections MAINTAINERS: Add limited globs for Networking headers MAINTAINERS: Add net_tstamp.h to SOCKET TIMESTAMPING section MAINTAINERS: Add sonet.h to ATM section of MAINTAINERS octeontx2-af: Fix CPT AF register offset calculation net: phy: realtek: Fix setting of PHY LEDs Mode B bit on RTL8211F net: ngbe: Fix phy mode set to external phy netfilter: flowtable: validate vlan header bnxt_en: Fix double DMA unmapping for XDP_REDIRECT ipv6: prevent possible UAF in ip6_xmit() ipv6: fix possible UAF in ip6_finish_output2() ipv6: prevent UAF in ip6_send_skb() netpoll: do not export netpoll_poll_[disable|enable]() selftests: mlxsw: ethtool_lanes: Source ethtool lib from correct path udp: fix receiving fraglist GSO packets ... commit 3f44ae972ae5cf6a75eb40314a6a81bd694d0f53 Merge: 872cf28b8df9 8fb4ac1cee88 Author: Linus Torvalds Date: Fri Aug 23 07:43:15 2024 +0800 Merge tag 'kbuild-fixes-v6.11-2' of git://git.kernel.org/pub/scm/linux/kernel/git/masahiroy/linux-kbuild Pull Kbuild fixes from Masahiro Yamada: - Eliminate the fdtoverlay command duplication in scripts/Makefile.lib - Fix 'make compile_commands.json' for external modules - Ensure scripts/kconfig/merge_config.sh handles missing newlines - Fix some build errors on macOS * tag 'kbuild-fixes-v6.11-2' of git://git.kernel.org/pub/scm/linux/kernel/git/masahiroy/linux-kbuild: kbuild: fix typos "prequisites" to "prerequisites" Documentation/llvm: turn make command for ccache into code block kbuild: avoid scripts/kallsyms parsing /dev/null treewide: remove unnecessary inclusion scripts: kconfig: merge_config: config files: add a trailing newline Makefile: add $(srctree) to dependency of compile_commands.json target kbuild: clean up code duplication in cmd_fdtoverlay commit 76f461867800fa9421d26a70a1640eed55dff0cd Merge: 5159b9dcfa4b 9e7f30563677 Author: Dave Airlie Date: Fri Aug 23 09:11:52 2024 +1000 Merge tag 'drm-xe-fixes-2024-08-22' of https://gitlab.freedesktop.org/drm/xe/kernel into drm-fixes UAPI Changes: - Fix OA format masks which were breaking build with gcc-5 (Geert) Driver Changes: - Fix opregion leak (Lucas) - Fix OA sysfs entry (Ashutosh) - Fix VM dma-resv lock (Brost) - Fix tile fini sequence (Brost) - Prevent UAF around preempt fence (Auld) - Fix DGFX display suspend/resume (Maarten) - Many Xe/Xe2 critical workarounds (Auld, Ngai-Mint, Bommu, Tejas, Daniele) - Fix devm/drmm issues (Daniele) - Fix missing workqueue destroy in xe_gt_pagefault (Stuart) - Drop HW fence pointer to HW fence ctx (Brost) - Free job before xe_exec_queue_put (Brost) Signed-off-by: Dave Airlie From: Rodrigo Vivi Link: https://patchwork.freedesktop.org/patch/msgid/ZsdVe0XI2Pq8C-ON@intel.com commit 5159b9dcfa4b79658543465f6370cdd514cdc6d9 Merge: b069f6315c2d 9b340aeb26d5 Author: Dave Airlie Date: Fri Aug 23 09:08:18 2024 +1000 Merge tag 'drm-misc-fixes-2024-08-22' of https://gitlab.freedesktop.org/drm/misc/kernel into drm-fixes Short summary of fixes pull: nouveau: - firmware: use dma non-coherent allocator Signed-off-by: Dave Airlie From: Thomas Zimmermann Link: https://patchwork.freedesktop.org/patch/msgid/20240822123907.GA234335@localhost.localdomain commit b069f6315c2d99b32cb0e1adca7ab4d99bccf410 Merge: 424a98a68fea 5d41eeb6725e Author: Dave Airlie Date: Fri Aug 23 09:05:11 2024 +1000 Merge tag 'drm-intel-fixes-2024-08-22' of https://gitlab.freedesktop.org/drm/i915/kernel into drm-fixes - Fix for HDCP timeouts Signed-off-by: Dave Airlie From: Joonas Lahtinen Link: https://patchwork.freedesktop.org/patch/msgid/ZsbPMm6XfzimmZW0@jlahtine-mobl.ger.corp.intel.com commit 424a98a68feac20de626e307e09c7ced6585a658 Merge: 5d34b050c729 9cead81eff63 Author: Dave Airlie Date: Fri Aug 23 08:58:17 2024 +1000 Merge tag 'amd-drm-fixes-6.11-2024-08-21' of https://gitlab.freedesktop.org/agd5f/linux into drm-fixes amd-drm-fixes-6.11-2024-08-21: amdgpu: - GFX10 firmware loading fix - SDMA 5.2 fix - Debugfs parameter validation fix - eGPU hotplug fix Signed-off-by: Dave Airlie From: Alex Deucher Link: https://patchwork.freedesktop.org/patch/msgid/20240821172810.302416-1-alexander.deucher@amd.com commit e6b09a173870720e4d4c6fd755803970015ac043 Merge: 81475beb1b59 fe0175134735 Author: Jens Axboe Date: Thu Aug 22 16:20:24 2024 -0600 Merge tag 'nvme-6.11-2024-08-22' of git://git.infradead.org/nvme into block-6.11 Pull NVMe fixes from Keith: "nvme fixes for Linux 6.11 - Remove unused struct field (Nilay) - Fix fabrics keep-alive teardown order (Ming)" * tag 'nvme-6.11-2024-08-22' of git://git.infradead.org/nvme: nvme: Remove unused field nvme: move stopping keep-alive into nvme_uninit_ctrl() commit f92214e4c312f6ea9d78650cc6291d200f17abb6 Author: Trond Myklebust Date: Wed Aug 21 14:05:02 2024 -0400 NFS: Avoid unnecessary rescanning of the per-server delegation list If the call to nfs_delegation_grab_inode() fails, we will not have dropped any locks that require us to rescan the list. Signed-off-by: Trond Myklebust Reviewed-by: Jeff Layton Signed-off-by: Anna Schumaker fs/nfs/delegation.c | 15 +++++---------- 1 file changed, 5 insertions(+), 10 deletions(-) commit d72b7963115bea971a28eaa2cb76722c023f9fdf Author: Trond Myklebust Date: Wed Aug 21 14:05:01 2024 -0400 NFSv4: Fix clearing of layout segments in layoutreturn Make sure that we clear the layout segments in cases where we see a fatal error, and also in the case where the layout is invalid. Signed-off-by: Trond Myklebust Reviewed-by: Jeff Layton Signed-off-by: Anna Schumaker fs/nfs/nfs4proc.c | 9 ++++++--- fs/nfs/pnfs.c | 5 ++--- 2 files changed, 8 insertions(+), 6 deletions(-) commit a017ad1313fc91bdf235097fd0a02f673fc7bb11 Author: Trond Myklebust Date: Wed Aug 21 14:05:00 2024 -0400 NFSv4: Add missing rescheduling points in nfs_client_return_marked_delegations We're seeing reports of soft lockups when iterating through the loops, so let's add rescheduling points. Signed-off-by: Trond Myklebust Reviewed-by: Jeff Layton Signed-off-by: Anna Schumaker fs/nfs/super.c | 2 ++ 1 file changed, 2 insertions(+) commit 95832998fb6edc50d4f2f6a958d9f90142d4be48 Author: Jeff Layton Date: Wed Aug 21 08:28:25 2024 -0400 nfs: fix bitmap decoder to handle a 3rd word It only decodes the first two words at this point. Have it decode the third word as well. Without this, the client doesn't send delegated timestamps in the CB_GETATTR response. With this change we also need to expand the on-stack bitmap in decode_recallany_args to 3 elements, in case the server sends a larger bitmap than expected. Fixes: 43df7110f4a9 ("NFSv4: Add CB_GETATTR support for delegated attributes") Signed-off-by: Jeff Layton Reviewed-by: Benjamin Coddington Signed-off-by: Anna Schumaker fs/nfs/callback_xdr.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) commit cb78f9b7d0c0c9f86d8c0ac9c46b8b684d8785a9 Author: Jeff Layton Date: Thu Aug 15 10:18:41 2024 -0400 nfs: fix the fetch of FATTR4_OPEN_ARGUMENTS The client doesn't properly request FATTR4_OPEN_ARGUMENTS in the initial SERVER_CAPS getattr. Add FATTR4_WORD2_OPEN_ARGUMENTS to the initial request. Fixes: 707f13b3d081 (NFSv4: Add support for the FATTR4_OPEN_ARGUMENTS attribute) Signed-off-by: Jeff Layton Reviewed-by: Benjamin Coddington Signed-off-by: Anna Schumaker fs/nfs/nfs4proc.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) commit 5d34b050c7290af2723dd728dffb08d38df9c096 Merge: 47ac09b91bef 624ab9cde26a Author: Dave Airlie Date: Fri Aug 23 06:46:28 2024 +1000 Merge tag 'drm-msm-fixes-2024-08-19' of https://gitlab.freedesktop.org/drm/msm into drm-fixes Fixes for v6.11-rc5 1) Fixes from the virtual plane series, namely - fix the list of formats for QCM2290 since it has no YUV support - minor fix in dpu_plane_atomic_check_pipe() to check only for csc and not csc and scaler while allowing yuv formats - take rotation into account while allocating virtual planes 2) Fix to cleanup FB if dpu_format_populate_layout() fails. This fixes the warning splat during DRM file closure 3) Fix to reset the phy link params before re-starting link training. This fixes the 100% link training failure when someone starts modetest while cable is connected 4) Long pending fix to fix a visual corruption seen for 4k modes. Root-cause was we cannot support 4k@30 with 30bpp with 2 lanes so this is a critical fix to use 24bpp for such cases 5) Fix to move dpu encoder's connector assignment to atomic_enable(). This fixes the NULL ptr crash for cases when there is an atomic_enable() without atomic_modeset() after atomic_disable() . This happens for connectors_changed case of crtc. It fixes a NULL ptr crash reported during hotplug. 6) Fix to simplify DPU's debug macros without which dynamic debug does not work as expected 7) Fix the highest bank bit setting for sc7180 8) adreno: fix error return if missing firmware-name Signed-off-by: Dave Airlie From: Rob Clark Link: https://patchwork.freedesktop.org/patch/msgid/CAF6AEGvxF2p3-AsjUydmSYrA0Vb+Ea7nh3VtNX0pT0Ae_Me-Kw@mail.gmail.com commit 5e51224d2afbda57f33f47485871ee5532145e18 Author: ChenXiaoSong Date: Tue Aug 20 14:33:15 2024 +0000 smb/client: fix typo: GlobalMid_Sem -> GlobalMid_Lock The comments have typos, fix that to not confuse readers. Signed-off-by: ChenXiaoSong Reviewed-by: Namjae Jeon fs/smb/client/cifsfs.c | 6 +++--- fs/smb/client/cifsglob.h | 6 +++--- 2 files changed, 6 insertions(+), 6 deletions(-) commit 0d8584d288a9b4132e945d76bcc04395d158b2e7 Author: Gautham R. Shenoy Date: Tue Aug 13 15:21:14 2024 +0530 cpufreq/amd-pstate: Use topology_logical_package_id() instead of logical_die_id() After the commit 63edbaa48a57 ("x86/cpu/topology: Add support for the AMD 0x80000026 leaf"), the topolgy_logical_die_id() function returns the logical Core Chiplet Die (CCD) ID instead of the logical socket ID. Since this is currently used to set MSR_AMD_CPPC_ENABLE, which needs to be set on any one of the threads of the socket, it is prudent to use topology_logical_package_id() in place of topology_logical_die_id(). Fixes: 63edbaa48a57 ("x86/cpu/topology: Add support for the AMD 0x80000026 leaf") cc: stable@vger.kernel.org # 6.10 Signed-off-by: Gautham R. Shenoy Tested-by: Dhananjay Ugwekar Link: https://lore.kernel.org/lkml/20240801124509.3650-1-Dhananjay.Ugwekar@amd.com/ Signed-off-by: Dhananjay Ugwekar Signed-off-by: Mario Limonciello drivers/cpufreq/amd-pstate.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 67d95303c84732c2e1de5730756281f648dbefaf Author: Dan Carpenter Date: Tue Aug 13 15:21:13 2024 +0530 cpufreq: amd-pstate: Fix uninitialized variable in amd_pstate_cpu_boost_update() Smatch complains that "ret" could be uninitialized: drivers/cpufreq/amd-pstate.c:734 amd_pstate_cpu_boost_update() error: uninitialized symbol 'ret'. This seems like it probably is a real issue. Initialize "ret" to zero to be safe. Fixes: c8c68c38b56f ("cpufreq: amd-pstate: initialize core precision boost state") Signed-off-by: Dan Carpenter Reviewed-by: Perry Yuan Acked-by: Gautham R. Shenoy Link: https://lore.kernel.org/lkml/7ff53543-6c04-48a0-8d99-7dc010b93b3a@stanley.mountain/T/ Signed-off-by: Gautham R. Shenoy Signed-off-by: Mario Limonciello drivers/cpufreq/amd-pstate.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit fe01751347359862c65c715d51c0b3f4fa8ee2f0 Author: Nilay Shroff Date: Wed Aug 14 19:26:50 2024 +0530 nvme: Remove unused field The "name" field in struct nvme_ctrl is unsued so removing it. This would help save 12 bytes of space for each nvme_ctrl instance created. Signed-off-by: Nilay Shroff Reviewed-by: Kanchan Joshi Signed-off-by: Keith Busch drivers/nvme/host/nvme.h | 1 - 1 file changed, 1 deletion(-) commit a54a93d0e3599b05856971734e15418ac551a14c Author: Ming Lei Date: Tue Aug 13 09:35:27 2024 +0800 nvme: move stopping keep-alive into nvme_uninit_ctrl() Commit 4733b65d82bd ("nvme: start keep-alive after admin queue setup") moves starting keep-alive from nvme_start_ctrl() into nvme_init_ctrl_finish(), but don't move stopping keep-alive into nvme_uninit_ctrl(), so keep-alive work can be started and keep pending after failing to start controller, finally use-after-free is triggered if nvme host driver is unloaded. This patch fixes kernel panic when running nvme/004 in case that connection failure is triggered, by moving stopping keep-alive into nvme_uninit_ctrl(). This way is reasonable because keep-alive is now started in nvme_init_ctrl_finish(). Fixes: 3af755a46881 ("nvme: move nvme_stop_keep_alive() back to original position") Cc: Hannes Reinecke Cc: Mark O'Donovan Reported-by: Changhui Zhong Reviewed-by: Christoph Hellwig Reviewed-by: Sagi Grimberg Reviewed-by: Hannes Reinecke Signed-off-by: Ming Lei Signed-off-by: Keith Busch drivers/nvme/host/core.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 0124fb0ebf3b0ef89892d42147c9387be3105318 Author: Alexandra Winter Date: Wed Aug 21 11:13:37 2024 +0200 s390/iucv: Fix vargs handling in iucv_alloc_device() iucv_alloc_device() gets a format string and a varying number of arguments. This is incorrectly forwarded by calling dev_set_name() with the format string and a va_list, while dev_set_name() expects also a varying number of arguments. Symptoms: Corrupted iucv device names, which can result in log messages like: sysfs: cannot create duplicate filename '/devices/iucv/hvc_iucv1827699952' Fixes: 4452e8ef8c36 ("s390/iucv: Provide iucv_alloc_device() / iucv_release_device()") Link: https://bugzilla.suse.com/show_bug.cgi?id=1228425 Signed-off-by: Alexandra Winter Reviewed-by: Thorsten Winkler Reviewed-by: Przemek Kitszel Link: https://patch.msgid.link/20240821091337.3627068-1-wintera@linux.ibm.com Signed-off-by: Jakub Kicinski net/iucv/iucv.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) commit 57fb67783c4011581882f32e656d738da1f82042 Author: Menglong Dong Date: Wed Aug 21 20:32:52 2024 +0800 net: ovs: fix ovs_drop_reasons error There is something wrong with ovs_drop_reasons. ovs_drop_reasons[0] is "OVS_DROP_LAST_ACTION", but OVS_DROP_LAST_ACTION == __OVS_DROP_REASON + 1, which means that ovs_drop_reasons[1] should be "OVS_DROP_LAST_ACTION". And as Adrian tested, without the patch, adding flow to drop packets results in: drop at: do_execute_actions+0x197/0xb20 [openvsw (0xffffffffc0db6f97) origin: software input port ifindex: 8 timestamp: Tue Aug 20 10:19:17 2024 859853461 nsec protocol: 0x800 length: 98 original length: 98 drop reason: OVS_DROP_ACTION_ERROR With the patch, the same results in: drop at: do_execute_actions+0x197/0xb20 [openvsw (0xffffffffc0db6f97) origin: software input port ifindex: 8 timestamp: Tue Aug 20 10:16:13 2024 475856608 nsec protocol: 0x800 length: 98 original length: 98 drop reason: OVS_DROP_LAST_ACTION Fix this by initializing ovs_drop_reasons with index. Fixes: 9d802da40b7c ("net: openvswitch: add last-action drop reason") Signed-off-by: Menglong Dong Tested-by: Adrian Moreno Reviewed-by: Adrian Moreno Link: https://patch.msgid.link/20240821123252.186305-1-dongml2@chinatelecom.cn Signed-off-by: Jakub Kicinski net/openvswitch/datapath.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 3ddbf7b6966d8a679bd2a6f8104734face6de4a1 Merge: 2696c15ce065 6ea14ccb60c8 Author: Jakub Kicinski Date: Thu Aug 22 13:06:24 2024 -0700 Merge tag 'nf-24-08-22' of git://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf Pablo Neira Ayuso says: ==================== Netfilter fixes for net The following patchset contains Netfilter fixes for net: Patch #1 disable BH when collecting stats via hardware offload to ensure concurrent updates from packet path do not result in losing stats. From Sebastian Andrzej Siewior. Patch #2 uses write seqcount to reset counters serialize against reader. Also from Sebastian Andrzej Siewior. Patch #3 ensures vlan header is in place before accessing its fields, according to KMSAN splat triggered by syzbot. * tag 'nf-24-08-22' of git://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf: netfilter: flowtable: validate vlan header netfilter: nft_counter: Synchronize nft_counter_reset() against reader. netfilter: nft_counter: Disable BH in nft_counter_offload_stats(). ==================== Link: https://patch.msgid.link/20240822101842.4234-1-pablo@netfilter.org Signed-off-by: Jakub Kicinski commit 2696c15ce065252fe53d4a38b847383153cdfd71 Merge: a812a3f45cae 797a68c9de0f Author: Jakub Kicinski Date: Thu Aug 22 13:03:59 2024 -0700 Merge branch 'net-xilinx-axienet-multicast-fixes-and-improvements' Sean Anderson says: ==================== net: xilinx: axienet: Multicast fixes and improvements [part] ==================== First two patches of the series which are fixes. Link: https://patch.msgid.link/20240822154059.1066595-1-sean.anderson@linux.dev Signed-off-by: Jakub Kicinski commit 797a68c9de0f5a5447baf4bd3bb9c10a3993435b Author: Sean Anderson Date: Thu Aug 22 11:40:56 2024 -0400 net: xilinx: axienet: Fix dangling multicast addresses If a multicast address is removed but there are still some multicast addresses, that address would remain programmed into the frame filter. Fix this by explicitly setting the enable bit for each filter. Fixes: 8a3b7a252dca ("drivers/net/ethernet/xilinx: added Xilinx AXI Ethernet driver") Signed-off-by: Sean Anderson Reviewed-by: Simon Horman Link: https://patch.msgid.link/20240822154059.1066595-3-sean.anderson@linux.dev Signed-off-by: Jakub Kicinski drivers/net/ethernet/xilinx/xilinx_axienet.h | 1 + drivers/net/ethernet/xilinx/xilinx_axienet_main.c | 21 +++++++++------------ 2 files changed, 10 insertions(+), 12 deletions(-) commit 4ae738dfef2c0323752ab81786e2d298c9939321 Author: Sean Anderson Date: Thu Aug 22 11:40:55 2024 -0400 net: xilinx: axienet: Always disable promiscuous mode If promiscuous mode is disabled when there are fewer than four multicast addresses, then it will not be reflected in the hardware. Fix this by always clearing the promiscuous mode flag even when we program multicast addresses. Fixes: 8a3b7a252dca ("drivers/net/ethernet/xilinx: added Xilinx AXI Ethernet driver") Signed-off-by: Sean Anderson Reviewed-by: Simon Horman Link: https://patch.msgid.link/20240822154059.1066595-2-sean.anderson@linux.dev Signed-off-by: Jakub Kicinski drivers/net/ethernet/xilinx/xilinx_axienet_main.c | 4 ++++ 1 file changed, 4 insertions(+) commit 591940e22e287fb64ac07be275e343d860cb72d6 Author: Steve Wilkins Date: Fri Aug 9 14:47:44 2024 +0100 firmware: microchip: fix incorrect error report of programming:timeout on success After successfully programming the SPI flash with an MFPS auto update image, the error sysfs attribute reports programming:timeout. This is caused by an incorrect check on the return value from wait_for_completion_timeout() in mpfs_auto_update_poll_complete(). Fixes: ec5b0f1193ad ("firmware: microchip: add PolarFire SoC Auto Update support") Signed-off-by: Steve Wilkins Signed-off-by: Conor Dooley drivers/firmware/microchip/mpfs-auto-update.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 54950bfe2b69cdc06ef753872b5225e54eb73506 Author: Ravi Bangoria Date: Thu Aug 8 06:29:36 2024 +0000 KVM: SVM: Don't advertise Bus Lock Detect to guest if SVM support is missing If host supports Bus Lock Detect, KVM advertises it to guests even if SVM support is absent. Additionally, guest wouldn't be able to use it despite guest CPUID bit being set. Fix it by unconditionally clearing the feature bit in KVM cpu capability. Reported-by: Jim Mattson Closes: https://lore.kernel.org/r/CALMp9eRet6+v8Y1Q-i6mqPm4hUow_kJNhmVHfOV8tMfuSS=tVg@mail.gmail.com Fixes: 76ea438b4afc ("KVM: X86: Expose bus lock debug exception to guest") Cc: stable@vger.kernel.org Signed-off-by: Ravi Bangoria Reviewed-by: Jim Mattson Reviewed-by: Tom Lendacky Link: https://lore.kernel.org/r/20240808062937.1149-4-ravi.bangoria@amd.com Signed-off-by: Sean Christopherson arch/x86/kvm/svm/svm.c | 3 +++ 1 file changed, 3 insertions(+) commit c0a1ef9c5be72ff28a5413deb1b3e1a066593c13 Author: Krzysztof Kozlowski Date: Wed Aug 14 21:58:23 2024 +0200 thermal: of: Fix OF node leak in of_thermal_zone_find() error paths Terminating for_each_available_child_of_node() loop requires dropping OF node reference, so bailing out on errors misses this. Solve the OF node reference leak with scoped for_each_available_child_of_node_scoped(). Fixes: 3fd6d6e2b4e8 ("thermal/of: Rework the thermal device tree initialization") Cc: Signed-off-by: Krzysztof Kozlowski Reviewed-by: Chen-Yu Tsai Reviewed-by: Daniel Lezcano Link: https://patch.msgid.link/20240814195823.437597-3-krzysztof.kozlowski@linaro.org Signed-off-by: Rafael J. Wysocki drivers/thermal/thermal_of.c | 13 +++++++------ 1 file changed, 7 insertions(+), 6 deletions(-) commit 662b52b761bfe0ba970e5823759798faf809b896 Author: Krzysztof Kozlowski Date: Wed Aug 14 21:58:22 2024 +0200 thermal: of: Fix OF node leak in thermal_of_zone_register() thermal_of_zone_register() calls of_thermal_zone_find() which will iterate over OF nodes with for_each_available_child_of_node() to find matching thermal zone node. When it finds such, it exits the loop and returns the node. Prematurely ending for_each_available_child_of_node() loops requires dropping OF node reference, thus success of of_thermal_zone_find() means that caller must drop the reference. Fixes: 3fd6d6e2b4e8 ("thermal/of: Rework the thermal device tree initialization") Cc: All applicable Signed-off-by: Krzysztof Kozlowski Reviewed-by: Chen-Yu Tsai Reviewed-by: Daniel Lezcano Link: https://patch.msgid.link/20240814195823.437597-2-krzysztof.kozlowski@linaro.org Signed-off-by: Rafael J. Wysocki drivers/thermal/thermal_of.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) commit afc954fd223ded70b1fa000767e2531db55cce58 Author: Krzysztof Kozlowski Date: Wed Aug 14 21:58:21 2024 +0200 thermal: of: Fix OF node leak in thermal_of_trips_init() error path Terminating for_each_child_of_node() loop requires dropping OF node reference, so bailing out after thermal_of_populate_trip() error misses this. Solve the OF node reference leak with scoped for_each_child_of_node_scoped(). Fixes: d0c75fa2c17f ("thermal/of: Initialize trip points separately") Cc: All applicable Signed-off-by: Krzysztof Kozlowski Reviewed-by: Chen-Yu Tsai Reviewed-by: Daniel Lezcano Link: https://patch.msgid.link/20240814195823.437597-1-krzysztof.kozlowski@linaro.org Signed-off-by: Rafael J. Wysocki drivers/thermal/thermal_of.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) commit f58bab6fd4063913bd8321e99874b8239e9ba726 Author: Jeff Layton Date: Thu Aug 22 14:47:01 2024 -0400 nfsd: ensure that nfsd4_fattr_args.context is zeroed out If nfsd4_encode_fattr4 ends up doing a "goto out" before we get to checking for the security label, then args.context will be set to uninitialized junk on the stack, which we'll then try to free. Initialize it early. Fixes: f59388a579c6 ("NFSD: Add nfsd4_encode_fattr4_sec_label()") Signed-off-by: Jeff Layton Signed-off-by: Chuck Lever fs/nfsd/nfs4xdr.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) commit dad1613e0533b380318281c1519e1a3477c2d0d2 Author: Maxim Levitsky Date: Fri Aug 2 18:16:08 2024 +0300 KVM: SVM: fix emulation of msr reads/writes of MSR_FS_BASE and MSR_GS_BASE If these msrs are read by the emulator (e.g due to 'force emulation' prefix), SVM code currently fails to extract the corresponding segment bases, and return them to the emulator. Fix that. Cc: stable@vger.kernel.org Signed-off-by: Maxim Levitsky Link: https://lore.kernel.org/r/20240802151608.72896-3-mlevitsk@redhat.com Signed-off-by: Sean Christopherson arch/x86/kvm/svm/svm.c | 12 ++++++++++++ 1 file changed, 12 insertions(+) commit 4bcdd831d9d01e0fb64faea50732b59b2ee88da1 Author: Sean Christopherson Date: Tue Jul 23 16:20:55 2024 -0700 KVM: x86: Acquire kvm->srcu when handling KVM_SET_VCPU_EVENTS Grab kvm->srcu when processing KVM_SET_VCPU_EVENTS, as KVM will forcibly leave nested VMX/SVM if SMM mode is being toggled, and leaving nested VMX reads guest memory. Note, kvm_vcpu_ioctl_x86_set_vcpu_events() can also be called from KVM_RUN via sync_regs(), which already holds SRCU. I.e. trying to precisely use kvm_vcpu_srcu_read_lock() around the problematic SMM code would cause problems. Acquiring SRCU isn't all that expensive, so for simplicity, grab it unconditionally for KVM_SET_VCPU_EVENTS. ============================= WARNING: suspicious RCU usage 6.10.0-rc7-332d2c1d713e-next-vm #552 Not tainted ----------------------------- include/linux/kvm_host.h:1027 suspicious rcu_dereference_check() usage! other info that might help us debug this: rcu_scheduler_active = 2, debug_locks = 1 1 lock held by repro/1071: #0: ffff88811e424430 (&vcpu->mutex){+.+.}-{3:3}, at: kvm_vcpu_ioctl+0x7d/0x970 [kvm] stack backtrace: CPU: 15 PID: 1071 Comm: repro Not tainted 6.10.0-rc7-332d2c1d713e-next-vm #552 Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 0.0.0 02/06/2015 Call Trace: dump_stack_lvl+0x7f/0x90 lockdep_rcu_suspicious+0x13f/0x1a0 kvm_vcpu_gfn_to_memslot+0x168/0x190 [kvm] kvm_vcpu_read_guest+0x3e/0x90 [kvm] nested_vmx_load_msr+0x6b/0x1d0 [kvm_intel] load_vmcs12_host_state+0x432/0xb40 [kvm_intel] vmx_leave_nested+0x30/0x40 [kvm_intel] kvm_vcpu_ioctl_x86_set_vcpu_events+0x15d/0x2b0 [kvm] kvm_arch_vcpu_ioctl+0x1107/0x1750 [kvm] ? mark_held_locks+0x49/0x70 ? kvm_vcpu_ioctl+0x7d/0x970 [kvm] ? kvm_vcpu_ioctl+0x497/0x970 [kvm] kvm_vcpu_ioctl+0x497/0x970 [kvm] ? lock_acquire+0xba/0x2d0 ? find_held_lock+0x2b/0x80 ? do_user_addr_fault+0x40c/0x6f0 ? lock_release+0xb7/0x270 __x64_sys_ioctl+0x82/0xb0 do_syscall_64+0x6c/0x170 entry_SYSCALL_64_after_hwframe+0x4b/0x53 RIP: 0033:0x7ff11eb1b539 Fixes: f7e570780efc ("KVM: x86: Forcibly leave nested virt when SMM state is toggled") Cc: stable@vger.kernel.org Link: https://lore.kernel.org/r/20240723232055.3643811-1-seanjc@google.com Signed-off-by: Sean Christopherson arch/x86/kvm/x86.c | 2 ++ 1 file changed, 2 insertions(+) commit 28cec7f08b8b41b9b082f1dcc6a94656f125063f Author: Sean Christopherson Date: Mon Jul 22 17:02:11 2024 -0700 KVM: x86/mmu: Check that root is valid/loaded when pre-faulting SPTEs Error out if kvm_mmu_reload() fails when pre-faulting memory, as trying to fault-in SPTEs will fail miserably due to root.hpa pointing at garbage. Note, kvm_mmu_reload() can return -EIO and thus trigger the WARN on -EIO in kvm_vcpu_pre_fault_memory(), but all such paths also WARN, i.e. the WARN isn't user-triggerable and won't run afoul of warn-on-panic because the kernel would already be panicking. BUG: unable to handle page fault for address: 000029ffffffffe8 #PF: supervisor read access in kernel mode #PF: error_code(0x0000) - not-present page PGD 0 P4D 0 Oops: Oops: 0000 [#1] PREEMPT SMP CPU: 22 PID: 1069 Comm: pre_fault_memor Not tainted 6.10.0-rc7-332d2c1d713e-next-vm #548 Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 0.0.0 02/06/2015 RIP: 0010:is_page_fault_stale+0x3e/0xe0 [kvm] RSP: 0018:ffffc9000114bd48 EFLAGS: 00010206 RAX: 00003fffffffffc0 RBX: ffff88810a07c080 RCX: ffffc9000114bd78 RDX: ffff88810a07c080 RSI: ffffea0000000000 RDI: ffff88810a07c080 RBP: ffffc9000114bd78 R08: 00007fa3c8c00000 R09: 8000000000000225 R10: ffffea00043d7d80 R11: 0000000000000000 R12: ffff88810a07c080 R13: 0000000100000000 R14: ffffc9000114be58 R15: 0000000000000000 FS: 00007fa3c9da0740(0000) GS:ffff888277d80000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 000029ffffffffe8 CR3: 000000011d698000 CR4: 0000000000352eb0 Call Trace: kvm_tdp_page_fault+0xcc/0x160 [kvm] kvm_mmu_do_page_fault+0xfb/0x1f0 [kvm] kvm_arch_vcpu_pre_fault_memory+0xd0/0x1a0 [kvm] kvm_vcpu_ioctl+0x761/0x8c0 [kvm] __x64_sys_ioctl+0x82/0xb0 do_syscall_64+0x5b/0x160 entry_SYSCALL_64_after_hwframe+0x4b/0x53 Modules linked in: kvm_intel kvm CR2: 000029ffffffffe8 ---[ end trace 0000000000000000 ]--- Fixes: 6e01b7601dfe ("KVM: x86: Implement kvm_arch_vcpu_pre_fault_memory()") Reported-by: syzbot+23786faffb695f17edaa@syzkaller.appspotmail.com Closes: https://lore.kernel.org/all/0000000000002b84dc061dd73544@google.com Reviewed-by: Kai Huang Tested-by: xingwei lee Tested-by: yuxin wang Link: https://lore.kernel.org/r/20240723000211.3352304-1-seanjc@google.com Signed-off-by: Sean Christopherson arch/x86/kvm/mmu/mmu.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) commit e03a7caa5335c41e39991cfa73bb037872d1e2cb Author: Yan Zhao Date: Fri Jul 12 16:34:38 2024 -0700 KVM: x86/mmu: Fixup comments missed by the REMOVED_SPTE=>FROZEN_SPTE rename Replace "removed" with "frozen" in comments as appropriate to complete the rename of REMOVED_SPTE to FROZEN_SPTE. Fixes: 964cea817196 ("KVM: x86/tdp_mmu: Rename REMOVED_SPTE to FROZEN_SPTE") Signed-off-by: Yan Zhao Signed-off-by: Rick Edgecombe Link: https://lore.kernel.org/r/20240712233438.518591-1-rick.p.edgecombe@intel.com [sean: write changelog] Signed-off-by: Sean Christopherson arch/x86/kvm/mmu/spte.c | 6 +++--- arch/x86/kvm/mmu/spte.h | 2 +- arch/x86/kvm/mmu/tdp_mmu.c | 8 ++++---- 3 files changed, 8 insertions(+), 8 deletions(-) commit 8fb4ac1cee88a57e7a56faba49b408a41a4af4db Author: Masahiro Yamada Date: Sun Aug 18 16:07:11 2024 +0900 kbuild: fix typos "prequisites" to "prerequisites" This typo in scripts/Makefile.build has been present for more than 20 years. It was accidentally copy-pasted to other scripts/Makefile.* files. Fix them all. Signed-off-by: Masahiro Yamada Reviewed-by: Nathan Chancellor scripts/Makefile.build | 2 +- scripts/Makefile.modfinal | 2 +- scripts/Makefile.vmlinux | 2 +- scripts/Makefile.vmlinux_o | 2 +- 4 files changed, 4 insertions(+), 4 deletions(-) commit ec686804117a0421cf31d54427768aaf93aa0069 Author: Paulo Alcantara Date: Wed Aug 21 00:45:03 2024 -0300 smb: client: ignore unhandled reparse tags Just ignore reparse points that the client can't parse rather than bailing out and not opening the file or directory. Reported-by: Marc <1marc1@gmail.com> Closes: https://lore.kernel.org/r/CAMHwNVv-B+Q6wa0FEXrAuzdchzcJRsPKDDRrNaYZJd6X-+iJzw@mail.gmail.com Fixes: 539aad7f14da ("smb: client: introduce ->parse_reparse_point()") Tested-by: Anthony Nandaa (Microsoft) Signed-off-by: Paulo Alcantara (Red Hat) Signed-off-by: Steve French fs/smb/client/reparse.c | 11 +++++++---- 1 file changed, 7 insertions(+), 4 deletions(-) commit 15179cf2806f91685410e598f82813a7fcf90f6c Author: Steve French Date: Fri Aug 16 16:47:39 2024 -0500 smb3: fix problem unloading module due to leaked refcount on shutdown The shutdown ioctl can leak a refcount on the tlink which can prevent rmmod (unloading the cifs.ko) module from working. Found while debugging xfstest generic/043 Fixes: 69ca1f57555f ("smb3: add dynamic tracepoints for shutdown ioctl") Reviewed-by: Meetakshi Setiya Reviewed-by: Shyam Prasad N Signed-off-by: Steve French fs/smb/client/connect.c | 3 +++ fs/smb/client/ioctl.c | 2 ++ fs/smb/client/link.c | 1 + 3 files changed, 6 insertions(+) commit 1642285e511c2a40b14e87a41aa8feace6123036 Author: Alexander Gordeev Date: Wed Aug 21 18:55:07 2024 +0200 s390/boot: Fix KASLR base offset off by __START_KERNEL bytes Symbol offsets to the KASLR base do not match symbol address in the vmlinux image. That is the result of setting the KASLR base to the beginning of .text section as result of an optimization. Revert that optimization and allocate virtual memory for the whole kernel image including __START_KERNEL bytes as per the linker script. That allows keeping the semantics of the KASLR base offset in sync with other architectures. Rename __START_KERNEL to TEXT_OFFSET, since it represents the offset of the .text section within the kernel image, rather than a virtual address. Still skip mapping TEXT_OFFSET bytes to save memory on pgtables and provoke exceptions in case an attempt to access this area is made, as no kernel symbol may reside there. In case CONFIG_KASAN is enabled the location counter might exceed the value of TEXT_OFFSET, while the decompressor linker script forcefully resets it to TEXT_OFFSET, which leads to a sections overlap link failure. Use MAX() expression to avoid that. Reported-by: Omar Sandoval Closes: https://lore.kernel.org/linux-s390/ZnS8dycxhtXBZVky@telecaster.dhcp.thefacebook.com/ Fixes: 56b1069c40c7 ("s390/boot: Rework deployment of the kernel image") Signed-off-by: Alexander Gordeev Acked-by: Vasily Gorbik Signed-off-by: Vasily Gorbik arch/s390/boot/startup.c | 55 +++++++++++++++++++++++------------------- arch/s390/boot/vmem.c | 14 +++++++++-- arch/s390/boot/vmlinux.lds.S | 7 +++++- arch/s390/include/asm/page.h | 3 ++- arch/s390/kernel/vmlinux.lds.S | 2 +- arch/s390/tools/relocs.c | 2 +- 6 files changed, 52 insertions(+), 31 deletions(-) commit d7fd2941ae9a67423d1c7bee985f240e4686634f Author: Alexander Gordeev Date: Wed Aug 21 18:55:06 2024 +0200 s390/boot: Avoid possible physmem_info segment corruption When physical memory for the kernel image is allocated it does not consider extra memory required for offsetting the image start to match it with the lower 20 bits of KASLR virtual base address. That might lead to kernel access beyond its memory range. Suggested-by: Vasily Gorbik Fixes: 693d41f7c938 ("s390/mm: Restore mapping of kernel image using large pages") Signed-off-by: Alexander Gordeev Acked-by: Vasily Gorbik Signed-off-by: Vasily Gorbik arch/s390/boot/startup.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) commit bb4485562f5907708f1c218b5d70dce04165d1e1 Author: Richard Fitzgerald Date: Thu Aug 22 14:35:44 2024 +0100 ASoC: cs-amp-lib: Ignore empty UEFI calibration entries If the timestamp of a calibration entry is 0 it is an unused entry and must be ignored. Some end-products reserve EFI space for calibration entries by shipping with a zero-filled EFI file. When searching the file for calibration data the driver must skip the empty entries. The timestamp of a valid entry is always non-zero. Signed-off-by: Richard Fitzgerald Fixes: 1cad8725f2b9 ("ASoC: cs-amp-lib: Add helpers for factory calibration data") Link: https://patch.msgid.link/20240822133544.304421-1-rf@opensource.cirrus.com Signed-off-by: Mark Brown sound/soc/codecs/cs-amp-lib.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) commit 2b7e0573a49064d9c94c114b4471327cd96ae39c Author: ChenXiaoSong Date: Thu Aug 22 08:20:54 2024 +0000 smb/server: update misguided comment of smb2_allocate_rsp_buf() smb2_allocate_rsp_buf() will return other error code except -ENOMEM. Signed-off-by: ChenXiaoSong Acked-by: Namjae Jeon Signed-off-by: Steve French fs/smb/server/smb2pdu.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 0dd771b7d60b8281f10f6721783c60716d22075f Author: ChenXiaoSong Date: Thu Aug 22 08:20:52 2024 +0000 smb/server: remove useless assignment of 'file_present' in smb2_open() The variable is already true here. Signed-off-by: ChenXiaoSong Acked-by: Namjae Jeon Signed-off-by: Steve French fs/smb/server/smb2pdu.c | 1 - 1 file changed, 1 deletion(-) commit 4e8771a3666c8f216eefd6bd2fd50121c6c437db Author: ChenXiaoSong Date: Thu Aug 22 08:20:51 2024 +0000 smb/server: fix potential null-ptr-deref of lease_ctx_info in smb2_open() null-ptr-deref will occur when (req_op_level == SMB2_OPLOCK_LEVEL_LEASE) and parse_lease_state() return NULL. Fix this by check if 'lease_ctx_info' is NULL. Additionally, remove the redundant parentheses in parse_durable_handle_context(). Signed-off-by: ChenXiaoSong Signed-off-by: Steve French fs/smb/server/oplock.c | 2 +- fs/smb/server/smb2pdu.c | 10 +++++----- 2 files changed, 6 insertions(+), 6 deletions(-) commit 2186a116538a715b20e15f84fdd3545e5fe0a39b Author: ChenXiaoSong Date: Thu Aug 22 08:20:50 2024 +0000 smb/server: fix return value of smb2_open() In most error cases, error code is not returned in smb2_open(), __process_request() will not print error message. Fix this by returning the correct value at the end of smb2_open(). Signed-off-by: ChenXiaoSong Acked-by: Namjae Jeon Signed-off-by: Steve French fs/smb/server/smb2pdu.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit ce61b605a00502c59311d0a4b1f58d62b48272d0 Author: Namjae Jeon Date: Tue Aug 20 22:07:38 2024 +0900 ksmbd: the buffer of smb2 query dir response has at least 1 byte When STATUS_NO_MORE_FILES status is set to smb2 query dir response, ->StructureSize is set to 9, which mean buffer has 1 byte. This issue occurs because ->Buffer[1] in smb2_query_directory_rsp to flex-array. Fixes: eb3e28c1e89b ("smb3: Replace smb2pdu 1-element arrays with flex-arrays") Cc: stable@vger.kernel.org # v6.1+ Signed-off-by: Namjae Jeon Signed-off-by: Steve French fs/smb/server/smb2pdu.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) commit a592cdf5164d3feb821085df71f63e70e8b8b08c Author: Kent Overstreet Date: Mon Aug 19 16:41:00 2024 -0400 bcachefs: don't use rht_bucket() in btree_key_cache_scan() rht_bucket() does strange complicated things when a rehash is in progress. Instead, just skip scanning when a rehash is in progress: scanning is going to be more expensive (many more empty slots to cover), and some sort of infinite loop is being observed Signed-off-by: Kent Overstreet fs/bcachefs/btree_key_cache.c | 30 +++++++++++++++++++++++++++--- 1 file changed, 27 insertions(+), 3 deletions(-) commit 3e878fe5a0b139838a65f50a3df3caf3299dbc24 Author: Kent Overstreet Date: Thu Aug 22 03:57:39 2024 -0400 bcachefs: add missing inode_walker_exit() fix a small leak Signed-off-by: Kent Overstreet fs/bcachefs/fsck.c | 2 ++ 1 file changed, 2 insertions(+) commit a812a3f45cae787abe29567749a0acc879d2df37 Merge: af688a99eb1f 46097a926624 Author: Paolo Abeni Date: Thu Aug 22 15:24:07 2024 +0200 Merge branch 'maintainers-networking-updates' Simon Horman says: ==================== MAINTAINERS: Networking updates This series includes Networking-related updates to MAINTAINERS. * Patches 1-4 aim to assign header files with "*net*' and '*skbuff*' in their name to Networking-related sections within Maintainers. There are a few such files left over after this patches. I have to sent separate patches to add them to SCSI SUBSYSTEM and NETWORKING DRIVERS (WIRELESS) sections [1][2]. [1] https://lore.kernel.org/linux-scsi/20240816-scsi-mnt-v1-1-439af8b1c28b@kernel.org/ [2] https://lore.kernel.org/linux-wireless/20240816-wifi-mnt-v1-1-3fb3bf5d44aa@kernel.org/ * Patch 5 updates the status of the JME driver to 'Odd Fixes' ==================== Link: https://patch.msgid.link/20240821-net-mnt-v2-0-59a5af38e69d@kernel.org Signed-off-by: Paolo Abeni commit 46097a92662496394628cb41138e681d6074cce7 Author: Simon Horman Date: Wed Aug 21 09:46:48 2024 +0100 MAINTAINERS: Mark JME Network Driver as Odd Fixes This driver only appears to have received sporadic clean-ups, typically part of some tree-wide activity, and fixes for quite some time. And according to the maintainer, Guo-Fu Tseng, the device has been EOLed for a long time (see Link). Accordingly, it seems appropriate to mark this driver as odd fixes. Cc: Moon Yeounsu Cc: Guo-Fu Tseng Link: https://lore.kernel.org/netdev/20240805003139.M94125@cooldavid.org/ Signed-off-by: Simon Horman Signed-off-by: Paolo Abeni MAINTAINERS | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit f2d20c9b97f0df64841b89fa1ad3e9c92f7377ae Author: Simon Horman Date: Wed Aug 21 09:46:47 2024 +0100 MAINTAINERS: Add header files to NETWORKING sections This is part of an effort to assign a section in MAINTAINERS to header files that relate to Networking. In this case the files with "net" or "skbuff" in their name. This patch adds a number of such files to the NETWORKING DRIVERS and NETWORKING [GENERAL] sections. Signed-off-by: Simon Horman Signed-off-by: Paolo Abeni MAINTAINERS | 17 +++++++++++++++++ 1 file changed, 17 insertions(+) commit 8cb0a938d90b25f123fcb2e24bbda9eaabd79c9e Author: Simon Horman Date: Wed Aug 21 09:46:46 2024 +0100 MAINTAINERS: Add limited globs for Networking headers This aims to add limited globs to improve the coverage of header files in the NETWORKING DRIVERS and NETWORKING [GENERAL] sections. It is done so in a minimal way to exclude overlap with other sections. And so as not to require "X" entries to exclude files otherwise matched by these new globs. While imperfect, due to it's limited nature, this does extend coverage of header files by these sections. And aims to automatically cover new files that seem very likely belong to these sections. The include/linux/netdev* glob (both sections) + Subsumes the entries for: - include/linux/netdevice.h + Extends the sections to cover - include/linux/netdevice_xmit.h - include/linux/netdev_features.h The include/uapi/linux/netdev* globs: (both sections) + Subsumes the entries for: - include/linux/netdevice.h + Extends the sections to cover - include/linux/netdev.h The include/linux/skbuff* glob (NETWORKING [GENERAL] section only): + Subsumes the entry for: - include/linux/skbuff.h + Extends the section to cover - include/linux/skbuff_ref.h A include/uapi/linux/net_* glob was not added to the NETWORKING [GENERAL] section. Although it would subsume the entry for include/uapi/linux/net_namespace.h, which is fine, it would also extend coverage to: - include/uapi/linux/net_dropmon.h, which belongs to the NETWORK DROP MONITOR section - include/uapi/linux/net_tstamp.h which, as per an earlier patch in this series, belongs to the SOCKET TIMESTAMPING section Signed-off-by: Simon Horman Signed-off-by: Paolo Abeni MAINTAINERS | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) commit eb208fecd77d898709c25af680487289fd5f3e16 Author: Simon Horman Date: Wed Aug 21 09:46:45 2024 +0100 MAINTAINERS: Add net_tstamp.h to SOCKET TIMESTAMPING section This is part of an effort to assign a section in MAINTAINERS to header files that relate to Networking. In this case the files with "net" in their name. Cc: Richard Cochran Cc: Willem de Bruijn Signed-off-by: Simon Horman Acked-by: Willem de Bruijn Signed-off-by: Paolo Abeni MAINTAINERS | 1 + 1 file changed, 1 insertion(+) commit 1ac66c4960e1c735eb6edfd3e6d52bebb2aa347e Author: Simon Horman Date: Wed Aug 21 09:46:44 2024 +0100 MAINTAINERS: Add sonet.h to ATM section of MAINTAINERS This is part of an effort to assign a section in MAINTAINERS to header files that relate to Networking. In this case the files with "net" in their name. It seems that sonet.h is included in ATM related source files, and thus that ATM is the most relevant section for these files. Cc: Chas Williams <3chas3@gmail.com> Signed-off-by: Simon Horman Signed-off-by: Paolo Abeni MAINTAINERS | 2 ++ 1 file changed, 2 insertions(+) commit 3b1f7a46977fe2ff9384d08651a6e0d272ae6a60 Author: Christophe Leroy Date: Thu Aug 22 09:58:42 2024 +0200 powerpc/mm: Fix return type of pgd_val() Commit 6b0e82791bd0 ("powerpc/e500: switch to 64 bits PGD on 85xx (32 bits)") switched PGD entries to 64 bits, but pgd_val() returns an unsigned long which is 32 bits on PPC32. This is not a problem for regular PMD entries because the upper part is always NULL, but when PMD entries are leaf they contain 64 bits values, so pgd_val() must return an unsigned long long instead of an unsigned long. Also change the condition to CONFIG_PPC_85xx instead of CONFIG_PPC_E500 as the change was meant for 32 bits only. Allthough this should be harmless on PPC64, it generates a warning with pgd_ERROR print. Fixes: 6b0e82791bd0 ("powerpc/e500: switch to 64 bits PGD on 85xx (32 bits)") Signed-off-by: Christophe Leroy Signed-off-by: Michael Ellerman Link: https://msgid.link/45f8fdf298ec3df7573b66d21b03a5cda92e2cb1.1724313510.git.christophe.leroy@csgroup.eu arch/powerpc/include/asm/nohash/32/pgtable.h | 4 ++-- arch/powerpc/include/asm/pgtable-types.h | 12 +++++++++--- 2 files changed, 11 insertions(+), 5 deletions(-) commit 6114139c3bdde992f4a19264e4f9bfc100d8d776 Author: Christophe Leroy Date: Tue Aug 20 13:28:07 2024 +0200 powerpc/vdso: Don't discard rela sections After building the VDSO, there is a verification that it contains no dynamic relocation, see commit aff69273af61 ("vdso: Improve cmd_vdso_check to check all dynamic relocations"). This verification uses readelf -r and doesn't work if rela sections are discarded. Fixes: 8ad57add77d3 ("powerpc/build: vdso linker warning for orphan sections") Signed-off-by: Christophe Leroy Signed-off-by: Michael Ellerman Link: https://msgid.link/45c3e6fc76cad05ad2cac0f5b5dfb4fae86dc9d6.1724153239.git.christophe.leroy@csgroup.eu arch/powerpc/kernel/vdso/vdso32.lds.S | 4 +++- arch/powerpc/kernel/vdso/vdso64.lds.S | 4 ++-- 2 files changed, 5 insertions(+), 3 deletions(-) commit d92b5cc29c792f1d3f0aaa3b29dddfe816c03e88 Author: Christophe Leroy Date: Tue Aug 20 14:42:38 2024 +0200 powerpc/64e: Define mmu_pte_psize static mmu_pte_psize is only used in the tlb_64e.c, define it static. Fixes: 25d21ad6e799 ("powerpc: Add TLB management code for 64-bit Book3E") Reported-by: kernel test robot Closes: https://lore.kernel.org/oe-kbuild-all/202408011256.1O99IB0s-lkp@intel.com/ Signed-off-by: Christophe Leroy Signed-off-by: Michael Ellerman Link: https://msgid.link/beb30d280eaa5d857c38a0834b147dffd6b28aa9.1724157750.git.christophe.leroy@csgroup.eu arch/powerpc/mm/nohash/tlb_64e.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit bff980d8d9ca537fd5f3c0e9a99876c1e3713e81 Author: Richard Fitzgerald Date: Thu Aug 22 12:57:25 2024 +0100 ASoC: cs-amp-lib-test: Force test calibration blob entries to be valid For a normal calibration blob the calTarget values must be non-zero and unique, and the calTime values must be non-zero. Don't rely on get_random_bytes() to be random enough to guarantee this. Force the calTarget and calTime values to be valid while retaining randomness in the values. Signed-off-by: Richard Fitzgerald Fixes: 177862317a98 ("ASoC: cs-amp-lib: Add KUnit test for calibration helpers") Link: https://patch.msgid.link/20240822115725.259568-1-rf@opensource.cirrus.com Signed-off-by: Mark Brown sound/soc/codecs/cs-amp-lib-test.c | 9 +++++++++ 1 file changed, 9 insertions(+) commit e17465f78eb92ebb4be17e35d6c0584406f643a0 Author: Andy Shevchenko Date: Thu Aug 22 14:30:54 2024 +0300 spi: pxa2xx: Move PM runtime handling to the glue drivers PCI and platform buses have different defaults for runtime PM. In particular PCI probe is assumed to be called when PM runtime is enabled by the PCI core. In this case if we try enable it again the PM runtime complaints with pxa2xx_spi_pci 0000:00:07.0: Unbalanced pm_runtime_enable! Fix this by moving PM runtime handling from the SPI PXA2xx core to the glue drivers. Fixes: cc160697a576 ("spi: pxa2xx: Convert PCI driver to use spi-pxa2xx code directly") Fixes: 3d8f037fbcab ("spi: pxa2xx: Move platform driver to a separate file") Fixes: 20ade9b9771c ("spi: pxa2xx: Extract pxa2xx_spi_platform_*() callbacks") Signed-off-by: Andy Shevchenko Link: https://patch.msgid.link/20240822113408.750831-3-andriy.shevchenko@linux.intel.com Signed-off-by: Mark Brown drivers/spi/spi-pxa2xx-pci.c | 15 ++++++++++++++- drivers/spi/spi-pxa2xx-platform.c | 22 ++++++++++++++++++++-- drivers/spi/spi-pxa2xx.c | 15 +-------------- 3 files changed, 35 insertions(+), 17 deletions(-) commit 9a8fc292dd93b93db30e01c94c0da4c944852f28 Author: Andy Shevchenko Date: Thu Aug 22 14:30:53 2024 +0300 spi: pxa2xx: Do not override dev->platform_data on probe The platform_data field may be supplied by legacy board code. In other cases we override it, and module remove and probe cycle will crash the kernel since it will carry a stale pointer. Fix this by supplying a third argument to the pxa2xx_spi_probe() and avoid overriding dev->platform_data. Reported-by: Hao Ma Fixes: cc160697a576 ("spi: pxa2xx: Convert PCI driver to use spi-pxa2xx code directly") Fixes: 3d8f037fbcab ("spi: pxa2xx: Move platform driver to a separate file") Fixes: 20ade9b9771c ("spi: pxa2xx: Extract pxa2xx_spi_platform_*() callbacks") Signed-off-by: Andy Shevchenko Link: https://patch.msgid.link/20240822113408.750831-2-andriy.shevchenko@linux.intel.com Signed-off-by: Mark Brown drivers/spi/spi-pxa2xx-pci.c | 2 +- drivers/spi/spi-pxa2xx-platform.c | 6 ++---- drivers/spi/spi-pxa2xx.c | 5 ++--- drivers/spi/spi-pxa2xx.h | 3 ++- 4 files changed, 7 insertions(+), 9 deletions(-) commit 9abf199943a6469a71f6ce5c2266e9364d310f8b Author: Baochen Qiang Date: Tue Aug 13 16:38:08 2024 +0800 wifi: ath11k: fix NULL pointer dereference in ath11k_mac_get_eirp_power() Commit 39dc8b8ea387 ("wifi: mac80211: pass parsed TPE data to drivers") breaks ath11k, leading to kernel crash: BUG: kernel NULL pointer dereference, address: 0000000000000018 RIP: 0010:ath11k_mac_get_eirp_power.isra.0+0x5b/0x80 [ath11k] Call Trace: ath11k_mac_fill_reg_tpc_info+0x3d6/0x800 [ath11k] ath11k_mac_vdev_start_restart+0x412/0x4d0 [ath11k] ath11k_mac_op_sta_state+0x7bc/0xbb0 [ath11k] drv_sta_state+0xf1/0x5f0 [mac80211] sta_info_insert_rcu+0x28d/0x530 [mac80211] sta_info_insert+0xf/0x20 [mac80211] ieee80211_prep_connection+0x3b4/0x4c0 [mac80211] ieee80211_mgd_auth+0x363/0x600 [mac80211] The issue scenario is, AP advertises power spectral density (PSD) values in its transmit power envelope (TPE) IE and supports 160 MHz bandwidth in 6 GHz. When connecting to this AP, in ath11k_mac_parse_tx_pwr_env(), the local variable psd is true and then reg_tpc_info.num_pwr_levels is set to 8 due to 160 MHz bandwidth. Note here ath11k fails to set reg_tpc_info.is_psd_power as TRUE due to above commit. Then in ath11k_mac_fill_reg_tpc_info(), for each of the 8 power levels, for a PSD channel, ath11k_mac_get_psd_channel() is expected to be called to get required information. However due to invalid reg_tpc_info.is_psd_power, it is ath11k_mac_get_eirp_power() that gets called and passed with pwr_lvl_idx as one of the arguments. Note this function implicitly requires pwr_lvl_idx to be no more than 3. So when pwr_lvl_idx is larger than that ath11k_mac_get_seg_freq() returns invalid center frequency, with which as the input ieee80211_get_channel() returns NULL, then kernel crashes due to NULL pointer dereference. Fix it by setting reg_tpc_info.is_psd_power properly. Tested-on: WCN6855 hw2.0 PCI WLAN.HSP.1.1-03125-QCAHSPSWPL_V1_V2_SILICONZ_LITE-3.6510.30 Fixes: 39dc8b8ea387 ("wifi: mac80211: pass parsed TPE data to drivers") Reported-by: Mikko Tiihonen Tested-by: Mikko Tiihonen Closes: https://bugzilla.kernel.org/show_bug.cgi?id=219131 Signed-off-by: Baochen Qiang Acked-by: Jeff Johnson Signed-off-by: Kalle Valo Link: https://patch.msgid.link/20240813083808.9224-1-quic_bqiang@quicinc.com drivers/net/wireless/ath/ath11k/mac.c | 1 + 1 file changed, 1 insertion(+) commit af688a99eb1fc7ef69774665d61e6be51cea627a Author: Bharat Bhushan Date: Wed Aug 21 12:35:58 2024 +0530 octeontx2-af: Fix CPT AF register offset calculation Some CPT AF registers are per LF and others are global. Translation of PF/VF local LF slot number to actual LF slot number is required only for accessing perf LF registers. CPT AF global registers access do not require any LF slot number. Also, there is no reason CPT PF/VF to know actual lf's register offset. Without this fix microcode loading will fail, VFs cannot be created and hardware is not usable. Fixes: bc35e28af789 ("octeontx2-af: replace cpt slot with lf id on reg write") Signed-off-by: Bharat Bhushan Reviewed-by: Simon Horman Link: https://patch.msgid.link/20240821070558.1020101-1-bbhushan2@marvell.com Signed-off-by: Paolo Abeni .../net/ethernet/marvell/octeontx2/af/rvu_cpt.c | 23 +++++++++++----------- 1 file changed, 11 insertions(+), 12 deletions(-) commit a2f5c505b4378cd6fc7c4a44ff3665ccef2037db Author: Sava Jakovljev Date: Wed Aug 21 04:16:57 2024 +0200 net: phy: realtek: Fix setting of PHY LEDs Mode B bit on RTL8211F The current implementation incorrectly sets the mode bit of the PHY chip. Bit 15 (RTL8211F_LEDCR_MODE) should not be shifted together with the configuration nibble of a LED- it should be set independently of the index of the LED being configured. As a consequence, the RTL8211F LED control is actually operating in Mode A. Fix the error by or-ing final register value to write with a const-value of RTL8211F_LEDCR_MODE, thus setting Mode bit explicitly. Fixes: 17784801d888 ("net: phy: realtek: Add support for PHY LEDs on RTL8211F") Signed-off-by: Sava Jakovljev Reviewed-by: Marek Vasut Link: https://patch.msgid.link/PAWP192MB21287372F30C4E55B6DF6158C38E2@PAWP192MB2128.EURP192.PROD.OUTLOOK.COM Signed-off-by: Paolo Abeni drivers/net/phy/realtek.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) commit f2916c83d746eb99f50f42c15cf4c47c2ea5f3b3 Author: Mengyuan Lou Date: Tue Aug 20 11:04:25 2024 +0800 net: ngbe: Fix phy mode set to external phy The MAC only has add the TX delay and it can not be modified. MAC and PHY are both set the TX delay cause transmission problems. So just disable TX delay in PHY, when use rgmii to attach to external phy, set PHY_INTERFACE_MODE_RGMII_RXID to phy drivers. And it is does not matter to internal phy. Fixes: bc2426d74aa3 ("net: ngbe: convert phylib to phylink") Signed-off-by: Mengyuan Lou Cc: stable@vger.kernel.org # 6.3+ Reviewed-by: Jacob Keller Link: https://patch.msgid.link/E6759CF1387CF84C+20240820030425.93003-1-mengyuanlou@net-swift.com Signed-off-by: Paolo Abeni drivers/net/ethernet/wangxun/ngbe/ngbe_mdio.c | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) commit 1fa7b099d60ad64f559bd3b8e3f0d94b2e015514 Author: Kailang Yang Date: Thu Aug 22 16:46:56 2024 +0800 ALSA: hda/realtek - FIxed ALC285 headphone no sound Dell platform with ALC215 ALC285 ALC289 ALC225 ALC295 ALC299, plug headphone or headset. It had a chance to get no sound from headphone. Replace depop procedure will solve this issue. Signed-off-by: Kailang Yang Link: https://lore.kernel.org/d0de1b03fd174520945dde216d765223@realtek.com Signed-off-by: Takashi Iwai sound/pci/hda/patch_realtek.c | 26 ++++++++++++++------------ 1 file changed, 14 insertions(+), 12 deletions(-) commit 6ea14ccb60c8ab829349979b22b58a941ec4a3ee Author: Pablo Neira Ayuso Date: Tue Aug 13 12:39:46 2024 +0200 netfilter: flowtable: validate vlan header Ensure there is sufficient room to access the protocol field of the VLAN header, validate it once before the flowtable lookup. ===================================================== BUG: KMSAN: uninit-value in nf_flow_offload_inet_hook+0x45a/0x5f0 net/netfilter/nf_flow_table_inet.c:32 nf_flow_offload_inet_hook+0x45a/0x5f0 net/netfilter/nf_flow_table_inet.c:32 nf_hook_entry_hookfn include/linux/netfilter.h:154 [inline] nf_hook_slow+0xf4/0x400 net/netfilter/core.c:626 nf_hook_ingress include/linux/netfilter_netdev.h:34 [inline] nf_ingress net/core/dev.c:5440 [inline] Fixes: 4cd91f7c290f ("netfilter: flowtable: add vlan support") Reported-by: syzbot+8407d9bb88cd4c6bf61a@syzkaller.appspotmail.com Signed-off-by: Pablo Neira Ayuso net/netfilter/nf_flow_table_inet.c | 3 +++ net/netfilter/nf_flow_table_ip.c | 3 +++ 2 files changed, 6 insertions(+) commit cd4897bfd14f6a5388b21ba45a066541a0425199 Author: Krzysztof Kozlowski Date: Wed Aug 14 11:39:57 2024 +0200 usb: dwc3: st: add missing depopulate in probe error path Depopulate device in probe error paths to fix leak of children resources. Fixes: f83fca0707c6 ("usb: dwc3: add ST dwc3 glue layer to manage dwc3 HC") Cc: stable@vger.kernel.org Signed-off-by: Krzysztof Kozlowski Reviewed-by: Patrice Chotard Acked-by: Thinh Nguyen Link: https://lore.kernel.org/r/20240814093957.37940-2-krzysztof.kozlowski@linaro.org Signed-off-by: Greg Kroah-Hartman drivers/usb/dwc3/dwc3-st.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) commit ddfcfeba891064b88bb844208b43bef2ef970f0c Author: Krzysztof Kozlowski Date: Wed Aug 14 11:39:56 2024 +0200 usb: dwc3: st: fix probed platform device ref count on probe error path The probe function never performs any paltform device allocation, thus error path "undo_platform_dev_alloc" is entirely bogus. It drops the reference count from the platform device being probed. If error path is triggered, this will lead to unbalanced device reference counts and premature release of device resources, thus possible use-after-free when releasing remaining devm-managed resources. Fixes: f83fca0707c6 ("usb: dwc3: add ST dwc3 glue layer to manage dwc3 HC") Cc: stable@vger.kernel.org Signed-off-by: Krzysztof Kozlowski Acked-by: Thinh Nguyen Reviewed-by: Patrice Chotard Link: https://lore.kernel.org/r/20240814093957.37940-1-krzysztof.kozlowski@linaro.org Signed-off-by: Greg Kroah-Hartman drivers/usb/dwc3/dwc3-st.c | 11 +++-------- 1 file changed, 3 insertions(+), 8 deletions(-) commit 72fca8371f205d654f95b09cd023a71fd5307041 Author: Michael Grzeschik Date: Thu Aug 15 08:40:29 2024 +0200 usb: dwc3: ep0: Don't reset resource alloc flag (including ep0) The DWC3_EP_RESOURCE_ALLOCATED flag ensures that the resource of an endpoint is only assigned once. Unless the endpoint is reset, don't clear this flag. Otherwise we may set endpoint resource again, which prevents the driver from initiate transfer after handling a STALL or endpoint halt to the control endpoint. Commit f2e0eee47038 ("usb: dwc3: ep0: Don't reset resource alloc flag") was fixing the initial issue, but did this only for physical ep1. Since the function dwc3_ep0_stall_and_restart is resetting the flags for both physical endpoints, this also has to be done for ep0. Cc: stable@vger.kernel.org Fixes: b311048c174d ("usb: dwc3: gadget: Rewrite endpoint allocation flow") Acked-by: Thinh Nguyen Signed-off-by: Michael Grzeschik Link: https://lore.kernel.org/r/20240814-dwc3hwep0reset-v2-1-29e1d7d923ea@pengutronix.de Signed-off-by: Greg Kroah-Hartman drivers/usb/dwc3/ep0.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) commit 3a8839bbb86da7968a792123ed2296d063871a52 Author: Zijun Hu Date: Tue Aug 20 19:01:27 2024 +0800 usb: core: sysfs: Unmerge @usb3_hardware_lpm_attr_group in remove_power_attributes() Device attribute group @usb3_hardware_lpm_attr_group is merged by add_power_attributes(), but it is not unmerged explicitly, fixed by unmerging it in remove_power_attributes(). Fixes: 655fe4effe0f ("usbcore: add sysfs support to xHCI usb3 hardware LPM") Cc: stable@vger.kernel.org Signed-off-by: Zijun Hu Link: https://lore.kernel.org/r/20240820-sysfs_fix-v2-1-a9441487077e@quicinc.com Signed-off-by: Greg Kroah-Hartman drivers/usb/core/sysfs.c | 1 + 1 file changed, 1 insertion(+) commit 4f83cae0edb2b13aabb82e8a4852092844d320aa Author: Luca Weiss Date: Sun Aug 18 22:21:01 2024 +0200 usb: typec: fsa4480: Relax CHIP_ID check Some FSA4480-compatible chips like the OCP96011 used on Fairphone 5 return 0x00 from the CHIP_ID register. Handle that gracefully and only fail probe when the I2C read has failed. With this the dev_dbg will print 0 but otherwise continue working. [ 0.251581] fsa4480 1-0042: Found FSA4480 v0.0 (Vendor ID = 0) Cc: stable@vger.kernel.org Fixes: e885f5f1f2b4 ("usb: typec: fsa4480: Check if the chip is really there") Signed-off-by: Luca Weiss Reviewed-by: Heikki Krogerus Reviewed-by: Neil Armstrong Link: https://lore.kernel.org/r/20240818-fsa4480-chipid-fix-v1-1-17c239435cf7@fairphone.com Signed-off-by: Greg Kroah-Hartman drivers/usb/typec/mux/fsa4480.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 16f2a21d9d7e48e1af02654fe3d926c0ce6cb3e5 Author: Krzysztof Kozlowski Date: Fri Aug 16 09:54:09 2024 +0200 usb: dwc3: xilinx: add missing depopulate in probe error path Depopulate device in probe error paths to fix leak of children resources. Fixes: 53b5ff83d893 ("usb: dwc3: xilinx: improve error handling for PM APIs") Cc: stable@vger.kernel.org Reviewed-by: Radhey Shyam Pandey Signed-off-by: Krzysztof Kozlowski Acked-by: Thinh Nguyen Link: https://lore.kernel.org/r/20240816075409.23080-2-krzysztof.kozlowski@linaro.org Signed-off-by: Greg Kroah-Hartman drivers/usb/dwc3/dwc3-xilinx.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) commit 2aa765a43817ec8add990f83c8e54a9a5d87aa9c Author: Krzysztof Kozlowski Date: Fri Aug 16 09:54:08 2024 +0200 usb: dwc3: omap: add missing depopulate in probe error path Depopulate device in probe error paths to fix leak of children resources. Fixes: ee249b455494 ("usb: dwc3: omap: remove IRQ_NOAUTOEN used with shared irq") Cc: stable@vger.kernel.org Acked-by: Thinh Nguyen Signed-off-by: Krzysztof Kozlowski Reviewed-by: Radhey Shyam Pandey Link: https://lore.kernel.org/r/20240816075409.23080-1-krzysztof.kozlowski@linaro.org Signed-off-by: Greg Kroah-Hartman drivers/usb/dwc3/dwc3-omap.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) commit 5b235693ed2a1e4963625717a1598becf97759cc Author: Alexander Stein Date: Thu Aug 15 13:31:31 2024 +0200 dt-bindings: usb: microchip,usb2514: Fix reference USB device schema An USB hub is not a HCD, but an USB device. Fix the referenced schema accordingly. Fixes: bfbf2e4b77e2 ("dt-bindings: usb: Document the Microchip USB2514 hub") Cc: stable@vger.kernel.org Reviewed-by: Krzysztof Kozlowski Signed-off-by: Alexander Stein Link: https://lore.kernel.org/r/20240815113132.372542-1-alexander.stein@ew.tq-group.com Signed-off-by: Greg Kroah-Hartman Documentation/devicetree/bindings/usb/microchip,usb2514.yaml | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-) commit b52a07e07dead777517af3cbda851bb2cc157c9d Author: Xu Yang Date: Wed Aug 14 19:25:37 2024 +0800 usb: gadget: uvc: queue pump work in uvcg_video_enable() Since commit "6acba0345b68 usb:gadget:uvc Do not use worker thread to pump isoc usb requests", pump work could only be queued in uvc_video_complete() and uvc_v4l2_qbuf(). If VIDIOC_QBUF is executed before VIDIOC_STREAMON, we can only depend on uvc_video_complete() to queue pump work. However, this requires some free requests in req_ready list. If req_ready list is empty all the time, pump work will never be queued and video datas will never be pumped to usb controller. Actually, this situation could happen when run uvc-gadget with static image: $ ./uvc-gadget -i 1080p.jpg uvc.0 When capture image from this device, the user app will always block there. The issue is uvc driver has queued video buffer before streamon, but the req_ready list is empty all the time after streamon. This will queue pump work in uvcg_video_enable() to fill some request to req_ready list so the uvc device could work properly. Fixes: 6acba0345b68 ("usb:gadget:uvc Do not use worker thread to pump isoc usb requests") Cc: stable@vger.kernel.org Signed-off-by: Xu Yang Link: https://lore.kernel.org/r/20240814112537.2608949-1-xu.yang_2@nxp.com Signed-off-by: Greg Kroah-Hartman drivers/usb/gadget/function/uvc_video.c | 1 + 1 file changed, 1 insertion(+) commit 0b00583ecacb0b51712a5ecd34cf7e6684307c67 Author: Ian Ray Date: Wed Aug 14 10:29:05 2024 +0300 cdc-acm: Add DISABLE_ECHO quirk for GE HealthCare UI Controller USB_DEVICE(0x1901, 0x0006) may send data before cdc_acm is ready, which may be misinterpreted in the default N_TTY line discipline. Signed-off-by: Ian Ray Acked-by: Oliver Neuku Cc: stable Link: https://lore.kernel.org/r/20240814072905.2501-1-ian.ray@gehealthcare.com Signed-off-by: Greg Kroah-Hartman drivers/usb/class/cdc-acm.c | 3 +++ 1 file changed, 3 insertions(+) commit 0497a356d3c498221eb0c1edc1e8985816092f12 Author: Pawel Laszczak Date: Tue Aug 20 08:21:19 2024 +0000 usb: cdnsp: fix incorrect index in cdnsp_get_hw_deq function Patch fixes the incorrect "stream_id" table index instead of "ep_index" used in cdnsp_get_hw_deq function. Fixes: 3d82904559f4 ("usb: cdnsp: cdns3 Add main part of Cadence USBSSP DRD Driver") cc: stable@vger.kernel.org Signed-off-by: Pawel Laszczak Reviewed-by: Peter Chen Link: https://lore.kernel.org/r/PH7PR07MB95381F2182688811D5C711CEDD8D2@PH7PR07MB9538.namprd07.prod.outlook.com Signed-off-by: Greg Kroah-Hartman drivers/usb/cdns3/cdnsp-ring.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 14e497183df28c006603cc67fd3797a537eef7b9 Author: Selvarasu Ganesan Date: Thu Aug 15 12:18:31 2024 +0530 usb: dwc3: core: Prevent USB core invalid event buffer address access This commit addresses an issue where the USB core could access an invalid event buffer address during runtime suspend, potentially causing SMMU faults and other memory issues in Exynos platforms. The problem arises from the following sequence. 1. In dwc3_gadget_suspend, there is a chance of a timeout when moving the USB core to the halt state after clearing the run/stop bit by software. 2. In dwc3_core_exit, the event buffer is cleared regardless of the USB core's status, which may lead to an SMMU faults and other memory issues. if the USB core tries to access the event buffer address. To prevent this hardware quirk on Exynos platforms, this commit ensures that the event buffer address is not cleared by software when the USB core is active during runtime suspend by checking its status before clearing the buffer address. Cc: stable Signed-off-by: Selvarasu Ganesan Acked-by: Thinh Nguyen Link: https://lore.kernel.org/r/20240815064836.1491-1-selvarasu.g@samsung.com Signed-off-by: Greg Kroah-Hartman drivers/usb/dwc3/core.c | 8 ++++++++ 1 file changed, 8 insertions(+) commit 3e6245ebe7ef341639e9a7e402b3ade8ad45a19f Author: Marc Zyngier Date: Tue Aug 20 11:03:38 2024 +0100 KVM: arm64: Make ICC_*SGI*_EL1 undef in the absence of a vGICv3 On a system with a GICv3, if a guest hasn't been configured with GICv3 and that the host is not capable of GICv2 emulation, a write to any of the ICC_*SGI*_EL1 registers is trapped to EL2. We therefore try to emulate the SGI access, only to hit a NULL pointer as no private interrupt is allocated (no GIC, remember?). The obvious fix is to give the guest what it deserves, in the shape of a UNDEF exception. Reported-by: Alexander Potapenko Signed-off-by: Marc Zyngier Cc: stable@vger.kernel.org Link: https://lore.kernel.org/r/20240820100349.3544850-2-maz@kernel.org Signed-off-by: Oliver Upton arch/arm64/kvm/sys_regs.c | 6 ++++++ arch/arm64/kvm/vgic/vgic.h | 7 +++++++ 2 files changed, 13 insertions(+) commit 6e95097b6bb20f0021180b150f41ad9962dcdcc9 Author: Laurent Pinchart Date: Tue Aug 13 13:44:47 2024 +0300 MAINTAINERS: Mark UVC gadget driver as orphan I haven't had time to maintain the UVC gadget driver for a long while. Dan Scally confirmed he is also in a similar -ENOTIME situation with no short term hope of fixing that. Being listed as maintainers doesn't help progress, so mark the driver as orphan to reflect the current state. Signed-off-by: Laurent Pinchart Acked-by: Daniel Scally Link: https://lore.kernel.org/r/20240813104447.25821-1-laurent.pinchart@ideasonboard.com Signed-off-by: Greg Kroah-Hartman MAINTAINERS | 4 +--- 1 file changed, 1 insertion(+), 3 deletions(-) commit 7dd9c26bd6cf679bcfdef01a8659791aa6487a29 Author: Simon Arlott Date: Thu Aug 22 08:25:07 2024 +0100 can: mcp251x: fix deadlock if an interrupt occurs during mcp251x_open The mcp251x_hw_wake() function is called with the mpc_lock mutex held and disables the interrupt handler so that no interrupts can be processed while waking the device. If an interrupt has already occurred then waiting for the interrupt handler to complete will deadlock because it will be trying to acquire the same mutex. CPU0 CPU1 ---- ---- mcp251x_open() mutex_lock(&priv->mcp_lock) request_threaded_irq() mcp251x_can_ist() mutex_lock(&priv->mcp_lock) mcp251x_hw_wake() disable_irq() <-- deadlock Use disable_irq_nosync() instead because the interrupt handler does everything while holding the mutex so it doesn't matter if it's still running. Fixes: 8ce8c0abcba3 ("can: mcp251x: only reset hardware as required") Signed-off-by: Simon Arlott Reviewed-by: Przemek Kitszel Cc: stable@vger.kernel.org Link: https://lore.kernel.org/all/4fc08687-1d80-43fe-9f0d-8ef8475e75f6@0882a8b5-c6c3-11e9-b005-00805fc181fe.uuid.home.arpa Signed-off-by: Marc Kleine-Budde drivers/net/can/spi/mcp251x.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 1d8c3c23a6bc1527e253b305b4b68c03d833b824 Author: Oliver Upton Date: Thu Aug 22 07:17:09 2024 +0000 KVM: arm64: Ensure canonical IPA is hugepage-aligned when handling fault Zenghui reports that VMs backed by hugetlb pages are no longer booting after commit fd276e71d1e7 ("KVM: arm64: nv: Handle shadow stage 2 page faults"). Support for shadow stage-2 MMUs introduced the concept of a fault IPA and canonical IPA to stage-2 fault handling. These are identical in the non-nested case, as the hardware stage-2 context is always that of the canonical IPA space. Both addresses need to be hugepage-aligned when preparing to install a hugepage mapping to ensure that KVM uses the correct GFN->PFN translation and installs that at the correct IPA for the current stage-2. And now I'm feeling thirsty after all this talk of IPAs... Fixes: fd276e71d1e7 ("KVM: arm64: nv: Handle shadow stage 2 page faults") Reported-by: Zenghui Yu Reviewed-by: Marc Zyngier Link: https://lore.kernel.org/r/20240822071710.2291690-1-oliver.upton@linux.dev Signed-off-by: Oliver Upton arch/arm64/kvm/mmu.c | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-) commit 9b82ff1362f50914c8292902e07be98a9f59d33d Author: Kailang Yang Date: Thu Aug 22 10:54:19 2024 +0800 ALSA: hda/realtek - Fixed ALC256 headphone no sound Dell platform, plug headphone or headset, it had a chance to get no sound from headphone. Replace depop procedure will solve this issue. Signed-off-by: Kailang Yang Link: https://lore.kernel.org/bb8e2de30d294dc287944efa0667685a@realtek.com Signed-off-by: Takashi Iwai sound/pci/hda/patch_realtek.c | 50 ++++++++++++++++++++++++++++++++----------- 1 file changed, 37 insertions(+), 13 deletions(-) commit 87313ac1f134d6ee1e7c858da8bdea9147b537a9 Author: Kent Overstreet Date: Thu Aug 22 02:13:02 2024 -0400 bcachefs: clear path->should_be_locked in bch2_btree_key_cache_drop() bch2_btree_key_cache_drop() evicts the key cache entry - it's used when we're doing an update that bypasses the key cache, because for cache coherency reasons a key can't be in the key cache unless it also exists in the btree - i.e. creates have to bypass the cache. After evicting, the path no longer points to a key cache key, and relock() will always fail if should_be_locked is true. Prep for improving path->should_be_locked assertions Signed-off-by: Kent Overstreet fs/bcachefs/btree_key_cache.c | 1 + 1 file changed, 1 insertion(+) commit dedb2fe37574857c84e9598b9f5272505dedf7af Author: Yuesong Li Date: Thu Aug 22 14:21:58 2024 +0800 bcachefs: Fix double assignment in check_dirent_to_subvol() ret was assigned twice in check_dirent_to_subvol(). Reported by cocci. Signed-off-by: Yuesong Li Signed-off-by: Kent Overstreet fs/bcachefs/fsck.c | 1 - 1 file changed, 1 deletion(-) commit 0b50b7313ef2494926df30ce8e2ce284f1b847fc Author: Kent Overstreet Date: Wed Aug 21 23:21:52 2024 -0400 bcachefs: Fix refcounting in discard path bch_dev->io_ref does not protect against the filesystem going away; bch_fs->writes does. Thus the filesystem write ref needs to be the last ref we release. Reported-by: syzbot+9e0404b505e604f67e41@syzkaller.appspotmail.com Signed-off-by: Kent Overstreet fs/bcachefs/alloc_background.c | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-) commit 8ed823b19214e403ca485532f48c0e02035021ae Author: Kent Overstreet Date: Wed Aug 21 22:57:56 2024 -0400 bcachefs: Fix compat issue with old alloc_v4 keys we allow new fields to be added to existing key types, and new versions should treat them as being zeroed; this was not handled in alloc_v4_validate. Reported-by: syzbot+3b2968fa4953885dd66a@syzkaller.appspotmail.com Signed-off-by: Kent Overstreet fs/bcachefs/alloc_background.c | 50 ++++++++++++++++++----------------- fs/bcachefs/alloc_background_format.h | 1 + fs/bcachefs/btree_iter.h | 9 +++++++ 3 files changed, 36 insertions(+), 24 deletions(-) commit 7f2de6947f92cfa4be8e5eaa1237e962bb8ee65f Author: Kent Overstreet Date: Wed Aug 21 22:27:45 2024 -0400 bcachefs: Fix warning in bch2_fs_journal_stop() j->last_empty_seq needs to match j->seq when the journal is empty Reported-by: syzbot+4093905737cf289b6b38@syzkaller.appspotmail.com Signed-off-by: Kent Overstreet fs/bcachefs/journal.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 06f67437ab356e3140f51aea272d33ce28421f66 Author: Kent Overstreet Date: Wed Aug 21 22:06:44 2024 -0400 fs/super.c: improve get_tree() error message seeing an odd bug where we fail to correctly return an error from .get_tree(): https://syzkaller.appspot.com/bug?extid=c0360e8367d6d8d04a66 we need to be able to distinguish between accidently returning a positive error (as implied by the log) and no error. Cc: David Howells Signed-off-by: Kent Overstreet fs/super.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) commit bdbdd4759f081ca2d0a5d9e8af21d742ffaf8439 Author: Kent Overstreet Date: Wed Aug 21 21:10:45 2024 -0400 bcachefs: Fix missing validation in bch2_sb_journal_v2_validate() Reported-by: syzbot+47ecc948aadfb2ab3efc@syzkaller.appspotmail.com Signed-off-by: Kent Overstreet fs/bcachefs/journal_sb.c | 15 +++++++++++++++ 1 file changed, 15 insertions(+) commit cab18be6957b6af8cbe3502fd5f6d7b9f02ccceb Author: Kent Overstreet Date: Wed Aug 21 20:49:07 2024 -0400 bcachefs: Fix replay_now_at() assert Journal replay, in the slowpath where we insert keys in journal order, was inserting keys in the wrong order; keys from early repair come last. Reported-by: syzbot+2c4fcb257ce2b6a29d0e@syzkaller.appspotmail.com Signed-off-by: Kent Overstreet fs/bcachefs/recovery.c | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-) commit 6575b8c9877c3dd1f7db1d0d61bd250a0bf18b6d Author: Kent Overstreet Date: Tue Aug 20 19:31:20 2024 -0400 bcachefs: Fix locking in bch2_ioc_setlabel() Fixes: 7a254053a590 ("bcachefs: support FS_IOC_SETFSLABEL") Reported-by: syzbot+7e9efdfec27fbde0141d@syzkaller.appspotmail.com Signed-off-by: Kent Overstreet fs/bcachefs/fs-ioctl.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) commit 5dbfc4ef72f15508882aff58c307b8425cf037a8 Author: Kent Overstreet Date: Tue Aug 20 15:04:15 2024 -0400 bcachefs: fix failure to relock in btree_node_fill() Signed-off-by: Kent Overstreet fs/bcachefs/btree_cache.c | 4 ++++ 1 file changed, 4 insertions(+) commit 3c5d0b72a8e8c19c960e8fefb7463067e58b6bc4 Author: Kent Overstreet Date: Mon Aug 19 15:22:55 2024 -0400 bcachefs: fix failure to relock in bch2_btree_node_mem_alloc() We weren't always so strict about trans->locked state - but now we are, and new assertions are shaking some bugs out. Signed-off-by: Kent Overstreet fs/bcachefs/btree_cache.c | 17 ++++++++++++++ fs/bcachefs/btree_cache.h | 2 ++ fs/bcachefs/btree_update_interior.c | 46 ++++++++++++++++++++----------------- 3 files changed, 44 insertions(+), 21 deletions(-) commit 1dceae4cc12aa6389d9a8706f0d2a94d1679e79d Author: Kent Overstreet Date: Tue Aug 20 12:10:33 2024 -0400 bcachefs: unlock_long() before resort in journal replay Fix another SRCU splat - this one pretty harmless. Signed-off-by: Kent Overstreet fs/bcachefs/recovery.c | 1 + 1 file changed, 1 insertion(+) commit cecc328240609df17395dfd0ea03cc813d8be36d Author: Kent Overstreet Date: Tue Aug 20 11:25:39 2024 -0400 bcachefs: fix missing bch2_err_str() Signed-off-by: Kent Overstreet fs/bcachefs/fsck.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) commit b8db1bd8020d5fecb3bf46cd8b954a657c20ba14 Author: Kent Overstreet Date: Mon Aug 19 16:13:16 2024 -0400 bcachefs: fix time_stats_to_text() Fixes: 7423330e30ab ("bcachefs: prt_printf() now respects \r\n\t") Signed-off-by: Kent Overstreet fs/bcachefs/util.c | 1 - 1 file changed, 1 deletion(-) commit c2a503f3e98e191d86738f5438a3a2b69575c830 Author: Kent Overstreet Date: Sun Aug 18 20:38:49 2024 -0400 bcachefs: Fix bch2_bucket_gens_init() Comparing the wrong bpos - this was missed because normally bucket_gens_init() runs on brand new filesystems, but this bug caused it to overwrite bucket_gens keys with 0s when upgrading ancient filesystems. Signed-off-by: Kent Overstreet fs/bcachefs/alloc_background.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit e150a7e89c4727176d07f5a0a8966fc2af05821c Author: Kent Overstreet Date: Sun Aug 18 20:18:34 2024 -0400 bcachefs: Fix bch2_trigger_alloc assert On testing on an old mangled filesystem, we missed a case. Fixes: bd864bc2d907 ("bcachefs: Fix bch2_trigger_alloc when upgrading from old versions") Signed-off-by: Kent Overstreet fs/bcachefs/alloc_background.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 49203a6b9d12bfd1a223a67847a631a78f1cd782 Author: Kent Overstreet Date: Sun Aug 18 15:08:12 2024 -0400 bcachefs: Fix failure to relock in btree_node_get() discovered by new trans->locked asserts Signed-off-by: Kent Overstreet fs/bcachefs/btree_cache.c | 4 ++++ 1 file changed, 4 insertions(+) commit 548e7f51679bf0ec3cdc2027d780c5d06a2a7ac6 Author: Kent Overstreet Date: Sun Aug 18 13:24:26 2024 -0400 bcachefs: setting bcachefs_effective.* xattrs is a noop bcachefs_effective.* xattrs show the options inherited from parent directories (as well as explicitly set); this namespace is not for setting bcachefs options. Change the .set() handler to a noop so that if e.g. rsync is copying xattrs it'll do the right thing, and only copy xattrs in the bcachefs.* namespace. We don't want to return an error, because that will cause rsync to bail out or get spammy. Signed-off-by: Kent Overstreet fs/bcachefs/xattr.c | 12 +++++++++++- 1 file changed, 11 insertions(+), 1 deletion(-) commit 8cc0e50614520c6c609c6ae32a65d0591b7865a1 Author: Kent Overstreet Date: Sun Aug 18 13:13:39 2024 -0400 bcachefs: Fix "trying to move an extent, but nr_replicas=0" data_update_init() does a bunch of complicated stuff to decide how many replicas to add, since we only want to increase an extent's durability on an explicit rereplicate, but extent pointers may be on devices with different durability settings. There was a corner case when evacuating a device that had been set to durability=0 after data had been written to it, and extents on that device had already been rereplicated - then evacuate only needs to drop pointers on that device, not move them. So the assert for !m->op.nr_replicas was spurious; this was a perfectly legitimate case that needed to be handled. Signed-off-by: Kent Overstreet fs/bcachefs/data_update.c | 29 ++++++++++++----------------- 1 file changed, 12 insertions(+), 17 deletions(-) commit 3f53d050416e88122d53aabbadb1fede998004da Author: Kent Overstreet Date: Sun Aug 18 12:22:23 2024 -0400 bcachefs: bch2_data_update_init() cleanup Factor out some helpers - this function has gotten much too big. Signed-off-by: Kent Overstreet fs/bcachefs/data_update.c | 179 ++++++++++++++++++++++++++-------------------- 1 file changed, 101 insertions(+), 78 deletions(-) commit a0b4a80ed6ce2cf8140fe926303ba609884b5d9b Merge: 8baeef7616d5 503ab6ee40fc Author: Jakub Kicinski Date: Wed Aug 21 18:05:24 2024 -0700 Merge branch '100GbE' of git://git.kernel.org/pub/scm/linux/kernel/git/tnguy/net-queue Tony Nguyen says: ==================== Intel Wired LAN Driver Updates 2024-08-20 (ice) This series contains updates to ice driver only. Maciej fixes issues with Rx data path on architectures with PAGE_SIZE >= 8192; correcting page reuse usage and calculations for last offset and truesize. Michal corrects assignment of devlink port number to use PF id. * '100GbE' of git://git.kernel.org/pub/scm/linux/kernel/git/tnguy/net-queue: ice: use internal pf id instead of function number ice: fix truesize operations for PAGE_SIZE >= 8192 ice: fix ICE_LAST_OFFSET formula ice: fix page reuse when PAGE_SIZE is over 8k ==================== Link: https://patch.msgid.link/20240820215620.1245310-1-anthony.l.nguyen@intel.com Signed-off-by: Jakub Kicinski commit 8baeef7616d5194045c5a6b97fd1246b87c55b13 Author: Somnath Kotur Date: Tue Aug 20 13:34:15 2024 -0700 bnxt_en: Fix double DMA unmapping for XDP_REDIRECT Remove the dma_unmap_page_attrs() call in the driver's XDP_REDIRECT code path. This should have been removed when we let the page pool handle the DMA mapping. This bug causes the warning: WARNING: CPU: 7 PID: 59 at drivers/iommu/dma-iommu.c:1198 iommu_dma_unmap_page+0xd5/0x100 CPU: 7 PID: 59 Comm: ksoftirqd/7 Tainted: G W 6.8.0-1010-gcp #11-Ubuntu Hardware name: Dell Inc. PowerEdge R7525/0PYVT1, BIOS 2.15.2 04/02/2024 RIP: 0010:iommu_dma_unmap_page+0xd5/0x100 Code: 89 ee 48 89 df e8 cb f2 69 ff 48 83 c4 08 5b 41 5c 41 5d 41 5e 41 5f 5d 31 c0 31 d2 31 c9 31 f6 31 ff 45 31 c0 e9 ab 17 71 00 <0f> 0b 48 83 c4 08 5b 41 5c 41 5d 41 5e 41 5f 5d 31 c0 31 d2 31 c9 RSP: 0018:ffffab1fc0597a48 EFLAGS: 00010246 RAX: 0000000000000000 RBX: ffff99ff838280c8 RCX: 0000000000000000 RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 RBP: ffffab1fc0597a78 R08: 0000000000000002 R09: ffffab1fc0597c1c R10: ffffab1fc0597cd3 R11: ffff99ffe375acd8 R12: 00000000e65b9000 R13: 0000000000000050 R14: 0000000000001000 R15: 0000000000000002 FS: 0000000000000000(0000) GS:ffff9a06efb80000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000565c34c37210 CR3: 00000005c7e3e000 CR4: 0000000000350ef0 ? show_regs+0x6d/0x80 ? __warn+0x89/0x150 ? iommu_dma_unmap_page+0xd5/0x100 ? report_bug+0x16a/0x190 ? handle_bug+0x51/0xa0 ? exc_invalid_op+0x18/0x80 ? iommu_dma_unmap_page+0xd5/0x100 ? iommu_dma_unmap_page+0x35/0x100 dma_unmap_page_attrs+0x55/0x220 ? bpf_prog_4d7e87c0d30db711_xdp_dispatcher+0x64/0x9f bnxt_rx_xdp+0x237/0x520 [bnxt_en] bnxt_rx_pkt+0x640/0xdd0 [bnxt_en] __bnxt_poll_work+0x1a1/0x3d0 [bnxt_en] bnxt_poll+0xaa/0x1e0 [bnxt_en] __napi_poll+0x33/0x1e0 net_rx_action+0x18a/0x2f0 Fixes: 578fcfd26e2a ("bnxt_en: Let the page pool manage the DMA mapping") Reviewed-by: Andy Gospodarek Reviewed-by: Kalesh AP Signed-off-by: Somnath Kotur Signed-off-by: Michael Chan Reviewed-by: Jacob Keller Link: https://patch.msgid.link/20240820203415.168178-1-michael.chan@broadcom.com Signed-off-by: Jakub Kicinski drivers/net/ethernet/broadcom/bnxt/bnxt_xdp.c | 5 ----- 1 file changed, 5 deletions(-) commit 58652e2422a7407e77ee50fcaaf4bf1885de8753 Merge: 007d4271a5f1 2d5ff7e339d0 Author: Jakub Kicinski Date: Wed Aug 21 17:35:51 2024 -0700 Merge branch 'ipv6-fix-possible-uaf-in-output-paths' Eric Dumazet says: ==================== ipv6: fix possible UAF in output paths First patch fixes an issue spotted by syzbot, and the two other patches fix error paths after skb_expand_head() adoption. ==================== Link: https://patch.msgid.link/20240820160859.3786976-1-edumazet@google.com Signed-off-by: Jakub Kicinski commit 2d5ff7e339d04622d8282661df36151906d0e1c7 Author: Eric Dumazet Date: Tue Aug 20 16:08:59 2024 +0000 ipv6: prevent possible UAF in ip6_xmit() If skb_expand_head() returns NULL, skb has been freed and the associated dst/idev could also have been freed. We must use rcu_read_lock() to prevent a possible UAF. Fixes: 0c9f227bee11 ("ipv6: use skb_expand_head in ip6_xmit") Signed-off-by: Eric Dumazet Cc: Vasily Averin Reviewed-by: David Ahern Link: https://patch.msgid.link/20240820160859.3786976-4-edumazet@google.com Signed-off-by: Jakub Kicinski net/ipv6/ip6_output.c | 4 ++++ 1 file changed, 4 insertions(+) commit da273b377ae0d9bd255281ed3c2adb228321687b Author: Eric Dumazet Date: Tue Aug 20 16:08:58 2024 +0000 ipv6: fix possible UAF in ip6_finish_output2() If skb_expand_head() returns NULL, skb has been freed and associated dst/idev could also have been freed. We need to hold rcu_read_lock() to make sure the dst and associated idev are alive. Fixes: 5796015fa968 ("ipv6: allocate enough headroom in ip6_finish_output2()") Signed-off-by: Eric Dumazet Cc: Vasily Averin Reviewed-by: David Ahern Link: https://patch.msgid.link/20240820160859.3786976-3-edumazet@google.com Signed-off-by: Jakub Kicinski net/ipv6/ip6_output.c | 4 ++++ 1 file changed, 4 insertions(+) commit faa389b2fbaaec7fd27a390b4896139f9da662e3 Author: Eric Dumazet Date: Tue Aug 20 16:08:57 2024 +0000 ipv6: prevent UAF in ip6_send_skb() syzbot reported an UAF in ip6_send_skb() [1] After ip6_local_out() has returned, we no longer can safely dereference rt, unless we hold rcu_read_lock(). A similar issue has been fixed in commit a688caa34beb ("ipv6: take rcu lock in rawv6_send_hdrinc()") Another potential issue in ip6_finish_output2() is handled in a separate patch. [1] BUG: KASAN: slab-use-after-free in ip6_send_skb+0x18d/0x230 net/ipv6/ip6_output.c:1964 Read of size 8 at addr ffff88806dde4858 by task syz.1.380/6530 CPU: 1 UID: 0 PID: 6530 Comm: syz.1.380 Not tainted 6.11.0-rc3-syzkaller-00306-gdf6cbc62cc9b #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/06/2024 Call Trace: __dump_stack lib/dump_stack.c:93 [inline] dump_stack_lvl+0x241/0x360 lib/dump_stack.c:119 print_address_description mm/kasan/report.c:377 [inline] print_report+0x169/0x550 mm/kasan/report.c:488 kasan_report+0x143/0x180 mm/kasan/report.c:601 ip6_send_skb+0x18d/0x230 net/ipv6/ip6_output.c:1964 rawv6_push_pending_frames+0x75c/0x9e0 net/ipv6/raw.c:588 rawv6_sendmsg+0x19c7/0x23c0 net/ipv6/raw.c:926 sock_sendmsg_nosec net/socket.c:730 [inline] __sock_sendmsg+0x1a6/0x270 net/socket.c:745 sock_write_iter+0x2dd/0x400 net/socket.c:1160 do_iter_readv_writev+0x60a/0x890 vfs_writev+0x37c/0xbb0 fs/read_write.c:971 do_writev+0x1b1/0x350 fs/read_write.c:1018 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7f936bf79e79 Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007f936cd7f038 EFLAGS: 00000246 ORIG_RAX: 0000000000000014 RAX: ffffffffffffffda RBX: 00007f936c115f80 RCX: 00007f936bf79e79 RDX: 0000000000000001 RSI: 0000000020000040 RDI: 0000000000000004 RBP: 00007f936bfe7916 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 0000000000000000 R14: 00007f936c115f80 R15: 00007fff2860a7a8 Allocated by task 6530: kasan_save_stack mm/kasan/common.c:47 [inline] kasan_save_track+0x3f/0x80 mm/kasan/common.c:68 unpoison_slab_object mm/kasan/common.c:312 [inline] __kasan_slab_alloc+0x66/0x80 mm/kasan/common.c:338 kasan_slab_alloc include/linux/kasan.h:201 [inline] slab_post_alloc_hook mm/slub.c:3988 [inline] slab_alloc_node mm/slub.c:4037 [inline] kmem_cache_alloc_noprof+0x135/0x2a0 mm/slub.c:4044 dst_alloc+0x12b/0x190 net/core/dst.c:89 ip6_blackhole_route+0x59/0x340 net/ipv6/route.c:2670 make_blackhole net/xfrm/xfrm_policy.c:3120 [inline] xfrm_lookup_route+0xd1/0x1c0 net/xfrm/xfrm_policy.c:3313 ip6_dst_lookup_flow+0x13e/0x180 net/ipv6/ip6_output.c:1257 rawv6_sendmsg+0x1283/0x23c0 net/ipv6/raw.c:898 sock_sendmsg_nosec net/socket.c:730 [inline] __sock_sendmsg+0x1a6/0x270 net/socket.c:745 ____sys_sendmsg+0x525/0x7d0 net/socket.c:2597 ___sys_sendmsg net/socket.c:2651 [inline] __sys_sendmsg+0x2b0/0x3a0 net/socket.c:2680 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f Freed by task 45: kasan_save_stack mm/kasan/common.c:47 [inline] kasan_save_track+0x3f/0x80 mm/kasan/common.c:68 kasan_save_free_info+0x40/0x50 mm/kasan/generic.c:579 poison_slab_object+0xe0/0x150 mm/kasan/common.c:240 __kasan_slab_free+0x37/0x60 mm/kasan/common.c:256 kasan_slab_free include/linux/kasan.h:184 [inline] slab_free_hook mm/slub.c:2252 [inline] slab_free mm/slub.c:4473 [inline] kmem_cache_free+0x145/0x350 mm/slub.c:4548 dst_destroy+0x2ac/0x460 net/core/dst.c:124 rcu_do_batch kernel/rcu/tree.c:2569 [inline] rcu_core+0xafd/0x1830 kernel/rcu/tree.c:2843 handle_softirqs+0x2c4/0x970 kernel/softirq.c:554 __do_softirq kernel/softirq.c:588 [inline] invoke_softirq kernel/softirq.c:428 [inline] __irq_exit_rcu+0xf4/0x1c0 kernel/softirq.c:637 irq_exit_rcu+0x9/0x30 kernel/softirq.c:649 instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1043 [inline] sysvec_apic_timer_interrupt+0xa6/0xc0 arch/x86/kernel/apic/apic.c:1043 asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:702 Last potentially related work creation: kasan_save_stack+0x3f/0x60 mm/kasan/common.c:47 __kasan_record_aux_stack+0xac/0xc0 mm/kasan/generic.c:541 __call_rcu_common kernel/rcu/tree.c:3106 [inline] call_rcu+0x167/0xa70 kernel/rcu/tree.c:3210 refdst_drop include/net/dst.h:263 [inline] skb_dst_drop include/net/dst.h:275 [inline] nf_ct_frag6_queue net/ipv6/netfilter/nf_conntrack_reasm.c:306 [inline] nf_ct_frag6_gather+0xb9a/0x2080 net/ipv6/netfilter/nf_conntrack_reasm.c:485 ipv6_defrag+0x2c8/0x3c0 net/ipv6/netfilter/nf_defrag_ipv6_hooks.c:67 nf_hook_entry_hookfn include/linux/netfilter.h:154 [inline] nf_hook_slow+0xc3/0x220 net/netfilter/core.c:626 nf_hook include/linux/netfilter.h:269 [inline] __ip6_local_out+0x6fa/0x800 net/ipv6/output_core.c:143 ip6_local_out+0x26/0x70 net/ipv6/output_core.c:153 ip6_send_skb+0x112/0x230 net/ipv6/ip6_output.c:1959 rawv6_push_pending_frames+0x75c/0x9e0 net/ipv6/raw.c:588 rawv6_sendmsg+0x19c7/0x23c0 net/ipv6/raw.c:926 sock_sendmsg_nosec net/socket.c:730 [inline] __sock_sendmsg+0x1a6/0x270 net/socket.c:745 sock_write_iter+0x2dd/0x400 net/socket.c:1160 do_iter_readv_writev+0x60a/0x890 Fixes: 0625491493d9 ("ipv6: ip6_push_pending_frames() should increment IPSTATS_MIB_OUTDISCARDS") Signed-off-by: Eric Dumazet Reported-by: syzbot Reviewed-by: David Ahern Link: https://patch.msgid.link/20240820160859.3786976-2-edumazet@google.com Signed-off-by: Jakub Kicinski net/ipv6/ip6_output.c | 2 ++ 1 file changed, 2 insertions(+) commit 007d4271a5f10638cba6f0b99698557ef30014b9 Author: Eric Dumazet Date: Tue Aug 20 16:20:53 2024 +0000 netpoll: do not export netpoll_poll_[disable|enable]() netpoll_poll_disable() and netpoll_poll_enable() are only used from core networking code, there is no need to export them. Signed-off-by: Eric Dumazet Reviewed-by: Simon Horman Link: https://patch.msgid.link/20240820162053.3870927-1-edumazet@google.com Signed-off-by: Jakub Kicinski net/core/netpoll.c | 2 -- 1 file changed, 2 deletions(-) commit f8669d7b5f5d2d88959456ae9123d8bb6fdc1ebe Author: Ido Schimmel Date: Tue Aug 20 12:53:47 2024 +0200 selftests: mlxsw: ethtool_lanes: Source ethtool lib from correct path Source the ethtool library from the correct path and avoid the following error: ./ethtool_lanes.sh: line 14: ./../../../net/forwarding/ethtool_lib.sh: No such file or directory Fixes: 40d269c000bd ("selftests: forwarding: Move several selftests") Signed-off-by: Ido Schimmel Signed-off-by: Petr Machata Reviewed-by: Simon Horman Link: https://patch.msgid.link/2112faff02e536e1ac14beb4c2be09c9574b90ae.1724150067.git.petrm@nvidia.com Signed-off-by: Jakub Kicinski tools/testing/selftests/drivers/net/mlxsw/ethtool_lanes.sh | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) commit b128ed5ab27330deeeaf51ea8bb69f1442a96f7f Author: Felix Fietkau Date: Mon Aug 19 17:06:21 2024 +0200 udp: fix receiving fraglist GSO packets When assembling fraglist GSO packets, udp4_gro_complete does not set skb->csum_start, which makes the extra validation in __udp_gso_segment fail. Fixes: 89add40066f9 ("net: drop bad gso csum_start and offset in virtio_net_hdr") Signed-off-by: Felix Fietkau Reviewed-by: Willem de Bruijn Link: https://patch.msgid.link/20240819150621.59833-1-nbd@nbd.name Signed-off-by: Jakub Kicinski net/ipv4/udp_offload.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) commit 872cf28b8df9c5c3a1e71a88ee750df7c2513971 Merge: 5c6154ffd40c 46ee21e9f592 Author: Linus Torvalds Date: Thu Aug 22 06:34:27 2024 +0800 Merge tag 'platform-drivers-x86-v6.11-4' of git://git.kernel.org/pub/scm/linux/kernel/git/pdx86/platform-drivers-x86 Pull x86 platform driver fixes from Ilpo Järvinen: - ISST: Fix an error-handling corner case - platform/surface: aggregator: Minor corner case fix and new HW support * tag 'platform-drivers-x86-v6.11-4' of git://git.kernel.org/pub/scm/linux/kernel/git/pdx86/platform-drivers-x86: platform/x86: ISST: Fix return value on last invalid resource platform/surface: aggregator: Fix warning when controller is destroyed in probe platform/surface: aggregator_registry: Add support for Surface Laptop 6 platform/surface: aggregator_registry: Add fan and thermal sensor support for Surface Laptop 5 platform/surface: aggregator_registry: Add support for Surface Laptop Studio 2 platform/surface: aggregator_registry: Add support for Surface Laptop Go 3 platform/surface: aggregator_registry: Add Support for Surface Pro 10 platform/x86: asus-wmi: Add quirk for ROG Ally X commit 5c6154ffd40c5bca1eb01f9bf5a4d2b6d18d55bd Merge: b311c1b497e5 0005e01e1e87 Author: Linus Torvalds Date: Thu Aug 22 06:06:09 2024 +0800 Merge tag 'erofs-for-6.11-rc5-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/xiang/erofs Pull erofs fixes from Gao Xiang: "As I mentioned in the merge window pull request, there is a regression which could cause system hang due to page migration. The corresponding fix landed upstream through MM tree last week (commit 2e6506e1c4ee: "mm/migrate: fix deadlock in migrate_pages_batch() on large folios"), therefore large folios can be safely allowed for compressed inodes and stress tests have been running on my fleet for over 20 days without any regression. Users have explicitly requested this for months, so let's allow large folios for EROFS full cases now for wider testing. Additionally, there is a fix which addresses invalid memory accesses on a failure path triggered by fault injection and two minor cleanups to simplify the codebase. Summary: - Allow large folios on compressed inodes - Fix invalid memory accesses if z_erofs_gbuf_growsize() partially fails - Two minor cleanups" * tag 'erofs-for-6.11-rc5-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/xiang/erofs: erofs: fix out-of-bound access when z_erofs_gbuf_growsize() partially fails erofs: allow large folios for compressed files erofs: get rid of check_layout_compatibility() erofs: simplify readdir operation commit db1ec60fba4a995975dc1dc837b408db0d666801 Author: Manivannan Sadhasivam Date: Mon Jul 22 18:41:28 2024 +0530 PCI: qcom: Use OPP only if the platform supports it With commit 5b6272e0efd5 ("PCI: qcom: Add OPP support to scale performance"), OPP was used to control the interconnect and power domains if the platform supported OPP. Also to maintain the backward compatibility with platforms not supporting OPP but just ICC, the above mentioned commit assumed that if ICC was not available on the platform, it would resort to OPP. Unfortunately, some old platforms don't support either ICC or OPP. On those platforms, resorting to OPP in the absence of ICC throws below errors from OPP core during suspend and resume: qcom-pcie 1c08000.pcie: dev_pm_opp_set_opp: device opp doesn't exist qcom-pcie 1c08000.pcie: _find_key: OPP table not found (-19) Also, it doesn't make sense to invoke the OPP APIs when OPP is not supported by the platform at all. Add a "use_pm_opp" flag to identify whether OPP is supported and use it to control invoking the OPP APIs. Fixes: 5b6272e0efd5 ("PCI: qcom: Add OPP support to scale performance") Link: https://lore.kernel.org/linux-pci/20240722131128.32470-1-manivannan.sadhasivam@linaro.org Signed-off-by: Manivannan Sadhasivam Signed-off-by: Krzysztof Wilczyński Signed-off-by: Bjorn Helgaas Reviewed-by: Mayank Rana drivers/pci/controller/dwc/pcie-qcom.c | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) commit 5d6a6c7454ebaefba518e334750b05700131923b Author: Manivannan Sadhasivam Date: Thu Aug 8 12:00:57 2024 +0530 PCI: qcom-ep: Disable MHI RAM data parity error interrupt for SA8775P SoC SA8775P SoC has support for the hardware parity check feature on the MHI RAM (entity that holds MHI registers, etc.) But due to a hardware bug in the parity check logic, the data parity error interrupt is getting generated all the time when using MHI. So the hardware team has suggested disabling the parity check error to work around the hardware bug. Mask the parity error interrupt in PARF_INT_ALL_5_MASK register. Fixes: 58d0d3e032b3 ("PCI: qcom-ep: Add support for SA8775P SOC") Link: https://lore.kernel.org/linux-pci/20240808063057.7394-1-manivannan.sadhasivam@linaro.org Signed-off-by: Manivannan Sadhasivam Signed-off-by: Krzysztof Wilczyński Signed-off-by: Bjorn Helgaas drivers/pci/controller/dwc/pcie-qcom-ep.c | 13 +++++++++++++ 1 file changed, 13 insertions(+) commit 232590ea7fc125986a526e03081b98e5783f70d2 Author: Christian Brauner Date: Mon Aug 19 10:38:23 2024 +0200 Revert "pidfd: prevent creation of pidfds for kthreads" This reverts commit 3b5bbe798b2451820e74243b738268f51901e7d0. Eric reported that systemd-shutdown gets broken by blocking the creating of pidfds for kthreads as older versions seems to rely on being able to create a pidfd for any process in /proc. Reported-by: Eric Biggers Link: https://lore.kernel.org/r/20240818035818.GA1929@sol.localdomain Signed-off-by: Christian Brauner kernel/fork.c | 25 +++---------------------- 1 file changed, 3 insertions(+), 22 deletions(-) commit 524b2c6dc80d735be9ebcd2decffe2889baab65d Author: Christian Brauner Date: Thu Aug 15 14:39:33 2024 +0200 romfs: fix romfs_read_folio() Add the correct offset to folio_zero_tail(). Fixes: d86f2de026c5 ("romfs: Convert romfs_read_folio() to use a folio") Reported-by: Greg Ungerer Link: https://lore.kernel.org/r/Zr0GTnPHfeA0P8nb@casper.infradead.org Signed-off-by: Christian Brauner fs/romfs/super.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 92764e8822d4e7f8efb5ad959fac195a7f8ea0c6 Author: David Howells Date: Wed Aug 14 21:38:21 2024 +0100 netfs, ceph: Partially revert "netfs: Replace PG_fscache by setting folio->private and marking dirty" This partially reverts commit 2ff1e97587f4d398686f52c07afde3faf3da4e5c. In addition to reverting the removal of PG_private_2 wrangling from the buffered read code[1][2], the removal of the waits for PG_private_2 from netfs_release_folio() and netfs_invalidate_folio() need reverting too. It also adds a wait into ceph_evict_inode() to wait for netfs read and copy-to-cache ops to complete. Fixes: 2ff1e97587f4 ("netfs: Replace PG_fscache by setting folio->private and marking dirty") Signed-off-by: David Howells Link: https://lore.kernel.org/r/3575457.1722355300@warthog.procyon.org.uk [1] Link: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=8e5ced7804cb9184c4a23f8054551240562a8eda [2] Link: https://lore.kernel.org/r/20240814203850.2240469-2-dhowells@redhat.com cc: Max Kellermann cc: Ilya Dryomov cc: Xiubo Li cc: Jeff Layton cc: Matthew Wilcox cc: ceph-devel@vger.kernel.org cc: netfs@lists.linux.dev cc: linux-fsdevel@vger.kernel.org cc: linux-mm@kvack.org Signed-off-by: Christian Brauner fs/ceph/inode.c | 1 + fs/netfs/misc.c | 7 +++++++ 2 files changed, 8 insertions(+) commit bc754cc76d1bbc87be5d8b7eee05ceb0ae613bce Author: Masami Hiramatsu (Google) Date: Tue Aug 20 09:56:38 2024 +0900 tracing: Fix memory leak in fgraph storage selftest With ftrace boot-time selftest, kmemleak reported some memory leaks in the new test case for function graph storage for multiple tracers. unreferenced object 0xffff888005060080 (size 32): comm "swapper/0", pid 1, jiffies 4294676440 hex dump (first 32 bytes): 00 00 00 00 00 00 00 00 20 10 06 05 80 88 ff ff ........ ....... 54 0c 1e 81 ff ff ff ff 00 00 00 00 00 00 00 00 T............... backtrace (crc 7c93416c): [<000000000238ee6f>] __kmalloc_cache_noprof+0x11f/0x2a0 [<0000000033d2b6c5>] enter_record+0xe8/0x150 [<0000000054c38424>] match_records+0x1cd/0x230 [<00000000c775b63d>] ftrace_set_hash+0xff/0x380 [<000000007bf7208c>] ftrace_set_filter+0x70/0x90 [<00000000a5c08dda>] test_graph_storage_multi+0x2e/0xf0 [<000000006ba028ca>] trace_selftest_startup_function_graph+0x1e8/0x260 [<00000000a715d3eb>] run_tracer_selftest+0x111/0x190 [<00000000395cbf90>] register_tracer+0xdf/0x1f0 [<0000000093e67f7b>] do_one_initcall+0x141/0x3b0 [<00000000c591b682>] do_initcall_level+0x82/0xa0 [<000000004e4c6600>] do_initcalls+0x43/0x70 [<0000000034f3c4e4>] kernel_init_freeable+0x170/0x1f0 [<00000000c7a5dab2>] kernel_init+0x1a/0x1a0 [<00000000ea105947>] ret_from_fork+0x3a/0x50 [<00000000a1932e84>] ret_from_fork_asm+0x1a/0x30 ... This means filter hash allocated for the fixtures are not correctly released after the test. Free those hash lists after tests are done and split the loop for initialize fixture and register fixture for rollback. Fixes: dd120af2d5f8 ("ftrace: Add multiple fgraph storage selftest") Cc: stable@vger.kernel.org Link: https://lore.kernel.org/172411539857.28895.13119957560263401102.stgit@devnote2 Signed-off-by: Masami Hiramatsu (Google) Signed-off-by: Steven Rostedt (Google) kernel/trace/trace_selftest.c | 23 ++++++++++++++++++----- 1 file changed, 18 insertions(+), 5 deletions(-) commit 57df60e1f981fa8c288a49012a4bbb02ae0ecdbc Author: Yang Ruibin <11162571@vivo.com> Date: Wed Aug 21 03:59:33 2024 -0400 thermal/debugfs: Fix the NULL vs IS_ERR() confusion in debugfs_create_dir() The debugfs_create_dir() return value is never NULL, it is either a valid pointer or an error one. Use IS_ERR() to check it. Fixes: 7ef01f228c9f ("thermal/debugfs: Add thermal debugfs information for mitigation episodes") Fixes: 755113d76786 ("thermal/debugfs: Add thermal cooling device debugfs information") Signed-off-by: Yang Ruibin <11162571@vivo.com> Link: https://patch.msgid.link/20240821075934.12145-1-11162571@vivo.com [ rjw: Subject and changelog edits ] Signed-off-by: Rafael J. Wysocki drivers/thermal/thermal_debugfs.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) commit a069a22f391019e84390f4e8c1a9c531ba4fb28f Author: Masami Hiramatsu (Google) Date: Sun Aug 18 21:48:03 2024 +0900 tracing: fgraph: Fix to add new fgraph_ops to array after ftrace_startup_subops() Since the register_ftrace_graph() assigns a new fgraph_ops to fgraph_array before registring it by ftrace_startup_subops(), the new fgraph_ops can be used in function_graph_enter(). In most cases, it is still OK because those fgraph_ops's hashtable is already initialized by ftrace_set_filter*() etc. But if a user registers a new fgraph_ops which does not initialize the hash list, ftrace_ops_test() in function_graph_enter() causes a NULL pointer dereference BUG because fgraph_ops->ops.func_hash is NULL. This can be reproduced by the below commands because function profiler's fgraph_ops does not initialize the hash list; # cd /sys/kernel/tracing # echo function_graph > current_tracer # echo 1 > function_profile_enabled To fix this problem, add a new fgraph_ops to fgraph_array after ftrace_startup_subops(). Thus, until the new fgraph_ops is initialized, we will see fgraph_stub on the corresponding fgraph_array entry. Cc: Alexei Starovoitov Cc: Florent Revest Cc: Martin KaFai Lau Cc: bpf Cc: Sven Schnelle Cc: Alexei Starovoitov Cc: Jiri Olsa Cc: Arnaldo Carvalho de Melo Cc: Daniel Borkmann Cc: Alan Maguire Cc: Mark Rutland Cc: Peter Zijlstra Cc: Thomas Gleixner Cc: Guo Ren Link: https://lore.kernel.org/172398528350.293426.8347220120333730248.stgit@devnote2 Fixes: c132be2c4fcc ("function_graph: Have the instances use their own ftrace_ops for filtering") Signed-off-by: Masami Hiramatsu (Google) Signed-off-by: Steven Rostedt (Google) kernel/trace/fgraph.c | 31 ++++++++++++++++++------------- 1 file changed, 18 insertions(+), 13 deletions(-) commit 9e7f30563677fbeff62d368d5d2a5ac7aaa9746a Author: Matthew Brost Date: Tue Aug 20 13:23:09 2024 -0700 drm/xe: Free job before xe_exec_queue_put Free job depends on job->vm being valid, the last xe_exec_queue_put can destroy the VM. Prevent UAF by freeing job before xe_exec_queue_put. Fixes: dd08ebf6c352 ("drm/xe: Introduce a new DRM driver for Intel GPUs") Signed-off-by: Matthew Brost Reviewed-by: Nirmoy Das Reviewed-by: Jagmeet Randhawa Link: https://patchwork.freedesktop.org/patch/msgid/20240820202309.1260755-1-matthew.brost@intel.com (cherry picked from commit 32a42c93b74c8ca6d0915ea3eba21bceff53042f) Signed-off-by: Rodrigo Vivi drivers/gpu/drm/xe/xe_sched_job.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) commit dd3e840a33b57b92812fbec26273b3f0b4eb5ae3 Author: Matthew Brost Date: Thu Aug 15 12:35:22 2024 -0700 drm/xe: Drop HW fence pointer to HW fence ctx The HW fence ctx objects are not ref counted rather tied to the life of an LRC object. HW fences reference the HW fence ctx, HW fences can outlive LRCs thus resulting in UAF. Drop the HW fence pointer to HW fence ctx rather just store what is needed directly in HW fence. v2: - Fix typo in commit (Ashutosh) - Use snprintf (Ashutosh) Fixes: dd08ebf6c352 ("drm/xe: Introduce a new DRM driver for Intel GPUs") Signed-off-by: Matthew Brost Reviewed-by: Ashutosh Dixit Link: https://patchwork.freedesktop.org/patch/msgid/20240815193522.16008-1-matthew.brost@intel.com (cherry picked from commit 60db6f540af9f93144d5039140aa2ed17171d168) Signed-off-by: Rodrigo Vivi drivers/gpu/drm/xe/xe_hw_fence.c | 9 +++++---- drivers/gpu/drm/xe/xe_hw_fence_types.h | 7 +++++-- drivers/gpu/drm/xe/xe_trace.h | 2 +- 3 files changed, 11 insertions(+), 7 deletions(-) commit a6f78359ac75f24cac3c1bdd753c49c1877bcd82 Author: Stuart Summers Date: Sat Aug 17 02:47:30 2024 +0000 drm/xe: Fix missing workqueue destroy in xe_gt_pagefault On driver reload we never free up the memory for the pagefault and access counter workqueues. Add those destroy calls here. Fixes: dd08ebf6c352 ("drm/xe: Introduce a new DRM driver for Intel GPUs") Signed-off-by: Stuart Summers Reviewed-by: Rodrigo Vivi Signed-off-by: Matthew Brost Link: https://patchwork.freedesktop.org/patch/msgid/c9a951505271dc3a7aee76de7656679f69c11518.1723862633.git.stuart.summers@intel.com (cherry picked from commit 7586fc52b14e0b8edd0d1f8a434e0de2078b7b2b) Signed-off-by: Rodrigo Vivi drivers/gpu/drm/xe/xe_gt_pagefault.c | 18 ++++++++++++++++-- 1 file changed, 16 insertions(+), 2 deletions(-) commit 5f7c98b7519a3a847d9182bd99d57ea250032ca1 Author: Hongbo Li Date: Wed Aug 21 14:19:55 2024 +0800 ASoC: allow module autoloading for table board_ids Add MODULE_DEVICE_TABLE(), so modules could be properly autoloaded based on the alias from platform_device_id table. Signed-off-by: Hongbo Li Link: https://patch.msgid.link/20240821061955.2273782-3-lihongbo22@huawei.com Signed-off-by: Mark Brown sound/soc/amd/acp/acp-sof-mach.c | 2 ++ 1 file changed, 2 insertions(+) commit 0e9fdab1e8df490354562187cdbb8dec643eae2c Author: Hongbo Li Date: Wed Aug 21 14:19:54 2024 +0800 ASoC: allow module autoloading for table db1200_pids Add MODULE_DEVICE_TABLE(), so modules could be properly autoloaded based on the alias from platform_device_id table. Signed-off-by: Hongbo Li Link: https://patch.msgid.link/20240821061955.2273782-2-lihongbo22@huawei.com Signed-off-by: Mark Brown sound/soc/au1x/db1200.c | 1 + 1 file changed, 1 insertion(+) commit c158ceb826068a8bbe3c9e78df420f47ba53c8a8 Author: Bjorn Andersson Date: Tue Aug 20 15:59:34 2024 -0700 soc: qcom: pd-mapper: Fix singleton refcount The Qualcomm pd-mapper is a refcounted singleton, but the refcount is never incremented, which means the as soon as any remoteproc instance stops the count will hit 0. At this point the pd-mapper QMI service is stopped, leaving firmware without access to the PD information. Stopping any other remoteproc instances will result in a use-after-free, which best case manifest itself as a refcount underflow: refcount_t: underflow; use-after-free. WARNING: CPU: 1 PID: 354 at lib/refcount.c:87 refcount_dec_and_mutex_lock+0xc4/0x148 ... Call trace: refcount_dec_and_mutex_lock+0xc4/0x148 qcom_pdm_remove+0x40/0x118 [qcom_pd_mapper] ... Fix this by incrementing the refcount, so that the pd-mapper is only torn down when the last remoteproc stops, as intended. Fixes: 1ebcde047c54 ("soc: qcom: add pd-mapper implementation") Signed-off-by: Bjorn Andersson Reviewed-by: Dmitry Baryshkov Link: https://lore.kernel.org/r/20240820-pd-mapper-refcount-fix-v1-1-03ea65c0309b@quicinc.com Signed-off-by: Bjorn Andersson drivers/soc/qcom/qcom_pd_mapper.c | 2 ++ 1 file changed, 2 insertions(+) commit b4f5bd60d558f6ba451d7e76aa05782c07a182a3 Author: Harald Freudenberger Date: Tue Aug 6 12:06:23 2024 +0200 s390/ap: Refine AP bus bindings complete processing With the rework of the AP bus scan and the introduction of a bindings complete completion also the timing until the userspace finally receives a AP bus binding complete uevent had increased. Unfortunately this event triggers some important jobs for preparation of KVM guests, for example the modification of card/queue masks to reassign AP resources to the alternate AP queue device driver (vfio_ap) which is the precondition for building mediated devices which may be a precondition for starting KVM guests using AP resources. This small fix now triggers the check for binding complete each time an AP device driver has registered. With this patch the bindings complete may be posted up to 30s earlier as there is no need to wait for the next AP bus scan any more. Fixes: 778412ab915d ("s390/ap: rearm APQNs bindings complete completion") Signed-off-by: Harald Freudenberger Reviewed-by: Holger Dengler Cc: stable@vger.kernel.org Acked-by: Alexander Gordeev Signed-off-by: Vasily Gorbik drivers/s390/crypto/ap_bus.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) commit 32db401965f165f7c44447d0508097f070c8f576 Author: Alexander Gordeev Date: Fri Aug 9 08:47:16 2024 +0200 s390/mm: Pin identity mapping base to zero SIE instruction performs faster when the virtual address of SIE block matches the physical one. Pin the identity mapping base to zero for the benefit of SIE and other instructions that have similar performance impact. Still, randomize the base when DEBUG_VM kernel configuration option is enabled. Suggested-by: Vasily Gorbik Reviewed-by: Christian Borntraeger Signed-off-by: Alexander Gordeev Signed-off-by: Vasily Gorbik arch/s390/Kconfig | 13 +++++++++++++ arch/s390/boot/startup.c | 3 ++- 2 files changed, 15 insertions(+), 1 deletion(-) commit a3ca27c405faad584af6e8e38cdafe5be73230a1 Author: Alexander Gordeev Date: Fri Aug 9 08:47:15 2024 +0200 s390/mm: Prevent lowcore vs identity mapping overlap The identity mapping position in virtual memory is randomized together with the kernel mapping. That position can never overlap with the lowcore even when the lowcore is relocated. Prevent overlapping with the lowcore to allow independent positioning of the identity mapping. With the current value of the alternative lowcore address of 0x70000 the overlap could happen in case the identity mapping is placed at zero. This is a prerequisite for uncoupling of randomization base of kernel image and identity mapping in virtual memory. Acked-by: Vasily Gorbik Signed-off-by: Alexander Gordeev Signed-off-by: Vasily Gorbik arch/s390/kernel/setup.c | 19 ++++++++++++++++++- 1 file changed, 18 insertions(+), 1 deletion(-) commit 8342009efa2a5e75dce56173d7de026bcc6666d8 Author: Richard Acayan Date: Mon Jul 29 21:38:35 2024 -0400 firmware: qcom: tzmem: disable sdm670 platform The Pixel 3a returns 4291821499 (-3145797 or 0xFFCFFFBB) when attempting to load the GPU firmware if tzmem is allowed. Disable it on SDM670 so the GPU can successfully probe. Signed-off-by: Richard Acayan Acked-by: Bartosz Golaszewski Link: https://lore.kernel.org/r/20240730013834.41840-2-mailingradian@gmail.com Signed-off-by: Bjorn Andersson drivers/firmware/qcom/qcom_tzmem.c | 1 + 1 file changed, 1 insertion(+) commit ad51126037a43c05f5f4af5eb262734e3e88ca59 Author: Bjorn Andersson Date: Tue Aug 20 13:29:32 2024 -0700 soc: qcom: pmic_glink: Actually communicate when remote goes down When the pmic_glink state is UP and we either receive a protection- domain (PD) notification indicating that the PD is going down, or that the whole remoteproc is going down, it's expected that the pmic_glink client instances are notified that their function has gone DOWN. This is not what the code does, which results in the client state either not updating, or being wrong in many cases. So let's fix the conditions. Fixes: 58ef4ece1e41 ("soc: qcom: pmic_glink: Introduce base PMIC GLINK driver") Cc: stable@vger.kernel.org Reviewed-by: Heikki Krogerus Reviewed-by: Neil Armstrong Reviewed-by: Dmitry Baryshkov Tested-by: Amit Pundir Reviewed-by: Johan Hovold Tested-by: Johan Hovold Signed-off-by: Bjorn Andersson Link: https://lore.kernel.org/r/20240820-pmic-glink-v6-11-races-v3-3-eec53c750a04@quicinc.com Signed-off-by: Bjorn Andersson drivers/soc/qcom/pmic_glink.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 11bb2ffb679399f99041540cf662409905179e3a Author: Bjorn Andersson Date: Tue Aug 20 13:29:31 2024 -0700 usb: typec: ucsi: Move unregister out of atomic section Commit '9329933699b3 ("soc: qcom: pmic_glink: Make client-lock non-sleeping")' moved the pmic_glink client list under a spinlock, as it is accessed by the rpmsg/glink callback, which in turn is invoked from IRQ context. This means that ucsi_unregister() is now called from atomic context, which isn't feasible as it's expecting a sleepable context. An effort is under way to get GLINK to invoke its callbacks in a sleepable context, but until then lets schedule the unregistration. A side effect of this is that ucsi_unregister() can now happen after the remote processor, and thereby the communication link with it, is gone. pmic_glink_send() is amended with a check to avoid the resulting NULL pointer dereference. This does however result in the user being informed about this error by the following entry in the kernel log: ucsi_glink.pmic_glink_ucsi pmic_glink.ucsi.0: failed to send UCSI write request: -5 Fixes: 9329933699b3 ("soc: qcom: pmic_glink: Make client-lock non-sleeping") Cc: stable@vger.kernel.org Reviewed-by: Heikki Krogerus Reviewed-by: Neil Armstrong Reviewed-by: Dmitry Baryshkov Tested-by: Amit Pundir Reviewed-by: Johan Hovold Tested-by: Johan Hovold Signed-off-by: Bjorn Andersson Link: https://lore.kernel.org/r/20240820-pmic-glink-v6-11-races-v3-2-eec53c750a04@quicinc.com Signed-off-by: Bjorn Andersson drivers/soc/qcom/pmic_glink.c | 10 +++++++++- drivers/usb/typec/ucsi/ucsi_glink.c | 27 ++++++++++++++++++++++----- 2 files changed, 31 insertions(+), 6 deletions(-) commit 3568affcddd68743e25aa3ec1647d9b82797757b Author: Bjorn Andersson Date: Tue Aug 20 13:29:30 2024 -0700 soc: qcom: pmic_glink: Fix race during initialization As pointed out by Stephen Boyd it is possible that during initialization of the pmic_glink child drivers, the protection-domain notifiers fires, and the associated work is scheduled, before the client registration returns and as a result the local "client" pointer has been initialized. The outcome of this is a NULL pointer dereference as the "client" pointer is blindly dereferenced. Timeline provided by Stephen: CPU0 CPU1 ---- ---- ucsi->client = NULL; devm_pmic_glink_register_client() client->pdr_notify(client->priv, pg->client_state) pmic_glink_ucsi_pdr_notify() schedule_work(&ucsi->register_work) pmic_glink_ucsi_register() ucsi_register() pmic_glink_ucsi_read_version() pmic_glink_ucsi_read() pmic_glink_ucsi_read() pmic_glink_send(ucsi->client) ucsi->client = client // Too late! This code is identical across the altmode, battery manager and usci child drivers. Resolve this by splitting the allocation of the "client" object and the registration thereof into two operations. This only happens if the protection domain registry is populated at the time of registration, which by the introduction of commit '1ebcde047c54 ("soc: qcom: add pd-mapper implementation")' became much more likely. Reported-by: Amit Pundir Closes: https://lore.kernel.org/all/CAMi1Hd2_a7TjA7J9ShrAbNOd_CoZ3D87twmO5t+nZxC9sX18tA@mail.gmail.com/ Reported-by: Johan Hovold Closes: https://lore.kernel.org/all/ZqiyLvP0gkBnuekL@hovoldconsulting.com/ Reported-by: Stephen Boyd Closes: https://lore.kernel.org/all/CAE-0n52JgfCBWiFQyQWPji8cq_rCsviBpW-m72YitgNfdaEhQg@mail.gmail.com/ Fixes: 58ef4ece1e41 ("soc: qcom: pmic_glink: Introduce base PMIC GLINK driver") Cc: stable@vger.kernel.org Reviewed-by: Heikki Krogerus Reviewed-by: Neil Armstrong Tested-by: Amit Pundir Reviewed-by: Johan Hovold Acked-by: Sebastian Reichel Tested-by: Johan Hovold Signed-off-by: Bjorn Andersson Link: https://lore.kernel.org/r/20240820-pmic-glink-v6-11-races-v3-1-eec53c750a04@quicinc.com Signed-off-by: Bjorn Andersson drivers/power/supply/qcom_battmgr.c | 16 ++++++++++------ drivers/soc/qcom/pmic_glink.c | 28 ++++++++++++++++++---------- drivers/soc/qcom/pmic_glink_altmode.c | 17 +++++++++++------ drivers/usb/typec/ucsi/ucsi_glink.c | 16 ++++++++++------ include/linux/soc/qcom/pmic_glink.h | 11 ++++++----- 5 files changed, 55 insertions(+), 33 deletions(-) commit 91191a6e50a2ff752da244493171037663536768 Author: Simon Trimmer Date: Wed Aug 21 12:47:11 2024 +0000 ALSA: hda: cs35l56: Don't use the device index as a calibration index The HDA driver cannot assume that the order that the devices are specified in the cirrus,dev-index matches the order of calibration entries. Only a calibration entry with a matching silicon id will be used. Fixes: cfa43aaa7948 ("ALSA: hda: cs35l56: Apply amp calibration from EFI data") Signed-off-by: Simon Trimmer Link: https://patch.msgid.link/20240821124711.44325-1-simont@opensource.cirrus.com Signed-off-by: Takashi Iwai sound/pci/hda/cs35l56_hda.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit e0ee967630c8ee67bb47a5b38d235cd5a8789c48 Author: Jens Axboe Date: Tue Aug 20 18:31:58 2024 -0600 io_uring/kbuf: sanitize peek buffer setup Harden the buffer peeking a bit, by adding a sanity check for it having a valid size. Outside of that, arg->max_len is a size_t, though it's only ever set to a 32-bit value (as it's governed by MAX_RW_COUNT). Bump our needed check to a size_t so we know it fits. Finally, cap the calculated needed iov value to the PEEK_MAX_IMPORT, which is the maximum number of segments that should be peeked. Fixes: 35c8711c8fc4 ("io_uring/kbuf: add helpers for getting/peeking multiple buffers") Signed-off-by: Jens Axboe io_uring/kbuf.c | 9 ++++++--- 1 file changed, 6 insertions(+), 3 deletions(-) commit 0ff8f3f0979559b0d7494d580f2597beab3f159b Author: Michael Vetter Date: Mon Aug 19 22:57:31 2024 +0200 rust: kernel: fix typos in code comments Fix spelling mistakes in code comments. Signed-off-by: Michael Vetter Reviewed-by: Alice Ryhl Reviewed-by: Benno Lossin Link: https://lore.kernel.org/r/20240819205731.2163-1-jubalh@iodoru.org [ Reworded slightly. - Miguel ] Signed-off-by: Miguel Ojeda rust/kernel/init/macros.rs | 4 ++-- rust/kernel/net/phy.rs | 2 +- 2 files changed, 3 insertions(+), 3 deletions(-) commit 5d88f98b2e73b2928cab7f8bd3d67777cb9ea1e7 Author: Vincent Woltmann Date: Fri Aug 16 20:01:42 2024 +0000 docs: rust: remove unintended blockquote in Coding Guidelines An unordered list in coding-guidelines.rst was indented, producing a blockquote around it and making it look more indented than expected. Remove the indentation to only output an unordered list. Reported-by: Miguel Ojeda Closes: https://github.com/Rust-for-Linux/linux/issues/1063 Fixes: d07479b211b7 ("docs: add Rust documentation") Signed-off-by: Vincent Woltmann Link: https://lore.kernel.org/r/20240816200339.2495875-1-vincent@woltmann.art [ Reworded title. - Miguel ] Signed-off-by: Miguel Ojeda Documentation/rust/coding-guidelines.rst | 38 ++++++++++++++++---------------- 1 file changed, 19 insertions(+), 19 deletions(-) commit fd764e74e5b75512be1b55ec9680a6c35885cc63 Author: Andreas Hindborg Date: Thu Aug 15 07:49:43 2024 +0000 rust: block: fix wrong usage of lockdep API When allocating `struct gendisk`, `GenDiskBuilder` is using a dynamic lock class key without registering the key. This is an incorrect use of the API, which causes a `WARN` trace. Fix the issue by using a static lock class key, which is more appropriate for the situation anyway. Fixes: 3253aba3408a ("rust: block: introduce `kernel::block::mq` module") Reported-by: Behme Dirk (XC-CP/ESB5) Closes: https://rust-for-linux.zulipchat.com/#narrow/stream/x/topic/x/near/457090036 Signed-off-by: Andreas Hindborg Reviewed-by: Benno Lossin Reviewed-by: Gary Guo Reviewed-by: Alice Ryhl Tested-by: Dirk Behme Link: https://lore.kernel.org/r/20240815074519.2684107-3-nmi@metaspace.dk [ Applied `rustfmt`, reworded slightly and made Zulip link a permalink. - Miguel ] Signed-off-by: Miguel Ojeda rust/kernel/block/mq/gen_disk.rs | 6 ++---- 1 file changed, 2 insertions(+), 4 deletions(-) commit d4bc0a264fb482b019c84fbc7202dd3cab059087 Author: Michael Ellerman Date: Tue Aug 20 13:04:07 2024 +1000 ata: pata_macio: Use WARN instead of BUG The overflow/underflow conditions in pata_macio_qc_prep() should never happen. But if they do there's no need to kill the system entirely, a WARN and failing the IO request should be sufficient and might allow the system to keep running. Signed-off-by: Michael Ellerman Signed-off-by: Damien Le Moal drivers/ata/pata_macio.c | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) commit 822c8020aebcf5804a143b891e34f29873fee5e2 Author: Michael Ellerman Date: Tue Aug 20 13:03:58 2024 +1000 ata: pata_macio: Fix DMA table overflow Kolbjørn and Jonáš reported that their 32-bit PowerMacs were crashing in pata-macio since commit 09fe2bfa6b83 ("ata: pata_macio: Fix max_segment_size with PAGE_SIZE == 64K"). For example: kernel BUG at drivers/ata/pata_macio.c:544! Oops: Exception in kernel mode, sig: 5 [#1] BE PAGE_SIZE=4K MMU=Hash SMP NR_CPUS=2 DEBUG_PAGEALLOC PowerMac ... NIP pata_macio_qc_prep+0xf4/0x190 LR pata_macio_qc_prep+0xfc/0x190 Call Trace: 0xc1421660 (unreliable) ata_qc_issue+0x14c/0x2d4 __ata_scsi_queuecmd+0x200/0x53c ata_scsi_queuecmd+0x50/0xe0 scsi_queue_rq+0x788/0xb1c __blk_mq_issue_directly+0x58/0xf4 blk_mq_plug_issue_direct+0x8c/0x1b4 blk_mq_flush_plug_list.part.0+0x584/0x5e0 __blk_flush_plug+0xf8/0x194 __submit_bio+0x1b8/0x2e0 submit_bio_noacct_nocheck+0x230/0x304 btrfs_work_helper+0x200/0x338 process_one_work+0x1a8/0x338 worker_thread+0x364/0x4c0 kthread+0x100/0x104 start_kernel_thread+0x10/0x14 That commit increased max_segment_size to 64KB, with the justification that the SCSI core was already using that size when PAGE_SIZE == 64KB, and that there was existing logic to split over-sized requests. However with a sufficiently large request, the splitting logic causes each sg to be split into two commands in the DMA table, leading to overflow of the DMA table, triggering the BUG_ON(). With default settings the bug doesn't trigger, because the request size is limited by max_sectors_kb == 1280, however max_sectors_kb can be increased, and apparently some distros do that by default using udev rules. Fix the bug for 4KB kernels by reverting to the old max_segment_size. For 64KB kernels the sg_tablesize needs to be halved, to allow for the possibility that each sg will be split into two. Fixes: 09fe2bfa6b83 ("ata: pata_macio: Fix max_segment_size with PAGE_SIZE == 64K") Cc: stable@vger.kernel.org # v6.10+ Reported-by: Kolbjørn Barmen Closes: https://lore.kernel.org/all/62d248bb-e97a-25d2-bcf2-9160c518cae5@kolla.no/ Reported-by: Jonáš Vidra Closes: https://lore.kernel.org/all/3b6441b8-06e6-45da-9e55-f92f2c86933e@ufal.mff.cuni.cz/ Tested-by: Kolbjørn Barmen Signed-off-by: Michael Ellerman Signed-off-by: Damien Le Moal drivers/ata/pata_macio.c | 23 +++++++++++++++-------- 1 file changed, 15 insertions(+), 8 deletions(-) commit 9cead81eff635e3b3cbce51b40228f3bdc6f2b8c Author: Alex Deucher Date: Mon Aug 19 11:14:29 2024 -0400 drm/amdgpu: fix eGPU hotplug regression The driver needs to wait for the on board firmware to finish its initialization before probing the card. Commit 959056982a9b ("drm/amdgpu: Fix discovery initialization failure during pci rescan") switched from using msleep() to using usleep_range() which seems to have caused init failures on some navi1x boards. Switch back to msleep(). Fixes: 959056982a9b ("drm/amdgpu: Fix discovery initialization failure during pci rescan") Closes: https://gitlab.freedesktop.org/drm/amd/-/issues/3559 Closes: https://gitlab.freedesktop.org/drm/amd/-/issues/3500 Reviewed-by: Hawking Zhang Signed-off-by: Alex Deucher Cc: Ma Jun (cherry picked from commit c69b07f7bbc905022491c45097923d3487479529) Cc: stable@vger.kernel.org # 6.10.x drivers/gpu/drm/amd/amdgpu/amdgpu_discovery.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit c99769bceab4ecb6a067b9af11f9db281eea3e2a Author: Candice Li Date: Thu Aug 15 11:37:28 2024 +0800 drm/amdgpu: Validate TA binary size Add TA binary size validation to avoid OOB write. Signed-off-by: Candice Li Reviewed-by: Hawking Zhang Signed-off-by: Alex Deucher (cherry picked from commit c0a04e3570d72aaf090962156ad085e37c62e442) Cc: stable@vger.kernel.org drivers/gpu/drm/amd/amdgpu/amdgpu_psp_ta.c | 3 +++ 1 file changed, 3 insertions(+) commit e3e4bf58bad1576ac732a1429f53e3d4bfb82b4b Author: Alex Deucher Date: Wed Aug 14 10:28:24 2024 -0400 drm/amdgpu/sdma5.2: limit wptr workaround to sdma 5.2.1 The workaround seems to cause stability issues on other SDMA 5.2.x IPs. Fixes: a03ebf116303 ("drm/amdgpu/sdma5.2: Update wptr registers as well as doorbell") Closes: https://gitlab.freedesktop.org/drm/amd/-/issues/3556 Acked-by: Ruijing Dong Signed-off-by: Alex Deucher (cherry picked from commit 2dc3851ef7d9c5439ea8e9623fc36878f3b40649) Cc: stable@vger.kernel.org drivers/gpu/drm/amd/amdgpu/sdma_v5_2.c | 18 ++++++++++-------- 1 file changed, 10 insertions(+), 8 deletions(-) commit 0b43312902d165c4c8429cd49e8c91479f52b7c4 Author: Yang Wang Date: Tue Aug 13 13:51:48 2024 +0800 drm/amdgpu: fixing rlc firmware loading failure issue Skip rlc firmware validation to ignore firmware header size mismatch issues. This restores the workaround added in commit 849e133c973c ("drm/amdgpu: Fix the null pointer when load rlc firmware") Fixes: 3af2c80ae2f5 ("drm/amdgpu: refine gfx10 firmware loading") Closes: https://gitlab.freedesktop.org/drm/amd/-/issues/3551 Signed-off-by: Yang Wang Reviewed-by: Alex Deucher Signed-off-by: Alex Deucher (cherry picked from commit 89ec85d16eb8110d88c273d1d34f1fe5a70ba8cc) drivers/gpu/drm/amd/amdgpu/gfx_v10_0.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) commit b311c1b497e51a628aa89e7cb954481e5f9dced2 Merge: 0108b7be2a18 7c525dddbee7 Author: Linus Torvalds Date: Tue Aug 20 19:03:07 2024 -0700 Merge tag '6.11-rc4-server-fixes' of git://git.samba.org/ksmbd Pull smb server fixes from Steve French: - important reconnect fix - fix for memcpy issues on mount - two minor cleanup patches * tag '6.11-rc4-server-fixes' of git://git.samba.org/ksmbd: ksmbd: Replace one-element arrays with flexible-array members ksmbd: fix spelling mistakes in documentation ksmbd: fix race condition between destroy_previous_session() and smb2 operations() ksmbd: Use unsafe_memcpy() for ntlm_negotiate commit 0d76fc7e27b2097e18ee128e484d107ed6d45e88 Merge: c07ff8592d57 48e50dcbcbaa Author: Jakub Kicinski Date: Tue Aug 20 17:40:15 2024 -0700 Merge branch 'mptcp-pm-fix-ids-not-being-reusable' Matthieu Baerts says: ==================== mptcp: pm: fix IDs not being reusable Here are more fixes for the MPTCP in-kernel path-manager. In this series, the fixes are around the endpoint IDs not being reusable for on-going connections when re-creating endpoints with previously used IDs. - Patch 1 fixes this case for endpoints being used to send ADD_ADDR. Patch 2 validates this fix. The issue is present since v5.10. - Patch 3 fixes this case for endpoints being used to establish new subflows. Patch 4 validates this fix. The issue is present since v5.10. - Patch 5 fixes this case when all endpoints are flushed. Patch 6 validates this fix. The issue is present since v5.13. - Patch 7 removes a helper that is confusing, and introduced in v5.10. It helps simplifying the next patches. - Patch 8 makes sure a 'subflow' counter is only decremented when removing a 'subflow' endpoint. Can be backported up to v5.13. - Patch 9 is similar, but for a 'signal' counter. Can be backported up to v5.10. - Patch 10 checks the last max accepted ADD_ADDR limit before accepting new ADD_ADDR. For v5.10 as well. - Patch 11 removes a wrong restriction for the userspace PM, added during a refactoring in v6.5. - Patch 12 makes sure the fullmesh mode sets the ID 0 when a new subflow using the source address of the initial subflow is created. Patch 13 covers this case. This issue is present since v5.15. - Patch 14 avoid possible UaF when selecting an address from the endpoints list. ==================== Link: https://patch.msgid.link/20240819-net-mptcp-pm-reusing-id-v1-0-38035d40de5b@kernel.org Signed-off-by: Jakub Kicinski commit 48e50dcbcbaaf713d82bf2da5c16aeced94ad07d Author: Matthieu Baerts (NGI0) Date: Mon Aug 19 21:45:32 2024 +0200 mptcp: pm: avoid possible UaF when selecting endp select_local_address() and select_signal_address() both select an endpoint entry from the list inside an RCU protected section, but return a reference to it, to be read later on. If the entry is dereferenced after the RCU unlock, reading info could cause a Use-after-Free. A simple solution is to copy the required info while inside the RCU protected section to avoid any risk of UaF later. The address ID might need to be modified later to handle the ID0 case later, so a copy seems OK to deal with. Reported-by: Paolo Abeni Closes: https://lore.kernel.org/45cd30d3-7710-491c-ae4d-a1368c00beb1@redhat.com Fixes: 01cacb00b35c ("mptcp: add netlink-based PM") Cc: stable@vger.kernel.org Reviewed-by: Mat Martineau Signed-off-by: Matthieu Baerts (NGI0) Link: https://patch.msgid.link/20240819-net-mptcp-pm-reusing-id-v1-14-38035d40de5b@kernel.org Signed-off-by: Jakub Kicinski net/mptcp/pm_netlink.c | 64 +++++++++++++++++++++++++++----------------------- 1 file changed, 34 insertions(+), 30 deletions(-) commit 4878f9f8421f4587bee7b232c1c8a9d3a7d4d782 Author: Matthieu Baerts (NGI0) Date: Mon Aug 19 21:45:31 2024 +0200 selftests: mptcp: join: validate fullmesh endp on 1st sf This case was not covered, and the wrong ID was set before the previous commit. The rest is not modified, it is just that it will increase the code coverage. The right address ID can be verified by looking at the packet traces. We could automate that using Netfilter with some cBPF code for example, but that's always a bit cryptic. Packetdrill seems better fitted for that. Fixes: 4f49d63352da ("selftests: mptcp: add fullmesh testcases") Cc: stable@vger.kernel.org Reviewed-by: Mat Martineau Signed-off-by: Matthieu Baerts (NGI0) Link: https://patch.msgid.link/20240819-net-mptcp-pm-reusing-id-v1-13-38035d40de5b@kernel.org Signed-off-by: Jakub Kicinski tools/testing/selftests/net/mptcp/mptcp_join.sh | 1 + 1 file changed, 1 insertion(+) commit 09355f7abb9fbfc1a240be029837921ea417bf4f Author: Matthieu Baerts (NGI0) Date: Mon Aug 19 21:45:30 2024 +0200 mptcp: pm: fullmesh: select the right ID later When reacting upon the reception of an ADD_ADDR, the in-kernel PM first looks for fullmesh endpoints. If there are some, it will pick them, using their entry ID. It should set the ID 0 when using the endpoint corresponding to the initial subflow, it is a special case imposed by the MPTCP specs. Note that msk->mpc_endpoint_id might not be set when receiving the first ADD_ADDR from the server. So better to compare the addresses. Fixes: 1a0d6136c5f0 ("mptcp: local addresses fullmesh") Cc: stable@vger.kernel.org Reviewed-by: Mat Martineau Signed-off-by: Matthieu Baerts (NGI0) Link: https://patch.msgid.link/20240819-net-mptcp-pm-reusing-id-v1-12-38035d40de5b@kernel.org Signed-off-by: Jakub Kicinski net/mptcp/pm_netlink.c | 11 ++++++++++- 1 file changed, 10 insertions(+), 1 deletion(-) commit ca6e55a703ca2894611bb5c5bca8bfd2290fd91e Author: Matthieu Baerts (NGI0) Date: Mon Aug 19 21:45:29 2024 +0200 mptcp: pm: only in-kernel cannot have entries with ID 0 The ID 0 is specific per MPTCP connections. The per netns entries cannot have this special ID 0 then. But that's different for the userspace PM where the entries are per connection, they can then use this special ID 0. Fixes: f40be0db0b76 ("mptcp: unify pm get_flags_and_ifindex_by_id") Cc: stable@vger.kernel.org Acked-by: Geliang Tang Reviewed-by: Mat Martineau Signed-off-by: Matthieu Baerts (NGI0) Link: https://patch.msgid.link/20240819-net-mptcp-pm-reusing-id-v1-11-38035d40de5b@kernel.org Signed-off-by: Jakub Kicinski net/mptcp/pm.c | 3 --- net/mptcp/pm_netlink.c | 4 ++++ 2 files changed, 4 insertions(+), 3 deletions(-) commit 0137a3c7c2ea3f9df8ebfc65d78b4ba712a187bb Author: Matthieu Baerts (NGI0) Date: Mon Aug 19 21:45:28 2024 +0200 mptcp: pm: check add_addr_accept_max before accepting new ADD_ADDR The limits might have changed in between, it is best to check them before accepting new ADD_ADDR. Fixes: d0876b2284cf ("mptcp: add the incoming RM_ADDR support") Cc: stable@vger.kernel.org Reviewed-by: Mat Martineau Signed-off-by: Matthieu Baerts (NGI0) Link: https://patch.msgid.link/20240819-net-mptcp-pm-reusing-id-v1-10-38035d40de5b@kernel.org Signed-off-by: Jakub Kicinski net/mptcp/pm_netlink.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) commit 1c1f721375989579e46741f59523e39ec9b2a9bd Author: Matthieu Baerts (NGI0) Date: Mon Aug 19 21:45:27 2024 +0200 mptcp: pm: only decrement add_addr_accepted for MPJ req Adding the following warning ... WARN_ON_ONCE(msk->pm.add_addr_accepted == 0) ... before decrementing the add_addr_accepted counter helped to find a bug when running the "remove single subflow" subtest from the mptcp_join.sh selftest. Removing a 'subflow' endpoint will first trigger a RM_ADDR, then the subflow closure. Before this patch, and upon the reception of the RM_ADDR, the other peer will then try to decrement this add_addr_accepted. That's not correct because the attached subflows have not been created upon the reception of an ADD_ADDR. A way to solve that is to decrement the counter only if the attached subflow was an MP_JOIN to a remote id that was not 0, and initiated by the host receiving the RM_ADDR. Fixes: d0876b2284cf ("mptcp: add the incoming RM_ADDR support") Cc: stable@vger.kernel.org Reviewed-by: Mat Martineau Signed-off-by: Matthieu Baerts (NGI0) Link: https://patch.msgid.link/20240819-net-mptcp-pm-reusing-id-v1-9-38035d40de5b@kernel.org Signed-off-by: Jakub Kicinski net/mptcp/pm_netlink.c | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) commit 322ea3778965da72862cca2a0c50253aacf65fe6 Author: Matthieu Baerts (NGI0) Date: Mon Aug 19 21:45:26 2024 +0200 mptcp: pm: only mark 'subflow' endp as available Adding the following warning ... WARN_ON_ONCE(msk->pm.local_addr_used == 0) ... before decrementing the local_addr_used counter helped to find a bug when running the "remove single address" subtest from the mptcp_join.sh selftests. Removing a 'signal' endpoint will trigger the removal of all subflows linked to this endpoint via mptcp_pm_nl_rm_addr_or_subflow() with rm_type == MPTCP_MIB_RMSUBFLOW. This will decrement the local_addr_used counter, which is wrong in this case because this counter is linked to 'subflow' endpoints, and here it is a 'signal' endpoint that is being removed. Now, the counter is decremented, only if the ID is being used outside of mptcp_pm_nl_rm_addr_or_subflow(), only for 'subflow' endpoints, and if the ID is not 0 -- local_addr_used is not taking into account these ones. This marking of the ID as being available, and the decrement is done no matter if a subflow using this ID is currently available, because the subflow could have been closed before. Fixes: 06faa2271034 ("mptcp: remove multi addresses and subflows in PM") Cc: stable@vger.kernel.org Reviewed-by: Mat Martineau Signed-off-by: Matthieu Baerts (NGI0) Link: https://patch.msgid.link/20240819-net-mptcp-pm-reusing-id-v1-8-38035d40de5b@kernel.org Signed-off-by: Jakub Kicinski net/mptcp/pm_netlink.c | 26 +++++++++++++++++--------- 1 file changed, 17 insertions(+), 9 deletions(-) commit f448451aa62d54be16acb0034223c17e0d12bc69 Author: Matthieu Baerts (NGI0) Date: Mon Aug 19 21:45:25 2024 +0200 mptcp: pm: remove mptcp_pm_remove_subflow() This helper is confusing. It is in pm.c, but it is specific to the in-kernel PM and it cannot be used by the userspace one. Also, it simply calls one in-kernel specific function with the PM lock, while the similar mptcp_pm_remove_addr() helper requires the PM lock. What's left is the pr_debug(), which is not that useful, because a similar one is present in the only function called by this helper: mptcp_pm_nl_rm_subflow_received() After these modifications, this helper can be marked as 'static', and the lock can be taken only once in mptcp_pm_flush_addrs_and_subflows(). Note that it is not a bug fix, but it will help backporting the following commits. Fixes: 0ee4261a3681 ("mptcp: implement mptcp_pm_remove_subflow") Cc: stable@vger.kernel.org Reviewed-by: Mat Martineau Signed-off-by: Matthieu Baerts (NGI0) Link: https://patch.msgid.link/20240819-net-mptcp-pm-reusing-id-v1-7-38035d40de5b@kernel.org Signed-off-by: Jakub Kicinski net/mptcp/pm.c | 10 ---------- net/mptcp/pm_netlink.c | 16 +++++++--------- net/mptcp/protocol.h | 3 --- 3 files changed, 7 insertions(+), 22 deletions(-) commit e06959e9eebdfea4654390f53b65cff57691872e Author: Matthieu Baerts (NGI0) Date: Mon Aug 19 21:45:24 2024 +0200 selftests: mptcp: join: test for flush/re-add endpoints After having flushed endpoints that didn't cause the creation of new subflows, it is important to check endpoints can be re-created, re-using previously used IDs. Before the previous commit, the client would not have been able to re-create the subflow that was previously rejected. The 'Fixes' tag here below is the same as the one from the previous commit: this patch here is not fixing anything wrong in the selftests, but it validates the previous fix for an issue introduced by this commit ID. Fixes: 06faa2271034 ("mptcp: remove multi addresses and subflows in PM") Cc: stable@vger.kernel.org Reviewed-by: Mat Martineau Signed-off-by: Matthieu Baerts (NGI0) Link: https://patch.msgid.link/20240819-net-mptcp-pm-reusing-id-v1-6-38035d40de5b@kernel.org Signed-off-by: Jakub Kicinski tools/testing/selftests/net/mptcp/mptcp_join.sh | 30 +++++++++++++++++++++++++ 1 file changed, 30 insertions(+) commit ef34a6ea0cab1800f4b3c9c3c2cefd5091e03379 Author: Matthieu Baerts (NGI0) Date: Mon Aug 19 21:45:23 2024 +0200 mptcp: pm: re-using ID of unused flushed subflows If no subflows are attached to the 'subflow' endpoints that are being flushed, the corresponding addr IDs will not be marked as available again. Mark all ID as being available when flushing all the 'subflow' endpoints, and reset local_addr_used counter to cover these cases. Note that mptcp_pm_remove_addrs_and_subflows() helper is only called for flushing operations, not to remove a specific set of addresses and subflows. Fixes: 06faa2271034 ("mptcp: remove multi addresses and subflows in PM") Cc: stable@vger.kernel.org Reviewed-by: Mat Martineau Signed-off-by: Matthieu Baerts (NGI0) Link: https://patch.msgid.link/20240819-net-mptcp-pm-reusing-id-v1-5-38035d40de5b@kernel.org Signed-off-by: Jakub Kicinski net/mptcp/pm_netlink.c | 7 +++++++ 1 file changed, 7 insertions(+) commit 65fb58afa341ad68e71e5c4d816b407e6a683a66 Author: Matthieu Baerts (NGI0) Date: Mon Aug 19 21:45:22 2024 +0200 selftests: mptcp: join: check re-using ID of closed subflow This test extends "delete and re-add" to validate the previous commit. A new 'subflow' endpoint is added, but the subflow request will be rejected. The result is that no subflow will be established from this address. Later, the endpoint is removed and re-added after having cleared the firewall rule. Before the previous commit, the client would not have been able to create this new subflow. While at it, extra checks have been added to validate the expected numbers of MPJ and RM_ADDR. The 'Fixes' tag here below is the same as the one from the previous commit: this patch here is not fixing anything wrong in the selftests, but it validates the previous fix for an issue introduced by this commit ID. Fixes: b6c08380860b ("mptcp: remove addr and subflow in PM netlink") Cc: stable@vger.kernel.org Reviewed-by: Mat Martineau Signed-off-by: Matthieu Baerts (NGI0) Link: https://patch.msgid.link/20240819-net-mptcp-pm-reusing-id-v1-4-38035d40de5b@kernel.org Signed-off-by: Jakub Kicinski tools/testing/selftests/net/mptcp/mptcp_join.sh | 27 ++++++++++++++++++++----- 1 file changed, 22 insertions(+), 5 deletions(-) commit edd8b5d868a4d459f3065493001e293901af758d Author: Matthieu Baerts (NGI0) Date: Mon Aug 19 21:45:21 2024 +0200 mptcp: pm: re-using ID of unused removed subflows If no subflow is attached to the 'subflow' endpoint that is being removed, the addr ID will not be marked as available again. Mark the linked ID as available when removing the 'subflow' endpoint if no subflow is attached to it. While at it, the local_addr_used counter is decremented if the ID was marked as being used to reflect the reality, but also to allow adding new endpoints after that. Fixes: b6c08380860b ("mptcp: remove addr and subflow in PM netlink") Cc: stable@vger.kernel.org Reviewed-by: Mat Martineau Signed-off-by: Matthieu Baerts (NGI0) Link: https://patch.msgid.link/20240819-net-mptcp-pm-reusing-id-v1-3-38035d40de5b@kernel.org Signed-off-by: Jakub Kicinski net/mptcp/pm_netlink.c | 11 ++++++++++- 1 file changed, 10 insertions(+), 1 deletion(-) commit a13d5aad4dd9a309eecdc33cfd75045bd5f376a3 Author: Matthieu Baerts (NGI0) Date: Mon Aug 19 21:45:20 2024 +0200 selftests: mptcp: join: check re-using ID of unused ADD_ADDR This test extends "delete re-add signal" to validate the previous commit. An extra address is announced by the server, but this address cannot be used by the client. The result is that no subflow will be established to this address. Later, the server will delete this extra endpoint, and set a new one, with a valid address, but re-using the same ID. Before the previous commit, the server would not have been able to announce this new address. While at it, extra checks have been added to validate the expected numbers of MPJ, ADD_ADDR and RM_ADDR. The 'Fixes' tag here below is the same as the one from the previous commit: this patch here is not fixing anything wrong in the selftests, but it validates the previous fix for an issue introduced by this commit ID. Fixes: b6c08380860b ("mptcp: remove addr and subflow in PM netlink") Cc: stable@vger.kernel.org Reviewed-by: Mat Martineau Signed-off-by: Matthieu Baerts (NGI0) Link: https://patch.msgid.link/20240819-net-mptcp-pm-reusing-id-v1-2-38035d40de5b@kernel.org Signed-off-by: Jakub Kicinski tools/testing/selftests/net/mptcp/mptcp_join.sh | 18 +++++++++++++----- 1 file changed, 13 insertions(+), 5 deletions(-) commit e255683c06df572ead96db5efb5d21be30c0efaa Author: Matthieu Baerts (NGI0) Date: Mon Aug 19 21:45:19 2024 +0200 mptcp: pm: re-using ID of unused removed ADD_ADDR If no subflow is attached to the 'signal' endpoint that is being removed, the addr ID will not be marked as available again. Mark the linked ID as available when removing the address entry from the list to cover this case. Fixes: b6c08380860b ("mptcp: remove addr and subflow in PM netlink") Cc: stable@vger.kernel.org Reviewed-by: Mat Martineau Signed-off-by: Matthieu Baerts (NGI0) Link: https://patch.msgid.link/20240819-net-mptcp-pm-reusing-id-v1-1-38035d40de5b@kernel.org Signed-off-by: Jakub Kicinski net/mptcp/pm_netlink.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) commit 0005e01e1e875c5e27130c5e2ed0189749d1e08a Author: Gao Xiang Date: Tue Aug 20 16:56:19 2024 +0800 erofs: fix out-of-bound access when z_erofs_gbuf_growsize() partially fails If z_erofs_gbuf_growsize() partially fails on a global buffer due to memory allocation failure or fault injection (as reported by syzbot [1]), new pages need to be freed by comparing to the existing pages to avoid memory leaks. However, the old gbuf->pages[] array may not be large enough, which can lead to null-ptr-deref or out-of-bound access. Fix this by checking against gbuf->nrpages in advance. [1] https://lore.kernel.org/r/000000000000f7b96e062018c6e3@google.com Reported-by: syzbot+242ee56aaa9585553766@syzkaller.appspotmail.com Fixes: d6db47e571dc ("erofs: do not use pagepool in z_erofs_gbuf_growsize()") Cc: # 6.10+ Reviewed-by: Chunhai Guo Reviewed-by: Sandeep Dhavale Signed-off-by: Gao Xiang Link: https://lore.kernel.org/r/20240820085619.1375963-1-hsiangkao@linux.alibaba.com fs/erofs/zutil.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) commit c07ff8592d57ed258afee5a5e04991a48dbaf382 Author: Stephen Hemminger Date: Mon Aug 19 10:56:45 2024 -0700 netem: fix return value if duplicate enqueue fails There is a bug in netem_enqueue() introduced by commit 5845f706388a ("net: netem: fix skb length BUG_ON in __skb_to_sgvec") that can lead to a use-after-free. This commit made netem_enqueue() always return NET_XMIT_SUCCESS when a packet is duplicated, which can cause the parent qdisc's q.qlen to be mistakenly incremented. When this happens qlen_notify() may be skipped on the parent during destruction, leaving a dangling pointer for some classful qdiscs like DRR. There are two ways for the bug happen: - If the duplicated packet is dropped by rootq->enqueue() and then the original packet is also dropped. - If rootq->enqueue() sends the duplicated packet to a different qdisc and the original packet is dropped. In both cases NET_XMIT_SUCCESS is returned even though no packets are enqueued at the netem qdisc. The fix is to defer the enqueue of the duplicate packet until after the original packet has been guaranteed to return NET_XMIT_SUCCESS. Fixes: 5845f706388a ("net: netem: fix skb length BUG_ON in __skb_to_sgvec") Reported-by: Budimir Markovic Signed-off-by: Stephen Hemminger Reviewed-by: Simon Horman Link: https://patch.msgid.link/20240819175753.5151-1-stephen@networkplumber.org Signed-off-by: Jakub Kicinski net/sched/sch_netem.c | 47 +++++++++++++++++++++++++++++------------------ 1 file changed, 29 insertions(+), 18 deletions(-) commit 528876d867a23b5198022baf2e388052ca67c952 Author: Joseph Huang Date: Mon Aug 19 19:52:50 2024 -0400 net: dsa: mv88e6xxx: Fix out-of-bound access If an ATU violation was caused by a CPU Load operation, the SPID could be larger than DSA_MAX_PORTS (the size of mv88e6xxx_chip.ports[] array). Fixes: 75c05a74e745 ("net: dsa: mv88e6xxx: Fix counting of ATU violations") Signed-off-by: Joseph Huang Reviewed-by: Andrew Lunn Link: https://patch.msgid.link/20240819235251.1331763-1-Joseph.Huang@garmin.com Signed-off-by: Jakub Kicinski drivers/net/dsa/mv88e6xxx/global1_atu.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) commit b8673d56935c32a4e0a1a0b40951fdd313dbf340 Author: Andreas Hindborg Date: Thu Aug 15 07:49:30 2024 +0000 rust: kbuild: fix export of bss symbols Symbols in the bss segment are not currently exported. This is a problem for Rust modules that link against statics, that are resident in the kernel image. Thus export symbols in the bss segment. Fixes: 2f7ab1267dc9 ("Kbuild: add Rust support") Signed-off-by: Andreas Hindborg Reviewed-by: Alice Ryhl Tested-by: Alice Ryhl Reviewed-by: Gary Guo Link: https://lore.kernel.org/r/20240815074519.2684107-2-nmi@metaspace.dk [ Reworded slightly. - Miguel ] Signed-off-by: Miguel Ojeda rust/Makefile | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 0108b7be2a18d85face1e10c68ecc0138f1bed58 Merge: 521b1e7f4cf0 cf1e515c9a40 Author: Linus Torvalds Date: Tue Aug 20 16:06:39 2024 -0700 Merge tag 'for-linus-iommufd' of git://git.kernel.org/pub/scm/linux/kernel/git/jgg/iommufd Pull iommufd fixes from Jason Gunthorpe: - Incorrect error unwind in iommufd_device_do_replace() - Correct a sparse warning missing static * tag 'for-linus-iommufd' of git://git.kernel.org/pub/scm/linux/kernel/git/jgg/iommufd: iommufd/selftest: Make dirty_ops static iommufd/device: Fix hwpt at err_unresv in iommufd_device_do_replace() commit 6efea5135417ae8194485d1d05ea79a21cf1a11c Author: Martin Whitaker Date: Sat Aug 17 10:41:41 2024 +0100 net: dsa: microchip: fix PTP config failure when using multiple ports When performing the port_hwtstamp_set operation, ptp_schedule_worker() will be called if hardware timestamoing is enabled on any of the ports. When using multiple ports for PTP, port_hwtstamp_set is executed for each port. When called for the first time ptp_schedule_worker() returns 0. On subsequent calls it returns 1, indicating the worker is already scheduled. Currently the ksz driver treats 1 as an error and fails to complete the port_hwtstamp_set operation, thus leaving the timestamping configuration for those ports unchanged. This patch fixes this by ignoring the ptp_schedule_worker() return value. Cc: stable@vger.kernel.org Link: https://lore.kernel.org/7aae307a-35ca-4209-a850-7b2749d40f90@martin-whitaker.me.uk Fixes: bb01ad30570b0 ("net: dsa: microchip: ptp: manipulating absolute time using ptp hw clock") Signed-off-by: Martin Whitaker Reviewed-by: Andrew Lunn Acked-by: Arun Ramadoss Link: https://patch.msgid.link/20240817094141.3332-1-foss@martin-whitaker.me.uk Signed-off-by: Jakub Kicinski drivers/net/dsa/microchip/ksz_ptp.c | 5 +---- 1 file changed, 1 insertion(+), 4 deletions(-) commit 8aba27c4a5020abdf60149239198297f88338a8d Author: Paolo Abeni Date: Fri Aug 16 17:20:34 2024 +0200 igb: cope with large MAX_SKB_FRAGS Sabrina reports that the igb driver does not cope well with large MAX_SKB_FRAG values: setting MAX_SKB_FRAG to 45 causes payload corruption on TX. An easy reproducer is to run ssh to connect to the machine. With MAX_SKB_FRAGS=17 it works, with MAX_SKB_FRAGS=45 it fails. This has been reported originally in https://bugzilla.redhat.com/show_bug.cgi?id=2265320 The root cause of the issue is that the driver does not take into account properly the (possibly large) shared info size when selecting the ring layout, and will try to fit two packets inside the same 4K page even when the 1st fraglist will trump over the 2nd head. Address the issue by checking if 2K buffers are insufficient. Fixes: 3948b05950fd ("net: introduce a config option to tweak MAX_SKB_FRAGS") Reported-by: Jan Tluka Reported-by: Jirka Hladky Reported-by: Sabrina Dubroca Tested-by: Sabrina Dubroca Tested-by: Corinna Vinschen Signed-off-by: Paolo Abeni Signed-off-by: Corinna Vinschen Link: https://patch.msgid.link/20240816152034.1453285-1-vinschen@redhat.com Signed-off-by: Jakub Kicinski drivers/net/ethernet/intel/igb/igb_main.c | 1 + 1 file changed, 1 insertion(+) commit 80a1e7b83bb1834b5568a3872e64c05795d88f31 Author: Nikolay Kuratov Date: Mon Aug 19 10:54:08 2024 +0300 cxgb4: add forgotten u64 ivlan cast before shift It is done everywhere in cxgb4 code, e.g. in is_filter_exact_match() There is no reason it should not be done here Found by Linux Verification Center (linuxtesting.org) with SVACE Signed-off-by: Nikolay Kuratov Cc: stable@vger.kernel.org Fixes: 12b276fbf6e0 ("cxgb4: add support to create hash filters") Reviewed-by: Simon Horman Reviewed-by: Jacob Keller Link: https://patch.msgid.link/20240819075408.92378-1-kniv@yandex-team.ru Signed-off-by: Jakub Kicinski drivers/net/ethernet/chelsio/cxgb4/cxgb4_filter.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) commit c50e7475961c36ec4d21d60af055b32f9436b431 Author: Dan Carpenter Date: Sat Aug 17 09:52:46 2024 +0300 dpaa2-switch: Fix error checking in dpaa2_switch_seed_bp() The dpaa2_switch_add_bufs() function returns the number of bufs that it was able to add. It returns BUFS_PER_CMD (7) for complete success or a smaller number if there are not enough pages available. However, the error checking is looking at the total number of bufs instead of the number which were added on this iteration. Thus the error checking only works correctly for the first iteration through the loop and subsequent iterations are always counted as a success. Fix this by checking only the bufs added in the current iteration. Fixes: 0b1b71370458 ("staging: dpaa2-switch: handle Rx path on control interface") Signed-off-by: Dan Carpenter Reviewed-by: Simon Horman Reviewed-by: Ioana Ciornei Tested-by: Ioana Ciornei Link: https://patch.msgid.link/eec27f30-b43f-42b6-b8ee-04a6f83423b6@stanley.mountain Signed-off-by: Jakub Kicinski drivers/net/ethernet/freescale/dpaa2/dpaa2-switch.c | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) commit 503ab6ee40fc103ea55cc9e50bb879e571d65aac Author: Michal Swiatkowski Date: Mon Aug 19 09:17:42 2024 +0200 ice: use internal pf id instead of function number Use always the same pf id in devlink port number. When doing pass-through the PF to VM bus info func number can be any value. Fixes: 2ae0aa4758b0 ("ice: Move devlink port to PF/VF struct") Reviewed-by: Wojciech Drewek Suggested-by: Jiri Pirko Signed-off-by: Michal Swiatkowski Signed-off-by: Tony Nguyen drivers/net/ethernet/intel/ice/devlink/devlink_port.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) commit d53d4dcce69be5773e2d0878c9899ebfbf58c393 Author: Maciej Fijalkowski Date: Wed Aug 7 12:53:26 2024 +0200 ice: fix truesize operations for PAGE_SIZE >= 8192 When working on multi-buffer packet on arch that has PAGE_SIZE >= 8192, truesize is calculated and stored in xdp_buff::frame_sz per each processed Rx buffer. This means that frame_sz will contain the truesize based on last received buffer, but commit 1dc1a7e7f410 ("ice: Centrallize Rx buffer recycling") assumed this value will be constant for each buffer, which breaks the page recycling scheme and mess up the way we update the page::page_offset. To fix this, let us work on constant truesize when PAGE_SIZE >= 8192 instead of basing this on size of a packet read from Rx descriptor. This way we can simplify the code and avoid calculating truesize per each received frame and on top of that when using xdp_update_skb_shared_info(), current formula for truesize update will be valid. This means ice_rx_frame_truesize() can be removed altogether. Furthermore, first call to it within ice_clean_rx_irq() for 4k PAGE_SIZE was redundant as xdp_buff::frame_sz is initialized via xdp_init_buff() in ice_vsi_cfg_rxq(). This should have been removed at the point where xdp_buff struct started to be a member of ice_rx_ring and it was no longer a stack based variable. There are two fixes tags as my understanding is that the first one exposed us to broken truesize and page_offset handling and then second introduced broken skb_shared_info update in ice_{construct,build}_skb(). Reported-and-tested-by: Luiz Capitulino Closes: https://lore.kernel.org/netdev/8f9e2a5c-fd30-4206-9311-946a06d031bb@redhat.com/ Fixes: 1dc1a7e7f410 ("ice: Centrallize Rx buffer recycling") Fixes: 2fba7dc5157b ("ice: Add support for XDP multi-buffer on Rx side") Signed-off-by: Maciej Fijalkowski Tested-by: Chandan Kumar Rout (A Contingent Worker at Intel) Signed-off-by: Tony Nguyen drivers/net/ethernet/intel/ice/ice_base.c | 21 +++++++++++++++++++- drivers/net/ethernet/intel/ice/ice_txrx.c | 33 ------------------------------- 2 files changed, 20 insertions(+), 34 deletions(-) commit b966ad832942b5a11e002f9b5ef102b08425b84a Author: Maciej Fijalkowski Date: Wed Aug 7 12:53:25 2024 +0200 ice: fix ICE_LAST_OFFSET formula For bigger PAGE_SIZE archs, ice driver works on 3k Rx buffers. Therefore, ICE_LAST_OFFSET should take into account ICE_RXBUF_3072, not ICE_RXBUF_2048. Fixes: 7237f5b0dba4 ("ice: introduce legacy Rx flag") Suggested-by: Luiz Capitulino Signed-off-by: Maciej Fijalkowski Tested-by: Chandan Kumar Rout (A Contingent Worker at Intel) Signed-off-by: Tony Nguyen drivers/net/ethernet/intel/ice/ice_txrx.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 50b2143356e888777fc5bca023c39f34f404613a Author: Maciej Fijalkowski Date: Wed Aug 7 12:53:24 2024 +0200 ice: fix page reuse when PAGE_SIZE is over 8k Architectures that have PAGE_SIZE >= 8192 such as arm64 should act the same as x86 currently, meaning reuse of a page should only take place when no one else is busy with it. Do two things independently of underlying PAGE_SIZE: - store the page count under ice_rx_buf::pgcnt - then act upon its value vs ice_rx_buf::pagecnt_bias when making the decision regarding page reuse Fixes: 2b245cb29421 ("ice: Implement transmit and NAPI support") Signed-off-by: Maciej Fijalkowski Tested-by: Chandan Kumar Rout (A Contingent Worker at Intel) Signed-off-by: Tony Nguyen drivers/net/ethernet/intel/ice/ice_txrx.c | 12 +++--------- 1 file changed, 3 insertions(+), 9 deletions(-) commit 521b1e7f4cf0b05a47995b103596978224b380a8 Merge: 6e4436539ae1 2c402bd2e85b Author: Linus Torvalds Date: Tue Aug 20 08:37:08 2024 -0700 Merge tag 'cxl-fixes-6.11-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/cxl/cxl Pull cxl fixes from Dave Jiang: "Check for RCH dport before accessing pci_host_bridge and a fix to address a KASAN warning for the cxl regression test suite cxl-test" * tag 'cxl-fixes-6.11-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/cxl/cxl: cxl/test: Skip cxl_setup_parent_dport() for emulated dports cxl/pci: Get AER capability address from RCRB only for RCH dport commit c5af2c90ba5629f0424a8d315f75fb8d91713c3c Author: Ma Ke Date: Tue Aug 20 17:28:43 2024 +0800 irqchip/gic-v2m: Fix refcount leak in gicv2m_of_init() gicv2m_of_init() fails to perform an of_node_put() when of_address_to_resource() fails, leading to a refcount leak. Address this by moving the error handling path outside of the loop and making it common to all failure modes. Fixes: 4266ab1a8ff5 ("irqchip/gic-v2m: Refactor to prepare for ACPI support") Signed-off-by: Ma Ke Signed-off-by: Thomas Gleixner Reviewed-by: Marc Zyngier Cc: stable@vger.kernel.org Link: https://lore.kernel.org/all/20240820092843.1219933-1-make24@iscas.ac.cn drivers/irqchip/irq-gic-v2m.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) commit efe81b7bdf7d882d0ce3d183f1571321046da8f1 Author: Dan Carpenter Date: Tue Aug 20 11:42:40 2024 +0300 irqchip/riscv-aplic: Fix an IS_ERR() vs NULL bug in probe() The devm_platform_ioremap_resource() function doesn't return NULL, it returns error pointers. Fix the error handling to match. Fixes: 2333df5ae51e ("irqchip: Add RISC-V advanced PLIC driver for direct-mode") Signed-off-by: Dan Carpenter Signed-off-by: Thomas Gleixner Reviewed-by: Jinjie Ruan Reviewed-by: Anup Patel Cc: stable@vger.kernel.org Link: https://lore.kernel.org/all/a5a628d6-81d8-4933-81a8-64aad4743ec4@stanley.mountain drivers/irqchip/irq-riscv-aplic-main.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) commit f97fd458763a4801d04dbb4a79d9ca6282d293ec Author: Marc Zyngier Date: Sun Aug 18 18:16:25 2024 +0100 irqchip/gic-v4: Fix ordering between vmapp and vpe locks The recently established lock ordering mandates that the per-VM vmapp_lock is acquired before taking the per-VPE lock. As it turns out, its_vpe_set_affinity() takes the VPE lock, and then calls into its_send_vmovp(), which itself takes the vmapp lock. Obviously, this is a lock order violation. As its_send_vmovp() is only called from its_vpe_set_affinity(), hoist the vmapp locking from the former into the latter, restoring the expected order. Fixes: f0eb154c39471 ("irqchip/gic-v4: Substitute vmovp_lock for a per-VM lock") Reported-by: Zhou Wang Signed-off-by: Marc Zyngier Signed-off-by: Thomas Gleixner Link: https://lore.kernel.org/all/20240818171625.3030584-1-maz@kernel.org drivers/irqchip/irq-gic-v3-its.c | 16 ++++++++++------ 1 file changed, 10 insertions(+), 6 deletions(-) commit 4d936f10ff80274841537a26d1fbfe9984de0ef9 Author: Anup Patel Date: Tue Aug 20 09:18:50 2024 +0530 irqchip/sifive-plic: Probe plic driver early for Allwinner D1 platform The latest Linux RISC-V no longer boots on the Allwinner D1 platform because the sun4i_timer driver fails to get an interrupt from PLIC due to the recent conversion of the PLIC to a platform driver. Converting the sun4i timer to a platform driver does not work either because the D1 does not have a SBI timer available so early boot hangs. See the 'Closes:' link for deeper analysis. The real fix requires enabling the SBI time extension in the platform firmware (OpenSBI) and convert sun4i_timer into platform driver. Unfortunately, the real fix involves changing multiple places and can't be achieved in a short duration and aside of that requires users to update firmware. As a work-around, retrofit PLIC probing such that the PLIC is probed early only for the Allwinner D1 platform and probed as a regular platform driver for rest of the RISC-V platforms. In the process, partially revert some of the previous changes because the PLIC device pointer is not available in all probing paths. Fixes: e306a894bd51 ("irqchip/sifive-plic: Chain to parent IRQ after handlers are ready") Fixes: 8ec99b033147 ("irqchip/sifive-plic: Convert PLIC driver into a platform driver") Suggested-by: Thomas Gleixner Signed-off-by: Anup Patel Signed-off-by: Thomas Gleixner Tested-by: Samuel Holland Tested-by: Emil Renner Berthing Tested-by: Charlie Jenkins Reviewed-by: Samuel Holland Reviewed-by: Charlie Jenkins Cc: stable@vger.kernel.org Link: https://lore.kernel.org/all/20240820034850.3189912-1-apatel@ventanamicro.com Closes: https://lore.kernel.org/lkml/20240814145642.344485-1-emil.renner.berthing@canonical.com/ drivers/irqchip/irq-sifive-plic.c | 115 +++++++++++++++++++++++--------------- 1 file changed, 71 insertions(+), 44 deletions(-) commit 7565c39da89dc6ac9b1b0733bd70276bc66612b1 Merge: 4b3e33fcc38f c4c5c5d2ef40 Author: Paolo Abeni Date: Tue Aug 20 15:30:37 2024 +0200 Merge branch 'bonding-fix-xfrm-offload-bugs' Nikolay Aleksandrov says: ==================== bonding: fix xfrm offload bugs I noticed these problems while reviewing a bond xfrm patch recently. The fixes are straight-forward, please review carefully the last one because it has side-effects. This set has passed bond's selftests and my custom bond stress tests which crash without these fixes. Note the first patch is not critical, but it simplifies the next fix. ==================== Link: https://patch.msgid.link/20240816114813.326645-1-razor@blackwall.org Signed-off-by: Paolo Abeni commit c4c5c5d2ef40a9f67a9241dc5422eac9ffe19547 Author: Nikolay Aleksandrov Date: Fri Aug 16 14:48:13 2024 +0300 bonding: fix xfrm state handling when clearing active slave If the active slave is cleared manually the xfrm state is not flushed. This leads to xfrm add/del imbalance and adding the same state multiple times. For example when the device cannot handle anymore states we get: [ 1169.884811] bond0: (slave eni0np1): bond_ipsec_add_sa_all: failed to add SA because it's filled with the same state after multiple active slave clearings. This change also has a few nice side effects: user-space gets a notification for the change, the old device gets its mac address and promisc/mcast adjusted properly. Fixes: 18cb261afd7b ("bonding: support hardware encryption offload to slaves") Signed-off-by: Nikolay Aleksandrov Reviewed-by: Hangbin Liu Signed-off-by: Paolo Abeni drivers/net/bonding/bond_options.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit f8cde9805981c50d0c029063dc7d82821806fc44 Author: Nikolay Aleksandrov Date: Fri Aug 16 14:48:12 2024 +0300 bonding: fix xfrm real_dev null pointer dereference We shouldn't set real_dev to NULL because packets can be in transit and xfrm might call xdo_dev_offload_ok() in parallel. All callbacks assume real_dev is set. Example trace: kernel: BUG: unable to handle page fault for address: 0000000000001030 kernel: bond0: (slave eni0np1): making interface the new active one kernel: #PF: supervisor write access in kernel mode kernel: #PF: error_code(0x0002) - not-present page kernel: PGD 0 P4D 0 kernel: Oops: 0002 [#1] PREEMPT SMP kernel: CPU: 4 PID: 2237 Comm: ping Not tainted 6.7.7+ #12 kernel: Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-2.fc40 04/01/2014 kernel: RIP: 0010:nsim_ipsec_offload_ok+0xc/0x20 [netdevsim] kernel: bond0: (slave eni0np1): bond_ipsec_add_sa_all: failed to add SA kernel: Code: e0 0f 0b 48 83 7f 38 00 74 de 0f 0b 48 8b 47 08 48 8b 37 48 8b 78 40 e9 b2 e5 9a d7 66 90 0f 1f 44 00 00 48 8b 86 80 02 00 00 <83> 80 30 10 00 00 01 b8 01 00 00 00 c3 0f 1f 80 00 00 00 00 0f 1f kernel: bond0: (slave eni0np1): making interface the new active one kernel: RSP: 0018:ffffabde81553b98 EFLAGS: 00010246 kernel: bond0: (slave eni0np1): bond_ipsec_add_sa_all: failed to add SA kernel: kernel: RAX: 0000000000000000 RBX: ffff9eb404e74900 RCX: ffff9eb403d97c60 kernel: RDX: ffffffffc090de10 RSI: ffff9eb404e74900 RDI: ffff9eb3c5de9e00 kernel: RBP: ffff9eb3c0a42000 R08: 0000000000000010 R09: 0000000000000014 kernel: R10: 7974203030303030 R11: 3030303030303030 R12: 0000000000000000 kernel: R13: ffff9eb3c5de9e00 R14: ffffabde81553cc8 R15: ffff9eb404c53000 kernel: FS: 00007f2a77a3ad00(0000) GS:ffff9eb43bd00000(0000) knlGS:0000000000000000 kernel: CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 kernel: CR2: 0000000000001030 CR3: 00000001122ab000 CR4: 0000000000350ef0 kernel: bond0: (slave eni0np1): making interface the new active one kernel: Call Trace: kernel: kernel: ? __die+0x1f/0x60 kernel: bond0: (slave eni0np1): bond_ipsec_add_sa_all: failed to add SA kernel: ? page_fault_oops+0x142/0x4c0 kernel: ? do_user_addr_fault+0x65/0x670 kernel: ? kvm_read_and_reset_apf_flags+0x3b/0x50 kernel: bond0: (slave eni0np1): making interface the new active one kernel: ? exc_page_fault+0x7b/0x180 kernel: ? asm_exc_page_fault+0x22/0x30 kernel: ? nsim_bpf_uninit+0x50/0x50 [netdevsim] kernel: bond0: (slave eni0np1): bond_ipsec_add_sa_all: failed to add SA kernel: ? nsim_ipsec_offload_ok+0xc/0x20 [netdevsim] kernel: bond0: (slave eni0np1): making interface the new active one kernel: bond_ipsec_offload_ok+0x7b/0x90 [bonding] kernel: xfrm_output+0x61/0x3b0 kernel: bond0: (slave eni0np1): bond_ipsec_add_sa_all: failed to add SA kernel: ip_push_pending_frames+0x56/0x80 Fixes: 18cb261afd7b ("bonding: support hardware encryption offload to slaves") Signed-off-by: Nikolay Aleksandrov Reviewed-by: Hangbin Liu Signed-off-by: Paolo Abeni drivers/net/bonding/bond_main.c | 1 - 1 file changed, 1 deletion(-) commit 95c90e4ad89d493a7a14fa200082e466e2548f9d Author: Nikolay Aleksandrov Date: Fri Aug 16 14:48:11 2024 +0300 bonding: fix null pointer deref in bond_ipsec_offload_ok We must check if there is an active slave before dereferencing the pointer. Fixes: 18cb261afd7b ("bonding: support hardware encryption offload to slaves") Signed-off-by: Nikolay Aleksandrov Reviewed-by: Hangbin Liu Reviewed-by: Eric Dumazet Signed-off-by: Paolo Abeni drivers/net/bonding/bond_main.c | 2 ++ 1 file changed, 2 insertions(+) commit fc59b9a5f7201b9f7272944596113a82cc7773d5 Author: Nikolay Aleksandrov Date: Fri Aug 16 14:48:10 2024 +0300 bonding: fix bond_ipsec_offload_ok return type Fix the return type which should be bool. Fixes: 955b785ec6b3 ("bonding: fix suspicious RCU usage in bond_ipsec_offload_ok()") Signed-off-by: Nikolay Aleksandrov Reviewed-by: Hangbin Liu Signed-off-by: Paolo Abeni drivers/net/bonding/bond_main.c | 18 ++++++------------ 1 file changed, 6 insertions(+), 12 deletions(-) commit 783bf5d09f86b9736605f3e01a3472e55ef98ff8 Author: Carlos Song Date: Tue Aug 20 15:06:58 2024 +0800 spi: spi-fsl-lpspi: limit PRESCALE bit in TCR register Referring to the errata ERR051608 of I.MX93, LPSPI TCR[PRESCALE] can only be configured to be 0 or 1, other values are not valid and will cause LPSPI to not work. Add the prescale limitation for LPSPI in I.MX93. Other platforms are not affected. Signed-off-by: Carlos Song Link: https://patch.msgid.link/20240820070658.672127-1-carlos.song@nxp.com Signed-off-by: Mark Brown drivers/spi/spi-fsl-lpspi.c | 31 +++++++++++++++++++++++++++++-- 1 file changed, 29 insertions(+), 2 deletions(-) commit a1e627af32ed60713941cbfc8075d44cad07f6dd Author: Dan Carpenter Date: Tue Aug 20 11:44:08 2024 +0300 mmc: mmc_test: Fix NULL dereference on allocation failure If the "test->highmem = alloc_pages()" allocation fails then calling __free_pages(test->highmem) will result in a NULL dereference. Also change the error code to -ENOMEM instead of returning success. Fixes: 2661081f5ab9 ("mmc_test: highmem tests") Signed-off-by: Dan Carpenter Link: https://lore.kernel.org/r/8c90be28-67b4-4b0d-a105-034dc72a0b31@stanley.mountain Signed-off-by: Ulf Hansson drivers/mmc/core/mmc_test.c | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-) commit ea72ce5da22806d5713f3ffb39a6d5ae73841f93 Author: Thomas Gleixner Date: Wed Aug 14 00:29:36 2024 +0200 x86/kaslr: Expose and use the end of the physical memory address space iounmap() on x86 occasionally fails to unmap because the provided valid ioremap address is not below high_memory. It turned out that this happens due to KASLR. KASLR uses the full address space between PAGE_OFFSET and vaddr_end to randomize the starting points of the direct map, vmalloc and vmemmap regions. It thereby limits the size of the direct map by using the installed memory size plus an extra configurable margin for hot-plug memory. This limitation is done to gain more randomization space because otherwise only the holes between the direct map, vmalloc, vmemmap and vaddr_end would be usable for randomizing. The limited direct map size is not exposed to the rest of the kernel, so the memory hot-plug and resource management related code paths still operate under the assumption that the available address space can be determined with MAX_PHYSMEM_BITS. request_free_mem_region() allocates from (1 << MAX_PHYSMEM_BITS) - 1 downwards. That means the first allocation happens past the end of the direct map and if unlucky this address is in the vmalloc space, which causes high_memory to become greater than VMALLOC_START and consequently causes iounmap() to fail for valid ioremap addresses. MAX_PHYSMEM_BITS cannot be changed for that because the randomization does not align with address bit boundaries and there are other places which actually require to know the maximum number of address bits. All remaining usage sites of MAX_PHYSMEM_BITS have been analyzed and found to be correct. Cure this by exposing the end of the direct map via PHYSMEM_END and use that for the memory hot-plug and resource management related places instead of relying on MAX_PHYSMEM_BITS. In the KASLR case PHYSMEM_END maps to a variable which is initialized by the KASLR initialization and otherwise it is based on MAX_PHYSMEM_BITS as before. To prevent future hickups add a check into add_pages() to catch callers trying to add memory above PHYSMEM_END. Fixes: 0483e1fa6e09 ("x86/mm: Implement ASLR for kernel memory regions") Reported-by: Max Ramanouski Reported-by: Alistair Popple Signed-off-by: Thomas Gleixner Tested-By: Max Ramanouski Tested-by: Alistair Popple Reviewed-by: Dan Williams Reviewed-by: Alistair Popple Reviewed-by: Kees Cook Cc: stable@vger.kernel.org Link: https://lore.kernel.org/all/87ed6soy3z.ffs@tglx arch/x86/include/asm/page_64.h | 1 + arch/x86/include/asm/pgtable_64_types.h | 4 ++++ arch/x86/mm/init_64.c | 4 ++++ arch/x86/mm/kaslr.c | 32 ++++++++++++++++++++++++++------ include/linux/mm.h | 4 ++++ kernel/resource.c | 6 ++---- mm/memory_hotplug.c | 2 +- mm/sparse.c | 2 +- 8 files changed, 43 insertions(+), 12 deletions(-) commit 6275c7bc8dd07644ea8142a1773d826800f0f3f7 Author: Ben Whitten Date: Sun Aug 11 22:22:11 2024 +0100 mmc: dw_mmc: allow biu and ciu clocks to defer Fix a race condition if the clock provider comes up after mmc is probed, this causes mmc to fail without retrying. When given the DEFER error from the clk source, pass it on up the chain. Fixes: f90a0612f0e1 ("mmc: dw_mmc: lookup for optional biu and ciu clocks") Signed-off-by: Ben Whitten Cc: stable@vger.kernel.org Link: https://lore.kernel.org/r/20240811212212.123255-1-ben.whitten@gmail.com Signed-off-by: Ulf Hansson drivers/mmc/host/dw_mmc.c | 8 ++++++++ 1 file changed, 8 insertions(+) commit 4b3e33fcc38f7750604b065c55a43e94c5bc3145 Author: Thomas Bogendoerfer Date: Thu Aug 15 17:14:16 2024 +0200 ip6_tunnel: Fix broken GRO GRO code checks for matching layer 2 headers to see, if packet belongs to the same flow and because ip6 tunnel set dev->hard_header_len this check fails in cases, where it shouldn't. To fix this don't set hard_header_len, but use needed_headroom like ipv4/ip_tunnel.c does. Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Signed-off-by: Thomas Bogendoerfer Link: https://patch.msgid.link/20240815151419.109864-1-tbogendoerfer@suse.de Signed-off-by: Paolo Abeni net/ipv6/ip6_tunnel.c | 12 +++++++----- 1 file changed, 7 insertions(+), 5 deletions(-) commit 46ee21e9f59205e54943dfe51b2dc8a9352ca37d Author: Srinivas Pandruvada Date: Fri Aug 16 09:36:26 2024 -0700 platform/x86: ISST: Fix return value on last invalid resource When only the last resource is invalid, tpmi_sst_dev_add() is returing error even if there are other valid resources before. This function should return error when there are no valid resources. Here tpmi_sst_dev_add() is returning "ret" variable. But this "ret" variable contains the failure status of last call to sst_main(), which failed for the invalid resource. But there may be other valid resources before the last entry. To address this, do not update "ret" variable for sst_main() return status. If there are no valid resources, it is already checked for by !inst below the loop and -ENODEV is returned. Fixes: 9d1d36268f3d ("platform/x86: ISST: Support partitioned systems") Signed-off-by: Srinivas Pandruvada Cc: stable@vger.kernel.org # 6.10+ Link: https://lore.kernel.org/r/20240816163626.415762-1-srinivas.pandruvada@linux.intel.com Reviewed-by: Ilpo Järvinen Signed-off-by: Ilpo Järvinen drivers/platform/x86/intel/speed_select_if/isst_tpmi_core.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) commit a0b39e2dc7017ac667b70bdeee5293e410fab2fb Author: Sebastian Andrzej Siewior Date: Tue Aug 20 09:54:31 2024 +0200 netfilter: nft_counter: Synchronize nft_counter_reset() against reader. nft_counter_reset() resets the counter by subtracting the previously retrieved value from the counter. This is a write operation on the counter and as such it requires to be performed with a write sequence of nft_counter_seq to serialize against its possible reader. Update the packets/ bytes within write-sequence of nft_counter_seq. Fixes: d84701ecbcd6a ("netfilter: nft_counter: rework atomic dump and reset") Signed-off-by: Sebastian Andrzej Siewior Reviewed-by: Florian Westphal Signed-off-by: Pablo Neira Ayuso net/netfilter/nft_counter.c | 5 +++++ 1 file changed, 5 insertions(+) commit 1eacdd71b3436b54d5fc8218c4bb0187d92a6892 Author: Sebastian Andrzej Siewior Date: Tue Aug 20 09:54:30 2024 +0200 netfilter: nft_counter: Disable BH in nft_counter_offload_stats(). The sequence counter nft_counter_seq is a per-CPU counter. There is no lock associated with it. nft_counter_do_eval() is using the same counter and disables BH which suggest that it can be invoked from a softirq. This in turn means that nft_counter_offload_stats(), which disables only preemption, can be interrupted by nft_counter_do_eval() leading to two writer for one seqcount_t. This can lead to loosing stats or reading statistics while they are updated. Disable BH during stats update in nft_counter_offload_stats() to ensure one writer at a time. Fixes: b72920f6e4a9d ("netfilter: nftables: counter hardware offload support") Signed-off-by: Sebastian Andrzej Siewior Reviewed-by: Florian Westphal Signed-off-by: Pablo Neira Ayuso net/netfilter/nft_counter.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) commit 50f2b98dc83de7809a5c5bf0ccf9af2e75c37c13 Author: Jiaxun Yang Date: Tue Aug 13 10:59:08 2024 +0100 MIPS: cevt-r4k: Don't call get_c0_compare_int if timer irq is installed This avoids warning: [ 0.118053] BUG: sleeping function called from invalid context at kernel/locking/mutex.c:283 Caused by get_c0_compare_int on secondary CPU. We also skipped saving IRQ number to struct clock_event_device *cd as it's never used by clockevent core, as per comments it's only meant for "non CPU local devices". Reported-by: Serge Semin Closes: https://lore.kernel.org/linux-mips/6szkkqxpsw26zajwysdrwplpjvhl5abpnmxgu2xuj3dkzjnvsf@4daqrz4mf44k/ Signed-off-by: Jiaxun Yang Reviewed-by: Philippe Mathieu-Daudé Reviewed-by: Serge Semin Tested-by: Serge Semin Signed-off-by: Thomas Bogendoerfer arch/mips/kernel/cevt-r4k.c | 15 +++++++-------- 1 file changed, 7 insertions(+), 8 deletions(-) commit 2102bdac67b55bf2d1df4ff757bced74e94a5f74 Author: Kent Overstreet Date: Sat Aug 17 21:03:07 2024 -0400 bcachefs: Extra debug for data move path We don't have sufficient information to debug: https://github.com/koverstreet/bcachefs/issues/726 - print out durability of extent ptrs, when non default - print the number of replicas we need in data_update_to_text() Signed-off-by: Kent Overstreet fs/bcachefs/data_update.c | 3 +++ fs/bcachefs/extents.c | 2 ++ 2 files changed, 5 insertions(+) commit 807067bf014d4a3ae2cc55bd3de16f22a01eb580 Author: Kuniyuki Iwashima Date: Thu Aug 15 15:04:37 2024 -0700 kcm: Serialise kcm_sendmsg() for the same socket. syzkaller reported UAF in kcm_release(). [0] The scenario is 1. Thread A builds a skb with MSG_MORE and sets kcm->seq_skb. 2. Thread A resumes building skb from kcm->seq_skb but is blocked by sk_stream_wait_memory() 3. Thread B calls sendmsg() concurrently, finishes building kcm->seq_skb and puts the skb to the write queue 4. Thread A faces an error and finally frees skb that is already in the write queue 5. kcm_release() does double-free the skb in the write queue When a thread is building a MSG_MORE skb, another thread must not touch it. Let's add a per-sk mutex and serialise kcm_sendmsg(). [0]: BUG: KASAN: slab-use-after-free in __skb_unlink include/linux/skbuff.h:2366 [inline] BUG: KASAN: slab-use-after-free in __skb_dequeue include/linux/skbuff.h:2385 [inline] BUG: KASAN: slab-use-after-free in __skb_queue_purge_reason include/linux/skbuff.h:3175 [inline] BUG: KASAN: slab-use-after-free in __skb_queue_purge include/linux/skbuff.h:3181 [inline] BUG: KASAN: slab-use-after-free in kcm_release+0x170/0x4c8 net/kcm/kcmsock.c:1691 Read of size 8 at addr ffff0000ced0fc80 by task syz-executor329/6167 CPU: 1 PID: 6167 Comm: syz-executor329 Tainted: G B 6.8.0-rc5-syzkaller-g9abbc24128bc #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/25/2024 Call trace: dump_backtrace+0x1b8/0x1e4 arch/arm64/kernel/stacktrace.c:291 show_stack+0x2c/0x3c arch/arm64/kernel/stacktrace.c:298 __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0xd0/0x124 lib/dump_stack.c:106 print_address_description mm/kasan/report.c:377 [inline] print_report+0x178/0x518 mm/kasan/report.c:488 kasan_report+0xd8/0x138 mm/kasan/report.c:601 __asan_report_load8_noabort+0x20/0x2c mm/kasan/report_generic.c:381 __skb_unlink include/linux/skbuff.h:2366 [inline] __skb_dequeue include/linux/skbuff.h:2385 [inline] __skb_queue_purge_reason include/linux/skbuff.h:3175 [inline] __skb_queue_purge include/linux/skbuff.h:3181 [inline] kcm_release+0x170/0x4c8 net/kcm/kcmsock.c:1691 __sock_release net/socket.c:659 [inline] sock_close+0xa4/0x1e8 net/socket.c:1421 __fput+0x30c/0x738 fs/file_table.c:376 ____fput+0x20/0x30 fs/file_table.c:404 task_work_run+0x230/0x2e0 kernel/task_work.c:180 exit_task_work include/linux/task_work.h:38 [inline] do_exit+0x618/0x1f64 kernel/exit.c:871 do_group_exit+0x194/0x22c kernel/exit.c:1020 get_signal+0x1500/0x15ec kernel/signal.c:2893 do_signal+0x23c/0x3b44 arch/arm64/kernel/signal.c:1249 do_notify_resume+0x74/0x1f4 arch/arm64/kernel/entry-common.c:148 exit_to_user_mode_prepare arch/arm64/kernel/entry-common.c:169 [inline] exit_to_user_mode arch/arm64/kernel/entry-common.c:178 [inline] el0_svc+0xac/0x168 arch/arm64/kernel/entry-common.c:713 el0t_64_sync_handler+0x84/0xfc arch/arm64/kernel/entry-common.c:730 el0t_64_sync+0x190/0x194 arch/arm64/kernel/entry.S:598 Allocated by task 6166: kasan_save_stack mm/kasan/common.c:47 [inline] kasan_save_track+0x40/0x78 mm/kasan/common.c:68 kasan_save_alloc_info+0x70/0x84 mm/kasan/generic.c:626 unpoison_slab_object mm/kasan/common.c:314 [inline] __kasan_slab_alloc+0x74/0x8c mm/kasan/common.c:340 kasan_slab_alloc include/linux/kasan.h:201 [inline] slab_post_alloc_hook mm/slub.c:3813 [inline] slab_alloc_node mm/slub.c:3860 [inline] kmem_cache_alloc_node+0x204/0x4c0 mm/slub.c:3903 __alloc_skb+0x19c/0x3d8 net/core/skbuff.c:641 alloc_skb include/linux/skbuff.h:1296 [inline] kcm_sendmsg+0x1d3c/0x2124 net/kcm/kcmsock.c:783 sock_sendmsg_nosec net/socket.c:730 [inline] __sock_sendmsg net/socket.c:745 [inline] sock_sendmsg+0x220/0x2c0 net/socket.c:768 splice_to_socket+0x7cc/0xd58 fs/splice.c:889 do_splice_from fs/splice.c:941 [inline] direct_splice_actor+0xec/0x1d8 fs/splice.c:1164 splice_direct_to_actor+0x438/0xa0c fs/splice.c:1108 do_splice_direct_actor fs/splice.c:1207 [inline] do_splice_direct+0x1e4/0x304 fs/splice.c:1233 do_sendfile+0x460/0xb3c fs/read_write.c:1295 __do_sys_sendfile64 fs/read_write.c:1362 [inline] __se_sys_sendfile64 fs/read_write.c:1348 [inline] __arm64_sys_sendfile64+0x160/0x3b4 fs/read_write.c:1348 __invoke_syscall arch/arm64/kernel/syscall.c:37 [inline] invoke_syscall+0x98/0x2b8 arch/arm64/kernel/syscall.c:51 el0_svc_common+0x130/0x23c arch/arm64/kernel/syscall.c:136 do_el0_svc+0x48/0x58 arch/arm64/kernel/syscall.c:155 el0_svc+0x54/0x168 arch/arm64/kernel/entry-common.c:712 el0t_64_sync_handler+0x84/0xfc arch/arm64/kernel/entry-common.c:730 el0t_64_sync+0x190/0x194 arch/arm64/kernel/entry.S:598 Freed by task 6167: kasan_save_stack mm/kasan/common.c:47 [inline] kasan_save_track+0x40/0x78 mm/kasan/common.c:68 kasan_save_free_info+0x5c/0x74 mm/kasan/generic.c:640 poison_slab_object+0x124/0x18c mm/kasan/common.c:241 __kasan_slab_free+0x3c/0x78 mm/kasan/common.c:257 kasan_slab_free include/linux/kasan.h:184 [inline] slab_free_hook mm/slub.c:2121 [inline] slab_free mm/slub.c:4299 [inline] kmem_cache_free+0x15c/0x3d4 mm/slub.c:4363 kfree_skbmem+0x10c/0x19c __kfree_skb net/core/skbuff.c:1109 [inline] kfree_skb_reason+0x240/0x6f4 net/core/skbuff.c:1144 kfree_skb include/linux/skbuff.h:1244 [inline] kcm_release+0x104/0x4c8 net/kcm/kcmsock.c:1685 __sock_release net/socket.c:659 [inline] sock_close+0xa4/0x1e8 net/socket.c:1421 __fput+0x30c/0x738 fs/file_table.c:376 ____fput+0x20/0x30 fs/file_table.c:404 task_work_run+0x230/0x2e0 kernel/task_work.c:180 exit_task_work include/linux/task_work.h:38 [inline] do_exit+0x618/0x1f64 kernel/exit.c:871 do_group_exit+0x194/0x22c kernel/exit.c:1020 get_signal+0x1500/0x15ec kernel/signal.c:2893 do_signal+0x23c/0x3b44 arch/arm64/kernel/signal.c:1249 do_notify_resume+0x74/0x1f4 arch/arm64/kernel/entry-common.c:148 exit_to_user_mode_prepare arch/arm64/kernel/entry-common.c:169 [inline] exit_to_user_mode arch/arm64/kernel/entry-common.c:178 [inline] el0_svc+0xac/0x168 arch/arm64/kernel/entry-common.c:713 el0t_64_sync_handler+0x84/0xfc arch/arm64/kernel/entry-common.c:730 el0t_64_sync+0x190/0x194 arch/arm64/kernel/entry.S:598 The buggy address belongs to the object at ffff0000ced0fc80 which belongs to the cache skbuff_head_cache of size 240 The buggy address is located 0 bytes inside of freed 240-byte region [ffff0000ced0fc80, ffff0000ced0fd70) The buggy address belongs to the physical page: page:00000000d35f4ae4 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x10ed0f flags: 0x5ffc00000000800(slab|node=0|zone=2|lastcpupid=0x7ff) page_type: 0xffffffff() raw: 05ffc00000000800 ffff0000c1cbf640 fffffdffc3423100 dead000000000004 raw: 0000000000000000 00000000000c000c 00000001ffffffff 0000000000000000 page dumped because: kasan: bad access detected Memory state around the buggy address: ffff0000ced0fb80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ffff0000ced0fc00: fb fb fb fb fb fb fc fc fc fc fc fc fc fc fc fc >ffff0000ced0fc80: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ^ ffff0000ced0fd00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fc fc ffff0000ced0fd80: fc fc fc fc fc fc fc fc fa fb fb fb fb fb fb fb Fixes: ab7ac4eb9832 ("kcm: Kernel Connection Multiplexor module") Reported-by: syzbot+b72d86aa5df17ce74c60@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=b72d86aa5df17ce74c60 Tested-by: syzbot+b72d86aa5df17ce74c60@syzkaller.appspotmail.com Signed-off-by: Kuniyuki Iwashima Reviewed-by: Eric Dumazet Link: https://patch.msgid.link/20240815220437.69511-1-kuniyu@amazon.com Signed-off-by: Jakub Kicinski include/net/kcm.h | 1 + net/kcm/kcmsock.c | 4 ++++ 2 files changed, 5 insertions(+) commit ce335db0621648472f9bb4b7191eb2e13a5793cf Author: Jeremy Kerr Date: Fri Aug 16 18:29:17 2024 +0800 net: mctp: test: Use correct skb for route input check In the MCTP route input test, we're routing one skb, then (when delivery is expected) checking the resulting routed skb. However, we're currently checking the original skb length, rather than the routed skb. Check the routed skb instead; the original will have been freed at this point. Fixes: 8892c0490779 ("mctp: Add route input to socket tests") Reported-by: Dan Carpenter Closes: https://lore.kernel.org/kernel-janitors/4ad204f0-94cf-46c5-bdab-49592addf315@kili.mountain/ Signed-off-by: Jeremy Kerr Reviewed-by: Simon Horman Link: https://patch.msgid.link/20240816-mctp-kunit-skb-fix-v1-1-3c367ac89c27@codeconstruct.com.au Signed-off-by: Jakub Kicinski net/mctp/test/route-test.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 4e870e6bbec5c41c0d8b253282dca9465fbf5044 Author: Dmitry Torokhov Date: Mon Aug 19 17:04:42 2024 -0700 Input: himax_hx83112b - fix incorrect size when reading product ID We need to read a u32 value (4 bytes), not size of a pointer to that value. Also, himax_read_mcu() wrapper is an overkill, remove it and use himax_bus_read() directly. Reported-by: kernel test robot Closes: https://lore.kernel.org/oe-kbuild-all/202408200301.Ujpj7Vov-lkp@intel.com/ Fixes: 0944829d491e ("Input: himax_hx83112b - implement MCU register reading") Tested-by: Felix Kaechele Link: https://lore.kernel.org/r/ZsPdmtfC54R7JVxR@google.com Signed-off-by: Dmitry Torokhov drivers/input/touchscreen/himax_hx83112b.c | 14 ++------------ 1 file changed, 2 insertions(+), 12 deletions(-) commit 6e4436539ae182dc86d57d13849862bcafaa4709 Merge: b0da640826ba 1b8f9c1fb464 Author: Linus Torvalds Date: Mon Aug 19 11:02:13 2024 -0700 Merge tag 'hid-for-linus-2024081901' of git://git.kernel.org/pub/scm/linux/kernel/git/hid/hid Pull HID fixes from Jiri Kosina: - memory corruption fixes for hid-cougar (Camila Alvarez) and hid-amd_sfh (Olivier Sobrie) - fix for regression in Wacom driver of twist gesture handling (Jason Gerecke) - two new device IDs for hid-multitouch (Dmitry Savin) and hid-asus (Luke D. Jones) * tag 'hid-for-linus-2024081901' of git://git.kernel.org/pub/scm/linux/kernel/git/hid/hid: HID: wacom: Defer calculation of resolution until resolution_code is known HID: multitouch: Add support for GT7868Q HID: amd_sfh: free driver_data after destroying hid device hid-asus: add ROG Ally X prod ID to quirk list HID: cougar: fix slab-out-of-bounds Read in cougar_report_fixup commit a06a7b3429e2548a28bb661f17347b8ffe4a8a15 Author: Daniele Ceraolo Spurio Date: Thu Aug 15 16:05:40 2024 -0700 drm/xe/uc: Use devm to register cleanup that includes exec_queues Exec_queue cleanup requires HW access, so we need to use devm instead of drmm for it. Signed-off-by: Daniele Ceraolo Spurio Cc: John Harrison Cc: Alan Previn Reviewed-by: Matthew Brost Reviewed-by: Lucas De Marchi Reviewed-by: Matthew Auld Link: https://patchwork.freedesktop.org/patch/msgid/20240815230541.3828206-2-lucas.demarchi@intel.com Signed-off-by: Lucas De Marchi (cherry picked from commit 5a891a0e69f134f53cc91b409f38e5ea1cafaf0a) Signed-off-by: Rodrigo Vivi drivers/gpu/drm/xe/xe_gsc.c | 4 ++-- drivers/gpu/drm/xe/xe_guc_submit.c | 4 ++-- 2 files changed, 4 insertions(+), 4 deletions(-) commit 8636a5c29be1f05b5162a5c82c874338b6717759 Author: Daniele Ceraolo Spurio Date: Fri Aug 9 16:12:35 2024 -0700 drm/xe: use devm instead of drmm for managed bo The BO cleanup touches the GGTT and therefore requires the HW to be available, so we need to use devm instead of drmm. Closes: https://gitlab.freedesktop.org/drm/xe/kernel/-/issues/1160 Signed-off-by: Daniele Ceraolo Spurio Cc: Lucas De Marchi Cc: Matthew Auld Reviewed-by: Matthew Auld Reviewed-by: Lucas De Marchi Link: https://patchwork.freedesktop.org/patch/msgid/20240809231237.1503796-2-daniele.ceraolospurio@intel.com Signed-off-by: Lucas De Marchi (cherry picked from commit 8d3a2d3d766a823c7510cdc17e6ff7c042c63b61) Signed-off-by: Rodrigo Vivi drivers/gpu/drm/xe/xe_bo.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) commit 8776b0234e1d008d8f19b26f6c3af1cfa6187070 Author: Tejas Upadhyay Date: Mon Aug 12 19:11:17 2024 +0530 drm/xe/xe2hpg: Add Wa_14021821874 Wa_14021821874 applies to xe2_hpg V2(Himal): - Use space after define Cc: Matt Roper Reviewed-by: Himal Prasad Ghimiray Signed-off-by: Tejas Upadhyay Reviewed-by: Matt Roper Signed-off-by: Matt Roper Link: https://patchwork.freedesktop.org/patch/msgid/20240812134117.813670-1-tejas.upadhyay@intel.com (cherry picked from commit 21ff3a16e92e2fa4f906a61d148aca1423c58298) Signed-off-by: Rodrigo Vivi drivers/gpu/drm/xe/regs/xe_gt_regs.h | 1 + drivers/gpu/drm/xe/xe_wa.c | 4 ++++ 2 files changed, 5 insertions(+) commit f5cb1275c8ce56c7583cb323cfa08a820a7ef6b4 Author: Daniele Ceraolo Spurio Date: Wed Aug 7 16:53:32 2024 -0700 drm/xe: fix WA 14018094691 This WA is applied while initializing the media GT, but it a primary GT WA (because it modifies a register on the primary GT), so the XE_WA macro is returning false even when the WA should be applied. Fix this by using the primary GT in the macro. Note that this WA only applies to PXP and we don't yet support that in Xe, so there are no negative effects to this bug, which is why we didn't see any errors in testing. v2: use the primary GT in the macro instead of marking the WA as platform-wide (Lucas, Matt). Signed-off-by: Daniele Ceraolo Spurio Cc: Matt Roper Cc: Lucas De Marchi Reviewed-by: Matt Roper Reviewed-by: Lucas De Marchi Link: https://patchwork.freedesktop.org/patch/msgid/20240807235333.1370915-1-daniele.ceraolospurio@intel.com (cherry picked from commit e422c0bfd9e47e399e86bcc483f49d8b54064fc2) Signed-off-by: Rodrigo Vivi drivers/gpu/drm/xe/xe_gsc.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) commit cbc6e98ab11bea52789d2835e45e8816c39407e1 Author: Tejas Upadhyay Date: Tue Jul 9 21:26:06 2024 +0530 drm/xe/xe2: Add Wa_15015404425 Wa_15015404425 asks us to perform four "dummy" writes to a non-existent register offset before every real register read. Although the specific offset of the writes doesn't directly matter, the workaround suggests offset 0x130030 as a good target so that these writes will be easy to recognize and filter out in debugging traces. V5(MattR): - Avoid negating an equality comparison V4(MattR): - Use writel and remove xe_reg usage V3(MattR): - Define dummy reg local to function - Avoid tracing dummy writes - Update commit message V2: - Add WA to 8/16/32bit reads also - MattR - Corrected dummy reg address - MattR - Use for loop to avoid mental pause - JaniN Reviewed-by: Matt Roper Signed-off-by: Tejas Upadhyay Signed-off-by: Matt Roper Link: https://patchwork.freedesktop.org/patch/msgid/20240709155606.2998941-1-tejas.upadhyay@intel.com (cherry picked from commit 86c5b70a9c0c3f05f7002ef8b789460c96b54e27) Signed-off-by: Rodrigo Vivi drivers/gpu/drm/xe/xe_mmio.c | 23 +++++++++++++++++++++++ 1 file changed, 23 insertions(+) commit 7e81285380743aa5759bb29a388f056c3d326a2c Author: Tejas Upadhyay Date: Wed Jul 10 10:57:50 2024 +0530 drm/xe/xe2: Make subsequent L2 flush sequential Issuing the flush on top of an ongoing flush is not desirable. Lets use lock to make it sequential. Reviewed-by: Nirmoy Das Signed-off-by: Tejas Upadhyay Link: https://patchwork.freedesktop.org/patch/msgid/20240710052750.3031586-1-tejas.upadhyay@intel.com Signed-off-by: Nirmoy Das (cherry picked from commit 71733b8d7f50b61403f940c6c9745fb3a9b98dcb) Signed-off-by: Rodrigo Vivi drivers/gpu/drm/xe/xe_device.c | 2 ++ drivers/gpu/drm/xe/xe_gt.c | 1 + drivers/gpu/drm/xe/xe_gt_types.h | 6 ++++++ 3 files changed, 9 insertions(+) commit b196e6fcc71186134b4cfe756067d87ae41b1ed9 Author: Bommu Krishnaiah Date: Wed Jul 3 14:37:54 2024 +0530 drm/xe/xe2lpg: Extend workaround 14021402888 workaround 14021402888 also applies to Xe2_LPG. Replicate the existing entry to one specific for Xe2_LPG. Signed-off-by: Bommu Krishnaiah Cc: Tejas Upadhyay Cc: Matt Roper Cc: Himal Prasad Ghimiray Reviewed-by: Matt Roper Link: https://patchwork.freedesktop.org/patch/msgid/20240703090754.1323647-1-krishnaiah.bommu@intel.com Signed-off-by: Lucas De Marchi (cherry picked from commit 56ab6986992ba143aee0bda33e15a764343e271d) Signed-off-by: Rodrigo Vivi drivers/gpu/drm/xe/xe_wa.c | 4 ++++ 1 file changed, 4 insertions(+) commit 03a2dc84f5c4ef31ac0112b29d51ff103f7c8dd4 Author: Ngai-Mint Kwan Date: Mon Jul 1 11:46:37 2024 -0700 drm/xe/xe2lpm: Extend Wa_16021639441 Wa_16021639441 applies to Xe2_LPM. Signed-off-by: Ngai-Mint Kwan Reviewed-by: Matt Roper Signed-off-by: Matt Roper Link: https://patchwork.freedesktop.org/patch/msgid/20240701184637.531794-1-ngai-mint.kwan@linux.intel.com (cherry picked from commit 74e3076800067c6dc0dcff5b75344cec064c20eb) Signed-off-by: Rodrigo Vivi drivers/gpu/drm/xe/xe_wa.c | 10 ++++++++++ 1 file changed, 10 insertions(+) commit 27cb2b7fec2abf310e4128137979124ead920ccb Author: Matthew Auld Date: Wed Jul 3 13:43:38 2024 +0100 drm/xe/bmg: implement Wa_16023588340 This involves enabling l2 caching of host side memory access to VRAM through the CPU BAR. The main fallout here is with display since VRAM writes from CPU can now be cached in GPU l2, and display is never coherent with caches, so needs various manual flushing. In the case of fbc we disable it due to complications in getting this to work correctly (in a later patch). Signed-off-by: Matthew Auld Cc: Jonathan Cavitt Cc: Matt Roper Cc: Lucas De Marchi Cc: Vinod Govindapillai Reviewed-by: Jonathan Cavitt Link: https://patchwork.freedesktop.org/patch/msgid/20240703124338.208220-3-matthew.auld@intel.com (cherry picked from commit 01570b446939c3538b1aa3d059837f49fa14a3ae) Signed-off-by: Rodrigo Vivi drivers/gpu/drm/xe/Makefile | 2 ++ drivers/gpu/drm/xe/display/xe_dsb_buffer.c | 8 +++++ drivers/gpu/drm/xe/display/xe_fb_pin.c | 3 ++ drivers/gpu/drm/xe/regs/xe_gt_regs.h | 8 +++++ drivers/gpu/drm/xe/xe_device.c | 30 +++++++++++++++++ drivers/gpu/drm/xe/xe_device.h | 1 + drivers/gpu/drm/xe/xe_gt.c | 54 ++++++++++++++++++++++++++++++ drivers/gpu/drm/xe/xe_pat.c | 11 +++++- drivers/gpu/drm/xe/xe_wa_oob.rules | 1 + 9 files changed, 117 insertions(+), 1 deletion(-) commit f616506754d34bcfdbfbc7508b562e5c98461e9a Author: Marc Zyngier Date: Mon Aug 19 13:50:45 2024 +0100 KVM: arm64: vgic: Don't hold config_lock while unregistering redistributors We recently moved the teardown of the vgic part of a vcpu inside a critical section guarded by the config_lock. This teardown phase involves calling into kvm_io_bus_unregister_dev(), which takes the kvm->srcu lock. However, this violates the established order where kvm->srcu is taken on a memory fault (such as an MMIO access), possibly followed by taking the config_lock if the GIC emulation requires mutual exclusion from the other vcpus. It therefore results in a bad lockdep splat, as reported by Zenghui. Fix this by moving the call to kvm_io_bus_unregister_dev() outside of the config_lock critical section. At this stage, there shouln't be any need to hold the config_lock. As an additional bonus, document the ordering between kvm->slots_lock, kvm->srcu and kvm->arch.config_lock so that I cannot pretend I didn't know about those anymore. Fixes: 9eb18136af9f ("KVM: arm64: vgic: Hold config_lock while tearing down a CPU interface") Reported-by: Zenghui Yu Signed-off-by: Marc Zyngier Reviewed-by: Zenghui Yu Tested-by: Zenghui Yu Link: https://lore.kernel.org/r/20240819125045.3474845-1-maz@kernel.org Signed-off-by: Oliver Upton arch/arm64/kvm/vgic/vgic-init.c | 9 ++++++--- arch/arm64/kvm/vgic/vgic.c | 5 +++++ 2 files changed, 11 insertions(+), 3 deletions(-) commit 2240a50e6294214de791729e9dcba6880fa7e44e Author: Zenghui Yu Date: Sat Aug 17 18:15:41 2024 +0800 KVM: arm64: vgic-debug: Don't put unmarked LPIs If there were LPIs being mapped behind our back (i.e., between .start() and .stop()), we would put them at iter_unmark_lpis() without checking if they were actually *marked*, which is obviously not good. Switch to use the xa_for_each_marked() iterator to fix it. Cc: stable@vger.kernel.org Fixes: 85d3ccc8b75b ("KVM: arm64: vgic-debug: Use an xarray mark for debug iterator") Signed-off-by: Zenghui Yu Reviewed-by: Marc Zyngier Link: https://lore.kernel.org/r/20240817101541.1664-1-yuzenghui@huawei.com Signed-off-by: Oliver Upton arch/arm64/kvm/vgic/vgic-debug.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit b0da640826ba3b6506b4996a6b23a429235e6923 Merge: 47ac09b91bef bcc954c6caba Author: Linus Torvalds Date: Mon Aug 19 09:26:35 2024 -0700 Merge tag 'printk-for-6.11-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/printk/linux Pull printk fix from Petr Mladek: - Do not block printk on non-panic CPUs when they are dumping backtraces * tag 'printk-for-6.11-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/printk/linux: printk/panic: Allow cpu backtraces to be written into ringbuffer during panic commit dc0112e6d8b42b39f9d283bab489a757e9d284f0 Author: Chuck Lever Date: Mon Aug 12 11:47:59 2024 -0400 rpcrdma: Trace connection registration and unregistration These new trace points record xarray indices and the time of endpoint registration and unregistration, to co-ordinate with device removal events. Signed-off-by: Chuck Lever Signed-off-by: Anna Schumaker include/trace/events/rpcrdma.h | 36 ++++++++++++++++++++++++++++++++++++ net/sunrpc/xprtrdma/ib_client.c | 2 ++ 2 files changed, 38 insertions(+) commit 6b3b023e2d0c130235c0e494f77df2a9a64ab6a2 Author: Chuck Lever Date: Mon Aug 12 11:47:58 2024 -0400 rpcrdma: Use XA_FLAGS_ALLOC instead of XA_FLAGS_ALLOC1 Nit: The built-in xa_limit_32b range starts at 0, but XA_FLAGS_ALLOC1 configures the xarray's allocator to start at 1. Adopt the more conventional XA_FLAGS_ALLOC because there's no mechanical reason to skip 0. Signed-off-by: Chuck Lever Signed-off-by: Anna Schumaker net/sunrpc/xprtrdma/ib_client.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit de48aad2a8e80ba026ca91c383f590f0bf97b3c0 Author: Chuck Lever Date: Mon Aug 12 11:47:57 2024 -0400 rpcrdma: Device kref is over-incremented on error from xa_alloc If the device's reference count is too high, the device completion callback never fires. Signed-off-by: Chuck Lever Signed-off-by: Anna Schumaker net/sunrpc/xprtrdma/ib_client.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 81475beb1b5996505a39cd1d9316ce1e668932a2 Author: John Garry Date: Thu Aug 15 16:32:28 2024 +0000 block: Drop NULL check in bdev_write_zeroes_sectors() Function bdev_get_queue() must not return NULL, so drop the check in bdev_write_zeroes_sectors(). Reviewed-by: Christoph Hellwig Signed-off-by: John Garry Reviewed-by: Martin K. Petersen Reviewed-by: Nitesh Shetty Link: https://lore.kernel.org/r/20240815163228.216051-3-john.g.garry@oracle.com Signed-off-by: Jens Axboe include/linux/blkdev.h | 7 +------ 1 file changed, 1 insertion(+), 6 deletions(-) commit 64b582ca88ca11400467b282d5fa3b870ded1c11 Author: John Garry Date: Thu Aug 15 16:32:27 2024 +0000 block: Read max write zeroes once for __blkdev_issue_write_zeroes() As reported in [0], we may get a hang when formatting a XFS FS on a RAID0 drive. Commit 73a768d5f955 ("block: factor out a blk_write_zeroes_limit helper") changed __blkdev_issue_write_zeroes() to read the max write zeroes value in the loop. This is not safe as max write zeroes may change in value. Specifically for the case of [0], the value goes to 0, and we get an infinite loop. Lift the limit reading out of the loop. [0] https://lore.kernel.org/linux-xfs/4d31268f-310b-4220-88a2-e191c3932a82@oracle.com/T/#t Fixes: 73a768d5f955 ("block: factor out a blk_write_zeroes_limit helper") Reviewed-by: Christoph Hellwig Signed-off-by: John Garry Reviewed-by: Martin K. Petersen Link: https://lore.kernel.org/r/20240815163228.216051-2-john.g.garry@oracle.com Signed-off-by: Jens Axboe block/blk-lib.c | 25 ++++++++++++++++++------- 1 file changed, 18 insertions(+), 7 deletions(-) commit 565d121b69980637f040eb4d84289869cdaabedf Author: Florian Westphal Date: Tue Aug 13 00:28:25 2024 +0200 tcp: prevent concurrent execution of tcp_sk_exit_batch Its possible that two threads call tcp_sk_exit_batch() concurrently, once from the cleanup_net workqueue, once from a task that failed to clone a new netns. In the latter case, error unwinding calls the exit handlers in reverse order for the 'failed' netns. tcp_sk_exit_batch() calls tcp_twsk_purge(). Problem is that since commit b099ce2602d8 ("net: Batch inet_twsk_purge"), this function picks up twsk in any dying netns, not just the one passed in via exit_batch list. This means that the error unwind of setup_net() can "steal" and destroy timewait sockets belonging to the exiting netns. This allows the netns exit worker to proceed to call WARN_ON_ONCE(!refcount_dec_and_test(&net->ipv4.tcp_death_row.tw_refcount)); without the expected 1 -> 0 transition, which then splats. At same time, error unwind path that is also running inet_twsk_purge() will splat as well: WARNING: .. at lib/refcount.c:31 refcount_warn_saturate+0x1ed/0x210 ... refcount_dec include/linux/refcount.h:351 [inline] inet_twsk_kill+0x758/0x9c0 net/ipv4/inet_timewait_sock.c:70 inet_twsk_deschedule_put net/ipv4/inet_timewait_sock.c:221 inet_twsk_purge+0x725/0x890 net/ipv4/inet_timewait_sock.c:304 tcp_sk_exit_batch+0x1c/0x170 net/ipv4/tcp_ipv4.c:3522 ops_exit_list+0x128/0x180 net/core/net_namespace.c:178 setup_net+0x714/0xb40 net/core/net_namespace.c:375 copy_net_ns+0x2f0/0x670 net/core/net_namespace.c:508 create_new_namespaces+0x3ea/0xb10 kernel/nsproxy.c:110 ... because refcount_dec() of tw_refcount unexpectedly dropped to 0. This doesn't seem like an actual bug (no tw sockets got lost and I don't see a use-after-free) but as erroneous trigger of debug check. Add a mutex to force strict ordering: the task that calls tcp_twsk_purge() blocks other task from doing final _dec_and_test before mutex-owner has removed all tw sockets of dying netns. Fixes: e9bd0cca09d1 ("tcp: Don't allocate tcp_death_row outside of struct netns_ipv4.") Reported-by: syzbot+8ea26396ff85d23a8929@syzkaller.appspotmail.com Closes: https://lore.kernel.org/netdev/0000000000003a5292061f5e4e19@google.com/ Link: https://lore.kernel.org/netdev/20240812140104.GA21559@breakpoint.cc/ Signed-off-by: Florian Westphal Reviewed-by: Kuniyuki Iwashima Reviewed-by: Jason Xing Reviewed-by: Eric Dumazet Link: https://patch.msgid.link/20240812222857.29837-1-fw@strlen.de Signed-off-by: Jakub Kicinski net/ipv4/tcp_ipv4.c | 14 ++++++++++++++ 1 file changed, 14 insertions(+) commit ad614a706b1ac83b95b333f44b8f5e70bcb37dc5 Author: Geert Uytterhoeven Date: Mon Jul 29 11:26:34 2024 +0200 drm/xe/oa/uapi: Make bit masks unsigned When building with gcc-5: In function ‘decode_oa_format.isra.26’, inlined from ‘xe_oa_set_prop_oa_format’ at drivers/gpu/drm/xe/xe_oa.c:1664:6: ././include/linux/compiler_types.h:510:38: error: call to ‘__compiletime_assert_1336’ declared with attribute error: FIELD_GET: mask is not constant [...] ./include/linux/bitfield.h:155:3: note: in expansion of macro ‘__BF_FIELD_CHECK’ __BF_FIELD_CHECK(_mask, _reg, 0U, "FIELD_GET: "); \ ^ drivers/gpu/drm/xe/xe_oa.c:1573:18: note: in expansion of macro ‘FIELD_GET’ u32 bc_report = FIELD_GET(DRM_XE_OA_FORMAT_MASK_BC_REPORT, fmt); ^ Fixes: b6fd51c62119 ("drm/xe/oa/uapi: Define and parse OA stream properties") Signed-off-by: Geert Uytterhoeven Reviewed-by: Lucas De Marchi Link: https://patchwork.freedesktop.org/patch/msgid/20240729092634.2227611-1-geert+renesas@glider.be Signed-off-by: Lucas De Marchi (cherry picked from commit f2881dfdaaa9ec873dbd383ef5512fc31e576cbb) Signed-off-by: Rodrigo Vivi include/uapi/drm/xe_drm.h | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) commit ddf6492e0e508b7c2b42c8d5a4ac82bd38ef0dd5 Author: Maarten Lankhorst Date: Tue Aug 6 12:50:44 2024 +0200 drm/xe/display: Make display suspend/resume work on discrete We should unpin before evicting all memory, and repin after GT resume. This way, we preserve the contents of the framebuffers, and won't hang on resume due to migration engine not being restored yet. Signed-off-by: Maarten Lankhorst Fixes: dd08ebf6c352 ("drm/xe: Introduce a new DRM driver for Intel GPUs") Cc: stable@vger.kernel.org # v6.8+ Reviewed-by: Uma Shankar Link: https://patchwork.freedesktop.org/patch/msgid/20240806105044.596842-3-maarten.lankhorst@linux.intel.com Signed-off-by: Maarten Lankhorst,,, (cherry picked from commit cb8f81c1753187995b7a43e79c12959f14eb32d3) Signed-off-by: Rodrigo Vivi drivers/gpu/drm/xe/display/xe_display.c | 23 +++++++++++++++++++++++ drivers/gpu/drm/xe/xe_pm.c | 11 ++++++----- 2 files changed, 29 insertions(+), 5 deletions(-) commit 730b72480e29f63fd644f5fa57c9d46109428953 Author: Matthew Auld Date: Wed Aug 14 12:01:30 2024 +0100 drm/xe: prevent UAF around preempt fence The fence lock is part of the queue, therefore in the current design anything locking the fence should then also hold a ref to the queue to prevent the queue from being freed. However, currently it looks like we signal the fence and then drop the queue ref, but if something is waiting on the fence, the waiter is kicked to wake up at some later point, where upon waking up it first grabs the lock before checking the fence state. But if we have already dropped the queue ref, then the lock might already be freed as part of the queue, leading to uaf. To prevent this, move the fence lock into the fence itself so we don't run into lifetime issues. Alternative might be to have device level lock, or only release the queue in the fence release callback, however that might require pushing to another worker to avoid locking issues. Fixes: dd08ebf6c352 ("drm/xe: Introduce a new DRM driver for Intel GPUs") References: https://gitlab.freedesktop.org/drm/xe/kernel/-/issues/2454 References: https://gitlab.freedesktop.org/drm/xe/kernel/-/issues/2342 References: https://gitlab.freedesktop.org/drm/xe/kernel/-/issues/2020 Signed-off-by: Matthew Auld Cc: Matthew Brost Cc: # v6.8+ Reviewed-by: Matthew Brost Link: https://patchwork.freedesktop.org/patch/msgid/20240814110129.825847-2-matthew.auld@intel.com (cherry picked from commit 7116c35aacedc38be6d15bd21b2fc936eed0008b) Signed-off-by: Rodrigo Vivi drivers/gpu/drm/xe/xe_exec_queue.c | 1 - drivers/gpu/drm/xe/xe_exec_queue_types.h | 2 -- drivers/gpu/drm/xe/xe_preempt_fence.c | 3 ++- drivers/gpu/drm/xe/xe_preempt_fence_types.h | 2 ++ 4 files changed, 4 insertions(+), 4 deletions(-) commit 15939ca77d4424f736e1e4953b4da2351cc9689d Author: Matthew Brost Date: Fri Aug 9 16:28:30 2024 -0700 drm/xe: Fix tile fini sequence Only set tile->mmio.regs to NULL if not the root tile in tile_fini. The root tile mmio regs is setup ealier in MMIO init thus it should be set to NULL in mmio_fini. Fixes: dd08ebf6c352 ("drm/xe: Introduce a new DRM driver for Intel GPUs") Signed-off-by: Matthew Brost Reviewed-by: Lucas De Marchi Reviewed-by: Himal Prasad Ghimiray Link: https://patchwork.freedesktop.org/patch/msgid/20240809232830.3302251-1-matthew.brost@intel.com (cherry picked from commit 3396900aa273903639a1792afa4d23dc09bec291) Signed-off-by: Rodrigo Vivi drivers/gpu/drm/xe/xe_mmio.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) commit 7090d7fc969fcc9985d7e538cfcd8a69a5f9c616 Author: Matthew Brost Date: Wed Jul 24 08:28:31 2024 -0700 drm/xe: Move VM dma-resv lock from xe_exec_queue_create to __xe_exec_queue_init The critical section which requires the VM dma-resv is the call xe_lrc_create in __xe_exec_queue_init. Move this lock to __xe_exec_queue_init holding it just around xe_lrc_create. Not only is good practice, this also fixes a locking double of the VM dma-resv in the error paths of __xe_exec_queue_init as xe_lrc_put tries to acquire this too resulting in a deadlock. Fixes: dd08ebf6c352 ("drm/xe: Introduce a new DRM driver for Intel GPUs") Cc: Maarten Lankhorst Signed-off-by: Matthew Brost Reviewed-by: Maarten Lankhorst Link: https://patchwork.freedesktop.org/patch/msgid/20240724152831.1848325-1-matthew.brost@intel.com (cherry picked from commit 549dd786b61cd3db903f5d94d07fc5a89ccdbeb9) Signed-off-by: Rodrigo Vivi drivers/gpu/drm/xe/xe_exec_queue.c | 23 ++++++++++++++--------- 1 file changed, 14 insertions(+), 9 deletions(-) commit c621f70539cae731d9749c1900cd00bb70ea5c72 Author: Ashutosh Dixit Date: Sun Aug 4 23:20:57 2024 -0700 drm/xe/observation: Drop empty sysctl table entry An empty sysctl table entry was inadvertently left behind for observation sysctl. The breaks on 6.11 with the following errors: [ 219.654850] sysctl table check failed: dev/xe/(null) procname is null [ 219.654862] sysctl table check failed: dev/xe/(null) No proc_handler Drop the empty entry. Fixes: 63347fe031e3 ("drm/xe/uapi: Rename xe perf layer as xe observation layer") Closes: https://gitlab.freedesktop.org/drm/xe/kernel/-/issues/2419 Signed-off-by: Ashutosh Dixit Reviewed-by: Umesh Nerlige Ramappa Link: https://patchwork.freedesktop.org/patch/msgid/20240805062057.3547560-1-ashutosh.dixit@intel.com (cherry picked from commit be1dec570b6f5a29ce9c99334c52bea94c28914b) Signed-off-by: Rodrigo Vivi drivers/gpu/drm/xe/xe_observation.c | 1 - 1 file changed, 1 deletion(-) commit f4b2a0ae1a31fd3d1b5ca18ee08319b479cf9b5f Author: Lucas De Marchi Date: Wed Jul 24 14:53:09 2024 -0700 drm/xe: Fix opregion leak Being part o the display, ideally the setup and cleanup would be done by display itself. However this is a bigger refactor that needs to be done on both i915 and xe. For now, just fix the leak: unreferenced object 0xffff8881a0300008 (size 192): comm "modprobe", pid 4354, jiffies 4295647021 hex dump (first 32 bytes): 00 00 87 27 81 88 ff ff 18 80 9b 00 00 c9 ff ff ...'............ 18 81 9b 00 00 c9 ff ff 00 00 00 00 00 00 00 00 ................ backtrace (crc 99260e31): [] kmemleak_alloc+0x4b/0x80 [] kmalloc_trace_noprof+0x312/0x3d0 [] intel_opregion_setup+0x89/0x700 [xe] [] xe_display_init_noirq+0x2f/0x90 [xe] [] xe_device_probe+0x7a3/0xbf0 [xe] [] xe_pci_probe+0x333/0x5b0 [xe] [] local_pci_probe+0x48/0xb0 [] pci_device_probe+0xc8/0x280 [] really_probe+0xf8/0x390 [] __driver_probe_device+0x8a/0x170 [] driver_probe_device+0x23/0xb0 [] __driver_attach+0xc7/0x190 [] bus_for_each_dev+0x7d/0xd0 [] driver_attach+0x1e/0x30 [] bus_add_driver+0x117/0x250 Fixes: 44e694958b95 ("drm/xe/display: Implement display support") Reviewed-by: Rodrigo Vivi Link: https://patchwork.freedesktop.org/patch/msgid/20240724215309.644423-1-lucas.demarchi@intel.com Signed-off-by: Lucas De Marchi (cherry picked from commit 6f4e43a2f771b737d991142ec4f6d4b7ff31fbb4) Signed-off-by: Rodrigo Vivi drivers/gpu/drm/xe/display/xe_display.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) commit 5c7bb62cb8f53de71d8ab3d619be22740da0b837 Author: Hans de Goede Date: Wed Aug 14 21:01:59 2024 +0200 ACPI: video: Add backlight=native quirk for Dell OptiPlex 7760 AIO Dell All In One (AIO) models released after 2017 may use a backlight controller board connected to an UART. In DSDT this uart port will be defined as: Name (_HID, "DELL0501") Name (_CID, EisaId ("PNP0501") The Dell OptiPlex 7760 AIO has an ACPI device for one if its UARTs with the above _HID + _CID. Loading the dell-uart-backlight driver shows that there actually is a backlight controller board attached to the UART, which reports a firmware version of "G&MX01-V15". But the backlight controller board does not actually control the backlight brightness and the GPU's native backlight control method does work. Add a quirk to use the GPU's native backlight control method on this model. Fixes: 484bae9e4d6a ("platform/x86: Add new Dell UART backlight driver") Closes: https://bugzilla.redhat.com/show_bug.cgi?id=2303936 Cc: All applicable Signed-off-by: Hans de Goede Reviewed-by: Andy Shevchenko Link: https://patch.msgid.link/20240814190159.15650-4-hdegoede@redhat.com Signed-off-by: Rafael J. Wysocki drivers/acpi/video_detect.c | 15 +++++++++++++++ 1 file changed, 15 insertions(+) commit b5f0943001339c4d324a1af10470ce0bdd79f966 Author: Hans de Goede Date: Wed Aug 14 21:01:58 2024 +0200 platform/x86: dell-uart-backlight: Use acpi_video_get_backlight_type() The dell-uart-backlight driver supports backlight control on Dell All In One (AIO) models using a backlight controller board connected to an UART. In DSDT this uart port will be defined as: Name (_HID, "DELL0501") Name (_CID, EisaId ("PNP0501") Now the first AIO has turned up which has not only the DSDT bits for this, but also an actual controller attached to the UART, yet it is not using this controller for backlight control. Use the acpi_video_get_backlight_type() function from the ACPI video-detect code to check if the dell-uart-backlight driver should actually be used. This allows reusing the existing ACPI video-detect infra to override the backlight control method on the commandline or with DMI quirks. Fixes: 484bae9e4d6a ("platform/x86: Add new Dell UART backlight driver") Cc: All applicable Signed-off-by: Hans de Goede Reviewed-by: Andy Shevchenko Link: https://patch.msgid.link/20240814190159.15650-3-hdegoede@redhat.com Signed-off-by: Rafael J. Wysocki drivers/platform/x86/dell/Kconfig | 1 + drivers/platform/x86/dell/dell-uart-backlight.c | 8 ++++++++ 2 files changed, 9 insertions(+) commit cd8e468efb4fb2742e06328a75b282c35c1abf8d Author: Hans de Goede Date: Wed Aug 14 21:01:57 2024 +0200 ACPI: video: Add Dell UART backlight controller detection Dell All In One (AIO) models released after 2017 use a backlight controller board connected to an UART. In DSDT this uart port will be defined as: Name (_HID, "DELL0501") Name (_CID, EisaId ("PNP0501") Commit 484bae9e4d6a ("platform/x86: Add new Dell UART backlight driver") has added support for this, but I neglected to tie this into acpi_video_get_backlight_type(). Now the first AIO has turned up which has not only the DSDT bits for this, but also an actual controller attached to the UART, yet it is not using this controller for backlight control. Add support to acpi_video_get_backlight_type() for a new dell_uart backlight type. So that the existing infra to override the backlight control method on the commandline or with DMI quirks can be used. Fixes: 484bae9e4d6a ("platform/x86: Add new Dell UART backlight driver") Cc: All applicable Signed-off-by: Hans de Goede Reviewed-by: Andy Shevchenko Link: https://patch.msgid.link/20240814190159.15650-2-hdegoede@redhat.com Signed-off-by: Rafael J. Wysocki drivers/acpi/video_detect.c | 7 +++++++ include/acpi/video.h | 1 + 2 files changed, 8 insertions(+) commit cf1e515c9a40caa8bddb920970d3257bb01c1421 Author: Jinjie Ruan Date: Mon Aug 19 20:00:07 2024 +0800 iommufd/selftest: Make dirty_ops static The sparse tool complains as follows: drivers/iommu/iommufd/selftest.c:277:30: warning: symbol 'dirty_ops' was not declared. Should it be static? This symbol is not used outside of selftest.c, so marks it static. Fixes: 266ce58989ba ("iommufd/selftest: Test IOMMU_HWPT_ALLOC_DIRTY_TRACKING") Link: https://patch.msgid.link/r/20240819120007.3884868-1-ruanjinjie@huawei.com Signed-off-by: Jinjie Ruan Reviewed-by: Yi Liu Signed-off-by: Jason Gunthorpe drivers/iommu/iommufd/selftest.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 1e557246f8dbdb476f7112ab58d2de947f22acc5 Merge: 2d7423040b7c d7818402b1d8 Author: David S. Miller Date: Mon Aug 19 09:54:24 2024 +0100 Merge branch 'selftests-udpgro-fixes' Hangbin Liu says: ==================== selftests: Fix udpgro failures There are 2 issues for the current udpgro test. The first one is the testing doesn't record all the failures, which may report pass but the test actually failed. e.g. https://netdev-3.bots.linux.dev/vmksft-net/results/725661/45-udpgro-sh/stdout The other one is after commit d7db7775ea2e ("net: veth: do not manipulate GRO when using XDP"), there is no need to load xdp program to enable GRO on veth device. ==================== Signed-off-by: David S. Miller commit d7818402b1d80347c764001583f6d63fa68c2e1a Author: Hangbin Liu Date: Thu Aug 15 15:59:51 2024 +0800 selftests: udpgro: no need to load xdp for gro After commit d7db7775ea2e ("net: veth: do not manipulate GRO when using XDP"), there is no need to load XDP program to enable GRO. On the other hand, the current test is failed due to loading the XDP program. e.g. # selftests: net: udpgro.sh # ipv4 # no GRO ok # no GRO chk cmsg ok # GRO ./udpgso_bench_rx: recv: bad packet len, got 1472, expected 14720 # # failed [...] # bad GRO lookup ok # multiple GRO socks ./udpgso_bench_rx: recv: bad packet len, got 1452, expected 14520 # # ./udpgso_bench_rx: recv: bad packet len, got 1452, expected 14520 # # failed ok 1 selftests: net: udpgro.sh After fix, all the test passed. # ./udpgro.sh ipv4 no GRO ok [...] multiple GRO socks ok Fixes: d7db7775ea2e ("net: veth: do not manipulate GRO when using XDP") Reported-by: Yi Chen Closes: https://issues.redhat.com/browse/RHEL-53858 Reviewed-by: Toke Høiland-Jørgensen Acked-by: Paolo Abeni Signed-off-by: Hangbin Liu Signed-off-by: David S. Miller tools/testing/selftests/net/udpgro.sh | 9 +-------- 1 file changed, 1 insertion(+), 8 deletions(-) commit 7167395a4be7930ecac6a33b4e54d7e3dd9ee209 Author: Hangbin Liu Date: Thu Aug 15 15:59:50 2024 +0800 selftests: udpgro: report error when receive failed Currently, we only check the latest senders's exit code. If the receiver report failed, it is not recoreded. Fix it by checking the exit code of all the involved processes. Before: bad GRO lookup ok multiple GRO socks ./udpgso_bench_rx: recv: bad packet len, got 1452, expected 14520 ./udpgso_bench_rx: recv: bad packet len, got 1452, expected 14520 failed $ echo $? 0 After: bad GRO lookup ok multiple GRO socks ./udpgso_bench_rx: recv: bad packet len, got 1452, expected 14520 ./udpgso_bench_rx: recv: bad packet len, got 1452, expected 14520 failed $ echo $? 1 Fixes: 3327a9c46352 ("selftests: add functionals test for UDP GRO") Suggested-by: Paolo Abeni Signed-off-by: Hangbin Liu Signed-off-by: David S. Miller tools/testing/selftests/net/udpgro.sh | 44 +++++++++++++++++++++-------------- 1 file changed, 27 insertions(+), 17 deletions(-) commit 32108c22ac619c32dd6db594319e259b63bfb387 Author: Takashi Iwai Date: Mon Aug 19 10:41:53 2024 +0200 ALSA: seq: Skip event type filtering for UMP events UMP events don't use the event type field, hence it's invalid to apply the filter, which may drop the events unexpectedly. Skip the event filtering for UMP events, instead. Fixes: 46397622a3fa ("ALSA: seq: Add UMP support") Cc: Link: https://patch.msgid.link/20240819084156.10286-1-tiwai@suse.de Signed-off-by: Takashi Iwai sound/core/seq/seq_clientmgr.c | 3 +++ 1 file changed, 3 insertions(+) commit 56314c0d78d6f5a60c8804c517167991a879e14a Author: John Sweeney Date: Sun Aug 18 11:30:15 2024 -0400 ALSA: hda/realtek: Enable mute/micmute LEDs on HP Laptop 14-ey0xxx HP Pavilion Plus 14-ey0xxx needs existing quirk ALC245_FIXUP_HP_X360_MUTE_LEDS to enable its mute/micmute LEDs. Signed-off-by: John Sweeney Cc: Link: https://patch.msgid.link/E1sfhrD-0007TA-HC@rmmprod05.runbox Signed-off-by: Takashi Iwai sound/pci/hda/patch_realtek.c | 1 + 1 file changed, 1 insertion(+) commit e080a26725fb36f535f22ea42694c60ab005fb2e Author: Gao Xiang Date: Mon Aug 19 10:52:07 2024 +0800 erofs: allow large folios for compressed files As commit 2e6506e1c4ee ("mm/migrate: fix deadlock in migrate_pages_batch() on large folios") has landed upstream, large folios can be safely enabled for compressed inodes since all prerequisites have already landed in 6.11-rc1. Stress tests has been running on my fleet for over 20 days without any regression. Additionally, users [1] have requested it for months. Let's allow large folios for EROFS full cases upstream now for wider testing. [1] https://lore.kernel.org/r/CAGsJ_4wtE8OcpinuqVwG4jtdx6Qh5f+TON6wz+4HMCq=A2qFcA@mail.gmail.com Cc: Barry Song <21cnbao@gmail.com> Cc: Matthew Wilcox (Oracle) [ Gao Xiang: minor commit typo fixes. ] Signed-off-by: Gao Xiang Link: https://lore.kernel.org/r/20240819025207.3808649-1-hsiangkao@linux.alibaba.com Documentation/filesystems/erofs.rst | 2 +- fs/erofs/inode.c | 18 ++++++++---------- 2 files changed, 9 insertions(+), 11 deletions(-) commit a9aaf1ff88a8cb99a1335c9eb76de637f0cf8c10 Author: Bartosz Golaszewski Date: Tue Aug 13 21:07:50 2024 +0200 power: sequencing: request the WLAN enable GPIO as-is If the WCN module is powered up before linux boots and the ath11k driver probes at the same time as the power sequencing driver, we may end up driving the wlan-enable GPIO low in the latter, breaking the start-up of the WLAN module. Request the wlan-enable GPIO as-is so that if the WLAN module is already starting/started, we leave it alone. Fixes: 2f1630f437df ("power: pwrseq: add a driver for the PMU module on the QCom WCN chipsets") Reported-by: Stephan Gerhold Link: https://lore.kernel.org/r/20240813190751.155035-1-brgl@bgdev.pl Signed-off-by: Bartosz Golaszewski drivers/power/sequencing/pwrseq-qcom-wcn.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit aaa4ca873d3da768896ffc909795359a01e853ef Author: Werner Sembach Date: Thu Jan 4 19:31:18 2024 +0100 Input: i8042 - use new forcenorestore quirk to replace old buggy quirk combination The old quirk combination sometimes cause a laggy keyboard after boot. With the new quirk the initial issue of an unresponsive keyboard after s3 resume is also fixed, but it doesn't have the negative side effect of the sometimes laggy keyboard. Signed-off-by: Werner Sembach Cc: stable@vger.kernel.org Reviewed-by: Hans de Goede Link: https://lore.kernel.org/r/20240104183118.779778-3-wse@tuxedocomputers.com Signed-off-by: Dmitry Torokhov drivers/input/serio/i8042-acpipnpio.h | 10 +--------- 1 file changed, 1 insertion(+), 9 deletions(-) commit 3d765ae2daccc570b3f4fbcb57eb321b12cdded2 Author: Werner Sembach Date: Thu Jan 4 19:31:17 2024 +0100 Input: i8042 - add forcenorestore quirk to leave controller untouched even on s3 On s3 resume the i8042 driver tries to restore the controller to a known state by reinitializing things, however this can confuse the controller with different effects. Mostly occasionally unresponsive keyboards after resume. These issues do not rise on s0ix resume as here the controller is assumed to preserved its state from before suspend. This patch adds a quirk for devices where the reinitialization on s3 resume is not needed and might be harmful as described above. It does this by using the s0ix resume code path at selected locations. This new quirk goes beyond what the preexisting reset=never quirk does, which only skips some reinitialization steps. Signed-off-by: Werner Sembach Cc: stable@vger.kernel.org Reviewed-by: Hans de Goede Link: https://lore.kernel.org/r/20240104183118.779778-2-wse@tuxedocomputers.com Signed-off-by: Dmitry Torokhov drivers/input/serio/i8042-acpipnpio.h | 10 +++++++--- drivers/input/serio/i8042.c | 10 +++++++--- 2 files changed, 14 insertions(+), 6 deletions(-) commit 5d41eeb6725e3e24853629e5d7635e4bc45d736e Author: Suraj Kandpal Date: Fri Aug 9 17:11:28 2024 +0530 drm/i915/hdcp: Use correct cp_irq_count We are checking cp_irq_count from the wrong hdcp structure which ends up giving timed out errors. We only increment the cp_irq_count of the primary connector's hdcp structure but here in case of multidisplay setup we end up checking the secondary connector's hdcp structure, which will not have its cp_irq_count incremented. This leads to a timed out at CP_IRQ error even though a CP_IRQ was raised. Extract it from the correct intel_hdcp structure. --v2 -Explain why it was the wrong hdcp structure [Jani] Fixes: 8c9e4f68b861 ("drm/i915/hdcp: Use per-device debugs") Signed-off-by: Suraj Kandpal Reviewed-by: Ankit Nautiyal Link: https://patchwork.freedesktop.org/patch/msgid/20240809114127.3940699-2-suraj.kandpal@intel.com (cherry picked from commit dd925902634def895690426bf10e0a8b3e56f56d) Signed-off-by: Joonas Lahtinen drivers/gpu/drm/i915/display/intel_dp_hdcp.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) commit 7ce7c2283fa6843ab3c2adfeb83dcc504a107858 Author: Takashi Iwai Date: Wed Aug 14 12:06:19 2024 +0200 Input: i8042 - add Fujitsu Lifebook E756 to i8042 quirk table Yet another quirk entry for Fujitsu laptop. Lifebook E756 requires i8041.nomux for keeping the touchpad working after suspend/resume. Link: https://bugzilla.suse.com/show_bug.cgi?id=1229056 Signed-off-by: Takashi Iwai Link: https://lore.kernel.org/r/20240814100630.2048-1-tiwai@suse.de Signed-off-by: Dmitry Torokhov drivers/input/serio/i8042-acpipnpio.h | 9 +++++++++ 1 file changed, 9 insertions(+) commit 2c534624ae70100aeea0b5800b0f3768b2fd3cf0 Author: Hongzhen Luo Date: Tue Aug 6 19:22:08 2024 +0800 erofs: get rid of check_layout_compatibility() Simple enough to just open-code it. Signed-off-by: Hongzhen Luo Reviewed-by: Sandeep Dhavale Reviewed-by: Gao Xiang Link: https://lore.kernel.org/r/20240806112208.150323-1-hongzhen@linux.alibaba.com Signed-off-by: Gao Xiang fs/erofs/super.c | 26 ++++++-------------------- 1 file changed, 6 insertions(+), 20 deletions(-) commit 5b5c96c63d5b6e91c622611e04b2b156bbae53f5 Author: Hongzhen Luo Date: Thu Aug 1 19:26:22 2024 +0800 erofs: simplify readdir operation - Use i_size instead of i_size_read() due to immutable fses; - Get rid of an unneeded goto since erofs_fill_dentries() also works; - Remove unnecessary lines. Signed-off-by: Hongzhen Luo Link: https://lore.kernel.org/r/20240801112622.2164029-1-hongzhen@linux.alibaba.com Reviewed-by: Gao Xiang Signed-off-by: Gao Xiang fs/erofs/dir.c | 35 ++++++++++++----------------------- fs/erofs/internal.h | 2 +- 2 files changed, 13 insertions(+), 24 deletions(-) commit 47cdc7b14417a40af6a5d5909f1d28a5a23fc11d Author: Kent Overstreet Date: Sat Aug 17 17:38:43 2024 -0400 bcachefs: Fix incorrect gfp flags fixes: 00488 WARNING: CPU: 9 PID: 194 at mm/page_alloc.c:4410 __alloc_pages_noprof+0x1818/0x1888 00488 Modules linked in: 00488 CPU: 9 UID: 0 PID: 194 Comm: kworker/u66:1 Not tainted 6.11.0-rc1-ktest-g18fa10d6495f #2931 00488 Hardware name: linux,dummy-virt (DT) 00488 Workqueue: writeback wb_workfn (flush-bcachefs-2) 00488 pstate: 20001005 (nzCv daif -PAN -UAO -TCO -DIT +SSBS BTYPE=--) 00488 pc : __alloc_pages_noprof+0x1818/0x1888 00488 lr : __alloc_pages_noprof+0x5f4/0x1888 00488 sp : ffffff80ccd8ed00 00488 x29: ffffff80ccd8ed00 x28: 0000000000000000 x27: dfffffc000000000 00488 x26: 0000000000000010 x25: 0000000000000002 x24: 0000000000000000 00488 x23: 0000000000000000 x22: 1ffffff0199b1dbe x21: ffffff80cc680900 00488 x20: 0000000000000000 x19: ffffff80ccd8eed0 x18: 0000000000000000 00488 x17: ffffff80cc58a010 x16: dfffffc000000000 x15: 1ffffff00474e518 00488 x14: 1ffffff00474e518 x13: 1ffffff00474e518 x12: ffffffb8104701b9 00488 x11: 1ffffff8104701b8 x10: ffffffb8104701b8 x9 : ffffffc08043cde8 00488 x8 : 00000047efb8fe48 x7 : ffffff80ccd8ee20 x6 : 0000000000048000 00488 x5 : 1ffffff810470138 x4 : 0000000000000050 x3 : 1ffffff0199b1d94 00488 x2 : ffffffb0199b1d94 x1 : 0000000000000001 x0 : ffffffc082387448 00488 Call trace: 00488 __alloc_pages_noprof+0x1818/0x1888 00488 new_slab+0x284/0x2f0 00488 ___slab_alloc+0x208/0x8e0 00488 __kmalloc_noprof+0x328/0x340 00488 __bch2_writepage+0x106c/0x1830 00488 write_cache_pages+0xa0/0xe8 due to __GFP_NOFAIL without allowing reclaim Signed-off-by: Kent Overstreet fs/bcachefs/fs-io-buffered.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit d9f49c3106e404776afcf6c5682357f4fe088beb Author: Kent Overstreet Date: Sat Aug 17 16:41:39 2024 -0400 bcachefs: fix field-spanning write warning attempts to retrofit memory safety onto C are increasingly annoying ------------[ cut here ]------------ memcpy: detected field-spanning write (size 4) of single field "&k.replicas" at fs/bcachefs/replicas.c:454 (size 3) WARNING: CPU: 5 PID: 6525 at fs/bcachefs/replicas.c:454 bch2_replicas_gc2+0x2cb/0x400 [bcachefs] bch2_replicas_gc2+0x2cb/0x400: bch2_replicas_gc2 at /home/ojab/src/bcachefs/fs/bcachefs/replicas.c:454 (discriminator 3) Modules linked in: dm_mod tun nf_conntrack_netlink nfnetlink xt_addrtype br_netfilter overlay msr sctp bcachefs lz4hc_compress lz4_compress libcrc32c xor raid6_pq lz4_decompress pps_ldisc pps_core wireguard libchacha20poly1305 chacha_x86_64 poly1305_x86_64 ip6_udp_tunnel udp_tunnel curve25519_x86_64 libcurve25519_generic libchacha sit tunnel4 ip_tunnel af_packet bridge stp llc ip6table_nat ip6table_filter ip6_tables xt_MASQUERADE xt_conntrack iptable_nat nf_nat nf_conntrack nf_defrag_ipv6 nf_defrag_ipv4 iptable_filter ip_tables x_tables tcp_bbr sch_fq_codel efivarfs nls_iso8859_1 nls_cp437 vfat fat cdc_mbim cdc_wdm cdc_ncm cdc_ether usbnet r8152 input_leds joydev mii amdgpu mousedev hid_generic usbhid hid ath10k_pci amd_atl edac_mce_amd ath10k_core kvm_amd ath kvm mac80211 bfq crc32_pclmul crc32c_intel polyval_clmulni polyval_generic sha512_ssse3 sha256_ssse3 sha1_ssse3 snd_hda_codec_generic snd_hda_codec_hdmi snd_hda_intel snd_intel_dspcfg i2c_algo_bit drm_exec snd_hda_codec r8169 drm_suballoc_helper aesni_intel gf128mul crypto_simd amdxcp realtek mfd_core tpm_crb drm_buddy snd_hwdep mdio_devres libarc4 cryptd tpm_tis wmi_bmof cfg80211 evdev libphy snd_hda_core tpm_tis_core gpu_sched rapl xhci_pci xhci_hcd snd_pcm drm_display_helper snd_timer tpm sp5100_tco rfkill efi_pstore mpt3sas drm_ttm_helper ahci usbcore libaescfb ccp snd ttm 8250 libahci watchdog soundcore raid_class sha1_generic acpi_cpufreq k10temp 8250_base usb_common scsi_transport_sas i2c_piix4 hwmon video serial_mctrl_gpio serial_base ecdh_generic wmi rtc_cmos backlight ecc gpio_amdpt rng_core gpio_generic button CPU: 5 UID: 0 PID: 6525 Comm: bcachefs Tainted: G W 6.11.0-rc1-ojab-00058-g224bc118aec9 #6 6d5debde398d2a84851f42ab300dae32c2992027 Tainted: [W]=WARN RIP: 0010:bch2_replicas_gc2+0x2cb/0x400 [bcachefs] Code: c7 c2 60 91 d1 c1 48 89 c6 48 c7 c7 98 91 d1 c1 4c 89 14 24 44 89 5c 24 08 48 89 44 24 20 c6 05 fa 68 04 00 01 e8 05 a3 40 e4 <0f> 0b 4c 8b 14 24 44 8b 5c 24 08 48 8b 44 24 20 e9 55 fe ff ff 8b RSP: 0018:ffffb434c9263d60 EFLAGS: 00010246 RAX: 0000000000000000 RBX: ffff9a8efa79cc00 RCX: 0000000000000000 RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 RBP: ffffb434c9263de0 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000005 R13: ffff9a8efa73c300 R14: ffff9a8d9e880000 R15: ffff9a8d9e8806f8 FS: 0000000000000000(0000) GS:ffff9a9410c80000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000565423373090 CR3: 0000000164e30000 CR4: 00000000003506f0 Call Trace: ? __warn+0x97/0x150 ? bch2_replicas_gc2+0x2cb/0x400 [bcachefs 9803eca5e131ef28f26250ede34072d5b50d98b3] bch2_replicas_gc2+0x2cb/0x400: bch2_replicas_gc2 at /home/ojab/src/bcachefs/fs/bcachefs/replicas.c:454 (discriminator 3) ? report_bug+0x196/0x1c0 ? handle_bug+0x3c/0x70 ? exc_invalid_op+0x17/0x80 ? __wake_up_klogd.part.0+0x4c/0x80 ? asm_exc_invalid_op+0x16/0x20 ? bch2_replicas_gc2+0x2cb/0x400 [bcachefs 9803eca5e131ef28f26250ede34072d5b50d98b3] bch2_replicas_gc2+0x2cb/0x400: bch2_replicas_gc2 at /home/ojab/src/bcachefs/fs/bcachefs/replicas.c:454 (discriminator 3) ? bch2_dev_usage_read+0xa0/0xa0 [bcachefs 9803eca5e131ef28f26250ede34072d5b50d98b3] bch2_dev_usage_read+0xa0/0xa0: discard_in_flight_remove at /home/ojab/src/bcachefs/fs/bcachefs/alloc_background.c:1712 Signed-off-by: Kent Overstreet fs/bcachefs/replicas.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) commit d6d539c9a7ad0655e5ad46b5e869f1b20bce8953 Author: Kent Overstreet Date: Sat Aug 17 19:51:13 2024 -0400 bcachefs: Reallocate table when we're increasing size Fixes: c2f6e16a6771 ("bcachefs: Increase size of cuckoo hash table on too many rehashes") Signed-off-by: Kent Overstreet fs/bcachefs/buckets_waiting_for_journal.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) commit 7c525dddbee71880e654ad44f3917787a4f6042c Author: Thorsten Blum Date: Fri Aug 16 19:33:39 2024 +0200 ksmbd: Replace one-element arrays with flexible-array members Replace the deprecated one-element arrays with flexible-array members in the structs filesystem_attribute_info and filesystem_device_info. There are no binary differences after this conversion. Link: https://github.com/KSPP/linux/issues/79 Signed-off-by: Thorsten Blum Reviewed-by: Gustavo A. R. Silva Acked-by: Namjae Jeon Signed-off-by: Steve French fs/smb/server/smb2pdu.c | 4 ++-- fs/smb/server/smb_common.h | 4 ++-- 2 files changed, 4 insertions(+), 4 deletions(-) commit 4fdd8664c8a94411a01d11d5ed2f083f105f570a Author: Victor Timofei Date: Fri Aug 16 22:24:52 2024 +0300 ksmbd: fix spelling mistakes in documentation There are a couple of spelling mistakes in the documentation. This patch fixes them. Signed-off-by: Victor Timofei Acked-by: Namjae Jeon Signed-off-by: Steve French Documentation/filesystems/smb/ksmbd.rst | 26 +++++++++++++------------- 1 file changed, 13 insertions(+), 13 deletions(-) commit 76e98a158b207771a6c9a0de0a60522a446a3447 Author: Namjae Jeon Date: Sat Aug 17 14:03:49 2024 +0900 ksmbd: fix race condition between destroy_previous_session() and smb2 operations() If there is ->PreviousSessionId field in the session setup request, The session of the previous connection should be destroyed. During this, if the smb2 operation requests in the previous session are being processed, a racy issue could happen with ksmbd_destroy_file_table(). This patch sets conn->status to KSMBD_SESS_NEED_RECONNECT to block incoming operations and waits until on-going operations are complete (i.e. idle) before desctorying the previous session. Fixes: c8efcc786146 ("ksmbd: add support for durable handles v1/v2") Cc: stable@vger.kernel.org # v6.6+ Reported-by: zdi-disclosures@trendmicro.com # ZDI-CAN-25040 Signed-off-by: Namjae Jeon Signed-off-by: Steve French fs/smb/server/connection.c | 34 +++++++++++++++++++++++++++++++++- fs/smb/server/connection.h | 3 ++- fs/smb/server/mgmt/user_session.c | 9 +++++++++ fs/smb/server/smb2pdu.c | 2 +- 4 files changed, 45 insertions(+), 3 deletions(-) commit dfd046d0ced19b6ff5f11ec4ceab0a83de924771 Author: Namjae Jeon Date: Thu Aug 15 08:56:35 2024 +0900 ksmbd: Use unsafe_memcpy() for ntlm_negotiate rsp buffer is allocated larger than spnego_blob from smb2_allocate_rsp_buf(). Signed-off-by: Namjae Jeon Signed-off-by: Steve French fs/smb/server/smb2pdu.c | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) commit e4be320eeca842a3d7648258ee3673f1755a5a59 Author: Steve French Date: Thu Aug 15 18:31:36 2024 -0500 smb3: fix broken cached reads when posix locks Mandatory locking is enforced for cached reads, which violates default posix semantics, and also it is enforced inconsistently. This affected recent versions of libreoffice, and can be demonstrated by opening a file twice from the same client, locking it from handle one and trying to read from it from handle two (which fails, returning EACCES). There is already a mount option "forcemandatorylock" (which defaults to off), so with this change only when the user intentionally specifies "forcemandatorylock" on mount will we break posix semantics on read to a locked range (ie we will only fail in this case, if the user mounts with "forcemandatorylock"). An earlier patch fixed the write path. Fixes: 85160e03a79e ("CIFS: Implement caching mechanism for mandatory brlocks") Cc: stable@vger.kernel.org Cc: Pavel Shilovsky Reviewed-by: David Howells Reported-by: abartlet@samba.org Reported-by: Kevin Ottens Signed-off-by: Steve French fs/smb/client/file.c | 4 +--- 1 file changed, 1 insertion(+), 3 deletions(-) commit 47ac09b91befbb6a235ab620c32af719f8208399 Author: Linus Torvalds Date: Sun Aug 18 13:17:27 2024 -0700 Linux 6.11-rc4 Makefile | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit ccdbf91fdf5a71881ef32b41797382c4edd6f670 Merge: e1bc113215ab cdd1fa91a6b8 Author: Linus Torvalds Date: Sun Aug 18 10:19:49 2024 -0700 Merge tag 'driver-core-6.11-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/driver-core Pull driver core fixes from Greg KH: "Here are two driver fixes for regressions from 6.11-rc1 due to the driver core change making a structure in a driver core callback const. These were missed by all testing EXCEPT for what Bart happened to be running, so I appreciate the fixes provided here for some odd/not-often-used driver subsystems that nothing else happened to catch. Both of these fixes have been in linux-next all week with no reported issues" * tag 'driver-core-6.11-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/driver-core: mips: sgi-ip22: Fix the build ARM: riscpc: ecard: Fix the build commit e1bc113215ab2875ab52fbbd76a54b5583f67e61 Merge: 394f33f9b3f4 2374bf7558de Author: Linus Torvalds Date: Sun Aug 18 10:16:34 2024 -0700 Merge tag 'char-misc-6.11-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc Pull char / misc fixes from Greg KH: "Here are some small char/misc fixes for 6.11-rc4 to resolve reported problems. Included in here are: - fastrpc revert of a change that broke userspace - xillybus fixes for reported issues Half of these have been in linux-next this week with no reported problems, I don't know if the last bit of xillybus driver changes made it in, but they are 'obviously correct' so will be safe :)" * tag 'char-misc-6.11-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc: char: xillybus: Check USB endpoints when probing device char: xillybus: Refine workqueue handling Revert "misc: fastrpc: Restrict untrusted app to attach to privileged PD" char: xillybus: Don't destroy workqueue from work item running on it commit 394f33f9b3f40dcdd0304f17186d28a0342e8763 Merge: 3d9061d22bef 0863bffda113 Author: Linus Torvalds Date: Sun Aug 18 10:10:48 2024 -0700 Merge tag 'tty-6.11-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/tty Pull tty / serial fixes from Greg KH: "Here are some small tty and serial driver fixes for 6.11-rc4 to resolve some reported problems. Included in here are: - conmakehash.c userspace build issues - fsl_lpuart driver fix - 8250_omap revert for reported regression - atmel_serial rts flag fix All of these have been in linux-next this week with no reported issues" * tag 'tty-6.11-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/tty: Revert "serial: 8250_omap: Set the console genpd always on if no console suspend" tty: atmel_serial: use the correct RTS flag. tty: vt: conmakehash: remove non-portable code printing comment header tty: serial: fsl_lpuart: mark last busy before uart_add_one_port commit 3d9061d22bef282dfd993f9481a1f0cb755bd7f6 Merge: 57b14823ea68 af8e119f52e9 Author: Linus Torvalds Date: Sun Aug 18 09:59:06 2024 -0700 Merge tag 'usb-6.11-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb Pull USB / Thunderbolt driver fixes from Greg KH: "Here are some small USB and Thunderbolt driver fixes for 6.11-rc4 to resolve some reported issues. Included in here are: - thunderbolt driver fixes for reported problems - typec driver fixes - xhci fixes - new device id for ljca usb driver All of these have been in linux-next this week with no reported issues" * tag 'usb-6.11-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb: xhci: Fix Panther point NULL pointer deref at full-speed re-enumeration usb: misc: ljca: Add Lunar Lake ljca GPIO HID to ljca_gpio_hids[] Revert "usb: typec: tcpm: clear pd_event queue in PORT_RESET" usb: typec: ucsi: Fix the return value of ucsi_run_command() usb: xhci: fix duplicate stall handling in handle_tx_event() usb: xhci: Check for xhci->interrupters being allocated in xhci_mem_clearup() thunderbolt: Mark XDomain as unplugged when router is removed thunderbolt: Fix memory leaks in {port|retimer}_sb_regs_write() commit 57b14823ea68592bd67e4992a2bf0dd67abb68d6 Merge: 3c0da3d163eb 534f7eff9239 Author: Linus Torvalds Date: Sun Aug 18 08:50:36 2024 -0700 Merge tag 'for-6.11-rc3-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/kdave/linux Pull more btrfs fixes from David Sterba: "A more fixes. We got reports that shrinker added in 6.10 still causes latency spikes and the fixes don't handle all corner cases. Due to summer holidays we're taking a shortcut to disable it for release builds and will fix it in the near future. - only enable extent map shrinker for DEBUG builds, temporary quick fix to avoid latency spikes for regular builds - update target inode's ctime on unlink, mandated by POSIX - properly take lock to read/update block group's zoned variables - add counted_by() annotations" * tag 'for-6.11-rc3-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/kdave/linux: btrfs: only enable extent map shrinker for DEBUG builds btrfs: zoned: properly take lock to read/update block group's zoned variables btrfs: tree-checker: add dev extent item checks btrfs: update target inode's ctime on unlink btrfs: send: annotate struct name_cache_entry with __counted_by() commit 3c0da3d163eb32f1f91891efaade027fa9b245b9 Author: Jann Horn Date: Tue Aug 6 21:51:42 2024 +0200 fuse: Initialize beyond-EOF page contents before setting uptodate fuse_notify_store(), unlike fuse_do_readpage(), does not enable page zeroing (because it can be used to change partial page contents). So fuse_notify_store() must be more careful to fully initialize page contents (including parts of the page that are beyond end-of-file) before marking the page uptodate. The current code can leave beyond-EOF page contents uninitialized, which makes these uninitialized page contents visible to userspace via mmap(). This is an information leak, but only affects systems which do not enable init-on-alloc (via CONFIG_INIT_ON_ALLOC_DEFAULT_ON=y or the corresponding kernel command line parameter). Link: https://bugs.chromium.org/p/project-zero/issues/detail?id=2574 Cc: stable@kernel.org Fixes: a1d75f258230 ("fuse: add store request") Signed-off-by: Jann Horn Signed-off-by: Linus Torvalds fs/fuse/dev.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) commit c3f2d783a459980eafd24c5af94ccd56a615961f Merge: 810996a36309 2e6506e1c4ee Author: Linus Torvalds Date: Sat Aug 17 19:50:16 2024 -0700 Merge tag 'mm-hotfixes-stable-2024-08-17-19-34' of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm Pull misc fixes from Andrew Morton: "16 hotfixes. All except one are for MM. 10 of these are cc:stable and the others pertain to post-6.10 issues. As usual with these merges, singletons and doubletons all over the place, no identifiable-by-me theme. Please see the lovingly curated changelogs to get the skinny" * tag 'mm-hotfixes-stable-2024-08-17-19-34' of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm: mm/migrate: fix deadlock in migrate_pages_batch() on large folios alloc_tag: mark pages reserved during CMA activation as not tagged alloc_tag: introduce clear_page_tag_ref() helper function crash: fix riscv64 crash memory reserve dead loop selftests: memfd_secret: don't build memfd_secret test on unsupported arches mm: fix endless reclaim on machines with unaccepted memory selftests/mm: compaction_test: fix off by one in check_compaction() mm/numa: no task_numa_fault() call if PMD is changed mm/numa: no task_numa_fault() call if PTE is changed mm/vmalloc: fix page mapping if vm_area_alloc_pages() with high order fallback to order 0 mm/memory-failure: use raw_spinlock_t in struct memory_failure_cpu mm: don't account memmap per-node mm: add system wide stats items category mm: don't account memmap on failure mm/hugetlb: fix hugetlb vs. core-mm PT locking mseal: fix is_madv_discard() commit 810996a36309a56a39b406d9ad2903115714228f Merge: e0fac5fc8b76 227bbaabe64b Author: Linus Torvalds Date: Sat Aug 17 19:23:02 2024 -0700 Merge tag 'powerpc-6.11-2' of git://git.kernel.org/pub/scm/linux/kernel/git/powerpc/linux Pull powerpc fixes from Michael Ellerman: - Fix crashes on 85xx with some configs since the recent hugepd rework. - Fix boot warning with hugepages and CONFIG_DEBUG_VIRTUAL on some platforms. - Don't enable offline cores when changing SMT modes, to match existing userspace behaviour. Thanks to Christophe Leroy, Dr. David Alan Gilbert, Guenter Roeck, Nysal Jan K.A, Shrikanth Hegde, Thomas Gleixner, and Tyrel Datwyler. * tag 'powerpc-6.11-2' of git://git.kernel.org/pub/scm/linux/kernel/git/powerpc/linux: powerpc/topology: Check if a core is online cpu/SMT: Enable SMT only if a core is online powerpc/mm: Fix boot warning with hugepages and CONFIG_DEBUG_VIRTUAL powerpc/mm: Fix size of allocated PGDIR soc: fsl: qbman: remove unused struct 'cgr_comp' commit e0fac5fc8b7657ee82a7d23eeac564182dbf51fd Merge: 98a1b2d71f9f 5b4f3af39b65 Author: Linus Torvalds Date: Sat Aug 17 16:31:12 2024 -0700 Merge tag 'v6.11-rc3-smb3-client-fixes' of git://git.samba.org/sfrench/cifs-2.6 Pull smb client fixes from Steve French: - fix for clang warning - additional null check - fix for cached write with posix locks - flexible structure fix * tag 'v6.11-rc3-smb3-client-fixes' of git://git.samba.org/sfrench/cifs-2.6: smb: smb2pdu.h: Use static_assert() to check struct sizes smb3: fix lock breakage for cached writes smb/client: avoid possible NULL dereference in cifs_free_subrequest() commit 98a1b2d71f9fac01c7aba80f30235b1b2e8234da Merge: df6cbc62cc9b 87cea484951e Author: Linus Torvalds Date: Sat Aug 17 16:23:05 2024 -0700 Merge tag 'i2c-for-6.11-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/wsa/linux Pull i2c fixes from Wolfram Sang: "I2C core fix replacing IS_ENABLED() with IS_REACHABLE() For host drivers, there are two fixes: - Tegra I2C Controller: Addresses a potential double-locking issue during probe. ACPI devices are not IRQ-safe when invoking runtime suspend and resume functions, so the irq_safe flag should not be set. - Qualcomm GENI I2C Controller: Fixes an oversight in the exit path of the runtime_resume() function, which was missed in the previous release" * tag 'i2c-for-6.11-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/wsa/linux: i2c: tegra: Do not mark ACPI devices as irq safe i2c: Use IS_REACHABLE() for substituting empty ACPI functions i2c: qcom-geni: Add missing geni_icc_disable in geni_i2c_runtime_resume commit ab8d66d132bc8f1992d3eb6cab8d32dda6733c84 Author: Krzysztof Kozlowski Date: Mon Jul 29 16:01:57 2024 +0200 soundwire: stream: fix programming slave ports for non-continous port maps Two bitmasks in 'struct sdw_slave_prop' - 'source_ports' and 'sink_ports' - define which ports to program in sdw_program_slave_port_params(). The masks are used to get the appropriate data port properties ('struct sdw_get_slave_dpn_prop') from an array. Bitmasks can be non-continuous or can start from index different than 0, thus when looking for matching port property for given port, we must iterate over mask bits, not from 0 up to number of ports. This fixes allocation and programming slave ports, when a source or sink masks start from further index. Fixes: f8101c74aa54 ("soundwire: Add Master and Slave port programming") Cc: stable@vger.kernel.org Signed-off-by: Krzysztof Kozlowski Reviewed-by: Pierre-Louis Bossart Link: https://lore.kernel.org/r/20240729140157.326450-1-krzysztof.kozlowski@linaro.org Signed-off-by: Vinod Koul drivers/soundwire/stream.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) commit df6cbc62cc9b3bcf593d13400dd58cd339a0f56d Merge: d09840f8b362 8c6b808c8c2a Author: Linus Torvalds Date: Sat Aug 17 10:04:01 2024 -0700 Merge tag 'scsi-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi Pull SCSI fixes from James Bottomley: "Two small fixes to the mpi3mr driver. One to avoid oversize allocations in tracing and the other to fix an uninitialized spinlock in the user to driver feature request code (used to trigger dumps and the like)" * tag 'scsi-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi: scsi: mpi3mr: Avoid MAX_PAGE_ORDER WARNING for buffer allocations scsi: mpi3mr: Add missing spin_lock_init() for mrioc->trigger_lock commit d09840f8b362d16a0722d300a6c7c8cca626e628 Merge: b71817585383 8d16762047c6 Author: Linus Torvalds Date: Sat Aug 17 09:51:28 2024 -0700 Merge tag 'xfs-6.11-fixes-3' of git://git.kernel.org/pub/scm/fs/xfs/xfs-linux Pull xfs fixes from Chandan Babu: - Check for presence of only 'attr' feature before scrubbing an inode's attribute fork. - Restore the behaviour of setting AIL thread to TASK_INTERRUPTIBLE for long (i.e. 50ms) sleep durations to prevent high load averages. - Do not allow users to change the realtime flag of a file unless the datadev and rtdev both support fsdax access modes. * tag 'xfs-6.11-fixes-3' of git://git.kernel.org/pub/scm/fs/xfs/xfs-linux: xfs: conditionally allow FS_XFLAG_REALTIME changes if S_DAX is set xfs: revert AIL TASK_KILLABLE threshold xfs: attr forks require attr, not attr2 commit b71817585383d96ddc51ebd126f6253fdb9a8568 Merge: e5fa841af679 0e49d3ff1250 Author: Linus Torvalds Date: Sat Aug 17 09:46:10 2024 -0700 Merge tag 'bcachefs-2024-08-16' of git://evilpiepirate.org/bcachefs Pull bcachefs fixes from Kent OverstreetL - New on disk format version, bcachefs_metadata_version_disk_accounting_inum This adds one more disk accounting counter, which counts disk usage and number of extents per inode number. This lets us track fragmentation, for implementing defragmentation later, and it also counts disk usage per inode in all snapshots, which will be a useful thing to expose to users. - One performance issue we've observed is threads spinning when they should be waiting for dirty keys in the key cache to be flushed by journal reclaim, so we now have hysteresis for the waiting thread, as well as improving the tracepoint and a new time_stat, for tracking time blocked waiting on key cache flushing. ... and various assorted smaller fixes. * tag 'bcachefs-2024-08-16' of git://evilpiepirate.org/bcachefs: bcachefs: Fix locking in __bch2_trans_mark_dev_sb() bcachefs: fix incorrect i_state usage bcachefs: avoid overflowing LRU_TIME_BITS for cached data lru bcachefs: Fix forgetting to pass trans to fsck_err() bcachefs: Increase size of cuckoo hash table on too many rehashes bcachefs: bcachefs_metadata_version_disk_accounting_inum bcachefs: Kill __bch2_accounting_mem_mod() bcachefs: Make bkey_fsck_err() a wrapper around fsck_err() bcachefs: Fix warning in __bch2_fsck_err() for trans not passed in bcachefs: Add a time_stat for blocked on key cache flush bcachefs: Improve trans_blocked_journal_reclaim tracepoint bcachefs: Add hysteresis to waiting on btree key cache flush lib/generic-radix-tree.c: Fix rare race in __genradix_ptr_alloc() bcachefs: Convert for_each_btree_node() to lockrestart_do() bcachefs: Add missing downgrade table entry bcachefs: disk accounting: ignore unknown types bcachefs: bch2_accounting_invalid() fixup bcachefs: Fix bch2_trigger_alloc when upgrading from old versions bcachefs: delete faulty fastpath in bch2_btree_path_traverse_cached() commit 0a3b517c8089aa4cf339f41460d542c681409386 Author: Jean-Baptiste Maneyrol Date: Wed Aug 14 14:37:35 2024 +0000 iio: imu: inv_mpu6050: fix interrupt status read for old buggy chips Interrupt status read seems to be broken on some old MPU-6050 like chips. Fix by reverting to previous driver behavior bypassing interrupt status read. This is working because these chips are not supporting WoM and data ready is the only interrupt source. Fixes: 5537f653d9be ("iio: imu: inv_mpu6050: add new interrupt handler for WoM events") Cc: stable@vger.kernel.org Signed-off-by: Jean-Baptiste Maneyrol Tested-by: Svyatoslav Ryhel # LG P895 Tested-by: Andreas Westman Dorcsak # LG P880 Link: https://patch.msgid.link/20240814143735.327302-1-inv.git-commit@tdk.com Signed-off-by: Jonathan Cameron drivers/iio/imu/inv_mpu6050/inv_mpu_trigger.c | 13 +++++++++++-- 1 file changed, 11 insertions(+), 2 deletions(-) commit f242967f4d1c024ac42bb47ea50b6360b4cb4556 Author: Dumitru Ceclan Date: Fri Aug 9 16:49:08 2024 +0300 iio: adc: ad7173: fix GPIO device info Models AD4114/5/6 have .higher_gpio_bits = true. This is not correct as the only models that have the GPIO bits to a higher position are AD4111/2. Fix by removing the higher_gpio_bits = true from the AD4114/5/6 models. Fixes: 13d12e3ad12d ("iio: adc: ad7173: Add support for AD411x devices") Signed-off-by: Dumitru Ceclan Link: https://patch.msgid.link/20240809134909.26829-1-dumitru.ceclan@analog.com Cc: Signed-off-by: Jonathan Cameron drivers/iio/adc/ad7173.c | 3 --- 1 file changed, 3 deletions(-) commit 2d7423040b7cca0beb385e67b660ca524c670ff9 Merge: a0c9fe5eecc9 538fd3921afa Author: Jakub Kicinski Date: Fri Aug 16 19:07:30 2024 -0700 Merge tag 'for-net-2024-08-15' of git://git.kernel.org/pub/scm/linux/kernel/git/bluetooth/bluetooth Luiz Augusto von Dentz says: ==================== bluetooth pull request for net: - MGMT: Add error handling to pair_device() - HCI: Invert LE State quirk to be opt-out rather then opt-in - hci_core: Fix LE quote calculation - SMP: Fix assumption of Central always being Initiator * tag 'for-net-2024-08-15' of git://git.kernel.org/pub/scm/linux/kernel/git/bluetooth/bluetooth: Bluetooth: MGMT: Add error handling to pair_device() Bluetooth: SMP: Fix assumption of Central always being Initiator Bluetooth: hci_core: Fix LE quote calculation Bluetooth: HCI: Invert LE State quirk to be opt-out rather then opt-in ==================== Link: https://patch.msgid.link/20240815171950.1082068-1-luiz.dentz@gmail.com Signed-off-by: Jakub Kicinski commit cbaac68987b8699397df29413b33bd51f5255255 Author: Martin K. Petersen Date: Fri Aug 16 20:53:10 2024 -0400 scsi: sd: Do not attempt to configure discard unless LBPME is set Commit f874d7210d88 ("scsi: sd: Keep the discard mode stable") attempted to address an issue where one mode of discard operation got configured prior to the device completing full discovery. Unfortunately this change assumed discard was always enabled on the device. Do not attempt to configure discard unless LBPME is enabled. Link: https://lore.kernel.org/r/20240817005325.3319384-1-martin.petersen@oracle.com Fixes: f874d7210d88 ("scsi: sd: Keep the discard mode stable") Reported-by: Chris Bainbridge Tested-by: Chris Bainbridge Tested-by: Shin'ichiro Kawasaki Tested-by: John Garry Signed-off-by: Martin K. Petersen drivers/scsi/sd.c | 3 +++ 1 file changed, 3 insertions(+) commit cd612b57c3672487ae8565855eaf9e83862eccc5 Author: Simon Horman Date: Fri Aug 16 13:59:56 2024 +0100 scsi: MAINTAINERS: Add header files to SCSI SUBSYSTEM This is part of an effort to assign a section in MAINTAINERS to header files that relate to Networking [1]. In this case the files with "net" in their name. [1] https://lore.kernel.org/netdev/20240816-net-mnt-v1-0-ef946b47ced4@kernel.org/ As part of that effort these files came up: * include/uapi/scsi/scsi_netlink_fc.h * include/uapi/scsi/scsi_netlink.h Unlike all the other matching files, these one seem to relate more closely to SCSI than Networking, so I have added them to the SCSI SUBSYSTEM section. In order to simplify things, and for consistency, I have added the entire include/uapi/scsi rather than the individual files. Signed-off-by: Simon Horman Link: https://lore.kernel.org/r/20240816-scsi-mnt-v1-1-439af8b1c28b@kernel.org Reviewed-by: Bart Van Assche Signed-off-by: Martin K. Petersen MAINTAINERS | 1 + 1 file changed, 1 insertion(+) commit ea593e028a9cc523557b4084a61d87ae69e2f270 Author: Manivannan Sadhasivam Date: Fri Aug 16 11:55:11 2024 +0530 scsi: ufs: qcom: Add UFSHCD_QUIRK_BROKEN_LSDBS_CAP for SM8550 SoC SM8550 SoC has the UFSHCI 4.0 compliant UFS controller and only supports legacy single doorbell mode without MCQ. But due to a hardware bug, it reports 1 in the 'Legacy Queue & Single Doorbell Support (LSDBS)' field of the Controller Capabilities register. This field is supposed to read as 0 if legacy single doorbell mode is supported and 1 otherwise. Starting with commit 0c60eb0cc320 ("scsi: ufs: core: Check LSDBS cap when !mcq"), ufshcd driver is now relying on the LSDBS field to decide when to use the legacy doorbell mode if MCQ is not supported. And this ends up breaking UFS on SM8550: ufshcd-qcom 1d84000.ufs: ufshcd_init: failed to initialize (legacy doorbell mode not supported) ufshcd-qcom 1d84000.ufs: error -EINVAL: Initialization failed with error -22 So use the UFSHCD_QUIRK_BROKEN_LSDBS_CAP quirk for SM8550 SoC so that the ufshcd driver could use legacy doorbell mode correctly. Fixes: 0c60eb0cc320 ("scsi: ufs: core: Check LSDBS cap when !mcq") Tested-by: Amit Pundir Reviewed-by: Bart Van Assche Signed-off-by: Manivannan Sadhasivam Link: https://lore.kernel.org/r/20240816-ufs-bug-fix-v3-2-e6fe0e18e2a3@linaro.org Signed-off-by: Martin K. Petersen drivers/ufs/host/ufs-qcom.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) commit cd06b713a6880997ca5aecac8e33d5f9c541749e Author: Manivannan Sadhasivam Date: Fri Aug 16 11:55:10 2024 +0530 scsi: ufs: core: Add a quirk for handling broken LSDBS field in controller capabilities register 'Legacy Queue & Single Doorbell Support (LSDBS)' field in the controller capabilities register is supposed to report whether the legacy single doorbell mode is supported in the controller or not. But some controllers report '1' in this field which corresponds to 'LSDB not supported', but they indeed support LSDB. So let's add a quirk to handle those controllers. If the quirk is enabled by the controller driver, then LSDBS register field will be ignored and legacy single doorbell mode is assumed to be enabled always. Tested-by: Amit Pundir Signed-off-by: Manivannan Sadhasivam Link: https://lore.kernel.org/r/20240816-ufs-bug-fix-v3-1-e6fe0e18e2a3@linaro.org Reviewed-by: Bart Van Assche Signed-off-by: Martin K. Petersen drivers/ufs/core/ufshcd.c | 6 +++++- include/ufs/ufshcd.h | 8 ++++++++ 2 files changed, 13 insertions(+), 1 deletion(-) commit a0c9fe5eecc97680323ee83780ea3eaf440ba1b7 Author: Simon Horman Date: Thu Aug 15 16:37:13 2024 +0100 tc-testing: don't access non-existent variable on exception Since commit 255c1c7279ab ("tc-testing: Allow test cases to be skipped") the variable test_ordinal doesn't exist in call_pre_case(). So it should not be accessed when an exception occurs. This resolves the following splat: ... During handling of the above exception, another exception occurred: Traceback (most recent call last): File ".../tdc.py", line 1028, in main() File ".../tdc.py", line 1022, in main set_operation_mode(pm, parser, args, remaining) File ".../tdc.py", line 966, in set_operation_mode catresults = test_runner_serial(pm, args, alltests) File ".../tdc.py", line 642, in test_runner_serial (index, tsr) = test_runner(pm, args, alltests) File ".../tdc.py", line 536, in test_runner res = run_one_test(pm, args, index, tidx) File ".../tdc.py", line 419, in run_one_test pm.call_pre_case(tidx) File ".../tdc.py", line 146, in call_pre_case print('test_ordinal is {}'.format(test_ordinal)) NameError: name 'test_ordinal' is not defined Fixes: 255c1c7279ab ("tc-testing: Allow test cases to be skipped") Signed-off-by: Simon Horman Acked-by: Jamal Hadi Salim Link: https://patch.msgid.link/20240815-tdc-test-ordinal-v1-1-0255c122a427@kernel.org Signed-off-by: Jakub Kicinski tools/testing/selftests/tc-testing/tdc.py | 1 - 1 file changed, 1 deletion(-) commit f03e94f23b04c2b71c0044c1534921b3975ef10c Author: Chaotian Jing Date: Tue Aug 13 13:34:10 2024 +0800 scsi: core: Fix the return value of scsi_logical_block_count() scsi_logical_block_count() should return the block count of a given SCSI command. The original implementation ended up shifting twice, leading to an incorrect count being returned. Fix the conversion between bytes and logical blocks. Cc: stable@vger.kernel.org Fixes: 6a20e21ae1e2 ("scsi: core: Add helper to return number of logical blocks in a request") Signed-off-by: Chaotian Jing Link: https://lore.kernel.org/r/20240813053534.7720-1-chaotian.jing@mediatek.com Reviewed-by: Bart Van Assche Signed-off-by: Martin K. Petersen include/scsi/scsi_cmnd.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 2fa62ce91a52e704716d08f9a8eb3f9e7e04710d Author: Yihang Li Date: Wed Aug 14 12:01:24 2024 +0800 scsi: MAINTAINERS: Update HiSilicon SAS controller driver maintainer Add Yihang Li as the maintainer of the HiSilicon SAS controller driver, replacing Xiang Chen. Signed-off-by: Yihang Li Link: https://lore.kernel.org/r/20240814040124.1376195-1-liyihang9@huawei.com Signed-off-by: Martin K. Petersen MAINTAINERS | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 0e49d3ff12501adaafaf6fdb19699f021d1eda1c Author: Kent Overstreet Date: Sat May 4 23:48:58 2024 -0400 bcachefs: Fix locking in __bch2_trans_mark_dev_sb() We run this in full RW mode now, so we have to guard against the superblock buffer being reallocated. Signed-off-by: Kent Overstreet fs/bcachefs/btree_gc.c | 5 +---- fs/bcachefs/buckets.c | 14 +++++++++----- 2 files changed, 10 insertions(+), 9 deletions(-) commit e5fa841af679cb830da6c609c740a37bdc0b8b35 Merge: c2cdb13a34d9 046667c4d319 Author: Linus Torvalds Date: Fri Aug 16 17:08:02 2024 -0700 Merge tag 'pull-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs Pull memcg-v1 fix from Al Viro: "memcg_write_event_control() oops fix" * tag 'pull-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs: memcg_write_event_control(): fix a user-triggerable oops commit c2cdb13a34d950e61e3b53af0c5f9eb828710beb Merge: 216595b708da f75c235565f9 Author: Linus Torvalds Date: Fri Aug 16 17:02:32 2024 -0700 Merge tag 'arm64-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux Pull arm64 fixes from Catalin Marinas: - Fix the arm64 __get_mem_asm() to use the _ASM_EXTABLE_##type##ACCESS() macro instead of the *_ERR() one in order to avoid writing -EFAULT to the value register in case of a fault - Initialise all elements of the acpi_early_node_map[] to NUMA_NO_NODE. Prior to this fix, only the first element was initialised - Move the KASAN random tag seed initialisation after the per-CPU areas have been initialised (prng_state is __percpu) * tag 'arm64-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux: arm64: Fix KASAN random tag seed initialization arm64: ACPI: NUMA: initialize all values of acpi_early_node_map to NUMA_NO_NODE arm64: uaccess: correct thinko in __get_mem_asm() commit 216595b708dac1707fc68d48042738d6d559ddd5 Merge: 85652baa895b 39a3396558fb Author: Linus Torvalds Date: Fri Aug 16 16:59:05 2024 -0700 Merge tag 'clk-fixes-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/clk/linux Pull clk fix from Stephen Boyd: "One fix for the new T-Head TH1520 clk driver that marks a bus clk critical so that it isn't turned off during late init which breaks emmc-sdio" * tag 'clk-fixes-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/clk/linux: clk: thead: fix dependency on clk_ignore_unused commit 0373d71215a2062fb9eaf82ab0ac09c87d067f9f Merge: 3d93a1448ed0 607e1df7bd47 Author: Jakub Kicinski Date: Fri Aug 16 16:15:58 2024 -0700 Merge branch 'mlx5-misc-fixes-2024-08-15' Tariq Toukan says: ==================== mlx5 misc fixes 2024-08-15 This patchset provides misc bug fixes from the team to the mlx5 driver. ==================== Link: https://patch.msgid.link/20240815071611.2211873-1-tariqt@nvidia.com Signed-off-by: Jakub Kicinski commit 607e1df7bd47fe91cab85a97f57870a26d066137 Author: Patrisious Haddad Date: Thu Aug 15 10:16:11 2024 +0300 net/mlx5: Fix IPsec RoCE MPV trace call Prevent the call trace below from happening, by not allowing IPsec creation over a slave, if master device doesn't support IPsec. WARNING: CPU: 44 PID: 16136 at kernel/locking/rwsem.c:240 down_read+0x75/0x94 Modules linked in: esp4_offload esp4 act_mirred act_vlan cls_flower sch_ingress mlx5_vdpa vringh vhost_iotlb vdpa mst_pciconf(OE) nfsv3 nfs_acl nfs lockd grace fscache netfs xt_CHECKSUM xt_MASQUERADE xt_conntrack ipt_REJECT nf_reject_ipv4 nft_compat nft_counter nft_chain_nat nf_nat nf_conntrack nf_defrag_ipv6 nf_defrag_ipv4 rfkill cuse fuse rpcrdma sunrpc rdma_ucm ib_srpt ib_isert iscsi_target_mod target_core_mod ib_umad ib_iser libiscsi scsi_transport_iscsi rdma_cm ib_ipoib iw_cm ib_cm ipmi_ssif intel_rapl_msr intel_rapl_common amd64_edac edac_mce_amd kvm_amd kvm irqbypass crct10dif_pclmul crc32_pclmul mlx5_ib ghash_clmulni_intel sha1_ssse3 dell_smbios ib_uverbs aesni_intel crypto_simd dcdbas wmi_bmof dell_wmi_descriptor cryptd pcspkr ib_core acpi_ipmi sp5100_tco ccp i2c_piix4 ipmi_si ptdma k10temp ipmi_devintf ipmi_msghandler acpi_power_meter acpi_cpufreq ext4 mbcache jbd2 sd_mod t10_pi sg mgag200 drm_kms_helper syscopyarea sysfillrect mlx5_core sysimgblt fb_sys_fops cec ahci libahci mlxfw drm pci_hyperv_intf libata tg3 sha256_ssse3 tls megaraid_sas i2c_algo_bit psample wmi dm_mirror dm_region_hash dm_log dm_mod [last unloaded: mst_pci] CPU: 44 PID: 16136 Comm: kworker/44:3 Kdump: loaded Tainted: GOE 5.15.0-20240509.el8uek.uek7_u3_update_v6.6_ipsec_bf.x86_64 #2 Hardware name: Dell Inc. PowerEdge R7525/074H08, BIOS 2.0.3 01/15/2021 Workqueue: events xfrm_state_gc_task RIP: 0010:down_read+0x75/0x94 Code: 00 48 8b 45 08 65 48 8b 14 25 80 fc 01 00 83 e0 02 48 09 d0 48 83 c8 01 48 89 45 08 5d 31 c0 89 c2 89 c6 89 c7 e9 cb 88 3b 00 <0f> 0b 48 8b 45 08 a8 01 74 b2 a8 02 75 ae 48 89 c2 48 83 ca 02 f0 RSP: 0018:ffffb26387773da8 EFLAGS: 00010282 RAX: 0000000000000000 RBX: ffffa08b658af900 RCX: 0000000000000001 RDX: 0000000000000000 RSI: ff886bc5e1366f2f RDI: 0000000000000000 RBP: ffffa08b658af940 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000000 R12: ffffa0a9bfb31540 R13: ffffa0a9bfb37900 R14: 0000000000000000 R15: ffffa0a9bfb37905 FS: 0000000000000000(0000) GS:ffffa0a9bfb00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 000055a45ed814e8 CR3: 000000109038a000 CR4: 0000000000350ee0 Call Trace: ? show_trace_log_lvl+0x1d6/0x2f9 ? show_trace_log_lvl+0x1d6/0x2f9 ? mlx5_devcom_for_each_peer_begin+0x29/0x60 [mlx5_core] ? down_read+0x75/0x94 ? __warn+0x80/0x113 ? down_read+0x75/0x94 ? report_bug+0xa4/0x11d ? handle_bug+0x35/0x8b ? exc_invalid_op+0x14/0x75 ? asm_exc_invalid_op+0x16/0x1b ? down_read+0x75/0x94 ? down_read+0xe/0x94 mlx5_devcom_for_each_peer_begin+0x29/0x60 [mlx5_core] mlx5_ipsec_fs_roce_tx_destroy+0xb1/0x130 [mlx5_core] tx_destroy+0x1b/0xc0 [mlx5_core] tx_ft_put+0x53/0xc0 [mlx5_core] mlx5e_xfrm_free_state+0x45/0x90 [mlx5_core] ___xfrm_state_destroy+0x10f/0x1a2 xfrm_state_gc_task+0x81/0xa9 process_one_work+0x1f1/0x3c6 worker_thread+0x53/0x3e4 ? process_one_work.cold+0x46/0x3c kthread+0x127/0x144 ? set_kthread_struct+0x60/0x52 ret_from_fork+0x22/0x2d ---[ end trace 5ef7896144d398e1 ]--- Fixes: dfbd229abeee ("net/mlx5: Configure IPsec steering for egress RoCEv2 MPV traffic") Reviewed-by: Leon Romanovsky Signed-off-by: Patrisious Haddad Signed-off-by: Tariq Toukan Link: https://patch.msgid.link/20240815071611.2211873-5-tariqt@nvidia.com Signed-off-by: Jakub Kicinski drivers/net/ethernet/mellanox/mlx5/core/lib/ipsec_fs_roce.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) commit a07e953dafe5ebd88942dc861dfb06eaf055fb07 Author: Carolina Jubran Date: Thu Aug 15 10:16:10 2024 +0300 net/mlx5e: XPS, Fix oversight of Multi-PF Netdev changes The offending commit overlooked the Multi-PF Netdev changes. Revert mlx5e_set_default_xps_cpumasks to incorporate Multi-PF Netdev changes. Fixes: bcee093751f8 ("net/mlx5e: Modifying channels number and updating TX queues") Signed-off-by: Carolina Jubran Signed-off-by: Tariq Toukan Link: https://patch.msgid.link/20240815071611.2211873-4-tariqt@nvidia.com Signed-off-by: Jakub Kicinski drivers/net/ethernet/mellanox/mlx5/core/en_main.c | 13 ++++++++----- 1 file changed, 8 insertions(+), 5 deletions(-) commit 94e521937839475b83bac46e4d3ccba332e12064 Author: Dragos Tatulea Date: Thu Aug 15 10:16:09 2024 +0300 net/mlx5e: SHAMPO, Release in progress headers The change in the fixes tag cleaned up too much: it removed the part that was releasing header pages that were posted via UMR but haven't been acknowledged yet on the ICOSQ. This patch corrects this omission by setting the bits between pi and ci to on when shutting down a queue with SHAMPO. To be consistent with the Striding RQ code, this action is done in mlx5e_free_rx_missing_descs(). Fixes: e839ac9a89cb ("net/mlx5e: SHAMPO, Simplify header page release in teardown") Signed-off-by: Dragos Tatulea Signed-off-by: Tariq Toukan Link: https://patch.msgid.link/20240815071611.2211873-3-tariqt@nvidia.com Signed-off-by: Jakub Kicinski drivers/net/ethernet/mellanox/mlx5/core/en.h | 1 + drivers/net/ethernet/mellanox/mlx5/core/en_main.c | 8 ++++++++ drivers/net/ethernet/mellanox/mlx5/core/en_rx.c | 25 ++++++++++++++--------- 3 files changed, 24 insertions(+), 10 deletions(-) commit f232de7cdb4b99adb2c7f2bc5e0b7e4e1292873b Author: Dragos Tatulea Date: Thu Aug 15 10:16:08 2024 +0300 net/mlx5e: SHAMPO, Fix page leak When SHAMPO is used, a receive queue currently almost always leaks one page on shutdown. A page has MLX5E_SHAMPO_WQ_HEADER_PER_PAGE (8) headers. These headers are tracked in the SHAMPO bitmap. Each page is released when the last header index in the group is processed. During header allocation, there can be leftovers from a page that will be used in a subsequent allocation. This is normally fine, except for the following scenario (simplified a bit): 1) Allocate N new page fragments, showing only the relevant last 4 fragments: 0: new page 1: new page 2: new page 3: new page 4: page from previous allocation 5: page from previous allocation 6: page from previous allocation 7: page from previous allocation 2) NAPI processes header indices 4-7 because they are the oldest allocated. Bit 7 will be set to 0. 3) Receive queue shutdown occurs. All the remaining bits are being iterated on to release the pages. But the page assigned to header indices 0-3 will not be freed due to what happened in step 2. This patch fixes the issue by making sure that on allocation, header fragments are always allocated in groups of MLX5E_SHAMPO_WQ_HEADER_PER_PAGE so that there is never a partial page left over between allocations. A more appropriate fix would be a refactoring of mlx5e_alloc_rx_hd_mpwqe() and mlx5e_build_shampo_hd_umr(). But this refactoring is too big for net. It will be targeted for net-next. Fixes: e839ac9a89cb ("net/mlx5e: SHAMPO, Simplify header page release in teardown") Signed-off-by: Dragos Tatulea Signed-off-by: Tariq Toukan Link: https://patch.msgid.link/20240815071611.2211873-2-tariqt@nvidia.com Signed-off-by: Jakub Kicinski drivers/net/ethernet/mellanox/mlx5/core/en_rx.c | 1 + 1 file changed, 1 insertion(+) commit 85652baa895b59b94bea29c77cb9b51cf7120deb Merge: c5ac744cddda b313a8c83551 Author: Linus Torvalds Date: Fri Aug 16 14:03:31 2024 -0700 Merge tag 'block-6.11-20240824' of git://git.kernel.dk/linux Pull block fixes from Jens Axboe: - Fix corruption issues with s390/dasd (Eric, Stefan) - Fix a misuse of non irq locking grab of a lock (Li) - MD pull request with a single data corruption fix for raid1 (Yu) * tag 'block-6.11-20240824' of git://git.kernel.dk/linux: block: Fix lockdep warning in blk_mq_mark_tag_wait md/raid1: Fix data corruption for degraded array with slow disk s390/dasd: fix error recovery leading to data corruption on ESE devices s390/dasd: Remove DMA alignment commit c5ac744cdddae82916d4cd35d962d3f47065e68a Merge: 2731835f3f2e 1fc2ac428ef7 Author: Linus Torvalds Date: Fri Aug 16 14:00:05 2024 -0700 Merge tag 'io_uring-6.11-20240824' of git://git.kernel.dk/linux Pull io_uring fixes from Jens Axboe: - Fix a comment in the uapi header using the wrong member name (Caleb) - Fix KCSAN warning for a debug check in sqpoll (me) - Two more NAPI tweaks (Olivier) * tag 'io_uring-6.11-20240824' of git://git.kernel.dk/linux: io_uring: fix user_data field name in comment io_uring/sqpoll: annotate debug task == current with data_race() io_uring/napi: remove duplicate io_napi_entry timeout assignation io_uring/napi: check napi_enabled in io_napi_add() before proceeding commit 2731835f3f2e5b0642ad82a3a0265c98a552283e Merge: 296c871d2904 b739dffa5d57 Author: Linus Torvalds Date: Fri Aug 16 13:50:33 2024 -0700 Merge tag 'devicetree-fixes-for-6.11-2' of git://git.kernel.org/pub/scm/linux/kernel/git/robh/linux Pull devicetree fixes from Rob Herring: - Fix a possible (but unlikely) out-of-bounds read in interrupts parsing code - Add AT25 EEPROM "fujitsu,mb85rs256" compatible - Update Konrad Dybcio's email * tag 'devicetree-fixes-for-6.11-2' of git://git.kernel.org/pub/scm/linux/kernel/git/robh/linux: of/irq: Prevent device address out-of-bounds read in interrupt map walk dt-bindings: eeprom: at25: add fujitsu,mb85rs256 compatible dt-bindings: Batch-update Konrad Dybcio's email commit 534f7eff9239c1b0af852fc33f5af2b62c00eddf Author: Qu Wenruo Date: Fri Aug 16 10:40:38 2024 +0930 btrfs: only enable extent map shrinker for DEBUG builds Although there are several patches improving the extent map shrinker, there are still reports of too frequent shrinker behavior, taking too much CPU for the kswapd process. So let's only enable extent shrinker for now, until we got more comprehensive understanding and a better solution. Link: https://lore.kernel.org/linux-btrfs/3df4acd616a07ef4d2dc6bad668701504b412ffc.camel@intelfx.name/ Link: https://lore.kernel.org/linux-btrfs/c30fd6b3-ca7a-4759-8a53-d42878bf84f7@gmail.com/ Fixes: 956a17d9d050 ("btrfs: add a shrinker for extent maps") CC: stable@vger.kernel.org # 6.10+ Signed-off-by: Qu Wenruo Reviewed-by: David Sterba Signed-off-by: David Sterba fs/btrfs/super.c | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-) commit 296c871d2904cff2b4742702ef94512ab467a8e3 Merge: 64ab5e4039cd 6e6f58a170ea Author: Linus Torvalds Date: Fri Aug 16 11:49:07 2024 -0700 Merge tag 'thermal-6.11-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm Pull thermal control fix from Rafael Wysocki: "Fix a Bang-bang thermal governor issue causing it to fail to reset the state of cooling devices if they are 'on' to start with, but the thermal zone temperature is always below the corresponding trip point (Rafael Wysocki)" * tag 'thermal-6.11-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm: thermal: gov_bang_bang: Use governor_data to reduce overhead thermal: gov_bang_bang: Add .manage() callback thermal: gov_bang_bang: Split bang_bang_control() thermal: gov_bang_bang: Call __thermal_cdev_update() directly commit 64ab5e4039cd713afdb7c1b1d6a693efdd2050d8 Merge: e4a55b555db6 71bf41b8e913 Author: Linus Torvalds Date: Fri Aug 16 11:43:54 2024 -0700 Merge tag 'acpi-6.11-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm Pull ACPI fix from Rafael Wysocki: "Fix an issue related to the ACPI EC device handling that causes the _REG control method to be evaluated for EC operation regions that are not expected to be used. This confuses the platform firmware and provokes various types of misbehavior on some systems (Rafael Wysocki)" * tag 'acpi-6.11-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm: ACPI: EC: Evaluate _REG outside the EC scope more carefully ACPICA: Add a depth argument to acpi_execute_reg_methods() Revert "ACPI: EC: Evaluate orphan _REG under EC device" commit e4a55b555db6d2a006551605ef4404529e878cd2 Merge: 60cb1da6ed4a d5240fa65db0 Author: Linus Torvalds Date: Fri Aug 16 11:36:40 2024 -0700 Merge tag 'libnvdimm-fixes-6.11-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/nvdimm/nvdimm Pull libnvdimm fix from Ira Weiny: "Commit f467fee48da4 ("block: move the dax flag to queue_limits") broke the DAX tests by skipping over the legacy pmem mapping pages case. Set the DAX flag in this case as well" * tag 'libnvdimm-fixes-6.11-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/nvdimm/nvdimm: nvdimm/pmem: Set dax flag for all 'PFN_MAP' cases commit 1fc2ac428ef7d2ab9e8e19efe7ec3e58aea51bf3 Author: Caleb Sander Mateos Date: Fri Aug 16 12:15:23 2024 -0600 io_uring: fix user_data field name in comment io_uring_cqe's user_data field refers to `sqe->data`, but io_uring_sqe does not have a data field. Fix the comment to say `sqe->user_data`. Signed-off-by: Caleb Sander Mateos Link: https://github.com/axboe/liburing/pull/1206 Link: https://lore.kernel.org/r/20240816181526.3642732-1-csander@purestorage.com Signed-off-by: Jens Axboe include/uapi/linux/io_uring.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 60cb1da6ed4a62ec8331e25ad4be87115cd28feb Merge: 5b179fe05233 0eba65f0310d Author: Linus Torvalds Date: Fri Aug 16 11:24:06 2024 -0700 Merge tag 'rust-fixes-6.11' of https://github.com/Rust-for-Linux/linux Pull rust fixes from Miguel Ojeda: - Fix '-Os' Rust 1.80.0+ builds adding more intrinsics (also tweaked in upstream Rust for the upcoming 1.82.0). - Fix support for the latest version of rust-analyzer due to a change on rust-analyzer config file semantics (considered a fix since most developers use the latest version of the tool, which is the only one actually supported by upstream). I am discussing stability of the config file with upstream -- they may be able to start versioning it. - Fix GCC 14 builds due to '-fmin-function-alignment' not skipped for libclang (bindgen). - A couple Kconfig fixes around '{RUSTC,BINDGEN}_VERSION_TEXT' to suppress error messages in a foreign architecture chroot and to use a proper default format. - Clean 'rust-analyzer' target warning due to missing recursive make invocation mark. - Clean Clippy warning due to missing indentation in docs. - Clean LLVM 19 build warning due to removed 3dnow feature upstream. * tag 'rust-fixes-6.11' of https://github.com/Rust-for-Linux/linux: rust: x86: remove `-3dnow{,a}` from target features kbuild: rust-analyzer: mark `rust_is_available.sh` invocation as recursive rust: add intrinsics to fix `-Os` builds kbuild: rust: skip -fmin-function-alignment in bindgen flags rust: Support latest version of `rust-analyzer` rust: macros: indent list item in `module!`'s docs rust: fix the default format for CONFIG_{RUSTC,BINDGEN}_VERSION_TEXT rust: suppress error messages from CONFIG_{RUSTC,BINDGEN}_VERSION_TEXT commit 5b179fe052334ea81c9f1841bf782bb0878b61d2 Merge: 4a621e291000 32d5f7add080 Author: Linus Torvalds Date: Fri Aug 16 11:18:09 2024 -0700 Merge tag 'riscv-for-linus-6.11-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/riscv/linux Pull RISC-V fixes from Palmer Dabbelt: - reintroduce the text patching global icache flush - fix syscall entry code to correctly initialize a0, which manifested as a strace bug - XIP kernels now map the entire kernel, which fixes boot under at least DEBUG_VIRTUAL=y - initialize all nodes in the acpi_early_node_map initializer - fix OOB access in the Andes vendor extension probing code - A new key for scalar misaligned access performance in hwprobe, which correctly treat the values as an enum (as opposed to a bitmap) * tag 'riscv-for-linus-6.11-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/riscv/linux: riscv: Fix out-of-bounds when accessing Andes per hart vendor extension array RISC-V: hwprobe: Add SCALAR to misaligned perf defines RISC-V: hwprobe: Add MISALIGNED_PERF key RISC-V: ACPI: NUMA: initialize all values of acpi_early_node_map to NUMA_NO_NODE riscv: change XIP's kernel_map.size to be size of the entire kernel riscv: entry: always initialize regs->a0 to -ENOSYS riscv: Re-introduce global icache flush in patch_text_XXX() commit 4a621e291000c3756c353c5671ade4837ba68e3e Merge: 1486141ad8e7 90574d2a6759 Author: Linus Torvalds Date: Fri Aug 16 11:12:29 2024 -0700 Merge tag 'trace-v6.11-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace Pull tracing fixes from Steven Rostedt: "A couple of fixes for tracing: - Prevent a NULL pointer dereference in the error path of RTLA tool - Fix an infinite loop bug when reading from the ring buffer when closed. If there's a thread trying to read the ring buffer and it gets closed by another thread, the one reading will go into an infinite loop when the buffer is empty instead of exiting back to user space" * tag 'trace-v6.11-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace: rtla/osnoise: Prevent NULL dereference in error handling tracing: Return from tracing_buffers_read() if the file has been closed commit 1486141ad8e79956e393f9af0ce076a5942e8feb Merge: 670c12ce09a8 0e28bf61a5f9 Author: Linus Torvalds Date: Fri Aug 16 11:05:25 2024 -0700 Merge tag 'keys-trusted-next-6.11-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/jarkko/linux-tpmdd Pull key fixes from Jarkko Sakkinen: "Two bug fixes for a memory corruption bug and a memory leak bug in the DCP trusted keys type. Just as a reminder DCP was a crypto coprocessor in i.MX SoCs" * tag 'keys-trusted-next-6.11-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/jarkko/linux-tpmdd: KEYS: trusted: dcp: fix leak of blob encryption key KEYS: trusted: fix DCP blob payload length assignment commit 99c87fe0f584f8d778a323141504d1ba5c89a4a5 Author: Kent Overstreet Date: Fri Aug 16 12:44:49 2024 -0400 bcachefs: fix incorrect i_state usage Reported-by: syzbot+95e40eae71609e40d851@syzkaller.appspotmail.com Signed-off-by: Kent Overstreet fs/bcachefs/fs.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 9482f3b05332a624508a91c2ab2cf3527328a6a4 Author: Kent Overstreet Date: Fri Aug 16 12:41:46 2024 -0400 bcachefs: avoid overflowing LRU_TIME_BITS for cached data lru Reported-by: syzbot+510b0b28f8e6de64d307@syzkaller.appspotmail.com Signed-off-by: Kent Overstreet fs/bcachefs/alloc_background.h | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) commit 075cabf324c3fd790d6ba39ff9db33a30b954fe2 Author: Kent Overstreet Date: Fri Aug 16 12:31:29 2024 -0400 bcachefs: Fix forgetting to pass trans to fsck_err() Reported-by: syzbot+e3938cd6d761b78750e6@syzkaller.appspotmail.com Signed-off-by: Kent Overstreet fs/bcachefs/buckets.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit c2f6e16a6771eaefba6bb35f6803fe7217822d41 Author: Kent Overstreet Date: Thu Aug 15 13:02:55 2024 -0400 bcachefs: Increase size of cuckoo hash table on too many rehashes Also, improve the calculation of the new table size, so that it can shrink when needed. Signed-off-by: Kent Overstreet fs/bcachefs/buckets_waiting_for_journal.c | 11 +++++++++-- 1 file changed, 9 insertions(+), 2 deletions(-) commit 670c12ce09a8180ebe0c608d8a789a7e58fe7d8e Merge: de53959e001b faada2174c08 Author: Linus Torvalds Date: Fri Aug 16 09:07:34 2024 -0700 Merge tag 'for-6.11/dm-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/device-mapper/linux-dm Pull device mapper fixes from Mikulas Patocka: - fix misbehavior if suspend or resume is interrupted by a signal - fix wrong indentation in dm-crypt.rst - fix memory allocation failure in dm-persistent-data * tag 'for-6.11/dm-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/device-mapper/linux-dm: dm persistent data: fix memory allocation failure Documentation: dm-crypt.rst warning + error fix dm resume: don't return EINVAL when signalled dm suspend: return -ERESTARTSYS instead of -EINTR commit de53959e001b73ceeb631e04491b473157e1b1a2 Merge: 9bd40f824a7f 92567a5f92bc Author: Linus Torvalds Date: Fri Aug 16 08:56:45 2024 -0700 Merge tag 'iommu-fixes-v6.11-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/iommu/linux Pull iommu fixes from Joerg Roedel: - Bring back a lost return statement in io-page-fault code - Remove an unused function declaration * tag 'iommu-fixes-v6.11-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/iommu/linux: iommu: Remove unused declaration iommu_sva_unbind_gpasid() iommu: Restore lost return in iommu_report_device_fault() commit 9bd40f824a7fed9ffdd1660ea7567f4133f8b672 Merge: d58c542a33e7 aad418323267 Author: Linus Torvalds Date: Fri Aug 16 08:47:50 2024 -0700 Merge tag 'gpio-fixes-for-v6.11-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/brgl/linux Pull gpio fix from Bartosz Golaszewski: - add the shutdown() callback to gpio-mlxbf3 in order to disable interrupts during graceful reboot * tag 'gpio-fixes-for-v6.11-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/brgl/linux: gpio: mlxbf3: Support shutdown() function commit d58c542a33e719029ae3fc1343b4cb09c125cb09 Merge: 37b20e9a5810 829e2a23121f Author: Linus Torvalds Date: Fri Aug 16 08:39:41 2024 -0700 Merge tag 'sound-6.11-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound Pull sound fixes from Takashi Iwai: "All small fixes, mostly for usual suspects, HD-audio and USB-audio device-specific fixes / quirks. The Cirrus codec support took the update of SPI header as well. Other than that, there is a regression fix in the sanity check of ALSA timer code" * tag 'sound-6.11-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound: ALSA: hda/tas2781: Use correct endian conversion ALSA: usb-audio: Support Yamaha P-125 quirk entry ALSA: hda: cs35l41: Remove redundant call to hda_cs_dsp_control_remove() ALSA: hda: cs35l56: Remove redundant call to hda_cs_dsp_control_remove() ALSA: hda/tas2781: fix wrong calibrated data order ALSA: usb-audio: Add delay quirk for VIVO USB-C-XE710 HEADSET ALSA: hda/realtek: Add support for new HP G12 laptops ALSA: hda/realtek: Fix noise from speakers on Lenovo IdeaPad 3 15IAU7 ALSA: timer: Relax start tick time check for slave timer elements spi: Add empty versions of ACPI functions commit 37b20e9a5810e132a21c54f858043b22671396dd Merge: d7a5aa4b3c00 fee9d135e2fd Author: Linus Torvalds Date: Fri Aug 16 08:35:50 2024 -0700 Merge tag 'drm-fixes-2024-08-16' of https://gitlab.freedesktop.org/drm/kernel Pull drm fixes from Dave Airlie: "Weekly drm fixes, mostly amdgpu and xe. The larger amdgpu fix is for a new IP block introduced in rc1, so should be fine. The xe fixes contain some missed fixes from the end of the previous round along with some fixes which required precursor changes, but otherwise everything seems fine, mediatek: - fix cursor crash amdgpu: - Fix MES ring buffer overflow - DCN 3.5 fix - DCN 3.2.1 fix - DP MST fix - Cursor fixes - JPEG fixes - Context ops validation - MES 12 fixes - VCN 5.0 fix - HDP fix panel: - dt bindings style fix - orientation quirks rockchip: - inno-hdmi: fix infoframe upload v3d: - fix OOB access in v3d_csd_job_run() xe: - Validate user fence during creation - Fix use after free when client stats are captured - SRIOV fixes - Runtime PM fixes" * tag 'drm-fixes-2024-08-16' of https://gitlab.freedesktop.org/drm/kernel: (37 commits) drm/xe: Hold a PM ref when GT TLB invalidations are inflight drm/xe: Drop xe_gt_tlb_invalidation_wait drm/xe: Add xe_gt_tlb_invalidation_fence_init helper drm/xe/pf: Fix VF config validation on multi-GT platforms drm/xe: Build PM into GuC CT layer drm/xe/vf: Fix register value lookup drm/xe: Fix use after free when client stats are captured drm/xe: Take a ref to xe file when user creates a VM drm/xe: Add ref counting for xe_file drm/xe: Move part of xe_file cleanup to a helper drm/xe: Validate user fence during creation drm/rockchip: inno-hdmi: Fix infoframe upload drm/amd/amdgpu: add HDP_SD support on gc 12.0.0/1 drm/amdgpu: Update kmd_fw_shared for VCN5 drm/amd/amdgpu: command submission parser for JPEG drm/amdgpu/mes12: fix suspend issue drm/amdgpu/mes12: sw/hw fini for unified mes drm/amdgpu/mes12: configure two pipes hardware resources drm/amdgpu/mes12: adjust mes12 sw/hw init for multiple pipes drm/amdgpu/mes12: add mes pipe switch support ... commit 87cea484951eba1d0342033241f80e49303d802c Merge: 71833e79a421 14d069d92951 Author: Wolfram Sang Date: Fri Aug 16 16:23:51 2024 +0200 Merge tag 'i2c-host-fixes-6.11-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/andi.shyti/linux into i2c/for-current Two fixes in this update: Tegra I2C Controller: Addresses a potential double-locking issue during probe. ACPI devices are not IRQ-safe when invoking runtime suspend and resume functions, so the irq_safe flag should not be set. Qualcomm GENI I2C Controller: Fixes an oversight in the exit path of the runtime_resume() function, which was missed in the previous release. commit 145082ebfcf08f4fd254c467abf4aa58b4d38505 Author: Javier Carrasco Date: Mon Aug 12 14:17:21 2024 +0200 Documentation/llvm: turn make command for ccache into code block The command provided to use ccache with clang is not a literal code block. Once built, the documentation displays the '' symbols as a " character, which is wrong, and the command can not be applied as provided. Turn the command into a literal code block. Signed-off-by: Javier Carrasco Reviewed-by: Nathan Chancellor Signed-off-by: Masahiro Yamada Documentation/kbuild/llvm.rst | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit a42db293e5983aa1508d12644f23d73f0553b32c Author: Vijendar Mukunda Date: Fri Aug 16 12:33:28 2024 +0530 ASoC: SOF: amd: Fix for acp init sequence When ACP is not powered on by default, acp power on sequence explicitly invoked by programming pgfsm control mask. The existing implementation checks the same PGFSM status mask and programs the same PGFSM control mask in all ACP variants which breaks acp power on sequence for ACP6.0 and ACP6.3 variants. So to fix this issue, update ACP pgfsm control mask and status mask based on acp descriptor rev field, which will vary based on acp variant. Fixes: 846aef1d7cc0 ("ASoC: SOF: amd: Add Renoir ACP HW support") Signed-off-by: Vijendar Mukunda Link: https://patch.msgid.link/20240816070328.610360-1-Vijendar.Mukunda@amd.com Signed-off-by: Mark Brown sound/soc/sof/amd/acp.c | 19 +++++++++++++++++-- sound/soc/sof/amd/acp.h | 7 +++++-- 2 files changed, 22 insertions(+), 4 deletions(-) commit 6e6f58a170ea98e44075b761f2da42a5aec47dfb Author: Rafael J. Wysocki Date: Tue Aug 13 16:29:11 2024 +0200 thermal: gov_bang_bang: Use governor_data to reduce overhead After running once, the for_each_trip_desc() loop in bang_bang_manage() is pure needless overhead because it is not going to make any changes unless a new cooling device has been bound to one of the trips in the thermal zone or the system is resuming from sleep. For this reason, make bang_bang_manage() set governor_data for the thermal zone and check it upfront to decide whether or not it needs to do anything. However, governor_data needs to be reset in some cases to let bang_bang_manage() know that it should walk the trips again, so add an .update_tz() callback to the governor and make the core additionally invoke it during system resume. To avoid affecting the other users of that callback unnecessarily, add a special notification reason for system resume, THERMAL_TZ_RESUME, and also pass it to __thermal_zone_device_update() called during system resume for consistency. Signed-off-by: Rafael J. Wysocki Acked-by: Peter Kästle Reviewed-by: Zhang Rui Cc: 6.10+ # 6.10+ Link: https://patch.msgid.link/2285575.iZASKD2KPV@rjwysocki.net drivers/thermal/gov_bang_bang.c | 18 ++++++++++++++++++ drivers/thermal/thermal_core.c | 3 ++- include/linux/thermal.h | 1 + 3 files changed, 21 insertions(+), 1 deletion(-) commit 5f64b4a1ab1b0412446d42e1fc2964c2cdb60b27 Author: Rafael J. Wysocki Date: Tue Aug 13 16:27:33 2024 +0200 thermal: gov_bang_bang: Add .manage() callback After recent changes, the Bang-bang governor may not adjust the initial configuration of cooling devices to the actual situation. Namely, if a cooling device bound to a certain trip point starts in the "on" state and the thermal zone temperature is below the threshold of that trip point, the trip point may never be crossed on the way up in which case the state of the cooling device will never be adjusted because the thermal core will never invoke the governor's .trip_crossed() callback. [Note that there is no issue if the zone temperature is at the trip threshold or above it to start with because .trip_crossed() will be invoked then to indicate the start of thermal mitigation for the given trip.] To address this, add a .manage() callback to the Bang-bang governor and use it to ensure that all of the thermal instances managed by the governor have been initialized properly and the states of all of the cooling devices involved have been adjusted to the current zone temperature as appropriate. Fixes: 530c932bdf75 ("thermal: gov_bang_bang: Use .trip_crossed() instead of .throttle()") Link: https://lore.kernel.org/linux-pm/1bfbbae5-42b0-4c7d-9544-e98855715294@piie.net/ Cc: 6.10+ # 6.10+ Signed-off-by: Rafael J. Wysocki Acked-by: Peter Kästle Reviewed-by: Zhang Rui Link: https://patch.msgid.link/8419356.T7Z3S40VBb@rjwysocki.net drivers/thermal/gov_bang_bang.c | 30 ++++++++++++++++++++++++++++++ 1 file changed, 30 insertions(+) commit 84248e35d9b60e03df7276627e4e91fbaf80f73d Author: Rafael J. Wysocki Date: Tue Aug 13 16:26:42 2024 +0200 thermal: gov_bang_bang: Split bang_bang_control() Move the setting of the thermal instance target state from bang_bang_control() into a separate function that will be also called in a different place going forward. No intentional functional impact. Signed-off-by: Rafael J. Wysocki Acked-by: Peter Kästle Reviewed-by: Zhang Rui Cc: 6.10+ # 6.10+ Link: https://patch.msgid.link/3313587.aeNJFYEL58@rjwysocki.net drivers/thermal/gov_bang_bang.c | 42 ++++++++++++++++++++++------------------- 1 file changed, 23 insertions(+), 19 deletions(-) commit b9b6ee6fe258ce4d89592593efcd3d798c418859 Author: Rafael J. Wysocki Date: Tue Aug 13 16:25:19 2024 +0200 thermal: gov_bang_bang: Call __thermal_cdev_update() directly Instead of clearing the "updated" flag for each cooling device affected by the trip point crossing in bang_bang_control() and walking all thermal instances to run thermal_cdev_update() for all of the affected cooling devices, call __thermal_cdev_update() directly for each of them. No intentional functional impact. Signed-off-by: Rafael J. Wysocki Acked-by: Peter Kästle Reviewed-by: Zhang Rui Cc: 6.10+ # 6.10+ Link: https://patch.msgid.link/13583081.uLZWGnKmhe@rjwysocki.net drivers/thermal/gov_bang_bang.c | 5 +---- 1 file changed, 1 insertion(+), 4 deletions(-) commit 27ec3c57fcadb43c79ed05b2ea31bc18c72d798a Author: Sascha Hauer Date: Fri Aug 9 10:11:33 2024 +0200 wifi: mwifiex: duplicate static structs used in driver instances mwifiex_band_2ghz and mwifiex_band_5ghz are statically allocated, but used and modified in driver instances. Duplicate them before using them in driver instances so that different driver instances do not influence each other. This was observed on a board which has one PCIe and one SDIO mwifiex adapter. It blew up in mwifiex_setup_ht_caps(). This was called with the statically allocated struct which is modified in this function. Cc: stable@vger.kernel.org Fixes: d6bffe8bb520 ("mwifiex: support for creation of AP interface") Signed-off-by: Sascha Hauer Reviewed-by: Francesco Dolcini Acked-by: Brian Norris Signed-off-by: Kalle Valo Link: https://patch.msgid.link/20240809-mwifiex-duplicate-static-structs-v1-1-6837b903b1a4@pengutronix.de drivers/net/wireless/marvell/mwifiex/cfg80211.c | 32 ++++++++++++++++++++----- 1 file changed, 26 insertions(+), 6 deletions(-) commit 3d93a1448ed017f3536319a2445568b5f3969547 Merge: b153b3c74700 36dd1141be70 Author: David S. Miller Date: Fri Aug 16 09:59:33 2024 +0100 Merge branch 'vln-ocelot-fixes' Vladimir Oltean says: ==================== VLAN fixes for Ocelot driver This is a collection of patches I've gathered over the past several months. Patches 1-6/14 are supporting patches for selftests. Patch 9/14 fixes PTP TX from a VLAN upper of a VLAN-aware bridge port when using the "ocelot-8021q" tagging protocol. Patch 7/14 is its supporting selftest. Patch 10/14 fixes the QoS class used by PTP in the same case as above. It is hard to quantify - there is no selftest. Patch 11/14 fixes potential data corruption during PTP TX in the same case as above. Again, there is no selftest. Patch 13/14 fixes RX in the same case as above - 8021q upper of a VLAN-aware bridge port, with the "ocelot-8021q" tagging protocol. Patch 12/14 is a supporting patch for this in the DSA core, and 7/14 is also its selftest. Patch 14/14 ensures that VLAN-aware bridges offloaded to Ocelot only react to the ETH_P_8021Q TPID, and treat absolutely everything else as VLAN-untagged, including ETH_P_8021AD. Patch 8/14 is the supporting selftest. ==================== Signed-off-by: David S. Miller commit 36dd1141be70b5966906919714dc504a24c65ddf Author: Vladimir Oltean Date: Thu Aug 15 03:07:07 2024 +0300 net: mscc: ocelot: treat 802.1ad tagged traffic as 802.1Q-untagged I was revisiting the topic of 802.1ad treatment in the Ocelot switch [0] and realized that not only is its basic VLAN classification pipeline improper for offloading vlan_protocol 802.1ad bridges, but also improper for offloading regular 802.1Q bridges already. Namely, 802.1ad-tagged traffic should be treated as VLAN-untagged by bridged ports, but this switch treats it as if it was 802.1Q-tagged with the same VID as in the 802.1ad header. This is markedly different to what the Linux bridge expects; see the "other_tpid()" function in tools/testing/selftests/net/forwarding/bridge_vlan_aware.sh. An idea came to me that the VCAP IS1 TCAM is more powerful than I'm giving it credit for, and that it actually overwrites the classified VID before the VLAN Table lookup takes place. In other words, it can be used even to save a packet from being dropped on ingress due to VLAN membership. Add a sophisticated TCAM rule hardcoded into the driver to force the switch to behave like a Linux bridge with vlan_filtering 1 vlan_protocol 802.1Q. Regarding the lifetime of the filter: eventually the bridge will disappear, and vlan_filtering on the port will be restored to 0 for standalone mode. Then the filter will be deleted. [0]: https://lore.kernel.org/netdev/20201009122947.nvhye4hvcha3tljh@skbuf/ Fixes: 7142529f1688 ("net: mscc: ocelot: add VLAN filtering") Signed-off-by: Vladimir Oltean Signed-off-by: David S. Miller drivers/net/ethernet/mscc/ocelot.c | 188 ++++++++++++++++++++++++++++++-- drivers/net/ethernet/mscc/ocelot_vcap.c | 1 + include/soc/mscc/ocelot_vcap.h | 2 + 3 files changed, 180 insertions(+), 11 deletions(-) commit f1288fd7293b91442ad7420394c252a252ecaa30 Author: Vladimir Oltean Date: Thu Aug 15 03:07:06 2024 +0300 net: dsa: felix: fix VLAN tag loss on CPU reception with ocelot-8021q There is a major design bug with ocelot-8021q, which is that it expects more of the hardware than the hardware can actually do. The short summary of the issue is that when a port is under a VLAN-aware bridge and we use this tagging protocol, VLAN upper interfaces of this port do not see RX traffic. We use VCAP ES0 (egress rewriter) rules towards the tag_8021q CPU port to encapsulate packets with an outer tag, later stripped by software, that depends on the source user port. We do this so that packets can be identified in ocelot_rcv(). To be precise, we create rules with push_outer_tag = OCELOT_ES0_TAG and push_inner_tag = 0. With this configuration, we expect the switch to keep the inner tag configuration as found in the packet (if it was untagged on user port ingress, keep it untagged, otherwise preserve the VLAN tag unmodified as the inner tag towards the tag_8021q CPU port). But this is not what happens. Instead, table "Tagging Combinations" from the user manual suggests that when the ES0 action is "PUSH_OUTER_TAG=1 and PUSH_INNER_TAG=0", there will be "no inner tag". Experimentation further clarifies what this means. It appears that this "inner tag" which is not pushed into the packet on its egress towards the CPU is none other than the classified VLAN. When the ingress user port is standalone or under a VLAN-unaware bridge, the classified VLAN is a discardable quantity: it is a fixed value - the result of ocelot_vlan_unaware_pvid()'s configuration, and actually independent of the VID from any 802.1Q header that may be in the frame. It is actually preferable to discard the "inner tag" in this case. The problem is when the ingress port is under a VLAN-aware bridge. Then, the classified VLAN is taken from the frame's 802.1Q header, with a fallback on the bridge port's PVID. It would be very good to not discard the "inner tag" here, because if we do, we break communication with any 8021q VLAN uppers that the port might have. These have a processing path outside the bridge. There seems to be nothing else we can do except to change the configuration for VCAP ES0 rules, to actually push the inner VLAN into the frame. There are 2 options for that, first is to push a fixed value specified in the rule, and second is to push a fixed value, plus (aka arithmetic +) the classified VLAN. We choose the second option, and we select that fixed value as 0. Thus, what is pushed in the inner tag is just the classified VLAN. From there, we need to perform software untagging, in the receive path, of stuff that was untagged on the wire. Fixes: 7c83a7c539ab ("net: dsa: add a second tagger for Ocelot switches based on tag_8021q") Signed-off-by: Vladimir Oltean Signed-off-by: David S. Miller drivers/net/dsa/ocelot/felix.c | 115 ++++++++++++++++++++++++++++++++++++++--- 1 file changed, 109 insertions(+), 6 deletions(-) commit 93e4649efa964201c73b0a03c35c04a0d6fc809f Author: Vladimir Oltean Date: Thu Aug 15 03:07:05 2024 +0300 net: dsa: provide a software untagging function on RX for VLAN-aware bridges Through code analysis, I realized that the ds->untag_bridge_pvid logic is contradictory - see the newly added FIXME above the kernel-doc for dsa_software_untag_vlan_unaware_bridge(). Moreover, for the Felix driver, I need something very similar, but which is actually _not_ contradictory: untag the bridge PVID on RX, but for VLAN-aware bridges. The existing logic does it for VLAN-unaware bridges. Since I don't want to change the functionality of drivers which were supposedly properly tested with the ds->untag_bridge_pvid flag, I have introduced a new one: ds->untag_vlan_aware_bridge_pvid, and I have refactored the DSA reception code into a common path for both flags. TODO: both flags should be unified under a single ds->software_vlan_untag, which users of both current flags should set. This is not something that can be carried out right away. It needs very careful examination of all drivers which make use of this functionality, since some of them actually get this wrong in the first place. For example, commit 9130c2d30c17 ("net: dsa: microchip: ksz8795: Use software untagging on CPU port") uses this in a driver which has ds->configure_vlan_while_not_filtering = true. The latter mechanism has been known for many years to be broken by design: https://lore.kernel.org/netdev/CABumfLzJmXDN_W-8Z=p9KyKUVi_HhS7o_poBkeKHS2BkAiyYpw@mail.gmail.com/ and we have the situation of 2 bugs canceling each other. There is no private VLAN, and the port follows the PVID of the VLAN-unaware bridge. So, it's kinda ok for that driver to use the ds->untag_bridge_pvid mechanism, in a broken way. Signed-off-by: Vladimir Oltean Signed-off-by: David S. Miller include/net/dsa.h | 16 ++++--- net/dsa/tag.c | 5 +- net/dsa/tag.h | 135 ++++++++++++++++++++++++++++++++++++++++++------------ 3 files changed, 118 insertions(+), 38 deletions(-) commit c5e12ac3beb0dd3a718296b2d8af5528e9ab728e Author: Vladimir Oltean Date: Thu Aug 15 03:07:04 2024 +0300 net: mscc: ocelot: serialize access to the injection/extraction groups As explained by Horatiu Vultur in commit 603ead96582d ("net: sparx5: Add spinlock for frame transmission from CPU") which is for a similar hardware design, multiple CPUs can simultaneously perform injection or extraction. There are only 2 register groups for injection and 2 for extraction, and the driver only uses one of each. So we'd better serialize access using spin locks, otherwise frame corruption is possible. Note that unlike in sparx5, FDMA in ocelot does not have this issue because struct ocelot_fdma_tx_ring already contains an xmit_lock. I guess this is mostly a problem for NXP LS1028A, as that is dual core. I don't think VSC7514 is. So I'm blaming the commit where LS1028A (aka the felix DSA driver) started using register-based packet injection and extraction. Fixes: 0a6f17c6ae21 ("net: dsa: tag_ocelot_8021q: add support for PTP timestamping") Signed-off-by: Vladimir Oltean Signed-off-by: David S. Miller drivers/net/dsa/ocelot/felix.c | 11 +++++++ drivers/net/ethernet/mscc/ocelot.c | 52 ++++++++++++++++++++++++++++++ drivers/net/ethernet/mscc/ocelot_vsc7514.c | 4 +++ include/soc/mscc/ocelot.h | 9 ++++++ 4 files changed, 76 insertions(+) commit e1b9e80236c540fa85d76e2d510d1b38e1968c5d Author: Vladimir Oltean Date: Thu Aug 15 03:07:03 2024 +0300 net: mscc: ocelot: fix QoS class for injected packets with "ocelot-8021q" There are 2 distinct code paths (listed below) in the source code which set up an injection header for Ocelot(-like) switches. Code path (2) lacks the QoS class and source port being set correctly. Especially the improper QoS classification is a problem for the "ocelot-8021q" alternative DSA tagging protocol, because we support tc-taprio and each packet needs to be scheduled precisely through its time slot. This includes PTP, which is normally assigned to a traffic class other than 0, but would be sent through TC 0 nonetheless. The code paths are: (1) ocelot_xmit_common() from net/dsa/tag_ocelot.c - called only by the standard "ocelot" DSA tagging protocol which uses NPI-based injection - sets up bit fields in the tag manually to account for a small difference (destination port offset) between Ocelot and Seville. Namely, ocelot_ifh_set_dest() is omitted out of ocelot_xmit_common(), because there's also seville_ifh_set_dest(). (2) ocelot_ifh_set_basic(), called by: - ocelot_fdma_prepare_skb() for FDMA transmission of the ocelot switchdev driver - ocelot_port_xmit() -> ocelot_port_inject_frame() for register-based transmission of the ocelot switchdev driver - felix_port_deferred_xmit() -> ocelot_port_inject_frame() for the DSA tagger ocelot-8021q when it must transmit PTP frames (also through register-based injection). sets the bit fields according to its own logic. The problem is that (2) doesn't call ocelot_ifh_set_qos_class(). Copying that logic from ocelot_xmit_common() fixes that. Unfortunately, although desirable, it is not easily possible to de-duplicate code paths (1) and (2), and make net/dsa/tag_ocelot.c directly call ocelot_ifh_set_basic()), because of the ocelot/seville difference. This is the "minimal" fix with some logic duplicated (but at least more consolidated). Fixes: 0a6f17c6ae21 ("net: dsa: tag_ocelot_8021q: add support for PTP timestamping") Signed-off-by: Vladimir Oltean Signed-off-by: David S. Miller drivers/net/ethernet/mscc/ocelot.c | 10 +++++++++- drivers/net/ethernet/mscc/ocelot_fdma.c | 1 - 2 files changed, 9 insertions(+), 2 deletions(-) commit 67c3ca2c5cfe6a50772514e3349b5e7b3b0fac03 Author: Vladimir Oltean Date: Thu Aug 15 03:07:02 2024 +0300 net: mscc: ocelot: use ocelot_xmit_get_vlan_info() also for FDMA and register injection Problem description ------------------- On an NXP LS1028A (felix DSA driver) with the following configuration: - ocelot-8021q tagging protocol - VLAN-aware bridge (with STP) spanning at least swp0 and swp1 - 8021q VLAN upper interfaces on swp0 and swp1: swp0.700, swp1.700 - ptp4l on swp0.700 and swp1.700 we see that the ptp4l instances do not see each other's traffic, and they all go to the grand master state due to the ANNOUNCE_RECEIPT_TIMEOUT_EXPIRES condition. Jumping to the conclusion for the impatient ------------------------------------------- There is a zero-day bug in the ocelot switchdev driver in the way it handles VLAN-tagged packet injection. The correct logic already exists in the source code, in function ocelot_xmit_get_vlan_info() added by commit 5ca721c54d86 ("net: dsa: tag_ocelot: set the classified VLAN during xmit"). But it is used only for normal NPI-based injection with the DSA "ocelot" tagging protocol. The other injection code paths (register-based and FDMA-based) roll their own wrong logic. This affects and was noticed on the DSA "ocelot-8021q" protocol because it uses register-based injection. By moving ocelot_xmit_get_vlan_info() to a place that's common for both the DSA tagger and the ocelot switch library, it can also be called from ocelot_port_inject_frame() in ocelot.c. We need to touch the lines with ocelot_ifh_port_set()'s prototype anyway, so let's rename it to something clearer regarding what it does, and add a kernel-doc. ocelot_ifh_set_basic() should do. Investigation notes ------------------- Debugging reveals that PTP event (aka those carrying timestamps, like Sync) frames injected into swp0.700 (but also swp1.700) hit the wire with two VLAN tags: 00000000: 01 1b 19 00 00 00 00 01 02 03 04 05 81 00 02 bc ~~~~~~~~~~~ 00000010: 81 00 02 bc 88 f7 00 12 00 2c 00 00 02 00 00 00 ~~~~~~~~~~~ 00000020: 00 00 00 00 00 00 00 00 00 00 00 01 02 ff fe 03 00000030: 04 05 00 01 00 04 00 00 00 00 00 00 00 00 00 00 00000040: 00 00 The second (unexpected) VLAN tag makes felix_check_xtr_pkt() -> ptp_classify_raw() fail to see these as PTP packets at the link partner's receiving end, and return PTP_CLASS_NONE (because the BPF classifier is not written to expect 2 VLAN tags). The reason why packets have 2 VLAN tags is because the transmission code treats VLAN incorrectly. Neither ocelot switchdev, nor felix DSA, declare the NETIF_F_HW_VLAN_CTAG_TX feature. Therefore, at xmit time, all VLANs should be in the skb head, and none should be in the hwaccel area. This is done by: static struct sk_buff *validate_xmit_vlan(struct sk_buff *skb, netdev_features_t features) { if (skb_vlan_tag_present(skb) && !vlan_hw_offload_capable(features, skb->vlan_proto)) skb = __vlan_hwaccel_push_inside(skb); return skb; } But ocelot_port_inject_frame() handles things incorrectly: ocelot_ifh_port_set(ifh, port, rew_op, skb_vlan_tag_get(skb)); void ocelot_ifh_port_set(struct sk_buff *skb, void *ifh, int port, u32 rew_op) { (...) if (vlan_tag) ocelot_ifh_set_vlan_tci(ifh, vlan_tag); (...) } The way __vlan_hwaccel_push_inside() pushes the tag inside the skb head is by calling: static inline void __vlan_hwaccel_clear_tag(struct sk_buff *skb) { skb->vlan_present = 0; } which does _not_ zero out skb->vlan_tci as seen by skb_vlan_tag_get(). This means that ocelot, when it calls skb_vlan_tag_get(), sees (and uses) a residual skb->vlan_tci, while the same VLAN tag is _already_ in the skb head. The trivial fix for double VLAN headers is to replace the content of ocelot_ifh_port_set() with: if (skb_vlan_tag_present(skb)) ocelot_ifh_set_vlan_tci(ifh, skb_vlan_tag_get(skb)); but this would not be correct either, because, as mentioned, vlan_hw_offload_capable() is false for us, so we'd be inserting dead code and we'd always transmit packets with VID=0 in the injection frame header. I can't actually test the ocelot switchdev driver and rely exclusively on code inspection, but I don't think traffic from 8021q uppers has ever been injected properly, and not double-tagged. Thus I'm blaming the introduction of VLAN fields in the injection header - early driver code. As hinted at in the early conclusion, what we _want_ to happen for VLAN transmission was already described once in commit 5ca721c54d86 ("net: dsa: tag_ocelot: set the classified VLAN during xmit"). ocelot_xmit_get_vlan_info() intends to ensure that if the port through which we're transmitting is under a VLAN-aware bridge, the outer VLAN tag from the skb head is stripped from there and inserted into the injection frame header (so that the packet is processed in hardware through that actual VLAN). And in all other cases, the packet is sent with VID=0 in the injection frame header, since the port is VLAN-unaware and has logic to strip this VID on egress (making it invisible to the wire). Fixes: 08d02364b12f ("net: mscc: fix the injection header") Signed-off-by: Vladimir Oltean Signed-off-by: David S. Miller drivers/net/ethernet/mscc/ocelot.c | 29 +++++++++++++++----- drivers/net/ethernet/mscc/ocelot_fdma.c | 2 +- include/linux/dsa/ocelot.h | 47 +++++++++++++++++++++++++++++++++ include/soc/mscc/ocelot.h | 3 ++- net/dsa/tag_ocelot.c | 37 ++------------------------ 5 files changed, 75 insertions(+), 43 deletions(-) commit e29b82ef27616777e21c07dc263a8769cbdaa358 Author: Vladimir Oltean Date: Thu Aug 15 03:07:01 2024 +0300 selftests: net: bridge_vlan_aware: test that other TPIDs are seen as untagged The bridge VLAN implementation w.r.t. VLAN protocol is described in merge commit 1a0b20b25732 ("Merge branch 'bridge-next'"). We are only sensitive to those VLAN tags whose TPID is equal to the bridge's vlan_protocol. Thus, an 802.1ad VLAN should be treated as 802.1Q-untagged. Add 3 tests which validate that: - 802.1ad-tagged traffic is learned into the PVID of an 802.1Q-aware bridge - Double-tagged traffic is forwarded when just the PVID of the port is present in the VLAN group of the ports - Double-tagged traffic is not forwarded when the PVID of the port is absent from the VLAN group of the ports The test passes with both veth and ocelot. Signed-off-by: Vladimir Oltean Reviewed-by: Ido Schimmel Tested-by: Ido Schimmel Signed-off-by: David S. Miller .../selftests/net/forwarding/bridge_vlan_aware.sh | 54 +++++++++++++++++++++- 1 file changed, 53 insertions(+), 1 deletion(-) commit 237979504264912a9797dabc0db35126e705fe0d Author: Vladimir Oltean Date: Thu Aug 15 03:07:00 2024 +0300 selftests: net: local_termination: add PTP frames to the mix A breakage in the felix DSA driver shows we do not have enough test coverage. More generally, it is sufficiently special that it is likely drivers will treat it differently. This is not meant to be a full PTP test, it just makes sure that PTP packets sent to the different addresses corresponding to their profiles are received correctly. The local_termination selftest seemed like the most appropriate place for this addition. PTP RX/TX in some cases makes no sense (over a bridge) and this is why $skip_ptp exists. And in others - PTP over a bridge port - the IP stack needs convincing through the available bridge netfilter hooks to leave the PTP packets alone and not stolen by the bridge rx_handler. It is safe to assume that users have that figured out already. This is a driver level test, and by using tcpdump, all that extra setup is out of scope here. send_non_ip() was an unfinished idea; written but never used. Replace it with a more generic send_raw(), and send 3 PTP packet types times 3 transports. Signed-off-by: Vladimir Oltean Signed-off-by: David S. Miller .../selftests/net/forwarding/local_termination.sh | 161 +++++++++++++++++++-- 1 file changed, 148 insertions(+), 13 deletions(-) commit 9aa3749ca4a880c1a59720aab3eacf344ed8d68d Author: Vladimir Oltean Date: Thu Aug 15 03:06:59 2024 +0300 selftests: net: local_termination: don't use xfail_on_veth() xfail_on_veth() for this test is an incorrect approximation which gives false positives and false negatives. When local_termination fails with "reception succeeded, but should have failed", it is because the DUT ($h2) accepts packets even when not configured as promiscuous. This is not something specific to veth; even the bridge behaves that way, but this is not captured by the xfail_on_veth test. The IFF_UNICAST_FLT flag is not explicitly exported to user space, but it can somewhat be determined from the interface's behavior. We have to create a macvlan upper with a different MAC address. This forces a dev_uc_add() call in the kernel. When the unicast filtering list is not empty, but the device doesn't support IFF_UNICAST_FLT, __dev_set_rx_mode() force-enables promiscuity on the interface, to ensure correct behavior (that the requested address is received). We can monitor the change in the promiscuity flag and infer from it whether the device supports unicast filtering. There is no equivalent thing for allmulti, unfortunately. We never know what's hiding behind a device which has allmulti=off. Whether it will actually perform RX multicast filtering of unknown traffic is a strong "maybe". The bridge driver, for example, completely ignores the flag. We'll have to keep the xfail behavior, but instead of XFAIL on just veth, always XFAIL. Signed-off-by: Vladimir Oltean Signed-off-by: David S. Miller tools/testing/selftests/net/forwarding/lib.sh | 57 +++++++++++++++++++++ .../selftests/net/forwarding/local_termination.sh | 58 ++++++++++++++++------ 2 files changed, 99 insertions(+), 16 deletions(-) commit 5fea8bb009744bbb90b3f6ca41c558429ee4c849 Author: Vladimir Oltean Date: Thu Aug 15 03:06:58 2024 +0300 selftests: net: local_termination: introduce new tests which capture VLAN behavior Add more coverage to the local termination selftest as follows: - 8021q upper of $h2 - 8021q upper of $h2, where $h2 is a port of a VLAN-unaware bridge - 8021q upper of $h2, where $h2 is a port of a VLAN-aware bridge - 8021q upper of VLAN-unaware br0, which is the upper of $h2 - 8021q upper of VLAN-aware br0, which is the upper of $h2 Especially the cases with traffic sent through the VLAN upper of a VLAN-aware bridge port will be immediately relevant when we will start transmitting PTP packets as an additional kind of traffic. Signed-off-by: Vladimir Oltean Signed-off-by: David S. Miller .../selftests/net/forwarding/local_termination.sh | 117 +++++++++++++++++++-- 1 file changed, 110 insertions(+), 7 deletions(-) commit 5b8e74182ed3d4f1c38c626e6120275ca9d92bee Author: Vladimir Oltean Date: Thu Aug 15 03:06:57 2024 +0300 selftests: net: local_termination: add one more test for VLAN-aware bridges The current bridge() test is for packet reception on a VLAN-unaware bridge. Some things are different enough with VLAN-aware bridges that it's worth renaming this test into vlan_unaware_bridge(), and add a new vlan_aware_bridge() test. The two will share the same implementation: bridge() becomes a common function, which receives $vlan_filtering as an argument. Rename it to test_bridge() at the same time, because just bridge() pollutes the global namespace and we cannot invoke the binary with the same name from the iproute2 package currently. Signed-off-by: Vladimir Oltean Signed-off-by: David S. Miller .../selftests/net/forwarding/local_termination.sh | 22 ++++++++++++++++++---- 1 file changed, 18 insertions(+), 4 deletions(-) commit df7cf5cc551c7c0a92520e91e1184993784c6386 Author: Vladimir Oltean Date: Thu Aug 15 03:06:56 2024 +0300 selftests: net: local_termination: parameterize test name There are upcoming tests which verify the RX filtering of a bridge (or bridge port), but under differing vlan_filtering conditions. Since we currently print $h2 (the DUT) in the log_test() output, it becomes necessary to make a further distinction between tests, to not give the user the impression that the exact same thing is run twice. Signed-off-by: Vladimir Oltean Signed-off-by: David S. Miller .../selftests/net/forwarding/local_termination.sh | 38 ++++++++++++---------- 1 file changed, 20 insertions(+), 18 deletions(-) commit 4261fa35185c0112acca0496d3732c8fcfe1dcf2 Author: Vladimir Oltean Date: Thu Aug 15 03:06:55 2024 +0300 selftests: net: local_termination: parameterize sending interface In future changes we will want to subject the DUT, $h2, to additional VLAN-tagged traffic. For that, we need to run the tests using $h1.100 as a sending interface, rather than the currently hardcoded $h1. Add a parameter to run_test() and modify its 2 callers to explicitly pass $h1, as was implicit before. Signed-off-by: Vladimir Oltean Signed-off-by: David S. Miller .../selftests/net/forwarding/local_termination.sh | 39 +++++++++++----------- 1 file changed, 20 insertions(+), 19 deletions(-) commit 8d019b15ddd55d6dc5685b1f51902c4aa8e01939 Author: Vladimir Oltean Date: Thu Aug 15 03:06:54 2024 +0300 selftests: net: local_termination: refactor macvlan creation/deletion This will be used in other subtests as well; make new macvlan_create() and macvlan_destroy() functions. Signed-off-by: Vladimir Oltean Signed-off-by: David S. Miller .../selftests/net/forwarding/local_termination.sh | 30 +++++++++++++--------- 1 file changed, 18 insertions(+), 12 deletions(-) commit 2374bf7558de915edc6ec8cb10ec3291dfab9594 Author: Eli Billauer Date: Fri Aug 16 10:02:00 2024 +0300 char: xillybus: Check USB endpoints when probing device Ensure, as the driver probes the device, that all endpoints that the driver may attempt to access exist and are of the correct type. All XillyUSB devices must have a Bulk IN and Bulk OUT endpoint at address 1. This is verified in xillyusb_setup_base_eps(). On top of that, a XillyUSB device may have additional Bulk OUT endpoints. The information about these endpoints' addresses is deduced from a data structure (the IDT) that the driver fetches from the device while probing it. These endpoints are checked in setup_channels(). A XillyUSB device never has more than one IN endpoint, as all data towards the host is multiplexed in this single Bulk IN endpoint. This is why setup_channels() only checks OUT endpoints. Reported-by: syzbot+eac39cba052f2e750dbe@syzkaller.appspotmail.com Cc: stable Closes: https://lore.kernel.org/all/0000000000001d44a6061f7a54ee@google.com/T/ Fixes: a53d1202aef1 ("char: xillybus: Add driver for XillyUSB (Xillybus variant for USB)"). Signed-off-by: Eli Billauer Link: https://lore.kernel.org/r/20240816070200.50695-2-eli.billauer@gmail.com Signed-off-by: Greg Kroah-Hartman drivers/char/xillybus/xillyusb.c | 22 ++++++++++++++++++++-- 1 file changed, 20 insertions(+), 2 deletions(-) commit ad899c301c880766cc709aad277991b3ab671b66 Author: Eli Billauer Date: Fri Aug 16 10:01:59 2024 +0300 char: xillybus: Refine workqueue handling As the wakeup work item now runs on a separate workqueue, it needs to be flushed separately along with flushing the device's workqueue. Also, move the destroy_workqueue() call to the end of the exit method, so that deinitialization is done in the opposite order of initialization. Fixes: ccbde4b128ef ("char: xillybus: Don't destroy workqueue from work item running on it") Cc: stable Signed-off-by: Eli Billauer Link: https://lore.kernel.org/r/20240816070200.50695-1-eli.billauer@gmail.com Signed-off-by: Greg Kroah-Hartman drivers/char/xillybus/xillyusb.c | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-) commit 2e6506e1c4eed2676a8412231046f31e10e240da Author: Gao Xiang Date: Mon Jul 29 10:13:06 2024 +0800 mm/migrate: fix deadlock in migrate_pages_batch() on large folios Currently, migrate_pages_batch() can lock multiple locked folios with an arbitrary order. Although folio_trylock() is used to avoid deadlock as commit 2ef7dbb26990 ("migrate_pages: try migrate in batch asynchronously firstly") mentioned, it seems try_split_folio() is still missing. It was found by compaction stress test when I explicitly enable EROFS compressed files to use large folios, which case I cannot reproduce with the same workload if large folio support is off (current mainline). Typically, filesystem reads (with locked file-backed folios) could use another bdev/meta inode to load some other I/Os (e.g. inode extent metadata or caching compressed data), so the locking order will be: file-backed folios (A) bdev/meta folios (B) The following calltrace shows the deadlock: Thread 1 takes (B) lock and tries to take folio (A) lock Thread 2 takes (A) lock and tries to take folio (B) lock [Thread 1] INFO: task stress:1824 blocked for more than 30 seconds. Tainted: G OE 6.10.0-rc7+ #6 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. task:stress state:D stack:0 pid:1824 tgid:1824 ppid:1822 flags:0x0000000c Call trace: __switch_to+0xec/0x138 __schedule+0x43c/0xcb0 schedule+0x54/0x198 io_schedule+0x44/0x70 folio_wait_bit_common+0x184/0x3f8 <-- folio mapping ffff00036d69cb18 index 996 (**) __folio_lock+0x24/0x38 migrate_pages_batch+0x77c/0xea0 // try_split_folio (mm/migrate.c:1486:2) // migrate_pages_batch (mm/migrate.c:1734:16) <--- LIST_HEAD(unmap_folios) has .. folio mapping 0xffff0000d184f1d8 index 1711; (*) folio mapping 0xffff0000d184f1d8 index 1712; .. migrate_pages+0xb28/0xe90 compact_zone+0xa08/0x10f0 compact_node+0x9c/0x180 sysctl_compaction_handler+0x8c/0x118 proc_sys_call_handler+0x1a8/0x280 proc_sys_write+0x1c/0x30 vfs_write+0x240/0x380 ksys_write+0x78/0x118 __arm64_sys_write+0x24/0x38 invoke_syscall+0x78/0x108 el0_svc_common.constprop.0+0x48/0xf0 do_el0_svc+0x24/0x38 el0_svc+0x3c/0x148 el0t_64_sync_handler+0x100/0x130 el0t_64_sync+0x190/0x198 [Thread 2] INFO: task stress:1825 blocked for more than 30 seconds. Tainted: G OE 6.10.0-rc7+ #6 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. task:stress state:D stack:0 pid:1825 tgid:1825 ppid:1822 flags:0x0000000c Call trace: __switch_to+0xec/0x138 __schedule+0x43c/0xcb0 schedule+0x54/0x198 io_schedule+0x44/0x70 folio_wait_bit_common+0x184/0x3f8 <-- folio = 0xfffffdffc6b503c0 (mapping == 0xffff0000d184f1d8 index == 1711) (*) __folio_lock+0x24/0x38 z_erofs_runqueue+0x384/0x9c0 [erofs] z_erofs_readahead+0x21c/0x350 [erofs] <-- folio mapping 0xffff00036d69cb18 range from [992, 1024] (**) read_pages+0x74/0x328 page_cache_ra_order+0x26c/0x348 ondemand_readahead+0x1c0/0x3a0 page_cache_sync_ra+0x9c/0xc0 filemap_get_pages+0xc4/0x708 filemap_read+0x104/0x3a8 generic_file_read_iter+0x4c/0x150 vfs_read+0x27c/0x330 ksys_pread64+0x84/0xd0 __arm64_sys_pread64+0x28/0x40 invoke_syscall+0x78/0x108 el0_svc_common.constprop.0+0x48/0xf0 do_el0_svc+0x24/0x38 el0_svc+0x3c/0x148 el0t_64_sync_handler+0x100/0x130 el0t_64_sync+0x190/0x198 Link: https://lkml.kernel.org/r/20240729021306.398286-1-hsiangkao@linux.alibaba.com Fixes: 5dfab109d519 ("migrate_pages: batch _unmap and _move") Signed-off-by: Gao Xiang Reviewed-by: "Huang, Ying" Acked-by: David Hildenbrand Cc: Matthew Wilcox Signed-off-by: Andrew Morton mm/migrate.c | 16 +++++++++++----- 1 file changed, 11 insertions(+), 5 deletions(-) commit 766c163c2068b45330664fb67df67268e588a22d Author: Suren Baghdasaryan Date: Tue Aug 13 08:07:57 2024 -0700 alloc_tag: mark pages reserved during CMA activation as not tagged During CMA activation, pages in CMA area are prepared and then freed without being allocated. This triggers warnings when memory allocation debug config (CONFIG_MEM_ALLOC_PROFILING_DEBUG) is enabled. Fix this by marking these pages not tagged before freeing them. Link: https://lkml.kernel.org/r/20240813150758.855881-2-surenb@google.com Fixes: d224eb0287fb ("codetag: debug: mark codetags for reserved pages as empty") Signed-off-by: Suren Baghdasaryan Acked-by: David Hildenbrand Cc: Kees Cook Cc: Kent Overstreet Cc: Pasha Tatashin Cc: Sourav Panda Cc: Vlastimil Babka Cc: [6.10] Signed-off-by: Andrew Morton mm/mm_init.c | 2 ++ 1 file changed, 2 insertions(+) commit a8fc28dad6d574582cdf2f7e78c73c59c623df30 Author: Suren Baghdasaryan Date: Tue Aug 13 08:07:56 2024 -0700 alloc_tag: introduce clear_page_tag_ref() helper function In several cases we are freeing pages which were not allocated using common page allocators. For such cases, in order to keep allocation accounting correct, we should clear the page tag to indicate that the page being freed is expected to not have a valid allocation tag. Introduce clear_page_tag_ref() helper function to be used for this. Link: https://lkml.kernel.org/r/20240813150758.855881-1-surenb@google.com Fixes: d224eb0287fb ("codetag: debug: mark codetags for reserved pages as empty") Signed-off-by: Suren Baghdasaryan Suggested-by: David Hildenbrand Acked-by: David Hildenbrand Reviewed-by: Pasha Tatashin Cc: Kees Cook Cc: Kent Overstreet Cc: Sourav Panda Cc: Vlastimil Babka Cc: [6.10] Signed-off-by: Andrew Morton include/linux/pgalloc_tag.h | 13 +++++++++++++ mm/mm_init.c | 10 +--------- mm/page_alloc.c | 9 +-------- 3 files changed, 15 insertions(+), 17 deletions(-) commit edb907a6133323e19311901a39dee68b1c6a2ef8 Author: Jinjie Ruan Date: Mon Aug 12 14:20:17 2024 +0800 crash: fix riscv64 crash memory reserve dead loop On RISCV64 Qemu machine with 512MB memory, cmdline "crashkernel=500M,high" will cause system stall as below: Zone ranges: DMA32 [mem 0x0000000080000000-0x000000009fffffff] Normal empty Movable zone start for each node Early memory node ranges node 0: [mem 0x0000000080000000-0x000000008005ffff] node 0: [mem 0x0000000080060000-0x000000009fffffff] Initmem setup node 0 [mem 0x0000000080000000-0x000000009fffffff] (stall here) commit 5d99cadf1568 ("crash: fix x86_32 crash memory reserve dead loop bug") fix this on 32-bit architecture. However, the problem is not completely solved. If `CRASH_ADDR_LOW_MAX = CRASH_ADDR_HIGH_MAX` on 64-bit architecture, for example, when system memory is equal to CRASH_ADDR_LOW_MAX on RISCV64, the following infinite loop will also occur: -> reserve_crashkernel_generic() and high is true -> alloc at [CRASH_ADDR_LOW_MAX, CRASH_ADDR_HIGH_MAX] fail -> alloc at [0, CRASH_ADDR_LOW_MAX] fail and repeatedly (because CRASH_ADDR_LOW_MAX = CRASH_ADDR_HIGH_MAX). As Catalin suggested, do not remove the ",high" reservation fallback to ",low" logic which will change arm64's kdump behavior, but fix it by skipping the above situation similar to commit d2f32f23190b ("crash: fix x86_32 crash memory reserve dead loop"). After this patch, it print: cannot allocate crashkernel (size:0x1f400000) Link: https://lkml.kernel.org/r/20240812062017.2674441-1-ruanjinjie@huawei.com Signed-off-by: Jinjie Ruan Suggested-by: Catalin Marinas Reviewed-by: Catalin Marinas Acked-by: Baoquan He Cc: Albert Ou Cc: Dave Young Cc: Palmer Dabbelt Cc: Paul Walmsley Cc: Vivek Goyal Signed-off-by: Andrew Morton kernel/crash_reserve.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) commit 7c5e8d212d7d81991a580e7de3904ea213d9a852 Author: Muhammad Usama Anjum Date: Fri Aug 9 12:56:42 2024 +0500 selftests: memfd_secret: don't build memfd_secret test on unsupported arches [1] mentions that memfd_secret is only supported on arm64, riscv, x86 and x86_64 for now. It doesn't support other architectures. I found the build error on arm and decided to send the fix as it was creating noise on KernelCI: memfd_secret.c: In function 'memfd_secret': memfd_secret.c:42:24: error: '__NR_memfd_secret' undeclared (first use in this function); did you mean 'memfd_secret'? 42 | return syscall(__NR_memfd_secret, flags); | ^~~~~~~~~~~~~~~~~ | memfd_secret Hence I'm adding condition that memfd_secret should only be compiled on supported architectures. Also check in run_vmtests script if memfd_secret binary is present before executing it. Link: https://lkml.kernel.org/r/20240812061522.1933054-1-usama.anjum@collabora.com Link: https://lore.kernel.org/all/20210518072034.31572-7-rppt@kernel.org/ [1] Link: https://lkml.kernel.org/r/20240809075642.403247-1-usama.anjum@collabora.com Fixes: 76fe17ef588a ("secretmem: test: add basic selftest for memfd_secret(2)") Signed-off-by: Muhammad Usama Anjum Reviewed-by: Shuah Khan Acked-by: Mike Rapoport (Microsoft) Cc: Albert Ou Cc: James Bottomley Cc: Mike Rapoport (Microsoft) Cc: Palmer Dabbelt Cc: Paul Walmsley Cc: Signed-off-by: Andrew Morton tools/testing/selftests/mm/Makefile | 2 ++ tools/testing/selftests/mm/run_vmtests.sh | 3 +++ 2 files changed, 5 insertions(+) commit 807174a93d24c456503692dc3f5af322ee0b640a Author: Kirill A. Shutemov Date: Fri Aug 9 14:48:47 2024 +0300 mm: fix endless reclaim on machines with unaccepted memory Unaccepted memory is considered unusable free memory, which is not counted as free on the zone watermark check. This causes get_page_from_freelist() to accept more memory to hit the high watermark, but it creates problems in the reclaim path. The reclaim path encounters a failed zone watermark check and attempts to reclaim memory. This is usually successful, but if there is little or no reclaimable memory, it can result in endless reclaim with little to no progress. This can occur early in the boot process, just after start of the init process when the only reclaimable memory is the page cache of the init executable and its libraries. Make unaccepted memory free from watermark check point of view. This way unaccepted memory will never be the trigger of memory reclaim. Accept more memory in the get_page_from_freelist() if needed. Link: https://lkml.kernel.org/r/20240809114854.3745464-2-kirill.shutemov@linux.intel.com Fixes: dcdfdd40fa82 ("mm: Add support for unaccepted memory") Signed-off-by: Kirill A. Shutemov Reported-by: Jianxiong Gao Acked-by: David Hildenbrand Tested-by: Jianxiong Gao Cc: Borislav Petkov Cc: Johannes Weiner Cc: Kirill A. Shutemov Cc: Matthew Wilcox Cc: Mel Gorman Cc: Mike Rapoport (Microsoft) Cc: Tom Lendacky Cc: Vlastimil Babka Cc: [6.5+] Signed-off-by: Andrew Morton mm/page_alloc.c | 42 ++++++++++++++++++++---------------------- 1 file changed, 20 insertions(+), 22 deletions(-) commit af3b7d09a9934220a8136065a0e6985fe0b67a1b Author: Dan Carpenter Date: Fri Aug 9 15:32:30 2024 +0300 selftests/mm: compaction_test: fix off by one in check_compaction() The "initial_nr_hugepages" variable is unsigned long so it takes up to 20 characters to print, plus 1 more character for the NUL terminator. Unfortunately, this buffer is not quite large enough for the terminator to fit. Also use snprintf() for a belt and suspenders approach. Link: https://lkml.kernel.org/r/87470c06-b45a-4e83-92ff-aac2e7b9c6ba@stanley.mountain Fixes: fb9293b6b015 ("selftests/mm: compaction_test: fix bogus test success and reduce probability of OOM-killer invocation") Signed-off-by: Dan Carpenter Cc: Shuah Khan Signed-off-by: Andrew Morton tools/testing/selftests/mm/compaction_test.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) commit fd8c35a92910f4829b7c99841f39b1b952c259d5 Author: Zi Yan Date: Fri Aug 9 10:59:05 2024 -0400 mm/numa: no task_numa_fault() call if PMD is changed When handling a numa page fault, task_numa_fault() should be called by a process that restores the page table of the faulted folio to avoid duplicated stats counting. Commit c5b5a3dd2c1f ("mm: thp: refactor NUMA fault handling") restructured do_huge_pmd_numa_page() and did not avoid task_numa_fault() call in the second page table check after a numa migration failure. Fix it by making all !pmd_same() return immediately. This issue can cause task_numa_fault() being called more than necessary and lead to unexpected numa balancing results (It is hard to tell whether the issue will cause positive or negative performance impact due to duplicated numa fault counting). Link: https://lkml.kernel.org/r/20240809145906.1513458-3-ziy@nvidia.com Fixes: c5b5a3dd2c1f ("mm: thp: refactor NUMA fault handling") Reported-by: "Huang, Ying" Closes: https://lore.kernel.org/linux-mm/87zfqfw0yw.fsf@yhuang6-desk2.ccr.corp.intel.com/ Signed-off-by: Zi Yan Acked-by: David Hildenbrand Cc: Baolin Wang Cc: "Huang, Ying" Cc: Kefeng Wang Cc: Mel Gorman Cc: Yang Shi Cc: Signed-off-by: Andrew Morton mm/huge_memory.c | 29 +++++++++++++---------------- 1 file changed, 13 insertions(+), 16 deletions(-) commit 40b760cfd44566bca791c80e0720d70d75382b84 Author: Zi Yan Date: Fri Aug 9 10:59:04 2024 -0400 mm/numa: no task_numa_fault() call if PTE is changed When handling a numa page fault, task_numa_fault() should be called by a process that restores the page table of the faulted folio to avoid duplicated stats counting. Commit b99a342d4f11 ("NUMA balancing: reduce TLB flush via delaying mapping on hint page fault") restructured do_numa_page() and did not avoid task_numa_fault() call in the second page table check after a numa migration failure. Fix it by making all !pte_same() return immediately. This issue can cause task_numa_fault() being called more than necessary and lead to unexpected numa balancing results (It is hard to tell whether the issue will cause positive or negative performance impact due to duplicated numa fault counting). Link: https://lkml.kernel.org/r/20240809145906.1513458-2-ziy@nvidia.com Fixes: b99a342d4f11 ("NUMA balancing: reduce TLB flush via delaying mapping on hint page fault") Signed-off-by: Zi Yan Reported-by: "Huang, Ying" Closes: https://lore.kernel.org/linux-mm/87zfqfw0yw.fsf@yhuang6-desk2.ccr.corp.intel.com/ Acked-by: David Hildenbrand Cc: Baolin Wang Cc: Kefeng Wang Cc: Mel Gorman Cc: Yang Shi Cc: Signed-off-by: Andrew Morton mm/memory.c | 33 ++++++++++++++++----------------- 1 file changed, 16 insertions(+), 17 deletions(-) commit 61ebe5a747da649057c37be1c37eb934b4af79ca Author: Hailong Liu Date: Thu Aug 8 20:19:56 2024 +0800 mm/vmalloc: fix page mapping if vm_area_alloc_pages() with high order fallback to order 0 The __vmap_pages_range_noflush() assumes its argument pages** contains pages with the same page shift. However, since commit e9c3cda4d86e ("mm, vmalloc: fix high order __GFP_NOFAIL allocations"), if gfp_flags includes __GFP_NOFAIL with high order in vm_area_alloc_pages() and page allocation failed for high order, the pages** may contain two different page shifts (high order and order-0). This could lead __vmap_pages_range_noflush() to perform incorrect mappings, potentially resulting in memory corruption. Users might encounter this as follows (vmap_allow_huge = true, 2M is for PMD_SIZE): kvmalloc(2M, __GFP_NOFAIL|GFP_X) __vmalloc_node_range_noprof(vm_flags=VM_ALLOW_HUGE_VMAP) vm_area_alloc_pages(order=9) ---> order-9 allocation failed and fallback to order-0 vmap_pages_range() vmap_pages_range_noflush() __vmap_pages_range_noflush(page_shift = 21) ----> wrong mapping happens We can remove the fallback code because if a high-order allocation fails, __vmalloc_node_range_noprof() will retry with order-0. Therefore, it is unnecessary to fallback to order-0 here. Therefore, fix this by removing the fallback code. Link: https://lkml.kernel.org/r/20240808122019.3361-1-hailong.liu@oppo.com Fixes: e9c3cda4d86e ("mm, vmalloc: fix high order __GFP_NOFAIL allocations") Signed-off-by: Hailong Liu Reported-by: Tangquan Zheng Reviewed-by: Baoquan He Reviewed-by: Uladzislau Rezki (Sony) Acked-by: Barry Song Acked-by: Michal Hocko Cc: Matthew Wilcox Cc: Signed-off-by: Andrew Morton mm/vmalloc.c | 11 ++--------- 1 file changed, 2 insertions(+), 9 deletions(-) commit d75abd0d0bc29e6ebfebbf76d11b4067b35844af Author: Waiman Long Date: Tue Aug 6 12:41:07 2024 -0400 mm/memory-failure: use raw_spinlock_t in struct memory_failure_cpu The memory_failure_cpu structure is a per-cpu structure. Access to its content requires the use of get_cpu_var() to lock in the current CPU and disable preemption. The use of a regular spinlock_t for locking purpose is fine for a non-RT kernel. Since the integration of RT spinlock support into the v5.15 kernel, a spinlock_t in a RT kernel becomes a sleeping lock and taking a sleeping lock in a preemption disabled context is illegal resulting in the following kind of warning. [12135.732244] BUG: sleeping function called from invalid context at kernel/locking/spinlock_rt.c:48 [12135.732248] in_atomic(): 1, irqs_disabled(): 0, non_block: 0, pid: 270076, name: kworker/0:0 [12135.732252] preempt_count: 1, expected: 0 [12135.732255] RCU nest depth: 2, expected: 2 : [12135.732420] Hardware name: Dell Inc. PowerEdge R640/0HG0J8, BIOS 2.10.2 02/24/2021 [12135.732423] Workqueue: kacpi_notify acpi_os_execute_deferred [12135.732433] Call Trace: [12135.732436] [12135.732450] dump_stack_lvl+0x57/0x81 [12135.732461] __might_resched.cold+0xf4/0x12f [12135.732479] rt_spin_lock+0x4c/0x100 [12135.732491] memory_failure_queue+0x40/0xe0 [12135.732503] ghes_do_memory_failure+0x53/0x390 [12135.732516] ghes_do_proc.constprop.0+0x229/0x3e0 [12135.732575] ghes_proc+0xf9/0x1a0 [12135.732591] ghes_notify_hed+0x6a/0x150 [12135.732602] notifier_call_chain+0x43/0xb0 [12135.732626] blocking_notifier_call_chain+0x43/0x60 [12135.732637] acpi_ev_notify_dispatch+0x47/0x70 [12135.732648] acpi_os_execute_deferred+0x13/0x20 [12135.732654] process_one_work+0x41f/0x500 [12135.732695] worker_thread+0x192/0x360 [12135.732715] kthread+0x111/0x140 [12135.732733] ret_from_fork+0x29/0x50 [12135.732779] Fix it by using a raw_spinlock_t for locking instead. Also move the pr_err() out of the lock critical section and after put_cpu_ptr() to avoid indeterminate latency and the possibility of sleep with this call. [longman@redhat.com: don't hold percpu ref across pr_err(), per Miaohe] Link: https://lkml.kernel.org/r/20240807181130.1122660-1-longman@redhat.com Link: https://lkml.kernel.org/r/20240806164107.1044956-1-longman@redhat.com Fixes: 0f383b6dc96e ("locking/spinlock: Provide RT variant") Signed-off-by: Waiman Long Acked-by: Miaohe Lin Cc: "Huang, Ying" Cc: Juri Lelli Cc: Len Brown Cc: Naoya Horiguchi Cc: Signed-off-by: Andrew Morton mm/memory-failure.c | 20 +++++++++++--------- 1 file changed, 11 insertions(+), 9 deletions(-) commit 9d85731110241fb8ca9445ea4177d816041a8825 Author: Pasha Tatashin Date: Thu Aug 8 21:34:36 2024 +0000 mm: don't account memmap per-node Fix invalid access to pgdat during hot-remove operation: ndctl users reported a GPF when trying to destroy a namespace: $ ndctl destroy-namespace all -r all -f Segmentation fault dmesg: Oops: general protection fault, probably for non-canonical address 0xdffffc0000005650: 0000 [#1] PREEMPT SMP KASAN PTI KASAN: probably user-memory-access in range [0x000000000002b280-0x000000000002b287] CPU: 26 UID: 0 PID: 1868 Comm: ndctl Not tainted 6.11.0-rc1 #1 Hardware name: Dell Inc. PowerEdge R640/08HT8T, BIOS 2.20.1 09/13/2023 RIP: 0010:mod_node_page_state+0x2a/0x110 cxl-test users report a GPF when trying to unload the test module: $ modrpobe -r cxl-test dmesg BUG: unable to handle page fault for address: 0000000000004200 #PF: supervisor read access in kernel mode #PF: error_code(0x0000) - not-present page PGD 0 P4D 0 Oops: Oops: 0000 [#1] PREEMPT SMP PTI CPU: 0 UID: 0 PID: 1076 Comm: modprobe Tainted: G O N 6.11.0-rc1 #197 Tainted: [O]=OOT_MODULE, [N]=TEST Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 0.0.0 02/06/15 RIP: 0010:mod_node_page_state+0x6/0x90 Currently, when memory is hot-plugged or hot-removed the accounting is done based on the assumption that memmap is allocated from the same node as the hot-plugged/hot-removed memory, which is not always the case. In addition, there are challenges with keeping the node id of the memory that is being remove to the time when memmap accounting is actually performed: since this is done after remove_pfn_range_from_zone(), and also after remove_memory_block_devices(). Meaning that we cannot use pgdat nor walking though memblocks to get the nid. Given all of that, account the memmap overhead system wide instead. For this we are going to be using global atomic counters, but given that memmap size is rarely modified, and normally is only modified either during early boot when there is only one CPU, or under a hotplug global mutex lock, therefore there is no need for per-cpu optimizations. Also, while we are here rename nr_memmap to nr_memmap_pages, and nr_memmap_boot to nr_memmap_boot_pages to be self explanatory that the units are in page count. [pasha.tatashin@soleen.com: address a few nits from David Hildenbrand] Link: https://lkml.kernel.org/r/20240809191020.1142142-4-pasha.tatashin@soleen.com Link: https://lkml.kernel.org/r/20240809191020.1142142-4-pasha.tatashin@soleen.com Link: https://lkml.kernel.org/r/20240808213437.682006-4-pasha.tatashin@soleen.com Fixes: 15995a352474 ("mm: report per-page metadata information") Signed-off-by: Pasha Tatashin Reported-by: Yi Zhang Closes: https://lore.kernel.org/linux-cxl/CAHj4cs9Ax1=CoJkgBGP_+sNu6-6=6v=_L-ZBZY0bVLD3wUWZQg@mail.gmail.com Reported-by: Alison Schofield Closes: https://lore.kernel.org/linux-mm/Zq0tPd2h6alFz8XF@aschofie-mobl2/#t Tested-by: Dan Williams Tested-by: Alison Schofield Acked-by: David Hildenbrand Acked-by: David Rientjes Tested-by: Yi Zhang Cc: Domenico Cerasuolo Cc: Fan Ni Cc: Joel Granados Cc: Johannes Weiner Cc: Li Zhijian Cc: Matthew Wilcox (Oracle) Cc: Mike Rapoport Cc: Muchun Song Cc: Nhat Pham Cc: Sourav Panda Cc: Vlastimil Babka Cc: Yosry Ahmed Signed-off-by: Andrew Morton include/linux/mmzone.h | 2 -- include/linux/vmstat.h | 7 ++++--- mm/hugetlb_vmemmap.c | 8 ++++---- mm/mm_init.c | 3 +-- mm/page_alloc.c | 1 - mm/page_ext.c | 18 ++++-------------- mm/sparse-vmemmap.c | 11 ++++------- mm/sparse.c | 5 ++--- mm/vmstat.c | 46 ++++++++++++++++++++++------------------------ 9 files changed, 41 insertions(+), 60 deletions(-) commit f4cb78af91e3b2b7aa76dbf8213b898fa8811b12 Author: Pasha Tatashin Date: Thu Aug 8 21:34:35 2024 +0000 mm: add system wide stats items category /proc/vmstat contains events and stats, events can only grow, but stats can grow and shrink. vmstat has the following: ------------------------- NR_VM_ZONE_STAT_ITEMS: per-zone stats NR_VM_NUMA_EVENT_ITEMS: per-numa events NR_VM_NODE_STAT_ITEMS: per-numa stats NR_VM_WRITEBACK_STAT_ITEMS: system-wide background-writeback and dirty-throttling tresholds. NR_VM_EVENT_ITEMS: system-wide events ------------------------- Rename NR_VM_WRITEBACK_STAT_ITEMS to NR_VM_STAT_ITEMS, to track the system-wide stats, we are going to add per-page metadata stats to this category in the next patch. Also delete unused writeback_stat_name(). Link: https://lkml.kernel.org/r/20240809191020.1142142-2-pasha.tatashin@soleen.com Link: https://lkml.kernel.org/r/20240808213437.682006-3-pasha.tatashin@soleen.com Fixes: 15995a352474 ("mm: report per-page metadata information") Signed-off-by: Pasha Tatashin Suggested-by: Yosry Ahmed Tested-by: Alison Schofield Acked-by: David Hildenbrand Acked-by: David Rientjes Cc: Dan Williams Cc: Domenico Cerasuolo Cc: Joel Granados Cc: Johannes Weiner Cc: Li Zhijian Cc: Matthew Wilcox (Oracle) Cc: Mike Rapoport Cc: Muchun Song Cc: Nhat Pham Cc: Sourav Panda Cc: Vlastimil Babka Cc: Yi Zhang Cc: Fan Ni Signed-off-by: Andrew Morton include/linux/vmstat.h | 15 ++++----------- mm/vmstat.c | 6 +++--- 2 files changed, 7 insertions(+), 14 deletions(-) commit ace0741a55e453c265cbf3d965eea7f687cd6d45 Author: Pasha Tatashin Date: Thu Aug 8 21:34:34 2024 +0000 mm: don't account memmap on failure Patch series "Fixes for memmap accounting", v4. Memmap accounting provides us with observability of how much memory is used for per-page metadata: i.e. "struct page"'s and "struct page_ext". It also provides with information of how much was allocated using boot allocator (i.e. not part of MemTotal), and how much was allocated using buddy allocated (i.e. part of MemTotal). This small series fixes a few problems that were discovered with the original patch. This patch (of 3): When we fail to allocate the mmemmap in alloc_vmemmap_page_list(), do not account any already-allocated pages: we're going to free all them before we return from the function. Link: https://lkml.kernel.org/r/20240809191020.1142142-1-pasha.tatashin@soleen.com Link: https://lkml.kernel.org/r/20240808213437.682006-1-pasha.tatashin@soleen.com Link: https://lkml.kernel.org/r/20240808213437.682006-2-pasha.tatashin@soleen.com Fixes: 15995a352474 ("mm: report per-page metadata information") Signed-off-by: Pasha Tatashin Reviewed-by: Fan Ni Reviewed-by: Yosry Ahmed Acked-by: David Hildenbrand Tested-by: Alison Schofield Reviewed-by: Muchun Song Acked-by: David Rientjes Cc: Dan Williams Cc: Domenico Cerasuolo Cc: Joel Granados Cc: Johannes Weiner Cc: Li Zhijian Cc: Matthew Wilcox (Oracle) Cc: Mike Rapoport Cc: Nhat Pham Cc: Sourav Panda Cc: Vlastimil Babka Cc: Yi Zhang Signed-off-by: Andrew Morton mm/hugetlb_vmemmap.c | 5 +---- 1 file changed, 1 insertion(+), 4 deletions(-) commit 5f75cfbd6bb02295ddaed48adf667b6c828ce07b Author: David Hildenbrand Date: Thu Aug 1 22:47:48 2024 +0200 mm/hugetlb: fix hugetlb vs. core-mm PT locking We recently made GUP's common page table walking code to also walk hugetlb VMAs without most hugetlb special-casing, preparing for the future of having less hugetlb-specific page table walking code in the codebase. Turns out that we missed one page table locking detail: page table locking for hugetlb folios that are not mapped using a single PMD/PUD. Assume we have hugetlb folio that spans multiple PTEs (e.g., 64 KiB hugetlb folios on arm64 with 4 KiB base page size). GUP, as it walks the page tables, will perform a pte_offset_map_lock() to grab the PTE table lock. However, hugetlb that concurrently modifies these page tables would actually grab the mm->page_table_lock: with USE_SPLIT_PTE_PTLOCKS, the locks would differ. Something similar can happen right now with hugetlb folios that span multiple PMDs when USE_SPLIT_PMD_PTLOCKS. This issue can be reproduced [1], for example triggering: [ 3105.936100] ------------[ cut here ]------------ [ 3105.939323] WARNING: CPU: 31 PID: 2732 at mm/gup.c:142 try_grab_folio+0x11c/0x188 [ 3105.944634] Modules linked in: [...] [ 3105.974841] CPU: 31 PID: 2732 Comm: reproducer Not tainted 6.10.0-64.eln141.aarch64 #1 [ 3105.980406] Hardware name: QEMU KVM Virtual Machine, BIOS edk2-20240524-4.fc40 05/24/2024 [ 3105.986185] pstate: 60000005 (nZCv daif -PAN -UAO -TCO -DIT -SSBS BTYPE=--) [ 3105.991108] pc : try_grab_folio+0x11c/0x188 [ 3105.994013] lr : follow_page_pte+0xd8/0x430 [ 3105.996986] sp : ffff80008eafb8f0 [ 3105.999346] x29: ffff80008eafb900 x28: ffffffe8d481f380 x27: 00f80001207cff43 [ 3106.004414] x26: 0000000000000001 x25: 0000000000000000 x24: ffff80008eafba48 [ 3106.009520] x23: 0000ffff9372f000 x22: ffff7a54459e2000 x21: ffff7a546c1aa978 [ 3106.014529] x20: ffffffe8d481f3c0 x19: 0000000000610041 x18: 0000000000000001 [ 3106.019506] x17: 0000000000000001 x16: ffffffffffffffff x15: 0000000000000000 [ 3106.024494] x14: ffffb85477fdfe08 x13: 0000ffff9372ffff x12: 0000000000000000 [ 3106.029469] x11: 1fffef4a88a96be1 x10: ffff7a54454b5f0c x9 : ffffb854771b12f0 [ 3106.034324] x8 : 0008000000000000 x7 : ffff7a546c1aa980 x6 : 0008000000000080 [ 3106.038902] x5 : 00000000001207cf x4 : 0000ffff9372f000 x3 : ffffffe8d481f000 [ 3106.043420] x2 : 0000000000610041 x1 : 0000000000000001 x0 : 0000000000000000 [ 3106.047957] Call trace: [ 3106.049522] try_grab_folio+0x11c/0x188 [ 3106.051996] follow_pmd_mask.constprop.0.isra.0+0x150/0x2e0 [ 3106.055527] follow_page_mask+0x1a0/0x2b8 [ 3106.058118] __get_user_pages+0xf0/0x348 [ 3106.060647] faultin_page_range+0xb0/0x360 [ 3106.063651] do_madvise+0x340/0x598 Let's make huge_pte_lockptr() effectively use the same PT locks as any core-mm page table walker would. Add ptep_lockptr() to obtain the PTE page table lock using a pte pointer -- unfortunately we cannot convert pte_lockptr() because virt_to_page() doesn't work with kmap'ed page tables we can have with CONFIG_HIGHPTE. Handle CONFIG_PGTABLE_LEVELS correctly by checking in reverse order, such that when e.g., CONFIG_PGTABLE_LEVELS==2 with PGDIR_SIZE==P4D_SIZE==PUD_SIZE==PMD_SIZE will work as expected. Document why that works. There is one ugly case: powerpc 8xx, whereby we have an 8 MiB hugetlb folio being mapped using two PTE page tables. While hugetlb wants to take the PMD table lock, core-mm would grab the PTE table lock of one of both PTE page tables. In such corner cases, we have to make sure that both locks match, which is (fortunately!) currently guaranteed for 8xx as it does not support SMP and consequently doesn't use split PT locks. [1] https://lore.kernel.org/all/1bbfcc7f-f222-45a5-ac44-c5a1381c596d@redhat.com/ Link: https://lkml.kernel.org/r/20240801204748.99107-1-david@redhat.com Fixes: 9cb28da54643 ("mm/gup: handle hugetlb in the generic follow_page_mask code") Signed-off-by: David Hildenbrand Acked-by: Peter Xu Reviewed-by: Baolin Wang Tested-by: Baolin Wang Cc: Peter Xu Cc: Oscar Salvador Cc: Muchun Song Cc: Signed-off-by: Andrew Morton include/linux/hugetlb.h | 33 ++++++++++++++++++++++++++++++--- include/linux/mm.h | 11 +++++++++++ 2 files changed, 41 insertions(+), 3 deletions(-) commit e46bc2e7eb90a370bc27fa2fd98cb8251e7da1ec Author: Pedro Falcato Date: Wed Aug 7 18:33:35 2024 +0100 mseal: fix is_madv_discard() is_madv_discard did its check wrong. MADV_ flags are not bitwise, they're normal sequential numbers. So, for instance: behavior & (/* ... */ | MADV_REMOVE) tagged both MADV_REMOVE and MADV_RANDOM (bit 0 set) as discard operations. As a result the kernel could erroneously block certain madvises (e.g MADV_RANDOM or MADV_HUGEPAGE) on sealed VMAs due to them sharing bits with blocked MADV operations (e.g REMOVE or WIPEONFORK). This is obviously incorrect, so use a switch statement instead. Link: https://lkml.kernel.org/r/20240807173336.2523757-1-pedro.falcato@gmail.com Link: https://lkml.kernel.org/r/20240807173336.2523757-2-pedro.falcato@gmail.com Fixes: 8be7258aad44 ("mseal: add mseal syscall") Signed-off-by: Pedro Falcato Tested-by: Jeff Xu Reviewed-by: Jeff Xu Cc: Kees Cook Cc: Liam R. Howlett Cc: Shuah Khan Cc: Signed-off-by: Andrew Morton mm/mseal.c | 14 +++++++++++--- 1 file changed, 11 insertions(+), 3 deletions(-) commit fee9d135e2fd5963a7f466cd1ef2060731a1ab29 Merge: f8e170a3dd72 042b8711a0be Author: Dave Airlie Date: Fri Aug 16 13:16:43 2024 +1000 Merge tag 'mediatek-drm-fixes-20240805' of https://git.kernel.org/pub/scm/linux/kernel/git/chunkuang.hu/linux into drm-fixes Mediatek DRM Fixes - 20240805 1. Set sensible cursor width/height values to fix crash Signed-off-by: Dave Airlie From: Chun-Kuang Hu Link: https://patchwork.freedesktop.org/patch/msgid/20240810084605.3435-1-chunkuang.hu@kernel.org commit b153b3c747003e1ce312ba205e552db4bd9e8df7 Author: Jakub Kicinski Date: Wed Aug 14 07:28:32 2024 -0700 MAINTAINERS: add selftests to network drivers tools/testing/selftests/drivers/net/ is not listed under networking entries. Add it to NETWORKING DRIVERS. Reviewed-by: Simon Horman Link: https://patch.msgid.link/20240814142832.3473685-1-kuba@kernel.org Signed-off-by: Jakub Kicinski MAINTAINERS | 1 + 1 file changed, 1 insertion(+) commit c948c0973df5db9314459da621342e1170bd9e8e Author: Pavan Chebbi Date: Wed Aug 14 15:54:29 2024 -0700 bnxt_en: Don't clear ntuple filters and rss contexts during ethtool ops The driver currently blindly deletes its cache of RSS cotexts and ntuple filters when the ethtool channel count is changing. It also deletes the ntuple filters cache when the default indirection table is changing. The core will not allow ethtool channels to drop below any that have been configured as ntuple destinations since this commit from 2022: 47f3ecf4763d ("ethtool: Fail number of channels change when it conflicts with rxnfc") So there is absolutely no need to delete the ntuple filters and RSS contexts when changing ethtool channels. It is also unnecessary to delete ntuple filters when the default RSS indirection table is changing. Remove bnxt_clear_usr_fltrs() and bnxt_clear_rss_ctxis() from the ethtool ops and change them to static functions. This bug will cause confusion to the end user and causes failure when running the rss_ctx.py selftest. Fixes: 1018319f949c ("bnxt_en: Invalidate user filters when needed") Reported-by: Jakub Kicinski Closes: https://lore.kernel.org/netdev/20240725111912.7bc17cf6@kernel.org/ Reviewed-by: Andy Gospodarek Signed-off-by: Pavan Chebbi Signed-off-by: Michael Chan Link: https://patch.msgid.link/20240814225429.199280-1-michael.chan@broadcom.com Signed-off-by: Jakub Kicinski drivers/net/ethernet/broadcom/bnxt/bnxt.c | 4 ++-- drivers/net/ethernet/broadcom/bnxt/bnxt.h | 2 -- drivers/net/ethernet/broadcom/bnxt/bnxt_ethtool.c | 4 ---- 3 files changed, 2 insertions(+), 8 deletions(-) commit b96ed2c97c791954abc881ef384e773010945aec Author: Jiri Pirko Date: Wed Aug 14 14:25:00 2024 +0200 virtio_net: move netdev_tx_reset_queue() call before RX napi enable During suspend/resume the following BUG was hit: ------------[ cut here ]------------ kernel BUG at lib/dynamic_queue_limits.c:99! Internal error: Oops - BUG: 0 [#1] SMP ARM Modules linked in: bluetooth ecdh_generic ecc libaes CPU: 1 PID: 1282 Comm: rtcwake Not tainted 6.10.0-rc3-00732-gc8bd1f7f3e61 #15240 Hardware name: Generic DT based system PC is at dql_completed+0x270/0x2cc LR is at __free_old_xmit+0x120/0x198 pc : []    lr : []    psr: 80000013 ... Flags: Nzcv  IRQs on  FIQs on  Mode SVC_32  ISA ARM  Segment none Control: 10c5387d  Table: 43a4406a  DAC: 00000051 ... Process rtcwake (pid: 1282, stack limit = 0xfbc21278) Stack: (0xe0805e80 to 0xe0806000) ... Call trace:  dql_completed from __free_old_xmit+0x120/0x198  __free_old_xmit from free_old_xmit+0x44/0xe4  free_old_xmit from virtnet_poll_tx+0x88/0x1b4  virtnet_poll_tx from __napi_poll+0x2c/0x1d4  __napi_poll from net_rx_action+0x140/0x2b4  net_rx_action from handle_softirqs+0x11c/0x350  handle_softirqs from call_with_stack+0x18/0x20  call_with_stack from do_softirq+0x48/0x50  do_softirq from __local_bh_enable_ip+0xa0/0xa4  __local_bh_enable_ip from virtnet_open+0xd4/0x21c  virtnet_open from virtnet_restore+0x94/0x120  virtnet_restore from virtio_device_restore+0x110/0x1f4  virtio_device_restore from dpm_run_callback+0x3c/0x100  dpm_run_callback from device_resume+0x12c/0x2a8  device_resume from dpm_resume+0x12c/0x1e0  dpm_resume from dpm_resume_end+0xc/0x18  dpm_resume_end from suspend_devices_and_enter+0x1f0/0x72c  suspend_devices_and_enter from pm_suspend+0x270/0x2a0  pm_suspend from state_store+0x68/0xc8  state_store from kernfs_fop_write_iter+0x10c/0x1cc  kernfs_fop_write_iter from vfs_write+0x2b0/0x3dc  vfs_write from ksys_write+0x5c/0xd4  ksys_write from ret_fast_syscall+0x0/0x54 Exception stack(0xe8bf1fa8 to 0xe8bf1ff0) ... ---[ end trace 0000000000000000 ]--- After virtnet_napi_enable() is called, the following path is hit: __napi_poll() -> virtnet_poll() -> virtnet_poll_cleantx() -> netif_tx_wake_queue() That wakes the TX queue and allows skbs to be submitted and accounted by BQL counters. Then netdev_tx_reset_queue() is called that resets BQL counters and eventually leads to the BUG in dql_completed(). Move virtnet_napi_tx_enable() what does BQL counters reset before RX napi enable to avoid the issue. Reported-by: Marek Szyprowski Closes: https://lore.kernel.org/netdev/e632e378-d019-4de7-8f13-07c572ab37a9@samsung.com/ Fixes: c8bd1f7f3e61 ("virtio_net: add support for Byte Queue Limits") Tested-by: Marek Szyprowski Signed-off-by: Jiri Pirko Acked-by: Michael S. Tsirkin Acked-by: Jason Wang Link: https://patch.msgid.link/20240814122500.1710279-1-jiri@resnulli.us Signed-off-by: Jakub Kicinski drivers/net/virtio_net.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit f8e170a3dd723c29d7fedcd584c468e1fedd5e5b Merge: 75eac7e8bb77 f002702290fc Author: Dave Airlie Date: Fri Aug 16 12:06:07 2024 +1000 Merge tag 'drm-xe-fixes-2024-08-15' of https://gitlab.freedesktop.org/drm/xe/kernel into drm-fixes - Validate user fence during creation (Brost) - Fix use after free when client stats are captured (Umesh) - SRIOV fixes (Michal) - Runtime PM fixes (Brost) Signed-off-by: Dave Airlie From: Rodrigo Vivi Link: https://patchwork.freedesktop.org/patch/msgid/Zr4KWF5nM1YvnT8H@intel.com commit 9b340aeb26d50e9a9ec99599e2a39b035fac978e Author: Dave Airlie Date: Fri Aug 16 06:19:23 2024 +1000 nouveau/firmware: use dma non-coherent allocator Currently, enabling SG_DEBUG in the kernel will cause nouveau to hit a BUG() on startup, when the iommu is enabled: kernel BUG at include/linux/scatterlist.h:187! invalid opcode: 0000 [#1] PREEMPT SMP NOPTI CPU: 7 PID: 930 Comm: (udev-worker) Not tainted 6.9.0-rc3Lyude-Test+ #30 Hardware name: MSI MS-7A39/A320M GAMING PRO (MS-7A39), BIOS 1.I0 01/22/2019 RIP: 0010:sg_init_one+0x85/0xa0 Code: 69 88 32 01 83 e1 03 f6 c3 03 75 20 a8 01 75 1e 48 09 cb 41 89 54 24 08 49 89 1c 24 41 89 6c 24 0c 5b 5d 41 5c e9 7b b9 88 00 <0f> 0b 0f 0b 0f 0b 48 8b 05 5e 46 9a 01 eb b2 66 66 2e 0f 1f 84 00 RSP: 0018:ffffa776017bf6a0 EFLAGS: 00010246 RAX: 0000000000000000 RBX: ffffa77600d87000 RCX: 000000000000002b RDX: 0000000000000001 RSI: 0000000000000000 RDI: ffffa77680d87000 RBP: 000000000000e000 R08: 0000000000000000 R09: 0000000000000000 R10: ffff98f4c46aa508 R11: 0000000000000000 R12: ffff98f4c46aa508 R13: ffff98f4c46aa008 R14: ffffa77600d4a000 R15: ffffa77600d4a018 FS: 00007feeb5aae980(0000) GS:ffff98f5c4dc0000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f22cb9a4520 CR3: 00000001043ba000 CR4: 00000000003506f0 Call Trace: ? die+0x36/0x90 ? do_trap+0xdd/0x100 ? sg_init_one+0x85/0xa0 ? do_error_trap+0x65/0x80 ? sg_init_one+0x85/0xa0 ? exc_invalid_op+0x50/0x70 ? sg_init_one+0x85/0xa0 ? asm_exc_invalid_op+0x1a/0x20 ? sg_init_one+0x85/0xa0 nvkm_firmware_ctor+0x14a/0x250 [nouveau] nvkm_falcon_fw_ctor+0x42/0x70 [nouveau] ga102_gsp_booter_ctor+0xb4/0x1a0 [nouveau] r535_gsp_oneinit+0xb3/0x15f0 [nouveau] ? srso_return_thunk+0x5/0x5f ? srso_return_thunk+0x5/0x5f ? nvkm_udevice_new+0x95/0x140 [nouveau] ? srso_return_thunk+0x5/0x5f ? srso_return_thunk+0x5/0x5f ? ktime_get+0x47/0xb0 Fix this by using the non-coherent allocator instead, I think there might be a better answer to this, but it involve ripping up some of APIs using sg lists. Cc: stable@vger.kernel.org Fixes: 2541626cfb79 ("drm/nouveau/acr: use common falcon HS FW code for ACR FWs") Signed-off-by: Dave Airlie Signed-off-by: Danilo Krummrich Link: https://patchwork.freedesktop.org/patch/msgid/20240815201923.632803-1-airlied@gmail.com drivers/gpu/drm/nouveau/nvkm/core/firmware.c | 9 ++++++--- drivers/gpu/drm/nouveau/nvkm/falcon/fw.c | 6 ++++++ 2 files changed, 12 insertions(+), 3 deletions(-) commit 75eac7e8bb77597fa199a056710f9ebba5b1995b Merge: 9370e43071ba fd45cc614b8a Author: Dave Airlie Date: Fri Aug 16 11:21:31 2024 +1000 Merge tag 'drm-misc-fixes-2024-08-15' of https://gitlab.freedesktop.org/drm/misc/kernel into drm-fixes Short summary of fixes pull: panel: - dt-bindings style fixes panel-orientation: - add quirk for Any Loki Max - add quirk for Any Loki Zero rockchip: - inno-hdmi: fix infoframe upload v3d: - fix OOB access in v3d_csd_job_run() Signed-off-by: Dave Airlie From: Thomas Zimmermann Link: https://patchwork.freedesktop.org/patch/msgid/20240815131751.GA151031@linux.fritz.box commit b313a8c835516bdda85025500be866ac8a74e022 Author: Li Lingfeng Date: Thu Aug 15 10:47:36 2024 +0800 block: Fix lockdep warning in blk_mq_mark_tag_wait Lockdep reported a warning in Linux version 6.6: [ 414.344659] ================================ [ 414.345155] WARNING: inconsistent lock state [ 414.345658] 6.6.0-07439-gba2303cacfda #6 Not tainted [ 414.346221] -------------------------------- [ 414.346712] inconsistent {IN-SOFTIRQ-W} -> {SOFTIRQ-ON-W} usage. [ 414.347545] kworker/u10:3/1152 [HC0[0]:SC0[0]:HE0:SE1] takes: [ 414.349245] ffff88810edd1098 (&sbq->ws[i].wait){+.?.}-{2:2}, at: blk_mq_dispatch_rq_list+0x131c/0x1ee0 [ 414.351204] {IN-SOFTIRQ-W} state was registered at: [ 414.351751] lock_acquire+0x18d/0x460 [ 414.352218] _raw_spin_lock_irqsave+0x39/0x60 [ 414.352769] __wake_up_common_lock+0x22/0x60 [ 414.353289] sbitmap_queue_wake_up+0x375/0x4f0 [ 414.353829] sbitmap_queue_clear+0xdd/0x270 [ 414.354338] blk_mq_put_tag+0xdf/0x170 [ 414.354807] __blk_mq_free_request+0x381/0x4d0 [ 414.355335] blk_mq_free_request+0x28b/0x3e0 [ 414.355847] __blk_mq_end_request+0x242/0xc30 [ 414.356367] scsi_end_request+0x2c1/0x830 [ 414.345155] WARNING: inconsistent lock state [ 414.345658] 6.6.0-07439-gba2303cacfda #6 Not tainted [ 414.346221] -------------------------------- [ 414.346712] inconsistent {IN-SOFTIRQ-W} -> {SOFTIRQ-ON-W} usage. [ 414.347545] kworker/u10:3/1152 [HC0[0]:SC0[0]:HE0:SE1] takes: [ 414.349245] ffff88810edd1098 (&sbq->ws[i].wait){+.?.}-{2:2}, at: blk_mq_dispatch_rq_list+0x131c/0x1ee0 [ 414.351204] {IN-SOFTIRQ-W} state was registered at: [ 414.351751] lock_acquire+0x18d/0x460 [ 414.352218] _raw_spin_lock_irqsave+0x39/0x60 [ 414.352769] __wake_up_common_lock+0x22/0x60 [ 414.353289] sbitmap_queue_wake_up+0x375/0x4f0 [ 414.353829] sbitmap_queue_clear+0xdd/0x270 [ 414.354338] blk_mq_put_tag+0xdf/0x170 [ 414.354807] __blk_mq_free_request+0x381/0x4d0 [ 414.355335] blk_mq_free_request+0x28b/0x3e0 [ 414.355847] __blk_mq_end_request+0x242/0xc30 [ 414.356367] scsi_end_request+0x2c1/0x830 [ 414.356863] scsi_io_completion+0x177/0x1610 [ 414.357379] scsi_complete+0x12f/0x260 [ 414.357856] blk_complete_reqs+0xba/0xf0 [ 414.358338] __do_softirq+0x1b0/0x7a2 [ 414.358796] irq_exit_rcu+0x14b/0x1a0 [ 414.359262] sysvec_call_function_single+0xaf/0xc0 [ 414.359828] asm_sysvec_call_function_single+0x1a/0x20 [ 414.360426] default_idle+0x1e/0x30 [ 414.360873] default_idle_call+0x9b/0x1f0 [ 414.361390] do_idle+0x2d2/0x3e0 [ 414.361819] cpu_startup_entry+0x55/0x60 [ 414.362314] start_secondary+0x235/0x2b0 [ 414.362809] secondary_startup_64_no_verify+0x18f/0x19b [ 414.363413] irq event stamp: 428794 [ 414.363825] hardirqs last enabled at (428793): [] ktime_get+0x1dc/0x200 [ 414.364694] hardirqs last disabled at (428794): [] _raw_spin_lock_irq+0x47/0x50 [ 414.365629] softirqs last enabled at (428444): [] __do_softirq+0x540/0x7a2 [ 414.366522] softirqs last disabled at (428419): [] irq_exit_rcu+0x14b/0x1a0 [ 414.367425] other info that might help us debug this: [ 414.368194] Possible unsafe locking scenario: [ 414.368900] CPU0 [ 414.369225] ---- [ 414.369548] lock(&sbq->ws[i].wait); [ 414.370000] [ 414.370342] lock(&sbq->ws[i].wait); [ 414.370802] *** DEADLOCK *** [ 414.371569] 5 locks held by kworker/u10:3/1152: [ 414.372088] #0: ffff88810130e938 ((wq_completion)writeback){+.+.}-{0:0}, at: process_scheduled_works+0x357/0x13f0 [ 414.373180] #1: ffff88810201fdb8 ((work_completion)(&(&wb->dwork)->work)){+.+.}-{0:0}, at: process_scheduled_works+0x3a3/0x13f0 [ 414.374384] #2: ffffffff86ffbdc0 (rcu_read_lock){....}-{1:2}, at: blk_mq_run_hw_queue+0x637/0xa00 [ 414.375342] #3: ffff88810edd1098 (&sbq->ws[i].wait){+.?.}-{2:2}, at: blk_mq_dispatch_rq_list+0x131c/0x1ee0 [ 414.376377] #4: ffff888106205a08 (&hctx->dispatch_wait_lock){+.-.}-{2:2}, at: blk_mq_dispatch_rq_list+0x1337/0x1ee0 [ 414.378607] stack backtrace: [ 414.379177] CPU: 0 PID: 1152 Comm: kworker/u10:3 Not tainted 6.6.0-07439-gba2303cacfda #6 [ 414.380032] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.14.0-0-g155821a1990b-prebuilt.qemu.org 04/01/2014 [ 414.381177] Workqueue: writeback wb_workfn (flush-253:0) [ 414.381805] Call Trace: [ 414.382136] [ 414.382429] dump_stack_lvl+0x91/0xf0 [ 414.382884] mark_lock_irq+0xb3b/0x1260 [ 414.383367] ? __pfx_mark_lock_irq+0x10/0x10 [ 414.383889] ? stack_trace_save+0x8e/0xc0 [ 414.384373] ? __pfx_stack_trace_save+0x10/0x10 [ 414.384903] ? graph_lock+0xcf/0x410 [ 414.385350] ? save_trace+0x3d/0xc70 [ 414.385808] mark_lock.part.20+0x56d/0xa90 [ 414.386317] mark_held_locks+0xb0/0x110 [ 414.386791] ? __pfx_do_raw_spin_lock+0x10/0x10 [ 414.387320] lockdep_hardirqs_on_prepare+0x297/0x3f0 [ 414.387901] ? _raw_spin_unlock_irq+0x28/0x50 [ 414.388422] trace_hardirqs_on+0x58/0x100 [ 414.388917] _raw_spin_unlock_irq+0x28/0x50 [ 414.389422] __blk_mq_tag_busy+0x1d6/0x2a0 [ 414.389920] __blk_mq_get_driver_tag+0x761/0x9f0 [ 414.390899] blk_mq_dispatch_rq_list+0x1780/0x1ee0 [ 414.391473] ? __pfx_blk_mq_dispatch_rq_list+0x10/0x10 [ 414.392070] ? sbitmap_get+0x2b8/0x450 [ 414.392533] ? __blk_mq_get_driver_tag+0x210/0x9f0 [ 414.393095] __blk_mq_sched_dispatch_requests+0xd99/0x1690 [ 414.393730] ? elv_attempt_insert_merge+0x1b1/0x420 [ 414.394302] ? __pfx___blk_mq_sched_dispatch_requests+0x10/0x10 [ 414.394970] ? lock_acquire+0x18d/0x460 [ 414.395456] ? blk_mq_run_hw_queue+0x637/0xa00 [ 414.395986] ? __pfx_lock_acquire+0x10/0x10 [ 414.396499] blk_mq_sched_dispatch_requests+0x109/0x190 [ 414.397100] blk_mq_run_hw_queue+0x66e/0xa00 [ 414.397616] blk_mq_flush_plug_list.part.17+0x614/0x2030 [ 414.398244] ? __pfx_blk_mq_flush_plug_list.part.17+0x10/0x10 [ 414.398897] ? writeback_sb_inodes+0x241/0xcc0 [ 414.399429] blk_mq_flush_plug_list+0x65/0x80 [ 414.399957] __blk_flush_plug+0x2f1/0x530 [ 414.400458] ? __pfx___blk_flush_plug+0x10/0x10 [ 414.400999] blk_finish_plug+0x59/0xa0 [ 414.401467] wb_writeback+0x7cc/0x920 [ 414.401935] ? __pfx_wb_writeback+0x10/0x10 [ 414.402442] ? mark_held_locks+0xb0/0x110 [ 414.402931] ? __pfx_do_raw_spin_lock+0x10/0x10 [ 414.403462] ? lockdep_hardirqs_on_prepare+0x297/0x3f0 [ 414.404062] wb_workfn+0x2b3/0xcf0 [ 414.404500] ? __pfx_wb_workfn+0x10/0x10 [ 414.404989] process_scheduled_works+0x432/0x13f0 [ 414.405546] ? __pfx_process_scheduled_works+0x10/0x10 [ 414.406139] ? do_raw_spin_lock+0x101/0x2a0 [ 414.406641] ? assign_work+0x19b/0x240 [ 414.407106] ? lock_is_held_type+0x9d/0x110 [ 414.407604] worker_thread+0x6f2/0x1160 [ 414.408075] ? __kthread_parkme+0x62/0x210 [ 414.408572] ? lockdep_hardirqs_on_prepare+0x297/0x3f0 [ 414.409168] ? __kthread_parkme+0x13c/0x210 [ 414.409678] ? __pfx_worker_thread+0x10/0x10 [ 414.410191] kthread+0x33c/0x440 [ 414.410602] ? __pfx_kthread+0x10/0x10 [ 414.411068] ret_from_fork+0x4d/0x80 [ 414.411526] ? __pfx_kthread+0x10/0x10 [ 414.411993] ret_from_fork_asm+0x1b/0x30 [ 414.412489] When interrupt is turned on while a lock holding by spin_lock_irq it throws a warning because of potential deadlock. blk_mq_prep_dispatch_rq blk_mq_get_driver_tag __blk_mq_get_driver_tag __blk_mq_alloc_driver_tag blk_mq_tag_busy -> tag is already busy // failed to get driver tag blk_mq_mark_tag_wait spin_lock_irq(&wq->lock) -> lock A (&sbq->ws[i].wait) __add_wait_queue(wq, wait) -> wait queue active blk_mq_get_driver_tag __blk_mq_tag_busy -> 1) tag must be idle, which means there can't be inflight IO spin_lock_irq(&tags->lock) -> lock B (hctx->tags) spin_unlock_irq(&tags->lock) -> unlock B, turn on interrupt accidentally -> 2) context must be preempt by IO interrupt to trigger deadlock. As shown above, the deadlock is not possible in theory, but the warning still need to be fixed. Fix it by using spin_lock_irqsave to get lockB instead of spin_lock_irq. Fixes: 4f1731df60f9 ("blk-mq: fix potential io hang by wrong 'wake_batch'") Signed-off-by: Li Lingfeng Reviewed-by: Ming Lei Reviewed-by: Yu Kuai Reviewed-by: Bart Van Assche Link: https://lore.kernel.org/r/20240815024736.2040971-1-lilingfeng@huaweicloud.com Signed-off-by: Jens Axboe block/blk-mq-tag.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) commit 9370e43071ba157b73d717b3bfa0f6aa628148d7 Merge: 7c626ce4bae1 23acd1f344e8 Author: Dave Airlie Date: Fri Aug 16 10:57:05 2024 +1000 Merge tag 'amd-drm-fixes-6.11-2024-08-14' of https://gitlab.freedesktop.org/agd5f/linux into drm-fixes amd-drm-fixes-6.11-2024-08-14: amdgpu: - Fix MES ring buffer overflow - DCN 3.5 fix - DCN 3.2.1 fix - DP MST fix - Cursor fixes - JPEG fixes - Context ops validation - MES 12 fixes - VCN 5.0 fix - HDP fix Signed-off-by: Dave Airlie From: Alex Deucher Link: https://patchwork.freedesktop.org/patch/msgid/20240814213846.1331827-1-alexander.deucher@amd.com commit d7a5aa4b3c007fae50405ca75c40258d90300e96 Merge: e724918b3786 4bbe60029319 Author: Linus Torvalds Date: Thu Aug 15 16:08:59 2024 -0700 Merge tag 'perf-tools-fixes-for-v6.11-2024-08-15' of git://git.kernel.org/pub/scm/linux/kernel/git/perf/perf-tools Pull perf tools fixes from Namhyung Kim: "The usual header file sync-ups and one more build fix: - Add README file to explain why we copy the headers - Sync UAPI and other header files with kernel source - Fix build on MIPS 32-bit" * tag 'perf-tools-fixes-for-v6.11-2024-08-15' of git://git.kernel.org/pub/scm/linux/kernel/git/perf/perf-tools: perf daemon: Fix the build on 32-bit architectures tools/include: Sync arm64 headers with the kernel sources tools/include: Sync x86 headers with the kernel sources tools/include: Sync filesystem headers with the kernel sources tools/include: Sync network socket headers with the kernel sources tools/include: Sync uapi/asm-generic/unistd.h with the kernel sources tools/include: Sync uapi/sound/asound.h with the kernel sources tools/include: Sync uapi/linux/perf.h with the kernel sources tools/include: Sync uapi/linux/kvm.h with the kernel sources tools/include: Sync uapi/drm/i915_drm.h with the kernel sources perf tools: Add tools/include/uapi/README commit 5b4f3af39b6588e8de4444d8e1ccf759b40f9414 Author: Gustavo A. R. Silva Date: Thu Aug 8 16:04:04 2024 -0600 smb: smb2pdu.h: Use static_assert() to check struct sizes Commit 9f9bef9bc5c6 ("smb: smb2pdu.h: Avoid -Wflex-array-member-not-at-end warnings") introduced tagged `struct create_context_hdr`. We want to ensure that when new members need to be added to the flexible structure, they are always included within this tagged struct. So, we use `static_assert()` to ensure that the memory layout for both the flexible structure and the tagged struct is the same after any changes. Acked-by: Namjae Jeon Signed-off-by: Gustavo A. R. Silva Signed-off-by: Steve French fs/smb/common/smb2pdu.h | 2 ++ 1 file changed, 2 insertions(+) commit 836bb3268db405cf9021496ac4dbc26d3e4758fe Author: Steve French Date: Thu Aug 15 14:03:43 2024 -0500 smb3: fix lock breakage for cached writes Mandatory locking is enforced for cached writes, which violates default posix semantics, and also it is enforced inconsistently. This apparently breaks recent versions of libreoffice, but can also be demonstrated by opening a file twice from the same client, locking it from handle one and writing to it from handle two (which fails, returning EACCES). Since there was already a mount option "forcemandatorylock" (which defaults to off), with this change only when the user intentionally specifies "forcemandatorylock" on mount will we break posix semantics on write to a locked range (ie we will only fail the write in this case, if the user mounts with "forcemandatorylock"). Fixes: 85160e03a79e ("CIFS: Implement caching mechanism for mandatory brlocks") Cc: stable@vger.kernel.org Cc: Pavel Shilovsky Reported-by: abartlet@samba.org Reported-by: Kevin Ottens Reviewed-by: David Howells Signed-off-by: Steve French fs/smb/client/file.c | 13 +++++++++---- 1 file changed, 9 insertions(+), 4 deletions(-) commit 50faba777177e80fd29a249fcd9f8aa18348d65b Merge: 7db404233658 c916ca35308d Author: Jens Axboe Date: Thu Aug 15 14:53:08 2024 -0600 Merge tag 'md-6.11-20240815' of https://git.kernel.org/pub/scm/linux/kernel/git/song/md into block-6.11 Pull MD fix from Song: "This patch fixes a potential data corruption in degraded raid0 array with slow (WriteMostly) drives. This issue was introduced in upstream 6.9 kernel." * tag 'md-6.11-20240815' of https://git.kernel.org/pub/scm/linux/kernel/git/song/md: md/raid1: Fix data corruption for degraded array with slow disk commit c916ca35308d3187c9928664f9be249b22a3a701 Author: Yu Kuai Date: Sat Aug 3 17:11:37 2024 +0800 md/raid1: Fix data corruption for degraded array with slow disk read_balance() will avoid reading from slow disks as much as possible, however, if valid data only lands in slow disks, and a new normal disk is still in recovery, unrecovered data can be read: raid1_read_request read_balance raid1_should_read_first -> return false choose_best_rdev -> normal disk is not recovered, return -1 choose_bb_rdev -> missing the checking of recovery, return the normal disk -> read unrecovered data Root cause is that the checking of recovery is missing in choose_bb_rdev(). Hence add such checking to fix the problem. Also fix similar problem in choose_slow_rdev(). Cc: stable@vger.kernel.org Fixes: 9f3ced792203 ("md/raid1: factor out choose_bb_rdev() from read_balance()") Fixes: dfa8ecd167c1 ("md/raid1: factor out choose_slow_rdev() from read_balance()") Reported-and-tested-by: Mateusz Jończyk Closes: https://lore.kernel.org/all/9952f532-2554-44bf-b906-4880b2e88e3a@o2.pl/ Signed-off-by: Yu Kuai Link: https://lore.kernel.org/r/20240803091137.3197008-1-yukuai1@huaweicloud.com Signed-off-by: Song Liu drivers/md/raid1.c | 14 ++++++++++---- 1 file changed, 10 insertions(+), 4 deletions(-) commit 74c2ab6d653b4c2354df65a7f7f2df1925a40a51 Author: Su Hui Date: Thu Aug 8 20:23:32 2024 +0800 smb/client: avoid possible NULL dereference in cifs_free_subrequest() Clang static checker (scan-build) warning: cifsglob.h:line 890, column 3 Access to field 'ops' results in a dereference of a null pointer. Commit 519be989717c ("cifs: Add a tracepoint to track credits involved in R/W requests") adds a check for 'rdata->server', and let clang throw this warning about NULL dereference. When 'rdata->credits.value != 0 && rdata->server == NULL' happens, add_credits_and_wake_if() will call rdata->server->ops->add_credits(). This will cause NULL dereference problem. Add a check for 'rdata->server' to avoid NULL dereference. Cc: stable@vger.kernel.org Fixes: 69c3c023af25 ("cifs: Implement netfslib hooks") Reviewed-by: David Howells Signed-off-by: Su Hui Signed-off-by: Steve French fs/smb/client/file.c | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) commit 32d5f7add080a936e28ab4142bfeea6b06999789 Merge: e01d48c699bb 1f5288874de7 Author: Palmer Dabbelt Date: Wed Aug 14 13:13:26 2024 -0700 Merge patch series "RISC-V: hwprobe: Misaligned scalar perf fix and rename" Evan Green says: The CPUPERF0 hwprobe key was documented and identified in code as a bitmask value, but its contents were an enum. This produced incorrect behavior in conjunction with the WHICH_CPUS hwprobe flag. The first patch in this series fixes the bitmask/enum problem by creating a new hwprobe key that returns the same data, but is properly described as a value instead of a bitmask. The second patch renames the value definitions in preparation for adding vector misaligned access info. As of this version, the old defines are kept in place to maintain source compatibility with older userspace programs. * b4-shazam-merge: RISC-V: hwprobe: Add SCALAR to misaligned perf defines RISC-V: hwprobe: Add MISALIGNED_PERF key Link: https://lore.kernel.org/r/20240809214444.3257596-1-evan@rivosinc.com Signed-off-by: Palmer Dabbelt commit e01d48c699bbe015d887cb598e4047f08f3998a8 Author: Alexandre Ghiti Date: Wed Aug 14 21:26:19 2024 +0200 riscv: Fix out-of-bounds when accessing Andes per hart vendor extension array The out-of-bounds access is reported by UBSAN: [ 0.000000] UBSAN: array-index-out-of-bounds in ../arch/riscv/kernel/vendor_extensions.c:41:66 [ 0.000000] index -1 is out of range for type 'riscv_isavendorinfo [32]' [ 0.000000] CPU: 0 UID: 0 PID: 0 Comm: swapper Not tainted 6.11.0-rc2ubuntu-defconfig #2 [ 0.000000] Hardware name: riscv-virtio,qemu (DT) [ 0.000000] Call Trace: [ 0.000000] [] dump_backtrace+0x32/0x40 [ 0.000000] [] show_stack+0x38/0x44 [ 0.000000] [] dump_stack_lvl+0x70/0x9c [ 0.000000] [] dump_stack+0x18/0x20 [ 0.000000] [] ubsan_epilogue+0x10/0x46 [ 0.000000] [] __ubsan_handle_out_of_bounds+0x94/0x9c [ 0.000000] [] __riscv_isa_vendor_extension_available+0x90/0x92 [ 0.000000] [] riscv_cpufeature_patch_func+0xc4/0x148 [ 0.000000] [] _apply_alternatives+0x42/0x50 [ 0.000000] [] apply_boot_alternatives+0x3c/0x100 [ 0.000000] [] setup_arch+0x85a/0x8bc [ 0.000000] [] start_kernel+0xa4/0xfb6 The dereferencing using cpu should actually not happen, so remove it. Fixes: 23c996fc2bc1 ("riscv: Extend cpufeature.c to detect vendor extensions") Signed-off-by: Alexandre Ghiti Link: https://lore.kernel.org/r/20240814192619.276794-1-alexghiti@rivosinc.com Signed-off-by: Palmer Dabbelt arch/riscv/kernel/vendor_extensions.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 0e28bf61a5f9ab30be3f3b4eafb8d097e39446bb Author: David Gstir Date: Wed Jul 17 13:28:45 2024 +0200 KEYS: trusted: dcp: fix leak of blob encryption key Trusted keys unseal the key blob on load, but keep the sealed payload in the blob field so that every subsequent read (export) will simply convert this field to hex and send it to userspace. With DCP-based trusted keys, we decrypt the blob encryption key (BEK) in the Kernel due hardware limitations and then decrypt the blob payload. BEK decryption is done in-place which means that the trusted key blob field is modified and it consequently holds the BEK in plain text. Every subsequent read of that key thus send the plain text BEK instead of the encrypted BEK to userspace. This issue only occurs when importing a trusted DCP-based key and then exporting it again. This should rarely happen as the common use cases are to either create a new trusted key and export it, or import a key blob and then just use it without exporting it again. Fix this by performing BEK decryption and encryption in a dedicated buffer. Further always wipe the plain text BEK buffer to prevent leaking the key via uninitialized memory. Cc: stable@vger.kernel.org # v6.10+ Fixes: 2e8a0f40a39c ("KEYS: trusted: Introduce NXP DCP-backed trusted keys") Signed-off-by: David Gstir Reviewed-by: Jarkko Sakkinen Signed-off-by: Jarkko Sakkinen security/keys/trusted-keys/trusted_dcp.c | 33 ++++++++++++++++++++------------ 1 file changed, 21 insertions(+), 12 deletions(-) commit 6486cad00a8b7f8585983408c152bbe33dda529b Author: David Gstir Date: Wed Jul 17 13:28:44 2024 +0200 KEYS: trusted: fix DCP blob payload length assignment The DCP trusted key type uses the wrong helper function to store the blob's payload length which can lead to the wrong byte order being used in case this would ever run on big endian architectures. Fix by using correct helper function. Cc: stable@vger.kernel.org # v6.10+ Fixes: 2e8a0f40a39c ("KEYS: trusted: Introduce NXP DCP-backed trusted keys") Suggested-by: Richard Weinberger Reported-by: kernel test robot Closes: https://lore.kernel.org/oe-kbuild-all/202405240610.fj53EK0q-lkp@intel.com/ Signed-off-by: David Gstir Reviewed-by: Jarkko Sakkinen Signed-off-by: Jarkko Sakkinen security/keys/trusted-keys/trusted_dcp.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit e724918b3786252b985b0c2764c16a57d1937707 Merge: a4a35f6cbebb fb6a421fb615 Author: Linus Torvalds Date: Thu Aug 15 11:50:07 2024 -0700 Merge tag 'hardening-v6.11-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/kees/linux Pull hardening fixes from Kees Cook: - gcc-plugins: randstruct: Remove GCC 4.7 or newer requirement (Thorsten Blum) - kallsyms: Clean up interaction with LTO suffixes (Song Liu) - refcount: Report UAF for refcount_sub_and_test(0) when counter==0 (Petr Pavlu) - kunit/overflow: Avoid misallocation of driver name (Ivan Orlov) * tag 'hardening-v6.11-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/kees/linux: kallsyms: Match symbols exactly with CONFIG_LTO_CLANG kallsyms: Do not cleanup .llvm. suffix before sorting symbols kunit/overflow: Fix UB in overflow_allocation_test gcc-plugins: randstruct: Remove GCC 4.7 or newer requirement refcount: Report UAF for refcount_sub_and_test(0) when counter==0 commit e30729d4bd4001881be4d1ad4332a5d4985398f8 Author: Naohiro Aota Date: Thu Aug 1 16:47:52 2024 +0900 btrfs: zoned: properly take lock to read/update block group's zoned variables __btrfs_add_free_space_zoned() references and modifies bg's alloc_offset, ro, and zone_unusable, but without taking the lock. It is mostly safe because they monotonically increase (at least for now) and this function is mostly called by a transaction commit, which is serialized by itself. Still, taking the lock is a safer and correct option and I'm going to add a change to reset zone_unusable while a block group is still alive. So, add locking around the operations. Fixes: 169e0da91a21 ("btrfs: zoned: track unusable bytes for zones") CC: stable@vger.kernel.org # 5.15+ Reviewed-by: Johannes Thumshirn Signed-off-by: Naohiro Aota Reviewed-by: David Sterba Signed-off-by: David Sterba fs/btrfs/free-space-cache.c | 14 ++++++++------ 1 file changed, 8 insertions(+), 6 deletions(-) commit 008e2512dc5696ab2dc5bf264e98a9fe9ceb830e Author: Qu Wenruo Date: Sun Aug 11 15:00:22 2024 +0930 btrfs: tree-checker: add dev extent item checks [REPORT] There is a corruption report that btrfs refused to mount a fs that has overlapping dev extents: BTRFS error (device sdc): dev extent devid 4 physical offset 14263979671552 overlap with previous dev extent end 14263980982272 BTRFS error (device sdc): failed to verify dev extents against chunks: -117 BTRFS error (device sdc): open_ctree failed [CAUSE] The direct cause is very obvious, there is a bad dev extent item with incorrect length. With btrfs check reporting two overlapping extents, the second one shows some clue on the cause: ERROR: dev extent devid 4 offset 14263979671552 len 6488064 overlap with previous dev extent end 14263980982272 ERROR: dev extent devid 13 offset 2257707008000 len 6488064 overlap with previous dev extent end 2257707270144 ERROR: errors found in extent allocation tree or chunk allocation The second one looks like a bitflip happened during new chunk allocation: hex(2257707008000) = 0x20da9d30000 hex(2257707270144) = 0x20da9d70000 diff = 0x00000040000 So it looks like a bitflip happened during new dev extent allocation, resulting the second overlap. Currently we only do the dev-extent verification at mount time, but if the corruption is caused by memory bitflip, we really want to catch it before writing the corruption to the storage. Furthermore the dev extent items has the following key definition: ( DEV_EXTENT ) Thus we can not just rely on the generic key order check to make sure there is no overlapping. [ENHANCEMENT] Introduce dedicated dev extent checks, including: - Fixed member checks * chunk_tree should always be BTRFS_CHUNK_TREE_OBJECTID (3) * chunk_objectid should always be BTRFS_FIRST_CHUNK_CHUNK_TREE_OBJECTID (256) - Alignment checks * chunk_offset should be aligned to sectorsize * length should be aligned to sectorsize * key.offset should be aligned to sectorsize - Overlap checks If the previous key is also a dev-extent item, with the same device id, make sure we do not overlap with the previous dev extent. Reported: Stefan N Link: https://lore.kernel.org/linux-btrfs/CA+W5K0rSO3koYTo=nzxxTm1-Pdu1HYgVxEpgJ=aGc7d=E8mGEg@mail.gmail.com/ CC: stable@vger.kernel.org # 5.10+ Reviewed-by: Anand Jain Signed-off-by: Qu Wenruo Reviewed-by: David Sterba Signed-off-by: David Sterba fs/btrfs/tree-checker.c | 69 +++++++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 69 insertions(+) commit 3bc2ac2f8f0b78a13140fc72022771efe0c9b778 Author: Jeff Layton Date: Mon Aug 12 12:30:52 2024 -0400 btrfs: update target inode's ctime on unlink Unlink changes the link count on the target inode. POSIX mandates that the ctime must also change when this occurs. According to https://pubs.opengroup.org/onlinepubs/9699919799/functions/unlink.html: "Upon successful completion, unlink() shall mark for update the last data modification and last file status change timestamps of the parent directory. Also, if the file's link count is not 0, the last file status change timestamp of the file shall be marked for update." Signed-off-by: Jeff Layton Reviewed-by: David Sterba [ add link to the opengroup docs ] Signed-off-by: David Sterba fs/btrfs/inode.c | 1 + 1 file changed, 1 insertion(+) commit c0247d289e73e18f6ddb0895de30c09770fbed95 Author: Thorsten Blum Date: Tue Aug 13 12:53:15 2024 +0200 btrfs: send: annotate struct name_cache_entry with __counted_by() Add the __counted_by compiler attribute to the flexible array member name to improve access bounds-checking via CONFIG_UBSAN_BOUNDS and CONFIG_FORTIFY_SOURCE. Signed-off-by: Thorsten Blum Reviewed-by: David Sterba Signed-off-by: David Sterba fs/btrfs/send.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit a4a35f6cbebbf9466b6c412506ab89299d567f51 Merge: 20573d8e1c28 9c5af2d7dfe1 Author: Linus Torvalds Date: Thu Aug 15 10:35:20 2024 -0700 Merge tag 'net-6.11-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net Pull networking fixes from Paolo Abeni: "Including fixes from wireless and netfilter Current release - regressions: - udp: fall back to software USO if IPv6 extension headers are present - wifi: iwlwifi: correctly lookup DMA address in SG table Current release - new code bugs: - eth: mlx5e: fix queue stats access to non-existing channels splat Previous releases - regressions: - eth: mlx5e: take state lock during tx timeout reporter - eth: mlxbf_gige: disable RX filters until RX path initialized - eth: igc: fix reset adapter logics when tx mode change Previous releases - always broken: - tcp: update window clamping condition - netfilter: - nf_queue: drop packets with cloned unconfirmed conntracks - nf_tables: Add locking for NFT_MSG_GETOBJ_RESET requests - vsock: fix recursive ->recvmsg calls - dsa: vsc73xx: fix MDIO bus access and PHY opera - eth: gtp: pull network headers in gtp_dev_xmit() - eth: igc: fix packet still tx after gate close by reducing i226 MAC retry buffer - eth: mana: fix RX buf alloc_size alignment and atomic op panic - eth: hns3: fix a deadlock problem when config TC during resetting" * tag 'net-6.11-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net: (58 commits) net: hns3: use correct release function during uninitialization net: hns3: void array out of bound when loop tnl_num net: hns3: fix a deadlock problem when config TC during resetting net: hns3: use the user's cfg after reset net: hns3: fix wrong use of semaphore up selftests: net: lib: kill PIDs before del netns pse-core: Conditionally set current limit during PI regulator registration net: thunder_bgx: Fix netdev structure allocation net: ethtool: Allow write mechanism of LPL and both LPL and EPL vsock: fix recursive ->recvmsg calls selftest: af_unix: Fix kselftest compilation warnings netfilter: nf_tables: Add locking for NFT_MSG_GETOBJ_RESET requests netfilter: nf_tables: Introduce nf_tables_getobj_single netfilter: nf_tables: Audit log dump reset after the fact selftests: netfilter: add test for br_netfilter+conntrack+queue combination netfilter: nf_queue: drop packets with cloned unconfirmed conntracks netfilter: flowtable: initialise extack before use netfilter: nfnetlink: Initialise extack before use in ACKs netfilter: allow ipv6 fragments to arrive on different devices tcp: Update window clamping condition ... commit 20573d8e1c2801d6f0cc08d26003248fd118962b Merge: 6e80a1fd99fd 63de936b513f Author: Linus Torvalds Date: Thu Aug 15 10:23:19 2024 -0700 Merge tag 'media/v6.11-3' of git://git.kernel.org/pub/scm/linux/kernel/git/mchehab/linux-media Pull media fixes from Mauro Carvalho Chehab: "Two regression fixes: - fix atomisp support for ISP2400 - fix dvb-usb regression for TeVii s480 dual DVB-S2 S660 board" * tag 'media/v6.11-3' of git://git.kernel.org/pub/scm/linux/kernel/git/mchehab/linux-media: media: atomisp: Fix streaming no longer working on BYT / ISP2400 devices media: Revert "media: dvb-usb: Fix unexpected infinite loop in dvb_usb_read_remote_control()" commit 624ab9cde26a9f150b4fd268b0f3dae3184dc40c Author: Rob Clark Date: Tue Jul 16 09:06:30 2024 -0700 drm/msm/adreno: Fix error return if missing firmware-name -ENODEV is used to signify that there is no zap shader for the platform, and the CPU can directly take the GPU out of secure mode. We want to use this return code when there is no zap-shader node. But not when there is, but without a firmware-name property. This case we want to treat as-if the needed fw is not found. Signed-off-by: Rob Clark Reviewed-by: Dmitry Baryshkov Reviewed-by: Akhil P Oommen Patchwork: https://patchwork.freedesktop.org/patch/604564/ drivers/gpu/drm/msm/adreno/adreno_gpu.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 6e80a1fd99fd71a2e104f45f2aeafb0cb19da44a Merge: 1fb918967b56 fa0db8e56878 Author: Linus Torvalds Date: Thu Aug 15 10:10:59 2024 -0700 Merge tag 'ata-6.11-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/libata/linux Pull ata fix from Niklas Cassel: - Revert a recent change to sense data generation. Sense data can be in either fixed format or descriptor format. The D_SENSE bit in the Control mode page controls which format to generate. All places but one respected the D_SENSE bit. The recent change fixed the one place that didn't respect the D_SENSE bit. However, it turns out that hdparm, hddtemp and udisks (incorrectly) assumes sense data in descriptor format. Therefore, even while the change was technically correct, revert it, since even if these user space programs are fixed to (correctly) look at the format type before parsing the data, older versions of these tools will be around roughly forever. * tag 'ata-6.11-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/libata/linux: Revert "ata: libata-scsi: Honor the D_SENSE bit for CK_COND=1 and no error" commit 538fd3921afac97158d4177139a0ad39f056dbb2 Author: Griffin Kroah-Hartman Date: Thu Aug 15 13:51:00 2024 +0200 Bluetooth: MGMT: Add error handling to pair_device() hci_conn_params_add() never checks for a NULL value and could lead to a NULL pointer dereference causing a crash. Fixed by adding error handling in the function. Cc: Stable Fixes: 5157b8a503fa ("Bluetooth: Fix initializing conn_params in scan phase") Signed-off-by: Griffin Kroah-Hartman Reported-by: Yiwei Zhang Signed-off-by: Luiz Augusto von Dentz net/bluetooth/mgmt.c | 4 ++++ 1 file changed, 4 insertions(+) commit 28cd47f75185c4818b0fb1b46f2f02faaba96376 Author: Luiz Augusto von Dentz Date: Wed Aug 30 15:08:06 2023 -0700 Bluetooth: SMP: Fix assumption of Central always being Initiator SMP initiator role shall be considered the one that initiates the pairing procedure with SMP_CMD_PAIRING_REQ: BLUETOOTH CORE SPECIFICATION Version 5.3 | Vol 3, Part H page 1557: Figure 2.1: LE pairing phases Note that by sending SMP_CMD_SECURITY_REQ it doesn't change the role to be Initiator. Link: https://github.com/bluez/bluez/issues/567 Fixes: b28b4943660f ("Bluetooth: Add strict checks for allowed SMP PDUs") Signed-off-by: Luiz Augusto von Dentz net/bluetooth/smp.c | 144 ++++++++++++++++++++++++++-------------------------- 1 file changed, 72 insertions(+), 72 deletions(-) commit 932021a11805b9da4bd6abf66fe233cccd59fe0e Author: Luiz Augusto von Dentz Date: Mon Aug 12 11:22:08 2024 -0400 Bluetooth: hci_core: Fix LE quote calculation Function hci_sched_le needs to update the respective counter variable inplace other the likes of hci_quote_sent would attempt to use the possible outdated value of conn->{le_cnt,acl_cnt}. Link: https://github.com/bluez/bluez/issues/915 Fixes: 73d80deb7bdf ("Bluetooth: prioritizing data over HCI") Signed-off-by: Luiz Augusto von Dentz net/bluetooth/hci_core.c | 19 +++++++------------ 1 file changed, 7 insertions(+), 12 deletions(-) commit aae6b81260fd9a7224f7eb4fc440d625852245bb Author: Luiz Augusto von Dentz Date: Mon Aug 12 10:43:48 2024 -0400 Bluetooth: HCI: Invert LE State quirk to be opt-out rather then opt-in This inverts the LE State quirk so by default we assume the controllers would report valid states rather than invalid which is how quirks normally behave, also this would result in HCI command failing it the LE States are really broken thus exposing the controllers that are really broken in this respect. Link: https://github.com/bluez/bluez/issues/584 Fixes: 220915857e29 ("Bluetooth: Adding driver and quirk defs for multi-role LE") Signed-off-by: Luiz Augusto von Dentz drivers/bluetooth/btintel.c | 10 ---------- drivers/bluetooth/btintel_pcie.c | 3 --- drivers/bluetooth/btmtksdio.c | 3 --- drivers/bluetooth/btrtl.c | 1 - drivers/bluetooth/btusb.c | 4 ++-- drivers/bluetooth/hci_qca.c | 4 ++-- drivers/bluetooth/hci_vhci.c | 2 -- include/net/bluetooth/hci.h | 17 ++++++++++------- include/net/bluetooth/hci_core.h | 2 +- net/bluetooth/hci_event.c | 2 +- 10 files changed, 16 insertions(+), 32 deletions(-) commit fb6a421fb6153d97cf3058f9bd550b377b76a490 Author: Song Liu Date: Wed Aug 7 15:05:13 2024 -0700 kallsyms: Match symbols exactly with CONFIG_LTO_CLANG With CONFIG_LTO_CLANG=y, the compiler may add .llvm. suffix to function names to avoid duplication. APIs like kallsyms_lookup_name() and kallsyms_on_each_match_symbol() tries to match these symbol names without the .llvm. suffix, e.g., match "c_stop" with symbol c_stop.llvm.17132674095431275852. This turned out to be problematic for use cases that require exact match, for example, livepatch. Fix this by making the APIs to match symbols exactly. Also cleanup kallsyms_selftests accordingly. Signed-off-by: Song Liu Fixes: 8cc32a9bbf29 ("kallsyms: strip LTO-only suffixes from promoted global functions") Tested-by: Masami Hiramatsu (Google) Reviewed-by: Masami Hiramatsu (Google) Acked-by: Petr Mladek Reviewed-by: Sami Tolvanen Reviewed-by: Luis Chamberlain Link: https://lore.kernel.org/r/20240807220513.3100483-3-song@kernel.org Signed-off-by: Kees Cook kernel/kallsyms.c | 55 +++++----------------------------------------- kernel/kallsyms_selftest.c | 22 +------------------ 2 files changed, 7 insertions(+), 70 deletions(-) commit 020925ce92990c3bf59ab2cde386ac6d9ec734ff Author: Song Liu Date: Wed Aug 7 15:05:12 2024 -0700 kallsyms: Do not cleanup .llvm. suffix before sorting symbols Cleaning up the symbols causes various issues afterwards. Let's sort the list based on original name. Signed-off-by: Song Liu Fixes: 8cc32a9bbf29 ("kallsyms: strip LTO-only suffixes from promoted global functions") Reviewed-by: Masami Hiramatsu (Google) Tested-by: Masami Hiramatsu (Google) Acked-by: Petr Mladek Reviewed-by: Sami Tolvanen Reviewed-by: Luis Chamberlain Link: https://lore.kernel.org/r/20240807220513.3100483-2-song@kernel.org Signed-off-by: Kees Cook scripts/kallsyms.c | 31 ++----------------------------- scripts/link-vmlinux.sh | 4 ---- 2 files changed, 2 insertions(+), 33 deletions(-) commit 92e9bac18124682c4b99ede9ee3bcdd68f121e92 Author: Ivan Orlov Date: Thu Aug 15 01:04:31 2024 +0100 kunit/overflow: Fix UB in overflow_allocation_test The 'device_name' array doesn't exist out of the 'overflow_allocation_test' function scope. However, it is being used as a driver name when calling 'kunit_driver_create' from 'kunit_device_register'. It produces the kernel panic with KASAN enabled. Since this variable is used in one place only, remove it and pass the device name into kunit_device_register directly as an ascii string. Signed-off-by: Ivan Orlov Reviewed-by: David Gow Link: https://lore.kernel.org/r/20240815000431.401869-1-ivan.orlov0322@gmail.com Signed-off-by: Kees Cook lib/overflow_kunit.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) commit 9bb5e74b2bf88fbb024bb15ded3b011e02c673be Author: Griffin Kroah-Hartman Date: Thu Aug 15 11:49:20 2024 +0200 Revert "misc: fastrpc: Restrict untrusted app to attach to privileged PD" This reverts commit bab2f5e8fd5d2f759db26b78d9db57412888f187. Joel reported that this commit breaks userspace and stops sensors in SDM845 from working. Also breaks other qcom SoC devices running postmarketOS. Cc: stable Cc: Ekansh Gupta Cc: Dmitry Baryshkov Reported-by: Joel Selvaraj Link: https://lore.kernel.org/r/9a9f5646-a554-4b65-8122-d212bb665c81@umsystem.edu Signed-off-by: Griffin Kroah-Hartman Acked-by: Srinivas Kandagatla Fixes: bab2f5e8fd5d ("misc: fastrpc: Restrict untrusted app to attach to privileged PD") Link: https://lore.kernel.org/r/20240815094920.8242-1-griffin@kroah.com Signed-off-by: Greg Kroah-Hartman drivers/misc/fastrpc.c | 22 +++------------------- include/uapi/misc/fastrpc.h | 3 --- 2 files changed, 3 insertions(+), 22 deletions(-) commit 164199615ae230ace4519141285f06766d6d8036 Author: Yuntao Liu Date: Thu Aug 15 08:49:23 2024 +0000 ASoC: amd: acp: fix module autoloading Add MODULE_DEVICE_TABLE(), so modules could be properly autoloaded based on the alias from platform_device_id table. Fixes: 9d8a7be88b336 ("ASoC: amd: acp: Add legacy sound card support for Chrome audio") Signed-off-by: Yuntao Liu Link: https://patch.msgid.link/20240815084923.756476-1-liuyuntao12@huawei.com Signed-off-by: Mark Brown sound/soc/amd/acp/acp-legacy-mach.c | 2 ++ 1 file changed, 2 insertions(+) commit af8e119f52e9c13e556be9e03f27957554a84656 Author: Mathias Nyman Date: Thu Aug 15 17:11:17 2024 +0300 xhci: Fix Panther point NULL pointer deref at full-speed re-enumeration re-enumerating full-speed devices after a failed address device command can trigger a NULL pointer dereference. Full-speed devices may need to reconfigure the endpoint 0 Max Packet Size value during enumeration. Usb core calls usb_ep0_reinit() in this case, which ends up calling xhci_configure_endpoint(). On Panther point xHC the xhci_configure_endpoint() function will additionally check and reserve bandwidth in software. Other hosts do this in hardware If xHC address device command fails then a new xhci_virt_device structure is allocated as part of re-enabling the slot, but the bandwidth table pointers are not set up properly here. This triggers the NULL pointer dereference the next time usb_ep0_reinit() is called and xhci_configure_endpoint() tries to check and reserve bandwidth [46710.713538] usb 3-1: new full-speed USB device number 5 using xhci_hcd [46710.713699] usb 3-1: Device not responding to setup address. [46710.917684] usb 3-1: Device not responding to setup address. [46711.125536] usb 3-1: device not accepting address 5, error -71 [46711.125594] BUG: kernel NULL pointer dereference, address: 0000000000000008 [46711.125600] #PF: supervisor read access in kernel mode [46711.125603] #PF: error_code(0x0000) - not-present page [46711.125606] PGD 0 P4D 0 [46711.125610] Oops: Oops: 0000 [#1] PREEMPT SMP PTI [46711.125615] CPU: 1 PID: 25760 Comm: kworker/1:2 Not tainted 6.10.3_2 #1 [46711.125620] Hardware name: Gigabyte Technology Co., Ltd. [46711.125623] Workqueue: usb_hub_wq hub_event [usbcore] [46711.125668] RIP: 0010:xhci_reserve_bandwidth (drivers/usb/host/xhci.c Fix this by making sure bandwidth table pointers are set up correctly after a failed address device command, and additionally by avoiding checking for bandwidth in cases like this where no actual endpoints are added or removed, i.e. only context for default control endpoint 0 is evaluated. Reported-by: Karel Balej Closes: https://lore.kernel.org/linux-usb/D3CKQQAETH47.1MUO22RTCH2O3@matfyz.cz/ Cc: stable@vger.kernel.org Fixes: 651aaf36a7d7 ("usb: xhci: Handle USB transaction error on address command") Signed-off-by: Mathias Nyman Link: https://lore.kernel.org/r/20240815141117.2702314-2-mathias.nyman@linux.intel.com Signed-off-by: Greg Kroah-Hartman drivers/usb/host/xhci.c | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-) commit f002702290fccbd473f5bb94e52f25c96917fff2 Author: Matthew Brost Date: Fri Jul 19 10:29:04 2024 -0700 drm/xe: Hold a PM ref when GT TLB invalidations are inflight Avoid GT TLB invalidation timeouts by holding a PM ref when invalidations are inflight. v2: - Drop PM ref before signaling fence (CI) v3: - Move invalidation_fence_signal helper in tlb timeout to previous patch (Matthew Auld) Fixes: dd08ebf6c352 ("drm/xe: Introduce a new DRM driver for Intel GPUs") Cc: Rodrigo Vivi Cc: Nirmoy Das Signed-off-by: Matthew Brost Reviewed-by: Nirmoy Das Link: https://patchwork.freedesktop.org/patch/msgid/20240719172905.1527927-4-matthew.brost@intel.com (cherry picked from commit 0a382f9bc5dc4744a33970a5ed4df8f9c702ee9e) Requires: 46209ce5287b ("drm/xe: Add xe_gt_tlb_invalidation_fence_init helper") Requires: 0e414ab036e0 ("drm/xe: Drop xe_gt_tlb_invalidation_wait") Signed-off-by: Rodrigo Vivi drivers/gpu/drm/xe/xe_gt_tlb_invalidation.c | 23 +++++++++++++++++++++-- drivers/gpu/drm/xe/xe_gt_tlb_invalidation.h | 1 + drivers/gpu/drm/xe/xe_gt_tlb_invalidation_types.h | 4 ++++ drivers/gpu/drm/xe/xe_vm.c | 4 +++- 4 files changed, 29 insertions(+), 3 deletions(-) commit 58bfe6674467f4c037e89111e6007f25b34d8bb3 Author: Matthew Brost Date: Fri Jul 19 10:29:03 2024 -0700 drm/xe: Drop xe_gt_tlb_invalidation_wait Having two methods to wait on GT TLB invalidations is not ideal. Remove xe_gt_tlb_invalidation_wait and only use GT TLB invalidation fences. In addition to two methods being less than ideal, once GT TLB invalidations are coalesced the seqno cannot be assigned during xe_gt_tlb_invalidation_ggtt/range. Thus xe_gt_tlb_invalidation_wait would not have a seqno to wait one. A fence however can be armed and later signaled. v3: - Add explaination about coalescing to commit message v4: - Don't put dma fence if defined on stack (CI) v5: - Initialize ret to zero (CI) v6: - Use invalidation_fence_signal helper in tlb timeout (Matthew Auld) Signed-off-by: Matthew Brost Reviewed-by: Nirmoy Das Link: https://patchwork.freedesktop.org/patch/msgid/20240719172905.1527927-3-matthew.brost@intel.com (cherry picked from commit 61ac035361ae555ee5a17a7667fe96afdde3d59a) Signed-off-by: Rodrigo Vivi drivers/gpu/drm/xe/xe_gt_tlb_invalidation.c | 148 +++++++++++----------------- drivers/gpu/drm/xe/xe_gt_tlb_invalidation.h | 10 +- drivers/gpu/drm/xe/xe_pt.c | 2 +- drivers/gpu/drm/xe/xe_vm.c | 30 +++--- 4 files changed, 80 insertions(+), 110 deletions(-) commit 90be4cc6f7674a1478c4c750beeee3edd14aee38 Author: Matthew Brost Date: Fri Jul 19 10:29:02 2024 -0700 drm/xe: Add xe_gt_tlb_invalidation_fence_init helper Other layers should not be touching struct xe_gt_tlb_invalidation_fence directly, add helper for initialization. v2: - Add dma_fence_get and list init to xe_gt_tlb_invalidation_fence_init Signed-off-by: Matthew Brost Reviewed-by: Nirmoy Das Link: https://patchwork.freedesktop.org/patch/msgid/20240719172905.1527927-2-matthew.brost@intel.com (cherry picked from commit a522b285c6b4b611406d59612a8d7241714d2e31) Signed-off-by: Rodrigo Vivi drivers/gpu/drm/xe/xe_gt_tlb_invalidation.c | 36 +++++++++++++++++++++++++++++ drivers/gpu/drm/xe/xe_gt_tlb_invalidation.h | 3 +++ drivers/gpu/drm/xe/xe_pt.c | 26 +-------------------- 3 files changed, 40 insertions(+), 25 deletions(-) commit 4f7652dcd339aca6678084d42fda999ecb19b624 Author: Michal Wajdeczko Date: Tue Aug 6 20:05:16 2024 +0200 drm/xe/pf: Fix VF config validation on multi-GT platforms When validating VF config on the media GT, we may wrongly report that VF is already partially configured on it, as we consider GGTT and LMEM provisioning done on the primary GT (since both GGTT and LMEM are tile-level resources, not a GT-level). This will cause skipping a VF auto-provisioning on the media-GT and in result will block a VF from successfully initialize that GT. Fix that by considering GGTT and LMEM configurations only when checking if a VF provisioning is complete, and omit GGTT and LMEM when reporting empty/partial provisioning. Fixes: 234670cea9a2 ("drm/xe/pf: Skip fair VFs provisioning if already provisioned") Signed-off-by: Michal Wajdeczko Cc: Piotr Piórkowski Reviewed-by: Jonathan Cavitt Link: https://patchwork.freedesktop.org/patch/msgid/20240806180516.618-1-michal.wajdeczko@intel.com (cherry picked from commit 5bdacb0907c1f531995b6ba47b832ac3a0182ae9) Signed-off-by: Rodrigo Vivi drivers/gpu/drm/xe/xe_gt_sriov_pf_config.c | 11 ++++++++--- 1 file changed, 8 insertions(+), 3 deletions(-) commit 55ea73aacfb9a92def840a7110a468c5a76caeb5 Author: Matthew Brost Date: Fri Jul 19 10:29:05 2024 -0700 drm/xe: Build PM into GuC CT layer Take PM ref when any G2H are outstanding, drop when none are outstanding. To safely ensure we have PM ref when in the GuC CT layer, a PM ref needs to be held when scheduler messages are pending too. v2: - Add outer PM protections to xe_file_close (CI) v3: - Only take PM ref 0->1 and drop on 1->0 (Matthew Auld) v4: - Add assert to G2H increment function v5: - Rebase v6: - Declare xe as local variable in xe_file_close (CI) Fixes: dd08ebf6c352 ("drm/xe: Introduce a new DRM driver for Intel GPUs") Cc: Matthew Auld Cc: Rodrigo Vivi Cc: Nirmoy Das Signed-off-by: Matthew Brost Reviewed-by: Matthew Auld Reviewed-by: Nirmoy Das Link: https://patchwork.freedesktop.org/patch/msgid/20240719172905.1527927-5-matthew.brost@intel.com (cherry picked from commit d930c19fdff3109e97b610fa10943b7602efcabd) Signed-off-by: Rodrigo Vivi drivers/gpu/drm/xe/xe_device.c | 5 +++++ drivers/gpu/drm/xe/xe_guc_ct.c | 10 +++++++++- drivers/gpu/drm/xe/xe_guc_submit.c | 4 ++++ 3 files changed, 18 insertions(+), 1 deletion(-) commit 64da63cd3f7d771bf8f240e72203da1f72aa3728 Author: Michal Wajdeczko Date: Thu Jul 18 22:31:55 2024 +0200 drm/xe/vf: Fix register value lookup We should use the number of actual entries stored in the runtime register buffer, not the maximum number of entries that this buffer can hold, otherwise bsearch() may fail and we may miss the data and wrongly report unexpected access to some registers. Fixes: 4edadc41a3a4 ("drm/xe/vf: Use register values obtained from the PF") Signed-off-by: Michal Wajdeczko Cc: Piotr Piórkowski Cc: Matt Roper Reviewed-by: Matt Roper Link: https://patchwork.freedesktop.org/patch/msgid/20240718203155.486-1-michal.wajdeczko@intel.com (cherry picked from commit ad16682db18f4414e53bba1ce0db75b08bdc4dff) Signed-off-by: Rodrigo Vivi drivers/gpu/drm/xe/xe_gt_sriov_vf.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 817c70e2ba278e9d5360833b1137ef8855ac1728 Author: Umesh Nerlige Ramappa Date: Thu Jul 18 14:05:48 2024 -0700 drm/xe: Fix use after free when client stats are captured xe_file_close triggers an asynchronous queue cleanup and then frees up the xef object. Since queue cleanup flushes all pending jobs and the KMD stores client usage stats into the xef object after jobs are flushed, we see a use-after-free for the xef object. Resolve this by taking a reference to xef from xe_exec_queue. While at it, revert an earlier change that contained a partial work around for this issue. v2: - Take a ref to xef even for the VM bind queue (Matt) - Squash patches relevant to that fix and work around (Lucas) v3: Fix typo (Lucas) Fixes: ce62827bc294 ("drm/xe: Do not access xe file when updating exec queue run_ticks") Fixes: 6109f24f87d7 ("drm/xe: Add helper to accumulate exec queue runtime") Closes: https://gitlab.freedesktop.org/drm/xe/kernel/issues/1908 Signed-off-by: Umesh Nerlige Ramappa Reviewed-by: Matthew Brost Reviewed-by: Lucas De Marchi Link: https://patchwork.freedesktop.org/patch/msgid/20240718210548.3580382-5-umesh.nerlige.ramappa@intel.com Signed-off-by: Lucas De Marchi (cherry picked from commit 2149ded63079449b8dddf9da38392632f155e6b5) Signed-off-by: Rodrigo Vivi drivers/gpu/drm/xe/xe_drm_client.c | 5 +---- drivers/gpu/drm/xe/xe_exec_queue.c | 10 +++++++++- drivers/gpu/drm/xe/xe_exec_queue_types.h | 7 +++---- 3 files changed, 13 insertions(+), 9 deletions(-) commit 6309f9b1fc4de2daa1293fe12a488d765e60507d Author: Umesh Nerlige Ramappa Date: Thu Jul 18 14:05:47 2024 -0700 drm/xe: Take a ref to xe file when user creates a VM Take a reference to xef when user creates the VM and put the reference when user destroys the VM. Signed-off-by: Umesh Nerlige Ramappa Reviewed-by: Matthew Brost Reviewed-by: Lucas De Marchi Link: https://patchwork.freedesktop.org/patch/msgid/20240718210548.3580382-4-umesh.nerlige.ramappa@intel.com Signed-off-by: Lucas De Marchi (cherry picked from commit a2387e69493df3de706f14e4573ee123d23d5d34) Signed-off-by: Rodrigo Vivi drivers/gpu/drm/xe/xe_vm.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) commit d28bb0120f360e772458a7cf295d6d0ae3dc18a4 Author: Umesh Nerlige Ramappa Date: Thu Jul 18 14:05:46 2024 -0700 drm/xe: Add ref counting for xe_file Add ref counting for xe_file. v2: - Add kernel doc for exported functions (Matt) - Instead of xe_file_destroy, export the get/put helpers (Lucas) v3: Fixup the kernel-doc format and description (Matt, Lucas) Signed-off-by: Umesh Nerlige Ramappa Reviewed-by: Matthew Brost Link: https://patchwork.freedesktop.org/patch/msgid/20240718210548.3580382-3-umesh.nerlige.ramappa@intel.com Signed-off-by: Lucas De Marchi (cherry picked from commit ce8c161cbad43f4056451e541f7ae3471d0cca12) Signed-off-by: Rodrigo Vivi drivers/gpu/drm/xe/xe_device.c | 33 +++++++++++++++++++++++++++++++-- drivers/gpu/drm/xe/xe_device.h | 3 +++ drivers/gpu/drm/xe/xe_device_types.h | 3 +++ 3 files changed, 37 insertions(+), 2 deletions(-) commit e98a032c0340d45c199f4eb536359f5762a8748f Author: Umesh Nerlige Ramappa Date: Thu Jul 18 14:05:45 2024 -0700 drm/xe: Move part of xe_file cleanup to a helper In order to make xe_file ref counted, move destruction of xe_file members to a helper. v2: Move xe_vm_close_and_put back into xe_file_close (Matt) Signed-off-by: Umesh Nerlige Ramappa Reviewed-by: Matthew Brost Reviewed-by: Lucas De Marchi Link: https://patchwork.freedesktop.org/patch/msgid/20240718210548.3580382-2-umesh.nerlige.ramappa@intel.com Signed-off-by: Lucas De Marchi (cherry picked from commit 3d0c4a62cc553c6ffde4cb11620eba991e770665) Signed-off-by: Rodrigo Vivi drivers/gpu/drm/xe/xe_device.c | 29 ++++++++++++++++++----------- 1 file changed, 18 insertions(+), 11 deletions(-) commit ddeb7989a98faf8da67ac613731a0eee32667b7d Author: Matthew Brost Date: Wed Jul 17 07:04:28 2024 -0700 drm/xe: Validate user fence during creation Fail invalid addresses during user fence creation. Fixes: dd08ebf6c352 ("drm/xe: Introduce a new DRM driver for Intel GPUs") Signed-off-by: Matthew Brost Reviewed-by: Thomas Hellström Reviewed-by: Nirmoy Das Link: https://patchwork.freedesktop.org/patch/msgid/20240717140429.1396820-1-matthew.brost@intel.com (cherry picked from commit 0fde907da2d5fd4da68845e96c6842497159c858) Signed-off-by: Rodrigo Vivi drivers/gpu/drm/xe/xe_sync.c | 12 ++++++++---- 1 file changed, 8 insertions(+), 4 deletions(-) commit d33d26036a0274b472299d7dcdaa5fb34329f91b Author: Roland Xu Date: Thu Aug 15 10:58:13 2024 +0800 rtmutex: Drop rt_mutex::wait_lock before scheduling rt_mutex_handle_deadlock() is called with rt_mutex::wait_lock held. In the good case it returns with the lock held and in the deadlock case it emits a warning and goes into an endless scheduling loop with the lock held, which triggers the 'scheduling in atomic' warning. Unlock rt_mutex::wait_lock in the dead lock case before issuing the warning and dropping into the schedule for ever loop. [ tglx: Moved unlock before the WARN(), removed the pointless comment, massaged changelog, added Fixes tag ] Fixes: 3d5c9340d194 ("rtmutex: Handle deadlock detection smarter") Signed-off-by: Roland Xu Signed-off-by: Thomas Gleixner Cc: stable@vger.kernel.org Link: https://lore.kernel.org/all/ME0P300MB063599BEF0743B8FA339C2CECC802@ME0P300MB0635.AUSP300.PROD.OUTLOOK.COM kernel/locking/rtmutex.c | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-) commit 9c5af2d7dfe18e3a36f85fad8204cd2442ecd82b Merge: 34dfdf210d05 bd662c4218f9 Author: Paolo Abeni Date: Thu Aug 15 13:25:06 2024 +0200 Merge tag 'nf-24-08-15' of git://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf Pablo Neira Ayuso says: ==================== Netfilter fixes for net The following patchset contains Netfilter fixes for net: 1) Ignores ifindex for types other than mcast/linklocal in ipv6 frag reasm, from Tom Hughes. 2) Initialize extack for begin/end netlink message marker in batch, from Donald Hunter. 3) Initialize extack for flowtable offload support, also from Donald. 4) Dropped packets with cloned unconfirmed conntracks in nfqueue, later it should be possible to explore lookup after reinject but Florian prefers this approach at this stage. From Florian Westphal. 5) Add selftest for cloned unconfirmed conntracks in nfqueue for previous update. 6) Audit after filling netlink header successfully in object dump, from Phil Sutter. 7-8) Fix concurrent dump and reset which could result in underflow counter / quota objects. netfilter pull request 24-08-15 * tag 'nf-24-08-15' of git://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf: netfilter: nf_tables: Add locking for NFT_MSG_GETOBJ_RESET requests netfilter: nf_tables: Introduce nf_tables_getobj_single netfilter: nf_tables: Audit log dump reset after the fact selftests: netfilter: add test for br_netfilter+conntrack+queue combination netfilter: nf_queue: drop packets with cloned unconfirmed conntracks netfilter: flowtable: initialise extack before use netfilter: nfnetlink: Initialise extack before use in ACKs netfilter: allow ipv6 fragments to arrive on different devices ==================== Link: https://patch.msgid.link/20240814222042.150590-1-pablo@netfilter.org Signed-off-by: Paolo Abeni commit 34dfdf210d05ea6c6c75de2fa785853734fb51e8 Merge: 7965a7f32a53 7660833d2175 Author: Paolo Abeni Date: Thu Aug 15 13:07:10 2024 +0200 Merge branch 'there-are-some-bugfix-for-the-hns3-ethernet-driver' Jijie Shao says: ==================== There are some bugfix for the HNS3 ethernet driver ==================== Link: https://patch.msgid.link/20240813141024.1707252-1-shaojijie@huawei.com Signed-off-by: Paolo Abeni commit 7660833d217528c8f2385528951ab820a031e4e3 Author: Peiyang Wang Date: Tue Aug 13 22:10:24 2024 +0800 net: hns3: use correct release function during uninitialization pci_request_regions is called to apply for PCI I/O and memory resources when the driver is initialized, Therefore, when the driver is uninstalled, pci_release_regions should be used to release PCI I/O and memory resources instead of pci_release_mem_regions is used to release memory reasouces only. Signed-off-by: Peiyang Wang Signed-off-by: Jijie Shao Signed-off-by: Paolo Abeni drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 86db7bfb06704ef17340eeae71c832f21cfce35c Author: Peiyang Wang Date: Tue Aug 13 22:10:23 2024 +0800 net: hns3: void array out of bound when loop tnl_num When query reg inf of SSU, it loops tnl_num times. However, tnl_num comes from hardware and the length of array is a fixed value. To void array out of bound, make sure the loop time is not greater than the length of array Signed-off-by: Peiyang Wang Signed-off-by: Jijie Shao Signed-off-by: Paolo Abeni drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_err.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) commit be5e816d00a506719e9dbb1a9c861c5ced30a109 Author: Jie Wang Date: Tue Aug 13 22:10:22 2024 +0800 net: hns3: fix a deadlock problem when config TC during resetting When config TC during the reset process, may cause a deadlock, the flow is as below: pf reset start │ ▼ ...... setup tc │ │ ▼ ▼ DOWN: napi_disable() napi_disable()(skip) │ │ │ ▼ ▼ ...... ...... │ │ ▼ │ napi_enable() │ ▼ UINIT: netif_napi_del() │ ▼ ...... │ ▼ INIT: netif_napi_add() │ ▼ ...... global reset start │ │ ▼ ▼ UP: napi_enable()(skip) ...... │ │ ▼ ▼ ...... napi_disable() In reset process, the driver will DOWN the port and then UINIT, in this case, the setup tc process will UP the port before UINIT, so cause the problem. Adds a DOWN process in UINIT to fix it. Fixes: bb6b94a896d4 ("net: hns3: Add reset interface implementation in client") Signed-off-by: Jie Wang Signed-off-by: Jijie Shao Signed-off-by: Paolo Abeni drivers/net/ethernet/hisilicon/hns3/hns3_enet.c | 3 +++ 1 file changed, 3 insertions(+) commit 30545e17eac1f50c5ef49644daf6af205100a965 Author: Peiyang Wang Date: Tue Aug 13 22:10:21 2024 +0800 net: hns3: use the user's cfg after reset Consider the followed case that the user change speed and reset the net interface. Before the hw change speed successfully, the driver get old old speed from hw by timer task. After reset, the previous speed is config to hw. As a result, the new speed is configed successfully but lost after PF reset. The followed pictured shows more dirrectly. +------+ +----+ +----+ | USER | | PF | | HW | +---+--+ +-+--+ +-+--+ | ethtool -s 100G | | +------------------>| set speed 100G | | +--------------------->| | | set successfully | | |<---------------------+---+ | |query cfg (timer task)| | | +--------------------->| | handle speed | | return 200G | | changing event | ethtool --reset |<---------------------+ | (100G) +------------------>| cfg previous speed |<--+ | | after reset (200G) | | +--------------------->| | | +---+ | |query cfg (timer task)| | | +--------------------->| | handle speed | | return 100G | | changing event | |<---------------------+ | (200G) | | |<--+ | |query cfg (timer task)| | +--------------------->| | | return 200G | | |<---------------------+ | | | v v v This patch save new speed if hw change speed successfully, which will be used after reset successfully. Fixes: 2d03eacc0b7e ("net: hns3: Only update mac configuation when necessary") Signed-off-by: Peiyang Wang Signed-off-by: Jijie Shao Signed-off-by: Paolo Abeni .../ethernet/hisilicon/hns3/hns3pf/hclge_main.c | 24 ++++++++++++++++------ .../ethernet/hisilicon/hns3/hns3pf/hclge_mdio.c | 3 +++ 2 files changed, 21 insertions(+), 6 deletions(-) commit 8445d9d3c03101859663d34fda747f6a50947556 Author: Jie Wang Date: Tue Aug 13 22:10:20 2024 +0800 net: hns3: fix wrong use of semaphore up Currently, if hns3 PF or VF FLR reset failed after five times retry, the reset done process will directly release the semaphore which has already released in hclge_reset_prepare_general. This will cause down operation fail. So this patch fixes it by adding reset state judgement. The up operation is only called after successful PF FLR reset. Fixes: 8627bdedc435 ("net: hns3: refactor the precedure of PF FLR") Fixes: f28368bb4542 ("net: hns3: refactor the procedure of VF FLR") Signed-off-by: Jie Wang Signed-off-by: Jijie Shao Signed-off-by: Paolo Abeni drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c | 4 ++-- drivers/net/ethernet/hisilicon/hns3/hns3vf/hclgevf_main.c | 4 ++-- 2 files changed, 4 insertions(+), 4 deletions(-) commit 7965a7f32a53d9ad807ce2c53bdda69ba104974f Author: Matthieu Baerts (NGI0) Date: Tue Aug 13 15:39:34 2024 +0200 selftests: net: lib: kill PIDs before del netns When deleting netns, it is possible to still have some tasks running, e.g. background tasks like tcpdump running in the background, not stopped because the test has been interrupted. Before deleting the netns, it is then safer to kill all attached PIDs, if any. That should reduce some noises after the end of some tests, and help with the debugging of some issues. That's why this modification is seen as a "fix". Fixes: 25ae948b4478 ("selftests/net: add lib.sh") Acked-by: Mat Martineau Signed-off-by: Matthieu Baerts (NGI0) Acked-by: Florian Westphal Reviewed-by: Hangbin Liu Link: https://patch.msgid.link/20240813-upstream-net-20240813-selftests-net-lib-kill-v1-1-27b689b248b8@kernel.org Signed-off-by: Paolo Abeni tools/testing/selftests/net/lib.sh | 1 + 1 file changed, 1 insertion(+) commit cdc90f75387c42d64a0ed1ba03550ea9447249d4 Author: Oleksij Rempel Date: Tue Aug 13 09:37:19 2024 +0200 pse-core: Conditionally set current limit during PI regulator registration Fix an issue where `devm_regulator_register()` would fail for PSE controllers that do not support current limit control, such as simple GPIO-based controllers like the podl-pse-regulator. The `REGULATOR_CHANGE_CURRENT` flag and `max_uA` constraint are now conditionally set only if the `pi_set_current_limit` operation is supported. This change prevents the regulator registration routine from attempting to call `pse_pi_set_current_limit()`, which would return `-EOPNOTSUPP` and cause the registration to fail. Fixes: 4a83abcef5f4f ("net: pse-pd: Add new power limit get and set c33 features") Signed-off-by: Oleksij Rempel Reviewed-by: Kory Maincent Tested-by: Kyle Swenson Link: https://patch.msgid.link/20240813073719.2304633-1-o.rempel@pengutronix.de Signed-off-by: Paolo Abeni drivers/net/pse-pd/pse_core.c | 11 ++++++++--- 1 file changed, 8 insertions(+), 3 deletions(-) commit 52dd070c62e4ae2b5e7411b920e3f7a64235ecfb Author: Peng Fan Date: Wed Aug 14 20:47:40 2024 +0800 pmdomain: imx: wait SSAR when i.MX93 power domain on With "quiet" set in bootargs, there is power domain failure: "imx93_power_domain 44462400.power-domain: pd_off timeout: name: 44462400.power-domain, stat: 4" The current power on opertation takes ISO state as power on finished flag, but it is wrong. Before powering on operation really finishes, powering off comes and powering off will never finish because the last powering on still not finishes, so the following powering off actually not trigger hardware state machine to run. SSAR is the last step when powering on a domain, so need to wait SSAR done when powering on. Since EdgeLock Enclave(ELE) handshake is involved in the flow, enlarge the waiting time to 10ms for both on and off to avoid timeout. Cc: stable@vger.kernel.org Fixes: 0a0f7cc25d4a ("soc: imx: add i.MX93 SRC power domain driver") Reviewed-by: Jacky Bai Signed-off-by: Peng Fan Link: https://lore.kernel.org/r/20240814124740.2778952-1-peng.fan@oss.nxp.com Signed-off-by: Ulf Hansson drivers/pmdomain/imx/imx93-pd.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) commit fd45cc614b8acca5bb435ba37fe9b3f9a17fab84 Author: Alex Bee Date: Mon Aug 5 13:08:56 2024 +0200 drm/rockchip: inno-hdmi: Fix infoframe upload HDMI analyser shows that the AVI infoframe is no being longer send. The switch to the HDMI connector api should have used the frame content which is now given in the buffer parameter, but instead still uses the (now) empty and superfluous packed_frame variable. Fix it. Fixes: 65548c8ff0ab ("drm/rockchip: inno_hdmi: Switch to HDMI connector") Signed-off-by: Alex Bee Acked-by: Maxime Ripard Signed-off-by: Heiko Stuebner Link: https://patchwork.freedesktop.org/patch/msgid/20240805110855.274140-2-knaerzche@gmail.com drivers/gpu/drm/rockchip/inno_hdmi.c | 4 +--- 1 file changed, 1 insertion(+), 3 deletions(-) commit 1f1b194284093d619c9fbc7e9e38b2c68d0408e8 Author: Marc Zyngier Date: Mon Aug 12 15:13:22 2024 +0100 net: thunder_bgx: Fix netdev structure allocation Commit 94833addfaba ("net: thunderx: Unembed netdev structure") had a go at dynamically allocating the netdev structures for the thunderx_bgx driver. This change results in my ThunderX box catching fire (to be fair, it is what it does best). The issues with this change are that: - bgx_lmac_enable() is called *after* bgx_acpi_register_phy() and bgx_init_of_phy(), both expecting netdev to be a valid pointer. - bgx_init_of_phy() populates the MAC addresses for *all* LMACs attached to a given BGX instance, and thus needs netdev for each of them to have been allocated. There is a few things to be said about how the driver mixes LMAC and BGX states which leads to this sorry state, but that's beside the point. To address this, go back to a situation where all netdev structures are allocated before the driver starts relying on them, and move the freeing of these structures to driver removal. Someone brave enough can always go and restructure the driver if they want. Fixes: 94833addfaba ("net: thunderx: Unembed netdev structure") Signed-off-by: Marc Zyngier Cc: Breno Leitao Cc: Sunil Goutham Cc: "David S. Miller" Cc: Eric Dumazet Cc: Jakub Kicinski Cc: Paolo Abeni Reviewed-by: Simon Horman Reviewed-by: Breno Leitao Link: https://patch.msgid.link/20240812141322.1742918-1-maz@kernel.org Signed-off-by: Paolo Abeni drivers/net/ethernet/cavium/thunder/thunder_bgx.c | 30 ++++++++++++++++------- 1 file changed, 21 insertions(+), 9 deletions(-) commit fde25c20f51807db340b875953cfd1cedaa392fc Author: Danielle Ratson Date: Mon Aug 12 17:08:24 2024 +0300 net: ethtool: Allow write mechanism of LPL and both LPL and EPL CMIS 5.2 standard section 9.4.2 defines four types of firmware update supported mechanism: None, only LPL, only EPL, both LPL and EPL. Currently, only LPL (Local Payload) type of write firmware block is supported. However, if the module supports both LPL and EPL the flashing process wrongly fails for no supporting LPL. Fix that, by allowing the write mechanism to be LPL or both LPL and EPL. Fixes: c4f78134d45c ("ethtool: cmis_fw_update: add a layer for supporting firmware update using CDB") Reported-by: Vladyslav Mykhaliuk Signed-off-by: Danielle Ratson Reviewed-by: Petr Machata Link: https://patch.msgid.link/20240812140824.3718826-1-danieller@nvidia.com Signed-off-by: Paolo Abeni net/ethtool/cmis_fw_update.c | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) commit 69139d2919dd4aa9a553c8245e7c63e82613e3fc Author: Cong Wang Date: Sun Aug 11 19:21:53 2024 -0700 vsock: fix recursive ->recvmsg calls After a vsock socket has been added to a BPF sockmap, its prot->recvmsg has been replaced with vsock_bpf_recvmsg(). Thus the following recursiion could happen: vsock_bpf_recvmsg() -> __vsock_recvmsg() -> vsock_connectible_recvmsg() -> prot->recvmsg() -> vsock_bpf_recvmsg() again We need to fix it by calling the original ->recvmsg() without any BPF sockmap logic in __vsock_recvmsg(). Fixes: 634f1a7110b4 ("vsock: support sockmap") Reported-by: syzbot+bdb4bd87b5e22058e2a4@syzkaller.appspotmail.com Tested-by: syzbot+bdb4bd87b5e22058e2a4@syzkaller.appspotmail.com Cc: Bobby Eshleman Cc: Michael S. Tsirkin Cc: Stefano Garzarella Signed-off-by: Cong Wang Acked-by: Michael S. Tsirkin Link: https://patch.msgid.link/20240812022153.86512-1-xiyou.wangcong@gmail.com Signed-off-by: Paolo Abeni include/net/af_vsock.h | 4 ++++ net/vmw_vsock/af_vsock.c | 50 +++++++++++++++++++++++++++-------------------- net/vmw_vsock/vsock_bpf.c | 4 ++-- 3 files changed, 35 insertions(+), 23 deletions(-) commit f75c235565f90c4a17b125e47f1c68ef6b8c2bce Author: Samuel Holland Date: Wed Aug 14 02:09:53 2024 -0700 arm64: Fix KASAN random tag seed initialization Currently, kasan_init_sw_tags() is called before setup_per_cpu_areas(), so per_cpu(prng_state, cpu) accesses the same address regardless of the value of "cpu", and the same seed value gets copied to the percpu area for every CPU. Fix this by moving the call to smp_prepare_boot_cpu(), which is the first architecture hook after setup_per_cpu_areas(). Fixes: 3c9e3aa11094 ("kasan: add tag related helper functions") Fixes: 3f41b6093823 ("kasan: fix random seed generation for tag-based mode") Signed-off-by: Samuel Holland Reviewed-by: Andrey Konovalov Link: https://lore.kernel.org/r/20240814091005.969756-1-samuel.holland@sifive.com Signed-off-by: Catalin Marinas arch/arm64/kernel/setup.c | 3 --- arch/arm64/kernel/smp.c | 2 ++ 2 files changed, 2 insertions(+), 3 deletions(-) commit 0863bffda1131fd2fa9c05b653ad9ee3d8db127e Author: Griffin Kroah-Hartman Date: Wed Aug 14 13:17:47 2024 +0200 Revert "serial: 8250_omap: Set the console genpd always on if no console suspend" This reverts commit 68e6939ea9ec3d6579eadeab16060339cdeaf940. Kevin reported that this causes a crash during suspend on platforms that dont use PM domains. Link: https://lore.kernel.org/r/7ha5hgpchq.fsf@baylibre.com Cc: Thomas Richard Fixes: 68e6939ea9ec ("serial: 8250_omap: Set the console genpd always on if no console suspend") Cc: stable Reported-by: Kevin Hilman Signed-off-by: Griffin Kroah-Hartman Link: https://lore.kernel.org/r/20240814111747.82371-1-griffin@kroah.com Signed-off-by: Greg Kroah-Hartman drivers/tty/serial/8250/8250_omap.c | 33 +++++---------------------------- 1 file changed, 5 insertions(+), 28 deletions(-) commit b2ca1661c7db9693095cee7991c55d67c3b5d346 Merge: 6c569b77f030 e37a9184f270 Author: Jakub Kicinski Date: Wed Aug 14 20:40:43 2024 -0700 Merge tag 'wireless-2024-08-14' of git://git.kernel.org/pub/scm/linux/kernel/git/wireless/wireless Kalle Valo says: ==================== wireless fixes for v6.11 We have few fixes to drivers. The most important here is a fix for iwlwifi which caused major slowdowns for several users. * tag 'wireless-2024-08-14' of git://git.kernel.org/pub/scm/linux/kernel/git/wireless/wireless: wifi: iwlwifi: correctly lookup DMA address in SG table wifi: mt76: mt7921: fix NULL pointer access in mt7921_ipv6_addr_change wifi: brcmfmac: cfg80211: Handle SSID based pmksa deletion wifi: rtlwifi: rtl8192du: Initialise value32 in _rtl92du_init_queue_reserved_page wifi: ath12k: use 128 bytes aligned iova in transmit path for WCN7850 ==================== Link: https://patch.msgid.link/20240814171606.E14A0C116B1@smtp.kernel.org Signed-off-by: Jakub Kicinski commit 6c569b77f0300f8a9960277c7094fa0f128eb811 Author: Abhinav Jain Date: Wed Aug 14 13:37:43 2024 +0530 selftest: af_unix: Fix kselftest compilation warnings Change expected_buf from (const void *) to (const char *) in function __recvpair(). This change fixes the below warnings during test compilation: ``` In file included from msg_oob.c:14: msg_oob.c: In function ‘__recvpair’: ../../kselftest_harness.h:106:40: warning: format ‘%s’ expects argument of type ‘char *’,but argument 6 has type ‘const void *’ [-Wformat=] ../../kselftest_harness.h:101:17: note: in expansion of macro ‘__TH_LOG’ msg_oob.c:235:17: note: in expansion of macro ‘TH_LOG’ ../../kselftest_harness.h:106:40: warning: format ‘%s’ expects argument of type ‘char *’,but argument 6 has type ‘const void *’ [-Wformat=] ../../kselftest_harness.h:101:17: note: in expansion of macro ‘__TH_LOG’ msg_oob.c:259:25: note: in expansion of macro ‘TH_LOG’ ``` Fixes: d098d77232c3 ("selftest: af_unix: Add msg_oob.c.") Signed-off-by: Abhinav Jain Reviewed-by: Kuniyuki Iwashima Link: https://patch.msgid.link/20240814080743.1156166-1-jain.abhinav177@gmail.com Signed-off-by: Jakub Kicinski tools/testing/selftests/net/af_unix/msg_oob.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 924fc22c282edbf93869b150d9e1b47e0b10485e Author: Bartosz Golaszewski Date: Wed Jul 31 09:44:57 2024 +0200 firmware: qcom: qseecom: remove unused functions qseecom_scm_dev(), qseecom_dma_alloc() and qseecom_dma_free() are no longer used following the conversion to using tzmem. Remove them. Fixes: 6612103ec35a ("firmware: qcom: qseecom: convert to using the TZ allocator") Reviewed-by: Andrew Halaney Signed-off-by: Bartosz Golaszewski Link: https://lore.kernel.org/r/20240731-tzmem-efivars-fix-v2-2-f0e84071ec07@linaro.org Signed-off-by: Bjorn Andersson include/linux/firmware/qcom/qcom_qseecom.h | 45 ------------------------------ 1 file changed, 45 deletions(-) commit 1c753d001a259d0278fe318a1ed3c8aa5f3ea09e Author: Bartosz Golaszewski Date: Wed Jul 31 09:44:56 2024 +0200 firmware: qcom: tzmem: fix virtual-to-physical address conversion We currently only correctly convert the virtual address passed by the caller to qcom_tzmem_to_phys() if it corresponds to the base address of the chunk. If the user wants to convert some pointer at an offset relative to that base address, we'll return 0. Let's change the implementation of qcom_tzmem_to_phys(): iterate over the chunks and try to call gen_pool_virt_to_phys() just-in-time instead of trying to call it only once when creating the chunk. Fixes: 84f5a7b67b61 ("firmware: qcom: add a dedicated TrustZone buffer allocator") Reported-by: Johan Hovold Closes: https://lore.kernel.org/lkml/20240729095542.21097-1-johan+linaro@kernel.org/ Acked-by: Andrew Halaney Signed-off-by: Bartosz Golaszewski Link: https://lore.kernel.org/r/20240731-tzmem-efivars-fix-v2-1-f0e84071ec07@linaro.org Signed-off-by: Bjorn Andersson drivers/firmware/qcom/qcom_tzmem.c | 32 +++++++++++++++++++++----------- 1 file changed, 21 insertions(+), 11 deletions(-) commit 9960085a3a82c58d3323c1c20b991db6045063b0 Author: Murali Nalajala Date: Wed Aug 14 15:32:44 2024 -0700 firmware: qcom: scm: Mark get_wq_ctx() as atomic call Currently get_wq_ctx() is wrongly configured as a standard call. When two SMC calls are in sleep and one SMC wakes up, it calls get_wq_ctx() to resume the corresponding sleeping thread. But if get_wq_ctx() is interrupted, goes to sleep and another SMC call is waiting to be allocated a waitq context, it leads to a deadlock. To avoid this get_wq_ctx() must be an atomic call and can't be a standard SMC call. Hence mark get_wq_ctx() as a fast call. Fixes: 6bf325992236 ("firmware: qcom: scm: Add wait-queue handling logic") Cc: stable@vger.kernel.org Signed-off-by: Murali Nalajala Signed-off-by: Unnathi Chalicheemala Reviewed-by: Elliot Berman Link: https://lore.kernel.org/r/20240814223244.40081-1-quic_uchalich@quicinc.com Signed-off-by: Bjorn Andersson drivers/firmware/qcom/qcom_scm-smc.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 6357efe3abead68048729adf11a9363881657939 Author: devi priya Date: Tue Aug 6 11:41:05 2024 +0530 clk: qcom: ipq9574: Update the alpha PLL type for GPLLs Update PLL offsets to DEFAULT_EVO to configure MDIO to 800MHz. The incorrect clock frequency leads to an incorrect MDIO clock. This, in turn, affects the MDIO hardware configurations as the divider is calculated from the MDIO clock frequency. If the clock frequency is not as expected, the MDIO register fails due to the generation of an incorrect MDIO frequency. This issue is critical as it results in incorrect MDIO configurations and ultimately leads to the MDIO function not working. This results in a complete feature failure affecting all Ethernet PHYs. Specifically, Ethernet will not work on IPQ9574 due to this issue. Currently, the clock frequency is set to CLK_ALPHA_PLL_TYPE_DEFAULT. However, this setting does not yield the expected clock frequency. To rectify this, we need to change this to CLK_ALPHA_PLL_TYPE_DEFAULT_EVO. This modification ensures that the clock frequency aligns with our expectations, thereby resolving the MDIO register failure and ensuring the proper functioning of the Ethernet on IPQ9574. Fixes: d75b82cff488 ("clk: qcom: Add Global Clock Controller driver for IPQ9574") Signed-off-by: devi priya Signed-off-by: Amandeep Singh Link: https://lore.kernel.org/r/20240806061105.2849944-1-quic_amansing@quicinc.com Signed-off-by: Bjorn Andersson drivers/clk/qcom/gcc-ipq9574.c | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-) commit dfbe93f32c12f5628bd83303e10ba63621c259ae Author: Konrad Dybcio Date: Tue Jul 16 12:35:03 2024 +0200 arm64: dts: qcom: x1e80100: Fix Adreno SMMU global interrupt Fix the unfortunate off-by-one. Fixes: 721e38301b79 ("arm64: dts: qcom: x1e80100: Add gpu support") Signed-off-by: Konrad Dybcio Link: https://lore.kernel.org/r/20240716-topic-h_bits-v1-1-f6c5d3ff982c@linaro.org Signed-off-by: Bjorn Andersson arch/arm64/boot/dts/qcom/x1e80100.dtsi | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 1f7574a1f9a892dd79e0dfc03f38573e9c399ec2 Author: Dmitry Baryshkov Date: Mon Jul 15 22:17:44 2024 +0300 arm64: dts: qcom: disable GPU on x1e80100 by default The GPU on X1E80100 requires ZAP 'shader' file to be useful. Since the file is signed by the OEM keys and might be not available by default, disable the GPU node and drop the firmware name from the x1e80100.dtsi file. Devices not being fused to use OEM keys can specify generic location at `qcom/x1e80100/gen70500_zap.mbn` while enabling the GPU. The CRD and QCP were lucky enough to work with the default settings, so reenable the GPU on those platforms and provide correct firmware-name (including the SoC subdir). Fixes: 721e38301b79 ("arm64: dts: qcom: x1e80100: Add gpu support") Cc: Akhil P Oommen Reviewed-by: Konrad Dybcio Signed-off-by: Dmitry Baryshkov Reviewed-by: Caleb Connolly Reviewed-by: Akhil P Oommen Link: https://lore.kernel.org/r/20240715-x1e8-zap-name-v3-1-e7a5258c3c2e@linaro.org Signed-off-by: Bjorn Andersson arch/arm64/boot/dts/qcom/x1e80100-crd.dts | 8 ++++++++ arch/arm64/boot/dts/qcom/x1e80100-qcp.dts | 8 ++++++++ arch/arm64/boot/dts/qcom/x1e80100.dtsi | 3 ++- 3 files changed, 18 insertions(+), 1 deletion(-) commit 1fb918967b56df3262ee984175816f0acb310501 Merge: d07b43284ab3 6252690f7e1b Author: Linus Torvalds Date: Wed Aug 14 17:56:15 2024 -0700 Merge tag 'for-6.11-rc3-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/kdave/linux Pull btrfs fixes from David Sterba: - extend tree-checker verification of directory item type - fix regression in page/folio and extent state tracking in xarray, the dirty status can get out of sync and can cause problems e.g. a hang - in send, detect last extent and allow to clone it instead of sending it as write, reduces amount of data transferred in the stream - fix checking extent references when cleaning deleted subvolumes - fix one more case in the extent map shrinker, let it run only in the kswapd context so it does not cause latency spikes during other operations * tag 'for-6.11-rc3-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/kdave/linux: btrfs: fix invalid mapping of extent xarray state btrfs: send: allow cloning non-aligned extent if it ends at i_size btrfs: only run the extent map shrinker from kswapd tasks btrfs: tree-checker: reject BTRFS_FT_UNKNOWN dir type btrfs: check delayed refs when we're checking if a ref exists commit 14d069d92951a3e150c0a81f2ca3b93e54da913b Author: Breno Leitao Date: Tue Aug 13 09:12:53 2024 -0700 i2c: tegra: Do not mark ACPI devices as irq safe On ACPI machines, the tegra i2c module encounters an issue due to a mutex being called inside a spinlock. This leads to the following bug: BUG: sleeping function called from invalid context at kernel/locking/mutex.c:585 ... Call trace: __might_sleep __mutex_lock_common mutex_lock_nested acpi_subsys_runtime_resume rpm_resume tegra_i2c_xfer The problem arises because during __pm_runtime_resume(), the spinlock &dev->power.lock is acquired before rpm_resume() is called. Later, rpm_resume() invokes acpi_subsys_runtime_resume(), which relies on mutexes, triggering the error. To address this issue, devices on ACPI are now marked as not IRQ-safe, considering the dependency of acpi_subsys_runtime_resume() on mutexes. Fixes: bd2fdedbf2ba ("i2c: tegra: Add the ACPI support") Cc: # v5.17+ Co-developed-by: Michael van der Westhuizen Signed-off-by: Michael van der Westhuizen Signed-off-by: Breno Leitao Reviewed-by: Dmitry Osipenko Reviewed-by: Andy Shevchenko Signed-off-by: Andi Shyti drivers/i2c/busses/i2c-tegra.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) commit bd662c4218f9648e888bebde9468146965f3f8a0 Author: Phil Sutter Date: Fri Aug 9 15:07:32 2024 +0200 netfilter: nf_tables: Add locking for NFT_MSG_GETOBJ_RESET requests Objects' dump callbacks are not concurrency-safe per-se with reset bit set. If two CPUs perform a reset at the same time, at least counter and quota objects suffer from value underrun. Prevent this by introducing dedicated locking callbacks for nfnetlink and the asynchronous dump handling to serialize access. Fixes: 43da04a593d8 ("netfilter: nf_tables: atomic dump and reset for stateful objects") Signed-off-by: Phil Sutter Reviewed-by: Florian Westphal Signed-off-by: Pablo Neira Ayuso net/netfilter/nf_tables_api.c | 72 +++++++++++++++++++++++++++++++++++-------- 1 file changed, 59 insertions(+), 13 deletions(-) commit 69fc3e9e90f1afc11f4015e6b75d18ab9acee348 Author: Phil Sutter Date: Fri Aug 9 15:07:31 2024 +0200 netfilter: nf_tables: Introduce nf_tables_getobj_single Outsource the reply skb preparation for non-dump getrule requests into a distinct function. Prep work for object reset locking. Signed-off-by: Phil Sutter Reviewed-by: Florian Westphal Signed-off-by: Pablo Neira Ayuso net/netfilter/nf_tables_api.c | 75 +++++++++++++++++++++++++------------------ 1 file changed, 44 insertions(+), 31 deletions(-) commit e0b6648b0446e59522819c75ba1dcb09e68d3e94 Author: Phil Sutter Date: Fri Aug 9 15:07:30 2024 +0200 netfilter: nf_tables: Audit log dump reset after the fact In theory, dumpreset may fail and invalidate the preceeding log message. Fix this and use the occasion to prepare for object reset locking, which benefits from a few unrelated changes: * Add an early call to nfnetlink_unicast if not resetting which effectively skips the audit logging but also unindents it. * Extract the table's name from the netlink attribute (which is verified via earlier table lookup) to not rely upon validity of the looked up table pointer. * Do not use local variable family, it will vanish. Fixes: 8e6cf365e1d5 ("audit: log nftables configuration change events") Signed-off-by: Phil Sutter Reviewed-by: Florian Westphal Signed-off-by: Pablo Neira Ayuso net/netfilter/nf_tables_api.c | 28 +++++++++++++--------------- 1 file changed, 13 insertions(+), 15 deletions(-) commit ea2306f0330c59ac8cd6ba13193497f0a6a02684 Author: Florian Westphal Date: Thu Aug 8 23:14:43 2024 +0200 selftests: netfilter: add test for br_netfilter+conntrack+queue combination Trigger cloned skbs leaving softirq protection. This triggers splat without the preceeding change ("netfilter: nf_queue: drop packets with cloned unconfirmed conntracks"): WARNING: at net/netfilter/nf_conntrack_core.c:1198 __nf_conntrack_confirm.. because local delivery and forwarding will race for confirmation. Based on a reproducer script from Yi Chen. Signed-off-by: Florian Westphal Signed-off-by: Pablo Neira Ayuso tools/testing/selftests/net/netfilter/Makefile | 1 + .../selftests/net/netfilter/br_netfilter_queue.sh | 78 ++++++++++++++++++++++ 2 files changed, 79 insertions(+) commit 7d8dc1c7be8d3509e8f5164dd5df64c8e34d7eeb Author: Florian Westphal Date: Wed Aug 7 21:28:41 2024 +0200 netfilter: nf_queue: drop packets with cloned unconfirmed conntracks Conntrack assumes an unconfirmed entry (not yet committed to global hash table) has a refcount of 1 and is not visible to other cores. With multicast forwarding this assumption breaks down because such skbs get cloned after being picked up, i.e. ct->use refcount is > 1. Likewise, bridge netfilter will clone broad/mutlicast frames and all frames in case they need to be flood-forwarded during learning phase. For ip multicast forwarding or plain bridge flood-forward this will "work" because packets don't leave softirq and are implicitly serialized. With nfqueue this no longer holds true, the packets get queued and can be reinjected in arbitrary ways. Disable this feature, I see no other solution. After this patch, nfqueue cannot queue packets except the last multicast/broadcast packet. Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Signed-off-by: Florian Westphal Signed-off-by: Pablo Neira Ayuso net/bridge/br_netfilter_hooks.c | 6 +++++- net/netfilter/nfnetlink_queue.c | 35 +++++++++++++++++++++++++++++++++-- 2 files changed, 38 insertions(+), 3 deletions(-) commit e9767137308daf906496613fd879808a07f006a2 Author: Donald Hunter Date: Tue Aug 6 17:16:37 2024 +0100 netfilter: flowtable: initialise extack before use Fix missing initialisation of extack in flow offload. Fixes: c29f74e0df7a ("netfilter: nf_flow_table: hardware offload support") Signed-off-by: Donald Hunter Reviewed-by: Simon Horman Signed-off-by: Pablo Neira Ayuso net/netfilter/nf_flow_table_offload.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit d1a7b382a9d3f0f3e5a80e0be2991c075fa4f618 Author: Donald Hunter Date: Tue Aug 6 16:43:24 2024 +0100 netfilter: nfnetlink: Initialise extack before use in ACKs Add missing extack initialisation when ACKing BATCH_BEGIN and BATCH_END. Fixes: bf2ac490d28c ("netfilter: nfnetlink: Handle ACK flags for batch messages") Signed-off-by: Donald Hunter Reviewed-by: Simon Horman Signed-off-by: Pablo Neira Ayuso net/netfilter/nfnetlink.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) commit ff9f065318e17a1a97981d9e535fcfc6ce5d5614 Author: YR Yang Date: Thu Aug 1 16:43:26 2024 +0800 ASoC: mediatek: mt8188: Mark AFE_DAC_CON0 register as volatile Add AFE Control Register 0 to the volatile_register. AFE_DAC_CON0 can be modified by both the SOF and ALSA drivers. If this register is read and written in cache mode, the cached value might not reflect the actual value when the register is modified by another driver. It can cause playback or capture failures. Therefore, it is necessary to add AFE_DAC_CON0 to the list of volatile registers. Signed-off-by: YR Yang Reviewed-by: Fei Shao Reviewed-by: Trevor Wu Link: https://patch.msgid.link/20240801084326.1472-1-yr.yang@mediatek.com Signed-off-by: Mark Brown sound/soc/mediatek/mt8188/mt8188-afe-pcm.c | 1 + 1 file changed, 1 insertion(+) commit d07b43284ab356daf7ec5ae1858a16c1c7b6adab Merge: 9d5906799f7d 1c0e5881691a Author: Linus Torvalds Date: Wed Aug 14 13:46:24 2024 -0700 Merge tag 'for-linus' of git://git.kernel.org/pub/scm/virt/kvm/kvm Pull kvm fixes from Paolo Bonzini: "s390: - Fix failure to start guests with kvm.use_gisa=0 - Panic if (un)share fails to maintain security. ARM: - Use kvfree() for the kvmalloc'd nested MMUs array - Set of fixes to address warnings in W=1 builds - Make KVM depend on assembler support for ARMv8.4 - Fix for vgic-debug interface for VMs without LPIs - Actually check ID_AA64MMFR3_EL1.S1PIE in get-reg-list selftest - Minor code / comment cleanups for configuring PAuth traps - Take kvm->arch.config_lock to prevent destruction / initialization race for a vCPU's CPUIF which may lead to a UAF x86: - Disallow read-only memslots for SEV-ES and SEV-SNP (and TDX) - Fix smatch issues - Small cleanups - Make x2APIC ID 100% readonly - Fix typo in uapi constant Generic: - Use synchronize_srcu_expedited() on irqfd shutdown" * tag 'for-linus' of git://git.kernel.org/pub/scm/virt/kvm/kvm: (21 commits) KVM: SEV: uapi: fix typo in SEV_RET_INVALID_CONFIG KVM: x86: Disallow read-only memslots for SEV-ES and SEV-SNP (and TDX) KVM: eventfd: Use synchronize_srcu_expedited() on shutdown KVM: selftests: Add a testcase to verify x2APIC is fully readonly KVM: x86: Make x2APIC ID 100% readonly KVM: x86: Use this_cpu_ptr() instead of per_cpu_ptr(smp_processor_id()) KVM: x86: hyper-v: Remove unused inline function kvm_hv_free_pa_page() KVM: SVM: Fix an error code in sev_gmem_post_populate() KVM: SVM: Fix uninitialized variable bug KVM: arm64: vgic: Hold config_lock while tearing down a CPU interface KVM: selftests: arm64: Correct feature test for S1PIE in get-reg-list KVM: arm64: Tidying up PAuth code in KVM KVM: arm64: vgic-debug: Exit the iterator properly w/o LPI KVM: arm64: Enforce dependency on an ARMv8.4-aware toolchain s390/uv: Panic for set and remove shared access UVC errors KVM: s390: fix validity interception issue when gisa is switched off docs: KVM: Fix register ID of SPSR_FIQ KVM: arm64: vgic: fix unexpected unlock sparse warnings KVM: arm64: fix kdoc warnings in W=1 builds KVM: arm64: fix override-init warnings in W=1 builds ... commit 1f5288874de776412041022607513ffac74ae1a6 Author: Evan Green Date: Fri Aug 9 14:44:44 2024 -0700 RISC-V: hwprobe: Add SCALAR to misaligned perf defines In preparation for misaligned vector performance hwprobe keys, rename the hwprobe key values associated with misaligned scalar accesses to include the term SCALAR. Leave the old defines in place to maintain source compatibility. This change is intended to be a functional no-op. Signed-off-by: Evan Green Reviewed-by: Charlie Jenkins Link: https://lore.kernel.org/r/20240809214444.3257596-3-evan@rivosinc.com Signed-off-by: Palmer Dabbelt Documentation/arch/riscv/hwprobe.rst | 28 +++++++++++++++------------- arch/riscv/include/uapi/asm/hwprobe.h | 5 +++++ arch/riscv/kernel/sys_hwprobe.c | 10 +++++----- arch/riscv/kernel/traps_misaligned.c | 6 +++--- arch/riscv/kernel/unaligned_access_speed.c | 12 ++++++------ 5 files changed, 34 insertions(+), 27 deletions(-) commit c42e2f076769c9c1bc5f3f0aa1c2032558e76647 Author: Evan Green Date: Fri Aug 9 14:44:43 2024 -0700 RISC-V: hwprobe: Add MISALIGNED_PERF key RISCV_HWPROBE_KEY_CPUPERF_0 was mistakenly flagged as a bitmask in hwprobe_key_is_bitmask(), when in reality it was an enum value. This causes problems when used in conjunction with RISCV_HWPROBE_WHICH_CPUS, since SLOW, FAST, and EMULATED have values whose bits overlap with each other. If the caller asked for the set of CPUs that was SLOW or EMULATED, the returned set would also include CPUs that were FAST. Introduce a new hwprobe key, RISCV_HWPROBE_KEY_MISALIGNED_PERF, which returns the same values in response to a direct query (with no flags), but is properly handled as an enumerated value. As a result, SLOW, FAST, and EMULATED are all correctly treated as distinct values under the new key when queried with the WHICH_CPUS flag. Leave the old key in place to avoid disturbing applications which may have already come to rely on the key, with or without its broken behavior with respect to the WHICH_CPUS flag. Fixes: e178bf146e4b ("RISC-V: hwprobe: Introduce which-cpus flag") Signed-off-by: Evan Green Reviewed-by: Charlie Jenkins Reviewed-by: Andrew Jones Link: https://lore.kernel.org/r/20240809214444.3257596-2-evan@rivosinc.com Signed-off-by: Palmer Dabbelt Documentation/arch/riscv/hwprobe.rst | 20 +++++++++++++------- arch/riscv/include/asm/hwprobe.h | 2 +- arch/riscv/include/uapi/asm/hwprobe.h | 1 + arch/riscv/kernel/sys_hwprobe.c | 1 + 4 files changed, 16 insertions(+), 8 deletions(-) commit a445699879f989f6700df81f497b70bf94cc6163 Author: Haibo Xu Date: Mon Aug 5 11:30:23 2024 +0800 RISC-V: ACPI: NUMA: initialize all values of acpi_early_node_map to NUMA_NO_NODE Currently, only acpi_early_node_map[0] was initialized to NUMA_NO_NODE. To ensure all the values were properly initialized, switch to initialize all of them to NUMA_NO_NODE. Fixes: eabd9db64ea8 ("ACPI: RISCV: Add NUMA support based on SRAT and SLIT") Reported-by: Andrew Jones Suggested-by: Andrew Jones Signed-off-by: Haibo Xu Reviewed-by: Sunil V L Reviewed-by: Andrew Jones Reviewed-by: Hanjun Guo Link: https://lore.kernel.org/r/0d362a8ae50558b95685da4c821b2ae9e8cf78be.1722828421.git.haibo1.xu@intel.com Signed-off-by: Palmer Dabbelt arch/riscv/kernel/acpi_numa.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 57d76bc51fd80824bcc0c84a5b5ec944f1b51edd Author: Nam Cao Date: Wed May 8 21:19:17 2024 +0200 riscv: change XIP's kernel_map.size to be size of the entire kernel With XIP kernel, kernel_map.size is set to be only the size of data part of the kernel. This is inconsistent with "normal" kernel, who sets it to be the size of the entire kernel. More importantly, XIP kernel fails to boot if CONFIG_DEBUG_VIRTUAL is enabled, because there are checks on virtual addresses with the assumption that kernel_map.size is the size of the entire kernel (these checks are in arch/riscv/mm/physaddr.c). Change XIP's kernel_map.size to be the size of the entire kernel. Signed-off-by: Nam Cao Cc: # v6.1+ Reviewed-by: Alexandre Ghiti Link: https://lore.kernel.org/r/20240508191917.2892064-1-namcao@linutronix.de Signed-off-by: Palmer Dabbelt arch/riscv/mm/init.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) commit 61119394631f219e23ce98bcc3eb993a64a8ea64 Author: Celeste Liu Date: Thu Jun 27 22:23:39 2024 +0800 riscv: entry: always initialize regs->a0 to -ENOSYS Otherwise when the tracer changes syscall number to -1, the kernel fails to initialize a0 with -ENOSYS and subsequently fails to return the error code of the failed syscall to userspace. For example, it will break strace syscall tampering. Fixes: 52449c17bdd1 ("riscv: entry: set a0 = -ENOSYS only when syscall != -1") Reported-by: "Dmitry V. Levin" Reviewed-by: Björn Töpel Cc: stable@vger.kernel.org Signed-off-by: Celeste Liu Link: https://lore.kernel.org/r/20240627142338.5114-2-CoelacanthusHex@gmail.com Signed-off-by: Palmer Dabbelt arch/riscv/kernel/traps.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) commit 3cd740b985963f874a1a094f1969e998b9d05554 Author: Tom Hughes Date: Tue Aug 6 12:40:52 2024 +0100 netfilter: allow ipv6 fragments to arrive on different devices Commit 264640fc2c5f4 ("ipv6: distinguish frag queues by device for multicast and link-local packets") modified the ipv6 fragment reassembly logic to distinguish frag queues by device for multicast and link-local packets but in fact only the main reassembly code limits the use of the device to those address types and the netfilter reassembly code uses the device for all packets. This means that if fragments of a packet arrive on different interfaces then netfilter will fail to reassemble them and the fragments will be expired without going any further through the filters. Fixes: 648700f76b03 ("inet: frags: use rhashtables for reassembly units") Signed-off-by: Tom Hughes Signed-off-by: Pablo Neira Ayuso net/ipv6/netfilter/nf_conntrack_reasm.c | 4 ++++ 1 file changed, 4 insertions(+) commit 2848ff28d180bd63a95da8e5dcbcdd76c1beeb7b Author: Mitchell Levy Date: Mon Aug 12 13:44:12 2024 -0700 x86/fpu: Avoid writing LBR bit to IA32_XSS unless supported There are two distinct CPU features related to the use of XSAVES and LBR: whether LBR is itself supported and whether XSAVES supports LBR. The LBR subsystem correctly checks both in intel_pmu_arch_lbr_init(), but the XSTATE subsystem does not. The LBR bit is only removed from xfeatures_mask_independent when LBR is not supported by the CPU, but there is no validation of XSTATE support. If XSAVES does not support LBR the write to IA32_XSS causes a #GP fault, leaving the state of IA32_XSS unchanged, i.e. zero. The fault is handled with a warning and the boot continues. Consequently the next XRSTORS which tries to restore supervisor state fails with #GP because the RFBM has zero for all supervisor features, which does not match the XCOMP_BV field. As XFEATURE_MASK_FPSTATE includes supervisor features setting up the FPU causes a #GP, which ends up in fpu_reset_from_exception_fixup(). That fails due to the same problem resulting in recursive #GPs until the kernel runs out of stack space and double faults. Prevent this by storing the supported independent features in fpu_kernel_cfg during XSTATE initialization and use that cached value for retrieving the independent feature bits to be written into IA32_XSS. [ tglx: Massaged change log ] Fixes: f0dccc9da4c0 ("x86/fpu/xstate: Support dynamic supervisor feature for LBR") Suggested-by: Thomas Gleixner Signed-off-by: Mitchell Levy Signed-off-by: Thomas Gleixner Cc: stable@vger.kernel.org Link: https://lore.kernel.org/all/20240812-xsave-lbr-fix-v3-1-95bac1bf62f4@gmail.com arch/x86/include/asm/fpu/types.h | 7 +++++++ arch/x86/kernel/fpu/xstate.c | 3 +++ arch/x86/kernel/fpu/xstate.h | 4 ++-- 3 files changed, 12 insertions(+), 2 deletions(-) commit 71833e79a42178d8a50b5081c98c78ace9325628 Author: Richard Fitzgerald Date: Wed Aug 14 13:16:49 2024 +0100 i2c: Use IS_REACHABLE() for substituting empty ACPI functions Replace IS_ENABLED() with IS_REACHABLE() to substitute empty stubs for: i2c_acpi_get_i2c_resource() i2c_acpi_client_count() i2c_acpi_find_bus_speed() i2c_acpi_new_device_by_fwnode() i2c_adapter *i2c_acpi_find_adapter_by_handle() i2c_acpi_waive_d0_probe() commit f17c06c6608a ("i2c: Fix conditional for substituting empty ACPI functions") partially fixed this conditional to depend on CONFIG_I2C, but used IS_ENABLED(), which is wrong since CONFIG_I2C is tristate. CONFIG_ACPI is boolean but let's also change it to use IS_REACHABLE() to future-proof it against becoming tristate. Somehow despite testing various combinations of CONFIG_I2C and CONFIG_ACPI we missed the combination CONFIG_I2C=m, CONFIG_ACPI=y. Signed-off-by: Richard Fitzgerald Fixes: f17c06c6608a ("i2c: Fix conditional for substituting empty ACPI functions") Reported-by: kernel test robot Closes: https://lore.kernel.org/oe-kbuild-all/202408141333.gYnaitcV-lkp@intel.com/ Reviewed-by: Takashi Iwai Signed-off-by: Wolfram Sang include/linux/i2c.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 57d5af2660e9443b081eeaf1c373b3ce48477828 Author: Vignesh Raghavendra Date: Wed Aug 14 20:42:37 2024 +0530 spi: spi-cadence-quadspi: Fix OSPI NOR failures during system resume Its necessary to call pm_runtime_force_*() hooks as part of system suspend/resume calls so that the runtime_pm hooks get called. This ensures latest state of the IP is cached and restored during system sleep. This is especially true if runtime autosuspend is enabled as runtime suspend hooks may not be called at all before system sleeps. Without this patch, OSPI NOR enumeration (READ_ID) fails during resume as context saved during suspend path is inconsistent. Fixes: 078d62de433b ("spi: cadence-qspi: add system-wide suspend and resume callbacks") Signed-off-by: Vignesh Raghavendra Link: https://patch.msgid.link/20240814151237.3856184-1-vigneshr@ti.com Signed-off-by: Mark Brown drivers/spi/spi-cadence-quadspi.c | 14 +++++++++++++- 1 file changed, 13 insertions(+), 1 deletion(-) commit 2251db28edcc70b7ee8a8c6bcbaecf752b3ea5ec Author: Krzysztof Kozlowski Date: Tue Aug 6 13:49:13 2024 +0200 ASoC: codecs: wcd937x: Fix missing de-assert of reset GPIO The device never comes online from a reset/shutdown state, because the driver de-asserts reset GPIO when requesting it but then, at the end of probe() through wcd937x_reset(), leaves it asserted. Cc: stable@vger.kernel.org Fixes: 9be3ec196da4 ("ASoC: codecs: wcd937x: add wcd937x codec driver") Signed-off-by: Krzysztof Kozlowski Link: https://patch.msgid.link/20240806114913.40022-1-krzysztof.kozlowski@linaro.org Signed-off-by: Mark Brown sound/soc/codecs/wcd937x.c | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-) commit 1c0e5881691a787a9399a99bff4d56ead6e75e91 Author: Amit Shah Date: Wed Aug 14 10:31:13 2024 +0200 KVM: SEV: uapi: fix typo in SEV_RET_INVALID_CONFIG "INVALID" is misspelt in "SEV_RET_INAVLID_CONFIG". Since this is part of the UAPI, keep the current definition and add a new one with the fix. Fix-suggested-by: Marc Zyngier Signed-off-by: Amit Shah Message-ID: <20240814083113.21622-1-amit@kernel.org> Signed-off-by: Paolo Bonzini include/uapi/linux/psp-sev.h | 1 + 1 file changed, 1 insertion(+) commit a21dcf0ea8566ebbe011c79d6ed08cdfea771de3 Author: Haibo Xu Date: Mon Aug 5 11:30:24 2024 +0800 arm64: ACPI: NUMA: initialize all values of acpi_early_node_map to NUMA_NO_NODE Currently, only acpi_early_node_map[0] was initialized to NUMA_NO_NODE. To ensure all the values were properly initialized, switch to initialize all of them to NUMA_NO_NODE. Fixes: e18962491696 ("arm64: numa: rework ACPI NUMA initialization") Cc: # 4.19.x Reported-by: Andrew Jones Suggested-by: Andrew Jones Signed-off-by: Haibo Xu Reviewed-by: Anshuman Khandual Reviewed-by: Sunil V L Reviewed-by: Andrew Jones Acked-by: Catalin Marinas Acked-by: Lorenzo Pieralisi Reviewed-by: Hanjun Guo Link: https://lore.kernel.org/r/853d7f74aa243f6f5999e203246f0d1ae92d2b61.1722828421.git.haibo1.xu@intel.com Signed-off-by: Catalin Marinas arch/arm64/kernel/acpi_numa.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit f94511df53bb792e505c98662971434c7995388a Author: Mark Rutland Date: Wed Aug 7 11:37:31 2024 +0100 arm64: uaccess: correct thinko in __get_mem_asm() In the CONFIG_CC_HAS_ASM_GOTO_OUTPUT=y version of __get_mem_asm(), we incorrectly use _ASM_EXTABLE_##type##ACCESS_ERR() such that upon a fault the extable fixup handler writes -EFAULT into "%w0", which is the register containing 'x' (the result of the load). This was a thinko in commit: 86a6a68febfcf57b ("arm64: start using 'asm goto' for get_user() when available") Prior to that commit _ASM_EXTABLE_##type##ACCESS_ERR_ZERO() was used such that the extable fixup handler wrote -EFAULT into "%w0" (the register containing 'err'), and zero into "%w1" (the register containing 'x'). When the 'err' variable was removed, the extable entry was updated incorrectly. Writing -EFAULT to the value register is unnecessary but benign: * We never want -EFAULT in the value register, and previously this would have been zeroed in the extable fixup handler. * In __get_user_error() the value is overwritten with zero explicitly in the error path. * The asm goto outputs cannot be used when the goto label is taken, as older compilers (e.g. clang < 16.0.0) do not guarantee that asm goto outputs are usable in this path and may use a stale value rather than the value in an output register. Consequently, zeroing in the extable fixup handler is insufficient to ensure callers see zero in the error path. * The expected usage of unsafe_get_user() and get_kernel_nofault() requires that the value is not consumed in the error path. Some versions of GCC would mis-compile asm goto with outputs, and erroneously omit subsequent assignments, breaking the error path handling in __get_user_error(). This was discussed at: https://lore.kernel.org/lkml/ZpfxLrJAOF2YNqCk@J2N7QTR9R3.cambridge.arm.com/ ... and was fixed by removing support for asm goto with outputs on those broken compilers in commit: f2f6a8e887172503 ("init/Kconfig: remove CONFIG_GCC_ASM_GOTO_OUTPUT_WORKAROUND") With that out of the way, we can safely replace the usage of _ASM_EXTABLE_##type##ACCESS_ERR() with _ASM_EXTABLE_##type##ACCESS(), leaving the value register unchanged in the case a fault is taken, as was originally intended. This matches other architectures and matches our __put_mem_asm(). Signed-off-by: Mark Rutland Cc: Will Deacon Link: https://lore.kernel.org/r/20240807103731.2498893-1-mark.rutland@arm.com Signed-off-by: Catalin Marinas arch/arm64/include/asm/uaccess.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 66155de93bcf4f2967e602a4b3bf7ebe58f34b11 Author: Sean Christopherson Date: Fri Aug 9 12:02:58 2024 -0700 KVM: x86: Disallow read-only memslots for SEV-ES and SEV-SNP (and TDX) Disallow read-only memslots for SEV-{ES,SNP} VM types, as KVM can't directly emulate instructions for ES/SNP, and instead the guest must explicitly request emulation. Unless the guest explicitly requests emulation without accessing memory, ES/SNP relies on KVM creating an MMIO SPTE, with the subsequent #NPF being reflected into the guest as a #VC. But for read-only memslots, KVM deliberately doesn't create MMIO SPTEs, because except for ES/SNP, doing so requires setting reserved bits in the SPTE, i.e. the SPTE can't be readable while also generating a #VC on writes. Because KVM never creates MMIO SPTEs and jumps directly to emulation, the guest never gets a #VC. And since KVM simply resumes the guest if ES/SNP guests trigger emulation, KVM effectively puts the vCPU into an infinite #NPF loop if the vCPU attempts to write read-only memory. Disallow read-only memory for all VMs with protected state, i.e. for upcoming TDX VMs as well as ES/SNP VMs. For TDX, it's actually possible to support read-only memory, as TDX uses EPT Violation #VE to reflect the fault into the guest, e.g. KVM could configure read-only SPTEs with RX protections and SUPPRESS_VE=0. But there is no strong use case for supporting read-only memslots on TDX, e.g. the main historical usage is to emulate option ROMs, but TDX disallows executing from shared memory. And if someone comes along with a legitimate, strong use case, the restriction can always be lifted for TDX. Don't bother trying to retroactively apply the restriction to SEV-ES VMs that are created as type KVM_X86_DEFAULT_VM. Read-only memslots can't possibly work for SEV-ES, i.e. disallowing such memslots is really just means reporting an error to userspace instead of silently hanging vCPUs. Trying to deal with the ordering between KVM_SEV_INIT and memslot creation isn't worth the marginal benefit it would provide userspace. Fixes: 26c44aa9e076 ("KVM: SEV: define VM types for SEV and SEV-ES") Fixes: 1dfe571c12cf ("KVM: SEV: Add initial SEV-SNP support") Cc: Peter Gonda Cc: Michael Roth Cc: Vishal Annapurve Cc: Ackerly Tng Signed-off-by: Sean Christopherson Message-ID: <20240809190319.1710470-2-seanjc@google.com> Signed-off-by: Paolo Bonzini arch/x86/include/asm/kvm_host.h | 2 ++ include/linux/kvm_host.h | 7 +++++++ virt/kvm/kvm_main.c | 5 ++--- 3 files changed, 11 insertions(+), 3 deletions(-) commit 9d5906799f7d89c9e12f6d2e0fccb00713c945ab Merge: 4ac0f08f44b6 05a3d6e93072 Author: Linus Torvalds Date: Wed Aug 14 09:23:20 2024 -0700 Merge tag 'selinux-pr-20240814' of git://git.kernel.org/pub/scm/linux/kernel/git/pcmoore/selinux Pull selinux fixes from Paul Moore: - Fix a xperms counting problem where we adding to the xperms count even if we failed to add the xperm. - Propogate errors from avc_add_xperms_decision() back to the caller so that we can trigger the proper cleanup and error handling. - Revert our use of vma_is_initial_heap() in favor of our older logic as vma_is_initial_heap() doesn't correctly handle the no-heap case and it is causing issues with the SELinux process/execheap access control. While the older SELinux logic may not be perfect, it restores the expected user visible behavior. Hopefully we will be able to resolve the problem with the vma_is_initial_heap() macro with the mm folks, but we need to fix this in the meantime. * tag 'selinux-pr-20240814' of git://git.kernel.org/pub/scm/linux/kernel/git/pcmoore/selinux: selinux: revert our use of vma_is_initial_heap() selinux: add the processing of the failure of avc_add_xperms_decision() selinux: fix potential counting error in avc_add_xperms_decision() commit 4ac0f08f44b62e59a389c7ed87c89087d9fefe29 Merge: 02f8ca3d4905 810ee43d9cd2 Author: Linus Torvalds Date: Wed Aug 14 09:06:28 2024 -0700 Merge tag 'vfs-6.11-rc4.fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs Pull vfs fixes from Christian Brauner: "VFS: - Fix the name of file lease slab cache. When file leases were split out of file locks the name of the file lock slab cache was used for the file leases slab cache as well. - Fix a type in take_fd() helper. - Fix infinite directory iteration for stable offsets in tmpfs. - When the icache is pruned all reclaimable inodes are marked with I_FREEING and other processes that try to lookup such inodes will block. But some filesystems like ext4 can trigger lookups in their inode evict callback causing deadlocks. Ext4 does such lookups if the ea_inode feature is used whereby a separate inode may be used to store xattrs. Introduce I_LRU_ISOLATING which pins the inode while its pages are reclaimed. This avoids inode deletion during inode_lru_isolate() avoiding the deadlock and evict is made to wait until I_LRU_ISOLATING is done. netfs: - Fault in smaller chunks for non-large folio mappings for filesystems that haven't been converted to large folios yet. - Fix the CONFIG_NETFS_DEBUG config option. The config option was renamed a short while ago and that introduced two minor issues. First, it depended on CONFIG_NETFS whereas it wants to depend on CONFIG_NETFS_SUPPORT. The former doesn't exist, while the latter does. Second, the documentation for the config option wasn't fixed up. - Revert the removal of the PG_private_2 writeback flag as ceph is using it and fix how that flag is handled in netfs. - Fix DIO reads on 9p. A program watching a file on a 9p mount wouldn't see any changes in the size of the file being exported by the server if the file was changed directly in the source filesystem. Fix this by attempting to read the full size specified when a DIO read is requested. - Fix a NULL pointer dereference bug due to a data race where a cachefiles cookies was retired even though it was still in use. Check the cookie's n_accesses counter before discarding it. nsfs: - Fix ioctl declaration for NS_GET_MNTNS_ID from _IO() to _IOR() as the kernel is writing to userspace. pidfs: - Prevent the creation of pidfds for kthreads until we have a use-case for it and we know the semantics we want. It also confuses userspace why they can get pidfds for kthreads. squashfs: - Fix an unitialized value bug reported by KMSAN caused by a corrupted symbolic link size read from disk. Check that the symbolic link size is not larger than expected" * tag 'vfs-6.11-rc4.fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs: Squashfs: sanity check symbolic link size 9p: Fix DIO read through netfs vfs: Don't evict inode under the inode lru traversing context netfs: Fix handling of USE_PGPRIV2 and WRITE_TO_CACHE flags netfs, ceph: Revert "netfs: Remove deprecated use of PG_private_2 as a second writeback flag" file: fix typo in take_fd() comment pidfd: prevent creation of pidfds for kthreads netfs: clean up after renaming FSCACHE_DEBUG config libfs: fix infinite directory reads for offset dir nsfs: fix ioctl declaration fs/netfs/fscache_cookie: add missing "n_accesses" check filelock: fix name of file_lease slab cache netfs: Fault in smaller chunks for non-large folio mappings commit 02f8ca3d49055788f112c17052a3da65feb01835 Merge: 6b0f8db921ab 100bff23818e Author: Linus Torvalds Date: Wed Aug 14 08:57:24 2024 -0700 Merge tag 'bpf-6.11-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf Pull bpf fixes from Alexei Starovoitov: - Fix bpftrace regression from Kyle Huey. Tracing bpf prog was called with perf_event input arguments causing bpftrace produce garbage output. - Fix verifier crash in stacksafe() from Yonghong Song. Daniel Hodges reported verifier crash when playing with sched-ext. The stack depth in the known verifier state was larger than stack depth in being explored state causing out-of-bounds access. - Fix update of freplace prog in prog_array from Leon Hwang. freplace prog type wasn't recognized correctly. * tag 'bpf-6.11-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf: perf/bpf: Don't call bpf_overflow_handler() for tracing events selftests/bpf: Add a test to verify previous stacksafe() fix bpf: Fix a kernel verifier crash in stacksafe() bpf: Fix updating attached freplace prog in prog_array map commit 8d16762047c627073955b7ed171a36addaf7b1ff Author: Darrick J. Wong Date: Sun Aug 4 14:39:57 2024 -0700 xfs: conditionally allow FS_XFLAG_REALTIME changes if S_DAX is set If a file has the S_DAX flag (aka fsdax access mode) set, we cannot allow users to change the realtime flag unless the datadev and rtdev both support fsdax access modes. Even if there are no extents allocated to the file, the setattr thread could be racing with another thread that has already started down the write code paths. Fixes: ba23cba9b3bdc ("fs: allow per-device dax status checking for filesystems") Signed-off-by: Darrick J. Wong Reviewed-by: Christoph Hellwig Signed-off-by: Chandan Babu R fs/xfs/xfs_ioctl.c | 11 +++++++++++ 1 file changed, 11 insertions(+) commit 04d6dbb55301a29aeb9a197e6b0012cdc265f1e4 Author: Darrick J. Wong Date: Sun Aug 4 14:39:34 2024 -0700 xfs: revert AIL TASK_KILLABLE threshold In commit 9adf40249e6c, we changed the behavior of the AIL thread to set its own task state to KILLABLE whenever the timeout value is nonzero. Unfortunately, this missed the fact that xfsaild_push will return 50ms (aka a longish sleep) when we reach the push target or the AIL becomes empty, so xfsaild goes to sleep for a long period of time in uninterruptible D state. This results in artificially high load averages because KILLABLE processes are UNINTERRUPTIBLE, which contributes to load average even though the AIL is asleep waiting for someone to interrupt it. It's not blocked on IOs or anything, but people scrap ps for processes that look like they're stuck in D state, so restore the previous threshold. Fixes: 9adf40249e6c ("xfs: AIL doesn't need manual pushing") Signed-off-by: Darrick J. Wong Reviewed-by: Christoph Hellwig Signed-off-by: Chandan Babu R fs/xfs/xfs_trans_ail.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) commit 73c34b0b85d46bf9c2c0b367aeaffa1e2481b136 Author: Darrick J. Wong Date: Mon Jul 29 13:44:33 2024 -0700 xfs: attr forks require attr, not attr2 It turns out that I misunderstood the difference between the attr and attr2 feature bits. "attr" means that at some point an attr fork was created somewhere in the filesystem. "attr2" means that inodes have variable-sized forks, but says nothing about whether or not there actually /are/ attr forks in the system. If we have an attr fork, we only need to check that attr is set. Fixes: 99d9d8d05da26 ("xfs: scrub inode block mappings") Signed-off-by: Darrick J. Wong Reviewed-by: Christoph Hellwig Signed-off-by: Chandan Babu R fs/xfs/scrub/bmap.c | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-) commit 829e2a23121fb36ee30ea5145c2a85199f68e2c8 Author: Takashi Iwai Date: Wed Aug 14 12:04:59 2024 +0200 ALSA: hda/tas2781: Use correct endian conversion The data conversion is done rather by a wrong function. We convert to BE32, not from BE32. Although the end result must be same, this was complained by the compiler. Fix the code again and align with another similar function tas2563_apply_calib() that does already right. Fixes: 3beddef84d90 ("ALSA: hda/tas2781: fix wrong calibrated data order") Reported-by: kernel test robot Closes: https://lore.kernel.org/oe-kbuild-all/202408141630.DiDUB8Z4-lkp@intel.com/ Link: https://patch.msgid.link/20240814100500.1944-1-tiwai@suse.de Signed-off-by: Takashi Iwai sound/pci/hda/tas2781_hda_i2c.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) commit fa0db8e568787c665384430eaf2221b299b85367 Author: Niklas Cassel Date: Tue Aug 13 15:19:01 2024 +0200 Revert "ata: libata-scsi: Honor the D_SENSE bit for CK_COND=1 and no error" This reverts commit 28ab9769117ca944cb6eb537af5599aa436287a4. Sense data can be in either fixed format or descriptor format. SAT-6 revision 1, "10.4.6 Control mode page", defines the D_SENSE bit: "The SATL shall support this bit as defined in SPC-5 with the following exception: if the D_ SENSE bit is set to zero (i.e., fixed format sense data), then the SATL should return fixed format sense data for ATA PASS-THROUGH commands." The libata SATL has always kept D_SENSE set to zero by default. (It is however possible to change the value using a MODE SELECT SG_IO command.) Failed ATA PASS-THROUGH commands correctly respected the D_SENSE bit, however, successful ATA PASS-THROUGH commands incorrectly returned the sense data in descriptor format (regardless of the D_SENSE bit). Commit 28ab9769117c ("ata: libata-scsi: Honor the D_SENSE bit for CK_COND=1 and no error") fixed this bug for successful ATA PASS-THROUGH commands. However, after commit 28ab9769117c ("ata: libata-scsi: Honor the D_SENSE bit for CK_COND=1 and no error"), there were bug reports that hdparm, hddtemp, and udisks were no longer working as expected. These applications incorrectly assume the returned sense data is in descriptor format, without even looking at the RESPONSE CODE field in the returned sense data (to see which format the returned sense data is in). Considering that there will be broken versions of these applications around roughly forever, we are stuck with being bug compatible with older kernels. Cc: stable@vger.kernel.org # 4.19+ Reported-by: Stephan Eisvogel Reported-by: Christian Heusel Closes: https://lore.kernel.org/linux-ide/0bf3f2f0-0fc6-4ba5-a420-c0874ef82d64@heusel.eu/ Fixes: 28ab9769117c ("ata: libata-scsi: Honor the D_SENSE bit for CK_COND=1 and no error") Reviewed-by: Hannes Reinecke Reviewed-by: Martin K. Petersen Link: https://lore.kernel.org/r/20240813131900.1285842-2-cassel@kernel.org Signed-off-by: Niklas Cassel drivers/ata/libata-scsi.c | 15 +++++++++++++-- 1 file changed, 13 insertions(+), 2 deletions(-) commit c286f204ce6ba7b48e3dcba53eda7df8eaa64dd9 Author: Juan José Arboleda Date: Tue Aug 13 11:10:53 2024 -0500 ALSA: usb-audio: Support Yamaha P-125 quirk entry This patch adds a USB quirk for the Yamaha P-125 digital piano. Signed-off-by: Juan José Arboleda Cc: Link: https://patch.msgid.link/20240813161053.70256-1-soyjuanarbol@gmail.com Signed-off-by: Takashi Iwai sound/usb/quirks-table.h | 1 + 1 file changed, 1 insertion(+) commit a2cbb1603943281a604f5adc48079a148db5cb0d Author: Subash Abhinov Kasiviswanathan Date: Thu Aug 8 16:06:40 2024 -0700 tcp: Update window clamping condition This patch is based on the discussions between Neal Cardwell and Eric Dumazet in the link https://lore.kernel.org/netdev/20240726204105.1466841-1-quic_subashab@quicinc.com/ It was correctly pointed out that tp->window_clamp would not be updated in cases where net.ipv4.tcp_moderate_rcvbuf=0 or if (copied <= tp->rcvq_space.space). While it is expected for most setups to leave the sysctl enabled, the latter condition may not end up hitting depending on the TCP receive queue size and the pattern of arriving data. The updated check should be hit only on initial MSS update from TCP_MIN_MSS to measured MSS value and subsequently if there was an update to a larger value. Fixes: 05f76b2d634e ("tcp: Adjust clamping window for applications specifying SO_RCVBUF") Signed-off-by: Sean Tranchetti Signed-off-by: Subash Abhinov Kasiviswanathan Acked-by: Neal Cardwell Signed-off-by: David S. Miller net/ipv4/tcp_input.c | 28 ++++++++++++---------------- 1 file changed, 12 insertions(+), 16 deletions(-) commit 63de936b513f7a9ce559194d3269ac291f4f4662 Author: Hans de Goede Date: Sun Jul 21 17:38:40 2024 +0200 media: atomisp: Fix streaming no longer working on BYT / ISP2400 devices Commit a0821ca14bb8 ("media: atomisp: Remove test pattern generator (TPG) support") broke BYT support because it removed a seemingly unused field from struct sh_css_sp_config and a seemingly unused value from enum ia_css_input_mode. But these are part of the ABI between the kernel and firmware on ISP2400 and this part of the TPG support removal changes broke ISP2400 support. ISP2401 support was not affected because on ISP2401 only a part of struct sh_css_sp_config is used. Restore the removed field and enum value to fix this. Fixes: a0821ca14bb8 ("media: atomisp: Remove test pattern generator (TPG) support") Cc: stable@vger.kernel.org Signed-off-by: Hans de Goede Signed-off-by: Hans Verkuil .../staging/media/atomisp/pci/ia_css_stream_public.h | 8 ++++++-- drivers/staging/media/atomisp/pci/sh_css_internal.h | 19 ++++++++++++++++--- 2 files changed, 22 insertions(+), 5 deletions(-) commit 58474f76a770bcc79d4b2d7232e4d6650e732b50 Author: Kent Overstreet Date: Mon Aug 12 02:27:36 2024 -0400 bcachefs: bcachefs_metadata_version_disk_accounting_inum This adds another disk accounting counter to track usage per inode number (any snapshot ID). This will be used for a couple things: - It'll give us a way to tell the user how much space a given file ista consuming in all snapshots; i.e. how much extra space it's consuming due to snapshot versioning. - It counts number of extents and total size of extents (both in btree keyspace sectors and actual disk usage), meaning it gives us average extent size: that is, it'll let us cheaply find fragmented files that should be defragmented. Signed-off-by: Kent Overstreet fs/bcachefs/bcachefs_format.h | 3 ++- fs/bcachefs/buckets.c | 14 ++++++++++++++ fs/bcachefs/disk_accounting.c | 3 +++ fs/bcachefs/disk_accounting.h | 3 +++ fs/bcachefs/disk_accounting_format.h | 8 +++++++- fs/bcachefs/sb-downgrade.c | 5 ++++- 6 files changed, 33 insertions(+), 3 deletions(-) commit 5132b99bb62664c02bd6c0dd62ad3fedc75294d8 Author: Kent Overstreet Date: Mon Aug 12 02:35:10 2024 -0400 bcachefs: Kill __bch2_accounting_mem_mod() The next patch will be adding a disk accounting counter type which is not kept in the in-memory eytzinger tree. As prep, fold __bch2_accounting_mem_mod() into bch2_accounting_mem_mod_locked() so that we can check for that counter type and bail out without calling bpos_to_disk_accounting_pos() twice. Signed-off-by: Kent Overstreet fs/bcachefs/btree_trans_commit.c | 4 +-- fs/bcachefs/disk_accounting.c | 4 +-- fs/bcachefs/disk_accounting.h | 54 ++++++++++++++++++---------------------- 3 files changed, 28 insertions(+), 34 deletions(-) commit d97de0d017cde0d442c3d144b4f969f43064cc0f Author: Kent Overstreet Date: Mon Aug 12 21:31:25 2024 -0400 bcachefs: Make bkey_fsck_err() a wrapper around fsck_err() bkey_fsck_err() was added as an interface that looks like fsck_err(), but previously all it did was ensure that the appropriate error counter was incremented in the superblock. This is a cleanup and bugfix patch that converts it to a wrapper around fsck_err(). This is needed to fix an issue with the upgrade path to disk_accounting_v3, where the "silent fix" error list now includes bkey_fsck errors; fsck_err() handles this in a unified way, and since we need to change printing of bkey fsck errors from the caller to the inner bkey_fsck_err() calls, this ends up being a pretty big change. Als,, rename .invalid() methods to .validate(), for clarity, while we're changing the function signature anyways (to drop the printbuf argument). Signed-off-by: Kent Overstreet fs/bcachefs/alloc_background.c | 63 ++++++++-------- fs/bcachefs/alloc_background.h | 26 +++---- fs/bcachefs/backpointers.c | 8 +- fs/bcachefs/backpointers.h | 5 +- fs/bcachefs/bkey.h | 7 +- fs/bcachefs/bkey_methods.c | 109 +++++++++++++-------------- fs/bcachefs/bkey_methods.h | 21 +++--- fs/bcachefs/btree_io.c | 67 +++++------------ fs/bcachefs/btree_node_scan.c | 2 +- fs/bcachefs/btree_trans_commit.c | 72 ++++-------------- fs/bcachefs/btree_update_interior.c | 16 +--- fs/bcachefs/data_update.c | 6 +- fs/bcachefs/dirent.c | 33 ++++----- fs/bcachefs/dirent.h | 5 +- fs/bcachefs/disk_accounting.c | 13 ++-- fs/bcachefs/disk_accounting.h | 5 +- fs/bcachefs/ec.c | 15 ++-- fs/bcachefs/ec.h | 5 +- fs/bcachefs/errcode.h | 1 + fs/bcachefs/error.c | 22 ++++++ fs/bcachefs/error.h | 39 ++++++---- fs/bcachefs/extents.c | 144 ++++++++++++++++++------------------ fs/bcachefs/extents.h | 24 +++--- fs/bcachefs/inode.c | 77 +++++++++---------- fs/bcachefs/inode.h | 24 +++--- fs/bcachefs/journal_io.c | 24 ++---- fs/bcachefs/lru.c | 9 +-- fs/bcachefs/lru.h | 5 +- fs/bcachefs/quota.c | 8 +- fs/bcachefs/quota.h | 5 +- fs/bcachefs/reflink.c | 19 ++--- fs/bcachefs/reflink.h | 22 +++--- fs/bcachefs/snapshot.c | 42 +++++------ fs/bcachefs/snapshot.h | 11 ++- fs/bcachefs/subvolume.c | 16 ++-- fs/bcachefs/subvolume.h | 5 +- fs/bcachefs/xattr.c | 21 +++--- fs/bcachefs/xattr.h | 5 +- 38 files changed, 448 insertions(+), 553 deletions(-) commit c99471024f24b3cbafc02bf5b112ecf34b0dbd40 Author: Kent Overstreet Date: Mon Aug 12 23:29:46 2024 -0400 bcachefs: Fix warning in __bch2_fsck_err() for trans not passed in Signed-off-by: Kent Overstreet fs/bcachefs/btree_io.c | 2 ++ 1 file changed, 2 insertions(+) commit 06a8693b890c0cf7d94bf7c6f0e2adf3a3aaa346 Author: Kent Overstreet Date: Sat Aug 10 15:48:18 2024 -0400 bcachefs: Add a time_stat for blocked on key cache flush Signed-off-by: Kent Overstreet fs/bcachefs/bcachefs.h | 1 + fs/bcachefs/btree_trans_commit.c | 4 ++++ 2 files changed, 5 insertions(+) commit 790666c8ac6427ddaa00f502dc44073c1e039355 Author: Kent Overstreet Date: Sat Aug 10 14:31:17 2024 -0400 bcachefs: Improve trans_blocked_journal_reclaim tracepoint include information about the state of the btree key cache Signed-off-by: Kent Overstreet fs/bcachefs/btree_key_cache.h | 9 +++++++-- fs/bcachefs/trace.c | 1 + fs/bcachefs/trace.h | 27 +++++++++++++++++++++++++-- 3 files changed, 33 insertions(+), 4 deletions(-) commit 7254555c440ff6b136aa97fb3c33fd5e0bb4fb9f Author: Kent Overstreet Date: Sat Aug 10 14:40:09 2024 -0400 bcachefs: Add hysteresis to waiting on btree key cache flush This helps ensure key cache reclaim isn't contending with threads waiting for the key cache to be helped, and fixes a severe performance bug. Signed-off-by: Kent Overstreet fs/bcachefs/btree_key_cache.h | 9 +++++++++ fs/bcachefs/btree_trans_commit.c | 2 +- 2 files changed, 10 insertions(+), 1 deletion(-) commit b2f11c6f3e1fc60742673b8675c95b78447f3dae Author: Kent Overstreet Date: Sat Aug 10 21:04:35 2024 -0400 lib/generic-radix-tree.c: Fix rare race in __genradix_ptr_alloc() If we need to increase the tree depth, allocate a new node, and then race with another thread that increased the tree depth before us, we'll still have a preallocated node that might be used later. If we then use that node for a new non-root node, it'll still have a pointer to the old root instead of being zeroed - fix this by zeroing it in the cmpxchg failure path. Signed-off-by: Kent Overstreet lib/generic-radix-tree.c | 2 ++ 1 file changed, 2 insertions(+) commit 968feb854a86b59cc4bc72af3105989706ca2c7d Author: Kent Overstreet Date: Wed Aug 7 16:34:28 2024 -0400 bcachefs: Convert for_each_btree_node() to lockrestart_do() for_each_btree_node() now works similarly to for_each_btree_key(), where the loop body is passed as an argument to be passed to lockrestart_do(). This now calls trans_begin() on every loop iteration - which fixes an SRCU warning in backpointers fsck. Signed-off-by: Kent Overstreet fs/bcachefs/backpointers.c | 15 +++++---------- fs/bcachefs/btree_iter.c | 1 + fs/bcachefs/btree_iter.h | 42 +++++++++++++++++++++++++++--------------- fs/bcachefs/debug.c | 38 +++++++++----------------------------- 4 files changed, 42 insertions(+), 54 deletions(-) commit 48d6cc1b4895ada0781da11a0a483332a236ec14 Author: Kent Overstreet Date: Tue Aug 13 01:01:35 2024 -0400 bcachefs: Add missing downgrade table entry Signed-off-by: Kent Overstreet fs/bcachefs/sb-downgrade.c | 1 + 1 file changed, 1 insertion(+) commit 486d920735325e507d965c2639ba2775b81fd329 Author: Kent Overstreet Date: Tue Aug 13 22:47:55 2024 -0400 bcachefs: disk accounting: ignore unknown types forward compat fix Signed-off-by: Kent Overstreet fs/bcachefs/disk_accounting.c | 12 +++++++++--- 1 file changed, 9 insertions(+), 3 deletions(-) commit d9e615762bf2eb7459fb0f270525f8b186bce6b7 Author: Kent Overstreet Date: Tue Aug 13 04:53:12 2024 -0400 bcachefs: bch2_accounting_invalid() fixup Signed-off-by: Kent Overstreet fs/bcachefs/disk_accounting.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit bd864bc2d90790e00b02b17c75fb951cb4b0bb8b Author: Kent Overstreet Date: Mon Aug 12 23:24:03 2024 -0400 bcachefs: Fix bch2_trigger_alloc when upgrading from old versions bch2_trigger_alloc was assuming that the new key would always be newly created and thus always an alloc_v4 key, but - not when called from btree_gc. Signed-off-by: Kent Overstreet fs/bcachefs/alloc_background.c | 14 +++++++++++++- 1 file changed, 13 insertions(+), 1 deletion(-) commit a24e6e7146e361aa0855cf8ee3b2e80b8eb692e3 Author: Kent Overstreet Date: Tue Aug 13 22:40:39 2024 -0400 bcachefs: delete faulty fastpath in bch2_btree_path_traverse_cached() bch2_btree_path_traverse_cached() was previously checking if it could just relock the path, which is a common idiom in path traversal. However, it was using btree_node_relock(), not btree_path_relock(); btree_path_relock() only succeeds if the path was in state BTREE_ITER_NEED_RELOCK. If the path was in state BTREE_ITER_NEED_TRAVERSE a full traversal is needed; this led to a null ptr deref in bch2_btree_path_traverse_cached(). And the short circuit check here isn't needed, since it was already done in the main bch2_btree_path_traverse_one(). Signed-off-by: Kent Overstreet fs/bcachefs/btree_key_cache.c | 5 ----- 1 file changed, 5 deletions(-) commit 655111b838cdabdb604f3625a9ff08c5eedb11da Author: Eugene Syromiatnikov Date: Mon Aug 12 08:51:23 2024 +0200 mptcp: correct MPTCP_SUBFLOW_ATTR_SSN_OFFSET reserved size ssn_offset field is u32 and is placed into the netlink response with nla_put_u32(), but only 2 bytes are reserved for the attribute payload in subflow_get_info_size() (even though it makes no difference in the end, as it is aligned up to 4 bytes). Supply the correct argument to the relevant nla_total_size() call to make it less confusing. Fixes: 5147dfb50832 ("mptcp: allow dumping subflow context to userspace") Signed-off-by: Eugene Syromiatnikov Reviewed-by: Matthieu Baerts (NGI0) Link: https://patch.msgid.link/20240812065024.GA19719@asgard.redhat.com Signed-off-by: Jakub Kicinski net/mptcp/diag.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 6b0f8db921abf0520081d779876d3a41069dab95 Merge: 6b4aa469f049 f50733b45d86 Author: Linus Torvalds Date: Tue Aug 13 16:10:32 2024 -0700 Merge tag 'execve-v6.11-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/kees/linux Pull execve fixes from Kees Cook: - binfmt_flat: Fix corruption when not offsetting data start - exec: Fix ToCToU between perm check and set-uid/gid usage * tag 'execve-v6.11-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/kees/linux: exec: Fix ToCToU between perm check and set-uid/gid usage binfmt_flat: Fix corruption when not offsetting data start commit 4e91fa1ef3ce6290b4c598e54b5eb6cf134fbec8 Author: Andi Shyti Date: Mon Aug 12 21:40:28 2024 +0200 i2c: qcom-geni: Add missing geni_icc_disable in geni_i2c_runtime_resume Add the missing geni_icc_disable() call before returning in the geni_i2c_runtime_resume() function. Commit 9ba48db9f77c ("i2c: qcom-geni: Add missing geni_icc_disable in geni_i2c_runtime_resume") by Gaosheng missed disabling the interconnect in one case. Fixes: bf225ed357c6 ("i2c: i2c-qcom-geni: Add interconnect support") Cc: Gaosheng Cui Cc: stable@vger.kernel.org # v5.9+ Signed-off-by: Andi Shyti drivers/i2c/busses/i2c-qcom-geni.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) commit b739dffa5d570b411d4bdf4bb9b8dfd6b7d72305 Author: Stefan Wiehler Date: Mon Aug 12 12:06:51 2024 +0200 of/irq: Prevent device address out-of-bounds read in interrupt map walk When of_irq_parse_raw() is invoked with a device address smaller than the interrupt parent node (from #address-cells property), KASAN detects the following out-of-bounds read when populating the initial match table (dyndbg="func of_irq_parse_* +p"): OF: of_irq_parse_one: dev=/soc@0/picasso/watchdog, index=0 OF: parent=/soc@0/pci@878000000000/gpio0@17,0, intsize=2 OF: intspec=4 OF: of_irq_parse_raw: ipar=/soc@0/pci@878000000000/gpio0@17,0, size=2 OF: -> addrsize=3 ================================================================== BUG: KASAN: slab-out-of-bounds in of_irq_parse_raw+0x2b8/0x8d0 Read of size 4 at addr ffffff81beca5608 by task bash/764 CPU: 1 PID: 764 Comm: bash Tainted: G O 6.1.67-484c613561-nokia_sm_arm64 #1 Hardware name: Unknown Unknown Product/Unknown Product, BIOS 2023.01-12.24.03-dirty 01/01/2023 Call trace: dump_backtrace+0xdc/0x130 show_stack+0x1c/0x30 dump_stack_lvl+0x6c/0x84 print_report+0x150/0x448 kasan_report+0x98/0x140 __asan_load4+0x78/0xa0 of_irq_parse_raw+0x2b8/0x8d0 of_irq_parse_one+0x24c/0x270 parse_interrupts+0xc0/0x120 of_fwnode_add_links+0x100/0x2d0 fw_devlink_parse_fwtree+0x64/0xc0 device_add+0xb38/0xc30 of_device_add+0x64/0x90 of_platform_device_create_pdata+0xd0/0x170 of_platform_bus_create+0x244/0x600 of_platform_notify+0x1b0/0x254 blocking_notifier_call_chain+0x9c/0xd0 __of_changeset_entry_notify+0x1b8/0x230 __of_changeset_apply_notify+0x54/0xe4 of_overlay_fdt_apply+0xc04/0xd94 ... The buggy address belongs to the object at ffffff81beca5600 which belongs to the cache kmalloc-128 of size 128 The buggy address is located 8 bytes inside of 128-byte region [ffffff81beca5600, ffffff81beca5680) The buggy address belongs to the physical page: page:00000000230d3d03 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x1beca4 head:00000000230d3d03 order:1 compound_mapcount:0 compound_pincount:0 flags: 0x8000000000010200(slab|head|zone=2) raw: 8000000000010200 0000000000000000 dead000000000122 ffffff810000c300 raw: 0000000000000000 0000000000200020 00000001ffffffff 0000000000000000 page dumped because: kasan: bad access detected Memory state around the buggy address: ffffff81beca5500: 04 fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc ffffff81beca5580: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc >ffffff81beca5600: 00 fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc ^ ffffff81beca5680: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc ffffff81beca5700: 00 00 00 00 00 00 fc fc fc fc fc fc fc fc fc fc ================================================================== OF: -> got it ! Prevent the out-of-bounds read by copying the device address into a buffer of sufficient size. Signed-off-by: Stefan Wiehler Link: https://lore.kernel.org/r/20240812100652.3800963-1-stefan.wiehler@nokia.com Signed-off-by: Rob Herring (Arm) drivers/of/irq.c | 15 +++++++++++---- 1 file changed, 11 insertions(+), 4 deletions(-) commit f50733b45d865f91db90919f8311e2127ce5a0cb Author: Kees Cook Date: Thu Aug 8 11:39:08 2024 -0700 exec: Fix ToCToU between perm check and set-uid/gid usage When opening a file for exec via do_filp_open(), permission checking is done against the file's metadata at that moment, and on success, a file pointer is passed back. Much later in the execve() code path, the file metadata (specifically mode, uid, and gid) is used to determine if/how to set the uid and gid. However, those values may have changed since the permissions check, meaning the execution may gain unintended privileges. For example, if a file could change permissions from executable and not set-id: ---------x 1 root root 16048 Aug 7 13:16 target to set-id and non-executable: ---S------ 1 root root 16048 Aug 7 13:16 target it is possible to gain root privileges when execution should have been disallowed. While this race condition is rare in real-world scenarios, it has been observed (and proven exploitable) when package managers are updating the setuid bits of installed programs. Such files start with being world-executable but then are adjusted to be group-exec with a set-uid bit. For example, "chmod o-x,u+s target" makes "target" executable only by uid "root" and gid "cdrom", while also becoming setuid-root: -rwxr-xr-x 1 root cdrom 16048 Aug 7 13:16 target becomes: -rwsr-xr-- 1 root cdrom 16048 Aug 7 13:16 target But racing the chmod means users without group "cdrom" membership can get the permission to execute "target" just before the chmod, and when the chmod finishes, the exec reaches brpm_fill_uid(), and performs the setuid to root, violating the expressed authorization of "only cdrom group members can setuid to root". Re-check that we still have execute permissions in case the metadata has changed. It would be better to keep a copy from the perm-check time, but until we can do that refactoring, the least-bad option is to do a full inode_permission() call (under inode lock). It is understood that this is safe against dead-locks, but hardly optimal. Reported-by: Marco Vanotti Tested-by: Marco Vanotti Suggested-by: Linus Torvalds Cc: stable@vger.kernel.org Cc: Eric Biederman Cc: Alexander Viro Cc: Christian Brauner Signed-off-by: Kees Cook fs/exec.c | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-) commit 3e30296b374af33cb4c12ff93df0b1e5b2d0f80b Author: Abhinav Kumar Date: Thu Aug 8 16:52:27 2024 -0700 drm/msm: fix the highest_bank_bit for sc7180 sc7180 programs the ubwc settings as 0x1e as that would mean a highest bank bit of 14 which matches what the GPU sets as well. However, the highest_bank_bit field of the msm_mdss_data which is being used to program the SSPP's fetch configuration is programmed to a highest bank bit of 16 as 0x3 translates to 16 and not 14. Fix the highest bank bit field used for the SSPP to match the mdss and gpu settings. Fixes: 6f410b246209 ("drm/msm/mdss: populate missing data") Reviewed-by: Rob Clark Tested-by: Stephen Boyd # Trogdor.Lazor Patchwork: https://patchwork.freedesktop.org/patch/607625/ Link: https://lore.kernel.org/r/20240808235227.2701479-1-quic_abhinavk@quicinc.com Signed-off-by: Abhinav Kumar drivers/gpu/drm/msm/msm_mdss.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit faada2174c08662ae98b439c69efe3e79382c538 Author: Mikulas Patocka Date: Tue Aug 13 16:35:14 2024 +0200 dm persistent data: fix memory allocation failure kmalloc is unreliable when allocating more than 8 pages of memory. It may fail when there is plenty of free memory but the memory is fragmented. Zdenek Kabelac observed such failure in his tests. This commit changes kmalloc to kvmalloc - kvmalloc will fall back to vmalloc if the large allocation fails. Signed-off-by: Mikulas Patocka Reported-by: Zdenek Kabelac Reviewed-by: Mike Snitzer Cc: stable@vger.kernel.org drivers/md/persistent-data/dm-space-map-metadata.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) commit 100bff23818eb61751ed05d64a7df36ce9728a4d Author: Kyle Huey Date: Tue Aug 13 15:17:27 2024 +0000 perf/bpf: Don't call bpf_overflow_handler() for tracing events The regressing commit is new in 6.10. It assumed that anytime event->prog is set bpf_overflow_handler() should be invoked to execute the attached bpf program. This assumption is false for tracing events, and as a result the regressing commit broke bpftrace by invoking the bpf handler with garbage inputs on overflow. Prior to the regression the overflow handlers formed a chain (of length 0, 1, or 2) and perf_event_set_bpf_handler() (the !tracing case) added bpf_overflow_handler() to that chain, while perf_event_attach_bpf_prog() (the tracing case) did not. Both set event->prog. The chain of overflow handlers was replaced by a single overflow handler slot and a fixed call to bpf_overflow_handler() when appropriate. This modifies the condition there to check event->prog->type == BPF_PROG_TYPE_PERF_EVENT, restoring the previous behavior and fixing bpftrace. Signed-off-by: Kyle Huey Suggested-by: Andrii Nakryiko Reported-by: Joe Damato Closes: https://lore.kernel.org/lkml/ZpFfocvyF3KHaSzF@LQ3V64L9R2/ Fixes: f11f10bfa1ca ("perf/bpf: Call BPF handler directly, not through overflow machinery") Cc: stable@vger.kernel.org Tested-by: Joe Damato # bpftrace Acked-by: Andrii Nakryiko Link: https://lore.kernel.org/r/20240813151727.28797-1-jdamato@fastly.com Signed-off-by: Alexei Starovoitov kernel/events/core.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) commit 23acd1f344e8102f803119d0c8fc4df4628d694f Author: Kenneth Feng Date: Thu Aug 8 12:19:22 2024 +0800 drm/amd/amdgpu: add HDP_SD support on gc 12.0.0/1 add HDP_SD support on gc 12.0.0/1 Signed-off-by: Kenneth Feng Reviewed-by: Yang Wang Signed-off-by: Alex Deucher (cherry picked from commit 61cffacb3a1c590b15c0e9ff987de02d293e0dd8) drivers/gpu/drm/amd/amdgpu/soc24.c | 2 ++ 1 file changed, 2 insertions(+) commit 507a2286c052919fe416b3daa0f0061d0fc702b9 Author: Yinjie Yao Date: Fri Aug 9 17:20:26 2024 -0400 drm/amdgpu: Update kmd_fw_shared for VCN5 kmd_fw_shared changed in VCN5 Signed-off-by: Yinjie Yao Reviewed-by: Ruijing Dong Acked-by: Alex Deucher Signed-off-by: Alex Deucher (cherry picked from commit aa02486fb18cecbaca0c4fd393d1a03f1d4c3f9a) drivers/gpu/drm/amd/amdgpu/amdgpu_vcn.h | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) commit 470516c2925493594a690bc4d05b1f4471d9f996 Author: David (Ming Qiang) Wu Date: Thu Aug 8 12:19:50 2024 -0400 drm/amd/amdgpu: command submission parser for JPEG Add JPEG IB command parser to ensure registers in the command are within the JPEG IP block. Reviewed-by: Alex Deucher Signed-off-by: David (Ming Qiang) Wu Signed-off-by: Alex Deucher (cherry picked from commit a7f670d5d8e77b092404ca8a35bb0f8f89ed3117) Cc: stable@vger.kernel.org drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c | 3 ++ drivers/gpu/drm/amd/amdgpu/jpeg_v4_0_3.c | 61 +++++++++++++++++++++++++++++++- drivers/gpu/drm/amd/amdgpu/jpeg_v4_0_3.h | 7 +++- drivers/gpu/drm/amd/amdgpu/jpeg_v5_0_0.c | 1 + drivers/gpu/drm/amd/amdgpu/soc15d.h | 6 ++++ 5 files changed, 76 insertions(+), 2 deletions(-) commit 4246b1077ffcc37926868581bb818fdb49d0d065 Author: Jack Xiao Date: Wed Aug 7 12:03:11 2024 +0800 drm/amdgpu/mes12: fix suspend issue Use mes pipe to unmap kcq and kgq. Signed-off-by: Jack Xiao Acked-by: Alex Deucher Reviewed-by: Hawking Zhang Signed-off-by: Alex Deucher (cherry picked from commit f7fb9d677faf0460131bc2af15afd766d48a1f47) drivers/gpu/drm/amd/amdgpu/amdgpu_gfx.c | 22 ++++++++++++++++++++++ drivers/gpu/drm/amd/amdgpu/gfx_v12_0.c | 27 +-------------------------- 2 files changed, 23 insertions(+), 26 deletions(-) commit af401543df510a73f7beb13f80cf4c541be94786 Author: Jack Xiao Date: Wed Aug 7 15:23:16 2024 +0800 drm/amdgpu/mes12: sw/hw fini for unified mes Free memory for two pipes and unmap pipe0 via pipe1. Signed-off-by: Jack Xiao Acked-by: Alex Deucher Reviewed-by: Hawking Zhang Signed-off-by: Alex Deucher (cherry picked from commit 98cae695a8ae0e4291b1fa7feef9b54fabefe885) drivers/gpu/drm/amd/amdgpu/mes_v12_0.c | 31 ++++++++++++++++++++----------- 1 file changed, 20 insertions(+), 11 deletions(-) commit 7254027e1e6edbff54f5930a5f13f14ac6f1694c Author: Jack Xiao Date: Wed Aug 7 14:49:30 2024 +0800 drm/amdgpu/mes12: configure two pipes hardware resources Configure two pipes with different hardware resources. Signed-off-by: Jack Xiao Acked-by: Alex Deucher Reviewed-by: Hawking Zhang Signed-off-by: Alex Deucher (cherry picked from commit ea5d6db17a8e3635ad91e8c53faa1fdc9570fbbb) drivers/gpu/drm/amd/amdgpu/amdgpu_mes.c | 77 ++++++++++++++++++++------------- drivers/gpu/drm/amd/amdgpu/amdgpu_mes.h | 12 ++--- drivers/gpu/drm/amd/amdgpu/mes_v11_0.c | 7 +-- drivers/gpu/drm/amd/amdgpu/mes_v12_0.c | 49 +++++++++++---------- 4 files changed, 81 insertions(+), 64 deletions(-) commit 1097727d6d0c13eca25321fff46714fc5047d6e8 Author: Jack Xiao Date: Wed Aug 7 14:44:07 2024 +0800 drm/amdgpu/mes12: adjust mes12 sw/hw init for multiple pipes Adjust mes12 sw/hw initiailization for both pipe0 and pipe1 enablement. The two pipes are almost identical pipe. Pipe0 behaves like schq and pipe1 like kiq, pipe0 was mapped by pipe1. Signed-off-by: Jack Xiao Acked-by: Alex Deucher Reviewed-by: Hawking Zhang Signed-off-by: Alex Deucher (cherry picked from commit aa539da8aff07ab08def6490e8c9b441439e70ba) drivers/gpu/drm/amd/amdgpu/mes_v12_0.c | 106 +++++++++++++++++++-------------- 1 file changed, 62 insertions(+), 44 deletions(-) commit 3738a7f0ddb920bde538d3f78a02edbc6ad1307e Author: Jack Xiao Date: Wed Aug 7 14:15:48 2024 +0800 drm/amdgpu/mes12: add mes pipe switch support Add mes pipe switch to let caller choose pipe to submit packet. Signed-off-by: Jack Xiao Acked-by: Alex Deucher Reviewed-by: Hawking Zhang Signed-off-by: Alex Deucher (cherry picked from commit b2dee0837a4be63e8d3e00550a9f057644f962c4) drivers/gpu/drm/amd/amdgpu/mes_v12_0.c | 59 +++++++++++++++++++--------------- 1 file changed, 33 insertions(+), 26 deletions(-) commit a13d91bf3c1910212e45a69d04ad40d99878f8da Author: Jack Xiao Date: Wed Aug 7 13:19:59 2024 +0800 drm/amdgpu/mes12: load unified mes fw on pipe0 and pipe1 Enable unified mes firmware to load on pipe0 and pipe1. Signed-off-by: Jack Xiao Acked-by: Alex Deucher Reviewed-by: Hawking Zhang Signed-off-by: Alex Deucher (cherry picked from commit e69c2dd7534f3fcabf7bb801db2a7ac71e7e5da6) drivers/gpu/drm/amd/amdgpu/amdgpu_mes.c | 2 +- drivers/gpu/drm/amd/amdgpu/mes_v12_0.c | 27 +++------------------------ 2 files changed, 4 insertions(+), 25 deletions(-) commit 2029b3d7e1358bcca30f74978543ba35b4bbc43d Author: Jack Xiao Date: Wed Aug 7 11:53:35 2024 +0800 drm/amdgpu/mes: add multiple mes ring instances support Add multiple mes ring instances in mes structure to support multiple mes pipes. Signed-off-by: Jack Xiao Acked-by: Alex Deucher Reviewed-by: Hawking Zhang Signed-off-by: Alex Deucher (cherry picked from commit c7d4355648ffa02a1551495b05c71ea6c884d29c) drivers/gpu/drm/amd/amdgpu/amdgpu_gfx.c | 4 ++-- drivers/gpu/drm/amd/amdgpu/amdgpu_gmc.c | 5 +++-- drivers/gpu/drm/amd/amdgpu/amdgpu_mes.c | 4 +++- drivers/gpu/drm/amd/amdgpu/amdgpu_mes.h | 4 ++-- drivers/gpu/drm/amd/amdgpu/amdgpu_virt.c | 2 +- drivers/gpu/drm/amd/amdgpu/gmc_v11_0.c | 2 +- drivers/gpu/drm/amd/amdgpu/gmc_v12_0.c | 2 +- drivers/gpu/drm/amd/amdgpu/mes_v11_0.c | 34 ++++++++++++++++---------------- drivers/gpu/drm/amd/amdgpu/mes_v12_0.c | 34 ++++++++++++++++---------------- 9 files changed, 47 insertions(+), 44 deletions(-) commit 278e1865b7a2124ea783b75ea8b3ee0bc2da5d85 Author: Jack Xiao Date: Wed Aug 7 11:43:45 2024 +0800 drm/amdgpu/mes12: update mes_v12_api_def.h Update mes12 api definition. Signed-off-by: Jack Xiao Acked-by: Alex Deucher Reviewed-by: Hawking Zhang Signed-off-by: Alex Deucher (cherry picked from commit 2ab5dc59177419d8a49e89585e82ff41524270fc) drivers/gpu/drm/amd/include/mes_v12_api_def.h | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) commit 0573a1e2ea7e35bff08944a40f1adf2bb35cea61 Author: Bas Nieuwenhuizen Date: Tue Aug 6 22:27:32 2024 +0200 drm/amdgpu: Actually check flags for all context ops. Missing validation ... Checked libdrm and it clears all the structs, so we should be safe to just check everything. Signed-off-by: Bas Nieuwenhuizen Signed-off-by: Alex Deucher (cherry picked from commit c6b86421f1f9ddf9d706f2453159813ee39d0cf9) Cc: stable@vger.kernel.org drivers/gpu/drm/amd/amdgpu/amdgpu_ctx.c | 8 ++++++++ 1 file changed, 8 insertions(+) commit e6c6bd6253e792cee6c5c065e106e87b9f0d9ae9 Author: Alex Deucher Date: Fri Jul 12 10:06:05 2024 -0400 drm/amdgpu/jpeg4: properly set atomics vmid field This needs to be set as well if the IB uses atomics. Reviewed-by: Leo Liu Signed-off-by: Alex Deucher (cherry picked from commit c6c2e8b6a427d4fecc7c36cffccb908185afcab2) Cc: stable@vger.kernel.org drivers/gpu/drm/amd/amdgpu/jpeg_v4_0_3.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) commit e414a304f2c5368a84f03ad34d29b89f965a33c9 Author: Alex Deucher Date: Fri Jul 12 10:00:33 2024 -0400 drm/amdgpu/jpeg2: properly set atomics vmid field This needs to be set as well if the IB uses atomics. Reviewed-by: Leo Liu Signed-off-by: Alex Deucher (cherry picked from commit 35c628774e50b3784c59e8ca7973f03bcb067132) Cc: stable@vger.kernel.org drivers/gpu/drm/amd/amdgpu/jpeg_v2_0.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) commit 56fb276d0244d430496f249335a44ae114dd5f54 Author: Rodrigo Siqueira Date: Thu Aug 1 16:16:35 2024 -0600 drm/amd/display: Adjust cursor position [why & how] When the commit 9d84c7ef8a87 ("drm/amd/display: Correct cursor position on horizontal mirror") was introduced, it used the wrong calculation for the position copy for X. This commit uses the correct calculation for that based on the original patch. Fixes: 9d84c7ef8a87 ("drm/amd/display: Correct cursor position on horizontal mirror") Cc: Mario Limonciello Cc: Alex Deucher Acked-by: Wayne Lin Signed-off-by: Rodrigo Siqueira Signed-off-by: Tom Chung Tested-by: Daniel Wheeler Signed-off-by: Alex Deucher (cherry picked from commit 8f9b23abbae5ffcd64856facd26a86b67195bc2f) Cc: stable@vger.kernel.org drivers/gpu/drm/amd/display/dc/hwss/dcn10/dcn10_hwseq.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 737222cebecbdbcdde2b69475c52bcb9ecfeb830 Author: Melissa Wen Date: Tue Jan 31 15:05:46 2023 -0100 drm/amd/display: fix cursor offset on rotation 180 [why & how] Cursor gets clipped off in the middle of the screen with hw rotation 180. Fix a miscalculation of cursor offset when it's placed near the edges in the pipe split case. Cursor bugs with hw rotation were reported on AMD issue tracker: https://gitlab.freedesktop.org/drm/amd/-/issues/2247 The issues on rotation 270 was fixed by: https://lore.kernel.org/amd-gfx/20221118125935.4013669-22-Brian.Chang@amd.com/ that partially addressed the rotation 180 too. So, this patch is the final bits for rotation 180. Reported-by: Xaver Hugl Closes: https://gitlab.freedesktop.org/drm/amd/-/issues/2247 Reviewed-by: Harry Wentland Fixes: 9d84c7ef8a87 ("drm/amd/display: Correct cursor position on horizontal mirror") Signed-off-by: Melissa Wen Signed-off-by: Hamza Mahfooz Signed-off-by: Tom Chung Tested-by: Daniel Wheeler Signed-off-by: Alex Deucher (cherry picked from commit 1fd2cf090096af8a25bf85564341cfc21cec659d) Cc: stable@vger.kernel.org drivers/gpu/drm/amd/display/dc/hwss/dcn10/dcn10_hwseq.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 338567d17627064dba63cf063459605e782f71d2 Author: Fangzhi Zuo Date: Mon Jul 29 10:23:03 2024 -0400 drm/amd/display: Fix MST BW calculation Regression [Why & How] Revert commit 8b2cb32cf0c6 ("drm/amd/display: FEC overhead should be checked once for mst slot nums") Because causes bw calculation regression Cc: mario.limonciello@amd.com Cc: alexander.deucher@amd.com Reported-by: jirislaby@kernel.org Closes: https://gitlab.freedesktop.org/drm/amd/-/issues/3495 Closes: https://bugzilla.suse.com/show_bug.cgi?id=1228093 Reviewed-by: Wayne Lin Signed-off-by: Fangzhi Zuo Signed-off-by: Tom Chung Tested-by: Daniel Wheeler Signed-off-by: Alex Deucher (cherry picked from commit 12dbb3ed212fc7655fce421542a5add637f8af7a) Cc: stable@vger.kernel.org .../amd/display/amdgpu_dm/amdgpu_dm_mst_types.c | 33 ++++++++++++++++------ .../amd/display/amdgpu_dm/amdgpu_dm_mst_types.h | 3 ++ 2 files changed, 27 insertions(+), 9 deletions(-) commit 0dbb81d44108a2a1004e5b485ef3fca5bc078424 Author: Loan Chen Date: Fri Aug 2 13:57:40 2024 +0800 drm/amd/display: Enable otg synchronization logic for DCN321 [Why] Tiled display cannot synchronize properly after S3. The fix for commit 5f0c74915815 ("drm/amd/display: Fix for otg synchronization logic") is not enable in DCN321, which causes the otg is excluded from synchronization. [How] Enable otg synchronization logic in dcn321. Fixes: 5f0c74915815 ("drm/amd/display: Fix for otg synchronization logic") Cc: Mario Limonciello Cc: Alex Deucher Reviewed-by: Alvin Lee Signed-off-by: Loan Chen Signed-off-by: Tom Chung Tested-by: Daniel Wheeler Signed-off-by: Alex Deucher (cherry picked from commit d6ed53712f583423db61fbb802606759e023bf7b) Cc: stable@vger.kernel.org drivers/gpu/drm/amd/display/dc/resource/dcn321/dcn321_resource.c | 3 +++ 1 file changed, 3 insertions(+) commit f6098641d3e1e4d4052ff9378857c831f9675f6b Author: Hamza Mahfooz Date: Tue Aug 6 09:55:55 2024 -0400 drm/amd/display: fix s2idle entry for DCN3.5+ To be able to get to the lowest power state when suspending systems with DCN3.5+, we must be in IPS before the display hardware is put into D3cold. So, to ensure that the system always reaches the lowest power state while suspending, force systems that support IPS to enter idle optimizations before entering D3cold. Reviewed-by: Roman Li Signed-off-by: Hamza Mahfooz Signed-off-by: Alex Deucher (cherry picked from commit 237193e21b29d4aa0617ffeea3d6f49e72999708) Cc: stable@vger.kernel.org # 6.10+ drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c | 3 +++ 1 file changed, 3 insertions(+) commit 11752c013f562a1124088a35bd314aa0e9f0e88f Author: Jack Xiao Date: Thu Jul 18 16:38:50 2024 +0800 drm/amdgpu/mes: fix mes ring buffer overflow wait memory room until enough before writing mes packets to avoid ring buffer overflow. v2: squash in sched_hw_submission fix Fixes: de3246254156 ("drm/amdgpu: cleanup MES11 command submission") Fixes: fffe347e1478 ("drm/amdgpu: cleanup MES12 command submission") Signed-off-by: Jack Xiao Acked-by: Alex Deucher Signed-off-by: Alex Deucher (cherry picked from commit 34e087e8920e635c62e2ed6a758b0cd27f836d13) Cc: stable@vger.kernel.org drivers/gpu/drm/amd/amdgpu/amdgpu_ring.c | 2 ++ drivers/gpu/drm/amd/amdgpu/mes_v11_0.c | 18 ++++++++++++++---- drivers/gpu/drm/amd/amdgpu/mes_v12_0.c | 18 ++++++++++++++---- 3 files changed, 30 insertions(+), 8 deletions(-) commit c9b35a6f4edea698a5bb4dd8029e7104ee0a3726 Author: Li RongQing Date: Thu Jul 11 20:11:30 2024 +0800 KVM: eventfd: Use synchronize_srcu_expedited() on shutdown When hot-unplug a device which has many queues, and guest CPU will has huge jitter, and unplugging is very slow. It turns out synchronize_srcu() in irqfd_shutdown() caused the guest jitter and unplugging latency, so replace synchronize_srcu() with synchronize_srcu_expedited(), to accelerate the unplugging, and reduce the guest OS jitter, this accelerates the VM reboot too. Signed-off-by: Li RongQing Message-ID: <20240711121130.38917-1-lirongqing@baidu.com> [Call it just once in irqfd_resampler_shutdown. - Paolo] Signed-off-by: Paolo Bonzini virt/kvm/eventfd.c | 13 +++++++------ 1 file changed, 7 insertions(+), 6 deletions(-) commit 6b4aa469f04999c3f244515fa7491b4d093c5167 Merge: d74da846046a f6bd41280a44 Author: Linus Torvalds Date: Tue Aug 13 09:03:23 2024 -0700 Merge tag '6.11-rc3-ksmbd-fixes' of git://git.samba.org/ksmbd Pull smb server fixes from Steve French: "Two smb3 server fixes for access denied problem on share path checks" * tag '6.11-rc3-ksmbd-fixes' of git://git.samba.org/ksmbd: ksmbd: override fsids for smb2_query_info() ksmbd: override fsids for share path check commit 238d3d63d1e27c8d9733b48f7b682fc6aba86672 Author: Michal Luczaj Date: Fri Aug 2 13:29:41 2024 -0700 KVM: selftests: Add a testcase to verify x2APIC is fully readonly Add a test to verify that userspace can't change a vCPU's x2APIC ID by abusing KVM_SET_LAPIC. KVM models the x2APIC ID (and x2APIC LDR) as readonly, and silently ignores userspace attempts to change the x2APIC ID for backwards compatibility. Signed-off-by: Michal Luczaj [sean: write changelog, add to existing test] Signed-off-by: Sean Christopherson Message-ID: <20240802202941.344889-3-seanjc@google.com> Signed-off-by: Paolo Bonzini .../selftests/kvm/x86_64/xapic_state_test.c | 28 ++++++++++++++++++++++ 1 file changed, 28 insertions(+) commit 4b7c3f6d04bd53f2e5b228b6821fb8f5d1ba3071 Author: Sean Christopherson Date: Fri Aug 2 13:29:40 2024 -0700 KVM: x86: Make x2APIC ID 100% readonly Ignore the userspace provided x2APIC ID when fixing up APIC state for KVM_SET_LAPIC, i.e. make the x2APIC fully readonly in KVM. Commit a92e2543d6a8 ("KVM: x86: use hardware-compatible format for APIC ID register"), which added the fixup, didn't intend to allow userspace to modify the x2APIC ID. In fact, that commit is when KVM first started treating the x2APIC ID as readonly, apparently to fix some race: static inline u32 kvm_apic_id(struct kvm_lapic *apic) { - return (kvm_lapic_get_reg(apic, APIC_ID) >> 24) & 0xff; + /* To avoid a race between apic_base and following APIC_ID update when + * switching to x2apic_mode, the x2apic mode returns initial x2apic id. + */ + if (apic_x2apic_mode(apic)) + return apic->vcpu->vcpu_id; + + return kvm_lapic_get_reg(apic, APIC_ID) >> 24; } Furthermore, KVM doesn't support delivering interrupts to vCPUs with a modified x2APIC ID, but KVM *does* return the modified value on a guest RDMSR and for KVM_GET_LAPIC. I.e. no remotely sane setup can actually work with a modified x2APIC ID. Making the x2APIC ID fully readonly fixes a WARN in KVM's optimized map calculation, which expects the LDR to align with the x2APIC ID. WARNING: CPU: 2 PID: 958 at arch/x86/kvm/lapic.c:331 kvm_recalculate_apic_map+0x609/0xa00 [kvm] CPU: 2 PID: 958 Comm: recalc_apic_map Not tainted 6.4.0-rc3-vanilla+ #35 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Arch Linux 1.16.2-1-1 04/01/2014 RIP: 0010:kvm_recalculate_apic_map+0x609/0xa00 [kvm] Call Trace: kvm_apic_set_state+0x1cf/0x5b0 [kvm] kvm_arch_vcpu_ioctl+0x1806/0x2100 [kvm] kvm_vcpu_ioctl+0x663/0x8a0 [kvm] __x64_sys_ioctl+0xb8/0xf0 do_syscall_64+0x56/0x80 entry_SYSCALL_64_after_hwframe+0x46/0xb0 RIP: 0033:0x7fade8b9dd6f Unfortunately, the WARN can still trigger for other CPUs than the current one by racing against KVM_SET_LAPIC, so remove it completely. Reported-by: Michal Luczaj Closes: https://lore.kernel.org/all/814baa0c-1eaa-4503-129f-059917365e80@rbox.co Reported-by: Haoyu Wu Closes: https://lore.kernel.org/all/20240126161633.62529-1-haoyuwu254@gmail.com Reported-by: syzbot+545f1326f405db4e1c3e@syzkaller.appspotmail.com Closes: https://lore.kernel.org/all/000000000000c2a6b9061cbca3c3@google.com Signed-off-by: Sean Christopherson Message-ID: <20240802202941.344889-2-seanjc@google.com> Signed-off-by: Paolo Bonzini arch/x86/kvm/lapic.c | 22 +++++++++++++++------- 1 file changed, 15 insertions(+), 7 deletions(-) commit c0196faaa927321a63e680427e075734ee656e42 Author: Albert Jakieła Date: Fri Aug 9 13:56:27 2024 +0000 ASoC: SOF: mediatek: Add missing board compatible Add Google Dojo compatible. Signed-off-by: Albert Jakieła Reviewed-by: Chen-Yu Tsai Link: https://patch.msgid.link/20240809135627.544429-1-jakiela@google.com Signed-off-by: Mark Brown sound/soc/sof/mediatek/mt8195/mt8195.c | 3 +++ 1 file changed, 3 insertions(+) commit 86cfa9a85fb04fa61e7c6b5a8ecf812437cdad78 Author: Daniel Yang Date: Wed Aug 7 02:01:21 2024 -0700 Documentation: dm-crypt.rst warning + error fix While building kernel documention using make htmldocs command, I was getting unexpected indentation error. Single description was given for two module parameters with wrong indentation. So, I corrected the indentation of both parameters and the description. Signed-off-by: Shibu kumar Signed-off-by: Daniel Yang Signed-off-by: Mikulas Patocka Fixes: 0d815e3400e6 ("dm-crypt: limit the size of encryption requests") Documentation/admin-guide/device-mapper/dm-crypt.rst | 15 ++++++++------- 1 file changed, 8 insertions(+), 7 deletions(-) commit 15e1c3d65975524c5c792fcd59f7d89f00402261 Author: Isaku Yamahata Date: Fri Aug 2 13:16:30 2024 -0700 KVM: x86: Use this_cpu_ptr() instead of per_cpu_ptr(smp_processor_id()) Use this_cpu_ptr() instead of open coding the equivalent in various user return MSR helpers. Signed-off-by: Isaku Yamahata Reviewed-by: Chao Gao Reviewed-by: Yuan Yao [sean: massage changelog] Signed-off-by: Sean Christopherson Reviewed-by: Pankaj Gupta Message-ID: <20240802201630.339306-1-seanjc@google.com> Signed-off-by: Paolo Bonzini arch/x86/kvm/x86.c | 6 ++---- 1 file changed, 2 insertions(+), 4 deletions(-) commit df934abb185c71c9f2fa07a5013672d0cbd36560 Author: David Thompson Date: Fri Aug 9 12:36:12 2024 -0400 mlxbf_gige: disable RX filters until RX path initialized A recent change to the driver exposed a bug where the MAC RX filters (unicast MAC, broadcast MAC, and multicast MAC) are configured and enabled before the RX path is fully initialized. The result of this bug is that after the PHY is started packets that match these MAC RX filters start to flow into the RX FIFO. And then, after rx_init() is completed, these packets will go into the driver RX ring as well. If enough packets are received to fill the RX ring (default size is 128 packets) before the call to request_irq() completes, the driver RX function becomes stuck. This bug is intermittent but is most likely to be seen where the oob_net0 interface is connected to a busy network with lots of broadcast and multicast traffic. All the MAC RX filters must be disabled until the RX path is ready, i.e. all initialization is done and all the IRQs are installed. Fixes: f7442a634ac0 ("mlxbf_gige: call request_irq() after NAPI initialized") Reviewed-by: Asmaa Mnebhi Signed-off-by: David Thompson Reviewed-by: Simon Horman Link: https://patch.msgid.link/20240809163612.12852-1-davthompson@nvidia.com Signed-off-by: Paolo Abeni .../net/ethernet/mellanox/mlxbf_gige/mlxbf_gige.h | 8 ++++ .../ethernet/mellanox/mlxbf_gige/mlxbf_gige_main.c | 10 +++++ .../ethernet/mellanox/mlxbf_gige/mlxbf_gige_regs.h | 2 + .../ethernet/mellanox/mlxbf_gige/mlxbf_gige_rx.c | 50 +++++++++++++++++++--- 4 files changed, 64 insertions(+), 6 deletions(-) commit 6252690f7e1b173b86a4c27dfc046b351ab423e7 Author: Naohiro Aota Date: Fri Aug 9 16:54:22 2024 +0900 btrfs: fix invalid mapping of extent xarray state In __extent_writepage_io(), we call btrfs_set_range_writeback() -> folio_start_writeback(), which clears PAGECACHE_TAG_DIRTY mark from the mapping xarray if the folio is not dirty. This worked fine before commit 97713b1a2ced ("btrfs: do not clear page dirty inside extent_write_locked_range()"). After the commit, however, the folio is still dirty at this point, so the mapping DIRTY tag is not cleared anymore. Then, __extent_writepage_io() calls btrfs_folio_clear_dirty() to clear the folio's dirty flag. That results in the page being unlocked with a "strange" state. The page is not PageDirty, but the mapping tag is set as PAGECACHE_TAG_DIRTY. This strange state looks like causing a hang with a call trace below when running fstests generic/091 on a null_blk device. It is waiting for a folio lock. While I don't have an exact relation between this hang and the strange state, fixing the state also fixes the hang. And, that state is worth fixing anyway. This commit reorders btrfs_folio_clear_dirty() and btrfs_set_range_writeback() in __extent_writepage_io(), so that the PAGECACHE_TAG_DIRTY tag is properly removed from the xarray. [464.274] task:fsx state:D stack:0 pid:3034 tgid:3034 ppid:2853 flags:0x00004002 [464.286] Call Trace: [464.291] [464.295] __schedule+0x10ed/0x6260 [464.301] ? __pfx___blk_flush_plug+0x10/0x10 [464.308] ? __submit_bio+0x37c/0x450 [464.314] ? __pfx___schedule+0x10/0x10 [464.321] ? lock_release+0x567/0x790 [464.327] ? __pfx_lock_acquire+0x10/0x10 [464.334] ? __pfx_lock_release+0x10/0x10 [464.340] ? __pfx_lock_acquire+0x10/0x10 [464.347] ? __pfx_lock_release+0x10/0x10 [464.353] ? do_raw_spin_lock+0x12e/0x270 [464.360] schedule+0xdf/0x3b0 [464.365] io_schedule+0x8f/0xf0 [464.371] folio_wait_bit_common+0x2ca/0x6d0 [464.378] ? folio_wait_bit_common+0x1cc/0x6d0 [464.385] ? __pfx_folio_wait_bit_common+0x10/0x10 [464.392] ? __pfx_filemap_get_folios_tag+0x10/0x10 [464.400] ? __pfx_wake_page_function+0x10/0x10 [464.407] ? __pfx___might_resched+0x10/0x10 [464.414] ? do_raw_spin_unlock+0x58/0x1f0 [464.420] extent_write_cache_pages+0xe49/0x1620 [btrfs] [464.428] ? lock_acquire+0x435/0x500 [464.435] ? __pfx_extent_write_cache_pages+0x10/0x10 [btrfs] [464.443] ? btrfs_do_write_iter+0x493/0x640 [btrfs] [464.451] ? orc_find.part.0+0x1d4/0x380 [464.457] ? __pfx_lock_release+0x10/0x10 [464.464] ? __pfx_lock_release+0x10/0x10 [464.471] ? btrfs_do_write_iter+0x493/0x640 [btrfs] [464.478] btrfs_writepages+0x1cc/0x460 [btrfs] [464.485] ? __pfx_btrfs_writepages+0x10/0x10 [btrfs] [464.493] ? is_bpf_text_address+0x6e/0x100 [464.500] ? kernel_text_address+0x145/0x160 [464.507] ? unwind_get_return_address+0x5e/0xa0 [464.514] ? arch_stack_walk+0xac/0x100 [464.521] do_writepages+0x176/0x780 [464.527] ? lock_release+0x567/0x790 [464.533] ? __pfx_do_writepages+0x10/0x10 [464.540] ? __pfx_lock_acquire+0x10/0x10 [464.546] ? __pfx_stack_trace_save+0x10/0x10 [464.553] ? do_raw_spin_lock+0x12e/0x270 [464.560] ? do_raw_spin_unlock+0x58/0x1f0 [464.566] ? _raw_spin_unlock+0x23/0x40 [464.573] ? wbc_attach_and_unlock_inode+0x3da/0x7d0 [464.580] filemap_fdatawrite_wbc+0x113/0x180 [464.587] ? prepare_pages.constprop.0+0x13c/0x5c0 [btrfs] [464.596] __filemap_fdatawrite_range+0xaf/0xf0 [464.603] ? __pfx___filemap_fdatawrite_range+0x10/0x10 [464.611] ? trace_irq_enable.constprop.0+0xce/0x110 [464.618] ? kasan_quarantine_put+0xd7/0x1e0 [464.625] btrfs_start_ordered_extent+0x46f/0x570 [btrfs] [464.633] ? __pfx_btrfs_start_ordered_extent+0x10/0x10 [btrfs] [464.642] ? __clear_extent_bit+0x2c0/0x9d0 [btrfs] [464.650] btrfs_lock_and_flush_ordered_range+0xc6/0x180 [btrfs] [464.659] ? __pfx_btrfs_lock_and_flush_ordered_range+0x10/0x10 [btrfs] [464.669] btrfs_read_folio+0x12a/0x1d0 [btrfs] [464.676] ? __pfx_btrfs_read_folio+0x10/0x10 [btrfs] [464.684] ? __pfx_filemap_add_folio+0x10/0x10 [464.691] ? __pfx___might_resched+0x10/0x10 [464.698] ? __filemap_get_folio+0x1c5/0x450 [464.705] prepare_uptodate_page+0x12e/0x4d0 [btrfs] [464.713] prepare_pages.constprop.0+0x13c/0x5c0 [btrfs] [464.721] ? fault_in_iov_iter_readable+0xd2/0x240 [464.729] btrfs_buffered_write+0x5bd/0x12f0 [btrfs] [464.737] ? __pfx_btrfs_buffered_write+0x10/0x10 [btrfs] [464.745] ? __pfx_lock_release+0x10/0x10 [464.752] ? generic_write_checks+0x275/0x400 [464.759] ? down_write+0x118/0x1f0 [464.765] ? up_write+0x19b/0x500 [464.770] btrfs_direct_write+0x731/0xba0 [btrfs] [464.778] ? __pfx_btrfs_direct_write+0x10/0x10 [btrfs] [464.785] ? __pfx___might_resched+0x10/0x10 [464.792] ? lock_acquire+0x435/0x500 [464.798] ? lock_acquire+0x435/0x500 [464.804] btrfs_do_write_iter+0x494/0x640 [btrfs] [464.811] ? __pfx_btrfs_do_write_iter+0x10/0x10 [btrfs] [464.819] ? __pfx___might_resched+0x10/0x10 [464.825] ? rw_verify_area+0x6d/0x590 [464.831] vfs_write+0x5d7/0xf50 [464.837] ? __might_fault+0x9d/0x120 [464.843] ? __pfx_vfs_write+0x10/0x10 [464.849] ? btrfs_file_llseek+0xb1/0xfb0 [btrfs] [464.856] ? lock_release+0x567/0x790 [464.862] ksys_write+0xfb/0x1d0 [464.867] ? __pfx_ksys_write+0x10/0x10 [464.873] ? _raw_spin_unlock+0x23/0x40 [464.879] ? btrfs_getattr+0x4af/0x670 [btrfs] [464.886] ? vfs_getattr_nosec+0x79/0x340 [464.892] do_syscall_64+0x95/0x180 [464.898] ? __do_sys_newfstat+0xde/0xf0 [464.904] ? __pfx___do_sys_newfstat+0x10/0x10 [464.911] ? trace_irq_enable.constprop.0+0xce/0x110 [464.918] ? syscall_exit_to_user_mode+0xac/0x2a0 [464.925] ? do_syscall_64+0xa1/0x180 [464.931] ? trace_irq_enable.constprop.0+0xce/0x110 [464.939] ? trace_irq_enable.constprop.0+0xce/0x110 [464.946] ? syscall_exit_to_user_mode+0xac/0x2a0 [464.953] ? btrfs_file_llseek+0xb1/0xfb0 [btrfs] [464.960] ? do_syscall_64+0xa1/0x180 [464.966] ? btrfs_file_llseek+0xb1/0xfb0 [btrfs] [464.973] ? trace_irq_enable.constprop.0+0xce/0x110 [464.980] ? syscall_exit_to_user_mode+0xac/0x2a0 [464.987] ? __pfx_btrfs_file_llseek+0x10/0x10 [btrfs] [464.995] ? trace_irq_enable.constprop.0+0xce/0x110 [465.002] ? __pfx_btrfs_file_llseek+0x10/0x10 [btrfs] [465.010] ? do_syscall_64+0xa1/0x180 [465.016] ? lock_release+0x567/0x790 [465.022] ? __pfx_lock_acquire+0x10/0x10 [465.028] ? __pfx_lock_release+0x10/0x10 [465.034] ? trace_irq_enable.constprop.0+0xce/0x110 [465.042] ? syscall_exit_to_user_mode+0xac/0x2a0 [465.049] ? do_syscall_64+0xa1/0x180 [465.055] ? syscall_exit_to_user_mode+0xac/0x2a0 [465.062] ? do_syscall_64+0xa1/0x180 [465.068] ? syscall_exit_to_user_mode+0xac/0x2a0 [465.075] ? do_syscall_64+0xa1/0x180 [465.081] ? clear_bhb_loop+0x25/0x80 [465.087] ? clear_bhb_loop+0x25/0x80 [465.093] ? clear_bhb_loop+0x25/0x80 [465.099] entry_SYSCALL_64_after_hwframe+0x76/0x7e [465.106] RIP: 0033:0x7f093b8ee784 [465.111] RSP: 002b:00007ffc29d31b28 EFLAGS: 00000202 ORIG_RAX: 0000000000000001 [465.122] RAX: ffffffffffffffda RBX: 0000000000006000 RCX: 00007f093b8ee784 [465.131] RDX: 000000000001de00 RSI: 00007f093b6ed200 RDI: 0000000000000003 [465.141] RBP: 000000000001de00 R08: 0000000000006000 R09: 0000000000000000 [465.150] R10: 0000000000023e00 R11: 0000000000000202 R12: 0000000000006000 [465.160] R13: 0000000000023e00 R14: 0000000000023e00 R15: 0000000000000001 [465.170] [465.174] INFO: lockdep is turned off. Reported-by: Shinichiro Kawasaki Fixes: 97713b1a2ced ("btrfs: do not clear page dirty inside extent_write_locked_range()") Reviewed-by: Qu Wenruo Signed-off-by: Naohiro Aota Signed-off-by: David Sterba fs/btrfs/extent_io.c | 14 +++++++------- 1 file changed, 7 insertions(+), 7 deletions(-) commit b098495e69491c2225681f43228312d32477217b Author: Yue Haibing Date: Sat Aug 3 19:32:33 2024 +0800 KVM: x86: hyper-v: Remove unused inline function kvm_hv_free_pa_page() There is no caller in tree since introduction in commit b4f69df0f65e ("KVM: x86: Make Hyper-V emulation optional") Signed-off-by: Yue Haibing Message-ID: <20240803113233.128185-1-yuehaibing@huawei.com> Signed-off-by: Paolo Bonzini arch/x86/kvm/hyperv.h | 1 - 1 file changed, 1 deletion(-) commit 0ecc5be200c84e67114f3640064ba2bae3ba2f5a Author: Yuntao Wang Date: Tue Aug 13 09:48:27 2024 +0800 x86/apic: Make x2apic_disable() work correctly x2apic_disable() clears x2apic_state and x2apic_mode unconditionally, even when the state is X2APIC_ON_LOCKED, which prevents the kernel to disable it thereby creating inconsistent state. Due to the early state check for X2APIC_ON, the code path which warns about a locked X2APIC cannot be reached. Test for state < X2APIC_ON instead and move the clearing of the state and mode variables to the place which actually disables X2APIC. [ tglx: Massaged change log. Added Fixes tag. Moved clearing so it's at the right place for back ports ] Fixes: a57e456a7b28 ("x86/apic: Fix fallout from x2apic cleanup") Signed-off-by: Yuntao Wang Signed-off-by: Thomas Gleixner Cc: stable@vger.kernel.org Link: https://lore.kernel.org/all/20240813014827.895381-1-yuntao.wang@linux.dev arch/x86/kernel/apic/apic.c | 11 ++++++----- 1 file changed, 6 insertions(+), 5 deletions(-) commit bcc954c6caba01fca143162d5fbb90e46aa1ad80 Author: Ryo Takakura Date: Mon Aug 12 16:27:03 2024 +0900 printk/panic: Allow cpu backtraces to be written into ringbuffer during panic commit 779dbc2e78d7 ("printk: Avoid non-panic CPUs writing to ringbuffer") disabled non-panic CPUs to further write messages to ringbuffer after panicked. Since the commit, non-panicked CPU's are not allowed to write to ring buffer after panicked and CPU backtrace which is triggered after panicked to sample non-panicked CPUs' backtrace no longer serves its function as it has nothing to print. Fix the issue by allowing non-panicked CPUs to write into ringbuffer while CPU backtrace is in flight. Fixes: 779dbc2e78d7 ("printk: Avoid non-panic CPUs writing to ringbuffer") Signed-off-by: Ryo Takakura Reviewed-by: Petr Mladek Link: https://lore.kernel.org/r/20240812072703.339690-1-takakura@valinux.co.jp Signed-off-by: Petr Mladek include/linux/panic.h | 1 + kernel/panic.c | 8 +++++++- kernel/printk/printk.c | 2 +- 3 files changed, 9 insertions(+), 2 deletions(-) commit e4956dc7a84da074fd8dc10f7abd147f15b3ae58 Author: Jens Axboe Date: Tue Aug 13 06:10:59 2024 -0600 io_uring/sqpoll: annotate debug task == current with data_race() There's a debug check in io_sq_thread_park() checking if it's the SQPOLL thread itself calling park. KCSAN warns about this, as we should not be reading sqd->thread outside of sqd->lock. Just silence this with data_race(). The pointer isn't used for anything but this debug check. Reported-by: syzbot+2b946a3fd80caf971b21@syzkaller.appspotmail.com Signed-off-by: Jens Axboe io_uring/sqpoll.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 810ee43d9cd245d138a2733d87a24858a23f577d Author: Phillip Lougher Date: Mon Aug 12 00:28:21 2024 +0100 Squashfs: sanity check symbolic link size Syzkiller reports a "KMSAN: uninit-value in pick_link" bug. This is caused by an uninitialised page, which is ultimately caused by a corrupted symbolic link size read from disk. The reason why the corrupted symlink size causes an uninitialised page is due to the following sequence of events: 1. squashfs_read_inode() is called to read the symbolic link from disk. This assigns the corrupted value 3875536935 to inode->i_size. 2. Later squashfs_symlink_read_folio() is called, which assigns this corrupted value to the length variable, which being a signed int, overflows producing a negative number. 3. The following loop that fills in the page contents checks that the copied bytes is less than length, which being negative means the loop is skipped, producing an uninitialised page. This patch adds a sanity check which checks that the symbolic link size is not larger than expected. -- Signed-off-by: Phillip Lougher Link: https://lore.kernel.org/r/20240811232821.13903-1-phillip@squashfs.org.uk Reported-by: Lizhi Xu Reported-by: syzbot+24ac24ff58dc5b0d26b9@syzkaller.appspotmail.com Closes: https://lore.kernel.org/all/000000000000a90e8c061e86a76b@google.com/ V2: fix spelling mistake. Signed-off-by: Christian Brauner fs/squashfs/inode.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) commit e3786b29c54cdae3490b07180a54e2461f42144c Author: Dominique Martinet Date: Thu Aug 8 14:29:38 2024 +0100 9p: Fix DIO read through netfs If a program is watching a file on a 9p mount, it won't see any change in size if the file being exported by the server is changed directly in the source filesystem, presumably because 9p doesn't have change notifications, and because netfs skips the reads if the file is empty. Fix this by attempting to read the full size specified when a DIO read is requested (such as when 9p is operating in unbuffered mode) and dealing with a short read if the EOF was less than the expected read. To make this work, filesystems using netfslib must not set NETFS_SREQ_CLEAR_TAIL if performing a DIO read where that read hit the EOF. I don't want to mandatorily clear this flag in netfslib for DIO because, say, ceph might make a read from an object that is not completely filled, but does not reside at the end of file - and so we need to clear the excess. This can be tested by watching an empty file over 9p within a VM (such as in the ktest framework): while true; do read content; if [ -n "$content" ]; then echo $content; break; fi; done < /host/tmp/foo then writing something into the empty file. The watcher should immediately display the file content and break out of the loop. Without this fix, it remains in the loop indefinitely. Fixes: 80105ed2fd27 ("9p: Use netfslib read/write_iter") Closes: https://bugzilla.kernel.org/show_bug.cgi?id=218916 Signed-off-by: David Howells Link: https://lore.kernel.org/r/1229195.1723211769@warthog.procyon.org.uk cc: Eric Van Hensbergen cc: Latchesar Ionkov cc: Christian Schoenebeck cc: Marc Dionne cc: Ilya Dryomov cc: Steve French cc: Paulo Alcantara cc: Trond Myklebust cc: v9fs@lists.linux.dev cc: linux-afs@lists.infradead.org cc: ceph-devel@vger.kernel.org cc: linux-cifs@vger.kernel.org cc: linux-nfs@vger.kernel.org cc: netfs@lists.linux.dev cc: linux-fsdevel@vger.kernel.org Signed-off-by: Dominique Martinet Signed-off-by: Christian Brauner fs/9p/vfs_addr.c | 3 ++- fs/afs/file.c | 3 ++- fs/ceph/addr.c | 6 ++++-- fs/netfs/io.c | 17 +++++++++++------ fs/nfs/fscache.c | 3 ++- fs/smb/client/file.c | 3 ++- 6 files changed, 23 insertions(+), 12 deletions(-) commit 2a0629834cd82f05d424bbc193374f9a43d1f87d Author: Zhihao Cheng Date: Fri Aug 9 11:16:28 2024 +0800 vfs: Don't evict inode under the inode lru traversing context The inode reclaiming process(See function prune_icache_sb) collects all reclaimable inodes and mark them with I_FREEING flag at first, at that time, other processes will be stuck if they try getting these inodes (See function find_inode_fast), then the reclaiming process destroy the inodes by function dispose_list(). Some filesystems(eg. ext4 with ea_inode feature, ubifs with xattr) may do inode lookup in the inode evicting callback function, if the inode lookup is operated under the inode lru traversing context, deadlock problems may happen. Case 1: In function ext4_evict_inode(), the ea inode lookup could happen if ea_inode feature is enabled, the lookup process will be stuck under the evicting context like this: 1. File A has inode i_reg and an ea inode i_ea 2. getfattr(A, xattr_buf) // i_ea is added into lru // lru->i_ea 3. Then, following three processes running like this: PA PB echo 2 > /proc/sys/vm/drop_caches shrink_slab prune_dcache_sb // i_reg is added into lru, lru->i_ea->i_reg prune_icache_sb list_lru_walk_one inode_lru_isolate i_ea->i_state |= I_FREEING // set inode state inode_lru_isolate __iget(i_reg) spin_unlock(&i_reg->i_lock) spin_unlock(lru_lock) rm file A i_reg->nlink = 0 iput(i_reg) // i_reg->nlink is 0, do evict ext4_evict_inode ext4_xattr_delete_inode ext4_xattr_inode_dec_ref_all ext4_xattr_inode_iget ext4_iget(i_ea->i_ino) iget_locked find_inode_fast __wait_on_freeing_inode(i_ea) ----→ AA deadlock dispose_list // cannot be executed by prune_icache_sb wake_up_bit(&i_ea->i_state) Case 2: In deleted inode writing function ubifs_jnl_write_inode(), file deleting process holds BASEHD's wbuf->io_mutex while getting the xattr inode, which could race with inode reclaiming process(The reclaiming process could try locking BASEHD's wbuf->io_mutex in inode evicting function), then an ABBA deadlock problem would happen as following: 1. File A has inode ia and a xattr(with inode ixa), regular file B has inode ib and a xattr. 2. getfattr(A, xattr_buf) // ixa is added into lru // lru->ixa 3. Then, following three processes running like this: PA PB PC echo 2 > /proc/sys/vm/drop_caches shrink_slab prune_dcache_sb // ib and ia are added into lru, lru->ixa->ib->ia prune_icache_sb list_lru_walk_one inode_lru_isolate ixa->i_state |= I_FREEING // set inode state inode_lru_isolate __iget(ib) spin_unlock(&ib->i_lock) spin_unlock(lru_lock) rm file B ib->nlink = 0 rm file A iput(ia) ubifs_evict_inode(ia) ubifs_jnl_delete_inode(ia) ubifs_jnl_write_inode(ia) make_reservation(BASEHD) // Lock wbuf->io_mutex ubifs_iget(ixa->i_ino) iget_locked find_inode_fast __wait_on_freeing_inode(ixa) | iput(ib) // ib->nlink is 0, do evict | ubifs_evict_inode | ubifs_jnl_delete_inode(ib) ↓ ubifs_jnl_write_inode ABBA deadlock ←-----make_reservation(BASEHD) dispose_list // cannot be executed by prune_icache_sb wake_up_bit(&ixa->i_state) Fix the possible deadlock by using new inode state flag I_LRU_ISOLATING to pin the inode in memory while inode_lru_isolate() reclaims its pages instead of using ordinary inode reference. This way inode deletion cannot be triggered from inode_lru_isolate() thus avoiding the deadlock. evict() is made to wait for I_LRU_ISOLATING to be cleared before proceeding with inode cleanup. Link: https://lore.kernel.org/all/37c29c42-7685-d1f0-067d-63582ffac405@huaweicloud.com/ Link: https://bugzilla.kernel.org/show_bug.cgi?id=219022 Fixes: e50e5129f384 ("ext4: xattr-in-inode support") Fixes: 7959cf3a7506 ("ubifs: journal: Handle xattrs like files") Cc: stable@vger.kernel.org Signed-off-by: Zhihao Cheng Link: https://lore.kernel.org/r/20240809031628.1069873-1-chengzhihao@huaweicloud.com Reviewed-by: Jan Kara Suggested-by: Jan Kara Suggested-by: Mateusz Guzik Signed-off-by: Christian Brauner fs/inode.c | 39 +++++++++++++++++++++++++++++++++++++-- include/linux/fs.h | 5 +++++ 2 files changed, 42 insertions(+), 2 deletions(-) commit 7a636b4f03af9d541205f69e373672e7b2b60a8a Author: Khazhismel Kumykov Date: Tue Aug 13 12:39:52 2024 +0200 dm resume: don't return EINVAL when signalled If the dm_resume method is called on a device that is not suspended, the method will suspend the device briefly, before resuming it (so that the table will be swapped). However, there was a bug that the return value of dm_suspended_md was not checked. dm_suspended_md may return an error when it is interrupted by a signal. In this case, do_resume would call dm_swap_table, which would return -EINVAL. This commit fixes the logic, so that error returned by dm_suspend is checked and the resume operation is undone. Signed-off-by: Mikulas Patocka Signed-off-by: Khazhismel Kumykov Cc: stable@vger.kernel.org drivers/md/dm-ioctl.c | 22 ++++++++++++++++++++-- 1 file changed, 20 insertions(+), 2 deletions(-) commit 1e1fd567d32fcf7544c6e09e0e5bc6c650da6e23 Author: Mikulas Patocka Date: Tue Aug 13 12:38:51 2024 +0200 dm suspend: return -ERESTARTSYS instead of -EINTR This commit changes device mapper, so that it returns -ERESTARTSYS instead of -EINTR when it is interrupted by a signal (so that the ioctl can be restarted). The manpage signal(7) says that the ioctl function should be restarted if the signal was handled with SA_RESTART. Signed-off-by: Mikulas Patocka Cc: stable@vger.kernel.org drivers/md/dm.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) commit 46a6e10a1ab16cc71d4a3cab73e79aabadd6b8ea Author: Filipe Manana Date: Mon Aug 12 14:18:06 2024 +0100 btrfs: send: allow cloning non-aligned extent if it ends at i_size If we a find that an extent is shared but its end offset is not sector size aligned, then we don't clone it and issue write operations instead. This is because the reflink (remap_file_range) operation does not allow to clone unaligned ranges, except if the end offset of the range matches the i_size of the source and destination files (and the start offset is sector size aligned). While this is not incorrect because send can only guarantee that a file has the same data in the source and destination snapshots, it's not optimal and generates confusion and surprising behaviour for users. For example, running this test: $ cat test.sh #!/bin/bash DEV=/dev/sdi MNT=/mnt/sdi mkfs.btrfs -f $DEV mount $DEV $MNT # Use a file size not aligned to any possible sector size. file_size=$((1 * 1024 * 1024 + 5)) # 1MB + 5 bytes dd if=/dev/random of=$MNT/foo bs=$file_size count=1 cp --reflink=always $MNT/foo $MNT/bar btrfs subvolume snapshot -r $MNT/ $MNT/snap rm -f /tmp/send-test btrfs send -f /tmp/send-test $MNT/snap umount $MNT mkfs.btrfs -f $DEV mount $DEV $MNT btrfs receive -vv -f /tmp/send-test $MNT xfs_io -r -c "fiemap -v" $MNT/snap/bar umount $MNT Gives the following result: (...) mkfile o258-7-0 rename o258-7-0 -> bar write bar - offset=0 length=49152 write bar - offset=49152 length=49152 write bar - offset=98304 length=49152 write bar - offset=147456 length=49152 write bar - offset=196608 length=49152 write bar - offset=245760 length=49152 write bar - offset=294912 length=49152 write bar - offset=344064 length=49152 write bar - offset=393216 length=49152 write bar - offset=442368 length=49152 write bar - offset=491520 length=49152 write bar - offset=540672 length=49152 write bar - offset=589824 length=49152 write bar - offset=638976 length=49152 write bar - offset=688128 length=49152 write bar - offset=737280 length=49152 write bar - offset=786432 length=49152 write bar - offset=835584 length=49152 write bar - offset=884736 length=49152 write bar - offset=933888 length=49152 write bar - offset=983040 length=49152 write bar - offset=1032192 length=16389 chown bar - uid=0, gid=0 chmod bar - mode=0644 utimes bar utimes BTRFS_IOC_SET_RECEIVED_SUBVOL uuid=06d640da-9ca1-604c-b87c-3375175a8eb3, stransid=7 /mnt/sdi/snap/bar: EXT: FILE-OFFSET BLOCK-RANGE TOTAL FLAGS 0: [0..2055]: 26624..28679 2056 0x1 There's no clone operation to clone extents from the file foo into file bar and fiemap confirms there's no shared flag (0x2000). So update send_write_or_clone() so that it proceeds with cloning if the source and destination ranges end at the i_size of the respective files. After this changes the result of the test is: (...) mkfile o258-7-0 rename o258-7-0 -> bar clone bar - source=foo source offset=0 offset=0 length=1048581 chown bar - uid=0, gid=0 chmod bar - mode=0644 utimes bar utimes BTRFS_IOC_SET_RECEIVED_SUBVOL uuid=582420f3-ea7d-564e-bbe5-ce440d622190, stransid=7 /mnt/sdi/snap/bar: EXT: FILE-OFFSET BLOCK-RANGE TOTAL FLAGS 0: [0..2055]: 26624..28679 2056 0x2001 A test case for fstests will also follow up soon. Link: https://github.com/kdave/btrfs-progs/issues/572#issuecomment-2282841416 CC: stable@vger.kernel.org # 5.10+ Reviewed-by: Qu Wenruo Signed-off-by: Filipe Manana Reviewed-by: David Sterba Signed-off-by: David Sterba fs/btrfs/send.c | 52 +++++++++++++++++++++++++++++++++++++++------------- 1 file changed, 39 insertions(+), 13 deletions(-) commit 71bf41b8e913ec9fc91f0d39ab8fb320229ec604 Author: Rafael J. Wysocki Date: Mon Aug 12 15:16:21 2024 +0200 ACPI: EC: Evaluate _REG outside the EC scope more carefully Commit 60fa6ae6e6d0 ("ACPI: EC: Install address space handler at the namespace root") caused _REG methods for EC operation regions outside the EC device scope to be evaluated which on some systems leads to the evaluation of _REG methods in the scopes of device objects representing devices that are not present and not functional according to the _STA return values. Some of those device objects represent EC "alternatives" and if _REG is evaluated for their operation regions, the platform firmware may be confused and the platform may start to behave incorrectly. To avoid this problem, only evaluate _REG for EC operation regions located in the scopes of device objects representing known-to-be-present devices. For this purpose, partially revert commit 60fa6ae6e6d0 and trigger the evaluation of _REG for EC operation regions from acpi_bus_attach() for the known-valid devices. Fixes: 60fa6ae6e6d0 ("ACPI: EC: Install address space handler at the namespace root") Link: https://lore.kernel.org/linux-acpi/1f76b7e2-1928-4598-8037-28a1785c2d13@redhat.com Link: https://bugzilla.redhat.com/show_bug.cgi?id=2298938 Link: https://bugzilla.redhat.com/show_bug.cgi?id=2302253 Reported-by: Hans de Goede Signed-off-by: Rafael J. Wysocki Reviewed-by: Hans de Goede Cc: All applicable Link: https://patch.msgid.link/23612351.6Emhk5qWAg@rjwysocki.net drivers/acpi/ec.c | 11 +++++++++-- drivers/acpi/internal.h | 1 + drivers/acpi/scan.c | 2 ++ 3 files changed, 12 insertions(+), 2 deletions(-) commit cdf65d73e001fde600b18d7e45afadf559425ce5 Author: Rafael J. Wysocki Date: Mon Aug 12 15:11:42 2024 +0200 ACPICA: Add a depth argument to acpi_execute_reg_methods() A subsequent change will need to pass a depth argument to acpi_execute_reg_methods(), so prepare that function for it. No intentional functional changes. Signed-off-by: Rafael J. Wysocki Reviewed-by: Hans de Goede Cc: All applicable Link: https://patch.msgid.link/8451567.NyiUUSuA9g@rjwysocki.net drivers/acpi/acpica/acevents.h | 2 +- drivers/acpi/acpica/evregion.c | 6 ++++-- drivers/acpi/acpica/evxfregn.c | 10 +++++++--- drivers/acpi/ec.c | 2 +- include/acpi/acpixf.h | 1 + 5 files changed, 14 insertions(+), 7 deletions(-) commit 5d61841c74db8b5bbbf9403f1bd4879f614617d2 Author: Sean Anderson Date: Fri Aug 9 16:15:39 2024 -0400 spi: zynqmp-gqspi: Scale timeout by data size Large blocks of data time out when reading because we don't wait long enough for the transfer to complete. Scale our timeouts based on the amount of data we are tranferring, with a healthy dose of pessimism. Signed-off-by: Sean Anderson Link: https://patch.msgid.link/20240809201540.3363243-1-sean.anderson@linux.dev Signed-off-by: Mark Brown drivers/spi/spi-zynqmp-gqspi.c | 30 ++++++++++++++++++++++++------ 1 file changed, 24 insertions(+), 6 deletions(-) commit 779bac9994452f6a894524f70c00cfb0cd4b6364 Author: Rafael J. Wysocki Date: Mon Aug 12 15:08:04 2024 +0200 Revert "ACPI: EC: Evaluate orphan _REG under EC device" This reverts commit 0e6b6dedf168 ("Revert "ACPI: EC: Evaluate orphan _REG under EC device") because the problem addressed by it will be addressed differently in what follows. Signed-off-by: Rafael J. Wysocki Reviewed-by: Hans de Goede Cc: All applicable Link: https://patch.msgid.link/3236716.5fSG56mABF@rjwysocki.net drivers/acpi/acpica/acevents.h | 4 ---- drivers/acpi/acpica/evregion.c | 6 ++++- drivers/acpi/acpica/evxfregn.c | 54 ------------------------------------------ drivers/acpi/ec.c | 3 --- include/acpi/acpixf.h | 4 ---- 5 files changed, 5 insertions(+), 66 deletions(-) commit ae1e766f623f7a2a889a0b09eb076dd9a60efbe9 Author: Filipe Manana Date: Sun Aug 11 11:53:42 2024 +0100 btrfs: only run the extent map shrinker from kswapd tasks Currently the extent map shrinker can be run by any task when attempting to allocate memory and there's enough memory pressure to trigger it. To avoid too much latency we stop iterating over extent maps and removing them once the task needs to reschedule. This logic was introduced in commit b3ebb9b7e92a ("btrfs: stop extent map shrinker if reschedule is needed"). While that solved high latency problems for some use cases, it's still not enough because with a too high number of tasks entering the extent map shrinker code, either due to memory allocations or because they are a kswapd task, we end up having a very high level of contention on some spin locks, namely: 1) The fs_info->fs_roots_radix_lock spin lock, which we need to find roots to iterate over their inodes; 2) The spin lock of the xarray used to track open inodes for a root (struct btrfs_root::inodes) - on 6.10 kernels and below, it used to be a red black tree and the spin lock was root->inode_lock; 3) The fs_info->delayed_iput_lock spin lock since the shrinker adds delayed iputs (calls btrfs_add_delayed_iput()). Instead of allowing the extent map shrinker to be run by any task, make it run only by kswapd tasks. This still solves the problem of running into OOM situations due to an unbounded extent map creation, which is simple to trigger by direct IO writes, as described in the changelog of commit 956a17d9d050 ("btrfs: add a shrinker for extent maps"), and by a similar case when doing buffered IO on files with a very large number of holes (keeping the file open and creating many holes, whose extent maps are only released when the file is closed). Reported-by: kzd Link: https://bugzilla.kernel.org/show_bug.cgi?id=219121 Reported-by: Octavia Togami Link: https://lore.kernel.org/linux-btrfs/CAHPNGSSt-a4ZZWrtJdVyYnJFscFjP9S7rMcvEMaNSpR556DdLA@mail.gmail.com/ Fixes: 956a17d9d050 ("btrfs: add a shrinker for extent maps") CC: stable@vger.kernel.org # 6.10+ Tested-by: kzd Tested-by: Octavia Togami Signed-off-by: Filipe Manana Reviewed-by: David Sterba Signed-off-by: David Sterba fs/btrfs/extent_map.c | 22 ++++++---------------- fs/btrfs/super.c | 10 ++++++++++ 2 files changed, 16 insertions(+), 16 deletions(-) commit 8475a1d9bb7acf1cb15842dd24baab0e8ea4e4ff Author: Richard Fitzgerald Date: Tue Aug 13 12:32:09 2024 +0100 ALSA: hda: cs35l41: Remove redundant call to hda_cs_dsp_control_remove() The driver doesn't create any ALSA controls for firmware controls, so it shouldn't be calling hda_cs_dsp_control_remove(). commit 312c04cee408 ("ALSA: hda: cs35l41: Stop creating ALSA Controls for firmware coefficients") removed the call to hda_cs_dsp_add_controls() but didn't remove the call for destroying those controls. Signed-off-by: Richard Fitzgerald Fixes: 312c04cee408 ("ALSA: hda: cs35l41: Stop creating ALSA Controls for firmware coefficients") Link: https://patch.msgid.link/20240813113209.648-1-rf@opensource.cirrus.com Signed-off-by: Takashi Iwai sound/pci/hda/cs35l41_hda.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 31723c9542dba1681cc3720571fdf12ffe0eddd9 Author: Qu Wenruo Date: Mon Aug 12 08:52:44 2024 +0930 btrfs: tree-checker: reject BTRFS_FT_UNKNOWN dir type [REPORT] There is a bug report that kernel is rejecting a mismatching inode mode and its dir item: [ 1881.553937] BTRFS critical (device dm-0): inode mode mismatch with dir: inode mode=040700 btrfs type=2 dir type=0 [CAUSE] It looks like the inode mode is correct, while the dir item type 0 is BTRFS_FT_UNKNOWN, which should not be generated by btrfs at all. This may be caused by a memory bit flip. [ENHANCEMENT] Although tree-checker is not able to do any cross-leaf verification, for this particular case we can at least reject any dir type with BTRFS_FT_UNKNOWN. So here we enhance the dir type check from [0, BTRFS_FT_MAX), to (0, BTRFS_FT_MAX). Although the existing corruption can not be fixed just by such enhanced checking, it should prevent the same 0x2->0x0 bitflip for dir type to reach disk in the future. Reported-by: Kota Link: https://lore.kernel.org/linux-btrfs/CACsxjPYnQF9ZF-0OhH16dAx50=BXXOcP74MxBc3BG+xae4vTTw@mail.gmail.com/ CC: stable@vger.kernel.org # 5.4+ Signed-off-by: Qu Wenruo Signed-off-by: David Sterba fs/btrfs/tree-checker.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) commit 42fac187b5c746227c92d024f1caf33bc1d337e4 Author: Josef Bacik Date: Thu Apr 11 16:41:20 2024 -0400 btrfs: check delayed refs when we're checking if a ref exists In the patch 78c52d9eb6b7 ("btrfs: check for refs on snapshot delete resume") I added some code to handle file systems that had been corrupted by a bug that incorrectly skipped updating the drop progress key while dropping a snapshot. This code would check to see if we had already deleted our reference for a child block, and skip the deletion if we had already. Unfortunately there is a bug, as the check would only check the on-disk references. I made an incorrect assumption that blocks in an already deleted snapshot that was having the deletion resume on mount wouldn't be modified. If we have 2 pending deleted snapshots that share blocks, we can easily modify the rules for a block. Take the following example subvolume a exists, and subvolume b is a snapshot of subvolume a. They share references to block 1. Block 1 will have 2 full references, one for subvolume a and one for subvolume b, and it belongs to subvolume a (btrfs_header_owner(block 1) == subvolume a). When deleting subvolume a, we will drop our full reference for block 1, and because we are the owner we will drop our full reference for all of block 1's children, convert block 1 to FULL BACKREF, and add a shared reference to all of block 1's children. Then we will start the snapshot deletion of subvolume b. We look up the extent info for block 1, which checks delayed refs and tells us that FULL BACKREF is set, so sets parent to the bytenr of block 1. However because this is a resumed snapshot deletion, we call into check_ref_exists(). Because check_ref_exists() only looks at the disk, it doesn't find the shared backref for the child of block 1, and thus returns 0 and we skip deleting the reference for the child of block 1 and continue. This orphans the child of block 1. The fix is to lookup the delayed refs, similar to what we do in btrfs_lookup_extent_info(). However we only care about whether the reference exists or not. If we fail to find our reference on disk, go look up the bytenr in the delayed refs, and if it exists look for an existing ref in the delayed ref head. If that exists then we know we can delete the reference safely and carry on. If it doesn't exist we know we have to skip over this block. This bug has existed since I introduced this fix, however requires having multiple deleted snapshots pending when we unmount. We noticed this in production because our shutdown path stops the container on the system, which deletes a bunch of subvolumes, and then reboots the box. This gives us plenty of opportunities to hit this issue. Looking at the history we've seen this occasionally in production, but we had a big spike recently thanks to faster machines getting jobs with multiple subvolumes in the job. Chris Mason wrote a reproducer which does the following mount /dev/nvme4n1 /btrfs btrfs subvol create /btrfs/s1 simoop -E -f 4k -n 200000 -z /btrfs/s1 while(true) ; do btrfs subvol snap /btrfs/s1 /btrfs/s2 simoop -f 4k -n 200000 -r 10 -z /btrfs/s2 btrfs subvol snap /btrfs/s2 /btrfs/s3 btrfs balance start -dusage=80 /btrfs btrfs subvol del /btrfs/s2 /btrfs/s3 umount /btrfs btrfsck /dev/nvme4n1 || exit 1 mount /dev/nvme4n1 /btrfs done On the second loop this would fail consistently, with my patch it has been running for hours and hasn't failed. I also used dm-log-writes to capture the state of the failure so I could debug the problem. Using the existing failure case to test my patch validated that it fixes the problem. Fixes: 78c52d9eb6b7 ("btrfs: check for refs on snapshot delete resume") CC: stable@vger.kernel.org # 5.4+ Reviewed-by: Filipe Manana Signed-off-by: Josef Bacik Signed-off-by: David Sterba fs/btrfs/delayed-ref.c | 67 ++++++++++++++++++++++++++++++++++++++++++++++++++ fs/btrfs/delayed-ref.h | 2 ++ fs/btrfs/extent-tree.c | 51 +++++++++++++++++++++++++++++++++----- 3 files changed, 114 insertions(+), 6 deletions(-) commit b919a27fab37e108164d657ac6e77bf870bf95e6 Author: Krzysztof Kozlowski Date: Tue Jul 30 12:35:11 2024 +0200 ASoC: MAINTAINERS: Drop Banajit Goswami from Qualcomm sound drivers There was no active maintenance from Banajit Goswami - last email is from 2019 - so make obvious that Qualcomm sound drivers are maintained by only one person. Signed-off-by: Krzysztof Kozlowski Link: https://patch.msgid.link/20240730103511.21728-1-krzysztof.kozlowski@linaro.org Signed-off-by: Mark Brown MAINTAINERS | 1 - 1 file changed, 1 deletion(-) commit 897e91e995b338002b00454fd0018af26a098148 Author: Vijendar Mukunda Date: Tue Aug 13 16:29:44 2024 +0530 ASoC: SOF: amd: Fix for incorrect acp error register offsets Addition of 'dsp_intr_base' to ACP error register offsets points to wrong register offsets in irq handler. Correct the acp error register offsets. ACP error status register offset and acp error reason register offset got changed from ACP6.0 onwards. Add 'acp_error_stat' and 'acp_sw0_i2s_err_reason' as descriptor fields in sof_amd_acp_desc structure and update the values based on the ACP variant. >From Rembrandt platform onwards, errors related to SW1 Soundwire manager instance/I2S controller connected on P1 power tile is reported with ACP_SW1_I2S_ERROR_REASON register. Add conditional check for the same. Fixes: 96eb81851012 ("ASoC: SOF: amd: add interrupt handling for SoundWire manager devices") Signed-off-by: Vijendar Mukunda Link: https://patch.msgid.link/20240813105944.3126903-2-Vijendar.Mukunda@amd.com Signed-off-by: Mark Brown sound/soc/sof/amd/acp-dsp-offset.h | 6 ++++-- sound/soc/sof/amd/acp.c | 11 +++++++---- sound/soc/sof/amd/acp.h | 2 ++ sound/soc/sof/amd/pci-acp63.c | 2 ++ sound/soc/sof/amd/pci-rmb.c | 2 ++ sound/soc/sof/amd/pci-rn.c | 2 ++ 6 files changed, 19 insertions(+), 6 deletions(-) commit c56ba3e44784527fd6efe5eb7a4fa6c9f6969a58 Author: Vijendar Mukunda Date: Tue Aug 13 16:29:43 2024 +0530 ASoC: SOF: amd: move iram-dram fence register programming sequence The existing code modifies IRAM and DRAM size after sha dma start for vangogh platform. The problem with this sequence is that it might cause sha dma failure when firmware code binary size is greater than the default IRAM size. To fix this issue, Move the iram-dram fence register sequence prior to sha dma start. Fixes: 094d11768f74 ("ASoC: SOF: amd: Skip IRAM/DRAM size modification for Steam Deck OLED") Signed-off-by: Vijendar Mukunda Link: https://patch.msgid.link/20240813105944.3126903-1-Vijendar.Mukunda@amd.com Signed-off-by: Mark Brown sound/soc/sof/amd/acp.c | 22 +++++++++++----------- 1 file changed, 11 insertions(+), 11 deletions(-) commit 12d82c7b0a612372f594e4ff00983a1da3a1d929 Author: Richard Fitzgerald Date: Tue Aug 13 12:07:50 2024 +0100 ALSA: hda: cs35l56: Remove redundant call to hda_cs_dsp_control_remove() The driver doesn't create any ALSA controls for firmware controls, so it shouldn't be calling hda_cs_dsp_control_remove(). commit 34e1b1bb7324 ("ALSA: hda: cs35l56: Stop creating ALSA controls for firmware coefficients") removed the call to hda_cs_dsp_add_controls() but didn't remove the call for destroying those controls. Signed-off-by: Richard Fitzgerald Fixes: 34e1b1bb7324 ("ALSA: hda: cs35l56: Stop creating ALSA controls for firmware coefficients") Link: https://patch.msgid.link/20240813110750.2814-1-rf@opensource.cirrus.com Signed-off-by: Takashi Iwai sound/pci/hda/cs35l56_hda.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 58a63729c957621f1990c3494c702711188ca347 Author: Long Li Date: Fri Aug 9 08:58:58 2024 -0700 net: mana: Fix doorbell out of order violation and avoid unnecessary doorbell rings After napi_complete_done() is called when NAPI is polling in the current process context, another NAPI may be scheduled and start running in softirq on another CPU and may ring the doorbell before the current CPU does. When combined with unnecessary rings when there is no need to arm the CQ, it triggers error paths in the hardware. This patch fixes this by calling napi_complete_done() after doorbell rings. It limits the number of unnecessary rings when there is no need to arm. MANA hardware specifies that there must be one doorbell ring every 8 CQ wraparounds. This driver guarantees one doorbell ring as soon as the number of consumed CQEs exceeds 4 CQ wraparounds. In practical workloads, the 4 CQ wraparounds proves to be big enough that it rarely exceeds this limit before all the napi weight is consumed. To implement this, add a per-CQ counter cq->work_done_since_doorbell, and make sure the CQ is armed as soon as passing 4 wraparounds of the CQ. Cc: stable@vger.kernel.org Fixes: e1b5683ff62e ("net: mana: Move NAPI from EQ to CQ") Reviewed-by: Haiyang Zhang Signed-off-by: Long Li Link: https://patch.msgid.link/1723219138-29887-1-git-send-email-longli@linuxonhyperv.com Signed-off-by: Paolo Abeni drivers/net/ethernet/microsoft/mana/mana_en.c | 24 +++++++++++++++--------- include/net/mana/mana.h | 1 + 2 files changed, 16 insertions(+), 9 deletions(-) commit cd2d00606553e631e9b5d11cca7da38fc95433e6 Author: Dan Carpenter Date: Wed Jun 12 14:50:39 2024 +0300 KVM: SVM: Fix an error code in sev_gmem_post_populate() The copy_from_user() function returns the number of bytes which it was not able to copy. Return -EFAULT instead. Fixes: dee5a47cc7a4 ("KVM: SEV: Add KVM_SEV_SNP_LAUNCH_UPDATE command") Signed-off-by: Dan Carpenter Message-ID: <20240612115040.2423290-4-dan.carpenter@linaro.org> Signed-off-by: Paolo Bonzini arch/x86/kvm/svm/sev.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) commit 696eb24ac2af632ddcb422114b2d8498af1de20c Merge: 747cfbf161a5 cff59d8631e1 Author: Paolo Bonzini Date: Tue Aug 13 06:07:03 2024 -0400 Merge tag 'kvm-s390-master-6.11-1' of https://git.kernel.org/pub/scm/linux/kernel/git/kvms390/linux into HEAD Fix invalid gisa designation value when gisa is not in use. Panic if (un)share fails to maintain security. commit 747cfbf161a5bc292ce194bfce6ab1a2d5e60b40 Merge: 92b6c2f0076c 9eb18136af9f Author: Paolo Bonzini Date: Tue Aug 13 06:06:27 2024 -0400 Merge tag 'kvmarm-fixes-6.11-1' of git://git.kernel.org/pub/scm/linux/kernel/git/kvmarm/kvmarm into HEAD KVM/arm64 fixes for 6.11, round #1 - Use kvfree() for the kvmalloc'd nested MMUs array - Set of fixes to address warnings in W=1 builds - Make KVM depend on assembler support for ARMv8.4 - Fix for vgic-debug interface for VMs without LPIs - Actually check ID_AA64MMFR3_EL1.S1PIE in get-reg-list selftest - Minor code / comment cleanups for configuring PAuth traps - Take kvm->arch.config_lock to prevent destruction / initialization race for a vCPU's CPUIF which may lead to a UAF commit 92b6c2f0076c50aaa919d16b595f34f3e9967bea Author: Dan Carpenter Date: Wed Jun 12 14:50:38 2024 +0300 KVM: SVM: Fix uninitialized variable bug If snp_lookup_rmpentry() fails then "assigned" is printed in the error message but it was never initialized. Initialize it to false. Fixes: dee5a47cc7a4 ("KVM: SEV: Add KVM_SEV_SNP_LAUNCH_UPDATE command") Signed-off-by: Dan Carpenter Message-ID: <20240612115040.2423290-3-dan.carpenter@linaro.org> Signed-off-by: Paolo Bonzini arch/x86/kvm/svm/sev.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit e37a9184f27084b891d3617723b9410f8fcaff99 Merge: 38c8d02501c0 38055789d151 Author: Kalle Valo Date: Tue Aug 13 12:51:21 2024 +0300 Merge tag 'ath-current-20240812' of git://git.kernel.org/pub/scm/linux/kernel/git/ath/ath ath.git patch for v6.11 We have a single patch for the next 6.11-rc which introduces a workaround to ath12k which addresses a WCN7850 hardware issue that prevents proper operation with unaligned transmit buffers. commit 38c8d02501c09454e4fbf0f67de03de35e94d384 Author: Benjamin Berg Date: Mon Aug 12 13:06:40 2024 +0200 wifi: iwlwifi: correctly lookup DMA address in SG table The code to lookup the scatter gather table entry assumed that it was possible to use sg_virt() in order to lookup the DMA address in a mapped scatter gather table. However, this assumption is incorrect as the DMA mapping code may merge multiple entries into one. In that case, the DMA address space may have e.g. two consecutive pages which is correctly represented by the scatter gather list entry, however the virtual addresses for these two pages may differ and the relationship cannot be resolved anymore. Avoid this problem entirely by working with the offset into the mapped area instead of using virtual addresses. With that we only use the DMA length and DMA address from the scatter gather list entries. The underlying DMA/IOMMU code is therefore free to merge two entries into one even if the virtual addresses space for the area is not continuous. Fixes: 90db50755228 ("wifi: iwlwifi: use already mapped data when TXing an AMSDU") Reported-by: Chris Bainbridge Closes: https://lore.kernel.org/r/ZrNRoEbdkxkKFMBi@debian.local Signed-off-by: Benjamin Berg Tested-by: Chris Bainbridge Signed-off-by: Kalle Valo Link: https://patch.msgid.link/20240812110640.460514-1-benjamin@sipsolutions.net drivers/net/wireless/intel/iwlwifi/pcie/internal.h | 3 +- drivers/net/wireless/intel/iwlwifi/pcie/tx-gen2.c | 5 +++- drivers/net/wireless/intel/iwlwifi/pcie/tx.c | 32 +++++++++++++++------- 3 files changed, 28 insertions(+), 12 deletions(-) commit 479ffee68d59c599f8aed8fa2dcc8e13e7bd13c3 Author: Bert Karwatzki Date: Mon Aug 12 12:45:41 2024 +0200 wifi: mt76: mt7921: fix NULL pointer access in mt7921_ipv6_addr_change When disabling wifi mt7921_ipv6_addr_change() is called as a notifier. At this point mvif->phy is already NULL so we cannot use it here. Signed-off-by: Bert Karwatzki Signed-off-by: Felix Fietkau Signed-off-by: Kalle Valo Link: https://patch.msgid.link/20240812104542.80760-1-spasswolf@web.de drivers/net/wireless/mediatek/mt76/mt7921/main.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit cdd1fa91a6b8c7cd93b3abf9f3ef05b8ce741b61 Author: Bart Van Assche Date: Mon Aug 5 16:20:21 2024 -0700 mips: sgi-ip22: Fix the build Fix a recently introduced build failure. Fixes: d69d80484598 ("driver core: have match() callback in struct bus_type take a const *") Signed-off-by: Bart Van Assche Link: https://lore.kernel.org/r/20240805232026.65087-3-bvanassche@acm.org Signed-off-by: Greg Kroah-Hartman arch/mips/sgi-ip22/ip22-gio.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit abfceba0a7a246ac082bf569807738ff7416f59f Author: Bart Van Assche Date: Mon Aug 5 16:20:20 2024 -0700 ARM: riscpc: ecard: Fix the build Fix a recently introduced build failure. Cc: Russell King Fixes: d69d80484598 ("driver core: have match() callback in struct bus_type take a const *") Signed-off-by: Bart Van Assche Link: https://lore.kernel.org/r/20240805232026.65087-2-bvanassche@acm.org Signed-off-by: Greg Kroah-Hartman arch/arm/mach-rpc/ecard.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit c9f6613b16123989f2c3bd04b1d9b2365d6914e7 Author: Mathieu Othacehe Date: Thu Aug 8 08:06:37 2024 +0200 tty: atmel_serial: use the correct RTS flag. In RS485 mode, the RTS pin is driven high by hardware when the transmitter is operating. This behaviour cannot be changed. This means that the driver should claim that it supports SER_RS485_RTS_ON_SEND and not SER_RS485_RTS_AFTER_SEND. Otherwise, when configuring the port with the SER_RS485_RTS_ON_SEND, one get the following warning: kern.warning kernel: atmel_usart_serial atmel_usart_serial.2.auto: ttyS1 (1): invalid RTS setting, using RTS_AFTER_SEND instead which is contradictory with what's really happening. Signed-off-by: Mathieu Othacehe Cc: stable Tested-by: Alexander Dahl Fixes: af47c491e3c7 ("serial: atmel: Fill in rs485_supported") Link: https://lore.kernel.org/r/20240808060637.19886-1-othacehe@gnu.org Signed-off-by: Greg Kroah-Hartman drivers/tty/serial/atmel_serial.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 7258fdd7d7459616b3fe1a603e33900584b10c13 Author: Masahiro Yamada Date: Sat Aug 10 01:07:20 2024 +0900 tty: vt: conmakehash: remove non-portable code printing comment header Commit 6e20753da6bc ("tty: vt: conmakehash: cope with abs_srctree no longer in env") included , which invoked another (wrong) patch that tried to address a build error on macOS. According to the specification [1], the correct header to use PATH_MAX is . The minimal fix would be to replace with . However, the following commits seem questionable to me: - 3bd85c6c97b2 ("tty: vt: conmakehash: Don't mention the full path of the input in output") - 6e20753da6bc ("tty: vt: conmakehash: cope with abs_srctree no longer in env") These commits made too many efforts to cope with a comment header in drivers/tty/vt/consolemap_deftbl.c: /* * Do not edit this file; it was automatically generated by * * conmakehash drivers/tty/vt/cp437.uni > [this file] * */ With this commit, the header part of the generate C file will be simplified as follows: /* * Automatically generated file; Do not edit. */ BTW, another series of excessive efforts for a comment header can be seen in the following: - 5ef6dc08cfde ("lib/build_OID_registry: don't mention the full path of the script in output") - 2fe29fe94563 ("lib/build_OID_registry: avoid non-destructive substitution for Perl < 5.13.2 compat") [1]: https://pubs.opengroup.org/onlinepubs/009695399/basedefs/limits.h.html Fixes: 6e20753da6bc ("tty: vt: conmakehash: cope with abs_srctree no longer in env") Cc: stable Reported-by: Daniel Gomez Closes: https://lore.kernel.org/all/20240807-macos-build-support-v1-11-4cd1ded85694@samsung.com/ Signed-off-by: Masahiro Yamada Link: https://lore.kernel.org/r/20240809160853.1269466-1-masahiroy@kernel.org Signed-off-by: Greg Kroah-Hartman drivers/tty/vt/conmakehash.c | 12 ++---------- 1 file changed, 2 insertions(+), 10 deletions(-) commit dc98d76a15bc29a9a4e76f2f65f39f3e590fb15c Author: Peng Fan Date: Thu Aug 8 22:03:25 2024 +0800 tty: serial: fsl_lpuart: mark last busy before uart_add_one_port With "earlycon initcall_debug=1 loglevel=8" in bootargs, kernel sometimes boot hang. It is because normal console still is not ready, but runtime suspend is called, so early console putchar will hang in waiting TRDE set in UARTSTAT. The lpuart driver has auto suspend delay set to 3000ms, but during uart_add_one_port, a child device serial ctrl will added and probed with its pm runtime enabled(see serial_ctrl.c). The runtime suspend call path is: device_add |-> bus_probe_device |->device_initial_probe |->__device_attach |-> pm_runtime_get_sync(dev->parent); |-> pm_request_idle(dev); |-> pm_runtime_put(dev->parent); So in the end, before normal console ready, the lpuart get runtime suspended. And earlycon putchar will hang. To address the issue, mark last busy just after pm_runtime_enable, three seconds is long enough to switch from bootconsole to normal console. Fixes: 43543e6f539b ("tty: serial: fsl_lpuart: Add runtime pm support") Cc: stable Signed-off-by: Peng Fan Link: https://lore.kernel.org/r/20240808140325.580105-1-peng.fan@oss.nxp.com Signed-off-by: Greg Kroah-Hartman drivers/tty/serial/fsl_lpuart.c | 1 + 1 file changed, 1 insertion(+) commit 92567a5f92bc947fb7aa4351979db1b7b71a554c Author: Yue Haibing Date: Thu Aug 8 22:06:19 2024 +0800 iommu: Remove unused declaration iommu_sva_unbind_gpasid() Commit 0c9f17877891 ("iommu: Remove guest pasid related interfaces and definitions") removed the implementation but leave declaration. Signed-off-by: Yue Haibing Reviewed-by: Lu Baolu Reviewed-by: Jason Gunthorpe Link: https://lore.kernel.org/r/20240808140619.2498535-1-yuehaibing@huawei.com Signed-off-by: Joerg Roedel include/linux/iommu.h | 2 -- 1 file changed, 2 deletions(-) commit f149be46e4c13e277e013c0fff13cb2aa7a4399c Author: Frank Li Date: Wed Aug 7 10:52:09 2024 -0400 arm64: dts: imx8mm-phygate: fix typo pinctrcl-0 Fix typo pinctrcl-0 with pinctrl-0. Fix below warning: arch/arm64/boot/dts/freescale/imx8mm-phygate-tauri-l-rs232-rs485.dtb: gpio@30220000: 'pinctrl-0' is a dependency of 'pinctrl-names' from schema $id: http://devicetree.org/schemas/pinctrl/pinctrl-consumer.yaml# arch/arm64/boot/dts/freescale/imx8mm-phygate-tauri-l-rs232-rs485.dtb: uart4_rs485_en: $nodename:0: 'uart4_rs485_en' does not match '^(hog-[0-9]+|.+-hog(-[0-9]+)?)$ Fixes: 8d97083c0b5d ("arm64: dts: phygate-tauri-l: add overlays for RS232 and RS485") Reviewed-by: Teresa Remmet Signed-off-by: Frank Li Signed-off-by: Shawn Guo arch/arm64/boot/dts/freescale/imx8mm-phygate-tauri-l-rs232-rs232.dtso | 2 +- arch/arm64/boot/dts/freescale/imx8mm-phygate-tauri-l-rs232-rs485.dtso | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) commit 3ed486e383ccee9b0c8d727608f12a937c6603ca Author: Hans de Goede Date: Mon Aug 12 11:50:38 2024 +0200 usb: misc: ljca: Add Lunar Lake ljca GPIO HID to ljca_gpio_hids[] Add LJCA GPIO support for the Lunar Lake platform. New HID taken from out of tree ivsc-driver git repo. Link: https://github.com/intel/ivsc-driver/commit/47e7c4a446c8ea8c741ff5a32fa7b19f9e6fd47e Cc: stable Signed-off-by: Hans de Goede Link: https://lore.kernel.org/r/20240812095038.555837-1-hdegoede@redhat.com Signed-off-by: Greg Kroah-Hartman drivers/usb/misc/usb-ljca.c | 1 + 1 file changed, 1 insertion(+) commit 21ea1ce37fc267dc45fe27517bbde926211683df Author: Xu Yang Date: Fri Aug 9 19:29:01 2024 +0800 Revert "usb: typec: tcpm: clear pd_event queue in PORT_RESET" This reverts commit bf20c69cf3cf9c6445c4925dd9a8a6ca1b78bfdf. During tcpm_init() stage, if the VBUS is still present after tcpm_reset_port(), then we assume that VBUS will off and goto safe0v after a specific discharge time. Following a TCPM_VBUS_EVENT event if VBUS reach to off state. TCPM_VBUS_EVENT event may be set during PORT_RESET handling stage. If pd_events reset to 0 after TCPM_VBUS_EVENT set, we will lost this VBUS event. Then the port state machine may stuck at one state. Before: [ 2.570172] pending state change PORT_RESET -> PORT_RESET_WAIT_OFF @ 100 ms [rev1 NONE_AMS] [ 2.570179] state change PORT_RESET -> PORT_RESET_WAIT_OFF [delayed 100 ms] [ 2.570182] pending state change PORT_RESET_WAIT_OFF -> SNK_UNATTACHED @ 920 ms [rev1 NONE_AMS] [ 3.490213] state change PORT_RESET_WAIT_OFF -> SNK_UNATTACHED [delayed 920 ms] [ 3.490220] Start toggling [ 3.546050] CC1: 0 -> 0, CC2: 0 -> 2 [state TOGGLING, polarity 0, connected] [ 3.546057] state change TOGGLING -> SRC_ATTACH_WAIT [rev1 NONE_AMS] After revert this patch, we can see VBUS off event and the port will goto expected state. [ 2.441992] pending state change PORT_RESET -> PORT_RESET_WAIT_OFF @ 100 ms [rev1 NONE_AMS] [ 2.441999] state change PORT_RESET -> PORT_RESET_WAIT_OFF [delayed 100 ms] [ 2.442002] pending state change PORT_RESET_WAIT_OFF -> SNK_UNATTACHED @ 920 ms [rev1 NONE_AMS] [ 2.442122] VBUS off [ 2.442125] state change PORT_RESET_WAIT_OFF -> SNK_UNATTACHED [rev1 NONE_AMS] [ 2.442127] VBUS VSAFE0V [ 2.442351] CC1: 0 -> 0, CC2: 0 -> 0 [state SNK_UNATTACHED, polarity 0, disconnected] [ 2.442357] Start toggling [ 2.491850] CC1: 0 -> 0, CC2: 0 -> 2 [state TOGGLING, polarity 0, connected] [ 2.491858] state change TOGGLING -> SRC_ATTACH_WAIT [rev1 NONE_AMS] [ 2.491863] pending state change SRC_ATTACH_WAIT -> SNK_TRY @ 200 ms [rev1 NONE_AMS] [ 2.691905] state change SRC_ATTACH_WAIT -> SNK_TRY [delayed 200 ms] Fixes: bf20c69cf3cf ("usb: typec: tcpm: clear pd_event queue in PORT_RESET") Cc: stable@vger.kernel.org Signed-off-by: Xu Yang Acked-by: Heikki Krogerus Link: https://lore.kernel.org/r/20240809112901.535072-1-xu.yang_2@nxp.com Signed-off-by: Greg Kroah-Hartman drivers/usb/typec/tcpm/tcpm.c | 1 - 1 file changed, 1 deletion(-) commit d209d1634e6562eafc369b28f8a1f67a2e9e5222 Author: Heikki Krogerus Date: Fri Aug 9 18:03:43 2024 +0300 usb: typec: ucsi: Fix the return value of ucsi_run_command() The command execution routines need to return the amount of data that was transferred when succesful. This fixes an issue where the alternate modes and the power delivery capabilities are not getting registered. Fixes: 5e9c1662a89b ("usb: typec: ucsi: rework command execution functions") Signed-off-by: Heikki Krogerus Link: https://lore.kernel.org/r/20240809150343.286942-1-heikki.krogerus@linux.intel.com Signed-off-by: Greg Kroah-Hartman drivers/usb/typec/ucsi/ucsi.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 741b41b48faf41c0bcf3c26fbb3448b0fda4fc5d Author: Niklas Neronin Date: Fri Aug 9 15:44:08 2024 +0300 usb: xhci: fix duplicate stall handling in handle_tx_event() Stall handling is managed in the 'process_*' functions, which are called right before the 'goto' stall handling code snippet. Thus, there should be a return after the 'process_*' functions. Otherwise, the stall code may run twice. Fixes: 1b349f214ac7 ("usb: xhci: add 'goto' for halted endpoint check in handle_tx_event()") Reported-by: Michal Pecio Signed-off-by: Niklas Neronin Signed-off-by: Mathias Nyman Link: https://lore.kernel.org/r/20240809124408.505786-3-mathias.nyman@linux.intel.com Signed-off-by: Greg Kroah-Hartman drivers/usb/host/xhci-ring.c | 1 + 1 file changed, 1 insertion(+) commit dcdb52d948f3a17ccd3fce757d9bd981d7c32039 Author: Marc Zyngier Date: Fri Aug 9 15:44:07 2024 +0300 usb: xhci: Check for xhci->interrupters being allocated in xhci_mem_clearup() If xhci_mem_init() fails, it calls into xhci_mem_cleanup() to mop up the damage. If it fails early enough, before xhci->interrupters is allocated but after xhci->max_interrupters has been set, which happens in most (all?) cases, things get uglier, as xhci_mem_cleanup() unconditionally derefences xhci->interrupters. With prejudice. Gate the interrupt freeing loop with a check on xhci->interrupters being non-NULL. Found while debugging a DMA allocation issue that led the XHCI driver on this exact path. Fixes: c99b38c41234 ("xhci: add support to allocate several interrupters") Cc: Mathias Nyman Cc: Wesley Cheng Cc: Greg Kroah-Hartman Signed-off-by: Marc Zyngier Cc: stable@vger.kernel.org # 6.8+ Signed-off-by: Mathias Nyman Link: https://lore.kernel.org/r/20240809124408.505786-2-mathias.nyman@linux.intel.com Signed-off-by: Greg Kroah-Hartman drivers/usb/host/xhci-mem.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 2185b4b72017e47fc8e0daa6bba4d4cb662c48f7 Merge: 7c626ce4bae1 e2006140ad2e Author: Greg Kroah-Hartman Date: Tue Aug 13 10:22:34 2024 +0200 Merge tag 'thunderbolt-for-v6.11-rc3' of ssh://gitolite.kernel.org/pub/scm/linux/kernel/git/westeri/thunderbolt into usb-linus thunderbolt: Fixes for v6.11-rc3 This includes following USB4/Thunderbolt fixes for v6.11-rc3: - Fix memory leak in debugfs sideband register access - Fix hang when host router NVM is upgraded and there is another host connected. Both have been in linux-next with no reported issues. * tag 'thunderbolt-for-v6.11-rc3' of ssh://gitolite.kernel.org/pub/scm/linux/kernel/git/westeri/thunderbolt: thunderbolt: Mark XDomain as unplugged when router is removed thunderbolt: Fix memory leaks in {port|retimer}_sb_regs_write() commit bc923d594db21bee0ead128eb4bb78f7e77467a4 Author: Maximilian Luz Date: Sun Aug 11 14:46:44 2024 +0200 platform/surface: aggregator: Fix warning when controller is destroyed in probe There is a small window in ssam_serial_hub_probe() where the controller is initialized but has not been started yet. Specifically, between ssam_controller_init() and ssam_controller_start(). Any failure in this window, for example caused by a failure of serdev_device_open(), currently results in an incorrect warning being emitted. In particular, any failure in this window results in the controller being destroyed via ssam_controller_destroy(). This function checks the state of the controller and, in an attempt to validate that the controller has been cleanly shut down before we try and deallocate any resources, emits a warning if that state is not SSAM_CONTROLLER_STOPPED. However, since we have only just initialized the controller and have not yet started it, its state is SSAM_CONTROLLER_INITIALIZED. Note that this is the only point at which the controller has this state, as it will change after we start the controller with ssam_controller_start() and never revert back. Further, at this point no communication has taken place and the sender and receiver threads have not been started yet (and we may not even have an open serdev device either). Therefore, it is perfectly safe to call ssam_controller_destroy() with a state of SSAM_CONTROLLER_INITIALIZED. This, however, means that the warning currently being emitted is incorrect. Fix it by extending the check. Fixes: c167b9c7e3d6 ("platform/surface: Add Surface Aggregator subsystem") Signed-off-by: Maximilian Luz Link: https://lore.kernel.org/r/20240811124645.246016-1-luzmaximilian@gmail.com Reviewed-by: Ilpo Järvinen Signed-off-by: Ilpo Järvinen drivers/platform/surface/aggregator/controller.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) commit ccbde4b128ef9c73d14d0d7817d68ef795f6d131 Author: Eli Billauer Date: Thu Aug 1 15:11:26 2024 +0300 char: xillybus: Don't destroy workqueue from work item running on it Triggered by a kref decrement, destroy_workqueue() may be called from within a work item for destroying its own workqueue. This illegal situation is averted by adding a module-global workqueue for exclusive use of the offending work item. Other work items continue to be queued on per-device workqueues to ensure performance. Reported-by: syzbot+91dbdfecdd3287734d8e@syzkaller.appspotmail.com Cc: stable Closes: https://lore.kernel.org/lkml/0000000000000ab25a061e1dfe9f@google.com/ Signed-off-by: Eli Billauer Link: https://lore.kernel.org/r/20240801121126.60183-1-eli.billauer@gmail.com Signed-off-by: Greg Kroah-Hartman drivers/char/xillybus/xillyusb.c | 16 +++++++++++----- 1 file changed, 11 insertions(+), 5 deletions(-) commit 99ae7b9ba047ad029a0a23b2bd51608ce79c8e97 Author: Maximilian Luz Date: Sun Aug 11 15:19:48 2024 +0200 platform/surface: aggregator_registry: Add support for Surface Laptop 6 Add SAM client device nodes for the Surface Laptop Studio 6 (SL6). The SL6 is similar to the SL5, with the typical battery/AC, platform profile, and HID nodes. It also has support for the newly supported fan interface. Signed-off-by: Maximilian Luz Link: https://lore.kernel.org/r/20240811131948.261806-6-luzmaximilian@gmail.com Reviewed-by: Ilpo Järvinen Signed-off-by: Ilpo Järvinen .../platform/surface/surface_aggregator_registry.c | 19 +++++++++++++++++++ 1 file changed, 19 insertions(+) commit 002adda09bc1c983c75c82a7e12285c7423aec31 Author: Maximilian Luz Date: Sun Aug 11 15:19:47 2024 +0200 platform/surface: aggregator_registry: Add fan and thermal sensor support for Surface Laptop 5 The EC on the Surface Laptop 5 exposes the fan interface. With the recently introduced driver for it, we can now also enable it here. In addition, also enable the thermal sensor interface. Signed-off-by: Maximilian Luz Link: https://lore.kernel.org/r/20240811131948.261806-5-luzmaximilian@gmail.com Reviewed-by: Ilpo Järvinen Signed-off-by: Ilpo Järvinen drivers/platform/surface/surface_aggregator_registry.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) commit 28d04b4a2cc20981c95787f9c449e6fc51d904f9 Author: Maximilian Luz Date: Sun Aug 11 15:19:46 2024 +0200 platform/surface: aggregator_registry: Add support for Surface Laptop Studio 2 Add SAM client device nodes for the Surface Laptop Studio 2 (SLS2). The SLS2 is quite similar to the SLS1, but it does not provide the touchpad as a SAM-HID device. Therefore, add a new node group for the SLS2 and update the comments accordingly. In addition, it uses the new fan control interface. Signed-off-by: Maximilian Luz Link: https://lore.kernel.org/r/20240811131948.261806-4-luzmaximilian@gmail.com Reviewed-by: Ilpo Järvinen Signed-off-by: Ilpo Järvinen .../platform/surface/surface_aggregator_registry.c | 27 ++++++++++++++++++---- 1 file changed, 23 insertions(+), 4 deletions(-) commit ed235163c3f02329d5e37ed4485bbc39ed2568d4 Author: Maximilian Luz Date: Sun Aug 11 15:19:45 2024 +0200 platform/surface: aggregator_registry: Add support for Surface Laptop Go 3 Add SAM client device nodes for the Surface Laptop Go 3. It seems to use the same SAM client devices as the Surface Laptop Go 1 and 2, so re-use their node group. Signed-off-by: Maximilian Luz Link: https://lore.kernel.org/r/20240811131948.261806-3-luzmaximilian@gmail.com Reviewed-by: Ilpo Järvinen Signed-off-by: Ilpo Järvinen drivers/platform/surface/surface_aggregator_registry.c | 3 +++ 1 file changed, 3 insertions(+) commit 9c8e022567bbec53bee8ae75c44b3d6cd2080d42 Author: Maximilian Luz Date: Sun Aug 11 15:19:44 2024 +0200 platform/surface: aggregator_registry: Add Support for Surface Pro 10 Add SAM client device nodes for the Surface Pro 10. It seems to use the same SAM client devices as the Surface Pro 9, so re-use its node group. Signed-off-by: Maximilian Luz Link: https://lore.kernel.org/r/20240811131948.261806-2-luzmaximilian@gmail.com Reviewed-by: Ilpo Järvinen Signed-off-by: Ilpo Järvinen drivers/platform/surface/surface_aggregator_registry.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) commit d2dfed310aae0739dc87b68c660357e6a4f29819 Author: Luke D. Jones Date: Tue Aug 6 11:46:03 2024 +1200 platform/x86: asus-wmi: Add quirk for ROG Ally X The new ROG Ally X functions the same as the previus model so we can use the same method to ensure the MCU USB devices wake and reconnect correctly. Given that two devices marks the start of a trend, this patch also adds a quirk table to make future additions easier if the MCU is the same. Signed-off-by: Luke D. Jones Reviewed-by: Ilpo Järvinen Link: https://lore.kernel.org/r/20240805234603.38736-1-luke@ljones.dev Signed-off-by: Ilpo Järvinen drivers/platform/x86/asus-wmi.c | 16 +++++++++++++++- 1 file changed, 15 insertions(+), 1 deletion(-) commit 3beddef84d90590270465a907de1cfe2539ac70d Author: Baojun Xu Date: Tue Aug 13 12:37:48 2024 +0800 ALSA: hda/tas2781: fix wrong calibrated data order Wrong calibration data order cause sound too low in some device. Fix wrong calibrated data order, add calibration data converssion by get_unaligned_be32() after reading from UEFI. Fixes: 5be27f1e3ec9 ("ALSA: hda/tas2781: Add tas2781 HDA driver") Cc: Signed-off-by: Baojun Xu Link: https://patch.msgid.link/20240813043749.108-1-shenghao-ding@ti.com Signed-off-by: Takashi Iwai sound/pci/hda/tas2781_hda_i2c.c | 14 +++++++++----- 1 file changed, 9 insertions(+), 5 deletions(-) commit d3c2b2a8923abc087c2e585f5828fb7fae8fedfe Author: Peng Fan Date: Mon Aug 5 11:05:35 2024 +0800 arm64: dts: imx95: correct L3Cache cache-sets The L3Cache size is 512KB. Size = Cache Line Size(64) * num sets(512) * Assoc(0x10). Correct the number of Cache sets. Fixes: 5e3cbb8e4256 ("arm64: dts: freescale: add i.MX95 basic dtsi") Signed-off-by: Peng Fan Signed-off-by: Shawn Guo arch/arm64/boot/dts/freescale/imx95.dtsi | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 915d9d914a25575055804cb8bfd13490111282ec Author: Peng Fan Date: Mon Jul 29 14:41:11 2024 +0800 arm64: dts: imx95: correct a55 power-domains The A55 power domains is for SCMI performance usage, so for device power on/off. Correct the power-domains entry to use scmi_perf not scmi_devpd. Fixes: 5e3cbb8e4256 ("arm64: dts: freescale: add i.MX95 basic dtsi") Signed-off-by: Peng Fan Signed-off-by: Shawn Guo arch/arm64/boot/dts/freescale/imx95.dtsi | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-) commit f4c16a7cdbd2edecdb854f2ce0ef07c6263c5379 Author: Abel Vesa Date: Thu Aug 1 13:21:07 2024 +0300 clk: qcom: gcc-x1e80100: Fix USB 0 and 1 PHY GDSC pwrsts flags Allowing these GDSCs to collapse makes the QMP combo PHYs lose their configuration on machine suspend. Currently, the QMP combo PHY driver doesn't reinitialise the HW on resume. Under such conditions, the USB SuperSpeed support is broken. To avoid this, mark the pwrsts flags with RET_ON. This is in line with USB 2 PHY GDSC config. Fixes: 161b7c401f4b ("clk: qcom: Add Global Clock controller (GCC) driver for X1E80100") Signed-off-by: Abel Vesa Link: https://lore.kernel.org/r/20240801-x1e80100-clk-gcc-fix-usb-phy-gdscs-pwrsts-v1-1-8df016768a0f@linaro.org Signed-off-by: Bjorn Andersson drivers/clk/qcom/gcc-x1e80100.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) commit 046667c4d3196938e992fba0dfcde570aa85cd0e Author: Al Viro Date: Sun Jul 21 14:45:08 2024 -0400 memcg_write_event_control(): fix a user-triggerable oops we are *not* guaranteed that anything past the terminating NUL is mapped (let alone initialized with anything sane). Fixes: 0dea116876ee ("cgroup: implement eventfd-based generic API for notifications") Cc: stable@vger.kernel.org Cc: Andrew Morton Acked-by: Michal Hocko Signed-off-by: Al Viro mm/memcontrol-v1.c | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) commit 5f0a894bfa3c26ce61deda4c52b12e8ec84d876a Author: Markus Niebel Date: Wed Jul 24 14:58:52 2024 +0200 arm64: dts: freescale: imx93-tqma9352-mba93xxla: fix typo Fix typo in assignment of SD-Card cd-gpios. Fixes: c982ecfa7992 ("arm64: dts: freescale: add initial device tree for MBa93xxLA SBC board") Signed-off-by: Markus Niebel Signed-off-by: Alexander Stein Signed-off-by: Shawn Guo arch/arm64/boot/dts/freescale/imx93-tqma9352-mba93xxla.dts | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit cd0c6872aab4d2c556a5e953e6926a1b4485e543 Author: Markus Niebel Date: Wed Jul 24 14:58:48 2024 +0200 arm64: dts: freescale: imx93-tqma9352: fix CMA alloc-ranges DRAM starts at 0x80000000. Fixes: c982ecfa7992 ("arm64: dts: freescale: add initial device tree for MBa93xxLA SBC board") Signed-off-by: Markus Niebel Signed-off-by: Alexander Stein Reviewed-by: Peng Fan Signed-off-by: Shawn Guo arch/arm64/boot/dts/freescale/imx93-tqma9352.dtsi | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 6e1918ff680527ce4be77426aa537012b5aa997c Author: Kuniyuki Iwashima Date: Wed Aug 7 21:00:21 2024 -0700 net: macb: Use rcu_dereference() for idev->ifa_list in macb_suspend(). In macb_suspend(), idev->ifa_list is fetched with rcu_access_pointer() and later the pointer is dereferenced as ifa->ifa_local. So, idev->ifa_list must be fetched with rcu_dereference(). Fixes: 0cb8de39a776 ("net: macb: Add ARP support to WOL") Signed-off-by: Kuniyuki Iwashima Link: https://patch.msgid.link/20240808040021.6971-1-kuniyu@amazon.com Signed-off-by: Jakub Kicinski drivers/net/ethernet/cadence/macb_main.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) commit 662c3e2db00f92e50c26e9dc4fe47c52223d9982 Author: Yonghong Song Date: Mon Aug 12 14:48:52 2024 -0700 selftests/bpf: Add a test to verify previous stacksafe() fix A selftest is added such that without the previous patch, a crash can happen. With the previous patch, the test can run successfully. The new test is written in a way which mimics original crash case: main_prog static_prog_1 static_prog_2 where static_prog_1 has different paths to static_prog_2 and some path has stack allocated and some other path does not. A stacksafe() checking in static_prog_2() triggered the crash. Signed-off-by: Yonghong Song Link: https://lore.kernel.org/r/20240812214852.214037-1-yonghong.song@linux.dev Signed-off-by: Alexei Starovoitov tools/testing/selftests/bpf/progs/iters.c | 54 +++++++++++++++++++++++++++++++ 1 file changed, 54 insertions(+) commit bed2eb964c70b780fb55925892a74f26cb590b25 Author: Yonghong Song Date: Mon Aug 12 14:48:47 2024 -0700 bpf: Fix a kernel verifier crash in stacksafe() Daniel Hodges reported a kernel verifier crash when playing with sched-ext. Further investigation shows that the crash is due to invalid memory access in stacksafe(). More specifically, it is the following code: if (exact != NOT_EXACT && old->stack[spi].slot_type[i % BPF_REG_SIZE] != cur->stack[spi].slot_type[i % BPF_REG_SIZE]) return false; The 'i' iterates old->allocated_stack. If cur->allocated_stack < old->allocated_stack the out-of-bound access will happen. To fix the issue add 'i >= cur->allocated_stack' check such that if the condition is true, stacksafe() should fail. Otherwise, cur->stack[spi].slot_type[i % BPF_REG_SIZE] memory access is legal. Fixes: 2793a8b015f7 ("bpf: exact states comparison for iterator convergence checks") Cc: Eduard Zingerman Reported-by: Daniel Hodges Acked-by: Eduard Zingerman Signed-off-by: Yonghong Song Link: https://lore.kernel.org/r/20240812214847.213612-1-yonghong.song@linux.dev Signed-off-by: Alexei Starovoitov kernel/bpf/verifier.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) commit 8c6b808c8c2a9de21503944bd6308979410fd812 Author: Shin'ichiro Kawasaki Date: Sat Aug 10 13:27:01 2024 +0900 scsi: mpi3mr: Avoid MAX_PAGE_ORDER WARNING for buffer allocations Commit fc4444941140 ("scsi: mpi3mr: HDB allocation and posting for hardware and firmware buffers") added mpi3mr_alloc_diag_bufs() which calls dma_alloc_coherent() to allocate the trace buffer and the firmware buffer. mpi3mr_alloc_diag_bufs() decides the buffer sizes from the driver configuration. In my environment, the sizes are 8MB. With the sizes, dma_alloc_coherent() fails and report this WARNING: WARNING: CPU: 4 PID: 438 at mm/page_alloc.c:4676 __alloc_pages_noprof+0x52f/0x640 The WARNING indicates that the order of the allocation size is larger than MAX_PAGE_ORDER. After this failure, mpi3mr_alloc_diag_bufs() reduces the buffer sizes and retries dma_alloc_coherent(). In the end, the buffer allocations succeed with 4MB size in my environment, which corresponds to MAX_PAGE_ORDER=10. Though the allocations succeed, the WARNING message is misleading and should be avoided. To avoid the WARNING, check the orders of the buffer allocation sizes before calling dma_alloc_coherent(). If the orders are larger than MAX_PAGE_ORDER, fall back to the retry path. Fixes: fc4444941140 ("scsi: mpi3mr: HDB allocation and posting for hardware and firmware buffers") Signed-off-by: Shin'ichiro Kawasaki Link: https://lore.kernel.org/r/20240810042701.661841-3-shinichiro.kawasaki@wdc.com Acked-by: Sathya Prakash Veerichetty Signed-off-by: Martin K. Petersen drivers/scsi/mpi3mr/mpi3mr_app.c | 11 ++++++++--- 1 file changed, 8 insertions(+), 3 deletions(-) commit 227bbaabe64b6f9cd98aa051454c1d4a194a8c6a Author: Nysal Jan K.A Date: Wed Jul 31 08:31:13 2024 +0530 powerpc/topology: Check if a core is online topology_is_core_online() checks if the core a CPU belongs to is online. The core is online if at least one of the sibling CPUs is online. The first CPU of an online core is also online in the common case, so this should be fairly quick. Fixes: 73c58e7e1412 ("powerpc: Add HOTPLUG_SMT support") Signed-off-by: Nysal Jan K.A Reviewed-by: Shrikanth Hegde Signed-off-by: Michael Ellerman Link: https://msgid.link/20240731030126.956210-3-nysal@linux.ibm.com arch/powerpc/include/asm/topology.h | 13 +++++++++++++ 1 file changed, 13 insertions(+) commit 6c17ea1f3eaa330d445ac14a9428402ce4e3055e Author: Nysal Jan K.A Date: Wed Jul 31 08:31:12 2024 +0530 cpu/SMT: Enable SMT only if a core is online If a core is offline then enabling SMT should not online CPUs of this core. By enabling SMT, what is intended is either changing the SMT value from "off" to "on" or setting the SMT level (threads per core) from a lower to higher value. On PowerPC the ppc64_cpu utility can be used, among other things, to perform the following functions: ppc64_cpu --cores-on # Get the number of online cores ppc64_cpu --cores-on=X # Put exactly X cores online ppc64_cpu --offline-cores=X[,Y,...] # Put specified cores offline ppc64_cpu --smt={on|off|value} # Enable, disable or change SMT level If the user has decided to offline certain cores, enabling SMT should not online CPUs in those cores. This patch fixes the issue and changes the behaviour as described, by introducing an arch specific function topology_is_core_online(). It is currently implemented only for PowerPC. Fixes: 73c58e7e1412 ("powerpc: Add HOTPLUG_SMT support") Reported-by: Tyrel Datwyler Closes: https://groups.google.com/g/powerpc-utils-devel/c/wrwVzAAnRlI/m/5KJSoqP4BAAJ Signed-off-by: Nysal Jan K.A Reviewed-by: Shrikanth Hegde Reviewed-by: Thomas Gleixner Signed-off-by: Michael Ellerman Link: https://msgid.link/20240731030126.956210-2-nysal@linux.ibm.com Documentation/ABI/testing/sysfs-devices-system-cpu | 3 ++- kernel/cpu.c | 12 +++++++++++- 2 files changed, 13 insertions(+), 2 deletions(-) commit fdad456cbcca739bae1849549c7a999857c56f88 Author: Leon Hwang Date: Sun Jul 28 19:46:11 2024 +0800 bpf: Fix updating attached freplace prog in prog_array map The commit f7866c358733 ("bpf: Fix null pointer dereference in resolve_prog_type() for BPF_PROG_TYPE_EXT") fixed a NULL pointer dereference panic, but didn't fix the issue that fails to update attached freplace prog to prog_array map. Since commit 1c123c567fb1 ("bpf: Resolve fext program type when checking map compatibility"), freplace prog and its target prog are able to tail call each other. And the commit 3aac1ead5eb6 ("bpf: Move prog->aux->linked_prog and trampoline into bpf_link on attach") sets prog->aux->dst_prog as NULL after attaching freplace prog to its target prog. After loading freplace the prog_array's owner type is BPF_PROG_TYPE_SCHED_CLS. Then, after attaching freplace its prog->aux->dst_prog is NULL. Then, while updating freplace in prog_array the bpf_prog_map_compatible() incorrectly returns false because resolve_prog_type() returns BPF_PROG_TYPE_EXT instead of BPF_PROG_TYPE_SCHED_CLS. After this patch the resolve_prog_type() returns BPF_PROG_TYPE_SCHED_CLS and update to prog_array can succeed. Fixes: f7866c358733 ("bpf: Fix null pointer dereference in resolve_prog_type() for BPF_PROG_TYPE_EXT") Cc: Toke Høiland-Jørgensen Cc: Martin KaFai Lau Acked-by: Yonghong Song Signed-off-by: Leon Hwang Link: https://lore.kernel.org/r/20240728114612.48486-2-leon.hwang@linux.dev Signed-off-by: Alexei Starovoitov include/linux/bpf_verifier.h | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) commit 6b9935da2a6b2a72774c15c844ae201a3fc362ac Author: Shin'ichiro Kawasaki Date: Sat Aug 10 13:27:00 2024 +0900 scsi: mpi3mr: Add missing spin_lock_init() for mrioc->trigger_lock Commit fc4444941140 ("scsi: mpi3mr: HDB allocation and posting for hardware and firmware buffers") added the spinlock trigger_lock to the struct mpi3mr_ioc. However, spin_lock_init() call was not added for it, then the lock does not work as expected. Also, the kernel reports the message below when lockdep is enabled. INFO: trying to register non-static key. The code is fine but needs lockdep annotation, or maybe you didn't initialize this object before use? To fix the issue and to avoid the INFO message, add the missing spin_lock_init() call. Fixes: fc4444941140 ("scsi: mpi3mr: HDB allocation and posting for hardware and firmware buffers") Signed-off-by: Shin'ichiro Kawasaki Link: https://lore.kernel.org/r/20240810042701.661841-2-shinichiro.kawasaki@wdc.com Acked-by: Sathya Prakash Veerichetty Signed-off-by: Martin K. Petersen drivers/scsi/mpi3mr/mpi3mr_os.c | 1 + 1 file changed, 1 insertion(+) commit 7b589a9b45ae32aa9d7bece597490e141198d7a6 Author: David Howells Date: Wed Aug 7 19:38:46 2024 +0100 netfs: Fix handling of USE_PGPRIV2 and WRITE_TO_CACHE flags The NETFS_RREQ_USE_PGPRIV2 and NETFS_RREQ_WRITE_TO_CACHE flags aren't used correctly. The problem is that we try to set them up in the request initialisation, but we the cache may be in the process of setting up still, and so the state may not be correct. Further, we secondarily sample the cache state and make contradictory decisions later. The issue arises because we set up the cache resources, which allows the cache's ->prepare_read() to switch on NETFS_SREQ_COPY_TO_CACHE - which triggers cache writing even if we didn't set the flags when allocating. Fix this in the following way: (1) Drop NETFS_ICTX_USE_PGPRIV2 and instead set NETFS_RREQ_USE_PGPRIV2 in ->init_request() rather than trying to juggle that in netfs_alloc_request(). (2) Repurpose NETFS_RREQ_USE_PGPRIV2 to merely indicate that if caching is to be done, then PG_private_2 is to be used rather than only setting it if we decide to cache and then having netfs_rreq_unlock_folios() set the non-PG_private_2 writeback-to-cache if it wasn't set. (3) Split netfs_rreq_unlock_folios() into two functions, one of which contains the deprecated code for using PG_private_2 to avoid accidentally doing the writeback path - and always use it if USE_PGPRIV2 is set. (4) As NETFS_ICTX_USE_PGPRIV2 is removed, make netfs_write_begin() always wait for PG_private_2. This function is deprecated and only used by ceph anyway, and so label it so. (5) Drop the NETFS_RREQ_WRITE_TO_CACHE flag and use fscache_operation_valid() on the cache_resources instead. This has the advantage of picking up the result of netfs_begin_cache_read() and fscache_begin_write_operation() - which are called after the object is initialised and will wait for the cache to come to a usable state. Just reverting ae678317b95e[1] isn't a sufficient fix, so this need to be applied on top of that. Without this as well, things like: rcu: INFO: rcu_sched detected expedited stalls on CPUs/tasks: { and: WARNING: CPU: 13 PID: 3621 at fs/ceph/caps.c:3386 may happen, along with some UAFs due to PG_private_2 not getting used to wait on writeback completion. Fixes: 2ff1e97587f4 ("netfs: Replace PG_fscache by setting folio->private and marking dirty") Reported-by: Max Kellermann Signed-off-by: David Howells cc: Ilya Dryomov cc: Xiubo Li cc: Hristo Venev cc: Jeff Layton cc: Matthew Wilcox cc: ceph-devel@vger.kernel.org cc: netfs@lists.linux.dev cc: linux-fsdevel@vger.kernel.org cc: linux-mm@kvack.org Link: https://lore.kernel.org/r/3575457.1722355300@warthog.procyon.org.uk/ [1] Link: https://lore.kernel.org/r/1173209.1723152682@warthog.procyon.org.uk Signed-off-by: Christian Brauner fs/ceph/addr.c | 3 ++ fs/ceph/inode.c | 2 - fs/netfs/buffered_read.c | 125 ++++++++++++++++++++++++++++++++++++------- fs/netfs/objects.c | 10 ---- fs/netfs/write_issue.c | 4 +- fs/nfs/fscache.c | 2 + fs/nfs/fscache.h | 2 - include/linux/netfs.h | 3 -- include/trace/events/netfs.h | 1 + 9 files changed, 116 insertions(+), 36 deletions(-) commit 8e5ced7804cb9184c4a23f8054551240562a8eda Author: David Howells Date: Tue Jul 30 17:01:40 2024 +0100 netfs, ceph: Revert "netfs: Remove deprecated use of PG_private_2 as a second writeback flag" This reverts commit ae678317b95e760607c7b20b97c9cd4ca9ed6e1a. Revert the patch that removes the deprecated use of PG_private_2 in netfslib for the moment as Ceph is actually still using this to track data copied to the cache. Fixes: ae678317b95e ("netfs: Remove deprecated use of PG_private_2 as a second writeback flag") Reported-by: Max Kellermann Signed-off-by: David Howells cc: Ilya Dryomov cc: Xiubo Li cc: Jeff Layton cc: Matthew Wilcox cc: ceph-devel@vger.kernel.org cc: netfs@lists.linux.dev cc: linux-fsdevel@vger.kernel.org cc: linux-mm@kvack.org https: //lore.kernel.org/r/3575457.1722355300@warthog.procyon.org.uk Signed-off-by: Christian Brauner fs/ceph/addr.c | 19 +++++- fs/netfs/buffered_read.c | 8 ++- fs/netfs/io.c | 144 +++++++++++++++++++++++++++++++++++++++++++ include/trace/events/netfs.h | 1 + 4 files changed, 170 insertions(+), 2 deletions(-) commit 86509e38a80da34d7800985fa2be183475242c8c Author: Mathias Krause Date: Fri Aug 9 15:50:35 2024 +0200 file: fix typo in take_fd() comment The explanatory comment above take_fd() contains a typo, fix that to not confuse readers. Signed-off-by: Mathias Krause Link: https://lore.kernel.org/r/20240809135035.748109-1-minipli@grsecurity.net Signed-off-by: Christian Brauner include/linux/file.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 3b5bbe798b2451820e74243b738268f51901e7d0 Author: Christian Brauner Date: Wed Jul 31 12:01:12 2024 +0200 pidfd: prevent creation of pidfds for kthreads It's currently possible to create pidfds for kthreads but it is unclear what that is supposed to mean. Until we have use-cases for it and we figured out what behavior we want block the creation of pidfds for kthreads. Link: https://lore.kernel.org/r/20240731-gleis-mehreinnahmen-6bbadd128383@brauner Fixes: 32fcb426ec00 ("pid: add pidfd_open()") Cc: stable@vger.kernel.org Signed-off-by: Christian Brauner kernel/fork.c | 25 ++++++++++++++++++++++--- 1 file changed, 22 insertions(+), 3 deletions(-) commit 889ced4c9388785952d78d20d338bda2df209bb5 Author: Lukas Bulwahn Date: Wed Jul 31 09:39:02 2024 +0200 netfs: clean up after renaming FSCACHE_DEBUG config Commit 6b8e61472529 ("netfs: Rename CONFIG_FSCACHE_DEBUG to CONFIG_NETFS_DEBUG") renames the config, but introduces two issues: First, NETFS_DEBUG mistakenly depends on the non-existing config NETFS, whereas the actual intended config is called NETFS_SUPPORT. Second, the config renaming misses to adjust the documentation of the functionality of this config. Clean up those two points. Signed-off-by: Lukas Bulwahn Link: https://lore.kernel.org/r/20240731073902.69262-1-lukas.bulwahn@redhat.com Signed-off-by: Christian Brauner Documentation/filesystems/caching/fscache.rst | 8 ++++---- fs/netfs/Kconfig | 2 +- 2 files changed, 5 insertions(+), 5 deletions(-) commit 64a7ce76fb901bf9f9c36cf5d681328fc0fd4b5a Author: yangerkun Date: Wed Jul 31 12:38:35 2024 +0800 libfs: fix infinite directory reads for offset dir After we switch tmpfs dir operations from simple_dir_operations to simple_offset_dir_operations, every rename happened will fill new dentry to dest dir's maple tree(&SHMEM_I(inode)->dir_offsets->mt) with a free key starting with octx->newx_offset, and then set newx_offset equals to free key + 1. This will lead to infinite readdir combine with rename happened at the same time, which fail generic/736 in xfstests(detail show as below). 1. create 5000 files(1 2 3...) under one dir 2. call readdir(man 3 readdir) once, and get one entry 3. rename(entry, "TEMPFILE"), then rename("TEMPFILE", entry) 4. loop 2~3, until readdir return nothing or we loop too many times(tmpfs break test with the second condition) We choose the same logic what commit 9b378f6ad48cf ("btrfs: fix infinite directory reads") to fix it, record the last_index when we open dir, and do not emit the entry which index >= last_index. The file->private_data now used in offset dir can use directly to do this, and we also update the last_index when we llseek the dir file. Fixes: a2e459555c5f ("shmem: stable directory offsets") Signed-off-by: yangerkun Link: https://lore.kernel.org/r/20240731043835.1828697-1-yangerkun@huawei.com Reviewed-by: Chuck Lever [brauner: only update last_index after seek when offset is zero like Jan suggested] Signed-off-by: Christian Brauner fs/libfs.c | 35 ++++++++++++++++++++++++----------- 1 file changed, 24 insertions(+), 11 deletions(-) commit 42b0f8da3acc87953161baeb24f756936eb4d4b2 Author: Christian Brauner Date: Wed Jul 31 07:47:27 2024 +0200 nsfs: fix ioctl declaration The kernel is writing an object of type __u64, so the ioctl has to be defined to _IOR(NSIO, 0x5, __u64) instead of _IO(NSIO, 0x5). Reported-by: Dmitry V. Levin Link: https://lore.kernel.org/r/20240730164554.GA18486@altlinux.org Signed-off-by: Christian Brauner include/uapi/linux/nsfs.h | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) commit f71aa06398aabc2e3eaac25acdf3d62e0094ba70 Author: Max Kellermann Date: Mon Jul 29 17:19:30 2024 +0100 fs/netfs/fscache_cookie: add missing "n_accesses" check This fixes a NULL pointer dereference bug due to a data race which looks like this: BUG: kernel NULL pointer dereference, address: 0000000000000008 #PF: supervisor read access in kernel mode #PF: error_code(0x0000) - not-present page PGD 0 P4D 0 Oops: 0000 [#1] SMP PTI CPU: 33 PID: 16573 Comm: kworker/u97:799 Not tainted 6.8.7-cm4all1-hp+ #43 Hardware name: HP ProLiant DL380 Gen9/ProLiant DL380 Gen9, BIOS P89 10/17/2018 Workqueue: events_unbound netfs_rreq_write_to_cache_work RIP: 0010:cachefiles_prepare_write+0x30/0xa0 Code: 57 41 56 45 89 ce 41 55 49 89 cd 41 54 49 89 d4 55 53 48 89 fb 48 83 ec 08 48 8b 47 08 48 83 7f 10 00 48 89 34 24 48 8b 68 20 <48> 8b 45 08 4c 8b 38 74 45 49 8b 7f 50 e8 4e a9 b0 ff 48 8b 73 10 RSP: 0018:ffffb4e78113bde0 EFLAGS: 00010286 RAX: ffff976126be6d10 RBX: ffff97615cdb8438 RCX: 0000000000020000 RDX: ffff97605e6c4c68 RSI: ffff97605e6c4c60 RDI: ffff97615cdb8438 RBP: 0000000000000000 R08: 0000000000278333 R09: 0000000000000001 R10: ffff97605e6c4600 R11: 0000000000000001 R12: ffff97605e6c4c68 R13: 0000000000020000 R14: 0000000000000001 R15: ffff976064fe2c00 FS: 0000000000000000(0000) GS:ffff9776dfd40000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000000000000008 CR3: 000000005942c002 CR4: 00000000001706f0 Call Trace: ? __die+0x1f/0x70 ? page_fault_oops+0x15d/0x440 ? search_module_extables+0xe/0x40 ? fixup_exception+0x22/0x2f0 ? exc_page_fault+0x5f/0x100 ? asm_exc_page_fault+0x22/0x30 ? cachefiles_prepare_write+0x30/0xa0 netfs_rreq_write_to_cache_work+0x135/0x2e0 process_one_work+0x137/0x2c0 worker_thread+0x2e9/0x400 ? __pfx_worker_thread+0x10/0x10 kthread+0xcc/0x100 ? __pfx_kthread+0x10/0x10 ret_from_fork+0x30/0x50 ? __pfx_kthread+0x10/0x10 ret_from_fork_asm+0x1b/0x30 Modules linked in: CR2: 0000000000000008 ---[ end trace 0000000000000000 ]--- This happened because fscache_cookie_state_machine() was slow and was still running while another process invoked fscache_unuse_cookie(); this led to a fscache_cookie_lru_do_one() call, setting the FSCACHE_COOKIE_DO_LRU_DISCARD flag, which was picked up by fscache_cookie_state_machine(), withdrawing the cookie via cachefiles_withdraw_cookie(), clearing cookie->cache_priv. At the same time, yet another process invoked cachefiles_prepare_write(), which found a NULL pointer in this code line: struct cachefiles_object *object = cachefiles_cres_object(cres); The next line crashes, obviously: struct cachefiles_cache *cache = object->volume->cache; During cachefiles_prepare_write(), the "n_accesses" counter is non-zero (via fscache_begin_operation()). The cookie must not be withdrawn until it drops to zero. The counter is checked by fscache_cookie_state_machine() before switching to FSCACHE_COOKIE_STATE_RELINQUISHING and FSCACHE_COOKIE_STATE_WITHDRAWING (in "case FSCACHE_COOKIE_STATE_FAILED"), but not for FSCACHE_COOKIE_STATE_LRU_DISCARDING ("case FSCACHE_COOKIE_STATE_ACTIVE"). This patch adds the missing check. With a non-zero access counter, the function returns and the next fscache_end_cookie_access() call will queue another fscache_cookie_state_machine() call to handle the still-pending FSCACHE_COOKIE_DO_LRU_DISCARD. Fixes: 12bb21a29c19 ("fscache: Implement cookie user counting and resource pinning") Signed-off-by: Max Kellermann Signed-off-by: David Howells Link: https://lore.kernel.org/r/20240729162002.3436763-2-dhowells@redhat.com cc: Jeff Layton cc: netfs@lists.linux.dev cc: linux-fsdevel@vger.kernel.org cc: stable@vger.kernel.org Signed-off-by: Christian Brauner fs/netfs/fscache_cookie.c | 4 ++++ 1 file changed, 4 insertions(+) commit 3f65f3c099bcb27949e712f39ba836f21785924a Author: Omar Sandoval Date: Mon Jul 29 15:48:12 2024 -0700 filelock: fix name of file_lease slab cache When struct file_lease was split out from struct file_lock, the name of the file_lock slab cache was copied to the new slab cache for file_lease. This name conflict causes confusion in /proc/slabinfo and /sys/kernel/slab. In particular, it caused failures in drgn's test case for slab cache merging. Link: https://github.com/osandov/drgn/blob/9ad29fd86499eb32847473e928b6540872d3d59a/tests/linux_kernel/helpers/test_slab.py#L81 Fixes: c69ff4071935 ("filelock: split leases out of struct file_lock") Signed-off-by: Omar Sandoval Link: https://lore.kernel.org/r/2d1d053da1cafb3e7940c4f25952da4f0af34e38.1722293276.git.osandov@fb.com Reviewed-by: Chuck Lever Reviewed-by: Jeff Layton Signed-off-by: Christian Brauner fs/locks.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 98055bc3595500bcf2126b93b1595354bdb86a66 Author: Matthew Wilcox (Oracle) Date: Mon May 27 21:17:32 2024 +0100 netfs: Fault in smaller chunks for non-large folio mappings As in commit 4e527d5841e2 ("iomap: fault in smaller chunks for non-large folio mappings"), we can see a performance loss for filesystems which have not yet been converted to large folios. Fixes: c38f4e96e605 ("netfs: Provide func to copy data to pagecache for buffered write") Signed-off-by: Matthew Wilcox (Oracle) Link: https://lore.kernel.org/r/20240527201735.1898381-1-willy@infradead.org Reviewed-by: Jeff Layton Signed-off-by: Christian Brauner fs/netfs/buffered_write.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 054308ad90ae43ba2d4b9c83c6582e8fe94f6fed Author: Manivannan Sadhasivam Date: Mon Aug 12 11:27:07 2024 +0530 MAINTAINERS: Add Manivannan Sadhasivam as Reviewer for PCI native host bridge and endpoint drivers I've been reviewing the native host bridge drivers for some time and would like to be listed as a Reviewer formally. Link: https://lore.kernel.org/r/20240812055707.6778-1-manivannan.sadhasivam@linaro.org Signed-off-by: Manivannan Sadhasivam Signed-off-by: Bjorn Helgaas MAINTAINERS | 1 + 1 file changed, 1 insertion(+) commit 48cc7ecd3a68e0fbfa281ef1ed6f6b6cb7638390 Author: Olivier Langlois Date: Sun Aug 11 20:34:46 2024 -0400 io_uring/napi: remove duplicate io_napi_entry timeout assignation io_napi_entry() has 2 calling sites. One of them is unlikely to find an entry and if it does, the timeout should arguable not be updated. The other io_napi_entry() calling site is overwriting the update made by io_napi_entry() so the io_napi_entry() timeout value update has no or little value and therefore is removed. Signed-off-by: Olivier Langlois Link: https://lore.kernel.org/r/145b54ff179f87609e20dffaf5563c07cdbcad1a.1723423275.git.olivier@trillion01.com Signed-off-by: Jens Axboe io_uring/napi.c | 1 - 1 file changed, 1 deletion(-) commit 84f2eecf95018386c145ada19bb45b03bdb80d9e Author: Olivier Langlois Date: Sun Aug 11 14:07:11 2024 -0400 io_uring/napi: check napi_enabled in io_napi_add() before proceeding doing so avoids the overhead of adding napi ids to all the rings that do not enable napi. if no id is added to napi_list because napi is disabled, __io_napi_busy_loop() will not be called. Signed-off-by: Olivier Langlois Fixes: b4ccc4dd1330 ("io_uring/napi: enable even with a timeout of 0") Link: https://lore.kernel.org/r/bd989ccef5fda14f5fd9888faf4fefcf66bd0369.1723400131.git.olivier@trillion01.com Signed-off-by: Jens Axboe io_uring/napi.c | 2 +- io_uring/napi.h | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) commit 7db4042336580dfd75cb5faa82c12cd51098c90b Author: Stefan Haberland Date: Mon Aug 12 14:57:33 2024 +0200 s390/dasd: fix error recovery leading to data corruption on ESE devices Extent Space Efficient (ESE) or thin provisioned volumes need to be formatted on demand during usual IO processing. The dasd_ese_needs_format function checks for error codes that signal the non existence of a proper track format. The check for incorrect length is to imprecise since other error cases leading to transport of insufficient data also have this flag set. This might lead to data corruption in certain error cases for example during a storage server warmstart. Fix by removing the check for incorrect length and replacing by explicitly checking for invalid track format in transport mode. Also remove the check for file protected since this is not a valid ESE handling case. Cc: stable@vger.kernel.org # 5.3+ Fixes: 5e2b17e712cf ("s390/dasd: Add dynamic formatting support for ESE volumes") Reviewed-by: Jan Hoeppner Signed-off-by: Stefan Haberland Link: https://lore.kernel.org/r/20240812125733.126431-3-sth@linux.ibm.com Signed-off-by: Jens Axboe drivers/s390/block/dasd.c | 36 ++++++++++++++++--------- drivers/s390/block/dasd_3990_erp.c | 10 ++----- drivers/s390/block/dasd_eckd.c | 55 +++++++++++++++++--------------------- drivers/s390/block/dasd_int.h | 2 +- 4 files changed, 50 insertions(+), 53 deletions(-) commit 2a07bb64d80152701d507b1498237ed1b8d83866 Author: Eric Farman Date: Mon Aug 12 14:57:32 2024 +0200 s390/dasd: Remove DMA alignment This reverts commit bc792884b76f ("s390/dasd: Establish DMA alignment"). Quoting the original commit: linux-next commit bf8d08532bc1 ("iomap: add support for dma aligned direct-io") changes the alignment requirement to come from the block device rather than the block size, and the default alignment requirement is 512-byte boundaries. Since DASD I/O has page alignments for IDAW/TIDAW requests, let's override this value to restore the expected behavior. I mentioned TIDAW, but that was wrong. TIDAWs have no distinct alignment requirement (per p. 15-70 of POPS SA22-7832-13): Unless otherwise specified, TIDAWs may designate a block of main storage on any boundary and length up to 4K bytes, provided the specified block does not cross a 4 K-byte boundary. IDAWs do, but the original commit neglected that while ECKD DASD are typically formatted in 4096-byte blocks, they don't HAVE to be. Formatting an ECKD volume with smaller blocks is permitted (dasdfmt -b xxx), and the problematic commit enforces alignment properties to such a device that will result in errors, such as: [test@host ~]# lsdasd -l a367 | grep blksz blksz: 512 [test@host ~]# mkfs.xfs -f /dev/disk/by-path/ccw-0.0.a367-part1 meta-data=/dev/dasdc1 isize=512 agcount=4, agsize=230075 blks = sectsz=512 attr=2, projid32bit=1 = crc=1 finobt=1, sparse=1, rmapbt=1 = reflink=1 bigtime=1 inobtcount=1 nrext64=1 data = bsize=4096 blocks=920299, imaxpct=25 = sunit=0 swidth=0 blks naming =version 2 bsize=4096 ascii-ci=0, ftype=1 log =internal log bsize=4096 blocks=16384, version=2 = sectsz=512 sunit=0 blks, lazy-count=1 realtime =none extsz=4096 blocks=0, rtextents=0 error reading existing superblock: Invalid argument mkfs.xfs: pwrite failed: Invalid argument libxfs_bwrite: write failed on (unknown) bno 0x70565c/0x100, err=22 mkfs.xfs: Releasing dirty buffer to free list! found dirty buffer (bulk) on free list! mkfs.xfs: pwrite failed: Invalid argument ...snipped... The original commit omitted the FBA discipline for just this reason, but the formatted block size of the other disciplines was overlooked. The solution to all of this is to revert to the original behavior, such that the block size can be respected. There were two commits [1] that moved this code in the interim, so a straight git-revert is not possible, but the change is straightforward. But what of the original problem? That was manifested with a direct-io QEMU guest, where QEMU itself was changed a month or two later with commit 25474d90aa ("block: use the request length for iov alignment") such that the blamed kernel commit is unnecessary. [1] commit 0127a47f58c6 ("dasd: move queue setup to common code") commit fde07a4d74e3 ("dasd: use the atomic queue limits API") Fixes: bc792884b76f ("s390/dasd: Establish DMA alignment") Reviewed-by: Stefan Haberland Signed-off-by: Eric Farman Signed-off-by: Stefan Haberland Link: https://lore.kernel.org/r/20240812125733.126431-2-sth@linux.ibm.com Signed-off-by: Jens Axboe drivers/s390/block/dasd_genhd.c | 1 - 1 file changed, 1 deletion(-) commit d74da846046aeec9333e802f5918bd3261fb5509 Merge: a1460e457e7a 7cc06e729460 Author: Linus Torvalds Date: Mon Aug 12 08:21:52 2024 -0700 Merge tag 'platform-drivers-x86-v6.11-3' of git://git.kernel.org/pub/scm/linux/kernel/git/pdx86/platform-drivers-x86 Pull x86 platform driver fixes from Ilpo Järvinen: "While the ideapad concurrency fix itself is relatively straightforward, it required moving code around and adding a bit of supporting infrastructure to have a clean inter-driver interface. This shows up in the diffstats. - ideapad-laptop / lenovo-ymc: Protect VPC calls with a mutex - amd/pmf: Query HPD data also when ALS is disabled" * tag 'platform-drivers-x86-v6.11-3' of git://git.kernel.org/pub/scm/linux/kernel/git/pdx86/platform-drivers-x86: platform/x86: ideapad-laptop: add a mutex to synchronize VPC commands platform/x86: ideapad-laptop: move ymc_trigger_ec from lenovo-ymc platform/x86: ideapad-laptop: introduce a generic notification chain platform/x86/amd/pmf: Fix to Update HPD Data When ALS is Disabled commit a1460e457e7ae42f48d8490c1214fa29f23e4d58 Merge: 7c626ce4bae1 9a2fa1472083 Author: Linus Torvalds Date: Mon Aug 12 08:03:28 2024 -0700 Merge tag 'pull-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs Pull fd bitmap fix from Al Viro: "Fix bitmap corruption on close_range() by cleaning up copy_fd_bitmaps()" * tag 'pull-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs: fix bitmap corruption on close_range() with CLOSE_RANGE_UNSHARE commit 497d370a644d95a9f04271aa92cb96d32e84c770 Author: Maíra Canal Date: Fri Aug 9 12:18:45 2024 -0300 drm/v3d: Fix out-of-bounds read in `v3d_csd_job_run()` When enabling UBSAN on Raspberry Pi 5, we get the following warning: [ 387.894977] UBSAN: array-index-out-of-bounds in drivers/gpu/drm/v3d/v3d_sched.c:320:3 [ 387.903868] index 7 is out of range for type '__u32 [7]' [ 387.909692] CPU: 0 PID: 1207 Comm: kworker/u16:2 Tainted: G WC 6.10.3-v8-16k-numa #151 [ 387.919166] Hardware name: Raspberry Pi 5 Model B Rev 1.0 (DT) [ 387.925961] Workqueue: v3d_csd drm_sched_run_job_work [gpu_sched] [ 387.932525] Call trace: [ 387.935296] dump_backtrace+0x170/0x1b8 [ 387.939403] show_stack+0x20/0x38 [ 387.942907] dump_stack_lvl+0x90/0xd0 [ 387.946785] dump_stack+0x18/0x28 [ 387.950301] __ubsan_handle_out_of_bounds+0x98/0xd0 [ 387.955383] v3d_csd_job_run+0x3a8/0x438 [v3d] [ 387.960707] drm_sched_run_job_work+0x520/0x6d0 [gpu_sched] [ 387.966862] process_one_work+0x62c/0xb48 [ 387.971296] worker_thread+0x468/0x5b0 [ 387.975317] kthread+0x1c4/0x1e0 [ 387.978818] ret_from_fork+0x10/0x20 [ 387.983014] ---[ end trace ]--- This happens because the UAPI provides only seven configuration registers and we are reading the eighth position of this u32 array. Therefore, fix the out-of-bounds read in `v3d_csd_job_run()` by accessing only seven positions on the '__u32 [7]' array. The eighth register exists indeed on V3D 7.1, but it isn't currently used. That being so, let's guarantee that it remains unused and add a note that it could be set in a future patch. Fixes: 0ad5bc1ce463 ("drm/v3d: fix up register addresses for V3D 7.x") Reported-by: Tvrtko Ursulin Signed-off-by: Maíra Canal Reviewed-by: Iago Toral Quiroga Link: https://patchwork.freedesktop.org/patch/msgid/20240809152001.668314-1-mcanal@igalia.com drivers/gpu/drm/v3d/v3d_sched.c | 14 +++++++++++--- 1 file changed, 11 insertions(+), 3 deletions(-) commit db1b4bedb9b97c6d34b03d03815147c04fffe8b4 Author: Zheng Zhang Date: Sat Aug 10 13:26:51 2024 +0800 net: ethernet: mtk_wed: fix use-after-free panic in mtk_wed_setup_tc_block_cb() When there are multiple ap interfaces on one band and with WED on, turning the interface down will cause a kernel panic on MT798X. Previously, cb_priv was freed in mtk_wed_setup_tc_block() without marking NULL,and mtk_wed_setup_tc_block_cb() didn't check the value, too. Assign NULL after free cb_priv in mtk_wed_setup_tc_block() and check NULL in mtk_wed_setup_tc_block_cb(). ---------- Unable to handle kernel paging request at virtual address 0072460bca32b4f5 Call trace: mtk_wed_setup_tc_block_cb+0x4/0x38 0xffffffc0794084bc tcf_block_playback_offloads+0x70/0x1e8 tcf_block_unbind+0x6c/0xc8 ... --------- Fixes: 799684448e3e ("net: ethernet: mtk_wed: introduce wed wo support") Signed-off-by: Zheng Zhang Signed-off-by: David S. Miller drivers/net/ethernet/mediatek/mtk_wed.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) commit 32316f676b4ee87c0404d333d248ccf777f739bc Author: Haiyang Zhang Date: Fri Aug 9 14:01:24 2024 -0700 net: mana: Fix RX buf alloc_size alignment and atomic op panic The MANA driver's RX buffer alloc_size is passed into napi_build_skb() to create SKB. skb_shinfo(skb) is located at the end of skb, and its alignment is affected by the alloc_size passed into napi_build_skb(). The size needs to be aligned properly for better performance and atomic operations. Otherwise, on ARM64 CPU, for certain MTU settings like 4000, atomic operations may panic on the skb_shinfo(skb)->dataref due to alignment fault. To fix this bug, add proper alignment to the alloc_size calculation. Sample panic info: [ 253.298819] Unable to handle kernel paging request at virtual address ffff000129ba5cce [ 253.300900] Mem abort info: [ 253.301760] ESR = 0x0000000096000021 [ 253.302825] EC = 0x25: DABT (current EL), IL = 32 bits [ 253.304268] SET = 0, FnV = 0 [ 253.305172] EA = 0, S1PTW = 0 [ 253.306103] FSC = 0x21: alignment fault Call trace: __skb_clone+0xfc/0x198 skb_clone+0x78/0xe0 raw6_local_deliver+0xfc/0x228 ip6_protocol_deliver_rcu+0x80/0x500 ip6_input_finish+0x48/0x80 ip6_input+0x48/0xc0 ip6_sublist_rcv_finish+0x50/0x78 ip6_sublist_rcv+0x1cc/0x2b8 ipv6_list_rcv+0x100/0x150 __netif_receive_skb_list_core+0x180/0x220 netif_receive_skb_list_internal+0x198/0x2a8 __napi_poll+0x138/0x250 net_rx_action+0x148/0x330 handle_softirqs+0x12c/0x3a0 Cc: stable@vger.kernel.org Fixes: 80f6215b450e ("net: mana: Add support for jumbo frame") Signed-off-by: Haiyang Zhang Reviewed-by: Long Li Signed-off-by: David S. Miller drivers/net/ethernet/microsoft/mana/mana_en.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) commit c25504a0ba36968f919aa30caff172ef23346299 Author: Frank Li Date: Fri Aug 9 16:06:53 2024 -0400 dt-bindings: net: fsl,qoriq-mc-dpmac: add missed property phys Add missed property phys, which indicate how connect to serdes phy. Fix below warning: arch/arm64/boot/dts/freescale/fsl-lx2160a-honeycomb.dtb: fsl-mc@80c000000: dpmacs:ethernet@7: Unevaluated properties are not allowed ('phys' was unexpected) Signed-off-by: Frank Li Reviewed-by: Krzysztof Kozlowski Signed-off-by: David S. Miller Documentation/devicetree/bindings/net/fsl,qoriq-mc-dpmac.yaml | 4 ++++ 1 file changed, 4 insertions(+) commit e7e846dc6c73fbc94ae8b4ec20d05627646416f2 Author: Christophe Leroy Date: Thu Aug 8 09:05:08 2024 +0200 powerpc/mm: Fix boot warning with hugepages and CONFIG_DEBUG_VIRTUAL Booting with CONFIG_DEBUG_VIRTUAL leads to following warning when passing hugepage reservation on command line: Kernel command line: hugepagesz=1g hugepages=1 hugepagesz=64m hugepages=1 hugepagesz=256m hugepages=1 noreboot HugeTLB: allocating 1 of page size 1.00 GiB failed. Only allocated 0 hugepages. ------------[ cut here ]------------ WARNING: CPU: 0 PID: 0 at arch/powerpc/include/asm/io.h:948 __alloc_bootmem_huge_page+0xd4/0x284 Modules linked in: CPU: 0 PID: 0 Comm: swapper Not tainted 6.10.0-rc6-00396-g6b0e82791bd0-dirty #936 Hardware name: MPC8544DS e500v2 0x80210030 MPC8544 DS NIP: c1020240 LR: c10201d0 CTR: 00000000 REGS: c13fdd30 TRAP: 0700 Not tainted (6.10.0-rc6-00396-g6b0e82791bd0-dirty) MSR: 00021000 CR: 44084288 XER: 20000000 GPR00: c10201d0 c13fde20 c130b560 e8000000 e8001000 00000000 00000000 c1420000 GPR08: 00000000 00028001 00000000 00000004 44084282 01066ac0 c0eb7c9c efffe149 GPR16: c0fc4228 0000005f ffffffff c0eb7d0c c0eb7cc0 c0eb7ce0 ffffffff 00000000 GPR24: c1441cec efffe153 e8001000 c14240c0 00000000 c1441d64 00000000 e8000000 NIP [c1020240] __alloc_bootmem_huge_page+0xd4/0x284 LR [c10201d0] __alloc_bootmem_huge_page+0x64/0x284 Call Trace: [c13fde20] [c10201d0] __alloc_bootmem_huge_page+0x64/0x284 (unreliable) [c13fde50] [c10207b8] hugetlb_hstate_alloc_pages+0x8c/0x3e8 [c13fdeb0] [c1021384] hugepages_setup+0x240/0x2cc [c13fdef0] [c1000574] unknown_bootoption+0xfc/0x280 [c13fdf30] [c0078904] parse_args+0x200/0x4c4 [c13fdfa0] [c1000d9c] start_kernel+0x238/0x7d0 [c13fdff0] [c0000434] set_ivor+0x12c/0x168 Code: 554aa33e 7c042840 3ce0c142 80a7427c 5109a016 50caa016 7c9a2378 7fdcf378 4180000c 7c052040 41810160 7c095040 <0fe00000> 38c00000 40800108 3c60c0eb ---[ end trace 0000000000000000 ]--- This is due to virt_addr_valid() using high_memory before it is set. high_memory is set in mem_init() using max_low_pfn, but max_low_pfn is available long before, it is set in mem_topology_setup(). So just like commit daa9ada2093e ("powerpc/mm: Fix boot crash with FLATMEM") moved the setting of max_mapnr immediately after the call to mem_topology_setup(), the same can be done for high_memory. Signed-off-by: Christophe Leroy Signed-off-by: Michael Ellerman Link: https://msgid.link/62b69c4baad067093f39e7e60df0fe27a86b8d2a.1723100702.git.christophe.leroy@csgroup.eu arch/powerpc/kernel/setup-common.c | 1 + arch/powerpc/mm/mem.c | 2 -- 2 files changed, 1 insertion(+), 2 deletions(-) commit e7a9af8c93aa9f408f9972809b642faeec5287e1 Author: Christophe Leroy Date: Thu Aug 8 11:32:47 2024 +0200 powerpc/mm: Fix size of allocated PGDIR Commit 6b0e82791bd0 ("powerpc/e500: switch to 64 bits PGD on 85xx (32 bits)") increased the size of PGD entries but failed to increase the PGD directory. Use the size of pgd_t instead of the size of pointers to calculate the allocated size. Reported-by: Guenter Roeck Fixes: 6b0e82791bd0 ("powerpc/e500: switch to 64 bits PGD on 85xx (32 bits)") Signed-off-by: Christophe Leroy Tested-by: Guenter Roeck Signed-off-by: Michael Ellerman Link: https://msgid.link/1cdaacb391cbd3e0240f0e0faf691202874e9422.1723109462.git.christophe.leroy@csgroup.eu arch/powerpc/mm/init-common.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) commit 8512fbb64b0e599412da661412d10d4ba1cb003c Author: Michal Vokáč Date: Tue Jul 23 16:25:19 2024 +0200 ARM: dts: imx6dl-yapp43: Increase LED current to match the yapp4 HW design On the imx6dl-yapp4 revision based boards, the RGB LED is not driven directly by the LP5562 driver but through FET transistors. Hence the LED current is not determined by the driver but by the LED series resistors. On the imx6dl-yapp43 revision based boards, we removed the FET transistors to drive the LED directly from the LP5562 but forgot to tune the output current to match the previous HW design. Set the LED current on imx6dl-yapp43 based boards to the same values measured on the imx6dl-yapp4 boards and limit the maximum current to 20mA. Fixes: 7da4734751e0 ("ARM: dts: imx6dl-yapp43: Add support for new HW revision of the IOTA board") Cc: Signed-off-by: Michal Vokáč Signed-off-by: Shawn Guo arch/arm/boot/dts/nxp/imx/imx6dl-yapp43-common.dtsi | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-) commit 1fc2021941241bf32728a198bc0a7f38669e44a5 Merge: 9ff2f816e2aa de7a670f8def Author: David S. Miller Date: Mon Aug 12 11:46:56 2024 +0100 Merge branch 'vsc73xx-fix-mdio-and-phy' Pawel Dembicki says: ==================== net: dsa: vsc73xx: fix MDIO bus access and PHY opera This series are extracted patches from net-next series [0]. The VSC73xx driver has issues with PHY configuration. This patch series fixes most of them. The first patch synchronizes the register configuration routine with the datasheet recommendations. Patches 2-3 restore proper communication on the MDIO bus. Currently, the write value isn't sent to the MDIO register, and without a busy check, communication with the PHY can be interrupted. This causes the PHY to receive improper configuration and autonegotiation could fail. The fourth patch removes the PHY reset blockade, as it is no longer required. After fixing the MDIO operations, autonegotiation became possible. The last patch removes the blockade, which became unnecessary after the MDIO operations fix. [0] https://patchwork.kernel.org/project/netdevbpf/list/?series=874739&state=%2A&archive=both ==================== Signed-off-by: David S. Miller commit de7a670f8defe4ed2115552ad23dea0f432f7be4 Author: Pawel Dembicki Date: Fri Aug 9 21:38:06 2024 +0200 net: phy: vitesse: repair vsc73xx autonegotiation When the vsc73xx mdio bus work properly, the generic autonegotiation configuration works well. Reviewed-by: Linus Walleij Signed-off-by: Pawel Dembicki Signed-off-by: David S. Miller drivers/net/phy/vitesse.c | 14 -------------- 1 file changed, 14 deletions(-) commit 9f9a72654622bae75adb1e1923d709e96ede3042 Author: Pawel Dembicki Date: Fri Aug 9 21:38:05 2024 +0200 net: dsa: vsc73xx: allow phy resetting Resetting the VSC73xx PHY was problematic because the MDIO bus, without a busy check, read and wrote incorrect register values. My investigation indicates that resetting the PHY only triggers changes in configuration. However, improper register values written earlier were only exposed after a soft reset. The reset itself wasn't the issue; rather, the problem stemmed from incorrect read and write operations. A 'soft_reset' can now proceed normally. There are no reasons to keep the VSC73xx from being reset. This commit removes the reset blockade in the 'vsc73xx_phy_write' function. Reviewed-by: Linus Walleij Reviewed-by: Florian Fainelli Signed-off-by: Pawel Dembicki Signed-off-by: David S. Miller drivers/net/dsa/vitesse-vsc73xx-core.c | 11 ----------- 1 file changed, 11 deletions(-) commit fa63c6434b6f6aaf9d8d599dc899bc0a074cc0ad Author: Pawel Dembicki Date: Fri Aug 9 21:38:04 2024 +0200 net: dsa: vsc73xx: check busy flag in MDIO operations The VSC73xx has a busy flag used during MDIO operations. It is raised when MDIO read/write operations are in progress. Without it, PHYs are misconfigured and bus operations do not work as expected. Fixes: 05bd97fc559d ("net: dsa: Add Vitesse VSC73xx DSA router driver") Reviewed-by: Linus Walleij Reviewed-by: Florian Fainelli Signed-off-by: Pawel Dembicki Signed-off-by: David S. Miller drivers/net/dsa/vitesse-vsc73xx-core.c | 37 +++++++++++++++++++++++++++++++++- 1 file changed, 36 insertions(+), 1 deletion(-) commit 5b9eebc2c7a5f0cc7950d918c1e8a4ad4bed5010 Author: Pawel Dembicki Date: Fri Aug 9 21:38:03 2024 +0200 net: dsa: vsc73xx: pass value in phy_write operation In the 'vsc73xx_phy_write' function, the register value is missing, and the phy write operation always sends zeros. This commit passes the value variable into the proper register. Fixes: 05bd97fc559d ("net: dsa: Add Vitesse VSC73xx DSA router driver") Reviewed-by: Linus Walleij Reviewed-by: Florian Fainelli Signed-off-by: Pawel Dembicki Signed-off-by: David S. Miller drivers/net/dsa/vitesse-vsc73xx-core.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 63796bc2e97cd5ebcef60bad4953259d4ad11cb4 Author: Pawel Dembicki Date: Fri Aug 9 21:38:02 2024 +0200 net: dsa: vsc73xx: fix port MAC configuration in full duplex mode According to the datasheet description ("Port Mode Procedure" in 5.6.2), the VSC73XX_MAC_CFG_WEXC_DIS bit is configured only for half duplex mode. The WEXC_DIS bit is responsible for MAC behavior after an excessive collision. Let's set it as described in the datasheet. Fixes: 05bd97fc559d ("net: dsa: Add Vitesse VSC73xx DSA router driver") Reviewed-by: Linus Walleij Reviewed-by: Florian Fainelli Signed-off-by: Pawel Dembicki Signed-off-by: David S. Miller drivers/net/dsa/vitesse-vsc73xx-core.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) commit 9ff2f816e2aa65ca9a1cdf0954842f8173c0f48d Author: Radhey Shyam Pandey Date: Fri Aug 9 11:56:09 2024 +0530 net: axienet: Fix register defines comment description In axiethernet header fix register defines comment description to be inline with IP documentation. It updates MAC configuration register, MDIO configuration register and frame filter control description. Fixes: 8a3b7a252dca ("drivers/net/ethernet/xilinx: added Xilinx AXI Ethernet driver") Signed-off-by: Radhey Shyam Pandey Reviewed-by: Andrew Lunn Signed-off-by: David S. Miller drivers/net/ethernet/xilinx/xilinx_axienet.h | 16 ++++++++-------- 1 file changed, 8 insertions(+), 8 deletions(-) commit a9a18e8f770c9b0703dab93580d0b02e199a4c79 Author: Dan Carpenter Date: Fri Aug 9 15:28:19 2024 +0300 atm: idt77252: prevent use after free in dequeue_rx() We can't dereference "skb" after calling vcc->push() because the skb is released. Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Signed-off-by: Dan Carpenter Signed-off-by: David S. Miller drivers/atm/idt77252.c | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-) commit 1472464c6248575bf2d01c7f076b94704bb32c95 Author: Masahiro Yamada Date: Thu Aug 8 03:03:00 2024 +0900 kbuild: avoid scripts/kallsyms parsing /dev/null On macOS, as reported by Daniel Gomez, getline() sets ENOTTY to errno if it is requested to read from /dev/null. If this is worth fixing, I would rather pass an empty file to scripts/kallsyms instead of adding the ugly #ifdef __APPLE__. Fixes: c442db3f49f2 ("kbuild: remove PROVIDE() for kallsyms symbols") Reported-by: Daniel Gomez Closes: https://lore.kernel.org/all/20240807-macos-build-support-v1-12-4cd1ded85694@samsung.com/ Signed-off-by: Masahiro Yamada Reviewed-by: Nicolas Schier Reviewed-by: Daniel Gomez scripts/link-vmlinux.sh | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) commit e332a5aba83500e8d422c90d2a84d8a5f888673e Author: Masahiro Yamada Date: Thu Aug 8 02:47:28 2024 +0900 treewide: remove unnecessary inclusion These files do not use any macros defined in . Signed-off-by: Masahiro Yamada Reviewed-by: Nicolas Schier drivers/accessibility/speakup/genmap.c | 1 - drivers/accessibility/speakup/makemapdata.c | 1 - drivers/staging/media/atomisp/include/linux/atomisp.h | 1 - samples/trace_events/trace_custom_sched.c | 1 - sound/soc/codecs/cs42l42.c | 1 - 5 files changed, 5 deletions(-) commit 2c71c8459c8ca66bd8f597effaac892ee8448a9f Author: Bouke Sybren Haarsma Date: Sun Jul 28 14:47:31 2024 +0200 drm: panel-orientation-quirks: Add quirk for Ayn Loki Max Add quirk orientation for Ayn Loki Max model. This has been tested by JELOS team that uses their own patched kernel for a while now and confirmed by users in the ChimeraOS discord servers. Signed-off-by: Bouke Sybren Haarsma Reviewed-by: Hans de Goede Signed-off-by: Hans de Goede Link: https://patchwork.freedesktop.org/patch/msgid/20240728124731.168452-3-boukehaarsma23@gmail.com drivers/gpu/drm/drm_panel_orientation_quirks.c | 6 ++++++ 1 file changed, 6 insertions(+) commit b86aa4140f6a8f01f35bfb05af60e01a55b48803 Author: Bouke Sybren Haarsma Date: Sun Jul 28 14:47:30 2024 +0200 drm: panel-orientation-quirks: Add quirk for Ayn Loki Zero Add quirk orientation for the Ayn Loki Zero. This also has been tested/used by the JELOS team. Signed-off-by: Bouke Sybren Haarsma Reviewed-by: Hans de Goede Signed-off-by: Hans de Goede Link: https://patchwork.freedesktop.org/patch/msgid/20240728124731.168452-2-boukehaarsma23@gmail.com drivers/gpu/drm/drm_panel_orientation_quirks.c | 6 ++++++ 1 file changed, 6 insertions(+) commit 004eb8ba776ccd3e296ea6f78f7ae7985b12824e Author: Lianqin Hu Date: Sun Aug 11 08:30:11 2024 +0000 ALSA: usb-audio: Add delay quirk for VIVO USB-C-XE710 HEADSET Audio control requests that sets sampling frequency sometimes fail on this card. Adding delay between control messages eliminates that problem. Signed-off-by: Lianqin Hu Cc: Link: https://patch.msgid.link/TYUPR06MB6217FF67076AF3E49E12C877D2842@TYUPR06MB6217.apcprd06.prod.outlook.com Signed-off-by: Takashi Iwai sound/usb/quirks.c | 2 ++ 1 file changed, 2 insertions(+) commit eb75d05d96b824e14efa4de6c30692d300a9ce67 Merge: ef9718b3d54e 03c5c350e38d Author: Takashi Iwai Date: Mon Aug 12 09:17:57 2024 +0200 Merge branch 'topic/cirrus-hp-g12' into for-linus Pull Cirrus HD-audio quirks for HP G12 laptops. Signed-off-by: Takashi Iwai commit 03c5c350e38d9346b69357d0e52c3c40495c14a0 Author: Simon Trimmer Date: Fri Aug 2 16:22:15 2024 +0100 ALSA: hda/realtek: Add support for new HP G12 laptops Some of these laptop models have quirk IDs that are identical but have different amplifier parts fitted, this difference is described in the ACPI information. The solution introduced for this product family can derive the required component binding information from ACPI instead of hardcoding it, supports the new variants of the CS35L56 being used and has generalized naming that makes it applicable to other ALC+amp combinations. Signed-off-by: Simon Trimmer Signed-off-by: Richard Fitzgerald Link: https://patch.msgid.link/20240802152215.20831-4-rf@opensource.cirrus.com Signed-off-by: Takashi Iwai sound/pci/hda/patch_realtek.c | 99 +++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 99 insertions(+) commit 9219b179bab20563c43aee0c195e1e9304a9deed Merge: 7c626ce4bae1 90ec3a8a7fd0 Author: Takashi Iwai Date: Mon Aug 12 09:15:01 2024 +0200 Merge tag 'spi-acpi-lookup-dummy' of https://git.kernel.org/pub/scm/linux/kernel/git/broonie/spi into topic/cirrus-hp-g12 spi: Add empty versions of ACPI lookup functions A patch from Richard Fitzgerald adding dummy versions of the ACPI lookup functions for SPI: Provide empty versions of acpi_spi_count_resources(), acpi_spi_device_alloc() and acpi_spi_find_controller_by_adev() if the real functions are not being built. This commit fixes two problems with the original definitions: 1) There wasn't an empty version of these functions 2) The #if only depended on CONFIG_ACPI. But the functions are implemented in the core spi.c so CONFIG_SPI_MASTER must also be enabled for the real functions to exist. commit 109f256285dd6a5f8c3bd0d80d39b2ccd4fe314e Author: Shenwei Wang Date: Mon Jul 15 08:17:22 2024 -0500 arm64: dts: imx93: update default value for snps,clk-csr For the i.MX93 SoC, the default clock rate for the IP of STMMAC EQOS is 312.5 MHz. According to the following mapping table from the i.MX93 reference manual, this clock rate corresponds to a CSR value of 6. 0000: CSR clock = 60-100 MHz; MDC clock = CSR clock/42 0001: CSR clock = 100-150 MHz; MDC clock = CSR clock/62 0010: CSR clock = 20-35 MHz; MDC clock = CSR clock/16 0011: CSR clock = 35-60 MHz; MDC clock = CSR clock/26 0100: CSR clock = 150-250 MHz; MDC clock = CSR clock/102 0101: CSR clock = 250-300 MHz; MDC clock = CSR clock/124 0110: CSR clock = 300-500 MHz; MDC clock = CSR clock/204 0111: CSR clock = 500-800 MHz; MDC clock = CSR clock/324 Fixes: f2d03ba997cb ("arm64: dts: imx93: reorder device nodes") Signed-off-by: Shenwei Wang Signed-off-by: Shawn Guo arch/arm64/boot/dts/freescale/imx93.dtsi | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 4736ad9422cb86f15464d2bd579c1f5d7786bb61 Author: Sascha Hauer Date: Mon Jul 15 11:32:31 2024 +0200 arm64: dts: freescale: tqma9352: Fix watchdog reset On the tqma9352 the board is reset through an external PMIC, so set the fsl,ext-reset-output property to enable triggering the output pin on a watchdog trigger. Signed-off-by: Sascha Hauer Reviewed-by: Fabio Estevam Reviewed-by: Alexander Stein Signed-off-by: Shawn Guo arch/arm64/boot/dts/freescale/imx93-tqma9352.dtsi | 1 + 1 file changed, 1 insertion(+) commit 4e69cd835a2d5c3915838491f59a68ee697a87d0 Author: Adam Ford Date: Sun Jul 14 12:20:17 2024 -0500 arm64: dts: imx8mp-beacon-kit: Fix Stereo Audio on WM8962 The L/R clock needs to be controlled by the SAI3 instead of the CODEC to properly achieve stereo sound. Doing this allows removes the need for unnecessary clock manipulation to try to get the CODEC's clock in sync with the SAI3 clock, since the CODEC can cope with a wide variety of clock inputs. Fixes: 161af16c18f3 ("arm64: dts: imx8mp-beacon-kit: Fix audio_pll2 clock") Fixes: 69e2f37a6ddc ("arm64: dts: imx8mp-beacon-kit: Enable WM8962 Audio CODEC") Signed-off-by: Adam Ford Signed-off-by: Shawn Guo arch/arm64/boot/dts/freescale/imx8mp-beacon-kit.dts | 12 +++++------- 1 file changed, 5 insertions(+), 7 deletions(-) commit 7c626ce4bae1ac14f60076d00eafe71af30450ba Author: Linus Torvalds Date: Sun Aug 11 14:27:14 2024 -0700 Linux 6.11-rc3 Makefile | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 7006fe2f7f781fc96c8bab9df0c0417fd670a8e1 Merge: 7270e931b530 919f18f961c0 Author: Linus Torvalds Date: Sun Aug 11 10:20:29 2024 -0700 Merge tag 'x86-urgent-2024-08-11' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull x86 fixes from Thomas Gleixner: - Fix 32-bit PTI for real. pti_clone_entry_text() is called twice, once before initcalls so that initcalls can use the user-mode helper and then again after text is set read only. Setting read only on 32-bit might break up the PMD mapping, which makes the second invocation of pti_clone_entry_text() find the mappings out of sync and failing. Allow the second call to split the existing PMDs in the user mapping and synchronize with the kernel mapping. - Don't make acpi_mp_wake_mailbox read-only after init as the mail box must be writable in the case that CPU hotplug operations happen after boot. Otherwise the attempt to start a CPU crashes with a write to read only memory. - Add a missing sanity check in mtrr_save_state() to ensure that the fixed MTRR MSRs are supported. Otherwise mtrr_save_state() ends up in a #GP, which is fixed up, but the WARN_ON() can bring systems down when panic on warn is set. * tag 'x86-urgent-2024-08-11' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: x86/mtrr: Check if fixed MTRRs exist before saving them x86/paravirt: Fix incorrect virt spinlock setting on bare metal x86/acpi: Remove __ro_after_init from acpi_mp_wake_mailbox x86/mm: Fix PTI for i386 some more commit 7270e931b53025c1070c2dda30a0ba7f1b2c072c Merge: 56fe0a6a9f89 5916be8a53de Author: Linus Torvalds Date: Sun Aug 11 10:15:34 2024 -0700 Merge tag 'timers-urgent-2024-08-11' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull time keeping fixes from Thomas Gleixner: - Fix a couple of issues in the NTP code where user supplied values are neither sanity checked nor clamped to the operating range. This results in integer overflows and eventualy NTP getting out of sync. According to the history the sanity checks had been removed in favor of clamping the values, but the clamping never worked correctly under all circumstances. The NTP people asked to not bring the sanity checks back as it might break existing applications. Make the clamping work correctly and add it where it's missing - If adjtimex() sets the clock it has to trigger the hrtimer subsystem so it can adjust and if the clock was set into the future expire timers if needed. The caller should provide a bitmask to tell hrtimers which clocks have been adjusted. adjtimex() uses not the proper constant and uses CLOCK_REALTIME instead, which is 0. So hrtimers adjusts only the clocks, but does not check for expired timers, which might make them expire really late. Use the proper bitmask constant instead. * tag 'timers-urgent-2024-08-11' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: timekeeping: Fix bogus clock_was_set() invocation in do_adjtimex() ntp: Safeguard against time_constant overflow ntp: Clamp maxerror and esterror to operating range commit 56fe0a6a9f8941b154bd6a41ed828e9e1078b67b Merge: cb2e5ee8e7a0 03f9885c60ad Author: Linus Torvalds Date: Sun Aug 11 10:07:52 2024 -0700 Merge tag 'irq-urgent-2024-08-11' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull irq fixes from Thomas Gleixner: "Three small fixes for interrupt core and drivers: - The interrupt core fails to honor caller supplied affinity hints for non-managed interrupts and uses the system default affinity on startup instead. Set the missing flag in the descriptor to tell the core to use the provided affinity. - Fix a shift out of bounds error in the Xilinx driver - Handle switching to level trigger correctly in the RISCV APLIC driver. It failed to retrigger the interrupt which causes it to become stale" * tag 'irq-urgent-2024-08-11' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: irqchip/riscv-aplic: Retrigger MSI interrupt on source configuration irqchip/xilinx: Fix shift out of bounds genirq/irqdesc: Honor caller provided affinity in alloc_desc() commit cb2e5ee8e7a04be6a762b51241701b5105b82022 Merge: 42b34a8de31f 65ba8cef0416 Author: Linus Torvalds Date: Sun Aug 11 09:55:32 2024 -0700 Merge tag 'usb-6.11-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb Pull USB fixes from Greg KH: "Here are a number of small USB driver fixes for reported issues for 6.11-rc3. Included in here are: - usb serial driver MODULE_DESCRIPTION() updates - usb serial driver fixes - typec driver fixes - usb-ip driver fix - gadget driver fixes - dt binding update All of these have been in linux-next with no reported issues" * tag 'usb-6.11-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb: usb: typec: ucsi: Fix a deadlock in ucsi_send_command_common() usb: typec: tcpm: avoid sink goto SNK_UNATTACHED state if not received source capability message usb: gadget: f_fs: pull out f->disable() from ffs_func_set_alt() usb: gadget: f_fs: restore ffs_func_disable() functionality USB: serial: debug: do not echo input by default usb: typec: tipd: Delete extra semi-colon usb: typec: tipd: Fix dereferencing freeing memory in tps6598x_apply_patch() usb: gadget: u_serial: Set start_delayed during suspend usb: typec: tcpci: Fix error code in tcpci_check_std_output_cap() usb: typec: fsa4480: Check if the chip is really there usb: gadget: core: Check for unset descriptor usb: vhci-hcd: Do not drop references before new references are gained usb: gadget: u_audio: Check return codes from usb_ep_enable and config_ep_by_speed. usb: gadget: midi2: Fix the response for FB info with block 0xff dt-bindings: usb: microchip,usb2514: Add USB2517 compatible USB: serial: garmin_gps: use struct_size() to allocate pkt USB: serial: garmin_gps: annotate struct garmin_packet with __counted_by USB: serial: add missing MODULE_DESCRIPTION() macros USB: serial: spcp8x5: remove unused struct 'spcp8x5_usb_ctrl_arg' commit 42b34a8de31f1de4bffbf7cc5a2ea699af8dca8a Merge: 84e6da575215 6e20753da6bc Author: Linus Torvalds Date: Sun Aug 11 09:51:29 2024 -0700 Merge tag 'tty-6.11-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/tty Pull tty / serial driver fixes from Greg KH: "Here are some small tty and serial driver fixes for reported problems for 6.11-rc3. Included in here are: - sc16is7xx serial driver fixes - uartclk bugfix for a divide by zero issue - conmakehash userspace build issue fix All of these have been in linux-next for a while with no reported issues" * tag 'tty-6.11-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/tty: tty: vt: conmakehash: cope with abs_srctree no longer in env serial: sc16is7xx: fix invalid FIFO access with special register set serial: sc16is7xx: fix TX fifo corruption serial: core: check uartclk for zero to avoid divide by zero commit 84e6da575215154cf6aa1e17661989d3b37bb3c1 Merge: 9221afb2d8e8 15fffc6a5624 Author: Linus Torvalds Date: Sun Aug 11 09:38:38 2024 -0700 Merge tag 'driver-core-6.11-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/driver-core Pull driver core / documentation fixes from Greg KH: "Here are some small fixes, and some documentation updates for 6.11-rc3. Included in here are: - embargoed hardware documenation updates based on a lot of review by legal-types in lots of companies to try to make the process a _bit_ easier for us to manage over time. - rust firmware documentation fix - driver detach race fix for the fix that went into 6.11-rc1 All of these have been in linux-next for a while with no reported issues" * tag 'driver-core-6.11-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/driver-core: driver core: Fix uevent_show() vs driver detach race Documentation: embargoed-hardware-issues.rst: add a section documenting the "early access" process Documentation: embargoed-hardware-issues.rst: minor cleanups and fixes rust: firmware: fix invalid rustdoc link commit 9221afb2d8e8db75bbf71a223010e37db1b64f30 Merge: 04cc50c2f38b ffcf2eb4bfa2 Author: Linus Torvalds Date: Sun Aug 11 09:32:54 2024 -0700 Merge tag 'char-misc-6.11-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc Pull char/misc fixes from Greg KH: "Here are some small char/misc/other driver fixes for 6.11-rc3 for reported issues. Included in here are: - binder driver fixes - fsi MODULE_DESCRIPTION() additions (people seem to love them...) - eeprom driver fix - Kconfig dependency fix to resolve build issues - spmi driver fixes All of these have been in linux-next for a while with no reported problems" * tag 'char-misc-6.11-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc: spmi: pmic-arb: add missing newline in dev_err format strings spmi: pmic-arb: Pass the correct of_node to irq_domain_add_tree binder_alloc: Fix sleeping function called from invalid context binder: fix descriptor lookup for context manager char: add missing NetWinder MODULE_DESCRIPTION() macros misc: mrvl-cn10k-dpi: add PCI_IOV dependency eeprom: ee1004: Fix locking issues in ee1004_probe() fsi: add missing MODULE_DESCRIPTION() macros commit 04cc50c2f38b032a167b289f1b351a83dbcb853e Merge: 5189dafa4cf9 f874d7210d88 Author: Linus Torvalds Date: Sun Aug 11 09:28:04 2024 -0700 Merge tag 'scsi-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi Pull SCSI fixes from James Bottomley: "Two core fixes: one to prevent discard type changes (seen on iSCSI) during intermittent errors and the other is fixing a lockdep problem caused by the queue limits change. And one driver fix in ufs" * tag 'scsi-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi: scsi: sd: Keep the discard mode stable scsi: sd: Move sd_read_cpr() out of the q->limits_lock region scsi: ufs: core: Fix hba->last_dme_cmd_tstamp timestamp updating logic commit ef9718b3d54e822de294351251f3a574f8a082ce Author: Parsa Poorshikhian Date: Sat Aug 10 18:39:06 2024 +0330 ALSA: hda/realtek: Fix noise from speakers on Lenovo IdeaPad 3 15IAU7 Fix noise from speakers connected to AUX port when no sound is playing. The problem occurs because the `alc_shutup_pins` function includes a 0x10ec0257 vendor ID, which causes noise on Lenovo IdeaPad 3 15IAU7 with Realtek ALC257 codec when no sound is playing. Removing this vendor ID from the function fixes the bug. Fixes: 70794b9563fe ("ALSA: hda/realtek: Add more codec ID to no shutup pins list") Signed-off-by: Parsa Poorshikhian Link: https://patch.msgid.link/20240810150939.330693-1-parsa.poorsh@gmail.com Signed-off-by: Takashi Iwai sound/pci/hda/patch_realtek.c | 1 - 1 file changed, 1 deletion(-) commit 484caf207629e94f8414ffd50d2287ca3c7698e3 Merge: 9a039eeb71a4 6c3fc0b1c3d0 Author: David S. Miller Date: Sun Aug 11 04:49:53 2024 +0100 Merge branch '1GbE' of git://git.kernel.org/pub/scm/linux/kernel/git/tnguy/net-q ueue Tony Nguyen says: ==================== Intel Wired LAN Driver Updates 2024-08-07 (igc) This series contains updates to igc driver only. Faizal adjusts the size of the MAC internal buffer on i226 devices to resolve an errata for leaking packet transmits. He also corrects a condition in which qbv_config_change_errors are incorrectly counted. Lastly, he adjusts the conditions for resetting the adapter when changing TSN Tx mode and corrects the conditions in which gtxoffset register is set. ==================== Signed-off-by: David S. Miller commit 9a039eeb71a42c8b13408a1976e300f3898e1be0 Author: Moon Yeounsu Date: Wed Aug 7 19:07:21 2024 +0900 net: ethernet: use ip_hdrlen() instead of bit shift `ip_hdr(skb)->ihl << 2` is the same as `ip_hdrlen(skb)` Therefore, we should use a well-defined function not a bit shift to find the header length. It also compresses two lines to a single line. Signed-off-by: Moon Yeounsu Reviewed-by: Christophe JAILLET Signed-off-by: David S. Miller drivers/net/ethernet/jme.c | 10 ++++------ 1 file changed, 4 insertions(+), 6 deletions(-) commit aad41832326723627ad8ac9ee8a543b6dca4454d Author: Asmaa Mnebhi Date: Tue Jun 11 13:15:09 2024 -0400 gpio: mlxbf3: Support shutdown() function During Linux graceful reboot, the GPIO interrupts are not disabled. Since the drivers are not removed during graceful reboot, the logic to call mlxbf3_gpio_irq_disable() is not triggered. Interrupts that remain enabled can cause issues on subsequent boots. For example, the mlxbf-gige driver contains PHY logic to bring up the link. If the gpio-mlxbf3 driver loads first, the mlxbf-gige driver will use a GPIO interrupt to bring up the link. Otherwise, it will use polling. The next time Linux boots and loads the drivers in this order, we encounter the issue: - mlxbf-gige loads first and uses polling while the GPIO10 interrupt is still enabled from the previous boot. So if the interrupt triggers, there is nothing to clear it. - gpio-mlxbf3 loads. - i2c-mlxbf loads. The interrupt doesn't trigger for I2C because it is shared with the GPIO interrupt line which was not cleared. The solution is to add a shutdown function to the GPIO driver to clear and disable all interrupts. Also clear the interrupt after disabling it in mlxbf3_gpio_irq_disable(). Fixes: 38a700efc510 ("gpio: mlxbf3: Add gpio driver support") Signed-off-by: Asmaa Mnebhi Reviewed-by: David Thompson Reviewed-by: Andy Shevchenko Reviewed-by: Linus Walleij Link: https://lore.kernel.org/r/20240611171509.22151-1-asmaa@nvidia.com Signed-off-by: Bartosz Golaszewski drivers/gpio/gpio-mlxbf3.c | 14 ++++++++++++++ 1 file changed, 14 insertions(+) commit 5189dafa4cf950e675f02ee04b577dfbbad0d9b1 Merge: 7299cd48aece 91da337e5d50 Author: Linus Torvalds Date: Sat Aug 10 10:44:21 2024 -0700 Merge tag 'nfsd-6.11-1' of git://git.kernel.org/pub/scm/linux/kernel/git/cel/linux Pull nfsd fixes from Chuck Lever: - Two minor fixes for recent changes * tag 'nfsd-6.11-1' of git://git.kernel.org/pub/scm/linux/kernel/git/cel/linux: nfsd: don't set SVC_SOCK_ANONYMOUS when creating nfsd sockets sunrpc: avoid -Wformat-security warning commit 7299cd48aeceba873a52968d6d6edb34c15bac11 Merge: 0409cc53c421 01a620d49159 Author: Linus Torvalds Date: Sat Aug 10 10:28:52 2024 -0700 Merge tag 'i2c-for-6.11-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/wsa/linux Pull i2c fixes from Wolfram Sang: - Two fixes for SMBusAlert handling in the I2C core: one to avoid an endless loop when scanning for handlers and one to make sure handlers are always called even if HW has broken behaviour - I2C header build fix for when ACPI is enabled but I2C isn't - The testunit gets a rename in the code to match the documentation - Two fixes for the Qualcomm GENI I2C controller are cleaning up the error exit patch in the runtime_resume() function. The first is disabling the clock, the second disables the icc on the way out * tag 'i2c-for-6.11-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/wsa/linux: i2c: testunit: match HostNotify test name with docs i2c: qcom-geni: Add missing geni_icc_disable in geni_i2c_runtime_resume i2c: qcom-geni: Add missing clk_disable_unprepare in geni_i2c_runtime_resume i2c: Fix conditional for substituting empty ACPI functions i2c: smbus: Send alert notifications to all devices if source not found i2c: smbus: Improve handling of stuck alerts commit 0409cc53c42129cfeeaea610d0ebb91934491dca Merge: 31b244460634 bd44ca3de49c Author: Linus Torvalds Date: Sat Aug 10 10:19:05 2024 -0700 Merge tag 'dma-mapping-6.11-2024-08-10' of git://git.infradead.org/users/hch/dma-mapping Pull dma-mapping fix from Christoph Hellwig: - avoid a deadlock with dma-debug and netconsole (Rik van Riel) * tag 'dma-mapping-6.11-2024-08-10' of git://git.infradead.org/users/hch/dma-mapping: dma-debug: avoid deadlock between dma debug vs printk and netconsole commit 31b244460634c74430745a74e56f5c88c43f079b Merge: 34ac1e82e5a7 8a2491db7bea Author: Linus Torvalds Date: Sat Aug 10 10:06:26 2024 -0700 Merge tag 'bcachefs-2024-08-10' of git://evilpiepirate.org/bcachefs Pull more bcachefs fixes from Kent Overstreet: "A couple last minute fixes for the new disk accounting - fix a bug that was causing ACLs to seemingly "disappear" - new on disk format version, bcachefs_metadata_version_disk_accounting_v3 bcachefs_metadata_version_disk_accounting_v2 accidentally included padding in disk_accounting_key; fortunately, 6.11 isn't out yet so we can fix this with another version bump" * tag 'bcachefs-2024-08-10' of git://evilpiepirate.org/bcachefs: bcachefs: bcachefs_metadata_version_disk_accounting_v3 bcachefs: improve bch2_dev_usage_to_text() bcachefs: bch2_accounting_invalid() bcachefs: Switch to .get_inode_acl() commit 2ad4e1ada8eebafa2d75a4b75eeeca882de6ada1 Author: Janne Grunau Date: Sat Aug 3 21:52:55 2024 +0200 wifi: brcmfmac: cfg80211: Handle SSID based pmksa deletion wpa_supplicant 2.11 sends since 1efdba5fdc2c ("Handle PMKSA flush in the driver for SAE/OWE offload cases") SSID based PMKSA del commands. brcmfmac is not prepared and tries to dereference the NULL bssid and pmkid pointers in cfg80211_pmksa. PMKID_V3 operations support SSID based updates so copy the SSID. Fixes: a96202acaea4 ("wifi: brcmfmac: cfg80211: Add support for PMKID_V3 operations") Cc: stable@vger.kernel.org # 6.4.x Signed-off-by: Janne Grunau Reviewed-by: Neal Gompa Acked-by: Arend van Spriel Signed-off-by: Kalle Valo Link: https://patch.msgid.link/20240803-brcmfmac_pmksa_del_ssid-v1-1-4e85f19135e1@jannau.net drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c | 13 ++++++++++--- 1 file changed, 10 insertions(+), 3 deletions(-) commit ccbfcac05866ebe6eb3bc6d07b51d4ed4fcde436 Author: Takashi Iwai Date: Sat Aug 10 10:48:32 2024 +0200 ALSA: timer: Relax start tick time check for slave timer elements The recent addition of a sanity check for a too low start tick time seems breaking some applications that uses aloop with a certain slave timer setup. They may have the initial resolution 0, hence it's treated as if it were a too low value. Relax and skip the check for the slave timer instance for addressing the regression. Fixes: 4a63bd179fa8 ("ALSA: timer: Set lower bound of start tick time") Cc: Link: https://github.com/raspberrypi/linux/issues/6294 Link: https://patch.msgid.link/20240810084833.10939-1-tiwai@suse.de Signed-off-by: Takashi Iwai sound/core/timer.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 03f9885c60adf73488fe32aab628ee3d4a39598e Author: Yong-Xuan Wang Date: Fri Aug 9 15:10:47 2024 +0800 irqchip/riscv-aplic: Retrigger MSI interrupt on source configuration The section 4.5.2 of the RISC-V AIA specification says that "any write to a sourcecfg register of an APLIC might (or might not) cause the corresponding interrupt-pending bit to be set to one if the rectified input value is high (= 1) under the new source mode." When the interrupt type is changed in the sourcecfg register, the APLIC device might not set the corresponding pending bit, so the interrupt might never become pending. To handle sourcecfg register changes for level-triggered interrupts in MSI mode, manually set the pending bit for retriggering interrupt so it gets retriggered if it was already asserted. Fixes: ca8df97fe679 ("irqchip/riscv-aplic: Add support for MSI-mode") Signed-off-by: Yong-Xuan Wang Signed-off-by: Thomas Gleixner Reviewed-by: Vincent Chen Reviewed-by: Anup Patel Cc: stable@vger.kernel.org Link: https://lore.kernel.org/all/20240809071049.2454-1-yongxuan.wang@sifive.com drivers/irqchip/irq-riscv-aplic-msi.c | 32 +++++++++++++++++++++++++------- 1 file changed, 25 insertions(+), 7 deletions(-) commit d73f0f49daa84176c3beee1606e73c7ffb6af8b2 Author: Radhey Shyam Pandey Date: Fri Aug 9 12:32:24 2024 +0530 irqchip/xilinx: Fix shift out of bounds The device tree property 'xlnx,kind-of-intr' is sanity checked that the bitmask contains only set bits which are in the range of the number of interrupts supported by the controller. The check is done by shifting the mask right by the number of supported interrupts and checking the result for zero. The data type of the mask is u32 and the number of supported interrupts is up to 32. In case of 32 interrupts the shift is out of bounds, resulting in a mismatch warning. The out of bounds condition is also reported by UBSAN: UBSAN: shift-out-of-bounds in irq-xilinx-intc.c:332:22 shift exponent 32 is too large for 32-bit type 'unsigned int' Fix it by promoting the mask to u64 for the test. Fixes: d50466c90724 ("microblaze: intc: Refactor DT sanity check") Signed-off-by: Radhey Shyam Pandey Signed-off-by: Thomas Gleixner Cc: stable@vger.kernel.org Link: https://lore.kernel.org/all/1723186944-3571957-1-git-send-email-radhey.shyam.pandey@amd.com drivers/irqchip/irq-xilinx-intc.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit eb755a956f618ff113355333b1af68973ce9d861 Merge: d2438c16a634 0b4a4534d083 Author: Jakub Kicinski Date: Fri Aug 9 22:16:48 2024 -0700 Merge branch 'mlx5-misc-fixes-2024-08-08' Tariq Toukan says: ==================== mlx5 misc fixes 2024-08-08 This patchset provides misc bug fixes from the team to the mlx5 core and Eth drivers. ==================== Link: https://patch.msgid.link/20240808144107.2095424-1-tariqt@nvidia.com Signed-off-by: Jakub Kicinski commit 0b4a4534d083e055831b3bc29c5eafc918ed4d86 Author: Gal Pressman Date: Thu Aug 8 17:41:06 2024 +0300 net/mlx5e: Fix queue stats access to non-existing channels splat The queue stats API queries the queues according to the real_num_[tr]x_queues, in case the device is down and channels were not yet created, don't try to query their statistics. To trigger the panic, run this command before the interface is brought up: ./cli.py --spec ../../../Documentation/netlink/specs/netdev.yaml --dump qstats-get --json '{"ifindex": 4}' BUG: kernel NULL pointer dereference, address: 0000000000000c00 PGD 0 P4D 0 Oops: Oops: 0000 [#1] SMP PTI CPU: 3 UID: 0 PID: 977 Comm: python3 Not tainted 6.10.0+ #40 Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.13.0-0-gf21b5a4aeb02-prebuilt.qemu.org 04/01/2014 RIP: 0010:mlx5e_get_queue_stats_rx+0x3c/0xb0 [mlx5_core] Code: fc 55 48 63 ee 53 48 89 d3 e8 40 3d 70 e1 85 c0 74 58 4c 89 ef e8 d4 07 04 00 84 c0 75 41 49 8b 84 24 f8 39 00 00 48 8b 04 e8 <48> 8b 90 00 0c 00 00 48 03 90 40 0a 00 00 48 89 53 08 48 8b 90 08 RSP: 0018:ffff888116be37d0 EFLAGS: 00010246 RAX: 0000000000000000 RBX: ffff888116be3868 RCX: 0000000000000004 RDX: ffff88810ada4000 RSI: 0000000000000000 RDI: ffff888109df09c0 RBP: 0000000000000000 R08: 0000000000000004 R09: 0000000000000004 R10: ffff88813461901c R11: ffffffffffffffff R12: ffff888109df0000 R13: ffff888109df09c0 R14: ffff888116be38d0 R15: 0000000000000000 FS: 00007f4375d5c740(0000) GS:ffff88852c980000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000000000000c00 CR3: 0000000106ada006 CR4: 0000000000370eb0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: ? __die+0x1f/0x60 ? page_fault_oops+0x14e/0x3d0 ? exc_page_fault+0x73/0x130 ? asm_exc_page_fault+0x22/0x30 ? mlx5e_get_queue_stats_rx+0x3c/0xb0 [mlx5_core] netdev_nl_stats_by_netdev+0x2a6/0x4c0 ? __rmqueue_pcplist+0x351/0x6f0 netdev_nl_qstats_get_dumpit+0xc4/0x1b0 genl_dumpit+0x2d/0x80 netlink_dump+0x199/0x410 __netlink_dump_start+0x1aa/0x2c0 genl_family_rcv_msg_dumpit+0x94/0xf0 ? __pfx_genl_start+0x10/0x10 ? __pfx_genl_dumpit+0x10/0x10 ? __pfx_genl_done+0x10/0x10 genl_rcv_msg+0x116/0x2b0 ? __pfx_netdev_nl_qstats_get_dumpit+0x10/0x10 ? __pfx_genl_rcv_msg+0x10/0x10 netlink_rcv_skb+0x54/0x100 genl_rcv+0x24/0x40 netlink_unicast+0x21a/0x340 netlink_sendmsg+0x1f4/0x440 __sys_sendto+0x1b6/0x1c0 ? do_sock_setsockopt+0xc3/0x180 ? __sys_setsockopt+0x60/0xb0 __x64_sys_sendto+0x20/0x30 do_syscall_64+0x50/0x110 entry_SYSCALL_64_after_hwframe+0x76/0x7e RIP: 0033:0x7f43757132b0 Code: c0 ff ff ff ff eb b8 0f 1f 00 f3 0f 1e fa 41 89 ca 64 8b 04 25 18 00 00 00 85 c0 75 1d 45 31 c9 45 31 c0 b8 2c 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 68 c3 0f 1f 80 00 00 00 00 41 54 48 83 ec 20 RSP: 002b:00007ffd258da048 EFLAGS: 00000246 ORIG_RAX: 000000000000002c RAX: ffffffffffffffda RBX: 00007ffd258da0f8 RCX: 00007f43757132b0 RDX: 000000000000001c RSI: 00007f437464b850 RDI: 0000000000000003 RBP: 00007f4375085de0 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: ffffffffc4653600 R14: 0000000000000001 R15: 00007f43751a6147 Modules linked in: netconsole xt_conntrack xt_MASQUERADE nf_conntrack_netlink nfnetlink xt_addrtype iptable_nat nf_nat br_netfilter rpcsec_gss_krb5 auth_rpcgss oid_registry overlay rpcrdma rdma_ucm ib_iser libiscsi scsi_transport_iscsi ib_umad rdma_cm ib_ipoib iw_cm ib_cm mlx5_ib ib_uverbs ib_core zram zsmalloc mlx5_core fuse [last unloaded: netconsole] CR2: 0000000000000c00 ---[ end trace 0000000000000000 ]--- RIP: 0010:mlx5e_get_queue_stats_rx+0x3c/0xb0 [mlx5_core] Code: fc 55 48 63 ee 53 48 89 d3 e8 40 3d 70 e1 85 c0 74 58 4c 89 ef e8 d4 07 04 00 84 c0 75 41 49 8b 84 24 f8 39 00 00 48 8b 04 e8 <48> 8b 90 00 0c 00 00 48 03 90 40 0a 00 00 48 89 53 08 48 8b 90 08 RSP: 0018:ffff888116be37d0 EFLAGS: 00010246 RAX: 0000000000000000 RBX: ffff888116be3868 RCX: 0000000000000004 RDX: ffff88810ada4000 RSI: 0000000000000000 RDI: ffff888109df09c0 RBP: 0000000000000000 R08: 0000000000000004 R09: 0000000000000004 R10: ffff88813461901c R11: ffffffffffffffff R12: ffff888109df0000 R13: ffff888109df09c0 R14: ffff888116be38d0 R15: 0000000000000000 FS: 00007f4375d5c740(0000) GS:ffff88852c980000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000000000000c00 CR3: 0000000106ada006 CR4: 0000000000370eb0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Fixes: 7b66ae536a78 ("net/mlx5e: Add per queue netdev-genl stats") Signed-off-by: Gal Pressman Signed-off-by: Tariq Toukan Reviewed-by: Joe Damato Link: https://patch.msgid.link/20240808144107.2095424-6-tariqt@nvidia.com Signed-off-by: Jakub Kicinski drivers/net/ethernet/mellanox/mlx5/core/en_main.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) commit cbc796be1779c4dbc9a482c7233995e2a8b6bfb3 Author: Cosmin Ratiu Date: Thu Aug 8 17:41:05 2024 +0300 net/mlx5e: Correctly report errors for ethtool rx flows Previously, an ethtool rx flow with no attrs would not be added to the NIC as it has no rules to configure the hw with, but it would be reported as successful to the caller (return code 0). This is confusing for the user as ethtool then reports "Added rule $num", but no rule was actually added. This change corrects that by instead reporting these wrong rules as -EINVAL. Fixes: b29c61dac3a2 ("net/mlx5e: Ethtool steering flow validation refactoring") Signed-off-by: Cosmin Ratiu Reviewed-by: Saeed Mahameed Reviewed-by: Dragos Tatulea Signed-off-by: Tariq Toukan Link: https://patch.msgid.link/20240808144107.2095424-5-tariqt@nvidia.com Signed-off-by: Jakub Kicinski drivers/net/ethernet/mellanox/mlx5/core/en_fs_ethtool.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit e6b5afd30b99b43682a7764e1a74a42fe4d5f4b3 Author: Dragos Tatulea Date: Thu Aug 8 17:41:04 2024 +0300 net/mlx5e: Take state lock during tx timeout reporter mlx5e_safe_reopen_channels() requires the state lock taken. The referenced changed in the Fixes tag removed the lock to fix another issue. This patch adds it back but at a later point (when calling mlx5e_safe_reopen_channels()) to avoid the deadlock referenced in the Fixes tag. Fixes: eab0da38912e ("net/mlx5e: Fix possible deadlock on mlx5e_tx_timeout_work") Signed-off-by: Dragos Tatulea Link: https://lore.kernel.org/all/ZplpKq8FKi3vwfxv@gmail.com/T/ Reviewed-by: Breno Leitao Reviewed-by: Moshe Shemesh Signed-off-by: Tariq Toukan Link: https://patch.msgid.link/20240808144107.2095424-4-tariqt@nvidia.com Signed-off-by: Jakub Kicinski drivers/net/ethernet/mellanox/mlx5/core/en/reporter_tx.c | 2 ++ 1 file changed, 2 insertions(+) commit ab6013a59b4d0947fda409c29426dc904959e632 Author: Dragos Tatulea Date: Thu Aug 8 17:41:03 2024 +0300 net/mlx5e: SHAMPO, Increase timeout to improve latency During latency tests (netperf TCP_RR) a 30% degradation of HW GRO vs SW GRO was observed. This is due to SHAMPO triggering timeout filler CQEs instead of delivering the CQE for the packet. Having a short timeout for SHAMPO doesn't bring any benefits as it is the driver that does the merging, not the hardware. On the contrary, it can have a negative impact: additional filler CQEs are generated due to the timeout. As there is no way to disable this timeout, this change sets it to the maximum value. Instead of using the packet_merge.timeout parameter which is also used for LRO, set the value directly when filling in the rest of the SHAMPO parameters in mlx5e_build_rq_param(). Fixes: 99be56171fa9 ("net/mlx5e: SHAMPO, Re-enable HW-GRO") Signed-off-by: Dragos Tatulea Signed-off-by: Tariq Toukan Link: https://patch.msgid.link/20240808144107.2095424-3-tariqt@nvidia.com Signed-off-by: Jakub Kicinski drivers/net/ethernet/mellanox/mlx5/core/en.h | 2 +- drivers/net/ethernet/mellanox/mlx5/core/en/params.c | 16 +++++++++++++++- drivers/net/ethernet/mellanox/mlx5/core/en/params.h | 1 + drivers/net/ethernet/mellanox/mlx5/core/en_main.c | 12 ------------ 4 files changed, 17 insertions(+), 14 deletions(-) commit c31fe2b5095d8c84562ce90db07600f7e9f318df Author: Tariq Toukan Date: Thu Aug 8 17:41:02 2024 +0300 net/mlx5: SD, Do not query MPIR register if no sd_group Unconditionally calling the MPIR query on BF separate mode yields the FW syndrome below [1]. Do not call it unless admin clearly specified the SD group, i.e. expressing the intention of using the multi-PF netdev feature. This fix covers cases not covered in commit fca3b4791850 ("net/mlx5: Do not query MPIR on embedded CPU function"). [1] mlx5_cmd_out_err:808:(pid 8267): ACCESS_REG(0x805) op_mod(0x1) failed, status bad system state(0x4), syndrome (0x685f19), err(-5) Fixes: 678eb448055a ("net/mlx5: SD, Implement basic query and instantiation") Signed-off-by: Tariq Toukan Reviewed-by: Gal Pressman Link: https://patch.msgid.link/20240808144107.2095424-2-tariqt@nvidia.com Signed-off-by: Jakub Kicinski drivers/net/ethernet/mellanox/mlx5/core/lib/sd.c | 18 +++++++++--------- 1 file changed, 9 insertions(+), 9 deletions(-) commit d2438c16a6347f811ab0249330ee9e54fa3db6b0 Merge: 3a3be7ff9224 1d2c46c1bc56 Author: Jakub Kicinski Date: Fri Aug 9 21:58:11 2024 -0700 Merge branch 'don-t-take-hw-uso-path-when-packets-can-t-be-checksummed-by-device' Jakub Sitnicki says: ==================== Don't take HW USO path when packets can't be checksummed by device This series addresses a recent regression report from syzbot [1]. After enabling UDP_SEGMENT for egress devices which don't support checksum offload [2], we need to tighten down the checks which let packets take the HW USO path. The fix consists of two parts: 1. don't let devices offer USO without checksum offload, and 2. force software USO fallback in presence of IPv6 extension headers. [1] https://lore.kernel.org/all/000000000000e1609a061d5330ce@google.com/ [2] https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=10154dbded6d6a2fecaebdfda206609de0f121a9 v3: https://lore.kernel.org/r/20240807-udp-gso-egress-from-tunnel-v3-0-8828d93c5b45@cloudflare.com v2: https://lore.kernel.org/r/20240801-udp-gso-egress-from-tunnel-v2-0-9a2af2f15d8d@cloudflare.com v1: https://lore.kernel.org/r/20240725-udp-gso-egress-from-tunnel-v1-0-5e5530ead524@cloudflare.com ==================== Link: https://patch.msgid.link/20240808-udp-gso-egress-from-tunnel-v4-0-f5c5b4149ab9@cloudflare.com Signed-off-by: Jakub Kicinski commit 1d2c46c1bc5680335f20f64089c161fdfcd3e8ab Author: Jakub Sitnicki Date: Thu Aug 8 11:56:23 2024 +0200 selftests/net: Add coverage for UDP GSO with IPv6 extension headers After enabling UDP GSO for devices not offering checksum offload, we have hit a regression where a bad offload warning can be triggered when sending a datagram with IPv6 extension headers. Extend the UDP GSO IPv6 tests to cover this scenario. Reviewed-by: Willem de Bruijn Signed-off-by: Jakub Sitnicki Link: https://patch.msgid.link/20240808-udp-gso-egress-from-tunnel-v4-3-f5c5b4149ab9@cloudflare.com Signed-off-by: Jakub Kicinski tools/testing/selftests/net/udpgso.c | 25 ++++++++++++++++++++++++- 1 file changed, 24 insertions(+), 1 deletion(-) commit 30b03f2a0592eee1267298298eac9dd655f55ab2 Author: Jakub Sitnicki Date: Thu Aug 8 11:56:22 2024 +0200 udp: Fall back to software USO if IPv6 extension headers are present In commit 10154dbded6d ("udp: Allow GSO transmit from devices with no checksum offload") we have intentionally allowed UDP GSO packets marked CHECKSUM_NONE to pass to the GSO stack, so that they can be segmented and checksummed by a software fallback when the egress device lacks these features. What was not taken into consideration is that a CHECKSUM_NONE skb can be handed over to the GSO stack also when the egress device advertises the tx-udp-segmentation / NETIF_F_GSO_UDP_L4 feature. This will happen when there are IPv6 extension headers present, which we check for in __ip6_append_data(). Syzbot has discovered this scenario, producing a warning as below: ip6tnl0: caps=(0x00000006401d7869, 0x00000006401d7869) WARNING: CPU: 0 PID: 5112 at net/core/dev.c:3293 skb_warn_bad_offload+0x166/0x1a0 net/core/dev.c:3291 Modules linked in: CPU: 0 PID: 5112 Comm: syz-executor391 Not tainted 6.10.0-rc7-syzkaller-01603-g80ab5445da62 #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/07/2024 RIP: 0010:skb_warn_bad_offload+0x166/0x1a0 net/core/dev.c:3291 [...] Call Trace: __skb_gso_segment+0x3be/0x4c0 net/core/gso.c:127 skb_gso_segment include/net/gso.h:83 [inline] validate_xmit_skb+0x585/0x1120 net/core/dev.c:3661 __dev_queue_xmit+0x17a4/0x3e90 net/core/dev.c:4415 neigh_output include/net/neighbour.h:542 [inline] ip6_finish_output2+0xffa/0x1680 net/ipv6/ip6_output.c:137 ip6_finish_output+0x41e/0x810 net/ipv6/ip6_output.c:222 ip6_send_skb+0x112/0x230 net/ipv6/ip6_output.c:1958 udp_v6_send_skb+0xbf5/0x1870 net/ipv6/udp.c:1292 udpv6_sendmsg+0x23b3/0x3270 net/ipv6/udp.c:1588 sock_sendmsg_nosec net/socket.c:730 [inline] __sock_sendmsg+0xef/0x270 net/socket.c:745 ____sys_sendmsg+0x525/0x7d0 net/socket.c:2585 ___sys_sendmsg net/socket.c:2639 [inline] __sys_sendmmsg+0x3b2/0x740 net/socket.c:2725 __do_sys_sendmmsg net/socket.c:2754 [inline] __se_sys_sendmmsg net/socket.c:2751 [inline] __x64_sys_sendmmsg+0xa0/0xb0 net/socket.c:2751 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f [...] We are hitting the bad offload warning because when an egress device is capable of handling segmentation offload requested by skb_shinfo(skb)->gso_type, the chain of gso_segment callbacks won't produce any segment skbs and return NULL. See the skb_gso_ok() branch in {__udp,tcp,sctp}_gso_segment helpers. To fix it, force a fallback to software USO when processing a packet with IPv6 extension headers, since we don't know if these can checksummed by all devices which offer USO. Fixes: 10154dbded6d ("udp: Allow GSO transmit from devices with no checksum offload") Reported-by: syzbot+e15b7e15b8a751a91d9a@syzkaller.appspotmail.com Closes: https://lore.kernel.org/all/000000000000e1609a061d5330ce@google.com/ Reviewed-by: Willem de Bruijn Signed-off-by: Jakub Sitnicki Link: https://patch.msgid.link/20240808-udp-gso-egress-from-tunnel-v4-2-f5c5b4149ab9@cloudflare.com Signed-off-by: Jakub Kicinski net/ipv4/udp_offload.c | 6 ++++++ 1 file changed, 6 insertions(+) commit 2b2bc3bab158b7e036508742b16cd8a3c2f59a12 Author: Jakub Sitnicki Date: Thu Aug 8 11:56:21 2024 +0200 net: Make USO depend on CSUM offload UDP segmentation offload inherently depends on checksum offload. It should not be possible to disable checksum offload while leaving USO enabled. Enforce this dependency in code. There is a single tx-udp-segmentation feature flag to indicate support for both IPv4/6, hence the devices wishing to support USO must offer checksum offload for both IP versions. Fixes: 10154dbded6d ("udp: Allow GSO transmit from devices with no checksum offload") Suggested-by: Willem de Bruijn Signed-off-by: Jakub Sitnicki Reviewed-by: Willem de Bruijn Link: https://patch.msgid.link/20240808-udp-gso-egress-from-tunnel-v4-1-f5c5b4149ab9@cloudflare.com Signed-off-by: Jakub Kicinski net/core/dev.c | 26 +++++++++++++++++--------- 1 file changed, 17 insertions(+), 9 deletions(-) commit 3a3be7ff9224f424e485287b54be00d2c6bd9c40 Author: Eric Dumazet Date: Thu Aug 8 13:24:55 2024 +0000 gtp: pull network headers in gtp_dev_xmit() syzbot/KMSAN reported use of uninit-value in get_dev_xmit() [1] We must make sure the IPv4 or Ipv6 header is pulled in skb->head before accessing fields in them. Use pskb_inet_may_pull() to fix this issue. [1] BUG: KMSAN: uninit-value in ipv6_pdp_find drivers/net/gtp.c:220 [inline] BUG: KMSAN: uninit-value in gtp_build_skb_ip6 drivers/net/gtp.c:1229 [inline] BUG: KMSAN: uninit-value in gtp_dev_xmit+0x1424/0x2540 drivers/net/gtp.c:1281 ipv6_pdp_find drivers/net/gtp.c:220 [inline] gtp_build_skb_ip6 drivers/net/gtp.c:1229 [inline] gtp_dev_xmit+0x1424/0x2540 drivers/net/gtp.c:1281 __netdev_start_xmit include/linux/netdevice.h:4913 [inline] netdev_start_xmit include/linux/netdevice.h:4922 [inline] xmit_one net/core/dev.c:3580 [inline] dev_hard_start_xmit+0x247/0xa20 net/core/dev.c:3596 __dev_queue_xmit+0x358c/0x5610 net/core/dev.c:4423 dev_queue_xmit include/linux/netdevice.h:3105 [inline] packet_xmit+0x9c/0x6c0 net/packet/af_packet.c:276 packet_snd net/packet/af_packet.c:3145 [inline] packet_sendmsg+0x90e3/0xa3a0 net/packet/af_packet.c:3177 sock_sendmsg_nosec net/socket.c:730 [inline] __sock_sendmsg+0x30f/0x380 net/socket.c:745 __sys_sendto+0x685/0x830 net/socket.c:2204 __do_sys_sendto net/socket.c:2216 [inline] __se_sys_sendto net/socket.c:2212 [inline] __x64_sys_sendto+0x125/0x1d0 net/socket.c:2212 x64_sys_call+0x3799/0x3c10 arch/x86/include/generated/asm/syscalls_64.h:45 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x1e0 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f Uninit was created at: slab_post_alloc_hook mm/slub.c:3994 [inline] slab_alloc_node mm/slub.c:4037 [inline] kmem_cache_alloc_node_noprof+0x6bf/0xb80 mm/slub.c:4080 kmalloc_reserve+0x13d/0x4a0 net/core/skbuff.c:583 __alloc_skb+0x363/0x7b0 net/core/skbuff.c:674 alloc_skb include/linux/skbuff.h:1320 [inline] alloc_skb_with_frags+0xc8/0xbf0 net/core/skbuff.c:6526 sock_alloc_send_pskb+0xa81/0xbf0 net/core/sock.c:2815 packet_alloc_skb net/packet/af_packet.c:2994 [inline] packet_snd net/packet/af_packet.c:3088 [inline] packet_sendmsg+0x749c/0xa3a0 net/packet/af_packet.c:3177 sock_sendmsg_nosec net/socket.c:730 [inline] __sock_sendmsg+0x30f/0x380 net/socket.c:745 __sys_sendto+0x685/0x830 net/socket.c:2204 __do_sys_sendto net/socket.c:2216 [inline] __se_sys_sendto net/socket.c:2212 [inline] __x64_sys_sendto+0x125/0x1d0 net/socket.c:2212 x64_sys_call+0x3799/0x3c10 arch/x86/include/generated/asm/syscalls_64.h:45 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x1e0 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f CPU: 0 UID: 0 PID: 7115 Comm: syz.1.515 Not tainted 6.11.0-rc1-syzkaller-00043-g94ede2a3e913 #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/27/2024 Fixes: 999cb275c807 ("gtp: add IPv6 support") Fixes: 459aa660eb1d ("gtp: add initial driver for datapath of GPRS Tunneling Protocol (GTP-U)") Signed-off-by: Eric Dumazet Cc: Harald Welte Reviewed-by: Pablo Neira Ayuso Link: https://patch.msgid.link/20240808132455.3413916-1-edumazet@google.com Signed-off-by: Jakub Kicinski drivers/net/gtp.c | 3 +++ 1 file changed, 3 insertions(+) commit 34ac1e82e5a78d5ed7f647766f5b1b51ca4d983a Merge: 57b935eb8c55 36bb22a08a69 Author: Linus Torvalds Date: Fri Aug 9 21:33:25 2024 -0700 Merge tag '6.11-rc2-smb3-client-fixes' of git://git.samba.org/sfrench/cifs-2.6 Pull smb client fixes from Steve French: - DFS fix - fix for security flags for requiring encryption - minor cleanup * tag '6.11-rc2-smb3-client-fixes' of git://git.samba.org/sfrench/cifs-2.6: cifs: cifs_inval_name_dfs_link_error: correct the check for fullpath Fix spelling errors in Server Message Block smb3: fix setting SecurityFlags when encryption is required commit 57b935eb8c553b93e7c88fc3c6f9163b06ef907e Merge: 15833fea97c1 730bbfaf7d48 Author: Linus Torvalds Date: Fri Aug 9 21:26:50 2024 -0700 Merge tag 'spi-fix-v6.11-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/spi Pull spi fixes from Mark Brown: "A few SPI fixes: clock rate calculation fixes for the Kunpeng and lpsi drivers and a missing registration of a device ID for spidev (which had only been updated for DT cases, causing warnings)" * tag 'spi-fix-v6.11-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/spi: spi: spi-fsl-lpspi: Fix scldiv calculation spi: spidev: Add missing spi_device_id for bh2228fv spi: hisi-kunpeng: Add verification for the max_frequency provided by the firmware spi: hisi-kunpeng: Add validation for the minimum value of speed_hz commit 3eb3cd5992f7a0c37edc8d05b4c38c98758d8671 Author: Kees Cook Date: Wed Aug 7 12:51:23 2024 -0700 binfmt_flat: Fix corruption when not offsetting data start Commit 04d82a6d0881 ("binfmt_flat: allow not offsetting data start") introduced a RISC-V specific variant of the FLAT format which does not allocate any space for the (obsolete) array of shared library pointers. However, it did not disable the code which initializes the array, resulting in the corruption of sizeof(long) bytes before the DATA segment, generally the end of the TEXT segment. Introduce MAX_SHARED_LIBS_UPDATE which depends on the state of CONFIG_BINFMT_FLAT_NO_DATA_START_OFFSET to guard the initialization of the shared library pointer region so that it will only be initialized if space is reserved for it. Fixes: 04d82a6d0881 ("binfmt_flat: allow not offsetting data start") Co-developed-by: Stefan O'Rear Signed-off-by: Stefan O'Rear Reviewed-by: Damien Le Moal Acked-by: Greg Ungerer Link: https://lore.kernel.org/r/20240807195119.it.782-kees@kernel.org Signed-off-by: Kees Cook fs/binfmt_flat.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) commit 4bbe6002931954bbe82b25f25990b987b0392e18 Author: Arnaldo Carvalho de Melo Date: Thu Jul 18 16:38:07 2024 -0300 perf daemon: Fix the build on 32-bit architectures Noticed with: 1 6.22 debian:experimental-x-mipsel : FAIL gcc version 13.2.0 (Debian 13.2.0-25) builtin-daemon.c: In function 'cmd_session_list': builtin-daemon.c:691:35: error: format '%lu' expects argument of type 'long unsigned int', but argument 4 has type 'time_t' {aka 'long long int'} [-Werror=format=] Use inttypes.h's PRIu64 to deal with that. Signed-off-by: Arnaldo Carvalho de Melo Link: https://lore.kernel.org/r/ZplvH21aQ8pzmza_@x1 Signed-off-by: Namhyung Kim tools/perf/builtin-daemon.c | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-) commit 8a2491db7bea6ad88ec568731eafd583501f1c96 Author: Kent Overstreet Date: Fri Aug 9 00:25:25 2024 -0400 bcachefs: bcachefs_metadata_version_disk_accounting_v3 bcachefs_metadata_version_disk_accounting_v2 erroneously had padding bytes in disk_accounting_key, which is a problem because we have to guarantee that all unused bytes in disk_accounting_key are zeroed. Fortunately 6.11 isn't out yet, so it's cheap to fix this by spinning a new version. Reported-by: Gabriel de Perthuis Signed-off-by: Kent Overstreet fs/bcachefs/bcachefs_format.h | 3 ++- fs/bcachefs/disk_accounting_format.h | 8 ++++---- fs/bcachefs/sb-downgrade.c | 27 ++++++++++++++++++++++++++- 3 files changed, 32 insertions(+), 6 deletions(-) commit 2c402bd2e85b44dc00ef85b5c0e217de684b5372 Author: Li Ming Date: Fri Aug 9 08:27:50 2024 +0000 cxl/test: Skip cxl_setup_parent_dport() for emulated dports The cxl_test unit test environment on qemu always hits below call trace with KASAN enabled: BUG: KASAN: slab-out-of-bounds in cxl_setup_parent_dport+0x480/0x530 [cxl_core] Read of size 1 at addr ff110000676014f8 by task (udev-worker)/676[ 24.424403] CPU: 2 PID: 676 Comm: (udev-worker) Tainted: G O N 6.10.0-qemucxl #1 Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS edk2-20240214-2.el9 02/14/2024 Call Trace: dump_stack_lvl+0xea/0x150 print_report+0xce/0x610 ? kasan_complete_mode_report_info+0x40/0x200 kasan_report+0xcc/0x110 __asan_report_load1_noabort+0x18/0x20 cxl_setup_parent_dport+0x480/0x530 [cxl_core] cxl_mem_probe+0x49b/0xaa0 [cxl_mem] cxl_test module models a CXL topology for testing, it creates some emulated dports with platform devices in the CXL topology, so the dport_dev of an emulated dport points to a platform device rather than a pci device or a pci host bridge in the case. Currently, cxl_setup_parent_dport() is used to set up RAS and AER capability on the dport connected to the CXL memory device, but cxl_test does not support RAS or AER functionality yet, so the fix is implementing a __wrap_cxl_setup_parent_dport() to filter out all emulated dports, guarantees only real dports can be handled by cxl_setup_parent_dport(). Fixes: f05fd10d138d ("cxl/pci: Add RCH downstream port AER register discovery") Reported-by: Pengfei Xu Closes: https://lore.kernel.org/linux-cxl/ZrHTBp2O+HtUe6kt@xpf.sh.intel.com/T/#t Signed-off-by: Li Ming Reviewed-by: Dan Williams Reviewed-by: Ira Weiny Reviewed-by: Alison Schofield Tested-by: Ira Weiny Tested-by: Alison Schofield Link: https://patch.msgid.link/20240809082750.3015641-3-ming4.li@intel.com Signed-off-by: Dave Jiang tools/testing/cxl/Kbuild | 1 + tools/testing/cxl/test/mock.c | 12 ++++++++++++ 2 files changed, 13 insertions(+) commit 8c251c5ab1b7cd204231e4ee936bfe078a33f234 Author: Li Ming Date: Fri Aug 9 08:27:49 2024 +0000 cxl/pci: Get AER capability address from RCRB only for RCH dport cxl_setup_parent_dport() needs to get RCH dport AER capability address from RCRB to disable AER interrupt. The function does not check if dport is RCH dport, it will get a wrong pci_host_bridge structure by dport_dev in VH case because dport_dev points to a pci device(RP or switch DSP) rather than a pci host bridge device. Fixes: f05fd10d138d ("cxl/pci: Add RCH downstream port AER register discovery") Signed-off-by: Li Ming Reviewed-by: Dan Williams Reviewed-by: Ira Weiny Tested-by: Ira Weiny Tested-by: Alison Schofield Link: https://patch.msgid.link/20240809082750.3015641-2-ming4.li@intel.com Signed-off-by: Dave Jiang drivers/cxl/core/pci.c | 10 ++++++---- 1 file changed, 6 insertions(+), 4 deletions(-) commit 0eba65f0310d3c7d5516c7fd4c172d0bfa8b285b Author: Miguel Ojeda Date: Tue Aug 6 16:45:58 2024 +0200 rust: x86: remove `-3dnow{,a}` from target features LLVM 19 is dropping support for 3DNow! in commit f0eb5587ceeb ("Remove support for 3DNow!, both intrinsics and builtins. (#96246)"): Remove support for 3DNow!, both intrinsics and builtins. (#96246) This set of instructions was only supported by AMD chips starting in the K6-2 (introduced 1998), and before the "Bulldozer" family (2011). They were never much used, as they were effectively superseded by the more-widely-implemented SSE (first implemented on the AMD side in Athlon XP in 2001). This is being done as a predecessor towards general removal of MMX register usage. Since there is almost no usage of the 3DNow! intrinsics, and no modern hardware even implements them, simple removal seems like the best option. Thus we should avoid passing these to the backend, since otherwise we get a diagnostic about it: '-3dnow' is not a recognized feature for this target (ignoring feature) '-3dnowa' is not a recognized feature for this target (ignoring feature) We could try to disable them only up to LLVM 19 (not the C side one, but the one used by `rustc`, which may be built with a range of LLVMs). However, to avoid more complexity, we can likely just remove them altogether. According to Nikita [2]: > I don't think it's needed because LLVM should not generate 3dnow > instructions unless specifically asked to, using intrinsics that > Rust does not provide in the first place. Thus do so, like Rust did for one of their builtin targets [3]. For those curious: Clang will warn only about trying to enable them (`-m3dnow{,a}`), but not about disabling them (`-mno-3dnow{,a}`), so there is no change needed there. Cc: Nikita Popov Cc: Nathan Chancellor Cc: x86@kernel.org Link: https://github.com/llvm/llvm-project/commit/f0eb5587ceeb641445b64cb264c822b4751de04a [1] Link: https://github.com/rust-lang/rust/pull/127864#issuecomment-2235898760 [2] Link: https://github.com/rust-lang/rust/pull/127864 [3] Closes: https://github.com/Rust-for-Linux/linux/issues/1094 Tested-by: Benno Lossin Tested-by: Alice Ryhl Link: https://lore.kernel.org/r/20240806144558.114461-1-ojeda@kernel.org Signed-off-by: Miguel Ojeda scripts/generate_rust_target.rs | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) commit d734422b7dd7d033fc02e421924e70dabf665b4c Author: Miguel Ojeda Date: Wed Aug 7 01:35:59 2024 +0200 kbuild: rust-analyzer: mark `rust_is_available.sh` invocation as recursive When calling the `rust_is_available.sh` script, we need to make the jobserver available to it, as commit ecab4115c44c ("kbuild: mark `rustc` (and others) invocations as recursive") explains and did for the others. Otherwise, we get a warning from `rustc` when calling `make rust-analyzer` with parallel jobs, e.g. `-j8`. Using several jobs for that target does not really matter, but developers may call `make` with jobs enabled in all cases. Thus fix it. Fixes: 6dc9d9ca9a72 ("kbuild: rust-analyzer: better error handling") Reviewed-by: Alice Ryhl Link: https://lore.kernel.org/r/20240806233559.246705-1-ojeda@kernel.org [ Reworded to add a couple more details mentioned in the list. - Miguel ] Signed-off-by: Miguel Ojeda Makefile | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 02dfd63afe65f7bacad543ba2b10f77083ae7929 Author: Miguel Ojeda Date: Tue Aug 6 17:06:19 2024 +0200 rust: add intrinsics to fix `-Os` builds Alice reported [1] that an arm64 build failed with: ld.lld: error: undefined symbol: __extendsfdf2 >>> referenced by core.a6f5fc5794e7b7b3-cgu.0 >>> rust/core.o:(::midpoint) in archive vmlinux.a >>> referenced by core.a6f5fc5794e7b7b3-cgu.0 >>> rust/core.o:(::midpoint) in archive vmlinux.a ld.lld: error: undefined symbol: __truncdfsf2 >>> referenced by core.a6f5fc5794e7b7b3-cgu.0 >>> rust/core.o:(::midpoint) in archive vmlinux.a Rust 1.80.0 or later together with `CONFIG_CC_OPTIMIZE_FOR_SIZE=y` is what triggers it. In addition, x86_64 builds also fail the same way. Similarly, compiling with Rust 1.82.0 (currently in nightly) makes another one appear, possibly due to the LLVM 19 upgrade there: ld.lld: error: undefined symbol: __eqdf2 >>> referenced by core.20495ea57a9f069d-cgu.0 >>> rust/core.o:(::next_up) in archive vmlinux.a >>> referenced by core.20495ea57a9f069d-cgu.0 >>> rust/core.o:(::next_down) in archive vmlinux.a Gary adds [1]: > Usually the fix on rustc side is to mark those functions as `#[inline]` > > All of {midpoint,next_up,next_down} are indeed unstable functions not > marked as inline... Fix all those by adding those intrinsics to our usual workaround. [ Trevor quickly submitted a fix to upstream Rust [2] that has already been merged, to be released in Rust 1.82.0 (2024-10-17). - Miguel ] Cc: Gary Guo Reported-by: Alice Ryhl Closes: https://rust-for-linux.zulipchat.com/#narrow/stream/x/topic/x/near/455637364 [1] Reviewed-by: Trevor Gross Tested-by: Alice Ryhl Tested-by: Boqun Feng Reviewed-by: Gary Guo Link: https://github.com/rust-lang/rust/pull/128749 [2] Link: https://lore.kernel.org/r/20240806150619.192882-1-ojeda@kernel.org [ Shortened Zulip link. - Miguel ] Signed-off-by: Miguel Ojeda rust/Makefile | 4 ++-- rust/compiler_builtins.rs | 3 +++ 2 files changed, 5 insertions(+), 2 deletions(-) commit 869b5016e94eced02f2cf99bf53c69b49adcee32 Author: Zehui Xu Date: Wed Jul 31 16:43:46 2024 +0300 kbuild: rust: skip -fmin-function-alignment in bindgen flags GCC 14 recently added -fmin-function-alignment option and the root Makefile uses it to replace -falign-functions when available. However, this flag can cause issues when passed to the Rust Makefile and affect the bindgen process. Bindgen relies on libclang to parse C code, and currently does not support the -fmin-function-alignment flag, leading to compilation failures when GCC 14 is used. This patch addresses the issue by adding -fmin-function-alignment to the bindgen_skip_c_flags in rust/Makefile. This prevents the flag from causing compilation issues. [ Matthew and Gary confirm function alignment should not change the ABI in a way that bindgen would care about, thus we did not need the extra logic for bindgen from v2. - Miguel ] Link: https://lore.kernel.org/linux-kbuild/20240222133500.16991-1-petr.pavlu@suse.com/ Signed-off-by: Zehui Xu Reviewed-by: Alice Ryhl Reviewed-by: Neal Gompa Reviewed-by: Gary Guo Link: https://lore.kernel.org/r/20240731134346.10630-1-zehuixu@whu.edu.cn [ Reworded title. - Miguel ] Signed-off-by: Miguel Ojeda rust/Makefile | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 15833fea97c1fdb3b34fceefa4b51177dd57e18f Merge: afdab700f65e 06f5b920d1d0 Author: Linus Torvalds Date: Fri Aug 9 14:00:22 2024 -0700 Merge tag 'drm-fixes-2024-08-10' of https://gitlab.freedesktop.org/drm/kernel Pull drm fixes from Dave Airlie: "Weekly regular fixes, mostly amdgpu with i915/xe having a few each, and then some misc bits across the board, seems about right for rc3 time. client: - fix null ptr deref bridge: - connector: fix double free atomic: - fix async flip update panel: - document panel omap: - add config dependency tests: - fix gem shmem test drm buddy: - Add start address to trim function amdgpu: - DMCUB fix - Fix DET programming on some DCNs - DCC fixes - DCN 4.0.1 fixes - SMU 14.0.x update - MMHUB fix - DCN 3.1.4 fix - GC 12.0 fixes - Fix soft recovery error propogation - SDMA 7.0 fixes - DSC fix xe: - Fix off-by-one when processing RTP rules - Use dma_fence_chain_free in chain fence unused as a sync - Fix PL1 disable flow in xe_hwmon_power_max_write - Take ref to VM in delayed dump snapshot i915: - correct dual pps handling for MTL_PCH+ [display] - Adjust vma offset for framebuffer mmap offset [gem] - Fix Virtual Memory mapping boundaries calculation [gem] - Allow evicting to use the requested placement - Attempt to get pages without eviction first" * tag 'drm-fixes-2024-08-10' of https://gitlab.freedesktop.org/drm/kernel: (31 commits) drm/xe: Take ref to VM in delayed snapshot drm/xe/hwmon: Fix PL1 disable flow in xe_hwmon_power_max_write drm/xe: Use dma_fence_chain_free in chain fence unused as a sync drm/xe/rtp: Fix off-by-one when processing rules drm/amdgpu: Add DCC GFX12 flag to enable address alignment drm/amdgpu: correct sdma7 max dw drm/amdgpu: Add address alignment support to DCC buffers drm/amd/display: Skip Recompute DSC Params if no Stream on Link drm/amdgpu: change non-dcc buffer copy configuration drm/amdgpu: Forward soft recovery errors to userspace drm/amdgpu: add golden setting for gc v12 drm/buddy: Add start address support to trim function drm/amd/display: Add missing program DET segment call to pipe init drm/amd/display: Add missing DCN314 to the DML Makefile drm/amdgpu: force to use legacy inv in mmhub drm/amd/pm: update powerplay structure on smu v14.0.2/3 drm/amd/display: Add missing mcache registers drm/amd/display: Add dcc propagation value drm/amd/display: Add missing DET segments programming drm/amd/display: Replace dm_execute_dmub_cmd with dc_wake_and_execute_dmub_cmd ... commit d5240fa65db071909e9d1d5adcc5fd1abc8e96fe Author: Zhihao Cheng Date: Fri Aug 9 11:11:55 2024 +0800 nvdimm/pmem: Set dax flag for all 'PFN_MAP' cases The dax is only supported on pfn type pmem devices since commit f467fee48da4 ("block: move the dax flag to queue_limits"). Trying to mount DAX filesystem fails with this error: mount: : wrong fs type, bad option, bad superblock on /dev/pmem7, missing codepage or helper program, or other error. dmesg(1) may have more information after failed mount system call. dmesg: EXT4-fs (pmem7): DAX unsupported by block device. Fix the problem by adding dax flag setting for the missed case. Fixes: f467fee48da4 ("block: move the dax flag to queue_limits") Signed-off-by: Zhihao Cheng Reviewed-by: Christoph Hellwig Reviewed-by: Dave Jiang Reviewed-by: Ira Weiny Tested-by: Ira Weiny Tested-by: Alison Schofield Link: https://patch.msgid.link/20240809031155.2837271-1-chengzhihao1@huawei.com Signed-off-by: Ira Weiny drivers/nvdimm/pmem.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 1a9e219db15e62760cfcc107ab6df3796d353605 Author: Kent Overstreet Date: Thu Aug 8 23:44:00 2024 -0400 bcachefs: improve bch2_dev_usage_to_text() Add a line for capacity Signed-off-by: Kent Overstreet fs/bcachefs/alloc_foreground.c | 2 +- fs/bcachefs/buckets.c | 12 ++++++++---- fs/bcachefs/buckets.h | 2 +- 3 files changed, 10 insertions(+), 6 deletions(-) commit 077e47372309dcbe3a150754ea9c6f15cc838d6b Author: Kent Overstreet Date: Thu Aug 8 23:19:59 2024 -0400 bcachefs: bch2_accounting_invalid() Implement bch2_accounting_invalid(); check for junk at the end, and replicas accounting entries in particular need to be checked or we'll pop asserts later. Signed-off-by: Kent Overstreet fs/bcachefs/disk_accounting.c | 65 +++++++++++++++++++++++++++++++++++- fs/bcachefs/disk_accounting_format.h | 9 +++-- fs/bcachefs/replicas.c | 1 - fs/bcachefs/sb-errors_format.h | 6 +++- 4 files changed, 73 insertions(+), 8 deletions(-) commit afdab700f65e14070d8ab92175544b1c62b8bf03 Merge: 850828972588 5819e464a175 Author: Linus Torvalds Date: Fri Aug 9 11:18:09 2024 -0700 Merge tag 'bitmap-6.11-rc' of https://github.com/norov/linux Pull cpumask fix from Yury Norov: "Fix for cpumask merge" [ Mea culpa, this was my mismerge due to too much cut-and-paste - Linus ] * tag 'bitmap-6.11-rc' of https://github.com/norov/linux: cpumask: Fix crash on updating CPU enabled mask commit 850828972588bd5422ab6c917df3f78233df1a62 Merge: 58d40f5f8131 64a66f4a3c89 Author: Linus Torvalds Date: Fri Aug 9 10:44:35 2024 -0700 Merge tag 'pm-6.11-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm Pull power management fix from Rafael Wysocki: "Change the default EPP (energy-performence preference) value for the Emerald Rapids processor in the intel_pstate driver. Thisshould improve both the performance and energy efficiency (Pedro Henrique Kopper)" * tag 'pm-6.11-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm: cpufreq: intel_pstate: Update Balance performance EPP for Emerald Rapids commit 58d40f5f8131479a1e688828e2fa0a7836cf5358 Merge: 0f135d3e30c4 b82c1d235a30 Author: Linus Torvalds Date: Fri Aug 9 10:23:18 2024 -0700 Merge tag 'asm-generic-fixes-6.11-2' of git://git.kernel.org/pub/scm/linux/kernel/git/arnd/asm-generic Pull asm-generic fixes from Arnd Bergmann: "There are two more changes to the syscall.tbl conversion: the '__NR_newfstat' in the previous bugfix was a mistake and gets reverted now, after triple-checking that the contents are now back to what they were on all architectures. The __NR_nfsservctl definition is not really needed but came up in the same discussion as it had previously been defined in uapi/asm-generic/unistd.h and tested for in user space. There are a few more symbols that used to be defined in the old unistd.h file, but that are never defined on any other architecture using syscall.tbl format. These used to be needed inside of the kernel: __NR_syscalls __NR_arch_specific_syscall __NR3264_* Searching for these on https://codesearch.debian.net/ shows a few packages (rustc, golang, clamav, libseccomp, librsvg, strace) that duplicate all the macros from asm/unistd.h, but nothing that actually uses the macros, so I concluded that they are fine to omit after all" * tag 'asm-generic-fixes-6.11-2' of git://git.kernel.org/pub/scm/linux/kernel/git/arnd/asm-generic: syscalls: add back legacy __NR_nfsservctl macro syscalls: fix fstat() entry again commit 0f135d3e30c43be2034299c560272e18c6166d04 Merge: 146430a0c26e 6b1124c4526f Author: Linus Torvalds Date: Fri Aug 9 10:06:43 2024 -0700 Merge tag 'arm-fixes-6.11-1' of git://git.kernel.org/pub/scm/linux/kernel/git/soc/soc Pull ARM SoC fixes from Arnd Bergmann: "There are three sets of patches for the soc tree: - Marek Behún addresses multiple build time regressions caused by changes to the cznic turris-omnia support - Dmitry Torokhov fixes a regression in the legacy "gumstix" board code he cleaned up earlier - The TI K3 maintainers found multiple bugs in the in gpio, audio and pcie devicetree nodes" * tag 'arm-fixes-6.11-1' of git://git.kernel.org/pub/scm/linux/kernel/git/soc/soc: ARM: pxa/gumstix: fix attaching properties to vbus gpio device doc: platform: cznic: turris-omnia-mcu: Use double backticks for attribute value doc: platform: cznic: turris-omnia-mcu: Fix sphinx-build warning platform: cznic: turris-omnia-mcu: Make GPIO code optional platform: cznic: turris-omnia-mcu: Make poweroff and wakeup code optional platform: cznic: turris-omnia-mcu: Make TRNG code optional platform: cznic: turris-omnia-mcu: Make watchdog code optional arm64: dts: ti: k3-j784s4-main: Correct McASP DMAs arm64: dts: ti: k3-j722s: Fix gpio-range for main_pmx0 arm64: dts: ti: k3-am62p: Fix gpio-range for main_pmx0 arm64: dts: ti: k3-am62p: Add gpio-ranges for mcu_gpio0 arm64: dts: ti: k3-am62-verdin-dahlia: Keep CTRL_SLEEP_MOCI# regulator on arm64: dts: ti: k3-j784s4-evm: Consolidate serdes0 references arm64: dts: ti: k3-j784s4-evm: Assign only lanes 0 and 1 to PCIe1 commit 90574d2a675947858b47008df8d07f75ea50d0d0 Author: Dan Carpenter Date: Fri Aug 9 15:34:30 2024 +0300 rtla/osnoise: Prevent NULL dereference in error handling If the "tool->data" allocation fails then there is no need to call osnoise_free_top() and, in fact, doing so will lead to a NULL dereference. Cc: stable@vger.kernel.org Cc: John Kacur Cc: "Luis Claudio R. Goncalves" Cc: Clark Williams Fixes: 1eceb2fc2ca5 ("rtla/osnoise: Add osnoise top mode") Link: https://lore.kernel.org/f964ed1f-64d2-4fde-ad3e-708331f8f358@stanley.mountain Signed-off-by: Dan Carpenter Signed-off-by: Steven Rostedt (Google) tools/tracing/rtla/src/osnoise_top.c | 11 ++++------- 1 file changed, 4 insertions(+), 7 deletions(-) commit d0949cd44a62c4c41b30ea7ae94d8c887f586882 Author: Steven Rostedt Date: Thu Aug 8 23:57:30 2024 -0400 tracing: Return from tracing_buffers_read() if the file has been closed When running the following: # cd /sys/kernel/tracing/ # echo 1 > events/sched/sched_waking/enable # echo 1 > events/sched/sched_switch/enable # echo 0 > tracing_on # dd if=per_cpu/cpu0/trace_pipe_raw of=/tmp/raw0.dat The dd task would get stuck in an infinite loop in the kernel. What would happen is the following: When ring_buffer_read_page() returns -1 (no data) then a check is made to see if the buffer is empty (as happens when the page is not full), it will call wait_on_pipe() to wait until the ring buffer has data. When it is it will try again to read data (unless O_NONBLOCK is set). The issue happens when there's a reader and the file descriptor is closed. The wait_on_pipe() will return when that is the case. But this loop will continue to try again and wait_on_pipe() will again return immediately and the loop will continue and never stop. Simply check if the file was closed before looping and exit out if it is. Cc: stable@vger.kernel.org Cc: Masami Hiramatsu Cc: Mathieu Desnoyers Link: https://lore.kernel.org/20240808235730.78bf63e5@rorschach.local.home Fixes: 2aa043a55b9a7 ("tracing/ring-buffer: Fix wait_on_pipe() race") Signed-off-by: Steven Rostedt (Google) kernel/trace/trace.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 146430a0c26eb7b515abb04664e1a516078ec5c2 Merge: b7768c4881d1 8c8acb8f26cb Author: Linus Torvalds Date: Fri Aug 9 09:43:46 2024 -0700 Merge tag 'probes-fixes-v6.11-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace Pull kprobe fixes from Masami Hiramatsu: - Fix misusing str_has_prefix() parameter order to check symbol prefix correctly - bpf: remove unused declaring of bpf_kprobe_override * tag 'probes-fixes-v6.11-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace: kprobes: Fix to check symbol prefixes correctly bpf: kprobe: remove unused declaring of bpf_kprobe_override commit b7768c4881d1b69bd95dad149d3b558c8e7de91a Merge: 8828729c4435 eded04fe3bda Author: Linus Torvalds Date: Fri Aug 9 09:35:58 2024 -0700 Merge tag 'block-6.11-20240809' of git://git.kernel.dk/linux Pull block fixes from Jens Axboe: "Just a set of cleanups for blk-throttle and nvme structures" * tag 'block-6.11-20240809' of git://git.kernel.dk/linux: nvme: reorganize nvme_ns_head fields nvme: change data type of lba_shift nvme: remove a field from nvme_ns_head nvme: remove unused parameter blk-throttle: remove more latency dead-code commit 8828729c4435b85844a3b6da19cc7c148c59ec43 Merge: 377773dd6be5 8fe8ac24adcd Author: Linus Torvalds Date: Fri Aug 9 09:32:10 2024 -0700 Merge tag 'io_uring-6.11-20240809' of git://git.kernel.dk/linux Pull io_uring fixes from Jens Axboe: "Nothing major in here, just two fixes for ensuring that bundle recv/send requests always get marked for cleanups, and a single fix to ensure that sends with provided buffers only pick a single buffer unless the bundle option has been enabled" * tag 'io_uring-6.11-20240809' of git://git.kernel.dk/linux: io_uring/net: don't pick multiple buffers for non-bundle send io_uring/net: ensure expanded bundle send gets marked for cleanup io_uring/net: ensure expanded bundle recv gets marked for cleanup commit 377773dd6be500d17b94de08271ff9ed643554f1 Merge: 2124d84db293 d3e82ced462b Author: Linus Torvalds Date: Fri Aug 9 09:25:30 2024 -0700 Merge tag 'sound-6.11-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound Pull sound fixes from Takashi Iwai: "A collection of lots of small changes, almost all device-specific: - A series of fixes for ASoC Qualcomm stuff - Various fixes for Cirrus ASoC and HD-audio codecs - A few AMD ASoC quirks and usual HD-audio quirks - Other misc fixes, including a long-time regression in USB-audio" * tag 'sound-6.11-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound: (39 commits) ASoC: cs35l56: Patch CS35L56_IRQ1_MASK_18 to the default value ASoC: meson: axg-fifo: fix irq scheduling issue with PREEMPT_RT MAINTAINERS: Update Cirrus Logic parts to linux-sound mailing list ASoC: dt-bindings: qcom,wcd939x: Correct reset GPIO polarity in example ASoC: dt-bindings: qcom,wcd938x: Correct reset GPIO polarity in example ASoC: dt-bindings: qcom,wcd934x: Correct reset GPIO polarity in example ASoC: dt-bindings: qcom,wcd937x: Correct reset GPIO polarity in example ASoC: amd: yc: Add quirk entry for OMEN by HP Gaming Laptop 16-n0xxx ASoC: codecs: ES8326: button detect issue ASoC: amd: yc: Support mic on Lenovo Thinkpad E14 Gen 6 ALSA: usb-audio: Re-add ScratchAmp quirk entries ALSA: hda/realtek: Add Framework Laptop 13 (Intel Core Ultra) to quirks ALSA: hda/hdmi: Yet more pin fix for HP EliteDesk 800 G4 ALSA: hda: Add HP MP9 G4 Retail System AMS to force connect list ASoC: cs35l56: Handle OTP read latency over SoundWire ASoC: codecs: lpass-macro: fix missing codec version ALSA: line6: Fix racy access to midibuf ASoC: cs-amp-lib: Fix NULL pointer crash if efi.get_variable is NULL ASoC: cs35l56: Stop creating ALSA controls for firmware coefficients ASoC: wm_adsp: Add control_add callback and export wm_adsp_control_add() ... commit 2124d84db293ba164059077944e6b429ba530495 Author: Linus Torvalds Date: Fri Aug 9 08:33:28 2024 -0700 module: make waiting for a concurrent module loader interruptible The recursive aes-arm-bs module load situation reported by Russell King is getting fixed in the crypto layer, but this in the meantime fixes the "recursive load hangs forever" by just making the waiting for the first module load be interruptible. This should now match the old behavior before commit 9b9879fc0327 ("modules: catch concurrent module loads, treat them as idempotent"), which used the different "wait for module to be ready" code in module_patient_check_exists(). End result: a recursive module load will still block, but now a signal will interrupt it and fail the second module load, at which point the first module will successfully complete loading. Fixes: 9b9879fc0327 ("modules: catch concurrent module loads, treat them as idempotent") Cc: Russell King Cc: Herbert Xu Signed-off-by: Linus Torvalds kernel/module/main.c | 40 +++++++++++++++++++++++++--------------- 1 file changed, 25 insertions(+), 15 deletions(-) commit 01a620d491592ead12eca039fe1c9e74908c35cf Merge: 74b0666f97f9 9ba48db9f77c Author: Wolfram Sang Date: Fri Aug 9 15:28:08 2024 +0200 Merge tag 'i2c-host-fixes-6.11-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/andi.shyti/linux into i2c/for-current Two fixes on the Qualcomm GENI I2C controller are cleaning up the error exit patch in the runtime_resume() function. The first is disabling the clock, the second disables the icc on the way out. commit 67927a1b255d883881be9467508e0af9a5e0be9d Author: Foster Snowhill Date: Tue Aug 6 19:28:09 2024 +0200 usbnet: ipheth: fix carrier detection in modes 1 and 4 Apart from the standard "configurations", "interfaces" and "alternate interface settings" in USB, iOS devices also have a notion of "modes". In different modes, the device exposes a different set of available configurations. Depending on the iOS version, and depending on the current mode, the length and contents of the carrier state control message differs: * 1 byte (seen on iOS 4.2.1, 8.4): * 03: carrier off (mode 0) * 04: carrier on (mode 0) * 3 bytes (seen on iOS 10.3.4, 15.7.6): * 03 03 03: carrier off (mode 0) * 04 04 03: carrier on (mode 0) * 4 bytes (seen on iOS 16.5, 17.6): * 03 03 03 00: carrier off (mode 0) * 04 03 03 00: carrier off (mode 1) * 06 03 03 00: carrier off (mode 4) * 04 04 03 04: carrier on (mode 0 and 1) * 06 04 03 04: carrier on (mode 4) Before this change, the driver always used the first byte of the response to determine carrier state. From this larger sample, the first byte seems to indicate the number of available USB configurations in the current mode (with the exception of the default mode 0), and in some cases (namely mode 1 and 4) does not correlate with the carrier state. Previous logic erroneously counted `04 03 03 00` as "carrier on" and `06 04 03 04` as "carrier off" on iOS versions that support mode 1 and mode 4 respectively. Only modes 0, 1 and 4 expose the USB Ethernet interfaces necessary for the ipheth driver. Check the second byte of the control message where possible, and fall back to checking the first byte on older iOS versions. Signed-off-by: Foster Snowhill Tested-by: Georgi Valkov Signed-off-by: David S. Miller drivers/net/usb/ipheth.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) commit 74efed51e0a4d62f998f806c307778b47fc73395 Author: Foster Snowhill Date: Tue Aug 6 19:28:08 2024 +0200 usbnet: ipheth: do not stop RX on failing RX callback RX callbacks can fail for multiple reasons: * Payload too short * Payload formatted incorrecly (e.g. bad NCM framing) * Lack of memory None of these should cause the driver to seize up. Make such failures non-critical and continue processing further incoming URBs. Signed-off-by: Foster Snowhill Signed-off-by: David S. Miller drivers/net/usb/ipheth.c | 1 - 1 file changed, 1 deletion(-) commit 94d7eeb6c0ef0310992944f0d0296929816a2cb0 Author: Foster Snowhill Date: Tue Aug 6 19:28:07 2024 +0200 usbnet: ipheth: drop RX URBs with no payload On iPhone 15 Pro Max one can observe periodic URBs with no payload on the "bulk in" (RX) endpoint. These don't seem to do anything meaningful. Reproduced on iOS 17.5.1 and 17.6. This behaviour isn't observed on iPhone 11 on the same iOS version. The nature of these zero-length URBs is so far unknown. Drop RX URBs with no payload. Signed-off-by: Foster Snowhill Signed-off-by: David S. Miller drivers/net/usb/ipheth.c | 6 ++++++ 1 file changed, 6 insertions(+) commit 655b46d7a39ac6f049698b27c1568c0f7ff85d1e Author: Foster Snowhill Date: Tue Aug 6 19:28:06 2024 +0200 usbnet: ipheth: remove extraneous rx URB length check Rx URB length was already checked in ipheth_rcvbulk_callback_legacy() and ipheth_rcvbulk_callback_ncm(), depending on the current mode. The check in ipheth_rcvbulk_callback() was thus mostly a duplicate. The only place in ipheth_rcvbulk_callback() where we care about the URB length is for the initial control frame. These frames are always 4 bytes long. This has been checked as far back as iOS 4.2.1 on iPhone 3G. Remove the extraneous URB length check. For control frames, check for the specific 4-byte length instead. Signed-off-by: Foster Snowhill Tested-by: Georgi Valkov Signed-off-by: David S. Miller drivers/net/usb/ipheth.c | 8 ++------ 1 file changed, 2 insertions(+), 6 deletions(-) commit e5876b088ba03a62124266fa20d00e65533c7269 Author: Oliver Neukum Date: Tue Aug 6 19:28:05 2024 +0200 usbnet: ipheth: race between ipheth_close and error handling ipheth_sndbulk_callback() can submit carrier_work as a part of its error handling. That means that the driver must make sure that the work is cancelled after it has made sure that no more URB can terminate with an error condition. Hence the order of actions in ipheth_close() needs to be inverted. Signed-off-by: Oliver Neukum Signed-off-by: Foster Snowhill Tested-by: Georgi Valkov Signed-off-by: David S. Miller drivers/net/usb/ipheth.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit d3e82ced462b4ed956504b62603a11d52a599f99 Merge: 03898691d42e 72776774b55b Author: Takashi Iwai Date: Fri Aug 9 09:58:07 2024 +0200 Merge tag 'asoc-fix-v6.11-rc2' of https://git.kernel.org/pub/scm/linux/kernel/git/broonie/sound into for-linus ASoC: Fixes for v6.11 Quite a lot of fixes have come in since the merge window, there's some repetitive fixes over the Qualcomm drivers increasing the patch count, along with a large batch of fixes from Cirrus. We also have some quirks and some individual fixes. commit 06f5b920d1d0b686d794426264dc39aa8582db14 Merge: fe0ce0d622d0 787db3bb6ed5 Author: Dave Airlie Date: Fri Aug 9 17:16:28 2024 +1000 Merge tag 'drm-intel-fixes-2024-08-08' of https://gitlab.freedesktop.org/drm/i915/kernel into drm-fixes - correct dual pps handling for MTL_PCH+ [display] (Dnyaneshwar Bhadane) - Adjust vma offset for framebuffer mmap offset [gem] (Andi Shyti) - Fix Virtual Memory mapping boundaries calculation [gem] (Andi Shyti) - Allow evicting to use the requested placement (David Gow) - Attempt to get pages without eviction first (David Gow) Signed-off-by: Dave Airlie From: Tvrtko Ursulin Link: https://patchwork.freedesktop.org/patch/msgid/ZrSFpj20b1LbBhCJ@linux commit fe0ce0d622d08dde6acb9857fc180d59af804a86 Merge: a507e750a1d6 642dfc9d5964 Author: Dave Airlie Date: Fri Aug 9 17:08:55 2024 +1000 Merge tag 'drm-xe-fixes-2024-08-08' of https://gitlab.freedesktop.org/drm/xe/kernel into drm-fixes - Fix off-by-one when processing RTP rules (Lucas) - Use dma_fence_chain_free in chain fence unused as a sync (Brost) - Fix PL1 disable flow in xe_hwmon_power_max_write (Karthik) - Take ref to VM in delayed dump snapshot (Brost) Signed-off-by: Dave Airlie From: Rodrigo Vivi Link: https://patchwork.freedesktop.org/patch/msgid/ZrUGgVrgTJ_vF2PS@intel.com commit f6bd41280a44dcc2e0a25ed72617d25f586974a7 Author: Namjae Jeon Date: Mon Aug 5 08:57:03 2024 +0900 ksmbd: override fsids for smb2_query_info() Sangsoo reported that a DAC denial error occurred when accessing files through the ksmbd thread. This patch override fsids for smb2_query_info(). Reported-by: Sangsoo Lee Signed-off-by: Namjae Jeon Signed-off-by: Steve French fs/smb/server/smb2pdu.c | 7 +++++++ 1 file changed, 7 insertions(+) commit a018c1b636e79b60149b41151ded7c2606d8606e Author: Namjae Jeon Date: Mon Aug 5 08:56:18 2024 +0900 ksmbd: override fsids for share path check Sangsoo reported that a DAC denial error occurred when accessing files through the ksmbd thread. This patch override fsids for share path check. Reported-by: Sangsoo Lee Signed-off-by: Namjae Jeon Signed-off-by: Steve French fs/smb/server/mgmt/share_config.c | 15 ++++++++++++--- fs/smb/server/mgmt/share_config.h | 4 +++- fs/smb/server/mgmt/tree_connect.c | 9 +++++---- fs/smb/server/mgmt/tree_connect.h | 4 ++-- fs/smb/server/smb2pdu.c | 2 +- fs/smb/server/smb_common.c | 9 +++++++-- fs/smb/server/smb_common.h | 2 ++ 7 files changed, 32 insertions(+), 13 deletions(-) commit a507e750a1d693a21b233f47db466d9aae895fa2 Merge: 062fd0a6cdb5 6ad9dafba19f Author: Dave Airlie Date: Fri Aug 9 13:45:52 2024 +1000 Merge tag 'amd-drm-fixes-6.11-2024-08-08' of https://gitlab.freedesktop.org/agd5f/linux into drm-fixes amd-drm-fixes-6.11-2024-08-08: amdgpu: - DMCUB fix - Fix DET programming on some DCNs - DCC fixes - DCN 4.0.1 fixes - SMU 14.0.x update - MMHUB fix - DCN 3.1.4 fix - GC 12.0 fixes - Fix soft recovery error propogation - SDMA 7.0 fixes - DSC fix drm buddy: - Add start address to trim function Signed-off-by: Dave Airlie From: Alex Deucher Link: https://patchwork.freedesktop.org/patch/msgid/20240808161134.1227671-1-alexander.deucher@amd.com commit 062fd0a6cdb5986745100ab1328d4e475078fda4 Merge: de9c2c66ad8e 929725bd7eb4 Author: Dave Airlie Date: Fri Aug 9 13:00:59 2024 +1000 Merge tag 'drm-misc-fixes-2024-08-08' of https://gitlab.freedesktop.org/drm/misc/kernel into drm-fixes A fix for drm/client to prevent a null pointer dereference, a fix for a double-free in drm/bridge-connector, a fix for a gem shmem test, and a fix for async flips updates. Signed-off-by: Dave Airlie From: Maxime Ripard Link: https://patchwork.freedesktop.org/patch/msgid/20240808-debonair-smoky-mustang-8b6b3f@houat commit 36bb22a08a69d9984a8399c07310d18b115eae20 Author: Gleb Korobeynikov Date: Thu Aug 8 18:47:48 2024 +0300 cifs: cifs_inval_name_dfs_link_error: correct the check for fullpath Replace the always-true check tcon->origin_fullpath with check of server->leaf_fullpath See https://bugzilla.kernel.org/show_bug.cgi?id=219083 The check of the new @tcon will always be true during mounting, since @tcon->origin_fullpath will only be set after the tree is connected to the latest common resource, as well as checking if the prefix paths from it are fully accessible. Fixes: 3ae872de4107 ("smb: client: fix shared DFS root mounts with different prefixes") Reviewed-by: Paulo Alcantara (Red Hat) Signed-off-by: Gleb Korobeynikov Signed-off-by: Steve French fs/smb/client/misc.c | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-) commit 5552cccb0b73020f6506fd5d8f81975b1f59080c Merge: 72776774b55b a9a7a2d80790 Author: Mark Brown Date: Thu Aug 8 22:47:19 2024 +0100 ASoC: codecs: warn on unknown codec version Merge series from Dmitry Baryshkov : While debugging broken audio issues on some of Qualcomm platforms I stumbled upon the kernel not providing the actual error information. It prints an error from the wsa_macro driver, but the actual issue is in the VA macro driver. Add error message to point to the actual error location. va_macro 3370000.codec: Unknown VA Codec version, ID: 00 / 0f / 00 wsa_macro 3240000.codec: Unsupported Codec version (0) commit ee9a43b7cfe2d8a3520335fea7d8ce71b8cabd9d Merge: 9466b6ae6bef 2ff4ceb0309a Author: Linus Torvalds Date: Thu Aug 8 13:51:44 2024 -0700 Merge tag 'net-6.11-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net Pull networking fixes from Jakub Kicinski: "Including fixes from bluetooth. Current release - regressions: - eth: bnxt_en: fix memory out-of-bounds in bnxt_fill_hw_rss_tbl() on older chips Current release - new code bugs: - ethtool: fix off-by-one error / kdoc contradicting the code for max RSS context IDs - Bluetooth: hci_qca: - QCA6390: fix support on non-DT platforms - QCA6390: don't call pwrseq_power_off() twice - fix a NULL-pointer derefence at shutdown - eth: ice: fix incorrect assigns of FEC counters Previous releases - regressions: - mptcp: fix handling endpoints with both 'signal' and 'subflow' flags set - virtio-net: fix changing ring count when vq IRQ coalescing not supported - eth: gve: fix use of netif_carrier_ok() during reconfig / reset Previous releases - always broken: - eth: idpf: fix bugs in queue re-allocation on reconfig / reset - ethtool: fix context creation with no parameters Misc: - linkwatch: use system_unbound_wq to ease RTNL contention" * tag 'net-6.11-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net: (41 commits) net: dsa: microchip: disable EEE for KSZ8567/KSZ9567/KSZ9896/KSZ9897. ethtool: Fix context creation with no parameters net: ethtool: fix off-by-one error in max RSS context IDs net: pse-pd: tps23881: include missing bitfield.h header net: fec: Stop PPS on driver remove net: bcmgenet: Properly overlay PHY and MAC Wake-on-LAN capabilities l2tp: fix lockdep splat net: stmmac: dwmac4: fix PCS duplex mode decode idpf: fix UAFs when destroying the queues idpf: fix memleak in vport interrupt configuration idpf: fix memory leaks and crashes while performing a soft reset bnxt_en : Fix memory out-of-bounds in bnxt_fill_hw_rss_tbl() net: dsa: bcm_sf2: Fix a possible memory leak in bcm_sf2_mdio_register() net/smc: add the max value of fallback reason count Bluetooth: hci_sync: avoid dup filtering when passive scanning with adv monitor Bluetooth: l2cap: always unlock channel in l2cap_conless_channel() Bluetooth: hci_qca: fix a NULL-pointer derefence at shutdown Bluetooth: hci_qca: fix QCA6390 support on non-DT platforms Bluetooth: hci_qca: don't call pwrseq_power_off() twice for QCA6390 ice: Fix incorrect assigns of FEC counts ... commit 9466b6ae6befa87b27cc13ee7263e01b9c48efc0 Merge: b3f5620f76f9 0b6743bd60a5 Author: Linus Torvalds Date: Thu Aug 8 13:32:59 2024 -0700 Merge tag 'trace-v6.11-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace Pull tracing fixes from Steven Rostedt: - Have reading of event format files test if the metadata still exists. When a event is freed, a flag (EVENT_FILE_FL_FREED) in the metadata is set to state that it is to prevent any new references to it from happening while waiting for existing references to close. When the last reference closes, the metadata is freed. But the "format" was missing a check to this flag (along with some other files) that allowed new references to happen, and a use-after-free bug to occur. - Have the trace event meta data use the refcount infrastructure instead of relying on its own atomic counters. - Have tracefs inodes use alloc_inode_sb() for allocation instead of using kmem_cache_alloc() directly. - Have eventfs_create_dir() return an ERR_PTR instead of NULL as the callers expect a real object or an ERR_PTR. - Have release_ei() use call_srcu() and not call_rcu() as all the protection is on SRCU and not RCU. - Fix ftrace_graph_ret_addr() to use the task passed in and not current. - Fix overflow bug in get_free_elt() where the counter can overflow the integer and cause an infinite loop. - Remove unused function ring_buffer_nr_pages() - Have tracefs freeing use the inode RCU infrastructure instead of creating its own. When the kernel had randomize structure fields enabled, the rcu field of the tracefs_inode was overlapping the rcu field of the inode structure, and corrupting it. Instead, use the destroy_inode() callback to do the initial cleanup of the code, and then have free_inode() free it. * tag 'trace-v6.11-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace: tracefs: Use generic inode RCU for synchronizing freeing ring-buffer: Remove unused function ring_buffer_nr_pages() tracing: Fix overflow in get_free_elt() function_graph: Fix the ret_stack used by ftrace_graph_ret_addr() eventfs: Use SRCU for freeing eventfs_inodes eventfs: Don't return NULL in eventfs_create_dir() tracefs: Fix inode allocation tracing: Use refcount for trace_event_file reference counter tracing: Have format file honor EVENT_FILE_FL_FREED commit b3f5620f76f9a6da024bd243a73fa8e2df520c5a Merge: cb5b81bc9a44 73dc1656f41a Author: Linus Torvalds Date: Thu Aug 8 13:27:31 2024 -0700 Merge tag 'bcachefs-2024-08-08' of git://evilpiepirate.org/bcachefs Pull bcachefs fixes from Kent Overstreet: "Assorted little stuff: - lockdep fixup for lockdep_set_notrack_class() - we can now remove a device when using erasure coding without deadlocking, though we still hit other issues - the 'allocator stuck' timeout is now configurable, and messages are ratelimited. The default timeout has been increased from 10 seconds to 30" * tag 'bcachefs-2024-08-08' of git://evilpiepirate.org/bcachefs: bcachefs: Use bch2_wait_on_allocator() in btree node alloc path bcachefs: Make allocator stuck timeout configurable, ratelimit messages bcachefs: Add missing path_traverse() to btree_iter_next_node() bcachefs: ec should not allocate from ro devs bcachefs: Improved allocator debugging for ec bcachefs: Add missing bch2_trans_begin() call bcachefs: Add a comment for bucket helper types bcachefs: Don't rely on implicit unsigned -> signed integer conversion lockdep: Fix lockdep_set_notrack_class() for CONFIG_LOCK_STAT bcachefs: Fix double free of ca->buckets_nouse commit 05a3d6e9307250a5911d75308e4363466794ab21 Author: Paul Moore Date: Thu Aug 8 11:57:38 2024 -0400 selinux: revert our use of vma_is_initial_heap() Unfortunately it appears that vma_is_initial_heap() is currently broken for applications that do not currently have any heap allocated, e.g. brk == start_brk. The breakage is such that it will cause SELinux to check for the process/execheap permission on memory regions that cross brk/start_brk even when there is no heap. The proper fix would be to correct vma_is_initial_heap(), but as there are multiple callers I am hesitant to unilaterally modify the helper out of concern that I would end up breaking some other subsystem. The mm developers have been made aware of the situation and hopefully they will have a fix at some point in the future, but we need a fix soon so we are simply going to revert our use of vma_is_initial_heap() in favor of our old logic/code which works as expected, even in the face of a zero size heap. We can return to using vma_is_initial_heap() at some point in the future when it is fixed. Cc: stable@vger.kernel.org Reported-by: Marc Reisner Closes: https://lore.kernel.org/all/ZrPmoLKJEf1wiFmM@marcreisner.com Fixes: 68df1baf158f ("selinux: use vma_is_initial_stack() and vma_is_initial_heap()") Signed-off-by: Paul Moore security/selinux/hooks.c | 12 +++++++++++- 1 file changed, 11 insertions(+), 1 deletion(-) commit 0c84bde4f37ba27d50e4c70ecacd33fe4a57030d Author: Sean Young Date: Thu Aug 8 10:35:19 2024 +0200 media: Revert "media: dvb-usb: Fix unexpected infinite loop in dvb_usb_read_remote_control()" This reverts commit 2052138b7da52ad5ccaf74f736d00f39a1c9198c. This breaks the TeVii s480 dual DVB-S2 S660. The device has a bulk in endpoint but no corresponding out endpoint, so the device does not pass the "has both receive and send bulk endpoint" test. Seemingly this device does not use dvb_usb_generic_rw() so I have tried removing the generic_bulk_ctrl_endpoint entry, but this resulted in different problems. As we have no explanation yet, revert. $ dmesg | grep -i -e dvb -e dw21 -e usb\ 4 [ 0.999122] usb 1-1: new high-speed USB device number 2 using ehci-pci [ 1.023123] usb 4-1: new high-speed USB device number 2 using ehci-pci [ 1.130247] usb 1-1: New USB device found, idVendor=9022, idProduct=d482, +bcdDevice= 0.01 [ 1.130257] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1.152323] usb 4-1: New USB device found, idVendor=9022, idProduct=d481, +bcdDevice= 0.01 [ 1.152329] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 6.701033] dvb-usb: found a 'TeVii S480.2 USB' in cold state, will try to +load a firmware [ 6.701178] dvb-usb: downloading firmware from file 'dvb-usb-s660.fw' [ 6.701179] dw2102: start downloading DW210X firmware [ 6.703715] dvb-usb: found a 'Microsoft Xbox One Digital TV Tuner' in cold +state, will try to load a firmware [ 6.703974] dvb-usb: downloading firmware from file 'dvb-usb-dib0700-1.20.fw' [ 6.756432] usb 1-1: USB disconnect, device number 2 [ 6.862119] dvb-usb: found a 'TeVii S480.2 USB' in warm state. [ 6.862194] dvb-usb: TeVii S480.2 USB error while loading driver (-22) [ 6.862209] dvb-usb: found a 'TeVii S480.1 USB' in cold state, will try to +load a firmware [ 6.862244] dvb-usb: downloading firmware from file 'dvb-usb-s660.fw' [ 6.862245] dw2102: start downloading DW210X firmware [ 6.914811] usb 4-1: USB disconnect, device number 2 [ 7.014131] dvb-usb: found a 'TeVii S480.1 USB' in warm state. [ 7.014487] dvb-usb: TeVii S480.1 USB error while loading driver (-22) [ 7.014538] usbcore: registered new interface driver dw2102 Closes: https://lore.kernel.org/stable/20240801165146.38991f60@mir/ Fixes: 2052138b7da5 ("media: dvb-usb: Fix unexpected infinite loop in dvb_usb_read_remote_control()") Reported-by: Stefan Lippers-Hollmann Cc: stable@vger.kernel.org Signed-off-by: Sean Young Signed-off-by: Mauro Carvalho Chehab drivers/media/usb/dvb-usb/dvb-usb-init.c | 35 ++++---------------------------- 1 file changed, 4 insertions(+), 31 deletions(-) commit 72776774b55bb59b7b1b09117e915a5030110304 Author: Simon Trimmer Date: Wed Aug 7 14:26:48 2024 +0000 ASoC: cs35l56: Patch CS35L56_IRQ1_MASK_18 to the default value Device tuning files made with early revision tooling may contain configuration that can unmask IRQ signals that are owned by the host. Adding a safe default to the regmap patch ensures that the hardware matches the driver expectations. Signed-off-by: Simon Trimmer Link: https://patch.msgid.link/20240807142648.46932-1-simont@opensource.cirrus.com Signed-off-by: Mark Brown sound/soc/codecs/cs35l56-shared.c | 1 + 1 file changed, 1 insertion(+) commit 5003d0ce5c7da3a02c0aff771f516f99731e7390 Author: Jerome Brunet Date: Wed Aug 7 18:27:03 2024 +0200 ASoC: meson: axg-fifo: fix irq scheduling issue with PREEMPT_RT With PREEMPT_RT enabled a spinlock_t becomes a sleeping lock. This is usually not a problem with spinlocks used in IRQ context since IRQ handlers get threaded. However, if IRQF_ONESHOT is set, the primary handler won't be force-threaded and runs always in hardirq context. This is a problem because spinlock_t requires a preemptible context on PREEMPT_RT. In this particular instance, regmap mmio uses spinlock_t to protect the register access and IRQF_ONESHOT is set on the IRQ. In this case, it is actually better to do everything in threaded handler and it solves the problem with PREEMPT_RT. Reported-by: Arseniy Krasnov Closes: https://lore.kernel.org/linux-amlogic/20240729131652.3012327-1-avkrasnov@salutedevices.com Suggested-by: Sebastian Andrzej Siewior Fixes: b11d26660dff ("ASoC: meson: axg-fifo: use threaded irq to check periods") Signed-off-by: Jerome Brunet Reviewed-by: Sebastian Andrzej Siewior Link: https://patch.msgid.link/20240807162705.4024136-1-jbrunet@baylibre.com Signed-off-by: Mark Brown sound/soc/meson/axg-fifo.c | 26 ++++++++++---------------- 1 file changed, 10 insertions(+), 16 deletions(-) commit 2f11f61f9d4d5692bcebb9d089429ee0c046e08a Author: Charles Keepax Date: Wed Aug 7 15:01:40 2024 +0100 MAINTAINERS: Update Cirrus Logic parts to linux-sound mailing list Now that most kernel work on sound has moved over to the linux-sound mailing list so should the Cirrus Logic audio parts. Signed-off-by: Charles Keepax Link: https://patch.msgid.link/20240807140140.421359-1-ckeepax@opensource.cirrus.com Signed-off-by: Mark Brown MAINTAINERS | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) commit 81f88fddef9cddae6b4e5d9359022c7a2a3e3b6a Author: Krzysztof Kozlowski Date: Tue Aug 6 13:49:31 2024 +0200 ASoC: dt-bindings: qcom,wcd939x: Correct reset GPIO polarity in example The reset GPIO of WCD9390/WCD9395 is active low and that's how it is routed on typical boards, so correct the example DTS to use expected polarity, instead of IRQ flag (which is a logical mistake on its own). Signed-off-by: Krzysztof Kozlowski Link: https://patch.msgid.link/20240806114931.40090-4-krzysztof.kozlowski@linaro.org Signed-off-by: Mark Brown Documentation/devicetree/bindings/sound/qcom,wcd939x.yaml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) commit 871f1a16fa3506487de24b05d68be45e9185e77a Author: Krzysztof Kozlowski Date: Tue Aug 6 13:49:30 2024 +0200 ASoC: dt-bindings: qcom,wcd938x: Correct reset GPIO polarity in example The reset GPIO of WCD9380/WCD9385 is active low and that's how it is routed on typical boards, so correct the example DTS to use expected polarity. Signed-off-by: Krzysztof Kozlowski Link: https://patch.msgid.link/20240806114931.40090-3-krzysztof.kozlowski@linaro.org Signed-off-by: Mark Brown Documentation/devicetree/bindings/sound/qcom,wcd938x.yaml | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) commit 55922275702e112652d314a9b6a6ca31d4b7252e Author: Krzysztof Kozlowski Date: Tue Aug 6 13:49:29 2024 +0200 ASoC: dt-bindings: qcom,wcd934x: Correct reset GPIO polarity in example The reset GPIO of WCD9340/WCD9341 is active low and that's how it is routed on typical boards, so correct the example DTS to use expected polarity. Signed-off-by: Krzysztof Kozlowski Link: https://patch.msgid.link/20240806114931.40090-2-krzysztof.kozlowski@linaro.org Signed-off-by: Mark Brown Documentation/devicetree/bindings/sound/qcom,wcd934x.yaml | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) commit 2f3e2c9eaafc272266344d777f8de44f8632e247 Author: Krzysztof Kozlowski Date: Tue Aug 6 13:49:28 2024 +0200 ASoC: dt-bindings: qcom,wcd937x: Correct reset GPIO polarity in example The reset GPIO of WCD9370/WCD9375 is active low and that's how it is routed on typical boards, so correct the example DTS to use expected polarity. Signed-off-by: Krzysztof Kozlowski Link: https://patch.msgid.link/20240806114931.40090-1-krzysztof.kozlowski@linaro.org Signed-off-by: Mark Brown Documentation/devicetree/bindings/sound/qcom,wcd937x.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 6675e76a5c441b52b1b983ebb714122087020ebe Author: Takashi Iwai Date: Wed Aug 7 19:02:27 2024 +0200 ASoC: amd: yc: Add quirk entry for OMEN by HP Gaming Laptop 16-n0xxx Fix the missing mic on OMEN by HP Gaming Laptop 16-n0xxx by adding the quirk entry with the board ID 8A44. Cc: stable@vger.kernel.org Link: https://bugzilla.suse.com/show_bug.cgi?id=1227182 Signed-off-by: Takashi Iwai Link: https://patch.msgid.link/20240807170249.16490-1-tiwai@suse.de Signed-off-by: Mark Brown sound/soc/amd/yc/acp6x-mach.c | 7 +++++++ 1 file changed, 7 insertions(+) commit 4684a2df9c5b3fc914377127faf2515aa9049093 Author: Zhang Yi Date: Wed Aug 7 10:53:55 2024 +0800 ASoC: codecs: ES8326: button detect issue We find that we need to set snd_jack_types to 0. If not, there will be a probability of button detection errors Signed-off-by: Zhang Yi Link: https://patch.msgid.link/20240807025356.24904-2-zhangyi@everest-semi.com Signed-off-by: Mark Brown sound/soc/codecs/es8326.c | 2 ++ 1 file changed, 2 insertions(+) commit 23a58b782f864951485d7a0018549729e007cb43 Author: Krzysztof Stępniak Date: Wed Aug 7 02:12:19 2024 +0200 ASoC: amd: yc: Support mic on Lenovo Thinkpad E14 Gen 6 Lenovo Thinkpad E14 Gen 6 (model type 21M3) needs a quirk entry for internal mic to work. Signed-off-by: Krzysztof Stępniak Link: https://patch.msgid.link/20240807001219.1147-1-kfs.szk@gmail.com Signed-off-by: Mark Brown sound/soc/amd/yc/acp6x-mach.c | 7 +++++++ 1 file changed, 7 insertions(+) commit cb5b81bc9a448f8db817566f60f92e2ea788ea0f Author: Linus Torvalds Date: Thu Aug 8 12:29:40 2024 -0700 module: warn about excessively long module waits Russell King reported that the arm cbc(aes) crypto module hangs when loaded, and Herbert Xu bisected it to commit 9b9879fc0327 ("modules: catch concurrent module loads, treat them as idempotent"), and noted: "So what's happening here is that the first modprobe tries to load a fallback CBC implementation, in doing so it triggers a load of the exact same module due to module aliases. IOW we're loading aes-arm-bs which provides cbc(aes). However, this needs a fallback of cbc(aes) to operate, which is made out of the generic cbc module + any implementation of aes, or ecb(aes). The latter happens to also be provided by aes-arm-cb so that's why it tries to load the same module again" So loading the aes-arm-bs module ends up wanting to recursively load itself, and the recursive load then ends up waiting for the original module load to complete. This is a regression, in that it used to be that we just tried to load the module multiple times, and then as we went on to install it the second time we would instead just error out because the module name already existed. That is actually also exactly what the original "catch concurrent loads" patch did in commit 9828ed3f695a ("module: error out early on concurrent load of the same module file"), but it turns out that it ends up being racy, in that erroring out before the module has been fully initialized will cause failures in dependent module loading. See commit ac2263b588df (which was the revert of that "error out early") commit for details about why erroring out before the module has been initialized is actually fundamentally racy. Now, for the actual recursive module load (as opposed to just concurrently loading the same module twice), the race is not an issue. At the same time it's hard for the kernel to see that this is recursion, because the module load is always done from a usermode helper, so the recursion is not some simple callchain within the kernel. End result: this is not the real fix, but this at least adds a warning for the situation (admittedly much too late for all the debugging pain that Russell and Herbert went through) and if we can come to a resolution on how to detect the recursion properly, this re-organizes the code to make that easier. Link: https://lore.kernel.org/all/ZrFHLqvFqhzykuYw@shell.armlinux.org.uk/ Reported-by: Russell King Debugged-by: Herbert Xu Signed-off-by: Linus Torvalds kernel/module/main.c | 27 ++++++++++++++++++++------- 1 file changed, 20 insertions(+), 7 deletions(-) commit f39bae2e028b841732ca81d8131d27b48a6051ad Author: Kent Overstreet Date: Wed Aug 7 15:42:23 2024 -0400 bcachefs: Switch to .get_inode_acl() .set_acl() requires a dentry, and if one isn't passed it marks the VFS inode as not having an ACL. This has been causing inodes with ACLs to have them "disappear" on bcachefs filesystem, depending on which path those inodes get pulled into the cache from. Switching to .get_inode_acl(), like other local filesystems, fixes this. Signed-off-by: Kent Overstreet fs/bcachefs/acl.c | 11 +++++++---- fs/bcachefs/acl.h | 2 +- fs/bcachefs/fs.c | 8 ++++---- 3 files changed, 12 insertions(+), 9 deletions(-) commit cd9aae921ab6b614e56ce690dedfe82e79db9354 Author: Douglas Anderson Date: Thu Aug 8 11:44:07 2024 -0700 dt-bindings: display: panel: samsung,atna45dc02: Fix indentation The yaml had indentation errors: ./Documentation/devicetree/bindings/display/panel/samsung,atna33xc20.yaml:21:9: [warning] wrong indentation: expected 10 but found 8 (indentation) ./Documentation/devicetree/bindings/display/panel/samsung,atna33xc20.yaml:23:11: [warning] wrong indentation: expected 12 but found 10 (indentation) Fix them. Reported-by: Rob Herring Closes: https://lore.kernel.org/r/CAL_JsqLRTgQRPcfXy4G9hLoHMd-Uax4_C90BV_OZn4mK+-82kw@mail.gmail.com Fixes: 1c4a057d01f4 ("dt-bindings: display: panel: samsung,atna45dc02: Document ATNA45DC02") Reviewed-by: Rob Clark Signed-off-by: Douglas Anderson Link: https://patchwork.freedesktop.org/patch/msgid/20240808114407.1.I099e8e9e36407a0785d846b953031d40ea71e559@changeid .../bindings/display/panel/samsung,atna33xc20.yaml | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-) commit eded04fe3bdad9b11bc82b972b4c6fa79f1726ba Merge: 01aa8c869d0c b4c1f33a5d59 Author: Jens Axboe Date: Thu Aug 8 12:27:40 2024 -0600 Merge tag 'nvme-6.11-2024-08-08' of git://git.infradead.org/nvme into block-6.11 Pull NVMe fixes from Keith: "nvme fixes for Linux 6.11 - Cleanups and improved struct packing (Kanchan)" * tag 'nvme-6.11-2024-08-08' of git://git.infradead.org/nvme: nvme: reorganize nvme_ns_head fields nvme: change data type of lba_shift nvme: remove a field from nvme_ns_head nvme: remove unused parameter commit cf6d429eb6563185919322205a320c3b12d1c255 Merge: 660e4b18a72e 494b0792d962 Author: Linus Torvalds Date: Thu Aug 8 11:22:04 2024 -0700 Merge tag 'loongarch-fixes-6.11-1' of git://git.kernel.org/pub/scm/linux/kernel/git/chenhuacai/linux-loongson Pull LoongArch fixes from Huacai Chen: "Enable general EFI poweroff method to make poweroff usable on hardwares which lack ACPI S5, use accessors to page table entries instead of direct dereference to avoid potential problems, and two trivial kvm cleanups" * tag 'loongarch-fixes-6.11-1' of git://git.kernel.org/pub/scm/linux/kernel/git/chenhuacai/linux-loongson: LoongArch: KVM: Remove undefined a6 argument comment for kvm_hypercall() LoongArch: KVM: Remove unnecessary definition of KVM_PRIVATE_MEM_SLOTS LoongArch: Use accessors to page table entries instead of direct dereference LoongArch: Enable general EFI poweroff method commit 642dfc9d5964b26f66fa6c28ce2861e11f9232aa Author: Matthew Brost Date: Thu Aug 1 08:41:16 2024 -0700 drm/xe: Take ref to VM in delayed snapshot Kernel BO's don't take a ref to the VM, we need the VM for the delayed snapshot, so take a ref to the VM in delayed snapshot. v2: - Check for lrc_bo before taking a VM ref (CI) - Check lrc_bo->vm before taking / dropping a VM ref (CI) - Drop VM in xe_lrc_snapshot_free v5: - Fix commit message wording (Johnathan) Fixes: 47058633d9c5 ("drm/xe: Move lrc snapshot capturing to xe_lrc.c") Cc: Maarten Lankhorst Signed-off-by: Matthew Brost Reviewed-by: Jonathan Cavitt Link: https://patchwork.freedesktop.org/patch/msgid/20240801154118.2547543-2-matthew.brost@intel.com (cherry picked from commit c3bc97d2f102ddd5a8341eeb2dbae2a3e98bb46a) Signed-off-by: Rodrigo Vivi drivers/gpu/drm/xe/xe_lrc.c | 15 ++++++++++++++- 1 file changed, 14 insertions(+), 1 deletion(-) commit ac3191c5cf47e2d5220a1ed7353a2e498a1f415e Author: Karthik Poosa Date: Thu Aug 1 16:54:24 2024 +0530 drm/xe/hwmon: Fix PL1 disable flow in xe_hwmon_power_max_write In xe_hwmon_power_max_write, for PL1 disable supported case, instead of returning after PL1 disable, PL1 enable path was also being run. Fixed it by returning after disable. v2: Correct typo and grammar in commit message. (Jonathan) Signed-off-by: Karthik Poosa Fixes: fef6dd12b45a ("drm/xe/hwmon: Protect hwmon rw attributes with hwmon_lock") Reviewed-by: Jonathan Cavitt Signed-off-by: Matt Roper Link: https://patchwork.freedesktop.org/patch/msgid/20240801112424.1841766-1-karthik.poosa@intel.com (cherry picked from commit 146458645e505f5eac498759bcd865cf7c0dfd9a) Signed-off-by: Rodrigo Vivi drivers/gpu/drm/xe/xe_hwmon.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) commit 4f854a8b1b85d46abd5ce206936d23f87ac5e0c9 Author: Matthew Brost Date: Fri Jul 26 18:22:16 2024 -0700 drm/xe: Use dma_fence_chain_free in chain fence unused as a sync A chain fence is uninitialized if not installed in a drm sync obj. Thus if xe_sync_entry_cleanup is called and sync->chain_fence is non-NULL the proper cleanup is dma_fence_chain_free rather than a dma-fence put. Reported-by: Paulo Zanoni Closes: https://gitlab.freedesktop.org/drm/xe/kernel/-/issues/2411 Closes: https://gitlab.freedesktop.org/drm/xe/kernel/-/issues/2261 Fixes: dd08ebf6c352 ("drm/xe: Introduce a new DRM driver for Intel GPUs") Signed-off-by: Matthew Brost Reviewed-by: Matthew Auld Link: https://patchwork.freedesktop.org/patch/msgid/20240727012216.2118276-1-matthew.brost@intel.com (cherry picked from commit 7f7a2da3bf8bc0e0f6c239af495b7050056e889c) Signed-off-by: Rodrigo Vivi drivers/gpu/drm/xe/xe_sync.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit ae02c7b7fea3e034fbd724c21d88406f71ccc2f8 Author: Lucas De Marchi Date: Thu Jul 25 23:43:35 2024 -0700 drm/xe/rtp: Fix off-by-one when processing rules Gustavo noticed an odd "+ 2" in rtp_mark_active() while processing rtp rules and pointed that it should be "+ 1". In fact, while processing entries without actions (OOB workarounds), if the WA is activated and has OR rules, it will also inadvertently activate the very next workaround. Test in a LNL B0 platform by moving 18024947630 on top of 16020292621, makes the latter become active: $ cat /sys/kernel/debug/dri/0/gt0/workarounds ... OOB Workarounds 18024947630 16020292621 14018094691 16022287689 13011645652 22019338487_display In future a kunit test will be added to cover the rtp checks for entries without actions. Fixes: fe19328b900c ("drm/xe/rtp: Add support for entries with no action") Cc: Gustavo Sousa Reviewed-by: Gustavo Sousa Link: https://patchwork.freedesktop.org/patch/msgid/20240726064337.797576-6-lucas.demarchi@intel.com Signed-off-by: Lucas De Marchi (cherry picked from commit fd6797ec50c561f085bc94e3ee26f484a52af79e) Signed-off-by: Rodrigo Vivi drivers/gpu/drm/xe/xe_rtp.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 5819e464a17587e6830cfab05f3e91a9a8753a41 Author: Gavin Shan Date: Thu Aug 8 14:08:08 2024 +1000 cpumask: Fix crash on updating CPU enabled mask The CPU enabled mask instead of the CPU possible mask should be used by set_cpu_enabled(). Otherwise, we run into crash due to write to the read-only CPU possible mask when vCPU is hot added on ARM64. (qemu) device_add host-arm-cpu,id=cpu1,socket-id=1 Unable to handle kernel write to read-only memory at virtual address ffff800080fa7190 : Call trace: register_cpu+0x1a4/0x2e8 arch_register_cpu+0x84/0xd8 acpi_processor_add+0x480/0x5b0 acpi_bus_attach+0x1c4/0x300 acpi_dev_for_one_check+0x3c/0x50 device_for_each_child+0x68/0xc8 acpi_dev_for_each_child+0x48/0x80 acpi_bus_attach+0x84/0x300 acpi_bus_scan+0x74/0x220 acpi_scan_rescan_bus+0x54/0x88 acpi_device_hotplug+0x208/0x478 acpi_hotplug_work_fn+0x2c/0x50 process_one_work+0x15c/0x3c0 worker_thread+0x2ec/0x400 kthread+0x120/0x130 ret_from_fork+0x10/0x20 Fix it by passing the CPU enabled mask instead of the CPU possible mask to set_cpu_enabled(). Fixes: 51c4767503d5 ("Merge tag 'bitmap-6.11-rc1' of https://github.com:/norov/linux") Signed-off-by: Gavin Shan Reviewed-by: Jonathan Cameron Signed-off-by: Yury Norov include/linux/cpumask.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 9eb18136af9fe4dd688724070f2bfba271bd1542 Author: Marc Zyngier Date: Thu Aug 8 10:15:46 2024 +0100 KVM: arm64: vgic: Hold config_lock while tearing down a CPU interface Tearing down a vcpu CPU interface involves freeing the private interrupt array. If we don't hold the lock, we may race against another thread trying to configure it. Yeah, fuzzers do wonderful things... Taking the lock early solves this particular problem. Fixes: 03b3d00a70b5 ("KVM: arm64: vgic: Allocate private interrupts on demand") Reported-by: Alexander Potapenko Tested-by: Alexander Potapenko Signed-off-by: Marc Zyngier Link: https://lore.kernel.org/r/20240808091546.3262111-1-maz@kernel.org Signed-off-by: Oliver Upton arch/arm64/kvm/vgic/vgic-init.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) commit 1cb6ab446424649f03c82334634360c2e3043684 Author: Jiaxun Yang Date: Tue Jul 23 17:15:44 2024 +0800 MIPS: Loongson64: Set timer mode in cpu-probe Loongson64 C and G processors have EXTIMER feature which is conflicting with CP0 counter. Although the processor resets in EXTIMER disabled & INTIMER enabled mode, which is compatible with MIPS CP0 compare, firmware may attempt to enable EXTIMER and interfere CP0 compare. Set timer mode back to MIPS compatible mode to fix booting on systems with such firmware before we have an actual driver for EXTIMER. Cc: stable@vger.kernel.org Signed-off-by: Jiaxun Yang Signed-off-by: Thomas Bogendoerfer arch/mips/kernel/cpu-probe.c | 4 ++++ 1 file changed, 4 insertions(+) commit bdcffe4be7cb90ccd12c49924dad9e2eda11b57a Author: Xiaxi Shen Date: Wed Aug 7 09:53:20 2024 -0700 Fix spelling errors in Server Message Block Fixed typos in various files under fs/smb/client/ Signed-off-by: Xiaxi Shen Signed-off-by: Steve French fs/smb/client/cifsglob.h | 4 ++-- fs/smb/client/misc.c | 2 +- fs/smb/client/smbdirect.c | 8 ++++---- fs/smb/client/transport.c | 2 +- 4 files changed, 8 insertions(+), 8 deletions(-) commit 1b5487aefb1ce7a6b1f15a33297d1231306b4122 Author: Steve French Date: Wed Jul 31 21:38:50 2024 -0500 smb3: fix setting SecurityFlags when encryption is required Setting encryption as required in security flags was broken. For example (to require all mounts to be encrypted by setting): "echo 0x400c5 > /proc/fs/cifs/SecurityFlags" Would return "Invalid argument" and log "Unsupported security flags" This patch fixes that (e.g. allowing overriding the default for SecurityFlags 0x00c5, including 0x40000 to require seal, ie SMB3.1.1 encryption) so now that works and forces encryption on subsequent mounts. Acked-by: Bharath SM Cc: stable@vger.kernel.org Signed-off-by: Steve French Documentation/admin-guide/cifs/usage.rst | 2 +- fs/smb/client/cifs_debug.c | 2 +- fs/smb/client/cifsglob.h | 8 ++++---- fs/smb/client/smb2pdu.c | 3 +++ 4 files changed, 9 insertions(+), 6 deletions(-) commit 2ff4ceb0309abb3cd1843189e99e4cc479ec5b92 Merge: 0411f73c13af c181da18a730 Author: Jakub Kicinski Date: Thu Aug 8 09:02:25 2024 -0700 Merge branch '100GbE' of git://git.kernel.org/pub/scm/linux/kernel/git/tnguy/net-queue Tony Nguyen says: ==================== Intel Wired LAN Driver Updates 2024-08-07 (ice) This series contains updates to ice driver only. Grzegorz adds IRQ synchronization call before performing reset and prevents writing to hardware when it is resetting. Mateusz swaps incorrect assignment of FEC statistics. * '100GbE' of git://git.kernel.org/pub/scm/linux/kernel/git/tnguy/net-queue: ice: Fix incorrect assigns of FEC counts ice: Skip PTP HW writes during PTP reset procedure ice: Fix reset handler ==================== Link: https://patch.msgid.link/20240807224521.3819189-1-anthony.l.nguyen@intel.com Signed-off-by: Jakub Kicinski commit 0411f73c13afcf619d7aa7546edbc5710a871cae Author: Martin Whitaker Date: Wed Aug 7 21:52:09 2024 +0100 net: dsa: microchip: disable EEE for KSZ8567/KSZ9567/KSZ9896/KSZ9897. As noted in the device errata [1-8], EEE support is not fully operational in the KSZ8567, KSZ9477, KSZ9567, KSZ9896, and KSZ9897 devices, causing link drops when connected to another device that supports EEE. The patch series "net: add EEE support for KSZ9477 switch family" merged in commit 9b0bf4f77162 caused EEE support to be enabled in these devices. A fix for this regression for the KSZ9477 alone was merged in commit 08c6d8bae48c2. This patch extends this fix to the other affected devices. [1] https://ww1.microchip.com/downloads/aemDocuments/documents/UNG/ProductDocuments/Errata/KSZ8567R-Errata-DS80000752.pdf [2] https://ww1.microchip.com/downloads/aemDocuments/documents/UNG/ProductDocuments/Errata/KSZ8567S-Errata-DS80000753.pdf [3] https://ww1.microchip.com/downloads/aemDocuments/documents/UNG/ProductDocuments/Errata/KSZ9477S-Errata-DS80000754.pdf [4] https://ww1.microchip.com/downloads/aemDocuments/documents/UNG/ProductDocuments/Errata/KSZ9567R-Errata-DS80000755.pdf [5] https://ww1.microchip.com/downloads/aemDocuments/documents/UNG/ProductDocuments/Errata/KSZ9567S-Errata-DS80000756.pdf [6] https://ww1.microchip.com/downloads/aemDocuments/documents/UNG/ProductDocuments/Errata/KSZ9896C-Errata-DS80000757.pdf [7] https://ww1.microchip.com/downloads/aemDocuments/documents/UNG/ProductDocuments/Errata/KSZ9897R-Errata-DS80000758.pdf [8] https://ww1.microchip.com/downloads/aemDocuments/documents/UNG/ProductDocuments/Errata/KSZ9897S-Errata-DS80000759.pdf Fixes: 69d3b36ca045 ("net: dsa: microchip: enable EEE support") # for KSZ8567/KSZ9567/KSZ9896/KSZ9897 Link: https://lore.kernel.org/netdev/137ce1ee-0b68-4c96-a717-c8164b514eec@martin-whitaker.me.uk/ Signed-off-by: Martin Whitaker Acked-by: Arun Ramadoss Reviewed-by: Oleksij Rempel Reviewed-by: Lukasz Majewski Link: https://patch.msgid.link/20240807205209.21464-1-foss@martin-whitaker.me.uk Signed-off-by: Jakub Kicinski drivers/net/dsa/microchip/ksz_common.c | 11 +++++++++++ 1 file changed, 11 insertions(+) commit 4d7c3c1aba3ca12fad2e90163b8d5153363f93e5 Author: Gal Pressman Date: Wed Aug 7 20:33:52 2024 +0300 ethtool: Fix context creation with no parameters The 'at least one change' requirement is not applicable for context creation, skip the check in such case. This allows a command such as 'ethtool -X eth0 context new' to work. The command works by mistake when using older versions of userspace ethtool due to an incompatibility issue where rxfh.input_xfrm is passed as zero (unset) instead of RXH_XFRM_NO_CHANGE as done with recent userspace. This patch does not try to solve the incompatibility issue. Link: https://lore.kernel.org/netdev/05ae8316-d3aa-4356-98c6-55ed4253c8a7@nvidia.com/ Fixes: 84a1d9c48200 ("net: ethtool: extend RXNFC API to support RSS spreading of filter matches") Reviewed-by: Dragos Tatulea Reviewed-by: Jianbo Liu Signed-off-by: Gal Pressman Reviewed-by: Edward Cree Link: https://patch.msgid.link/20240807173352.3501746-1-gal@nvidia.com Signed-off-by: Jakub Kicinski net/ethtool/ioctl.c | 13 ++++++++----- 1 file changed, 8 insertions(+), 5 deletions(-) commit b54de55990b0467538c6bb33523b28816384958a Author: Edward Cree Date: Wed Aug 7 17:06:12 2024 +0100 net: ethtool: fix off-by-one error in max RSS context IDs Both ethtool_ops.rxfh_max_context_id and the default value used when it's not specified are supposed to be exclusive maxima (the former is documented as such; the latter, U32_MAX, cannot be used as an ID since it equals ETH_RXFH_CONTEXT_ALLOC), but xa_alloc() expects an inclusive maximum. Subtract one from 'limit' to produce an inclusive maximum, and pass that to xa_alloc(). Increase bnxt's max by one to prevent a (very minor) regression, as BNXT_MAX_ETH_RSS_CTX is an inclusive max. This is safe since bnxt is not actually hard-limited; BNXT_MAX_ETH_RSS_CTX is just a leftover from old driver code that managed context IDs itself. Rename rxfh_max_context_id to rxfh_max_num_contexts to make its semantics (hopefully) more obvious. Fixes: 847a8ab18676 ("net: ethtool: let the core choose RSS context IDs") Signed-off-by: Edward Cree Link: https://patch.msgid.link/5a2d11a599aa5b0cc6141072c01accfb7758650c.1723045898.git.ecree.xilinx@gmail.com Signed-off-by: Jakub Kicinski drivers/net/ethernet/broadcom/bnxt/bnxt_ethtool.c | 2 +- include/linux/ethtool.h | 10 +++++----- net/ethtool/ioctl.c | 5 +++-- 3 files changed, 9 insertions(+), 8 deletions(-) commit a70b637db15b4de25af3c5946c4399144b3bc241 Author: Arnd Bergmann Date: Wed Aug 7 09:54:22 2024 +0200 net: pse-pd: tps23881: include missing bitfield.h header Using FIELD_GET() fails in configurations that don't already include the header file indirectly: drivers/net/pse-pd/tps23881.c: In function 'tps23881_i2c_probe': drivers/net/pse-pd/tps23881.c:755:13: error: implicit declaration of function 'FIELD_GET' [-Wimplicit-function-declaration] 755 | if (FIELD_GET(TPS23881_REG_DEVID_MASK, ret) != TPS23881_DEVICE_ID) { | ^~~~~~~~~ Fixes: 89108cb5c285 ("net: pse-pd: tps23881: Fix the device ID check") Signed-off-by: Arnd Bergmann Acked-by: Oleksij Rempel Link: https://patch.msgid.link/20240807075455.2055224-1-arnd@kernel.org Signed-off-by: Jakub Kicinski drivers/net/pse-pd/tps23881.c | 1 + 1 file changed, 1 insertion(+) commit 8fee6d5ad5fa18c270eedb2a2cdf58dbadefb94b Author: Csókás, Bence Date: Wed Aug 7 10:09:56 2024 +0200 net: fec: Stop PPS on driver remove PPS was not stopped in `fec_ptp_stop()`, called when the adapter was removed. Consequentially, you couldn't safely reload the driver with the PPS signal on. Fixes: 32cba57ba74b ("net: fec: introduce fec_ptp_stop and use in probe fail path") Reviewed-by: Fabio Estevam Link: https://lore.kernel.org/netdev/CAOMZO5BzcZR8PwKKwBssQq_wAGzVgf1ffwe_nhpQJjviTdxy-w@mail.gmail.com/T/#m01dcb810bfc451a492140f6797ca77443d0cb79f Signed-off-by: Csókás, Bence Reviewed-by: Andrew Lunn Reviewed-by: Frank Li Link: https://patch.msgid.link/20240807080956.2556602-1-csokas.bence@prolan.hu Signed-off-by: Jakub Kicinski drivers/net/ethernet/freescale/fec_ptp.c | 3 +++ 1 file changed, 3 insertions(+) commit 9ee09edc05f20422e7ced84b1f8a5d3359926ac8 Author: Florian Fainelli Date: Tue Aug 6 10:56:59 2024 -0700 net: bcmgenet: Properly overlay PHY and MAC Wake-on-LAN capabilities Some Wake-on-LAN modes such as WAKE_FILTER may only be supported by the MAC, while others might be only supported by the PHY. Make sure that the .get_wol() returns the union of both rather than only that of the PHY if the PHY supports Wake-on-LAN. Fixes: 7e400ff35cbe ("net: bcmgenet: Add support for PHY-based Wake-on-LAN") Signed-off-by: Florian Fainelli Link: https://patch.msgid.link/20240806175659.3232204-1-florian.fainelli@broadcom.com Signed-off-by: Jakub Kicinski drivers/net/ethernet/broadcom/genet/bcmgenet_wol.c | 14 +++++--------- 1 file changed, 5 insertions(+), 9 deletions(-) commit 86a41ea9fd79ddb6145cb8ebf5aeafceabca6f7d Author: James Chapman Date: Tue Aug 6 17:06:26 2024 +0100 l2tp: fix lockdep splat When l2tp tunnels use a socket provided by userspace, we can hit lockdep splats like the below when data is transmitted through another (unrelated) userspace socket which then gets routed over l2tp. This issue was previously discussed here: https://lore.kernel.org/netdev/87sfialu2n.fsf@cloudflare.com/ The solution is to have lockdep treat socket locks of l2tp tunnel sockets separately than those of standard INET sockets. To do so, use a different lockdep subclass where lock nesting is possible. ============================================ WARNING: possible recursive locking detected 6.10.0+ #34 Not tainted -------------------------------------------- iperf3/771 is trying to acquire lock: ffff8881027601d8 (slock-AF_INET/1){+.-.}-{2:2}, at: l2tp_xmit_skb+0x243/0x9d0 but task is already holding lock: ffff888102650d98 (slock-AF_INET/1){+.-.}-{2:2}, at: tcp_v4_rcv+0x1848/0x1e10 other info that might help us debug this: Possible unsafe locking scenario: CPU0 ---- lock(slock-AF_INET/1); lock(slock-AF_INET/1); *** DEADLOCK *** May be due to missing lock nesting notation 10 locks held by iperf3/771: #0: ffff888102650258 (sk_lock-AF_INET){+.+.}-{0:0}, at: tcp_sendmsg+0x1a/0x40 #1: ffffffff822ac220 (rcu_read_lock){....}-{1:2}, at: __ip_queue_xmit+0x4b/0xbc0 #2: ffffffff822ac220 (rcu_read_lock){....}-{1:2}, at: ip_finish_output2+0x17a/0x1130 #3: ffffffff822ac220 (rcu_read_lock){....}-{1:2}, at: process_backlog+0x28b/0x9f0 #4: ffffffff822ac220 (rcu_read_lock){....}-{1:2}, at: ip_local_deliver_finish+0xf9/0x260 #5: ffff888102650d98 (slock-AF_INET/1){+.-.}-{2:2}, at: tcp_v4_rcv+0x1848/0x1e10 #6: ffffffff822ac220 (rcu_read_lock){....}-{1:2}, at: __ip_queue_xmit+0x4b/0xbc0 #7: ffffffff822ac220 (rcu_read_lock){....}-{1:2}, at: ip_finish_output2+0x17a/0x1130 #8: ffffffff822ac1e0 (rcu_read_lock_bh){....}-{1:2}, at: __dev_queue_xmit+0xcc/0x1450 #9: ffff888101f33258 (dev->qdisc_tx_busylock ?: &qdisc_tx_busylock#2){+...}-{2:2}, at: __dev_queue_xmit+0x513/0x1450 stack backtrace: CPU: 2 UID: 0 PID: 771 Comm: iperf3 Not tainted 6.10.0+ #34 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.15.0-1 04/01/2014 Call Trace: dump_stack_lvl+0x69/0xa0 dump_stack+0xc/0x20 __lock_acquire+0x135d/0x2600 ? srso_alias_return_thunk+0x5/0xfbef5 lock_acquire+0xc4/0x2a0 ? l2tp_xmit_skb+0x243/0x9d0 ? __skb_checksum+0xa3/0x540 _raw_spin_lock_nested+0x35/0x50 ? l2tp_xmit_skb+0x243/0x9d0 l2tp_xmit_skb+0x243/0x9d0 l2tp_eth_dev_xmit+0x3c/0xc0 dev_hard_start_xmit+0x11e/0x420 sch_direct_xmit+0xc3/0x640 __dev_queue_xmit+0x61c/0x1450 ? ip_finish_output2+0xf4c/0x1130 ip_finish_output2+0x6b6/0x1130 ? srso_alias_return_thunk+0x5/0xfbef5 ? __ip_finish_output+0x217/0x380 ? srso_alias_return_thunk+0x5/0xfbef5 __ip_finish_output+0x217/0x380 ip_output+0x99/0x120 __ip_queue_xmit+0xae4/0xbc0 ? srso_alias_return_thunk+0x5/0xfbef5 ? srso_alias_return_thunk+0x5/0xfbef5 ? tcp_options_write.constprop.0+0xcb/0x3e0 ip_queue_xmit+0x34/0x40 __tcp_transmit_skb+0x1625/0x1890 __tcp_send_ack+0x1b8/0x340 tcp_send_ack+0x23/0x30 __tcp_ack_snd_check+0xa8/0x530 ? srso_alias_return_thunk+0x5/0xfbef5 tcp_rcv_established+0x412/0xd70 tcp_v4_do_rcv+0x299/0x420 tcp_v4_rcv+0x1991/0x1e10 ip_protocol_deliver_rcu+0x50/0x220 ip_local_deliver_finish+0x158/0x260 ip_local_deliver+0xc8/0xe0 ip_rcv+0xe5/0x1d0 ? __pfx_ip_rcv+0x10/0x10 __netif_receive_skb_one_core+0xce/0xe0 ? process_backlog+0x28b/0x9f0 __netif_receive_skb+0x34/0xd0 ? process_backlog+0x28b/0x9f0 process_backlog+0x2cb/0x9f0 __napi_poll.constprop.0+0x61/0x280 net_rx_action+0x332/0x670 ? srso_alias_return_thunk+0x5/0xfbef5 ? find_held_lock+0x2b/0x80 ? srso_alias_return_thunk+0x5/0xfbef5 ? srso_alias_return_thunk+0x5/0xfbef5 handle_softirqs+0xda/0x480 ? __dev_queue_xmit+0xa2c/0x1450 do_softirq+0xa1/0xd0 __local_bh_enable_ip+0xc8/0xe0 ? __dev_queue_xmit+0xa2c/0x1450 __dev_queue_xmit+0xa48/0x1450 ? ip_finish_output2+0xf4c/0x1130 ip_finish_output2+0x6b6/0x1130 ? srso_alias_return_thunk+0x5/0xfbef5 ? __ip_finish_output+0x217/0x380 ? srso_alias_return_thunk+0x5/0xfbef5 __ip_finish_output+0x217/0x380 ip_output+0x99/0x120 __ip_queue_xmit+0xae4/0xbc0 ? srso_alias_return_thunk+0x5/0xfbef5 ? srso_alias_return_thunk+0x5/0xfbef5 ? tcp_options_write.constprop.0+0xcb/0x3e0 ip_queue_xmit+0x34/0x40 __tcp_transmit_skb+0x1625/0x1890 tcp_write_xmit+0x766/0x2fb0 ? __entry_text_end+0x102ba9/0x102bad ? srso_alias_return_thunk+0x5/0xfbef5 ? __might_fault+0x74/0xc0 ? srso_alias_return_thunk+0x5/0xfbef5 __tcp_push_pending_frames+0x56/0x190 tcp_push+0x117/0x310 tcp_sendmsg_locked+0x14c1/0x1740 tcp_sendmsg+0x28/0x40 inet_sendmsg+0x5d/0x90 sock_write_iter+0x242/0x2b0 vfs_write+0x68d/0x800 ? __pfx_sock_write_iter+0x10/0x10 ksys_write+0xc8/0xf0 __x64_sys_write+0x3d/0x50 x64_sys_call+0xfaf/0x1f50 do_syscall_64+0x6d/0x140 entry_SYSCALL_64_after_hwframe+0x76/0x7e RIP: 0033:0x7f4d143af992 Code: c3 8b 07 85 c0 75 24 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 e9 01 cc ff ff 41 54 b8 02 00 00 0 RSP: 002b:00007ffd65032058 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 RAX: ffffffffffffffda RBX: 0000000000000001 RCX: 00007f4d143af992 RDX: 0000000000000025 RSI: 00007f4d143f3bcc RDI: 0000000000000005 RBP: 00007f4d143f2b28 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 00007f4d143f3bcc R13: 0000000000000005 R14: 0000000000000000 R15: 00007ffd650323f0 Fixes: 0b2c59720e65 ("l2tp: close all race conditions in l2tp_tunnel_register()") Suggested-by: Eric Dumazet Reported-by: syzbot+6acef9e0a4d1f46c83d4@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=6acef9e0a4d1f46c83d4 CC: gnault@redhat.com CC: cong.wang@bytedance.com Signed-off-by: James Chapman Signed-off-by: Tom Parkin Link: https://patch.msgid.link/20240806160626.1248317-1-jchapman@katalix.com Signed-off-by: Jakub Kicinski net/l2tp/l2tp_core.c | 15 +++++++++++++-- 1 file changed, 13 insertions(+), 2 deletions(-) commit 85ba108a529d99c82e814eaf782a9443acf5eaed Author: Russell King (Oracle) Date: Tue Aug 6 14:08:41 2024 +0100 net: stmmac: dwmac4: fix PCS duplex mode decode dwmac4 was decoding the duplex mode from the GMAC_PHYIF_CONTROL_STATUS register incorrectly, using GMAC_PHYIF_CTRLSTATUS_LNKMOD_MASK (value 1) rather than GMAC_PHYIF_CTRLSTATUS_LNKMOD (bit 16). Fix this. Fixes: 70523e639bf8c ("drivers: net: stmmac: reworking the PCS code.") Reviewed-by: Andrew Halaney Reviewed-by: Andrew Lunn Reviewed-by: Serge Semin Signed-off-by: Russell King (Oracle) Link: https://patch.msgid.link/E1sbJvd-001rGD-E3@rmk-PC.armlinux.org.uk Signed-off-by: Jakub Kicinski drivers/net/ethernet/stmicro/stmmac/dwmac4.h | 2 -- drivers/net/ethernet/stmicro/stmmac/dwmac4_core.c | 2 +- 2 files changed, 1 insertion(+), 3 deletions(-) commit 919f18f961c03d6694aa726c514184f2311a4614 Author: Andi Kleen Date: Wed Aug 7 17:02:44 2024 -0700 x86/mtrr: Check if fixed MTRRs exist before saving them MTRRs have an obsolete fixed variant for fine grained caching control of the 640K-1MB region that uses separate MSRs. This fixed variant has a separate capability bit in the MTRR capability MSR. So far all x86 CPUs which support MTRR have this separate bit set, so it went unnoticed that mtrr_save_state() does not check the capability bit before accessing the fixed MTRR MSRs. Though on a CPU that does not support the fixed MTRR capability this results in a #GP. The #GP itself is harmless because the RDMSR fault is handled gracefully, but results in a WARN_ON(). Add the missing capability check to prevent this. Fixes: 2b1f6278d77c ("[PATCH] x86: Save the MTRRs of the BSP before booting an AP") Signed-off-by: Andi Kleen Signed-off-by: Thomas Gleixner Cc: stable@vger.kernel.org Link: https://lore.kernel.org/all/20240808000244.946864-1-ak@linux.intel.com arch/x86/kernel/cpu/mtrr/mtrr.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 660e4b18a72efe555c9b7ff9a80cfd4777af9609 Merge: 6a0e38264012 6d45e1c948a8 Author: Linus Torvalds Date: Thu Aug 8 07:32:20 2024 -0700 Merge tag 'mm-hotfixes-stable-2024-08-07-18-32' of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm Pull misc fixes from Andrew Morton: "Nine hotfixes. Five are cc:stable, the others either pertain to post-6.10 material or aren't considered necessary for earlier kernels. Five are MM and four are non-MM. No identifiable theme here - please see the individual changelogs" * tag 'mm-hotfixes-stable-2024-08-07-18-32' of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm: padata: Fix possible divide-by-0 panic in padata_mt_helper() mailmap: update entry for David Heidelberg memcg: protect concurrent access to mem_cgroup_idr mm: shmem: fix incorrect aligned index when checking conflicts mm: shmem: avoid allocating huge pages larger than MAX_PAGECACHE_ORDER for shmem mm: list_lru: fix UAF for memory cgroup kcov: properly check for softirq context MAINTAINERS: Update LTP members and web selftests: mm: add s390 to ARCH check commit 7cc06e729460a209b84d3db4db56c9f85f048cc2 Author: Gergo Koteles Date: Thu Jul 25 11:21:10 2024 +0200 platform/x86: ideapad-laptop: add a mutex to synchronize VPC commands Calling VPC commands consists of several VPCW and VPCR ACPI calls. These calls and their results can get mixed up if they are called simultaneously from different threads, like acpi notify handler, sysfs, debugfs, notification chain. The commit e2ffcda16290 ("ACPI: OSL: Allow Notify () handlers to run on all CPUs") made the race issues much worse than before it but some races were possible even before that commit. Add a mutex to synchronize VPC commands. Fixes: e2ffcda16290 ("ACPI: OSL: Allow Notify () handlers to run on all CPUs") Fixes: e82882cdd241 ("platform/x86: Add driver for Yoga Tablet Mode switch") Signed-off-by: Gergo Koteles Link: https://lore.kernel.org/r/f26782fa1194ad11ed5d9ba121a804e59b58b026.1721898747.git.soyer@irl.hu Reviewed-by: Ilpo Järvinen Signed-off-by: Ilpo Järvinen drivers/platform/x86/ideapad-laptop.c | 64 +++++++++++++++++++++++++---------- 1 file changed, 47 insertions(+), 17 deletions(-) commit cde7886b35176d56e72bfc68dc104fa08e7b072c Author: Gergo Koteles Date: Thu Jul 25 11:21:08 2024 +0200 platform/x86: ideapad-laptop: move ymc_trigger_ec from lenovo-ymc Some models need to trigger the EC after each YMC event for the yoga mode control to work properly. EC triggering consist of a VPC call from the lenovo-ymc module. Except for this, all VPC calls are in the ideapad-laptop module. Since ideapad-laptop has a notification chain, a new YMC_EVENT action can be added and triggered from the lenovo-ymc module. Then the ideapad-laptop can trigger the EC. If the triggering is in the ideapad-laptop module, then the ec_trigger module parameter should be there as well. Move the ymc_trigger_ec functionality and the ec_trigger module parameter to the ideapad-laptop module. Signed-off-by: Gergo Koteles Reviewed-by: Ilpo Järvinen Link: https://lore.kernel.org/r/d980ab3ac32b5e554f456b0ff17279bfdbe2a203.1721898747.git.soyer@irl.hu Signed-off-by: Ilpo Järvinen drivers/platform/x86/Kconfig | 1 + drivers/platform/x86/ideapad-laptop.c | 49 ++++++++++++++++++++++++++++ drivers/platform/x86/ideapad-laptop.h | 4 +++ drivers/platform/x86/lenovo-ymc.c | 60 ++--------------------------------- 4 files changed, 56 insertions(+), 58 deletions(-) commit 613e3900c24bb1379d994f44d75d31c3223cc263 Author: Gergo Koteles Date: Thu Jul 25 11:21:07 2024 +0200 platform/x86: ideapad-laptop: introduce a generic notification chain There are several cases where a notification chain can simplify Lenovo WMI drivers. Add a generic notification chain into ideapad-laptop. Signed-off-by: Gergo Koteles Link: https://lore.kernel.org/r/c5a43efae8a32bd034c3d19c0a686941347575a7.1721898747.git.soyer@irl.hu Reviewed-by: Ilpo Järvinen Signed-off-by: Ilpo Järvinen drivers/platform/x86/ideapad-laptop.c | 37 +++++++++++++++++++++++++++++++++++ drivers/platform/x86/ideapad-laptop.h | 5 +++++ 2 files changed, 42 insertions(+) commit 78296429e20052b029211b0aca64aadc5052d581 Author: Shyam Sundar S K Date: Tue Jul 30 19:53:16 2024 +0530 platform/x86/amd/pmf: Fix to Update HPD Data When ALS is Disabled If the Ambient Light Sensor (ALS) is disabled, the current code in the PMF driver does not query for Human Presence Detection (HPD) data in amd_pmf_get_sensor_info(). As a result, stale HPD data is used by PMF-TA to evaluate policy conditions, leading to unexpected behavior in the policy output actions. To resolve this issue, modify the PMF driver to query HPD data independently of ALS. Since user_present is a boolean, modify the current code to return true if the user is present and false if the user is away or if the sensor is not detected, and report this status to the PMF TA firmware accordingly. With this change, amd_pmf_get_sensor_info() now returns void instead of int. Fixes: cedecdba60f4 ("platform/x86/amd/pmf: Get ambient light information from AMD SFH driver") Co-developed-by: Patil Rajesh Reddy Signed-off-by: Patil Rajesh Reddy Signed-off-by: Shyam Sundar S K Link: https://lore.kernel.org/r/20240730142316.3846259-1-Shyam-sundar.S-k@amd.com Reviewed-by: Ilpo Järvinen Signed-off-by: Ilpo Järvinen drivers/platform/x86/amd/pmf/spc.c | 32 +++++++++++--------------------- 1 file changed, 11 insertions(+), 21 deletions(-) commit 06ce0af34177a110d6a5cf71f924965b9b230691 Author: Dr. David Alan Gilbert Date: Wed May 29 00:11:23 2024 +0100 soc: fsl: qbman: remove unused struct 'cgr_comp' 'cgr_comp' has been unused since commit 96f413f47677 ("soc/fsl/qbman: fix issue in qman_delete_cgr_safe()"). Remove it. Signed-off-by: Dr. David Alan Gilbert Reviewed-by: Sean Anderson Signed-off-by: Michael Ellerman Link: https://msgid.link/20240528231123.136664-1-linux@treblig.org drivers/soc/fsl/qbman/qman.c | 5 ----- 1 file changed, 5 deletions(-) commit 03898691d42e0170e7d00f07cbe21ce0e9f3a8fa Author: Takashi Iwai Date: Thu Aug 8 10:18:01 2024 +0200 ALSA: usb-audio: Re-add ScratchAmp quirk entries At the code refactoring of USB-audio quirk handling, I assumed that the quirk entries of Stanton ScratchAmp devices were only about the device name, and moved them completely into the rename table. But it seems that the device requires the quirk entry so that it's probed by the driver itself. This re-adds back the quirk entries of ScratchAmp, but in a minimalistic manner. Fixes: 5436f59bc5bc ("ALSA: usb-audio: Move device rename and profile quirks to an internal table") Link: https://patch.msgid.link/20240808081803.22300-1-tiwai@suse.de Signed-off-by: Takashi Iwai sound/usb/quirks-table.h | 4 ++++ 1 file changed, 4 insertions(+) commit 74b0666f97f9455bc799405b7874df62fcb66bae Author: Wolfram Sang Date: Tue Aug 6 13:35:33 2024 +0200 i2c: testunit: match HostNotify test name with docs Ensure the test has the same name in the code as it has in the docs. Signed-off-by: Wolfram Sang drivers/i2c/i2c-slave-testunit.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) commit b928e7d19dfd8a336e13ec0d21e1d60dc285efd5 Merge: bc59b558927b b5431dc2803a Author: Jakub Kicinski Date: Wed Aug 7 20:31:42 2024 -0700 Merge tag 'for-net-2024-08-07' of git://git.kernel.org/pub/scm/linux/kernel/git/bluetooth/bluetooth Luiz Augusto von Dentz says: ==================== bluetooth pull request for net: - hci_sync: avoid dup filtering when passive scanning with adv monitor - hci_qca: don't call pwrseq_power_off() twice for QCA6390 - hci_qca: fix QCA6390 support on non-DT platforms - hci_qca: fix a NULL-pointer derefence at shutdown - l2cap: always unlock channel in l2cap_conless_channel() * tag 'for-net-2024-08-07' of git://git.kernel.org/pub/scm/linux/kernel/git/bluetooth/bluetooth: Bluetooth: hci_sync: avoid dup filtering when passive scanning with adv monitor Bluetooth: l2cap: always unlock channel in l2cap_conless_channel() Bluetooth: hci_qca: fix a NULL-pointer derefence at shutdown Bluetooth: hci_qca: fix QCA6390 support on non-DT platforms Bluetooth: hci_qca: don't call pwrseq_power_off() twice for QCA6390 ==================== Link: https://patch.msgid.link/20240807210103.142483-1-luiz.dentz@gmail.com Signed-off-by: Jakub Kicinski commit bc59b558927b180acbec40a0246557f77007e820 Merge: da03f5d1b2c3 290f1c033281 Author: Jakub Kicinski Date: Wed Aug 7 20:26:57 2024 -0700 Merge branch 'idpf-fix-3-bugs-revealed-by-the-chapter-i' Tony Nguyen says: ==================== idpf: fix 3 bugs revealed by the Chapter I Alexander Lobakin says: The libeth conversion revealed 2 serious issues which lead to sporadic crashes or WARNs under certain configurations. Additional one was found while debugging these two with kmemleak. This one is targeted stable, the rest can be backported manually later if needed. They can be reproduced only after the conversion is applied anyway. ==================== Link: https://patch.msgid.link/20240806220923.3359860-1-anthony.l.nguyen@intel.com Signed-off-by: Jakub Kicinski commit 290f1c033281c1a502a3cd1c53c3a549259c491f Author: Alexander Lobakin Date: Tue Aug 6 15:09:22 2024 -0700 idpf: fix UAFs when destroying the queues The second tagged commit started sometimes (very rarely, but possible) throwing WARNs from net/core/page_pool.c:page_pool_disable_direct_recycling(). Turned out idpf frees interrupt vectors with embedded NAPIs *before* freeing the queues making page_pools' NAPI pointers lead to freed memory before these pools are destroyed by libeth. It's not clear whether there are other accesses to the freed vectors when destroying the queues, but anyway, we usually free queue/interrupt vectors only when the queues are destroyed and the NAPIs are guaranteed to not be referenced anywhere. Invert the allocation and freeing logic making queue/interrupt vectors be allocated first and freed last. Vectors don't require queues to be present, so this is safe. Additionally, this change allows to remove that useless queue->q_vector pointer cleanup, as vectors are still valid when freeing the queues (+ both are freed within one function, so it's not clear why nullify the pointers at all). Fixes: 1c325aac10a8 ("idpf: configure resources for TX queues") Fixes: 90912f9f4f2d ("idpf: convert header split mode to libeth + napi_build_skb()") Reported-by: Michal Kubiak Signed-off-by: Alexander Lobakin Reviewed-by: Simon Horman Tested-by: Krishneil Singh Signed-off-by: Tony Nguyen Link: https://patch.msgid.link/20240806220923.3359860-4-anthony.l.nguyen@intel.com Signed-off-by: Jakub Kicinski drivers/net/ethernet/intel/idpf/idpf_lib.c | 24 ++++++++++++------------ drivers/net/ethernet/intel/idpf/idpf_txrx.c | 24 +----------------------- 2 files changed, 13 insertions(+), 35 deletions(-) commit 3cc88e8405b8d55e0ff035e31971aadd6baee2b6 Author: Michal Kubiak Date: Tue Aug 6 15:09:21 2024 -0700 idpf: fix memleak in vport interrupt configuration The initialization of vport interrupt consists of two functions: 1) idpf_vport_intr_init() where a generic configuration is done 2) idpf_vport_intr_req_irq() where the irq for each q_vector is requested. The first function used to create a base name for each interrupt using "kasprintf()" call. Unfortunately, although that call allocated memory for a text buffer, that memory was never released. Fix this by removing creating the interrupt base name in 1). Instead, always create a full interrupt name in the function 2), because there is no need to create a base name separately, considering that the function 2) is never called out of idpf_vport_intr_init() context. Fixes: d4d558718266 ("idpf: initialize interrupts and enable vport") Cc: stable@vger.kernel.org # 6.7 Signed-off-by: Michal Kubiak Reviewed-by: Pavan Kumar Linga Signed-off-by: Alexander Lobakin Reviewed-by: Simon Horman Tested-by: Krishneil Singh Signed-off-by: Tony Nguyen Link: https://patch.msgid.link/20240806220923.3359860-3-anthony.l.nguyen@intel.com Signed-off-by: Jakub Kicinski drivers/net/ethernet/intel/idpf/idpf_txrx.c | 19 ++++++++----------- 1 file changed, 8 insertions(+), 11 deletions(-) commit f01032a2ca099ec8d619aaa916c3762aa62495df Author: Alexander Lobakin Date: Tue Aug 6 15:09:20 2024 -0700 idpf: fix memory leaks and crashes while performing a soft reset The second tagged commit introduced a UAF, as it removed restoring q_vector->vport pointers after reinitializating the structures. This is due to that all queue allocation functions are performed here with the new temporary vport structure and those functions rewrite the backpointers to the vport. Then, this new struct is freed and the pointers start leading to nowhere. But generally speaking, the current logic is very fragile. It claims to be more reliable when the system is low on memory, but in fact, it consumes two times more memory as at the moment of running this function, there are two vports allocated with their queues and vectors. Moreover, it claims to prevent the driver from running into "bad state", but in fact, any error during the rebuild leaves the old vport in the partially allocated state. Finally, if the interface is down when the function is called, it always allocates a new queue set, but when the user decides to enable the interface later on, vport_open() allocates them once again, IOW there's a clear memory leak here. Just don't allocate a new queue set when performing a reset, that solves crashes and memory leaks. Readd the old queue number and reopen the interface on rollback - that solves limbo states when the device is left disabled and/or without HW queues enabled. Fixes: 02cbfba1add5 ("idpf: add ethtool callbacks") Fixes: e4891e4687c8 ("idpf: split &idpf_queue into 4 strictly-typed queue structures") Signed-off-by: Alexander Lobakin Reviewed-by: Simon Horman Tested-by: Krishneil Singh Signed-off-by: Tony Nguyen Link: https://patch.msgid.link/20240806220923.3359860-2-anthony.l.nguyen@intel.com Signed-off-by: Jakub Kicinski drivers/net/ethernet/intel/idpf/idpf_lib.c | 30 +++++++++++++++--------------- 1 file changed, 15 insertions(+), 15 deletions(-) commit da03f5d1b2c319a2b74fe76edeadcd8fa5f44376 Author: Michael Chan Date: Mon Aug 5 22:37:42 2024 -0700 bnxt_en : Fix memory out-of-bounds in bnxt_fill_hw_rss_tbl() A recent commit has modified the code in __bnxt_reserve_rings() to set the default RSS indirection table to default only when the number of RX rings is changing. While this works for newer firmware that requires RX ring reservations, it causes the regression on older firmware not requiring RX ring resrvations (BNXT_NEW_RM() returns false). With older firmware, RX ring reservations are not required and so hw_resc->resv_rx_rings is not always set to the proper value. The comparison: if (old_rx_rings != bp->hw_resc.resv_rx_rings) in __bnxt_reserve_rings() may be false even when the RX rings are changing. This will cause __bnxt_reserve_rings() to skip setting the default RSS indirection table to default to match the current number of RX rings. This may later cause bnxt_fill_hw_rss_tbl() to use an out-of-range index. We already have bnxt_check_rss_tbl_no_rmgr() to handle exactly this scenario. We just need to move it up in bnxt_need_reserve_rings() to be called unconditionally when using older firmware. Without the fix, if the TX rings are changing, we'll skip the bnxt_check_rss_tbl_no_rmgr() call and __bnxt_reserve_rings() may also skip the bnxt_set_dflt_rss_indir_tbl() call for the reason explained in the last paragraph. Without setting the default RSS indirection table to default, it causes the regression: BUG: KASAN: slab-out-of-bounds in __bnxt_hwrm_vnic_set_rss+0xb79/0xe40 Read of size 2 at addr ffff8881c5809618 by task ethtool/31525 Call Trace: __bnxt_hwrm_vnic_set_rss+0xb79/0xe40 bnxt_hwrm_vnic_rss_cfg_p5+0xf7/0x460 __bnxt_setup_vnic_p5+0x12e/0x270 __bnxt_open_nic+0x2262/0x2f30 bnxt_open_nic+0x5d/0xf0 ethnl_set_channels+0x5d4/0xb30 ethnl_default_set_doit+0x2f1/0x620 Reported-by: Breno Leitao Closes: https://lore.kernel.org/netdev/ZrC6jpghA3PWVWSB@gmail.com/ Fixes: 98ba1d931f61 ("bnxt_en: Fix RSS logic in __bnxt_reserve_rings()") Reviewed-by: Pavan Chebbi Reviewed-by: Kalesh AP Reviewed-by: Somnath Kotur Signed-off-by: Michael Chan Tested-by: Breno Leitao Link: https://patch.msgid.link/20240806053742.140304-1-michael.chan@broadcom.com Signed-off-by: Jakub Kicinski drivers/net/ethernet/broadcom/bnxt/bnxt.c | 13 +++++++------ 1 file changed, 7 insertions(+), 6 deletions(-) commit e3862093ee93fcfbdadcb7957f5f8974fffa806a Author: Joe Hattori Date: Tue Aug 6 10:13:27 2024 +0900 net: dsa: bcm_sf2: Fix a possible memory leak in bcm_sf2_mdio_register() bcm_sf2_mdio_register() calls of_phy_find_device() and then phy_device_remove() in a loop to remove existing PHY devices. of_phy_find_device() eventually calls bus_find_device(), which calls get_device() on the returned struct device * to increment the refcount. The current implementation does not decrement the refcount, which causes memory leak. This commit adds the missing phy_device_free() call to decrement the refcount via put_device() to balance the refcount. Fixes: 771089c2a485 ("net: dsa: bcm_sf2: Ensure that MDIO diversion is used") Signed-off-by: Joe Hattori Tested-by: Florian Fainelli Reviewed-by: Florian Fainelli Link: https://patch.msgid.link/20240806011327.3817861-1-joe@pf.is.s.u-tokyo.ac.jp Signed-off-by: Jakub Kicinski drivers/net/dsa/bcm_sf2.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) commit d27a835f41d947f62e6a95e89ba523299c9e6437 Author: Zhengchao Shao Date: Mon Aug 5 12:38:56 2024 +0800 net/smc: add the max value of fallback reason count The number of fallback reasons defined in the smc_clc.h file has reached 36. For historical reasons, some are no longer quoted, and there's 33 actually in use. So, add the max value of fallback reason count to 36. Fixes: 6ac1e6563f59 ("net/smc: support smc v2.x features validate") Fixes: 7f0620b9940b ("net/smc: support max connections per lgr negotiation") Fixes: 69b888e3bb4b ("net/smc: support max links per lgr negotiation in clc handshake") Signed-off-by: Zhengchao Shao Reviewed-by: Wenjia Zhang Reviewed-by: D. Wythe Link: https://patch.msgid.link/20240805043856.565677-1-shaozhengchao@huawei.com Signed-off-by: Jakub Kicinski net/smc/smc_stats.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 6d45e1c948a8b7ed6ceddb14319af69424db730c Author: Waiman Long Date: Tue Aug 6 13:46:47 2024 -0400 padata: Fix possible divide-by-0 panic in padata_mt_helper() We are hit with a not easily reproducible divide-by-0 panic in padata.c at bootup time. [ 10.017908] Oops: divide error: 0000 1 PREEMPT SMP NOPTI [ 10.017908] CPU: 26 PID: 2627 Comm: kworker/u1666:1 Not tainted 6.10.0-15.el10.x86_64 #1 [ 10.017908] Hardware name: Lenovo ThinkSystem SR950 [7X12CTO1WW]/[7X12CTO1WW], BIOS [PSE140J-2.30] 07/20/2021 [ 10.017908] Workqueue: events_unbound padata_mt_helper [ 10.017908] RIP: 0010:padata_mt_helper+0x39/0xb0 : [ 10.017963] Call Trace: [ 10.017968] [ 10.018004] ? padata_mt_helper+0x39/0xb0 [ 10.018084] process_one_work+0x174/0x330 [ 10.018093] worker_thread+0x266/0x3a0 [ 10.018111] kthread+0xcf/0x100 [ 10.018124] ret_from_fork+0x31/0x50 [ 10.018138] ret_from_fork_asm+0x1a/0x30 [ 10.018147] Looking at the padata_mt_helper() function, the only way a divide-by-0 panic can happen is when ps->chunk_size is 0. The way that chunk_size is initialized in padata_do_multithreaded(), chunk_size can be 0 when the min_chunk in the passed-in padata_mt_job structure is 0. Fix this divide-by-0 panic by making sure that chunk_size will be at least 1 no matter what the input parameters are. Link: https://lkml.kernel.org/r/20240806174647.1050398-1-longman@redhat.com Fixes: 004ed42638f4 ("padata: add basic support for multithreaded jobs") Signed-off-by: Waiman Long Cc: Daniel Jordan Cc: Steffen Klassert Cc: Waiman Long Cc: Signed-off-by: Andrew Morton kernel/padata.c | 7 +++++++ 1 file changed, 7 insertions(+) commit f2087995fb7165a88b50dde02f3909e448522e0a Author: David Heidelberg Date: Sun Aug 4 14:45:54 2024 +0900 mailmap: update entry for David Heidelberg Link my old gmail address to my active email. Link: https://lkml.kernel.org/r/20240804054704.859503-1-david@ixit.cz Signed-off-by: David Heidelberg Cc: David S. Miller Cc: Jiri Kosina Cc: Manivannan Sadhasivam Signed-off-by: Andrew Morton .mailmap | 1 + 1 file changed, 1 insertion(+) commit 9972605a238339b85bd16b084eed5f18414d22db Author: Shakeel Butt Date: Fri Aug 2 16:58:22 2024 -0700 memcg: protect concurrent access to mem_cgroup_idr Commit 73f576c04b94 ("mm: memcontrol: fix cgroup creation failure after many small jobs") decoupled the memcg IDs from the CSS ID space to fix the cgroup creation failures. It introduced IDR to maintain the memcg ID space. The IDR depends on external synchronization mechanisms for modifications. For the mem_cgroup_idr, the idr_alloc() and idr_replace() happen within css callback and thus are protected through cgroup_mutex from concurrent modifications. However idr_remove() for mem_cgroup_idr was not protected against concurrency and can be run concurrently for different memcgs when they hit their refcnt to zero. Fix that. We have been seeing list_lru based kernel crashes at a low frequency in our fleet for a long time. These crashes were in different part of list_lru code including list_lru_add(), list_lru_del() and reparenting code. Upon further inspection, it looked like for a given object (dentry and inode), the super_block's list_lru didn't have list_lru_one for the memcg of that object. The initial suspicions were either the object is not allocated through kmem_cache_alloc_lru() or somehow memcg_list_lru_alloc() failed to allocate list_lru_one() for a memcg but returned success. No evidence were found for these cases. Looking more deeply, we started seeing situations where valid memcg's id is not present in mem_cgroup_idr and in some cases multiple valid memcgs have same id and mem_cgroup_idr is pointing to one of them. So, the most reasonable explanation is that these situations can happen due to race between multiple idr_remove() calls or race between idr_alloc()/idr_replace() and idr_remove(). These races are causing multiple memcgs to acquire the same ID and then offlining of one of them would cleanup list_lrus on the system for all of them. Later access from other memcgs to the list_lru cause crashes due to missing list_lru_one. Link: https://lkml.kernel.org/r/20240802235822.1830976-1-shakeel.butt@linux.dev Fixes: 73f576c04b94 ("mm: memcontrol: fix cgroup creation failure after many small jobs") Signed-off-by: Shakeel Butt Acked-by: Muchun Song Reviewed-by: Roman Gushchin Acked-by: Johannes Weiner Cc: Michal Hocko Cc: Signed-off-by: Andrew Morton mm/memcontrol.c | 22 ++++++++++++++++++++-- 1 file changed, 20 insertions(+), 2 deletions(-) commit 4cbf320b1500fe64fcef8c96ed74dfc1ae2c9e2c Author: Baolin Wang Date: Wed Jul 31 13:46:20 2024 +0800 mm: shmem: fix incorrect aligned index when checking conflicts In the shmem_suitable_orders() function, xa_find() is used to check for conflicts in the pagecache to select suitable huge orders. However, when checking each huge order in every loop, the aligned index is calculated from the previous iteration, which may cause suitable huge orders to be missed. We should use the original index each time in the loop to calculate a new aligned index for checking conflicts to avoid this issue. Link: https://lkml.kernel.org/r/07433b0f16a152bffb8cee34934a5c040e8e2ad6.1722404078.git.baolin.wang@linux.alibaba.com Fixes: e7a2ab7b3bb5 ("mm: shmem: add mTHP support for anonymous shmem") Signed-off-by: Baolin Wang Acked-by: David Hildenbrand Cc: Barry Song <21cnbao@gmail.com> Cc: Gavin Shan Cc: Hugh Dickins Cc: Lance Yang Cc: Matthew Wilcox Cc: Ryan Roberts Cc: Zi Yan Cc: Barry Song Cc: Kefeng Wang Signed-off-by: Andrew Morton mm/shmem.c | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) commit b66b1b71d7ff5464d23a0ac6f73fae461b7264fd Author: Baolin Wang Date: Wed Jul 31 13:46:19 2024 +0800 mm: shmem: avoid allocating huge pages larger than MAX_PAGECACHE_ORDER for shmem Similar to commit d659b715e94ac ("mm/huge_memory: avoid PMD-size page cache if needed"), ARM64 can support 512MB PMD-sized THP when the base page size is 64KB, which is larger than the maximum supported page cache size MAX_PAGECACHE_ORDER. This is not expected. To fix this issue, use THP_ORDERS_ALL_FILE_DEFAULT for shmem to filter allowable huge orders. [baolin.wang@linux.alibaba.com: remove comment, per Barry] Link: https://lkml.kernel.org/r/c55d7ef7-78aa-4ed6-b897-c3e03a3f3ab7@linux.alibaba.com [wangkefeng.wang@huawei.com: remove local `orders'] Link: https://lkml.kernel.org/r/87769ae8-b6c6-4454-925d-1864364af9c8@huawei.com Link: https://lkml.kernel.org/r/117121665254442c3c7f585248296495e5e2b45c.1722404078.git.baolin.wang@linux.alibaba.com Fixes: e7a2ab7b3bb5 ("mm: shmem: add mTHP support for anonymous shmem") Signed-off-by: Baolin Wang Signed-off-by: Kefeng Wang Reviewed-by: Barry Song Cc: Barry Song <21cnbao@gmail.com> Cc: David Hildenbrand Cc: Gavin Shan Cc: Hugh Dickins Cc: Lance Yang Cc: Matthew Wilcox Cc: Ryan Roberts Cc: Zi Yan Signed-off-by: Andrew Morton mm/shmem.c | 7 +------ 1 file changed, 1 insertion(+), 6 deletions(-) commit 5161b48712dcd08ec427c450399d4d1483e21dea Author: Muchun Song Date: Thu Jul 18 16:36:07 2024 +0800 mm: list_lru: fix UAF for memory cgroup The mem_cgroup_from_slab_obj() is supposed to be called under rcu lock or cgroup_mutex or others which could prevent returned memcg from being freed. Fix it by adding missing rcu read lock. Found by code inspection. [songmuchun@bytedance.com: only grab rcu lock when necessary, per Vlastimil] Link: https://lkml.kernel.org/r/20240801024603.1865-1-songmuchun@bytedance.com Link: https://lkml.kernel.org/r/20240718083607.42068-1-songmuchun@bytedance.com Fixes: 0a97c01cd20b ("list_lru: allow explicit memcg and NUMA node selection") Signed-off-by: Muchun Song Acked-by: Shakeel Butt Acked-by: Vlastimil Babka Cc: Johannes Weiner Cc: Nhat Pham Cc: Signed-off-by: Andrew Morton mm/list_lru.c | 28 ++++++++++++++++++++++------ 1 file changed, 22 insertions(+), 6 deletions(-) commit 7d4df2dad312f270d62fecb0e5c8b086c6d7dcfc Author: Andrey Konovalov Date: Mon Jul 29 04:21:58 2024 +0200 kcov: properly check for softirq context When collecting coverage from softirqs, KCOV uses in_serving_softirq() to check whether the code is running in the softirq context. Unfortunately, in_serving_softirq() is > 0 even when the code is running in the hardirq or NMI context for hardirqs and NMIs that happened during a softirq. As a result, if a softirq handler contains a remote coverage collection section and a hardirq with another remote coverage collection section happens during handling the softirq, KCOV incorrectly detects a nested softirq coverate collection section and prints a WARNING, as reported by syzbot. This issue was exposed by commit a7f3813e589f ("usb: gadget: dummy_hcd: Switch to hrtimer transfer scheduler"), which switched dummy_hcd to using hrtimer and made the timer's callback be executed in the hardirq context. Change the related checks in KCOV to account for this behavior of in_serving_softirq() and make KCOV ignore remote coverage collection sections in the hardirq and NMI contexts. This prevents the WARNING printed by syzbot but does not fix the inability of KCOV to collect coverage from the __usb_hcd_giveback_urb when dummy_hcd is in use (caused by a7f3813e589f); a separate patch is required for that. Link: https://lkml.kernel.org/r/20240729022158.92059-1-andrey.konovalov@linux.dev Fixes: 5ff3b30ab57d ("kcov: collect coverage from interrupts") Signed-off-by: Andrey Konovalov Reported-by: syzbot+2388cdaeb6b10f0c13ac@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=2388cdaeb6b10f0c13ac Acked-by: Marco Elver Cc: Alan Stern Cc: Aleksandr Nogikh Cc: Alexander Potapenko Cc: Dmitry Vyukov Cc: Greg Kroah-Hartman Cc: Marcello Sylvester Bauer Cc: Signed-off-by: Andrew Morton kernel/kcov.c | 15 ++++++++++++--- 1 file changed, 12 insertions(+), 3 deletions(-) commit 37bf7fbe1db27792b27345871aa5f8ae52cd396c Author: Petr Vorel Date: Fri Jul 26 09:20:09 2024 +0200 MAINTAINERS: Update LTP members and web LTP project uses now readthedocs.org instance instead of GitHub wiki. LTP maintainers are listed in alphabetical order. Link: https://lkml.kernel.org/r/20240726072009.1021599-1-pvorel@suse.cz Signed-off-by: Petr Vorel Reviewed-by: Li Wang Reviewed-by: Cyril Hrubis Cc: Jan Stancek Cc: Xiao Yang Cc: Yang Xu Signed-off-by: Andrew Morton MAINTAINERS | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) commit 30b651c8bc788c068a978dc760e9d5f824f7019e Author: Nico Pache Date: Wed Jul 24 15:35:17 2024 -0600 selftests: mm: add s390 to ARCH check commit 0518dbe97fe6 ("selftests/mm: fix cross compilation with LLVM") changed the env variable for the architecture from MACHINE to ARCH. This is preventing 3 required TEST_GEN_FILES from being included when cross compiling s390x and errors when trying to run the test suite. This is due to the ARCH variable already being set and the arch folder name being s390. Add "s390" to the filtered list to cover this case and have the 3 files included in the build. Link: https://lkml.kernel.org/r/20240724213517.23918-1-npache@redhat.com Fixes: 0518dbe97fe6 ("selftests/mm: fix cross compilation with LLVM") Signed-off-by: Nico Pache Cc: Mark Brown Cc: Albert Ou Cc: Palmer Dabbelt Cc: Paul Walmsley Cc: Shuah Khan Cc: Signed-off-by: Andrew Morton tools/testing/selftests/mm/Makefile | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 73dc1656f41a42849e43b945fe44d4e3d55eb6c3 Author: Kent Overstreet Date: Wed Aug 7 16:40:14 2024 -0400 bcachefs: Use bch2_wait_on_allocator() in btree node alloc path If the allocator gets stuck, we need to know why. Signed-off-by: Kent Overstreet fs/bcachefs/btree_update_interior.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit cecf72798b25fcb00303392407fccf500a746747 Author: Kent Overstreet Date: Wed Aug 7 13:58:57 2024 -0400 bcachefs: Make allocator stuck timeout configurable, ratelimit messages Limit these messages to once every 2 minutes to avoid spamming logs; with multiple devices the output can be quite significant. Also, up the default timeout to 30 seconds from 10 seconds. Signed-off-by: Kent Overstreet fs/bcachefs/alloc_foreground.c | 26 ++++++++++++++++++++++++-- fs/bcachefs/alloc_foreground.h | 7 ++++++- fs/bcachefs/bcachefs.h | 2 ++ fs/bcachefs/bcachefs_format.h | 2 ++ fs/bcachefs/io_misc.c | 6 +----- fs/bcachefs/io_write.c | 5 +---- fs/bcachefs/opts.h | 5 +++++ fs/bcachefs/super-io.c | 4 ++++ 8 files changed, 45 insertions(+), 12 deletions(-) commit 6d496e02b4a70926c3bd4e7ab6249ff262eb3bc0 Author: Kent Overstreet Date: Wed Aug 7 18:03:54 2024 -0400 bcachefs: Add missing path_traverse() to btree_iter_next_node() This fixes a bug exposed by the next path - we pop an assert in path_set_should_be_locked(). Signed-off-by: Kent Overstreet fs/bcachefs/btree_iter.c | 5 +++++ 1 file changed, 5 insertions(+) commit 0b6743bd60a56a701070b89fb80c327a44b7b3e2 Author: Steven Rostedt Date: Wed Aug 7 18:54:02 2024 -0400 tracefs: Use generic inode RCU for synchronizing freeing With structure layout randomization enabled for 'struct inode' we need to avoid overlapping any of the RCU-used / initialized-only-once members, e.g. i_lru or i_sb_list to not corrupt related list traversals when making use of the rcu_head. For an unlucky structure layout of 'struct inode' we may end up with the following splat when running the ftrace selftests: [<...>] list_del corruption, ffff888103ee2cb0->next (tracefs_inode_cache+0x0/0x4e0 [slab object]) is NULL (prev is tracefs_inode_cache+0x78/0x4e0 [slab object]) [<...>] ------------[ cut here ]------------ [<...>] kernel BUG at lib/list_debug.c:54! [<...>] invalid opcode: 0000 [#1] PREEMPT SMP KASAN [<...>] CPU: 3 PID: 2550 Comm: mount Tainted: G N 6.8.12-grsec+ #122 ed2f536ca62f28b087b90e3cc906a8d25b3ddc65 [<...>] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.14.0-2 04/01/2014 [<...>] RIP: 0010:[] __list_del_entry_valid_or_report+0x138/0x3e0 [<...>] Code: 48 b8 99 fb 65 f2 ff ff ff ff e9 03 5c d9 fc cc 48 b8 99 fb 65 f2 ff ff ff ff e9 33 5a d9 fc cc 48 b8 99 fb 65 f2 ff ff ff ff <0f> 0b 4c 89 e9 48 89 ea 48 89 ee 48 c7 c7 60 8f dd 89 31 c0 e8 2f [<...>] RSP: 0018:fffffe80416afaf0 EFLAGS: 00010283 [<...>] RAX: 0000000000000098 RBX: ffff888103ee2cb0 RCX: 0000000000000000 [<...>] RDX: ffffffff84655fe8 RSI: ffffffff89dd8b60 RDI: 0000000000000001 [<...>] RBP: ffff888103ee2cb0 R08: 0000000000000001 R09: fffffbd0082d5f25 [<...>] R10: fffffe80416af92f R11: 0000000000000001 R12: fdf99c16731d9b6d [<...>] R13: 0000000000000000 R14: ffff88819ad4b8b8 R15: 0000000000000000 [<...>] RBX: tracefs_inode_cache+0x0/0x4e0 [slab object] [<...>] RDX: __list_del_entry_valid_or_report+0x108/0x3e0 [<...>] RSI: __func__.47+0x4340/0x4400 [<...>] RBP: tracefs_inode_cache+0x0/0x4e0 [slab object] [<...>] RSP: process kstack fffffe80416afaf0+0x7af0/0x8000 [mount 2550 2550] [<...>] R09: kasan shadow of process kstack fffffe80416af928+0x7928/0x8000 [mount 2550 2550] [<...>] R10: process kstack fffffe80416af92f+0x792f/0x8000 [mount 2550 2550] [<...>] R14: tracefs_inode_cache+0x78/0x4e0 [slab object] [<...>] FS: 00006dcb380c1840(0000) GS:ffff8881e0600000(0000) knlGS:0000000000000000 [<...>] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [<...>] CR2: 000076ab72b30e84 CR3: 000000000b088004 CR4: 0000000000360ef0 shadow CR4: 0000000000360ef0 [<...>] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [<...>] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [<...>] ASID: 0003 [<...>] Stack: [<...>] ffffffff818a2315 00000000f5c856ee ffffffff896f1840 ffff888103ee2cb0 [<...>] ffff88812b6b9750 0000000079d714b6 fffffbfff1e9280b ffffffff8f49405f [<...>] 0000000000000001 0000000000000000 ffff888104457280 ffffffff8248b392 [<...>] Call Trace: [<...>] [<...>] [] ? lock_release+0x175/0x380 fffffe80416afaf0 [<...>] [] list_lru_del+0x152/0x740 fffffe80416afb48 [<...>] [] list_lru_del_obj+0x113/0x280 fffffe80416afb88 [<...>] [] ? _atomic_dec_and_lock+0x119/0x200 fffffe80416afb90 [<...>] [] iput_final+0x1c4/0x9a0 fffffe80416afbb8 [<...>] [] dentry_unlink_inode+0x44b/0xaa0 fffffe80416afbf8 [<...>] [] __dentry_kill+0x23c/0xf00 fffffe80416afc40 [<...>] [] ? __this_cpu_preempt_check+0x1f/0xa0 fffffe80416afc48 [<...>] [] ? shrink_dentry_list+0x1c5/0x760 fffffe80416afc70 [<...>] [] ? shrink_dentry_list+0x51/0x760 fffffe80416afc78 [<...>] [] shrink_dentry_list+0x288/0x760 fffffe80416afc80 [<...>] [] shrink_dcache_sb+0x155/0x420 fffffe80416afcc8 [<...>] [] ? debug_smp_processor_id+0x23/0xa0 fffffe80416afce0 [<...>] [] ? do_one_tree+0x140/0x140 fffffe80416afcf8 [<...>] [] ? do_remount+0x329/0xa00 fffffe80416afd18 [<...>] [] ? security_sb_remount+0x81/0x1c0 fffffe80416afd38 [<...>] [] reconfigure_super+0x856/0x14e0 fffffe80416afd70 [<...>] [] ? ns_capable_common+0xe7/0x2a0 fffffe80416afd90 [<...>] [] do_remount+0x416/0xa00 fffffe80416afdd0 [<...>] [] path_mount+0x5c4/0x900 fffffe80416afe28 [<...>] [] ? finish_automount+0x13a0/0x13a0 fffffe80416afe60 [<...>] [] ? user_path_at_empty+0xb2/0x140 fffffe80416afe88 [<...>] [] do_mount+0x115/0x1c0 fffffe80416afeb8 [<...>] [] ? path_mount+0x900/0x900 fffffe80416afed8 [<...>] [] ? __kasan_check_write+0x1c/0xa0 fffffe80416afee0 [<...>] [] __do_sys_mount+0x12f/0x280 fffffe80416aff30 [<...>] [] __x64_sys_mount+0xcd/0x2e0 fffffe80416aff70 [<...>] [] ? syscall_trace_enter+0x218/0x380 fffffe80416aff88 [<...>] [] x64_sys_call+0x5d5e/0x6720 fffffe80416affa8 [<...>] [] do_syscall_64+0xcd/0x3c0 fffffe80416affb8 [<...>] [] entry_SYSCALL_64_safe_stack+0x4c/0x87 fffffe80416affe8 [<...>] [<...>] [<...>] RIP: 0033:[<00006dcb382ff66a>] vm_area_struct[mount 2550 2550 file 6dcb38225000-6dcb3837e000 22 55(read|exec|mayread|mayexec)]+0x0/0xb8 [userland map] [<...>] Code: 48 8b 0d 29 18 0d 00 f7 d8 64 89 01 48 83 c8 ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 49 89 ca b8 a5 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 8b 0d f6 17 0d 00 f7 d8 64 89 01 48 [<...>] RSP: 002b:0000763d68192558 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5 [<...>] RAX: ffffffffffffffda RBX: 00006dcb38433264 RCX: 00006dcb382ff66a [<...>] RDX: 000017c3e0d11210 RSI: 000017c3e0d1a5a0 RDI: 000017c3e0d1ae70 [<...>] RBP: 000017c3e0d10fb0 R08: 000017c3e0d11260 R09: 00006dcb383d1be0 [<...>] R10: 000000000020002e R11: 0000000000000246 R12: 0000000000000000 [<...>] R13: 000017c3e0d1ae70 R14: 000017c3e0d11210 R15: 000017c3e0d10fb0 [<...>] RBX: vm_area_struct[mount 2550 2550 file 6dcb38433000-6dcb38434000 5b 100033(read|write|mayread|maywrite|account)]+0x0/0xb8 [userland map] [<...>] RCX: vm_area_struct[mount 2550 2550 file 6dcb38225000-6dcb3837e000 22 55(read|exec|mayread|mayexec)]+0x0/0xb8 [userland map] [<...>] RDX: vm_area_struct[mount 2550 2550 anon 17c3e0d0f000-17c3e0d31000 17c3e0d0f 100033(read|write|mayread|maywrite|account)]+0x0/0xb8 [userland map] [<...>] RSI: vm_area_struct[mount 2550 2550 anon 17c3e0d0f000-17c3e0d31000 17c3e0d0f 100033(read|write|mayread|maywrite|account)]+0x0/0xb8 [userland map] [<...>] RDI: vm_area_struct[mount 2550 2550 anon 17c3e0d0f000-17c3e0d31000 17c3e0d0f 100033(read|write|mayread|maywrite|account)]+0x0/0xb8 [userland map] [<...>] RBP: vm_area_struct[mount 2550 2550 anon 17c3e0d0f000-17c3e0d31000 17c3e0d0f 100033(read|write|mayread|maywrite|account)]+0x0/0xb8 [userland map] [<...>] RSP: vm_area_struct[mount 2550 2550 anon 763d68173000-763d68195000 7ffffffdd 100133(read|write|mayread|maywrite|growsdown|account)]+0x0/0xb8 [userland map] [<...>] R08: vm_area_struct[mount 2550 2550 anon 17c3e0d0f000-17c3e0d31000 17c3e0d0f 100033(read|write|mayread|maywrite|account)]+0x0/0xb8 [userland map] [<...>] R09: vm_area_struct[mount 2550 2550 file 6dcb383d1000-6dcb383d3000 1cd 100033(read|write|mayread|maywrite|account)]+0x0/0xb8 [userland map] [<...>] R13: vm_area_struct[mount 2550 2550 anon 17c3e0d0f000-17c3e0d31000 17c3e0d0f 100033(read|write|mayread|maywrite|account)]+0x0/0xb8 [userland map] [<...>] R14: vm_area_struct[mount 2550 2550 anon 17c3e0d0f000-17c3e0d31000 17c3e0d0f 100033(read|write|mayread|maywrite|account)]+0x0/0xb8 [userland map] [<...>] R15: vm_area_struct[mount 2550 2550 anon 17c3e0d0f000-17c3e0d31000 17c3e0d0f 100033(read|write|mayread|maywrite|account)]+0x0/0xb8 [userland map] [<...>] [<...>] Modules linked in: [<...>] ---[ end trace 0000000000000000 ]--- The list debug message as well as RBX's symbolic value point out that the object in question was allocated from 'tracefs_inode_cache' and that the list's '->next' member is at offset 0. Dumping the layout of the relevant parts of 'struct tracefs_inode' gives the following: struct tracefs_inode { union { struct inode { struct list_head { struct list_head * next; /* 0 8 */ struct list_head * prev; /* 8 8 */ } i_lru; [...] } vfs_inode; struct callback_head { void (*func)(struct callback_head *); /* 0 8 */ struct callback_head * next; /* 8 8 */ } rcu; }; [...] }; Above shows that 'vfs_inode.i_lru' overlaps with 'rcu' which will destroy the 'i_lru' list as soon as the 'rcu' member gets used, e.g. in call_rcu() or later when calling the RCU callback. This will disturb concurrent list traversals as well as object reuse which assumes these list heads will keep their integrity. For reproduction, the following diff manually overlays 'i_lru' with 'rcu' as, otherwise, one would require some good portion of luck for gambling an unlucky RANDSTRUCT seed: --- a/include/linux/fs.h +++ b/include/linux/fs.h @@ -629,6 +629,7 @@ struct inode { umode_t i_mode; unsigned short i_opflags; kuid_t i_uid; + struct list_head i_lru; /* inode LRU list */ kgid_t i_gid; unsigned int i_flags; @@ -690,7 +691,6 @@ struct inode { u16 i_wb_frn_avg_time; u16 i_wb_frn_history; #endif - struct list_head i_lru; /* inode LRU list */ struct list_head i_sb_list; struct list_head i_wb_list; /* backing dev writeback list */ union { The tracefs inode does not need to supply its own RCU delayed destruction of its inode. The inode code itself offers both a "destroy_inode()" callback that gets called when the last reference of the inode is released, and the "free_inode()" which is called after a RCU synchronization period from the "destroy_inode()". The tracefs code can unlink the inode from its list in the destroy_inode() callback, and the simply free it from the free_inode() callback. This should provide the same protection. Link: https://lore.kernel.org/all/20240807115143.45927-3-minipli@grsecurity.net/ Cc: stable@vger.kernel.org Cc: Masami Hiramatsu Cc: Mathieu Desnoyers Cc: Ajay Kaher Cc: Ilkka =?utf-8?b?TmF1bGFww6TDpA==?= Link: https://lore.kernel.org/20240807185402.61410544@gandalf.local.home Fixes: baa23a8d4360 ("tracefs: Reset permissions on remount if permissions are options") Reported-by: Mathias Krause Reported-by: Brad Spengler Suggested-by: Al Viro Signed-off-by: Steven Rostedt (Google) fs/tracefs/inode.c | 10 ++++------ fs/tracefs/internal.h | 5 +---- 2 files changed, 5 insertions(+), 10 deletions(-) commit 58f7e4d7ba32758b861807e77535853cacc1f426 Author: Jianhui Zhou <912460177@qq.com> Date: Mon Aug 5 19:36:31 2024 +0800 ring-buffer: Remove unused function ring_buffer_nr_pages() Because ring_buffer_nr_pages() is not an inline function and user accesses buffer->buffers[cpu]->nr_pages directly, the function ring_buffer_nr_pages is removed. Signed-off-by: Jianhui Zhou <912460177@qq.com> Link: https://lore.kernel.org/tencent_F4A7E9AB337F44E0F4B858D07D19EF460708@qq.com Signed-off-by: Steven Rostedt (Google) include/linux/ring_buffer.h | 1 - kernel/trace/ring_buffer.c | 12 ------------ 2 files changed, 13 deletions(-) commit bcf86c01ca4676316557dd482c8416ece8c2e143 Author: Tze-nan Wu Date: Mon Aug 5 13:59:22 2024 +0800 tracing: Fix overflow in get_free_elt() "tracing_map->next_elt" in get_free_elt() is at risk of overflowing. Once it overflows, new elements can still be inserted into the tracing_map even though the maximum number of elements (`max_elts`) has been reached. Continuing to insert elements after the overflow could result in the tracing_map containing "tracing_map->max_size" elements, leaving no empty entries. If any attempt is made to insert an element into a full tracing_map using `__tracing_map_insert()`, it will cause an infinite loop with preemption disabled, leading to a CPU hang problem. Fix this by preventing any further increments to "tracing_map->next_elt" once it reaches "tracing_map->max_elt". Cc: stable@vger.kernel.org Cc: Masami Hiramatsu Fixes: 08d43a5fa063e ("tracing: Add lock-free tracing_map") Co-developed-by: Cheng-Jui Wang Link: https://lore.kernel.org/20240805055922.6277-1-Tze-nan.Wu@mediatek.com Signed-off-by: Cheng-Jui Wang Signed-off-by: Tze-nan Wu Signed-off-by: Steven Rostedt (Google) kernel/trace/tracing_map.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) commit 604b72b32522d548f855ed82842d2e49bf384edb Author: Petr Pavlu Date: Sat Aug 3 15:09:26 2024 +0200 function_graph: Fix the ret_stack used by ftrace_graph_ret_addr() When ftrace_graph_ret_addr() is invoked to convert a found stack return address to its original value, the function can end up producing the following crash: [ 95.442712] BUG: kernel NULL pointer dereference, address: 0000000000000028 [ 95.442720] #PF: supervisor read access in kernel mode [ 95.442724] #PF: error_code(0x0000) - not-present page [ 95.442727] PGD 0 P4D 0- [ 95.442731] Oops: Oops: 0000 [#1] PREEMPT SMP PTI [ 95.442736] CPU: 1 UID: 0 PID: 2214 Comm: insmod Kdump: loaded Tainted: G OE K 6.11.0-rc1-default #1 67c62a3b3720562f7e7db5f11c1fdb40b7a2857c [ 95.442747] Tainted: [O]=OOT_MODULE, [E]=UNSIGNED_MODULE, [K]=LIVEPATCH [ 95.442750] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.16.2-3-gd478f380-rebuilt.opensuse.org 04/01/2014 [ 95.442754] RIP: 0010:ftrace_graph_ret_addr+0x42/0xc0 [ 95.442766] Code: [...] [ 95.442773] RSP: 0018:ffff979b80ff7718 EFLAGS: 00010006 [ 95.442776] RAX: ffffffff8ca99b10 RBX: ffff979b80ff7760 RCX: ffff979b80167dc0 [ 95.442780] RDX: ffffffff8ca99b10 RSI: ffff979b80ff7790 RDI: 0000000000000005 [ 95.442783] RBP: 0000000000000001 R08: 0000000000000005 R09: 0000000000000000 [ 95.442786] R10: 0000000000000005 R11: 0000000000000000 R12: ffffffff8e9491e0 [ 95.442790] R13: ffffffff8d6f70f0 R14: ffff979b80167da8 R15: ffff979b80167dc8 [ 95.442793] FS: 00007fbf83895740(0000) GS:ffff8a0afdd00000(0000) knlGS:0000000000000000 [ 95.442797] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 95.442800] CR2: 0000000000000028 CR3: 0000000005070002 CR4: 0000000000370ef0 [ 95.442806] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 95.442809] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 95.442816] Call Trace: [ 95.442823] [ 95.442896] unwind_next_frame+0x20d/0x830 [ 95.442905] arch_stack_walk_reliable+0x94/0xe0 [ 95.442917] stack_trace_save_tsk_reliable+0x7d/0xe0 [ 95.442922] klp_check_and_switch_task+0x55/0x1a0 [ 95.442931] task_call_func+0xd3/0xe0 [ 95.442938] klp_try_switch_task.part.5+0x37/0x150 [ 95.442942] klp_try_complete_transition+0x79/0x2d0 [ 95.442947] klp_enable_patch+0x4db/0x890 [ 95.442960] do_one_initcall+0x41/0x2e0 [ 95.442968] do_init_module+0x60/0x220 [ 95.442975] load_module+0x1ebf/0x1fb0 [ 95.443004] init_module_from_file+0x88/0xc0 [ 95.443010] idempotent_init_module+0x190/0x240 [ 95.443015] __x64_sys_finit_module+0x5b/0xc0 [ 95.443019] do_syscall_64+0x74/0x160 [ 95.443232] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 95.443236] RIP: 0033:0x7fbf82f2c709 [ 95.443241] Code: [...] [ 95.443247] RSP: 002b:00007fffd5ea3b88 EFLAGS: 00000246 ORIG_RAX: 0000000000000139 [ 95.443253] RAX: ffffffffffffffda RBX: 000056359c48e750 RCX: 00007fbf82f2c709 [ 95.443257] RDX: 0000000000000000 RSI: 000056356ed4efc5 RDI: 0000000000000003 [ 95.443260] RBP: 000056356ed4efc5 R08: 0000000000000000 R09: 00007fffd5ea3c10 [ 95.443263] R10: 0000000000000003 R11: 0000000000000246 R12: 0000000000000000 [ 95.443267] R13: 000056359c48e6f0 R14: 0000000000000000 R15: 0000000000000000 [ 95.443272] [ 95.443274] Modules linked in: [...] [ 95.443385] Unloaded tainted modules: intel_uncore_frequency(E):1 isst_if_common(E):1 skx_edac(E):1 [ 95.443414] CR2: 0000000000000028 The bug can be reproduced with kselftests: cd linux/tools/testing/selftests make TARGETS='ftrace livepatch' (cd ftrace; ./ftracetest test.d/ftrace/fgraph-filter.tc) (cd livepatch; ./test-livepatch.sh) The problem is that ftrace_graph_ret_addr() is supposed to operate on the ret_stack of a selected task but wrongly accesses the ret_stack of the current task. Specifically, the above NULL dereference occurs when task->curr_ret_stack is non-zero, but current->ret_stack is NULL. Correct ftrace_graph_ret_addr() to work with the right ret_stack. Cc: stable@vger.kernel.org Cc: Masami Hiramatsu Cc: Mark Rutland Cc: Mathieu Desnoyers Reported-by: Miroslav Benes Link: https://lore.kernel.org/20240803131211.17255-1-petr.pavlu@suse.com Fixes: 7aa1eaef9f42 ("function_graph: Allow multiple users to attach to function graph") Signed-off-by: Petr Pavlu Signed-off-by: Steven Rostedt (Google) kernel/trace/fgraph.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 8e556432477e97ad6179c61b61a32bf5f1af2355 Author: Mathias Krause Date: Tue Jul 23 23:07:53 2024 +0200 eventfs: Use SRCU for freeing eventfs_inodes To mirror the SRCU lock held in eventfs_iterate() when iterating over eventfs inodes, use call_srcu() to free them too. This was accidentally(?) degraded to RCU in commit 43aa6f97c2d0 ("eventfs: Get rid of dentry pointers without refcounts"). Cc: Ajay Kaher Cc: Masami Hiramatsu Cc: Mathieu Desnoyers Cc: Linus Torvalds Cc: stable@vger.kernel.org Link: https://lore.kernel.org/20240723210755.8970-1-minipli@grsecurity.net Fixes: 43aa6f97c2d0 ("eventfs: Get rid of dentry pointers without refcounts") Signed-off-by: Mathias Krause Signed-off-by: Steven Rostedt (Google) fs/tracefs/event_inode.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 12c20c65d0460cf34f9a665d8f0c0d77d45a3829 Author: Mathias Krause Date: Tue Jul 23 14:25:21 2024 +0200 eventfs: Don't return NULL in eventfs_create_dir() Commit 77a06c33a22d ("eventfs: Test for ei->is_freed when accessing ei->dentry") added another check, testing if the parent was freed after we released the mutex. If so, the function returns NULL. However, all callers expect it to either return a valid pointer or an error pointer, at least since commit 5264a2f4bb3b ("tracing: Fix a NULL vs IS_ERR() bug in event_subsystem_dir()"). Returning NULL will therefore fail the error condition check in the caller. Fix this by substituting the NULL return value with a fitting error pointer. Cc: Masami Hiramatsu Cc: Mathieu Desnoyers Cc: stable@vger.kernel.org Fixes: 77a06c33a22d ("eventfs: Test for ei->is_freed when accessing ei->dentry") Link: https://lore.kernel.org/20240723122522.2724-1-minipli@grsecurity.net Reviewed-by: Dan Carpenter Reviewed-by: Ajay Kaher Signed-off-by: Mathias Krause Signed-off-by: Steven Rostedt (Google) fs/tracefs/event_inode.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 0df2ac59bebfac221463ef57ed3554899b41d75f Author: Mathias Krause Date: Wed Aug 7 13:51:38 2024 +0200 tracefs: Fix inode allocation The leading comment above alloc_inode_sb() is pretty explicit about it: /* * This must be used for allocating filesystems specific inodes to set * up the inode reclaim context correctly. */ Switch tracefs over to alloc_inode_sb() to make sure inodes are properly linked. Cc: Ajay Kaher Cc: Masami Hiramatsu Cc: Mathieu Desnoyers Cc: Al Viro Cc: stable@vger.kernel.org Link: https://lore.kernel.org/20240807115143.45927-2-minipli@grsecurity.net Fixes: ba37ff75e04b ("eventfs: Implement tracefs_inode_cache") Signed-off-by: Mathias Krause Signed-off-by: Steven Rostedt (Google) fs/tracefs/inode.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 730bbfaf7d4890bd99e637db7767dc68cfeb24e7 Author: Stefan Wahren Date: Sun Aug 4 13:36:11 2024 +0200 spi: spi-fsl-lpspi: Fix scldiv calculation The effective SPI clock frequency should never exceed speed_hz otherwise this might result in undefined behavior of the SPI device. Currently the scldiv calculation could violate this constraint. For the example parameters perclk_rate = 24 MHz and speed_hz = 7 MHz, the function fsl_lpspi_set_bitrate will determine perscale = 0 and scldiv = 1, which is a effective SPI clock of 8 MHz. So fix this by rounding up the quotient of perclk_rate and speed_hz. While this never change within the loop, we can pull this out. Fixes: 5314987de5e5 ("spi: imx: add lpspi bus driver") Signed-off-by: Stefan Wahren Link: https://patch.msgid.link/20240804113611.83613-1-wahrenst@gmx.net Signed-off-by: Mark Brown drivers/spi/spi-fsl-lpspi.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) commit a9a7a2d80790d06cd32c535e2e7b10f72ce592e7 Author: Dmitry Baryshkov Date: Sat Aug 3 13:41:41 2024 +0300 ASoC: codecs: lpass-va-macro: warn on unknown version Warn the users if the driver doesn't know the codec version. This helps in debugging the issues with other codec not detecting the correct version. va_macro 3370000.codec: Unknown VA Codec version, ID: 00 / 0f / 00 Signed-off-by: Dmitry Baryshkov Link: https://patch.msgid.link/20240803-codec-version-v1-2-bc29baa5e417@linaro.org Signed-off-by: Mark Brown sound/soc/codecs/lpass-va-macro.c | 4 ++++ 1 file changed, 4 insertions(+) commit 49f6202ce991742f451fc724f03d0c17460d06cd Author: Dmitry Baryshkov Date: Sat Aug 3 13:41:40 2024 +0300 ASoC: codecs: lpass-macro: fix version strings returned for 1.x codecs Add missing cases to lpass_macro_get_codec_version_string() to let it print the correct codec version for 1.x codec platforms. Fixes: 378918d59181 ("ASoC: codecs: lpass-macro: add helpers to get codec version") Signed-off-by: Dmitry Baryshkov Link: https://patch.msgid.link/20240803-codec-version-v1-1-bc29baa5e417@linaro.org Signed-off-by: Mark Brown sound/soc/codecs/lpass-macro-common.h | 6 ++++++ 1 file changed, 6 insertions(+) commit 6ad9dafba19f15a64f71c2e1a9e3b6932f96628e Author: Arunpravin Paneer Selvam Date: Mon Aug 5 19:17:04 2024 +0530 drm/amdgpu: Add DCC GFX12 flag to enable address alignment We require this flag AMDGPU_GEM_CREATE_GFX12_DCC or any other kernel level GFX12 DCC flag to differentiate the DCC buffers and other pinned display buffers(which has TTM_PL_FLAG_CONTIGUOUS enabled). If we use the TTM_PL_FLAG_CONTIGUOUS flag for DCC buffers, we may over allocate for all the pinned display buffers unnecessarily that leads to memory allocation failure. Signed-off-by: Arunpravin Paneer Selvam Acked-by: Alex Deucher Signed-off-by: Alex Deucher (cherry picked from commit 46142cc1b9272d664e0258e105b537735bfeeccc) drivers/gpu/drm/amd/amdgpu/amdgpu_vram_mgr.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) commit 7fc5f252c0d21b7b89720386344b614733edab32 Author: Frank Min Date: Thu Aug 1 12:20:18 2024 +0800 drm/amdgpu: correct sdma7 max dw correct sdma7 max dw into 8 Signed-off-by: Frank Min Acked-by: Christian König Reviewed-by: Hawking Zhang Signed-off-by: Alex Deucher (cherry picked from commit 86598c3819fdc70e59d28221bfa7bc36e9f5777e) drivers/gpu/drm/amd/amdgpu/sdma_v7_0.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 4a5ad08f537703c35cf7cc29845381805c891d9b Author: Arunpravin Paneer Selvam Date: Sat Aug 3 21:30:18 2024 +0530 drm/amdgpu: Add address alignment support to DCC buffers Add address alignment support to the DCC VRAM buffers. v2: - adjust size based on the max_texture_channel_caches values only for GFX12 DCC buffers. - used AMDGPU_GEM_CREATE_GFX12_DCC flag to apply change only for DCC buffers. - roundup non power of two DCC buffer adjusted size to nearest power of two number as the buddy allocator does not support non power of two alignments. This applies only to the contiguous DCC buffers. v3:(Alex) - rewrite the max texture channel caches comparison code in an algorithmic way to determine the alignment size. v4:(Alex) - Move the logic from amdgpu_vram_mgr_dcc_alignment() to gmc_v12_0.c and add a new gmc func callback for dcc alignment. If the callback is non-NULL, call it to get the alignment, otherwise, use the default. v5:(Alex) - Set the Alignment to a default value if the callback doesn't exist. - Add the callback to amdgpu_gmc_funcs. v6: - Fix checkpatch warning reported by Intel CI. v7:(Christian) - remove the AMDGPU_GEM_CREATE_GFX12_DCC flag and keep a flag that checks the BO pinning and for a specific hw generation. v8:(Christian) - move this check into gmc_v12_0_get_dcc_alignment. v9: - Fix 32bit build errors Signed-off-by: Arunpravin Paneer Selvam Acked-by: Alex Deucher Acked-by: Christian König Reviewed-by: Frank Min Signed-off-by: Alex Deucher (cherry picked from commit aa94b623cb9233b91ed342dd87ecd62e56ff4938) drivers/gpu/drm/amd/amdgpu/amdgpu_gmc.h | 6 +++++ drivers/gpu/drm/amd/amdgpu/amdgpu_vram_mgr.c | 35 ++++++++++++++++++++++++++-- drivers/gpu/drm/amd/amdgpu/gmc_v12_0.c | 18 ++++++++++++++ 3 files changed, 57 insertions(+), 2 deletions(-) commit 50e376f1fe3bf571d0645ddf48ad37eb58323919 Author: Fangzhi Zuo Date: Fri Jul 12 16:30:03 2024 -0400 drm/amd/display: Skip Recompute DSC Params if no Stream on Link [why] Encounter NULL pointer dereference uner mst + dsc setup. BUG: kernel NULL pointer dereference, address: 0000000000000008 PGD 0 P4D 0 Oops: 0000 [#1] PREEMPT SMP NOPTI CPU: 4 PID: 917 Comm: sway Not tainted 6.3.9-arch1-1 #1 124dc55df4f5272ccb409f39ef4872fc2b3376a2 Hardware name: LENOVO 20NKS01Y00/20NKS01Y00, BIOS R12ET61W(1.31 ) 07/28/2022 RIP: 0010:drm_dp_atomic_find_time_slots+0x5e/0x260 [drm_display_helper] Code: 01 00 00 48 8b 85 60 05 00 00 48 63 80 88 00 00 00 3b 43 28 0f 8d 2e 01 00 00 48 8b 53 30 48 8d 04 80 48 8d 04 c2 48 8b 40 18 <48> 8> RSP: 0018:ffff960cc2df77d8 EFLAGS: 00010293 RAX: 0000000000000000 RBX: ffff8afb87e81280 RCX: 0000000000000224 RDX: ffff8afb9ee37c00 RSI: ffff8afb8da1a578 RDI: ffff8afb87e81280 RBP: ffff8afb83d67000 R08: 0000000000000001 R09: ffff8afb9652f850 R10: ffff960cc2df7908 R11: 0000000000000002 R12: 0000000000000000 R13: ffff8afb8d7688a0 R14: ffff8afb8da1a578 R15: 0000000000000224 FS: 00007f4dac35ce00(0000) GS:ffff8afe30b00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000000000000008 CR3: 000000010ddc6000 CR4: 00000000003506e0 Call Trace: ? __die+0x23/0x70 ? page_fault_oops+0x171/0x4e0 ? plist_add+0xbe/0x100 ? exc_page_fault+0x7c/0x180 ? asm_exc_page_fault+0x26/0x30 ? drm_dp_atomic_find_time_slots+0x5e/0x260 [drm_display_helper 0e67723696438d8e02b741593dd50d80b44c2026] ? drm_dp_atomic_find_time_slots+0x28/0x260 [drm_display_helper 0e67723696438d8e02b741593dd50d80b44c2026] compute_mst_dsc_configs_for_link+0x2ff/0xa40 [amdgpu 62e600d2a75e9158e1cd0a243bdc8e6da040c054] ? fill_plane_buffer_attributes+0x419/0x510 [amdgpu 62e600d2a75e9158e1cd0a243bdc8e6da040c054] compute_mst_dsc_configs_for_state+0x1e1/0x250 [amdgpu 62e600d2a75e9158e1cd0a243bdc8e6da040c054] amdgpu_dm_atomic_check+0xecd/0x1190 [amdgpu 62e600d2a75e9158e1cd0a243bdc8e6da040c054] drm_atomic_check_only+0x5c5/0xa40 drm_mode_atomic_ioctl+0x76e/0xbc0 [how] dsc recompute should be skipped if no mode change detected on the new request. If detected, keep checking whether the stream is already on current state or not. Cc: Mario Limonciello Cc: Alex Deucher Cc: stable@vger.kernel.org Reviewed-by: Rodrigo Siqueira Signed-off-by: Fangzhi Zuo Signed-off-by: Wayne Lin Tested-by: Daniel Wheeler Signed-off-by: Alex Deucher (cherry picked from commit 8151a6c13111b465dbabe07c19f572f7cbd16fef) drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_mst_types.c | 3 +++ 1 file changed, 3 insertions(+) commit 5d687a67fda6389b9214815aa0d0adcc44302dc5 Author: Frank Min Date: Fri Aug 2 11:15:11 2024 +0800 drm/amdgpu: change non-dcc buffer copy configuration Without setting cpv bit and 7th ib dw, non-dcc buffer copy will have random corruption So set the cpv bit and clear the 7th ib dw for copy non-dcc buffers Signed-off-by: Frank Min Acked-by: Christian König Reviewed-by: Hawking Zhang Signed-off-by: Alex Deucher (cherry picked from commit 5aacf8917fde5bc2a640f3cd49130c0e2e85e726) drivers/gpu/drm/amd/amdgpu/sdma_v7_0.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) commit 829798c789f567ef6ba4b084c15b7b5f3bd98d51 Author: Joshua Ashton Date: Thu Mar 7 19:04:31 2024 +0000 drm/amdgpu: Forward soft recovery errors to userspace As we discussed before[1], soft recovery should be forwarded to userspace, or we can get into a really bad state where apps will keep submitting hanging command buffers cascading us to a hard reset. 1: https://lore.kernel.org/all/bf23d5ed-9a6b-43e7-84ee-8cbfd0d60f18@froggi.es/ Signed-off-by: Joshua Ashton Reviewed-by: Marek Olšák Signed-off-by: Christian König Signed-off-by: Alex Deucher (cherry picked from commit 434967aadbbbe3ad9103cc29e9a327de20fdba01) Cc: stable@vger.kernel.org drivers/gpu/drm/amd/amdgpu/amdgpu_job.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) commit 8ff3bb44cc94b74ebd57fe3be9dedb98dbf92771 Author: Likun Gao Date: Thu Aug 1 10:47:16 2024 +0800 drm/amdgpu: add golden setting for gc v12 Adding Manual GDB golden setting for gc v12 revision 0 ASIC. Signed-off-by: Likun Gao Reviewed-by: Hawking Zhang Signed-off-by: Alex Deucher (cherry picked from commit c9875d0a789060facc274dee0d4eb6500d471772) drivers/gpu/drm/amd/amdgpu/gfx_v12_0.c | 27 +++++++++++++++++++++++++++ 1 file changed, 27 insertions(+) commit d507ae0dc83b7f43cdf6760b8f1a30aac4fc405a Author: Arunpravin Paneer Selvam Date: Fri Aug 2 11:13:19 2024 +0530 drm/buddy: Add start address support to trim function - Add a new start parameter in trim function to specify exact address from where to start the trimming. This would help us in situations like if drivers would like to do address alignment for specific requirements. - Add a new flag DRM_BUDDY_TRIM_DISABLE. Drivers can use this flag to disable the allocator trimming part. This patch enables the drivers control trimming and they can do it themselves based on the application requirements. v1:(Matthew) - check new_start alignment with min chunk_size - use range_overflows() Signed-off-by: Arunpravin Paneer Selvam Acked-by: Alex Deucher Acked-by: Christian König Signed-off-by: Alex Deucher (cherry picked from commit db65eb46de135338d6177f8853e0fd208f19d63e) drivers/gpu/drm/drm_buddy.c | 25 +++++++++++++++++++++++-- drivers/gpu/drm/xe/xe_ttm_vram_mgr.c | 2 +- include/drm/drm_buddy.h | 2 ++ 3 files changed, 26 insertions(+), 3 deletions(-) commit e8097cf1ce9e7ad8516ee95f06f7baaa31506035 Author: Rodrigo Siqueira Date: Thu Jul 25 16:41:38 2024 -0600 drm/amd/display: Add missing program DET segment call to pipe init Add a callback that program the DET segment when initializing pipes. Acked-by: Tom Chung Signed-off-by: Rodrigo Siqueira Signed-off-by: Wayne Lin Tested-by: Daniel Wheeler Signed-off-by: Alex Deucher (cherry picked from commit e1dbe625d6ac2821eb29e087db46cb539d8079f0) drivers/gpu/drm/amd/display/dc/hwss/dcn10/dcn10_hwseq.c | 2 ++ 1 file changed, 2 insertions(+) commit 07cd40a0c9843653451f9355170770f6e42489c8 Author: Rodrigo Siqueira Date: Wed Jul 24 09:29:13 2024 -0600 drm/amd/display: Add missing DCN314 to the DML Makefile Include display_mode_vba_314 and display_rq_dlg_calc_314 to the dml Makefile. Acked-by: Tom Chung Signed-off-by: Rodrigo Siqueira Signed-off-by: Wayne Lin Tested-by: Daniel Wheeler Signed-off-by: Alex Deucher (cherry picked from commit 089525632d40bbfa507f224c20563529b3f8a4b3) drivers/gpu/drm/amd/display/dc/dml/Makefile | 2 ++ 1 file changed, 2 insertions(+) commit aa5c9701ebd654284c55eba30d0a38eec49f2946 Author: Likun Gao Date: Wed Jul 31 11:58:46 2024 +0800 drm/amdgpu: force to use legacy inv in mmhub MMHUB v4.1.0 only support fixed cache mode, so only use legacy invalidation accordingly. Signed-off-by: Likun Gao Reviewed-by: Frank Min Signed-off-by: Alex Deucher (cherry picked from commit 9192c7613ca53572908ba23a4c3f39c7f8ba8021) drivers/gpu/drm/amd/amdgpu/mmhub_v4_1_0.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) commit 5f142b3826a0d223e947501fa9fe4ca912d9db26 Author: Kenneth Feng Date: Mon Jul 29 09:24:20 2024 +0800 drm/amd/pm: update powerplay structure on smu v14.0.2/3 update powerplay structure on smu v14.0.2/3 Signed-off-by: Kenneth Feng Reviewed-by: Yang Wang Signed-off-by: Alex Deucher (cherry picked from commit f905d0c328b440fabaaf265350bf4187ccd5f59b) .../gpu/drm/amd/pm/swsmu/inc/smu_v14_0_2_pptable.h | 52 +++++++++++++++++++--- 1 file changed, 46 insertions(+), 6 deletions(-) commit eb880ffddd5da8a014669deaf7bb3e7e9ecd06f4 Author: Rodrigo Siqueira Date: Mon Jul 22 20:33:40 2024 -0600 drm/amd/display: Add missing mcache registers Add missing register programming for mcache in DCN401. Reviewed-by: Aurabindo Pillai Tested-by: Daniel Wheeler Signed-off-by: Rodrigo Siqueira Signed-off-by: Alex Deucher (cherry picked from commit a00a177055cced5cd2bb057a1ace9a95a286bc49) drivers/gpu/drm/amd/display/dc/resource/dcn401/dcn401_resource.h | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) commit 437cf8bb0e1a56fa0491610706ddafd04b3b1a9b Author: Rodrigo Siqueira Date: Mon Jul 22 20:40:22 2024 -0600 drm/amd/display: Add dcc propagation value Initialize the field dcc_meta_propagation_delay_us with 10 ms. Reviewed-by: Aurabindo Pillai Tested-by: Daniel Wheeler Signed-off-by: Rodrigo Siqueira Signed-off-by: Alex Deucher (cherry picked from commit 74bad61c5d83f5af8a855c8b7dc8e20377c74d46) drivers/gpu/drm/amd/display/dc/resource/dcn401/dcn401_resource.c | 1 + 1 file changed, 1 insertion(+) commit 4df19b14f6311c860223f349356da2c08ae92101 Author: Rodrigo Siqueira Date: Mon Jul 22 16:53:42 2024 -0600 drm/amd/display: Add missing DET segments programming The commit 5034b935f62a ("drm/amd/display: Modify DHCUB waterwark structures and functions") introduced a code refactor for DCHUB, but during the merge process into amd-staging-drm-next, the program det segments were removed. This commit adds the DET segment programming for DCN35. Fixes: 5034b935f62a ("drm/amd/display: Modify DHCUB waterwark structures and functions") Reviewed-by: Aurabindo Pillai Tested-by: Daniel Wheeler Signed-off-by: Rodrigo Siqueira Signed-off-by: Alex Deucher (cherry picked from commit 675d9ac9d0de765531e94f9fdc536989a997a324) drivers/gpu/drm/amd/display/dc/hwss/dcn35/dcn35_hwseq.c | 2 ++ 1 file changed, 2 insertions(+) commit f2aaed194a54d78c307c44d1829c7e1ba67e9ba5 Author: Rodrigo Siqueira Date: Mon Dec 4 16:35:04 2023 -0500 drm/amd/display: Replace dm_execute_dmub_cmd with dc_wake_and_execute_dmub_cmd In the commit c2cec7a872b6 ("drm/amd/display: Wake DMCUB before sending a command for replay feature"), replaced dm_execute_dmub_cmd with dc_wake_and_execute_dmub_cmd in multiple areas, but due to merge issues the replacement of this function in the dmub_replay_copy_settings was missed. This commit replaces the old dm_execute_dmub_cmd with dc_wake_and_execute_dmub_cmd. Fixes: 3601a35a2e9d ("drm/amd/display: Wake DMCUB before sending a command for replay feature") Reviewed-by: Aurabindo Pillai Tested-by: Daniel Wheeler Signed-off-by: Rodrigo Siqueira Signed-off-by: Alex Deucher (cherry picked from commit 6cc213b9aa34bc3213e20f9256345c5cc1495b0b) drivers/gpu/drm/amd/display/dc/dce/dmub_replay.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) commit 6e2fdceffdc6bd7b8ba314a1d1b976721533c8f9 Author: Steven Rostedt Date: Fri Jul 26 14:42:08 2024 -0400 tracing: Use refcount for trace_event_file reference counter Instead of using an atomic counter for the trace_event_file reference counter, use the refcount interface. It has various checks to make sure the reference counting is correct, and will warn if it detects an error (like refcount_inc() on '0'). Cc: Mathieu Desnoyers Link: https://lore.kernel.org/20240726144208.687cce24@rorschach.local.home Acked-by: Masami Hiramatsu (Google) Signed-off-by: Steven Rostedt (Google) include/linux/trace_events.h | 2 +- kernel/trace/trace_events.c | 8 ++++---- 2 files changed, 5 insertions(+), 5 deletions(-) commit b1560408692cd0ab0370cfbe9deb03ce97ab3f6d Author: Steven Rostedt Date: Tue Jul 30 11:06:57 2024 -0400 tracing: Have format file honor EVENT_FILE_FL_FREED When eventfs was introduced, special care had to be done to coordinate the freeing of the file meta data with the files that are exposed to user space. The file meta data would have a ref count that is set when the file is created and would be decremented and freed after the last user that opened the file closed it. When the file meta data was to be freed, it would set a flag (EVENT_FILE_FL_FREED) to denote that the file is freed, and any new references made (like new opens or reads) would fail as it is marked freed. This allowed other meta data to be freed after this flag was set (under the event_mutex). All the files that were dynamically created in the events directory had a pointer to the file meta data and would call event_release() when the last reference to the user space file was closed. This would be the time that it is safe to free the file meta data. A shortcut was made for the "format" file. It's i_private would point to the "call" entry directly and not point to the file's meta data. This is because all format files are the same for the same "call", so it was thought there was no reason to differentiate them. The other files maintain state (like the "enable", "trigger", etc). But this meant if the file were to disappear, the "format" file would be unaware of it. This caused a race that could be trigger via the user_events test (that would create dynamic events and free them), and running a loop that would read the user_events format files: In one console run: # cd tools/testing/selftests/user_events # while true; do ./ftrace_test; done And in another console run: # cd /sys/kernel/tracing/ # while true; do cat events/user_events/__test_event/format; done 2>/dev/null With KASAN memory checking, it would trigger a use-after-free bug report (which was a real bug). This was because the format file was not checking the file's meta data flag "EVENT_FILE_FL_FREED", so it would access the event that the file meta data pointed to after the event was freed. After inspection, there are other locations that were found to not check the EVENT_FILE_FL_FREED flag when accessing the trace_event_file. Add a new helper function: event_file_file() that will make sure that the event_mutex is held, and will return NULL if the trace_event_file has the EVENT_FILE_FL_FREED flag set. Have the first reference of the struct file pointer use event_file_file() and check for NULL. Later uses can still use the event_file_data() helper function if the event_mutex is still held and was not released since the event_file_file() call. Link: https://lore.kernel.org/all/20240719204701.1605950-1-minipli@grsecurity.net/ Cc: stable@vger.kernel.org Cc: Masami Hiramatsu Cc: Mathieu Desnoyers Cc: Ajay Kaher Cc: Ilkka Naulapää Cc: Linus Torvalds Cc: Al Viro Cc: Dan Carpenter Cc: Beau Belgrave Cc: Florian Fainelli Cc: Alexey Makhalov Cc: Vasavi Sirnapalli Link: https://lore.kernel.org/20240730110657.3b69d3c1@gandalf.local.home Fixes: b63db58e2fa5d ("eventfs/tracing: Add callback for release of an eventfs_inode") Reported-by: Mathias Krause Tested-by: Mathias Krause Signed-off-by: Steven Rostedt (Google) kernel/trace/trace.h | 23 +++++++++++++++++++++++ kernel/trace/trace_events.c | 33 ++++++++++++++++++++------------- kernel/trace/trace_events_hist.c | 4 ++-- kernel/trace/trace_events_inject.c | 2 +- kernel/trace/trace_events_trigger.c | 6 +++--- 5 files changed, 49 insertions(+), 19 deletions(-) commit 8fe8ac24adcd76b12edbfdefa078567bfff117d4 Author: Jens Axboe Date: Wed Aug 7 15:09:33 2024 -0600 io_uring/net: don't pick multiple buffers for non-bundle send If a send is issued marked with IOSQE_BUFFER_SELECT for selecting a buffer, unless it's a bundle, it should not select multiple buffers. Cc: stable@vger.kernel.org Fixes: a05d1f625c7a ("io_uring/net: support bundles for send") Signed-off-by: Jens Axboe io_uring/net.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) commit 70ed519ed59da3a92c3acedeb84a30e5a66051ce Author: Jens Axboe Date: Wed Aug 7 15:08:17 2024 -0600 io_uring/net: ensure expanded bundle send gets marked for cleanup If the iovec inside the kmsg isn't already allocated AND one gets expanded beyond the fixed size, then the request may not already have been marked for cleanup. Ensure that it is. Cc: stable@vger.kernel.org Fixes: a05d1f625c7a ("io_uring/net: support bundles for send") Signed-off-by: Jens Axboe io_uring/net.c | 1 + 1 file changed, 1 insertion(+) commit 11893e144ed75be55d99349760513ca104781fc0 Author: Jens Axboe Date: Wed Aug 7 15:06:45 2024 -0600 io_uring/net: ensure expanded bundle recv gets marked for cleanup If the iovec inside the kmsg isn't already allocated AND one gets expanded beyond the fixed size, then the request may not already have been marked for cleanup. Ensure that it is. Cc: stable@vger.kernel.org Fixes: 2f9c9515bdfd ("io_uring/net: support bundles for recv") Signed-off-by: Jens Axboe io_uring/net.c | 1 + 1 file changed, 1 insertion(+) commit b5431dc2803ac159d6d4645ae237d15c3cb252db Author: Anton Khirnov Date: Mon Jul 29 21:58:10 2024 +0200 Bluetooth: hci_sync: avoid dup filtering when passive scanning with adv monitor This restores behaviour (including the comment) from now-removed hci_request.c, and also matches existing code for active scanning. Without this, the duplicates filter is always active when passive scanning, which makes it impossible to work with devices that send nontrivial dynamic data in their advertisement reports. Fixes: abfeea476c68 ("Bluetooth: hci_sync: Convert MGMT_OP_START_DISCOVERY") Signed-off-by: Anton Khirnov Signed-off-by: Luiz Augusto von Dentz net/bluetooth/hci_sync.c | 14 ++++++++++++++ 1 file changed, 14 insertions(+) commit c531e63871c0b50c8c4e62c048535a08886fba3e Author: Dmitry Antipov Date: Wed Jul 31 12:19:36 2024 +0300 Bluetooth: l2cap: always unlock channel in l2cap_conless_channel() Add missing call to 'l2cap_chan_unlock()' on receive error handling path in 'l2cap_conless_channel()'. Fixes: a24cce144b98 ("Bluetooth: Fix reference counting of global L2CAP channels") Reported-by: syzbot+45ac74737e866894acb0@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=45ac74737e866894acb0 Signed-off-by: Dmitry Antipov Signed-off-by: Luiz Augusto von Dentz net/bluetooth/l2cap_core.c | 1 + 1 file changed, 1 insertion(+) commit e1d28be268cfe978e19a18a3a9b37a4a7d37745e Author: Bartosz Golaszewski Date: Wed Jul 31 17:20:50 2024 +0200 Bluetooth: hci_qca: fix a NULL-pointer derefence at shutdown Unlike qca_regulator_init(), qca_power_shutdown() may be called for QCA_ROME which does not have qcadev->bt_power assigned. Add a NULL-pointer check before dereferencing the struct qca_power pointer. Fixes: eba1718717b0 ("Bluetooth: hci_qca: make pwrseq calls the default if available") Reported-by: Dmitry Baryshkov Closes: https://lore.kernel.org/linux-bluetooth/su3wp6s44hrxf4ijvsdfzbvv4unu4ycb7kkvwbx6ltdafkldir@4g7ydqm2ap5j/ Signed-off-by: Bartosz Golaszewski Signed-off-by: Luiz Augusto von Dentz drivers/bluetooth/hci_qca.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit f3660957303b822e5dd6e10fe9e1e19afc6d33de Author: Bartosz Golaszewski Date: Wed Jul 31 17:20:49 2024 +0200 Bluetooth: hci_qca: fix QCA6390 support on non-DT platforms QCA6390 can albo be used on non-DT systems so we must not make the power sequencing the only option. Check if the serdev device consumes an OF node. If so: honor the new contract as per the DT bindings. If not: fall back to the previous behavior by falling through to the existing default label. Fixes: 9a15ce685706 ("Bluetooth: qca: use the power sequencer for QCA6390") Reported-by: Wren Turkal Closes: https://lore.kernel.org/linux-bluetooth/27e6a6c5-fb63-4219-be0b-eefa2c116e06@penguintechs.org/ Signed-off-by: Bartosz Golaszewski Reviewed-by: Paul Menzel Signed-off-by: Luiz Augusto von Dentz drivers/bluetooth/hci_qca.c | 13 ++++++++----- 1 file changed, 8 insertions(+), 5 deletions(-) commit 541b80216cd1d511841c3c8d9559a7b13f4f79f2 Author: Bartosz Golaszewski Date: Wed Jul 31 17:20:48 2024 +0200 Bluetooth: hci_qca: don't call pwrseq_power_off() twice for QCA6390 Now that we call pwrseq_power_off() for all models that hold a valid power sequencing handle, we can remove the switch case for QCA_6390. The switch will now use the default label for this model but that's fine: if it has the BT-enable GPIO than we should use it. Fixes: eba1718717b0 ("Bluetooth: hci_qca: make pwrseq calls the default if available") Signed-off-by: Bartosz Golaszewski Signed-off-by: Luiz Augusto von Dentz drivers/bluetooth/hci_qca.c | 4 ---- 1 file changed, 4 deletions(-) commit 6c3fc0b1c3d073bd6fc3bf43dbd0e64240537464 Author: Faizal Rahim Date: Sun Jul 7 08:53:18 2024 -0400 igc: Fix qbv tx latency by setting gtxoffset A large tx latency issue was discovered during testing when only QBV was enabled. The issue occurs because gtxoffset was not set when QBV is active, it was only set when launch time is active. The patch "igc: Correct the launchtime offset" only sets gtxoffset when the launchtime_enable field is set by the user. Enabling launchtime_enable ultimately sets the register IGC_TXQCTL_QUEUE_MODE_LAUNCHT (referred to as LaunchT in the SW user manual). Section 7.5.2.6 of the IGC i225/6 SW User Manual Rev 1.2.4 states: "The latency between transmission scheduling (launch time) and the time the packet is transmitted to the network is listed in Table 7-61." However, the patch misinterprets the phrase "launch time" in that section by assuming it specifically refers to the LaunchT register, whereas it actually denotes the generic term for when a packet is released from the internal buffer to the MAC transmit logic. This launch time, as per that section, also implicitly refers to the QBV gate open time, where a packet waits in the buffer for the QBV gate to open. Therefore, latency applies whenever QBV is in use. TSN features such as QBU and QAV reuse QBV, making the latency universal to TSN features. Discussed with i226 HW owner (Shalev, Avi) and we were in agreement that the term "launch time" used in Section 7.5.2.6 is not clear and can be easily misinterpreted. Avi will update this section to: "When TQAVCTRL.TRANSMIT_MODE = TSN, the latency between transmission scheduling and the time the packet is transmitted to the network is listed in Table 7-61." Fix this issue by using igc_tsn_is_tx_mode_in_tsn() as a condition to write to gtxoffset, aligning with the newly updated SW User Manual. Tested: 1. Enrol taprio on talker board base-time 0 cycle-time 1000000 flags 0x2 index 0 cmd S gatemask 0x1 interval1 index 0 cmd S gatemask 0x1 interval2 Note: interval1 = interval for a 64 bytes packet to go through interval2 = cycle-time - interval1 2. Take tcpdump on listener board 3. Use udp tai app on talker to send packets to listener 4. Check the timestamp on listener via wireshark Test Result: 100 Mbps: 113 ~193 ns 1000 Mbps: 52 ~ 84 ns 2500 Mbps: 95 ~ 223 ns Note that the test result is similar to the patch "igc: Correct the launchtime offset". Fixes: 790835fcc0cb ("igc: Correct the launchtime offset") Signed-off-by: Faizal Rahim Reviewed-by: Simon Horman Acked-by: Vinicius Costa Gomes Tested-by: Mor Bar-Gabay Signed-off-by: Tony Nguyen drivers/net/ethernet/intel/igc/igc_tsn.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 0afeaeb5dae86aceded0d5f0c3a54d27858c0c6f Author: Faizal Rahim Date: Sun Jul 7 08:53:17 2024 -0400 igc: Fix reset adapter logics when tx mode change Following the "igc: Fix TX Hang issue when QBV Gate is close" changes, remaining issues with the reset adapter logic in igc_tsn_offload_apply() have been observed: 1. The reset adapter logics for i225 and i226 differ, although they should be the same according to the guidelines in I225/6 HW Design Section 7.5.2.1 on software initialization during tx mode changes. 2. The i225 resets adapter every time, even though tx mode doesn't change. This occurs solely based on the condition igc_is_device_id_i225() when calling schedule_work(). 3. i226 doesn't reset adapter for tsn->legacy tx mode changes. It only resets adapter for legacy->tsn tx mode transitions. 4. qbv_count introduced in the patch is actually not needed; in this context, a non-zero value of qbv_count is used to indicate if tx mode was unconditionally set to tsn in igc_tsn_enable_offload(). This could be replaced by checking the existing register IGC_TQAVCTRL_TRANSMIT_MODE_TSN bit. This patch resolves all issues and enters schedule_work() to reset the adapter only when changing tx mode. It also removes reliance on qbv_count. qbv_count field will be removed in a future patch. Test ran: 1. Verify reset adapter behaviour in i225/6: a) Enrol a new GCL Reset adapter observed (tx mode change legacy->tsn) b) Enrol a new GCL without deleting qdisc No reset adapter observed (tx mode remain tsn->tsn) c) Delete qdisc Reset adapter observed (tx mode change tsn->legacy) 2. Tested scenario from "igc: Fix TX Hang issue when QBV Gate is closed" to confirm it remains resolved. Fixes: 175c241288c0 ("igc: Fix TX Hang issue when QBV Gate is closed") Signed-off-by: Faizal Rahim Reviewed-by: Simon Horman Acked-by: Vinicius Costa Gomes Tested-by: Mor Bar-Gabay Signed-off-by: Tony Nguyen drivers/net/ethernet/intel/igc/igc_tsn.c | 24 +++++++++++++++++++----- 1 file changed, 19 insertions(+), 5 deletions(-) commit f8d6acaee9d35cbff3c3cfad94641666c596f8da Author: Faizal Rahim Date: Sun Jul 7 08:53:16 2024 -0400 igc: Fix qbv_config_change_errors logics When user issues these cmds: 1. Either a) or b) a) mqprio with hardware offload disabled b) taprio with txtime-assist feature enabled 2. etf 3. tc qdisc delete 4. taprio with base time in the past At step 4, qbv_config_change_errors wrongly increased by 1. Excerpt from IEEE 802.1Q-2018 8.6.9.3.1: "If AdminBaseTime specifies a time in the past, and the current schedule is running, then: Increment ConfigChangeError counter" qbv_config_change_errors should only increase if base time is in the past and no taprio is active. In user perspective, taprio was not active when first triggered at step 4. However, i225/6 reuses qbv for etf, so qbv is enabled with a dummy schedule at step 2 where it enters igc_tsn_enable_offload() and qbv_count got incremented to 1. At step 4, it enters igc_tsn_enable_offload() again, qbv_count is incremented to 2. Because taprio is running, tc_setup_type is TC_SETUP_QDISC_ETF and qbv_count > 1, qbv_config_change_errors value got incremented. This issue happens due to reliance on qbv_count field where a non-zero value indicates that taprio is running. But qbv_count increases regardless if taprio is triggered by user or by other tsn feature. It does not align with qbv_config_change_errors expectation where it is only concerned with taprio triggered by user. Fixing this by relocating the qbv_config_change_errors logic to igc_save_qbv_schedule(), eliminating reliance on qbv_count and its inaccuracies from i225/6's multiple uses of qbv feature for other TSN features. The new function created: igc_tsn_is_taprio_activated_by_user() uses taprio_offload_enable field to indicate that the current running taprio was triggered by user, instead of triggered by non-qbv feature like etf. Fixes: ae4fe4698300 ("igc: Add qbv_config_change_errors counter") Signed-off-by: Faizal Rahim Reviewed-by: Simon Horman Acked-by: Vinicius Costa Gomes Tested-by: Mor Bar-Gabay Signed-off-by: Tony Nguyen drivers/net/ethernet/intel/igc/igc_main.c | 8 ++++++-- drivers/net/ethernet/intel/igc/igc_tsn.c | 16 ++++++++-------- drivers/net/ethernet/intel/igc/igc_tsn.h | 1 + 3 files changed, 15 insertions(+), 10 deletions(-) commit e037a26ead187901f83cad9c503ccece5ff6817a Author: Faizal Rahim Date: Sat Jul 6 11:38:07 2024 -0400 igc: Fix packet still tx after gate close by reducing i226 MAC retry buffer Testing uncovered that even when the taprio gate is closed, some packets still transmit. According to i225/6 hardware errata [1], traffic might overflow the planned QBV window. This happens because MAC maintains an internal buffer, primarily for supporting half duplex retries. Therefore, even when the gate closes, residual MAC data in the buffer may still transmit. To mitigate this for i226, reduce the MAC's internal buffer from 192 bytes to the recommended 88 bytes by modifying the RETX_CTL register value. This follows guidelines from: [1] Ethernet Controller I225/I22 Spec Update Rev 2.1 Errata Item 9: TSN: Packet Transmission Might Cross Qbv Window [2] I225/6 SW User Manual Rev 1.2.4: Section 8.11.5 Retry Buffer Control Note that the RETX_CTL register can't be used in TSN mode because half duplex feature cannot coexist with TSN. Test Steps: 1. Send taprio cmd to board A: tc qdisc replace dev enp1s0 parent root handle 100 taprio \ num_tc 4 \ map 3 2 1 0 3 3 3 3 3 3 3 3 3 3 3 3 \ queues 1@0 1@1 1@2 1@3 \ base-time 0 \ sched-entry S 0x07 500000 \ sched-entry S 0x0f 500000 \ flags 0x2 \ txtime-delay 0 Note that for TC3, gate should open for 500us and close for another 500us. 3. Take tcpdump log on Board B. 4. Send udp packets via UDP tai app from Board A to Board B. 5. Analyze tcpdump log via wireshark log on Board B. Ensure that the total time from the first to the last packet received during one cycle for TC3 does not exceed 500us. Fixes: 43546211738e ("igc: Add new device ID's") Signed-off-by: Faizal Rahim Acked-by: Vinicius Costa Gomes Tested-by: Mor Bar-Gabay Signed-off-by: Tony Nguyen drivers/net/ethernet/intel/igc/igc_defines.h | 6 +++++ drivers/net/ethernet/intel/igc/igc_tsn.c | 34 ++++++++++++++++++++++++++++ 2 files changed, 40 insertions(+) commit 6dd1e4c045afa6a4ba5d46f044c83bd357c593c2 Author: Zhen Lei Date: Wed Aug 7 17:00:56 2024 +0800 selinux: add the processing of the failure of avc_add_xperms_decision() When avc_add_xperms_decision() fails, the information recorded by the new avc node is incomplete. In this case, the new avc node should be released instead of replacing the old avc node. Cc: stable@vger.kernel.org Fixes: fa1aa143ac4a ("selinux: extended permissions for ioctls") Suggested-by: Stephen Smalley Signed-off-by: Zhen Lei Acked-by: Stephen Smalley Signed-off-by: Paul Moore security/selinux/avc.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) commit ad518452fd263766946346324810f14bd8bb8b34 Author: Mark Brown Date: Wed Jul 31 17:21:13 2024 +0100 KVM: selftests: arm64: Correct feature test for S1PIE in get-reg-list The ID register for S1PIE is ID_AA64MMFR3_EL1.S1PIE which is bits 11:8 but get-reg-list uses a shift of 4, checking SCTLRX instead. Use a shift of 8 instead. Fixes: 5f0419a0083b ("KVM: selftests: get-reg-list: add Permission Indirection registers") Signed-off-by: Mark Brown Reviewed-by: Joey Gouly Link: https://lore.kernel.org/r/20240731-kvm-arm64-fix-s1pie-test-v1-1-a9253f3b7db4@kernel.org Signed-off-by: Oliver Upton tools/testing/selftests/kvm/aarch64/get-reg-list.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) commit 7e814a20f6da2bd2044b1a4682dd92a6f0df5a92 Author: Fuad Tabba Date: Mon Jul 22 17:33:11 2024 +0100 KVM: arm64: Tidying up PAuth code in KVM Tidy up some of the PAuth trapping code to clear up some comments and avoid clang/checkpatch warnings. Also, don't bother setting PAuth HCR_EL2 bits in pKVM, since it's handled by the hypervisor. Signed-off-by: Fuad Tabba Link: https://lore.kernel.org/r/20240722163311.1493879-1-tabba@google.com Signed-off-by: Oliver Upton arch/arm64/include/asm/kvm_ptrauth.h | 2 +- arch/arm64/kvm/arm.c | 14 ++++---------- arch/arm64/kvm/hyp/include/hyp/switch.h | 1 - arch/arm64/kvm/hyp/nvhe/switch.c | 5 ++--- 4 files changed, 7 insertions(+), 15 deletions(-) commit 01ab08cafeced7ae1d6c01a08218742c8182f8da Author: Zenghui Yu Date: Wed Aug 7 13:20:24 2024 +0800 KVM: arm64: vgic-debug: Exit the iterator properly w/o LPI In case the guest doesn't have any LPI, we previously relied on the iterator setting 'intid = nr_spis + VGIC_NR_PRIVATE_IRQS' && 'lpi_idx = 1' to exit the iterator. But it was broken with commit 85d3ccc8b75b ("KVM: arm64: vgic-debug: Use an xarray mark for debug iterator") -- the intid remains at 'nr_spis + VGIC_NR_PRIVATE_IRQS - 1', and we end up endlessly printing the last SPI's state. Consider that it's meaningless to search the LPI xarray and populate lpi_idx when there is no LPI, let's just skip the process for that case. The result is that * If there's no LPI, we focus on the intid and exit the iterator when it runs out of the valid SPI range. * Otherwise we keep the current logic and let the xarray drive the iterator. Fixes: 85d3ccc8b75b ("KVM: arm64: vgic-debug: Use an xarray mark for debug iterator") Signed-off-by: Zenghui Yu Acked-by: Marc Zyngier Link: https://lore.kernel.org/r/20240807052024.2084-1-yuzenghui@huawei.com Signed-off-by: Oliver Upton arch/arm64/kvm/vgic/vgic-debug.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) commit 10f2ad032defe906240d0c3b62dcbceace96b230 Author: Marc Zyngier Date: Wed Aug 7 12:51:44 2024 +0100 KVM: arm64: Enforce dependency on an ARMv8.4-aware toolchain With the NV support of TLBI-range operations, KVM makes use of instructions that are only supported by binutils versions >= 2.30. This breaks the build for very old toolchains. Make KVM support conditional on having ARMv8.4 support in the assembler, side-stepping the issue. Fixes: 5d476ca57d7d ("KVM: arm64: nv: Add handling of range-based TLBI operations") Reported-by: Viresh Kumar Suggested-by: Arnd Bergmann Signed-off-by: Marc Zyngier Acked-by: Arnd Bergmann Link: https://lore.kernel.org/r/20240807115144.3237260-1-maz@kernel.org Signed-off-by: Oliver Upton arch/arm64/kvm/Kconfig | 1 + 1 file changed, 1 insertion(+) commit e639222a51196c69c70b49b67098ce2f9919ed08 Author: Chen Yu Date: Tue Aug 6 19:22:07 2024 +0800 x86/paravirt: Fix incorrect virt spinlock setting on bare metal The kernel can change spinlock behavior when running as a guest. But this guest-friendly behavior causes performance problems on bare metal. The kernel uses a static key to switch between the two modes. In theory, the static key is enabled by default (run in guest mode) and should be disabled for bare metal (and in some guests that want native behavior or paravirt spinlock). A performance drop is reported when running encode/decode workload and BenchSEE cache sub-workload. Bisect points to commit ce0a1b608bfc ("x86/paravirt: Silence unused native_pv_lock_init() function warning"). When CONFIG_PARAVIRT_SPINLOCKS is disabled the virt_spin_lock_key is incorrectly set to true on bare metal. The qspinlock degenerates to test-and-set spinlock, which decreases the performance on bare metal. Set the default value of virt_spin_lock_key to false. If booting in a VM, enable this key. Later during the VM initialization, if other high-efficient spinlock is preferred (e.g. paravirt-spinlock), or the user wants the native qspinlock (via nopvspin boot commandline), the virt_spin_lock_key is disabled accordingly. This results in the following decision matrix: X86_FEATURE_HYPERVISOR Y Y Y N CONFIG_PARAVIRT_SPINLOCKS Y Y N Y/N PV spinlock Y N N Y/N virt_spin_lock_key N Y/N Y N Fixes: ce0a1b608bfc ("x86/paravirt: Silence unused native_pv_lock_init() function warning") Reported-by: Prem Nath Dey Reported-by: Xiaoping Zhou Suggested-by: Dave Hansen Suggested-by: Qiuxu Zhuo Suggested-by: Nikolay Borisov Signed-off-by: Chen Yu Signed-off-by: Thomas Gleixner Reviewed-by: Nikolay Borisov Cc: stable@vger.kernel.org Link: https://lore.kernel.org/all/20240806112207.29792-1-yu.c.chen@intel.com arch/x86/include/asm/qspinlock.h | 12 +++++++----- arch/x86/kernel/paravirt.c | 7 +++---- 2 files changed, 10 insertions(+), 9 deletions(-) commit ab84ba647f2c94ac4d0c3fc6951c49f08aa1fcf7 Author: Zhiquan Li Date: Mon Aug 5 18:35:31 2024 +0800 x86/acpi: Remove __ro_after_init from acpi_mp_wake_mailbox On a platform using the "Multiprocessor Wakeup Structure"[1] to startup secondary CPUs the control processor needs to memremap() the physical address of the MP Wakeup Structure mailbox to the variable acpi_mp_wake_mailbox, which holds the virtual address of mailbox. To wake up the AP the control processor writes the APIC ID of AP, the wakeup vector and the ACPI_MP_WAKE_COMMAND_WAKEUP command into the mailbox. Current implementation doesn't consider the case which restricts boot time CPU bringup to 1 with the kernel parameter "maxcpus=1" and brings other CPUs online later from user space as it sets acpi_mp_wake_mailbox to read-only after init. So when the first AP is tried to brought online after init, the attempt to update the variable results in a kernel panic. The memremap() call that initializes the variable cannot be moved into acpi_parse_mp_wake() because memremap() is not functional at that point in the boot process. Also as the APs might never be brought up, keep the memremap() call in acpi_wakeup_cpu() so that the operation only takes place when needed. Fixes: 24dd05da8c79 ("x86/apic: Mark acpi_mp_wake_* variables as __ro_after_init") Signed-off-by: Zhiquan Li Signed-off-by: Thomas Gleixner Reviewed-by: Kirill A. Shutemov Link: https://lore.kernel.org/all/20240805103531.1230635-1-zhiquan1.li@intel.com arch/x86/kernel/acpi/madt_wakeup.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit d5b854893d27b4030943a10cf28a07189aab0c36 Author: Namhyung Kim Date: Tue Aug 6 12:07:50 2024 -0700 tools/include: Sync arm64 headers with the kernel sources To pick up changes from: 9ef54a384526 arm64: cputype: Add Cortex-A725 definitions 58d245e03c32 arm64: cputype: Add Cortex-X1C definitions fd2ff5f0b320 arm64: cputype: Add Cortex-X925 definitions add332c40328 arm64: cputype: Add Cortex-A720 definitions be5a6f238700 arm64: cputype: Add Cortex-X3 definitions This should be used to beautify x86 syscall arguments and it addresses these tools/perf build warnings: Warning: Kernel ABI header differences: diff -u tools/arch/arm64/include/asm/cputype.h arch/arm64/include/asm/cputype.h Please see tools/include/uapi/README for details (it's in the first patch of this series). Cc: Catalin Marinas Cc: Will Deacon Cc: linux-arm-kernel@lists.infradead.org Signed-off-by: Namhyung Kim tools/arch/arm64/include/asm/cputype.h | 10 ++++++++++ 1 file changed, 10 insertions(+) commit f6d9883f8e680460be4714d4d35c7acac1dffeaf Author: Namhyung Kim Date: Tue Aug 6 12:07:50 2024 -0700 tools/include: Sync x86 headers with the kernel sources To pick up changes from: 149fd4712bcd perf/x86/intel: Support Perfmon MSRs aliasing 21b362cc762a x86/resctrl: Enable shared RMID mode on Sub-NUMA Cluster (SNC) systems 4f460bff7b6a cpufreq: acpi: move MSR_K7_HWCR_CPB_DIS_BIT into msr-index.h 7ea81936b853 x86/cpufeatures: Add HWP highest perf change feature flag 78ce84b9e0a5 x86/cpufeatures: Flip the /proc/cpuinfo appearance logic 1beb348d5c7f x86/sev: Provide SVSM discovery support This should be used to beautify x86 syscall arguments and it addresses these tools/perf build warnings: Warning: Kernel ABI header differences: diff -u tools/arch/x86/include/asm/cpufeatures.h arch/x86/include/asm/cpufeatures.h diff -u tools/arch/x86/include/asm/msr-index.h arch/x86/include/asm/msr-index.h Please see tools/include/uapi/README for details (it's in the first patch of this series). Cc: Thomas Gleixner Cc: Ingo Molnar Cc: Borislav Petkov Cc: Dave Hansen Cc: "H. Peter Anvin" Cc: x86@kernel.org Signed-off-by: Namhyung Kim tools/arch/x86/include/asm/cpufeatures.h | 803 ++++++++++++++++--------------- tools/arch/x86/include/asm/msr-index.h | 11 + 2 files changed, 414 insertions(+), 400 deletions(-) commit 845295f4004c7e1591bab4bad01b51f37d32272f Author: Namhyung Kim Date: Tue Aug 6 12:07:50 2024 -0700 tools/include: Sync filesystem headers with the kernel sources To pick up changes from: 0f9ca80fa4f9 fs: Add initial atomic write support info to statx f9af549d1fd3 fs: export mount options via statmount() 0a3deb11858a fs: Allow listmount() in foreign mount namespace 09b31295f833 fs: export the mount ns id via statmount d04bccd8c19d listmount: allow listing in reverse order bfc69fd05ef9 fs/procfs: add build ID fetching to PROCMAP_QUERY API ed5d583a88a9 fs/procfs: implement efficient VMA querying API for /proc//maps This should be used to beautify FS syscall arguments and it addresses these tools/perf build warnings: Warning: Kernel ABI header differences: diff -u tools/include/uapi/linux/stat.h include/uapi/linux/stat.h diff -u tools/perf/trace/beauty/include/uapi/linux/fs.h include/uapi/linux/fs.h diff -u tools/perf/trace/beauty/include/uapi/linux/mount.h include/uapi/linux/mount.h diff -u tools/perf/trace/beauty/include/uapi/linux/stat.h include/uapi/linux/stat.h Please see tools/include/uapi/README for details (it's in the first patch of this series). Cc: Alexander Viro Cc: Christian Brauner Cc: Jan Kara Cc: linux-fsdevel@vger.kernel.org Signed-off-by: Namhyung Kim tools/include/uapi/linux/stat.h | 12 +- tools/perf/trace/beauty/include/uapi/linux/fs.h | 163 ++++++++++++++++++++- tools/perf/trace/beauty/include/uapi/linux/mount.h | 10 +- tools/perf/trace/beauty/include/uapi/linux/stat.h | 12 +- 4 files changed, 189 insertions(+), 8 deletions(-) commit ed86525f1f4b738bae75c73e89f25430bd0af1b0 Author: Namhyung Kim Date: Tue Aug 6 12:07:50 2024 -0700 tools/include: Sync network socket headers with the kernel sources To pick up changes from: d25a92ccae6b net/smc: Introduce IPPROTO_SMC 060f4ba6e403 io_uring/net: move charging socket out of zc io_uring bb6aaf736680 net: Split a __sys_listen helper for io_uring dc2e77979412 net: Split a __sys_bind helper for io_uring This should be used to beautify socket syscall arguments and it addresses these tools/perf build warnings: Warning: Kernel ABI header differences: diff -u tools/include/uapi/linux/in.h include/uapi/linux/in.h diff -u tools/perf/trace/beauty/include/linux/socket.h include/linux/socket.h Please see tools/include/uapi/README for details (it's in the first patch of this series). Cc: "David S. Miller" Cc: Eric Dumazet Cc: Jakub Kicinski Cc: Paolo Abeni Cc: netdev@vger.kernel.org Signed-off-by: Namhyung Kim tools/include/uapi/linux/in.h | 2 ++ tools/perf/trace/beauty/include/linux/socket.h | 5 ++++- 2 files changed, 6 insertions(+), 1 deletion(-) commit 568901e709d7fa564dfdc75816ea59fec65d20a0 Author: Namhyung Kim Date: Tue Aug 6 12:07:50 2024 -0700 tools/include: Sync uapi/asm-generic/unistd.h with the kernel sources And arch syscall tables to pick up changes from: b1e31c134a8a powerpc: restore some missing spu syscalls d3882564a77c syscalls: fix compat_sys_io_pgetevents_time64 usage 54233a425403 uretprobe: change syscall number, again 63ded110979b uprobe: Change uretprobe syscall scope and number 9142be9e6443 x86/syscall: Mark exit[_group] syscall handlers __noreturn 9aae1baa1c5d x86, arm: Add missing license tag to syscall tables files 5c28424e9a34 syscalls: Fix to add sys_uretprobe to syscall.tbl 190fec72df4a uprobe: Wire up uretprobe system call This should be used to beautify syscall arguments and it addresses these tools/perf build warnings: Warning: Kernel ABI header differences: diff -u tools/include/uapi/asm-generic/unistd.h include/uapi/asm-generic/unistd.h diff -u tools/perf/arch/x86/entry/syscalls/syscall_64.tbl arch/x86/entry/syscalls/syscall_64.tbl diff -u tools/perf/arch/powerpc/entry/syscalls/syscall.tbl arch/powerpc/kernel/syscalls/syscall.tbl diff -u tools/perf/arch/s390/entry/syscalls/syscall.tbl arch/s390/kernel/syscalls/syscall.tbl Please see tools/include/uapi/README for details (it's in the first patch of this series). Cc: Arnd Bergmann Cc: linux-arch@vger.kernel.org Signed-off-by: Namhyung Kim tools/include/uapi/asm-generic/unistd.h | 2 +- tools/perf/arch/powerpc/entry/syscalls/syscall.tbl | 6 +++++- tools/perf/arch/s390/entry/syscalls/syscall.tbl | 2 +- tools/perf/arch/x86/entry/syscalls/syscall_64.tbl | 8 +++++--- 4 files changed, 12 insertions(+), 6 deletions(-) commit c181da18a7302c5de510fe975a3a333299c6e4b7 Author: Mateusz Polchlopek Date: Fri Jul 26 06:19:28 2024 -0400 ice: Fix incorrect assigns of FEC counts Commit ac21add2540e ("ice: Implement driver functionality to dump fec statistics") introduces obtaining FEC correctable and uncorrectable stats per netdev in ICE driver. Unfortunately the assignment of values to fec_stats structure has been done incorrectly. This commit fixes the assignments. Fixes: ac21add2540e ("ice: Implement driver functionality to dump fec statistics") Reviewed-by: Wojciech Drewek Signed-off-by: Mateusz Polchlopek Tested-by: Pucha Himasekhar Reddy (A Contingent worker at Intel) Signed-off-by: Tony Nguyen drivers/net/ethernet/intel/ice/ice_ethtool.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) commit bca515d58367494d8699ab53c645b57b71fb4785 Author: Grzegorz Nitka Date: Mon Jul 15 17:39:11 2024 +0200 ice: Skip PTP HW writes during PTP reset procedure Block HW write access for the driver while the device is in reset to avoid potential race condition and access to the PTP HW in non-nominal state which could lead to undesired effects Fixes: 4aad5335969f ("ice: add individual interrupt allocation") Signed-off-by: Grzegorz Nitka Co-developed-by: Karol Kolacinski Signed-off-by: Karol Kolacinski Signed-off-by: Sergey Temerkhanov Reviewed-by: Przemek Kitszel Tested-by: Pucha Himasekhar Reddy (A Contingent worker at Intel) Signed-off-by: Tony Nguyen drivers/net/ethernet/intel/ice/ice_ptp.c | 4 ++++ 1 file changed, 4 insertions(+) commit 25a7123579ecac9a89a7e5b8d8a580bee4b68acd Author: Grzegorz Nitka Date: Mon Jul 15 17:39:10 2024 +0200 ice: Fix reset handler Synchronize OICR IRQ when preparing for reset to avoid potential race conditions between the reset procedure and OICR Fixes: 4aad5335969f ("ice: add individual interrupt allocation") Signed-off-by: Grzegorz Nitka Signed-off-by: Sergey Temerkhanov Reviewed-by: Przemek Kitszel Tested-by: Pucha Himasekhar Reddy (A Contingent worker at Intel) Signed-off-by: Tony Nguyen drivers/net/ethernet/intel/ice/ice_main.c | 2 ++ 1 file changed, 2 insertions(+) commit f1cb9d5aefba07fc52b06b7bd5fdcd9ef91157b4 Author: Bitterblue Smith Date: Tue Aug 6 19:20:11 2024 +0300 wifi: rtlwifi: rtl8192du: Initialise value32 in _rtl92du_init_queue_reserved_page GCC complains: In file included from include/linux/ieee80211.h:21, from include/net/mac80211.h:20, from drivers/net/wireless/realtek/rtlwifi/rtl8192du/../wifi.h:14, from drivers/net/wireless/realtek/rtlwifi/rtl8192du/hw.c:4: In function 'u32p_replace_bits', inlined from '_rtl92du_init_queue_reserved_page.isra' at drivers/net/wireless/realtek/rtlwifi/rtl8192du/hw.c:225:2: >> include/linux/bitfield.h:189:18: warning: 'value32' is used uninitialized [-Wuninitialized] Part of the variable is indeed left uninitialised. Reported-by: kernel test robot Closes: https://lore.kernel.org/oe-kbuild-all/202408062100.DWhN0CYH-lkp@intel.com/ Fixes: e769c67105d3 ("wifi: rtlwifi: Add rtl8192du/hw.{c,h}") Signed-off-by: Bitterblue Smith Acked-by: Ping-Ke Shih Signed-off-by: Kalle Valo Link: https://patch.msgid.link/2a808244-93d0-492c-b304-ae1974df5df9@gmail.com drivers/net/wireless/realtek/rtlwifi/rtl8192du/hw.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 6a0e38264012809afa24113ee2162dc07f4ed22b Merge: 94a8ee195daf 12653ec36112 Author: Linus Torvalds Date: Wed Aug 7 09:53:41 2024 -0700 Merge tag 'for-6.11-rc2-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/kdave/linux Pull btrfs fixes from David Sterba: - fix double inode unlock for direct IO sync writes (reported by syzbot) - fix root tree id/name map definitions, don't use fixed size buffers for name (reported by -Werror=unterminated-string-initialization) - fix qgroup reserve leaks in bufferd write path - update scrub status structure more often so it can be reported in user space more accurately and let 'resume' not repeat work - in preparation to remove space cache v1 in the future print a warning if it's detected * tag 'for-6.11-rc2-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/kdave/linux: btrfs: avoid using fixed char array size for tree names btrfs: fix double inode unlock for direct IO sync writes btrfs: emit a warning about space cache v1 being deprecated btrfs: fix qgroup reserve leaks in cow_file_range btrfs: implement launder_folio for clearing dirty page reserve btrfs: scrub: update last_physical after scrubbing one stripe btrfs: factor out stripe length calculation into a helper commit 94a8ee195daf9b2d081a573d740993cef4a64a20 Merge: d4560686726f d6cca7631a4b Author: Linus Torvalds Date: Wed Aug 7 09:45:21 2024 -0700 Merge tag 'for-v6.11-rc' of git://git.kernel.org/pub/scm/linux/kernel/git/sre/linux-power-supply Pull power supply fixes from Sebastian Reichel: "rt5033: - fix driver regression causing kernel oops axp288-charger: - fix charge voltage setup qcom-battmgr: - fix thermal zone spamming errors - fix init on Qualcomm X Elite" * tag 'for-v6.11-rc' of git://git.kernel.org/pub/scm/linux/kernel/git/sre/linux-power-supply: power: supply: qcom_battmgr: Ignore extra __le32 in info payload power: supply: qcom_battmgr: return EAGAIN when firmware service is not up power: supply: axp288_charger: Round constant_charge_voltage writes down power: supply: axp288_charger: Fix constant_charge_voltage writes power: supply: rt5033: Bring back i2c_set_clientdata commit e9408fa234fb2c0f087d718c7172212bb0dd7e6f Author: Andrei Simion Date: Wed Jul 31 17:41:00 2024 +0300 MAINTAINERS: Update DTS path for ARM/Microchip (AT91) SoC Update the path to the supported DTS files for ARM/Microchip (AT91) SoC to ensure that the output of the get_maintainer.pl script includes the email addresses of the maintainers for all files located in arch/arm/boot/dts/microchip. Suggested-by: Conor Dooley Signed-off-by: Andrei Simion Reviewed-by: Cristian Birsan Link: https://lore.kernel.org/r/20240731144100.182221-1-andrei.simion@microchip.com Signed-off-by: Claudiu Beznea MAINTAINERS | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) commit edbbaae42a56f9a2b39c52ef2504dfb3fb0a7858 Author: Shay Drory Date: Tue Aug 6 10:20:44 2024 +0300 genirq/irqdesc: Honor caller provided affinity in alloc_desc() Currently, whenever a caller is providing an affinity hint for an interrupt, the allocation code uses it to calculate the node and copies the cpumask into irq_desc::affinity. If the affinity for the interrupt is not marked 'managed' then the startup of the interrupt ignores irq_desc::affinity and uses the system default affinity mask. Prevent this by setting the IRQD_AFFINITY_SET flag for the interrupt in the allocator, which causes irq_setup_affinity() to use irq_desc::affinity on interrupt startup if the mask contains an online CPU. [ tglx: Massaged changelog ] Fixes: 45ddcecbfa94 ("genirq: Use affinity hint in irqdesc allocation") Signed-off-by: Shay Drory Signed-off-by: Thomas Gleixner Cc: Link: https://lore.kernel.org/all/20240806072044.837827-1-shayd@nvidia.com kernel/irq/irqdesc.c | 1 + 1 file changed, 1 insertion(+) commit c48b5a4cf3125adb679e28ef093f66ff81368d05 Author: Thomas Gleixner Date: Tue Aug 6 20:48:43 2024 +0200 x86/mm: Fix PTI for i386 some more So it turns out that we have to do two passes of pti_clone_entry_text(), once before initcalls, such that device and late initcalls can use user-mode-helper / modprobe and once after free_initmem() / mark_readonly(). Now obviously mark_readonly() can cause PMD splits, and pti_clone_pgtable() doesn't like that much. Allow the late clone to split PMDs so that pagetables stay in sync. [peterz: Changelog and comments] Reported-by: Guenter Roeck Signed-off-by: Thomas Gleixner Signed-off-by: Peter Zijlstra (Intel) Tested-by: Guenter Roeck Link: https://lkml.kernel.org/r/20240806184843.GX37996@noisy.programming.kicks-ass.net arch/x86/mm/pti.c | 45 +++++++++++++++++++++++++++++---------------- 1 file changed, 29 insertions(+), 16 deletions(-) commit 6b1124c4526fb1648a3921a441515ea8a98b92e4 Merge: cddaac0459c0 402d336053a5 Author: Arnd Bergmann Date: Wed Aug 7 14:45:45 2024 +0200 Merge tag 'ti-k3-dt-fixes-for-v6.11' of https://git.kernel.org/pub/scm/linux/kernel/git/ti/linux into arm/fixes Devicetree fixes for TI K3 platforms for v6.11 Critical fixes for the following: * j784s4: Fix for McASP DMA map * J722s/AM62p: GPIO ranges fixes * k3-am62-verdin-dahlia: sleep-moci fixes for deep-sleep (revert) * tag 'ti-k3-dt-fixes-for-v6.11' of https://git.kernel.org/pub/scm/linux/kernel/git/ti/linux: arm64: dts: ti: k3-j784s4-main: Correct McASP DMAs arm64: dts: ti: k3-j722s: Fix gpio-range for main_pmx0 arm64: dts: ti: k3-am62p: Fix gpio-range for main_pmx0 arm64: dts: ti: k3-am62p: Add gpio-ranges for mcu_gpio0 arm64: dts: ti: k3-am62-verdin-dahlia: Keep CTRL_SLEEP_MOCI# regulator on arm64: dts: ti: k3-j784s4-evm: Consolidate serdes0 references arm64: dts: ti: k3-j784s4-evm: Assign only lanes 0 and 1 to PCIe1 commit cddaac0459c004c439510bd109929466b0d5908e Author: Dmitry Torokhov Date: Tue Aug 6 09:12:58 2024 -0700 ARM: pxa/gumstix: fix attaching properties to vbus gpio device Commit f1d6588af93b tried to convert GPIO lookup tables to software properties for the vbus gpio device, bit forgot the most important step: actually attaching the new properties to the device. Also fix up the name of the property array to reflect the board name, and add missing gpio/property.h and devices.h includes absence of which causes compile failures on some configurations. Switch "#ifdef CONFIG_USB_PXA25X" to "#if IS_ENABLED(CONFIG_USB_PXA25X)" because it should not matter if the driver is buolt in or a module, it still need vbus controls. Reported-by: Arnd Bergmann Fixes: f1d6588af93b ("ARM: pxa/gumstix: convert vbus gpio to use software nodes") Signed-off-by: Dmitry Torokhov Signed-off-by: Arnd Bergmann arch/arm/mach-pxa/gumstix.c | 11 +++++++---- 1 file changed, 7 insertions(+), 4 deletions(-) commit e1793fea0350330a6a50721ecb2ad66846e0c51e Author: Marek Behún Date: Tue Jul 30 16:49:24 2024 +0200 doc: platform: cznic: turris-omnia-mcu: Use double backticks for attribute value Use double backticks instead of quotes for sysfs attribute value. This makes sphinx generate the "mcu" and "cpu" values in monospace when rendering to HTML. Fixes: dfa556e45ae9 ("platform: cznic: turris-omnia-mcu: Add support for MCU connected GPIOs") Tested-by: Stephen Rothwell Signed-off-by: Marek Behún Link: https://lore.kernel.org/r/20240730144924.25552-3-kabel@kernel.org Signed-off-by: Arnd Bergmann Documentation/ABI/testing/sysfs-bus-i2c-devices-turris-omnia-mcu | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) commit a626ada4184b1888c1c5a4566071643f6e8081a2 Author: Marek Behún Date: Tue Jul 30 16:49:23 2024 +0200 doc: platform: cznic: turris-omnia-mcu: Fix sphinx-build warning Fix sphinx-build warnings ERROR: Unexpected indentation. WARNING: Block quote ends without a blank line; unexpected unindent in Documentation/ABI/testing/sysfs-bus-i2c-devices-turris-omnia-mcu. Reported-by: Stephen Rothwell Link: https://lore.kernel.org/all/20240702174938.04c12aab@canb.auug.org.au/ Fixes: dfa556e45ae9 ("platform: cznic: turris-omnia-mcu: Add support for MCU connected GPIOs") Tested-by: Stephen Rothwell Signed-off-by: Marek Behún Link: https://lore.kernel.org/r/20240730144924.25552-2-kabel@kernel.org Signed-off-by: Arnd Bergmann Documentation/ABI/testing/sysfs-bus-i2c-devices-turris-omnia-mcu | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) commit af340b7aa21c351ba08950f664af601888633614 Author: Marek Behún Date: Fri Jul 19 10:57:56 2024 +0200 platform: cznic: turris-omnia-mcu: Make GPIO code optional Make the GPIO part of the driver optional, under a boolean config option. Move the dependency to GPIOLIB and OF and the selection of GPIOLIB_IRQCHIP to this new option. This makes the turris-omnia-mcu driver available for compilation even if GPIOLIB or OF are disabled. Fixes: ed46f1f7731d ("platform: cznic: turris-omnia-mcu: fix Kconfig dependencies") Signed-off-by: Marek Behún Link: https://lore.kernel.org/r/20240719085756.30598-5-kabel@kernel.org Signed-off-by: Arnd Bergmann drivers/platform/cznic/Kconfig | 42 +++++++++++++++----------- drivers/platform/cznic/Makefile | 2 +- drivers/platform/cznic/turris-omnia-mcu-base.c | 2 ++ drivers/platform/cznic/turris-omnia-mcu.h | 9 ++++++ 4 files changed, 37 insertions(+), 18 deletions(-) commit 74a22fced5a012c57f56d1cf7ea926cc366a2a3a Author: Marek Behún Date: Fri Jul 19 10:57:55 2024 +0200 platform: cznic: turris-omnia-mcu: Make poweroff and wakeup code optional Make the system poweroff and RTC wakeup part of the driver optional, under a boolean config option. Move the dependency to RTC_CLASS to this new option. This makes the turris-omnia-mcu driver available for compilation even if RTC_CLASS is disabled. Fixes: ed46f1f7731d ("platform: cznic: turris-omnia-mcu: fix Kconfig dependencies") Signed-off-by: Marek Behún Link: https://lore.kernel.org/r/20240719085756.30598-4-kabel@kernel.org Signed-off-by: Arnd Bergmann drivers/platform/cznic/Kconfig | 13 +++++++++---- drivers/platform/cznic/Makefile | 2 +- drivers/platform/cznic/turris-omnia-mcu-base.c | 2 ++ drivers/platform/cznic/turris-omnia-mcu.h | 13 +++++++++++-- 4 files changed, 23 insertions(+), 7 deletions(-) commit c7da0d4e33ce262dbed7b9ae4cf013aad0f541f6 Author: Marek Behún Date: Fri Jul 19 10:57:54 2024 +0200 platform: cznic: turris-omnia-mcu: Make TRNG code optional Make the TRNG part of the driver optional, under a boolean config option. This makes the driver turris-omnia-mcu available for compilation even if HW_RANDOM is disabled. Fixes: ed46f1f7731d ("platform: cznic: turris-omnia-mcu: fix Kconfig dependencies") Signed-off-by: Marek Behún Link: https://lore.kernel.org/r/20240719085756.30598-3-kabel@kernel.org Signed-off-by: Arnd Bergmann drivers/platform/cznic/Kconfig | 10 ++++++++-- drivers/platform/cznic/Makefile | 2 +- drivers/platform/cznic/turris-omnia-mcu.h | 10 ++++++++++ 3 files changed, 19 insertions(+), 3 deletions(-) commit 019f87f1ef967c5a5b263f21ad100f46c874505a Author: Marek Behún Date: Fri Jul 19 10:57:53 2024 +0200 platform: cznic: turris-omnia-mcu: Make watchdog code optional Make the watchdog part of the driver optional, under a boolean config option. Move the dependency to WATCHDOG to this new option, and change the WATCHDOG_CORE dependency to selection, as is done in most watchdog drivers. This makes the turris-omnia-mcu driver available for compilation even if WATCHDOG is disabled. Fixes: ed46f1f7731d ("platform: cznic: turris-omnia-mcu: fix Kconfig dependencies") Signed-off-by: Marek Behún Link: https://lore.kernel.org/r/20240719085756.30598-2-kabel@kernel.org Signed-off-by: Arnd Bergmann drivers/platform/cznic/Kconfig | 17 ++++++++++++++--- drivers/platform/cznic/Makefile | 2 +- drivers/platform/cznic/turris-omnia-mcu.h | 10 ++++++++++ 3 files changed, 25 insertions(+), 4 deletions(-) commit 2caca9fb166f82937110368768002511628e6e1f Author: Kent Overstreet Date: Tue Aug 6 23:30:48 2024 -0400 bcachefs: ec should not allocate from ro devs This fixes a device removal deadlock when using erasure coding. Signed-off-by: Kent Overstreet fs/bcachefs/ec.c | 3 +++ 1 file changed, 3 insertions(+) commit c1e4446247b2a8919649fb9aae2d86f53bf3d1e3 Author: Kent Overstreet Date: Tue Aug 6 21:02:34 2024 -0400 bcachefs: Improved allocator debugging for ec chasing down a device removal deadlock with erasure coding Signed-off-by: Kent Overstreet fs/bcachefs/alloc_foreground.c | 6 ++++-- fs/bcachefs/alloc_foreground.h | 2 +- fs/bcachefs/ec.c | 31 ++++++++++++++++++++----------- fs/bcachefs/sysfs.c | 6 +++++- 4 files changed, 30 insertions(+), 15 deletions(-) commit 02026e8931366158d7395f87afeb0b535210dbee Author: Kent Overstreet Date: Tue Aug 6 22:49:31 2024 -0400 bcachefs: Add missing bch2_trans_begin() call Signed-off-by: Kent Overstreet fs/bcachefs/io_read.c | 1 + 1 file changed, 1 insertion(+) commit 90b211fa2da3f36939e84b6426988832a62caf4b Author: Kent Overstreet Date: Tue Jul 30 20:35:59 2024 -0400 bcachefs: Add a comment for bucket helper types We've had bugs in the past with incorrect integer conversions in disk accounting code, which is why bucket helpers now always return s64s; add a comment explaining this. Signed-off-by: Kent Overstreet fs/bcachefs/alloc_background.h | 8 ++++++++ 1 file changed, 8 insertions(+) commit 7442b5cdf259e2fb112560904b7002ce48d15578 Author: Kent Overstreet Date: Tue Jul 30 20:33:25 2024 -0400 bcachefs: Don't rely on implicit unsigned -> signed integer conversion implicit integer conversion is a fertile source of bugs, and we really would rather not have the min()/max() macros doing it implicitly. bcachefs appears to be the only place in the kernel where this happens, so let's fix it. Signed-off-by: Kent Overstreet fs/bcachefs/alloc_background.h | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) commit ff9bf4b34104955017822e9bc42aeeb526ee2a80 Author: Kent Overstreet Date: Tue Jul 30 21:14:08 2024 -0400 lockdep: Fix lockdep_set_notrack_class() for CONFIG_LOCK_STAT We won't find a contended lock if it's not being tracked. Signed-off-by: Kent Overstreet kernel/locking/lockdep.c | 6 ++++++ 1 file changed, 6 insertions(+) commit cff59d8631e1409ffdd22d9d717e15810181b32c Author: Claudio Imbrenda Date: Thu Aug 1 13:25:48 2024 +0200 s390/uv: Panic for set and remove shared access UVC errors The return value uv_set_shared() and uv_remove_shared() (which are wrappers around the share() function) is not always checked. The system integrity of a protected guest depends on the Share and Unshare UVCs being successful. This means that any caller that fails to check the return value will compromise the security of the protected guest. No code path that would lead to such violation of the security guarantees is currently exercised, since all the areas that are shared never get unshared during the lifetime of the system. This might change and become an issue in the future. The Share and Unshare UVCs can only fail in case of hypervisor misbehaviour (either a bug or malicious behaviour). In such cases there is no reasonable way forward, and the system needs to panic. This patch replaces the return at the end of the share() function with a panic, to guarantee system integrity. Fixes: 5abb9351dfd9 ("s390/uv: introduce guest side ultravisor code") Signed-off-by: Claudio Imbrenda Reviewed-by: Christian Borntraeger Reviewed-by: Steffen Eiden Reviewed-by: Janosch Frank Link: https://lore.kernel.org/r/20240801112548.85303-1-imbrenda@linux.ibm.com Message-ID: <20240801112548.85303-1-imbrenda@linux.ibm.com> [frankja@linux.ibm.com: Fixed up patch subject] Signed-off-by: Janosch Frank arch/s390/include/asm/uv.h | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) commit 65ba8cef0416816b912c04850fc2468329994353 Author: Heikki Krogerus Date: Tue Aug 6 14:20:29 2024 +0300 usb: typec: ucsi: Fix a deadlock in ucsi_send_command_common() The function returns with the ppm_lock held if the PPM is busy or there's an error. Reported-and-tested-by: Luciano Coelho Fixes: 5e9c1662a89b ("usb: typec: ucsi: rework command execution functions") Signed-off-by: Heikki Krogerus Reported-by: Luciano Coelho Signed-off-by: Luca Coelho Link: https://lore.kernel.org/r/20240806112029.2984319-1-heikki.krogerus@linux.intel.com Signed-off-by: Greg Kroah-Hartman drivers/usb/typec/ucsi/ucsi.c | 11 ++++------- 1 file changed, 4 insertions(+), 7 deletions(-) commit becac61a771a4a127e0c38c28110a55cb84d9f41 Author: Xu Yang Date: Fri Aug 2 14:41:56 2024 +0800 usb: typec: tcpm: avoid sink goto SNK_UNATTACHED state if not received source capability message Since commit (122968f8dda8 usb: typec: tcpm: avoid resets for missing source capability messages), state will change from SNK_WAIT_CAPABILITIES to SNK_WAIT_CAPABILITIES_TIMEOUT. We need to change SNK_WAIT_CAPABILITIES -> SNK_READY path to SNK_WAIT_CAPABILITIES_TIMEOUT -> SNK_READY accordingly. Otherwise, the sink port will never change to SNK_READY state if the source does't have PD capability. [ 503.547183] pending state change SNK_WAIT_CAPABILITIES -> SNK_WAIT_CAPABILITIES_TIMEOUT @ 310 ms [rev3 NONE_AMS] [ 503.857239] state change SNK_WAIT_CAPABILITIES -> SNK_WAIT_CAPABILITIES_TIMEOUT [delayed 310 ms] [ 503.857254] PD TX, header: 0x87 [ 503.862440] PD TX complete, status: 2 [ 503.862484] state change SNK_WAIT_CAPABILITIES_TIMEOUT -> SNK_UNATTACHED [rev3 NONE_AMS] Fixes: 122968f8dda8 ("usb: typec: tcpm: avoid resets for missing source capability messages") Cc: stable@vger.kernel.org Signed-off-by: Xu Yang Reviewed-by: Sebastian Reichel Reviewed-by: Heikki Krogerus Reviewed-by: Badhri Jagan Sridharan Link: https://lore.kernel.org/r/20240802064156.1846768-1-xu.yang_2@nxp.com Signed-off-by: Greg Kroah-Hartman drivers/usb/typec/tcpm/tcpm.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit a59d8cc9292c58bccec7d8fa27eb59d0a3a6aa0d Author: Tudor Ambarus Date: Fri Aug 2 14:04:28 2024 +0000 usb: gadget: f_fs: pull out f->disable() from ffs_func_set_alt() The ``alt`` parameter was used as a way to differentiate between f->disable() and f->set_alt(). As the code paths diverge quite a bit, pull out the f->disable() code from ffs_func_set_alt(), everything will become clearer and less error prone. No change in functionality intended. Signed-off-by: Tudor Ambarus Link: https://lore.kernel.org/r/20240802140428.2000312-3-tudor.ambarus@linaro.org Signed-off-by: Greg Kroah-Hartman drivers/usb/gadget/function/f_fs.c | 36 ++++++++++++++++++++++-------------- 1 file changed, 22 insertions(+), 14 deletions(-) commit 382b6eabb0316b7334d97afbdcf33a4e20b0ecd8 Author: Tudor Ambarus Date: Fri Aug 2 14:04:27 2024 +0000 usb: gadget: f_fs: restore ffs_func_disable() functionality The blamed commit made ffs_func_disable() always return -EINVAL as the method calls ffs_func_set_alt() with the ``alt`` argument being ``(unsigned)-1``, which is always greater than MAX_ALT_SETTINGS. Use the MAX_ALT_SETTINGS check just in the f->set_alt() code path, f->disable() doesn't care about the ``alt`` parameter. Make a surgical fix, but really the f->disable() code shall be pulled out from ffs_func_set_alt(), the code will become clearer. A patch will follow. Note that ffs_func_disable() always returning -EINVAL made pixel6 crash on USB disconnect. Fixes: 2f550553e23c ("usb: gadget: f_fs: Add the missing get_alt callback") Cc: stable Reported-by: William McVicker Signed-off-by: Tudor Ambarus Link: https://lore.kernel.org/r/20240802140428.2000312-2-tudor.ambarus@linaro.org Signed-off-by: Greg Kroah-Hartman drivers/usb/gadget/function/f_fs.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) commit 7d5cbd799a97b4483aa278663138b5af8bccffdf Merge: b1dad2f09138 00af4f3dda14 Author: Greg Kroah-Hartman Date: Wed Aug 7 12:36:50 2024 +0200 Merge tag 'usb-serial-6.11-rc2' of https://git.kernel.org/pub/scm/linux/kernel/git/johan/usb-serial into usb-linus Johan writes: USB-serial fix for 6.11-rc2 Here's a fix for an issue when using the usb_debug driver with Xen. This change has been in linux-next for a couple of days with no reported issues. * tag 'usb-serial-6.11-rc2' of https://git.kernel.org/pub/scm/linux/kernel/git/johan/usb-serial: USB: serial: debug: do not echo input by default commit 494b0792d962e8efac72b3a5b6d9bcd4e6fa8cf0 Author: Dandan Zhang Date: Wed Aug 7 17:37:14 2024 +0800 LoongArch: KVM: Remove undefined a6 argument comment for kvm_hypercall() The kvm_hypercall() set for LoongArch is limited to a1-a5. So the mention of a6 in the comment is undefined that needs to be rectified. Reviewed-by: Bibo Mao Signed-off-by: Wentao Guan Signed-off-by: Dandan Zhang Signed-off-by: Huacai Chen arch/loongarch/include/asm/kvm_para.h | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) commit 296b03ce389b4f7b3d7ea5664e53d432fb17e745 Author: Yuli Wang Date: Wed Aug 7 17:37:14 2024 +0800 LoongArch: KVM: Remove unnecessary definition of KVM_PRIVATE_MEM_SLOTS 1. "KVM_PRIVATE_MEM_SLOTS" is renamed as "KVM_INTERNAL_MEM_SLOTS". 2. "KVM_INTERNAL_MEM_SLOTS" defaults to zero, so it is not necessary to define it in LoongArch's asm/kvm_host.h. Link: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=bdd1c37a315bc50ab14066c4852bc8dcf070451e Link: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=b075450868dbc0950f0942617f222eeb989cad10 Reviewed-by: Bibo Mao Signed-off-by: Wentao Guan Signed-off-by: Yuli Wang Signed-off-by: Huacai Chen arch/loongarch/include/asm/kvm_host.h | 2 -- 1 file changed, 2 deletions(-) commit 4574815abf43e2bf05643e1b3f7a2e5d6df894f0 Author: Huacai Chen Date: Wed Aug 7 17:37:11 2024 +0800 LoongArch: Use accessors to page table entries instead of direct dereference As very well explained in commit 20a004e7b017cce282 ("arm64: mm: Use READ_ONCE/WRITE_ONCE when accessing page tables"), an architecture whose page table walker can modify the PTE in parallel must use READ_ONCE()/ WRITE_ONCE() macro to avoid any compiler transformation. So apply that to LoongArch which is such an architecture, in order to avoid potential problems. Similar to commit edf955647269422e ("riscv: Use accessors to page table entries instead of direct dereference"). Signed-off-by: Huacai Chen arch/loongarch/include/asm/hugetlb.h | 4 +-- arch/loongarch/include/asm/kfence.h | 6 ++--- arch/loongarch/include/asm/pgtable.h | 48 ++++++++++++++++++++++-------------- arch/loongarch/kvm/mmu.c | 8 +++--- arch/loongarch/mm/hugetlbpage.c | 6 ++--- arch/loongarch/mm/init.c | 10 ++++---- arch/loongarch/mm/kasan_init.c | 10 ++++---- arch/loongarch/mm/pgtable.c | 2 +- 8 files changed, 52 insertions(+), 42 deletions(-) commit e688c220732e518c2eb1639e9ef77d4a9311713c Author: Miao Wang Date: Wed Aug 7 17:37:11 2024 +0800 LoongArch: Enable general EFI poweroff method efi_shutdown_init() can register a general sys_off handler named efi_power_off(). Enable this by providing efi_poweroff_required(), like arm and x86. Since EFI poweroff is also supported on LoongArch, and the enablement makes the poweroff function usable for hardwares which lack ACPI S5. We prefer ACPI poweroff rather than EFI poweroff (like x86), so we only require EFI poweroff if acpi_gbl_reduced_hardware or acpi_no_s5 is true. Cc: stable@vger.kernel.org Acked-by: Ard Biesheuvel Signed-off-by: Miao Wang Signed-off-by: Huacai Chen arch/loongarch/kernel/efi.c | 6 ++++++ 1 file changed, 6 insertions(+) commit 787db3bb6ed5cee56fc97fecdd61517d89763f0a Author: David Gow Date: Sun Aug 4 17:18:48 2024 +0800 drm/i915: Attempt to get pages without eviction first In commit a78a8da51b36 ("drm/ttm: replace busy placement with flags v6"), __i915_ttm_get_pages was updated to use flags instead of the separate 'busy' placement list. However, the behaviour was subtly changed. Originally, the function would attempt to use the preferred placement without eviction, and give an opportunity to restart the operation before falling back to allowing eviction. This was unintentionally changed, as the preferred placement was not given the TTM_PL_FLAG_DESIRED flag, and so eviction could be triggered in that first pass. This caused thrashing, and a significant performance regression on DG2 systems with small BAR. For example, Minecraft and Team Fortress 2 would drop to single-digit framerates. Restore the original behaviour by marking the initial placement as desired on that first attempt. Also, rework this to use a separate struct ttm_palcement, as the individual placements are marked 'const', so hot-patching the flags is even more dodgy than before. Thanks to Justin Brewer for bisecting this. Fixes: a78a8da51b36 ("drm/ttm: replace busy placement with flags v6") Link: https://gitlab.freedesktop.org/drm/i915/kernel/-/issues/11255 Signed-off-by: David Gow Reviewed-by: Jonathan Cavitt Reviewed-by: Andi Shyti Signed-off-by: Andi Shyti Link: https://patchwork.freedesktop.org/patch/msgid/20240804091851.122186-3-david@davidgow.net (cherry picked from commit 92653f2a572505adaf7f13f695c1907e71a1dc84) Signed-off-by: Joonas Lahtinen drivers/gpu/drm/i915/gem/i915_gem_ttm.c | 12 +++++++----- 1 file changed, 7 insertions(+), 5 deletions(-) commit 264b5b5980061d8c6a6a30c031cdec1179fe2bae Author: David Gow Date: Sun Aug 4 17:18:47 2024 +0800 drm/i915: Allow evicting to use the requested placement In commit a78a8da51b36 ("drm/ttm: replace busy placement with flags v6"), the old system of having a separate placement list (for placements which should be used without eviction) and a 'busy' placement list (for placements which should be attempted if eviction is required) was replaced with a new one where placements could be marked 'FALLBACK' (to be attempted if eviction is required) or 'DESIRED' (to be attempted first, but not if eviction is required). i915 had always included the requested placement in the list of 'busy' placements: i.e., the placement could be used either if eviction is required or not. But when the new system was put in place, the requested (first) placement was marked 'DESIRED', so would never be used if eviction became necessary. While a bug in the original commit prevented this flag from working, when this was fixed in 4a0e7b3c ("drm/i915: fix applying placement flag"), it caused long hangs on DG2 systems with small BAR. Don't mark the requested placement DESIRED (or FALLBACK), allowing it to be used in both situations. This matches the old behaviour, and resolves the hangs. Thanks to Justin Brewer for bisecting the issue. Fixes: a78a8da51b36 ("drm/ttm: replace busy placement with flags v6") Fixes: 4a0e7b3c3753 ("drm/i915: fix applying placement flag") Link: https://gitlab.freedesktop.org/drm/i915/kernel/-/issues/11255 Signed-off-by: David Gow Reviewed-by: Jonathan Cavitt Reviewed-by: Andi Shyti Signed-off-by: Andi Shyti Link: https://patchwork.freedesktop.org/patch/msgid/20240804091851.122186-2-david@davidgow.net (cherry picked from commit 54bf0af90844fbf18f5be3272eda69198dfdb622) Signed-off-by: Joonas Lahtinen drivers/gpu/drm/i915/gem/i915_gem_ttm.c | 1 - 1 file changed, 1 deletion(-) commit eb91c456f3714c336f0812dccab422ec0e72bde4 Author: Dustin L. Howett Date: Tue Aug 6 21:33:51 2024 -0500 ALSA: hda/realtek: Add Framework Laptop 13 (Intel Core Ultra) to quirks The Framework Laptop 13 (Intel Core Ultra) has an ALC285 that ships in a similar configuration to the ALC295 in previous models. It requires the same quirk for headset detection. Signed-off-by: Dustin L. Howett Cc: Link: https://patch.msgid.link/20240806-alsa-hda-realtek-add-framework-laptop-13-intel-core-ultra-to-quirks-v1-1-42d6ce2dbf14@howett.net Signed-off-by: Takashi Iwai sound/pci/hda/patch_realtek.c | 1 + 1 file changed, 1 insertion(+) commit 1ca645a2f74a4290527ae27130c8611391b07dbf Author: ZHANG Yuntian Date: Sat Aug 3 15:46:51 2024 +0800 net: usb: qmi_wwan: add MeiG Smart SRM825L Add support for MeiG Smart SRM825L which is based on Qualcomm 315 chip. T: Bus=04 Lev=01 Prnt=01 Port=00 Cnt=01 Dev#= 2 Spd=5000 MxCh= 0 D: Ver= 3.20 Cls=00(>ifc ) Sub=00 Prot=00 MxPS= 9 #Cfgs= 1 P: Vendor=2dee ProdID=4d22 Rev= 4.14 S: Manufacturer=MEIG S: Product=LTE-A Module S: SerialNumber=6f345e48 C:* #Ifs= 6 Cfg#= 1 Atr=80 MxPwr=896mA I:* If#= 0 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=30 Driver=option E: Ad=81(I) Atr=02(Bulk) MxPS=1024 Ivl=0ms E: Ad=01(O) Atr=02(Bulk) MxPS=1024 Ivl=0ms I:* If#= 1 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=40 Driver=option E: Ad=83(I) Atr=03(Int.) MxPS= 10 Ivl=32ms E: Ad=82(I) Atr=02(Bulk) MxPS=1024 Ivl=0ms E: Ad=02(O) Atr=02(Bulk) MxPS=1024 Ivl=0ms I:* If#= 2 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=40 Driver=option E: Ad=85(I) Atr=03(Int.) MxPS= 10 Ivl=32ms E: Ad=84(I) Atr=02(Bulk) MxPS=1024 Ivl=0ms E: Ad=03(O) Atr=02(Bulk) MxPS=1024 Ivl=0ms I:* If#= 3 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=60 Driver=option E: Ad=87(I) Atr=03(Int.) MxPS= 10 Ivl=32ms E: Ad=86(I) Atr=02(Bulk) MxPS=1024 Ivl=0ms E: Ad=04(O) Atr=02(Bulk) MxPS=1024 Ivl=0ms I:* If#= 4 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=42 Prot=01 Driver=(none) E: Ad=05(O) Atr=02(Bulk) MxPS=1024 Ivl=0ms E: Ad=88(I) Atr=02(Bulk) MxPS=1024 Ivl=0ms I:* If#= 5 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=50 Driver=qmi_wwan E: Ad=89(I) Atr=03(Int.) MxPS= 8 Ivl=32ms E: Ad=8e(I) Atr=02(Bulk) MxPS=1024 Ivl=0ms E: Ad=0f(O) Atr=02(Bulk) MxPS=1024 Ivl=0ms Signed-off-by: ZHANG Yuntian Link: https://patch.msgid.link/D1EB81385E405DFE+20240803074656.567061-1-yt@radxa.com Signed-off-by: Jakub Kicinski drivers/net/usb/qmi_wwan.c | 1 + 1 file changed, 1 insertion(+) commit c7a19018bd557c24072b59088ad2684fd83ea3f4 Author: Tristram Ha Date: Mon Aug 5 16:52:00 2024 -0700 net: dsa: microchip: Fix Wake-on-LAN check to not return an error The wol variable in ksz_port_set_mac_address() is declared with random data, but the code in ksz_get_wol call may not be executed so the WAKE_MAGIC check may be invalid resulting in an error message when setting a MAC address after starting the DSA driver. Fixes: 3b454b6390c3 ("net: dsa: microchip: ksz9477: Add Wake on Magic Packet support") Signed-off-by: Tristram Ha Reviewed-by: Oleksij Rempel Reviewed-by: Florian Fainelli Link: https://patch.msgid.link/20240805235200.24982-1-Tristram.Ha@microchip.com Signed-off-by: Jakub Kicinski drivers/net/dsa/microchip/ksz_common.c | 5 +++++ 1 file changed, 5 insertions(+) commit 9ba48db9f77ce0001dbb882476fa46e092feb695 Author: Gaosheng Cui Date: Tue Aug 6 20:53:31 2024 +0800 i2c: qcom-geni: Add missing geni_icc_disable in geni_i2c_runtime_resume Add the missing geni_icc_disable() before return in geni_i2c_runtime_resume(). Fixes: bf225ed357c6 ("i2c: i2c-qcom-geni: Add interconnect support") Signed-off-by: Gaosheng Cui Reviewed-by: Vladimir Zapolskiy Signed-off-by: Andi Shyti drivers/i2c/busses/i2c-qcom-geni.c | 1 + 1 file changed, 1 insertion(+) commit fe992163575b187405899c5abaad8ef6fb828ff6 Author: Sarthak Singh Date: Wed Jul 24 22:57:06 2024 +0530 rust: Support latest version of `rust-analyzer` Sets the `sysroot` field in rust-project.json which is now needed in newer versions of rust-analyzer instead of the `sysroot_src` field. Till [1] `rust-analyzer` used to guess the `sysroot` based on the `sysroot_src` at [2]. Now `sysroot` is a required parameter for a `rust-project.json` file. It is required because `rust-analyzer` need it to find the proc-macro server [3]. In the current version of `rust-analyzer` the `sysroot_src` is only used to include the inbuilt library crates (std, core, alloc, etc) [4]. Since we already specify the core library to be included in the `rust-project.json` we don't need to define the `sysroot_src`. Code editors like VS Code try to use the latest version of rust-analyzer (which is updated every week) instead of the version of rust-analyzer that comes with the rustup toolchain (which is updated every six weeks along with the rust version). Without this change `rust-analyzer` is breaking for anyone using VS Code. As they are getting the latest version of `rust-analyzer` with the changes made in [1]. `rust-analyzer` will also start breaking for other developers as they update their rust version (assuming that also updates the rust-analyzer version on their system). This patch should work with every setup as there is no more guess work being done by `rust-analyzer`. [ Lukas, who leads the rust-analyzer team, says: `sysroot_src` is required now if you want to have the sysroot source libraries be loaded. I think we used to infer it as `{sysroot}/lib/rustlib/src/rust/library` before when only the `sysroot` field was given but that was since changed to make it possible in having a sysroot without the standard library sources (that is only have the binaries available). So if you want the library sources to be loaded by rust-analyzer you will have to set that field as well now. - Miguel ] Link: https://github.com/rust-lang/rust-analyzer/pull/17287 [1] Link: https://github.com/rust-lang/rust-analyzer/blob/f372a8a1176ff8dd5f45ab2ddd45f3530db0374f/crates/project-model/src/workspace.rs#L367-L374 [2] Link: https://github.com/rust-lang/rust-analyzer/blob/eeb192b79aeac47b40add66347022af17a74fbaf/crates/project-model/src/sysroot.rs#L180-L192 [3] Link: https://github.com/search?q=repo%3AVeykril%2Frust-analyzer%20src_root()&type=code [4] Tested-by: Dirk Behme Signed-off-by: Sarthak Singh Link: https://rust-for-linux.zulipchat.com/#narrow/stream/291565-Help/topic/How.20to.20rust-analyzer.20correctly.20working Link: https://lore.kernel.org/r/20240724172713.899399-1-sarthak.singh99@gmail.com [ Formatted comment, fixed typo and removed spurious empty line. - Miguel ] Signed-off-by: Miguel Ojeda rust/Makefile | 2 +- scripts/generate_rust_analyzer.py | 6 +++++- 2 files changed, 6 insertions(+), 2 deletions(-) commit 379d9af3f3da2da1bbfa67baf1820c72a080d1f1 Author: Zhen Lei Date: Tue Aug 6 14:51:13 2024 +0800 selinux: fix potential counting error in avc_add_xperms_decision() The count increases only when a node is successfully added to the linked list. Cc: stable@vger.kernel.org Fixes: fa1aa143ac4a ("selinux: extended permissions for ioctls") Signed-off-by: Zhen Lei Acked-by: Stephen Smalley Signed-off-by: Paul Moore security/selinux/avc.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit b9735006762677c2cd794bfcb1463a9a6ed558dd Author: Namhyung Kim Date: Tue Aug 6 12:07:50 2024 -0700 tools/include: Sync uapi/sound/asound.h with the kernel sources To pick up changes from: f05c1ffc2745 ALSA: pcm: reinvent the stream synchronization ID API This should be used to beautify sound syscall arguments and it addresses these tools/perf build warnings: Warning: Kernel ABI header differences: diff -u tools/perf/trace/beauty/include/uapi/sound/asound.h include/uapi/sound/asound.h Please see tools/include/uapi/README for details (it's in the first patch of this series). Cc: Jaroslav Kysela Cc: Takashi Iwai Cc: linux-sound@vger.kernel.org Signed-off-by: Namhyung Kim tools/perf/trace/beauty/include/uapi/sound/asound.h | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-) commit 8ec9497d3ef34fab216e277eca5035811f06b421 Author: Namhyung Kim Date: Tue Aug 6 12:07:50 2024 -0700 tools/include: Sync uapi/linux/perf.h with the kernel sources To pick up changes from: 608f6976c309 perf/x86/intel: Support new data source for Lunar Lake This should be used to beautify perf syscall arguments and it addresses these tools/perf build warnings: Warning: Kernel ABI header differences: diff -u tools/include/uapi/linux/perf_event.h include/uapi/linux/perf_event.h Please see tools/include/uapi/README for details (it's in the first patch of this series). Cc: Peter Zijlstra Cc: Ingo Molnar Cc: Arnaldo Carvalho de Melo Cc: Mark Rutland Cc: Alexander Shishkin Cc: Jiri Olsa Cc: Ian Rogers Cc: Adrian Hunter Cc: "Liang, Kan" Cc: linux-perf-users@vger.kernel.org Signed-off-by: Namhyung Kim tools/include/uapi/linux/perf_event.h | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) commit a625df3995c31a5d8cf46f2337b207e93bef9bdd Author: Namhyung Kim Date: Tue Aug 6 12:07:50 2024 -0700 tools/include: Sync uapi/linux/kvm.h with the kernel sources And other arch-specific UAPI headers to pick up changes from: 4b23e0c199b2 KVM: Ensure new code that references immediate_exit gets extra scrutiny 85542adb65ec KVM: x86: Add KVM_RUN_X86_GUEST_MODE kvm_run flag 6fef518594bc KVM: x86: Add a capability to configure bus frequency for APIC timer 34ff65901735 x86/sev: Use kernel provided SVSM Calling Areas 5dcc1e76144f Merge tag 'kvm-x86-misc-6.11' of https://github.com/kvm-x86/linux into HEAD 9a0d2f4995dd KVM: PPC: Book3S HV: Add one-reg interface for HASHPKEYR register e9eb790b2557 KVM: PPC: Book3S HV: Add one-reg interface for HASHKEYR register 1a1e6865f516 KVM: PPC: Book3S HV: Add one-reg interface for DEXCR register This should be used to beautify KVM syscall arguments and it addresses these tools/perf build warnings: Warning: Kernel ABI header differences: diff -u tools/include/uapi/linux/kvm.h include/uapi/linux/kvm.h diff -u tools/arch/x86/include/uapi/asm/kvm.h arch/x86/include/uapi/asm/kvm.h diff -u tools/arch/x86/include/uapi/asm/svm.h arch/x86/include/uapi/asm/svm.h diff -u tools/arch/powerpc/include/uapi/asm/kvm.h arch/powerpc/include/uapi/asm/kvm.h Please see tools/include/uapi/README for details (it's in the first patch of this series). Cc: Paolo Bonzini Cc: kvm@vger.kernel.org Signed-off-by: Namhyung Kim tools/arch/powerpc/include/uapi/asm/kvm.h | 3 ++ tools/arch/x86/include/uapi/asm/kvm.h | 49 +++++++++++++++++++++++++++++++ tools/arch/x86/include/uapi/asm/svm.h | 1 + tools/include/uapi/linux/kvm.h | 17 ++++++++++- 4 files changed, 69 insertions(+), 1 deletion(-) commit aef21f6b6a4aae648c890e74c2322d10ab267249 Author: Namhyung Kim Date: Tue Aug 6 09:59:26 2024 -0700 tools/include: Sync uapi/drm/i915_drm.h with the kernel sources To pick up changes from: 0f1bb41bf396 drm/i915: Support replaying GPU hangs with captured context image This should be used to beautify DRM syscall arguments and it addresses these tools/perf build warnings: Warning: Kernel ABI header differences: diff -u tools/include/uapi/drm/i915_drm.h include/uapi/drm/i915_drm.h Please see tools/include/uapi/README for details (it's in the first patch of this series). Cc: Jani Nikula Cc: Joonas Lahtinen Cc: Rodrigo Vivi Cc: intel-gfx@lists.freedesktop.org Signed-off-by: Namhyung Kim tools/include/uapi/drm/i915_drm.h | 27 +++++++++++++++++++++++++++ 1 file changed, 27 insertions(+) commit fbc05142ccdd0061f6d0e489608935943d2984a1 Author: Namhyung Kim Date: Tue Aug 6 12:01:40 2024 -0700 perf tools: Add tools/include/uapi/README Write down the reason why we keep a copy of headers to the README file instead of adding it to every commit messages. Suggested-by: Jani Nikula Original-by: Arnaldo Carvalho de Melo Original-by: Ingo Molnar Signed-off-by: Namhyung Kim tools/include/uapi/README | 73 +++++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 73 insertions(+) commit 3e7917c0cdad835a5121520fc5686d954b7a61ab Author: Eric Dumazet Date: Mon Aug 5 08:58:21 2024 +0000 net: linkwatch: use system_unbound_wq linkwatch_event() grabs possibly very contended RTNL mutex. system_wq is not suitable for such work. Inspired by many noisy syzbot reports. 3 locks held by kworker/0:7/5266: #0: ffff888015480948 ((wq_completion)events){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3206 [inline] #0: ffff888015480948 ((wq_completion)events){+.+.}-{0:0}, at: process_scheduled_works+0x90a/0x1830 kernel/workqueue.c:3312 #1: ffffc90003f6fd00 ((linkwatch_work).work){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3207 [inline] , at: process_scheduled_works+0x945/0x1830 kernel/workqueue.c:3312 #2: ffffffff8fa6f208 (rtnl_mutex){+.+.}-{3:3}, at: linkwatch_event+0xe/0x60 net/core/link_watch.c:276 Reported-by: syzbot Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Signed-off-by: Eric Dumazet Reviewed-by: Kuniyuki Iwashima Link: https://patch.msgid.link/20240805085821.1616528-1-edumazet@google.com Signed-off-by: Jakub Kicinski net/core/link_watch.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) commit 929725bd7eb4eea1f75197d9847f3f1ea5afdad1 Author: Simon Ser Date: Wed Jul 31 19:10:20 2024 +0000 drm/atomic: allow no-op FB_ID updates for async flips User-space is allowed to submit any property in an async flip as long as the value doesn't change. However we missed one case: as things stand, the kernel rejects no-op FB_ID changes on non-primary planes. Fix this by changing the conditional and skipping drm_atomic_check_prop_changes() only for FB_ID on the primary plane (instead of skipping for FB_ID on any plane). Fixes: 0e26cc72c71c ("drm: Refuse to async flip with atomic prop changes") Signed-off-by: Simon Ser Reviewed-by: André Almeida Tested-by: Xaver Hugl Cc: Alex Deucher Cc: Christian König Cc: Michel Dänzer Cc: Ville Syrjälä Link: https://patchwork.freedesktop.org/patch/msgid/20240731191014.878320-1-contact@emersion.fr drivers/gpu/drm/drm_atomic_uapi.c | 15 ++++----------- 1 file changed, 4 insertions(+), 11 deletions(-) commit d4560686726f7a357922f300fc81f5964be8df04 Merge: eb5e56d14912 0823dc64586b Author: Linus Torvalds Date: Tue Aug 6 10:58:28 2024 -0700 Merge tag 'for_linus' of git://git.kernel.org/pub/scm/linux/kernel/git/mst/vhost Pull virtio fix from Michael Tsirkin: "Fix a single, long-standing issue with kick pass-through vdpa" * tag 'for_linus' of git://git.kernel.org/pub/scm/linux/kernel/git/mst/vhost: vhost-vdpa: switch to use vmf_insert_pfn() in the fault handler commit 1c4a057d01f4432704c4dc8842b6e888a91d95df Author: Rob Clark Date: Mon Jul 29 13:57:24 2024 -0700 dt-bindings: display: panel: samsung,atna45dc02: Document ATNA45DC02 The Samsung ATNA45DC02 panel is an AMOLED eDP panel, similar to the existing ATNA45AF01 and ATNA33XC20 panel but with a higher resolution. Signed-off-by: Rob Clark Acked-by: Conor Dooley Reviewed-by: Douglas Anderson Signed-off-by: Douglas Anderson Link: https://patchwork.freedesktop.org/patch/msgid/20240729205726.7923-1-robdclark@gmail.com .../devicetree/bindings/display/panel/samsung,atna33xc20.yaml | 9 ++++++--- 1 file changed, 6 insertions(+), 3 deletions(-) commit bd44ca3de49cc1badcff7a96010fa2c64f04868c Author: Rik van Riel Date: Tue Aug 6 11:56:45 2024 -0400 dma-debug: avoid deadlock between dma debug vs printk and netconsole Currently the dma debugging code can end up indirectly calling printk under the radix_lock. This happens when a radix tree node allocation fails. This is a problem because the printk code, when used together with netconsole, can end up inside the dma debugging code while trying to transmit a message over netcons. This creates the possibility of either a circular deadlock on the same CPU, with that CPU trying to grab the radix_lock twice, or an ABBA deadlock between different CPUs, where one CPU grabs the console lock first and then waits for the radix_lock, while the other CPU is holding the radix_lock and is waiting for the console lock. The trace captured by lockdep is of the ABBA variant. -> #2 (&dma_entry_hash[i].lock){-.-.}-{2:2}: _raw_spin_lock_irqsave+0x5a/0x90 debug_dma_map_page+0x79/0x180 dma_map_page_attrs+0x1d2/0x2f0 bnxt_start_xmit+0x8c6/0x1540 netpoll_start_xmit+0x13f/0x180 netpoll_send_skb+0x20d/0x320 netpoll_send_udp+0x453/0x4a0 write_ext_msg+0x1b9/0x460 console_flush_all+0x2ff/0x5a0 console_unlock+0x55/0x180 vprintk_emit+0x2e3/0x3c0 devkmsg_emit+0x5a/0x80 devkmsg_write+0xfd/0x180 do_iter_readv_writev+0x164/0x1b0 vfs_writev+0xf9/0x2b0 do_writev+0x6d/0x110 do_syscall_64+0x80/0x150 entry_SYSCALL_64_after_hwframe+0x4b/0x53 -> #0 (console_owner){-.-.}-{0:0}: __lock_acquire+0x15d1/0x31a0 lock_acquire+0xe8/0x290 console_flush_all+0x2ea/0x5a0 console_unlock+0x55/0x180 vprintk_emit+0x2e3/0x3c0 _printk+0x59/0x80 warn_alloc+0x122/0x1b0 __alloc_pages_slowpath+0x1101/0x1120 __alloc_pages+0x1eb/0x2c0 alloc_slab_page+0x5f/0x150 new_slab+0x2dc/0x4e0 ___slab_alloc+0xdcb/0x1390 kmem_cache_alloc+0x23d/0x360 radix_tree_node_alloc+0x3c/0xf0 radix_tree_insert+0xf5/0x230 add_dma_entry+0xe9/0x360 dma_map_page_attrs+0x1d2/0x2f0 __bnxt_alloc_rx_frag+0x147/0x180 bnxt_alloc_rx_data+0x79/0x160 bnxt_rx_skb+0x29/0xc0 bnxt_rx_pkt+0xe22/0x1570 __bnxt_poll_work+0x101/0x390 bnxt_poll+0x7e/0x320 __napi_poll+0x29/0x160 net_rx_action+0x1e0/0x3e0 handle_softirqs+0x190/0x510 run_ksoftirqd+0x4e/0x90 smpboot_thread_fn+0x1a8/0x270 kthread+0x102/0x120 ret_from_fork+0x2f/0x40 ret_from_fork_asm+0x11/0x20 This bug is more likely than it seems, because when one CPU has run out of memory, chances are the other has too. The good news is, this bug is hidden behind the CONFIG_DMA_API_DEBUG, so not many users are likely to trigger it. Signed-off-by: Rik van Riel Reported-by: Konstantin Ovsepian Signed-off-by: Christoph Hellwig kernel/dma/debug.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) commit 61cbfb5368dd50ed0d65ce21d305aa923581db2b Author: Dumitru Ceclan Date: Tue Aug 6 11:51:33 2024 +0300 iio: adc: ad7124: fix DT configuration parsing The cfg pointer is set before reading the channel number that the configuration should point to. This causes configurations to be shifted by one channel. For example setting bipolar to the first channel defined in the DT will cause bipolar mode to be active on the second defined channel. Fix by moving the cfg pointer setting after reading the channel number. Fixes: 7b8d045e497a ("iio: adc: ad7124: allow more than 8 channels") Signed-off-by: Dumitru Ceclan Reviewed-by: Nuno Sa Link: https://patch.msgid.link/20240806085133.114547-1-dumitru.ceclan@analog.com Cc: Signed-off-by: Jonathan Cameron drivers/iio/adc/ad7124.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) commit e81bb580ec08d7503c14c92157d810d306290003 Author: Nuno Sa Date: Tue Aug 6 17:40:49 2024 +0200 iio: adc: ad_sigma_delta: fix irq_flags on irq request With commit 7b0c9f8fa3d2 ("iio: adc: ad_sigma_delta: Add optional irq selection"), we can get the irq line from struct ad_sigma_delta_info instead of the spi device. However, in devm_ad_sd_probe_trigger(), when getting the irq_flags with irq_get_trigger_type() we are still using the spi device irq instead of the one used for devm_request_irq(). Fixes: 7b0c9f8fa3d2 ("iio: adc: ad_sigma_delta: Add optional irq selection") Signed-off-by: Nuno Sa Link: https://patch.msgid.link/20240806-dev-fix-ad-sigma-delta-v1-1-aa25b173c063@analog.com Cc: Signed-off-by: Jonathan Cameron drivers/iio/adc/ad_sigma_delta.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit eb5e56d1491297e0881c95824e2050b7c205f0d4 Merge: b446a2dae984 3114f77e9453 Author: Linus Torvalds Date: Tue Aug 6 07:52:10 2024 -0700 Merge tag 'platform-drivers-x86-v6.11-2' of git://git.kernel.org/pub/scm/linux/kernel/git/pdx86/platform-drivers-x86 Pull x86 platform driver fixes from Ilpo Järvinen: "Fixes: - Fix ACPI notifier racing with itself (intel-vbtn) - Initialize local variable to cover a timeout corner case (intel/ifs) - WMI docs spelling New device IDs: - amd/{pmc,pmf}: AMD 1Ah model 60h series. - amd/pmf: SPS quirk support for ASUS ROG Ally X" * tag 'platform-drivers-x86-v6.11-2' of git://git.kernel.org/pub/scm/linux/kernel/git/pdx86/platform-drivers-x86: platform/x86/intel/ifs: Initialize union ifs_status to zero platform/x86: msi-wmi-platform: Fix spelling mistakes platform/x86/amd/pmf: Add new ACPI ID AMDI0107 platform/x86/amd/pmc: Send OS_HINT command for new AMD platform platform/x86/amd: pmf: Add quirk for ROG Ally X platform/x86: intel-vbtn: Protect ACPI notify handler against recursion commit ee9a68394b4bea8b9044ec4bfdbaacf45297ecef Author: Alexandre Ghiti Date: Thu Aug 1 21:14:04 2024 +0200 riscv: Re-introduce global icache flush in patch_text_XXX() commit edf2d546bfd6 ("riscv: patch: Flush the icache right after patching to avoid illegal insns") mistakenly removed the global icache flush in patch_text_nosync() and patch_text_set_nosync() functions, so reintroduce them. Fixes: edf2d546bfd6 ("riscv: patch: Flush the icache right after patching to avoid illegal insns") Reported-by: Samuel Holland Closes: https://lore.kernel.org/linux-riscv/a28ddc26-d77a-470a-a33f-88144f717e86@sifive.com/ Signed-off-by: Alexandre Ghiti Reviewed-by: Samuel Holland Reviewed-by: Charlie Jenkins Link: https://lore.kernel.org/r/20240801191404.55181-1-alexghiti@rivosinc.com Signed-off-by: Palmer Dabbelt arch/riscv/kernel/patch.c | 4 ++++ 1 file changed, 4 insertions(+) commit a44b7b57ef144052cd322880c4d2b3d52e563544 Merge: e42066df07c0 2c3640b82213 Author: Mark Brown Date: Tue Aug 6 13:42:45 2024 +0100 ASoC: Extend wm_adsp so cs35l56 can suppress controls Merge series from Simon Trimmer : This pair of patches extend wm_adsp to add a callback that can be used to control whether ALSA controls are added and then tweak cs35l56 to use it to suppress controls made from firmware coefficients. commit 8bdd9ef7e9b1b2a73e394712b72b22055e0e26c3 Author: Andi Shyti Date: Fri Aug 2 10:38:50 2024 +0200 drm/i915/gem: Fix Virtual Memory mapping boundaries calculation Calculating the size of the mapped area as the lesser value between the requested size and the actual size does not consider the partial mapping offset. This can cause page fault access. Fix the calculation of the starting and ending addresses, the total size is now deduced from the difference between the end and start addresses. Additionally, the calculations have been rewritten in a clearer and more understandable form. Fixes: c58305af1835 ("drm/i915: Use remap_io_mapping() to prefault all PTE in a single pass") Reported-by: Jann Horn Co-developed-by: Chris Wilson Signed-off-by: Chris Wilson Signed-off-by: Andi Shyti Cc: Joonas Lahtinen Cc: Matthew Auld Cc: Rodrigo Vivi Cc: # v4.9+ Reviewed-by: Jann Horn Reviewed-by: Jonathan Cavitt [Joonas: Add Requires: tag] Requires: 60a2066c5005 ("drm/i915/gem: Adjust vma offset for framebuffer mmap offset") Signed-off-by: Joonas Lahtinen Link: https://patchwork.freedesktop.org/patch/msgid/20240802083850.103694-3-andi.shyti@linux.intel.com (cherry picked from commit 97b6784753da06d9d40232328efc5c5367e53417) Signed-off-by: Joonas Lahtinen drivers/gpu/drm/i915/gem/i915_gem_mman.c | 53 ++++++++++++++++++++++++++++---- 1 file changed, 47 insertions(+), 6 deletions(-) commit 1ac5167b3a90c9820daa64cc65e319b2d958d686 Author: Andi Shyti Date: Fri Aug 2 10:38:49 2024 +0200 drm/i915/gem: Adjust vma offset for framebuffer mmap offset When mapping a framebuffer object, the virtual memory area (VMA) offset ('vm_pgoff') should be adjusted by the start of the 'vma_node' associated with the object. This ensures that the VMA offset is correctly aligned with the corresponding offset within the GGTT aperture. Increment vm_pgoff by the start of the vma_node with the offset= provided by the user. Suggested-by: Chris Wilson Signed-off-by: Andi Shyti Reviewed-by: Jonathan Cavitt Reviewed-by: Rodrigo Vivi Cc: # v4.9+ [Joonas: Add Cc: stable] Signed-off-by: Joonas Lahtinen Link: https://patchwork.freedesktop.org/patch/msgid/20240802083850.103694-2-andi.shyti@linux.intel.com (cherry picked from commit 60a2066c50058086510c91f404eb582029650970) Signed-off-by: Joonas Lahtinen drivers/gpu/drm/i915/gem/i915_gem_mman.c | 2 ++ 1 file changed, 2 insertions(+) commit 402d336053a5d827c70ec11109e079811e86e0e8 Author: Parth Pancholi Date: Tue Jul 30 11:37:54 2024 +0200 arm64: dts: ti: k3-j784s4-main: Correct McASP DMAs Correct the McASP nodes - mcasp3 and mcasp4 with the right DMAs thread IDs as per TISCI documentation [1] for J784s4. This fixes the related McASPs probe failure due to incorrect DMA IDs. Link: http://downloads.ti.com/tisci/esd/latest/5_soc_doc/j784s4/psil_cfg.html#psi-l-source-and-destination-thread-ids/ [1] Fixes: 5095ec4aa1ea ("arm64: dts: ti: k3-j784s4-main: Add McASP nodes") Signed-off-by: Parth Pancholi Reviewed-by: Jayesh Choudhary Link: https://lore.kernel.org/r/20240730093754.1659782-1-parth105105@gmail.com Signed-off-by: Nishanth Menon arch/arm64/boot/dts/ti/k3-j784s4-main.dtsi | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) commit 8de78e00986e883670d79d99d174626e4d4dabc5 Merge: 053ae05f8032 ac2b81eb8b2d Author: Marc Kleine-Budde Date: Tue Aug 6 09:52:53 2024 +0200 Merge patch series "can: mcp251xfd: fix ring/coalescing configuration" Marc Kleine-Budde says: When changing from CAN-CC to CAN-FD mode the ring and/or coalescing parameters might be too big. This series fixes the problem and adds a safeguard to detect broken coalescing configuration. Link: https://lore.kernel.org/all/20240805-mcp251xfd-fix-ringconfig-v1-0-72086f0ca5ee@pengutronix.de Signed-off-by: Marc Kleine-Budde commit ac2b81eb8b2d104033560daea886ee84531e3d0a Author: Marc Kleine-Budde Date: Fri Jul 5 17:24:42 2024 +0200 can: mcp251xfd: mcp251xfd_ring_init(): check TX-coalescing configuration When changing the interface from CAN-CC to CAN-FD mode the old coalescing parameters are re-used. This might cause problem, as the configured parameters are too big for CAN-FD mode. During testing an invalid TX coalescing configuration has been seen. The problem should be been fixed in the previous patch, but add a safeguard here to ensure that the number of TEF coalescing buffers (if configured) is exactly the half of all TEF buffers. Link: https://lore.kernel.org/all/20240805-mcp251xfd-fix-ringconfig-v1-2-72086f0ca5ee@pengutronix.de Signed-off-by: Marc Kleine-Budde drivers/net/can/spi/mcp251xfd/mcp251xfd-ring.c | 14 +++++++++++--- 1 file changed, 11 insertions(+), 3 deletions(-) commit 50ea5449c56310d2d31c28ba91a59232116d3c1e Author: Marc Kleine-Budde Date: Fri Jul 5 17:28:27 2024 +0200 can: mcp251xfd: fix ring configuration when switching from CAN-CC to CAN-FD mode If the ring (rx, tx) and/or coalescing parameters (rx-frames-irq, tx-frames-irq) have been configured while the interface was in CAN-CC mode, but the interface is brought up in CAN-FD mode, the ring parameters might be too big. Use the default CAN-FD values in this case. Fixes: 9263c2e92be9 ("can: mcp251xfd: ring: add support for runtime configurable RX/TX ring parameters") Link: https://lore.kernel.org/all/20240805-mcp251xfd-fix-ringconfig-v1-1-72086f0ca5ee@pengutronix.de Signed-off-by: Marc Kleine-Budde drivers/net/can/spi/mcp251xfd/mcp251xfd-ram.c | 11 ++++++++++- drivers/net/can/spi/mcp251xfd/mcp251xfd-ring.c | 20 +++++++++++++++++--- 2 files changed, 27 insertions(+), 4 deletions(-) commit 053ae05f8032937ded7049366f2e6e7b36c6d6e9 Merge: 06d4ef3056a7 e443d15b9499 Author: Marc Kleine-Budde Date: Tue Aug 6 09:27:41 2024 +0200 Merge patch series "can: m_can: Fix polling and other issues" Markus Schneider-Pargmann says: these are a number of fixes for m_can that fix polling mode and some other issues that I saw while working on the code. Changes in v2 ------------- - Fixed one multiline comment - Rebased to v6.11-rc1 Previous versions ----------------- v1: https://lore.kernel.org/lkml/20240726195944.2414812-1-msp@baylibre.com/ Link: https://lore.kernel.org/all/20240805183047.305630-1-msp@baylibre.com Signed-off-by: Marc Kleine-Budde commit e443d15b949952ee039b731d5c35bcbafa300024 Author: Markus Schneider-Pargmann Date: Mon Aug 5 20:30:47 2024 +0200 can: m_can: Limit coalescing to peripheral instances The use of coalescing for non-peripheral chips in the current implementation is limited to non-existing. Disable the possibility to set coalescing through ethtool. Signed-off-by: Markus Schneider-Pargmann Link: https://lore.kernel.org/all/20240805183047.305630-8-msp@baylibre.com Signed-off-by: Marc Kleine-Budde drivers/net/can/m_can/m_can.c | 16 +++++++++------- 1 file changed, 9 insertions(+), 7 deletions(-) commit 733dbf556cd5b71d5e6f6aa7a93f117b438ab785 Author: Markus Schneider-Pargmann Date: Mon Aug 5 20:30:46 2024 +0200 can: m_can: Reset cached active_interrupts on start To force writing the enabled interrupts, reset the active_interrupts cache. Fixes: 07f25091ca02 ("can: m_can: Implement receive coalescing") Signed-off-by: Markus Schneider-Pargmann Link: https://lore.kernel.org/all/20240805183047.305630-7-msp@baylibre.com Signed-off-by: Marc Kleine-Budde drivers/net/can/m_can/m_can.c | 1 + 1 file changed, 1 insertion(+) commit a572fea86c9b06cd3e6e89d79d565b52cb7e7cff Author: Markus Schneider-Pargmann Date: Mon Aug 5 20:30:45 2024 +0200 can: m_can: disable_all_interrupts, not clear active_interrupts active_interrupts is a cache for the enabled interrupts and not the global masking of interrupts. Do not clear this variable otherwise we may loose the state of the interrupts. Fixes: 07f25091ca02 ("can: m_can: Implement receive coalescing") Signed-off-by: Markus Schneider-Pargmann Link: https://lore.kernel.org/all/20240805183047.305630-6-msp@baylibre.com Signed-off-by: Marc Kleine-Budde drivers/net/can/m_can/m_can.c | 1 - 1 file changed, 1 deletion(-) commit 4d5159bfafa8d1a205d8213b7434e0402588b9ed Author: Markus Schneider-Pargmann Date: Mon Aug 5 20:30:44 2024 +0200 can: m_can: Do not cancel timer from within timer On setups without interrupts, the interrupt handler is called from a timer callback. For non-peripheral receives napi is scheduled, interrupts are disabled and the timer is canceled with a blocking call. In case of an error this can happen as well. Check if napi is scheduled in the timer callback after the interrupt handler executed. If napi is scheduled, the timer is disabled. It will be reenabled by m_can_poll(). Return error values from the interrupt handler so that interrupt threads and timer callback can deal differently with it. In case of the timer we only disable the timer. The rest will be done when stopping the interface. Fixes: b382380c0d2d ("can: m_can: Add hrtimer to generate software interrupt") Fixes: a163c5761019 ("can: m_can: Start/Cancel polling timer together with interrupts") Signed-off-by: Markus Schneider-Pargmann Link: https://lore.kernel.org/all/20240805183047.305630-5-msp@baylibre.com Signed-off-by: Marc Kleine-Budde drivers/net/can/m_can/m_can.c | 57 +++++++++++++++++++++++++++++++------------ 1 file changed, 42 insertions(+), 15 deletions(-) commit 40e4552eeef0e3090a5988de15889795936fd38f Author: Markus Schneider-Pargmann Date: Mon Aug 5 20:30:43 2024 +0200 can: m_can: Remove m_can_rx_peripheral indirection m_can_rx_peripheral() is a wrapper around m_can_rx_handler() that calls m_can_disable_all_interrupts() on error. The same handling for the same error path is done in m_can_isr() as well. So remove m_can_rx_peripheral() and do the call from m_can_isr() directly. Signed-off-by: Markus Schneider-Pargmann Link: https://lore.kernel.org/all/20240805183047.305630-4-msp@baylibre.com Signed-off-by: Marc Kleine-Budde drivers/net/can/m_can/m_can.c | 18 +----------------- 1 file changed, 1 insertion(+), 17 deletions(-) commit 6eff1cead75ff330bb33264424c1da6cc7179ab8 Author: Markus Schneider-Pargmann Date: Mon Aug 5 20:30:42 2024 +0200 can: m_can: Remove coalesing disable in isr during suspend We don't need to disable coalescing when the interrupt handler executes while the chip is suspended. The coalescing is already reset during suspend. Fixes: 07f25091ca02 ("can: m_can: Implement receive coalescing") Signed-off-by: Markus Schneider-Pargmann Link: https://lore.kernel.org/all/20240805183047.305630-3-msp@baylibre.com Signed-off-by: Marc Kleine-Budde drivers/net/can/m_can/m_can.c | 4 +--- 1 file changed, 1 insertion(+), 3 deletions(-) commit a651261ac74298535f6d6316ebe27beceb6b17b1 Author: Markus Schneider-Pargmann Date: Mon Aug 5 20:30:41 2024 +0200 can: m_can: Reset coalescing during suspend/resume During resume the interrupts are limited to IR_RF0N and the chip keeps running. In this case if coalescing is enabled and active we may miss waterlevel interrupts during suspend. It is safer to reset the coalescing by stopping the timer and adding IR_RF0N | IR_TEFN to the interrupts. This is a theoratical issue and probably extremely rare. Cc: Martin Hundebøll Fixes: 4a94d7e31cf5 ("can: m_can: allow keeping the transceiver running in suspend") Signed-off-by: Markus Schneider-Pargmann Link: https://lore.kernel.org/all/20240805183047.305630-2-msp@baylibre.com Signed-off-by: Marc Kleine-Budde drivers/net/can/m_can/m_can.c | 16 +++++++++++++--- 1 file changed, 13 insertions(+), 3 deletions(-) commit 06d4ef3056a7ac31be331281bb7a6302ef5a7f8a Author: Simon Horman Date: Mon Aug 5 15:01:58 2024 +0100 can: m_can: Release irq on error in m_can_open It appears that the irq requested in m_can_open() may be leaked if an error subsequently occurs: if m_can_start() fails. Address this by calling free_irq in the unwind path for such cases. Flagged by Smatch. Compile tested only. Fixes: eaacfeaca7ad ("can: m_can: Call the RAM init directly from m_can_chip_config") Acked-by: Marc Kleine-Budde Signed-off-by: Simon Horman Link: https://lore.kernel.org/all/20240805-mcan-irq-v2-1-7154c0484819@kernel.org Signed-off-by: Marc Kleine-Budde drivers/net/can/m_can/m_can.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) commit 76fe372ccb81b0c89b6cd2fec26e2f38c958be85 Author: Kuniyuki Iwashima Date: Mon Jul 22 12:28:42 2024 -0700 can: bcm: Remove proc entry when dev is unregistered. syzkaller reported a warning in bcm_connect() below. [0] The repro calls connect() to vxcan1, removes vxcan1, and calls connect() with ifindex == 0. Calling connect() for a BCM socket allocates a proc entry. Then, bcm_sk(sk)->bound is set to 1 to prevent further connect(). However, removing the bound device resets bcm_sk(sk)->bound to 0 in bcm_notify(). The 2nd connect() tries to allocate a proc entry with the same name and sets NULL to bcm_sk(sk)->bcm_proc_read, leaking the original proc entry. Since the proc entry is available only for connect()ed sockets, let's clean up the entry when the bound netdev is unregistered. [0]: proc_dir_entry 'can-bcm/2456' already registered WARNING: CPU: 1 PID: 394 at fs/proc/generic.c:376 proc_register+0x645/0x8f0 fs/proc/generic.c:375 Modules linked in: CPU: 1 PID: 394 Comm: syz-executor403 Not tainted 6.10.0-rc7-g852e42cc2dd4 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.3-0-ga6ed6b701f0a-prebuilt.qemu.org 04/01/2014 RIP: 0010:proc_register+0x645/0x8f0 fs/proc/generic.c:375 Code: 00 00 00 00 00 48 85 ed 0f 85 97 02 00 00 4d 85 f6 0f 85 9f 02 00 00 48 c7 c7 9b cb cf 87 48 89 de 4c 89 fa e8 1c 6f eb fe 90 <0f> 0b 90 90 48 c7 c7 98 37 99 89 e8 cb 7e 22 05 bb 00 00 00 10 48 RSP: 0018:ffa0000000cd7c30 EFLAGS: 00010246 RAX: 9e129be1950f0200 RBX: ff1100011b51582c RCX: ff1100011857cd80 RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000002 RBP: 0000000000000000 R08: ffd400000000000f R09: ff1100013e78cac0 R10: ffac800000cd7980 R11: ff1100013e12b1f0 R12: 0000000000000000 R13: 0000000000000000 R14: 0000000000000000 R15: ff1100011a99a2ec FS: 00007fbd7086f740(0000) GS:ff1100013fd00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00000000200071c0 CR3: 0000000118556004 CR4: 0000000000771ef0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe07f0 DR7: 0000000000000400 PKRU: 55555554 Call Trace: proc_create_net_single+0x144/0x210 fs/proc/proc_net.c:220 bcm_connect+0x472/0x840 net/can/bcm.c:1673 __sys_connect_file net/socket.c:2049 [inline] __sys_connect+0x5d2/0x690 net/socket.c:2066 __do_sys_connect net/socket.c:2076 [inline] __se_sys_connect net/socket.c:2073 [inline] __x64_sys_connect+0x8f/0x100 net/socket.c:2073 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xd9/0x1c0 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x4b/0x53 RIP: 0033:0x7fbd708b0e5d Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 90 f3 0f 1e fa 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 8b 0d 73 9f 1b 00 f7 d8 64 89 01 48 RSP: 002b:00007fff8cd33f08 EFLAGS: 00000246 ORIG_RAX: 000000000000002a RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00007fbd708b0e5d RDX: 0000000000000010 RSI: 0000000020000040 RDI: 0000000000000003 RBP: 0000000000000000 R08: 0000000000000040 R09: 0000000000000040 R10: 0000000000000040 R11: 0000000000000246 R12: 00007fff8cd34098 R13: 0000000000401280 R14: 0000000000406de8 R15: 00007fbd70ab9000 remove_proc_entry: removing non-empty directory 'net/can-bcm', leaking at least '2456' Fixes: ffd980f976e7 ("[CAN]: Add broadcast manager (bcm) protocol") Reported-by: syzkaller Signed-off-by: Kuniyuki Iwashima Reviewed-by: Simon Horman Link: https://lore.kernel.org/all/20240722192842.37421-1-kuniyu@amazon.com Signed-off-by: Marc Kleine-Budde net/can/bcm.c | 4 ++++ 1 file changed, 4 insertions(+) commit 176fd1511dd9086ab4fa9323cb232177c6235288 Author: Takashi Iwai Date: Tue Aug 6 08:49:16 2024 +0200 ALSA: hda/hdmi: Yet more pin fix for HP EliteDesk 800 G4 HP EliteDesk 800 G4 (PCI SSID 103c:83e2) is another Kabylake machine where BIOS misses the HDMI pin initializations. Add the quirk entry. Cc: Link: https://patch.msgid.link/20240806064918.11132-1-tiwai@suse.de Signed-off-by: Takashi Iwai sound/pci/hda/patch_hdmi.c | 1 + 1 file changed, 1 insertion(+) commit b82c1d235a30622177ce10dcb94dfd691a49922f Author: Arnd Bergmann Date: Mon Aug 5 22:38:29 2024 +0200 syscalls: add back legacy __NR_nfsservctl macro The conversion from the old unistd.h file to syscall.tbl dropped the nfsservctl macro. This one was handled inconsistently across architectures in the original introduction of the syscall.tbl format, and I went the other way on this. The syscall was already gone in linux-3.1 before the current users of the generic table (other than openrisc) first appeared, so nobody could actally use it, but putting the number back helps for consistency since there are build scripts that check the presence of all these macros. Link: https://bugzilla.redhat.com/show_bug.cgi?id=2301919 Signed-off-by: Arnd Bergmann scripts/syscall.tbl | 1 + 1 file changed, 1 insertion(+) commit 7e1e206b99f4b3345aeb49d94584a420b7887f1d Author: Steven 'Steve' Kendall Date: Tue Aug 6 00:08:24 2024 +0000 ALSA: hda: Add HP MP9 G4 Retail System AMS to force connect list In recent HP UEFI firmware (likely v2.15 and above, tested on 2.27), these pins are incorrectly set for HDMI/DP audio. Tested on HP MP9 G4 Retail System AMS. Tested audio with two monitors connected via DisplayPort. Link: https://forum.manjaro.org/t/intel-cannon-lake-pch-cavs-conexant-cx20632-no-sound-at-hdmi-or-displayport/133494 Link: https://bbs.archlinux.org/viewtopic.php?id=270523 Signed-off-by: Steven 'Steve' Kendall Cc: Link: https://patch.msgid.link/20240806-hdmi-audio-hp-wrongpins-v2-1-d9eb4ad41043@chromium.org Signed-off-by: Takashi Iwai sound/pci/hda/patch_hdmi.c | 1 + 1 file changed, 1 insertion(+) commit 5a44bb061d04b0306f2aa8add761d86d152b9377 Author: Michael Mueller Date: Thu Aug 1 14:31:09 2024 +0200 KVM: s390: fix validity interception issue when gisa is switched off We might run into a SIE validity if gisa has been disabled either via using kernel parameter "kvm.use_gisa=0" or by setting the related sysfs attribute to N (echo N >/sys/module/kvm/parameters/use_gisa). The validity is caused by an invalid value in the SIE control block's gisa designation. That happens because we pass the uninitialized gisa origin to virt_to_phys() before writing it to the gisa designation. To fix this we return 0 in kvm_s390_get_gisa_desc() if the origin is 0. kvm_s390_get_gisa_desc() is used to determine which gisa designation to set in the SIE control block. A value of 0 in the gisa designation disables gisa usage. The issue surfaces in the host kernel with the following kernel message as soon a new kvm guest start is attemted. kvm: unhandled validity intercept 0x1011 WARNING: CPU: 0 PID: 781237 at arch/s390/kvm/intercept.c:101 kvm_handle_sie_intercept+0x42e/0x4d0 [kvm] Modules linked in: vhost_net tap tun xt_CHECKSUM xt_MASQUERADE xt_conntrack ipt_REJECT xt_tcpudp nft_compat x_tables nf_nat_tftp nf_conntrack_tftp vfio_pci_core irqbypass vhost_vsock vmw_vsock_virtio_transport_common vsock vhost vhost_iotlb kvm nft_fib_inet nft_fib_ipv4 nft_fib_ipv6 nft_fib nft_reject_inet nf_reject_ipv4 nf_reject_ipv6 nft_reject nft_ct nft_chain_nat nf_nat nf_conntrack nf_defrag_ipv6 nf_defrag_ipv4 ip_set nf_tables sunrpc mlx5_ib ib_uverbs ib_core mlx5_core uvdevice s390_trng eadm_sch vfio_ccw zcrypt_cex4 mdev vfio_iommu_type1 vfio sch_fq_codel drm i2c_core loop drm_panel_orientation_quirks configfs nfnetlink lcs ctcm fsm dm_service_time ghash_s390 prng chacha_s390 libchacha aes_s390 des_s390 libdes sha3_512_s390 sha3_256_s390 sha512_s390 sha256_s390 sha1_s390 sha_common dm_mirror dm_region_hash dm_log zfcp scsi_transport_fc scsi_dh_rdac scsi_dh_emc scsi_dh_alua pkey zcrypt dm_multipath rng_core autofs4 [last unloaded: vfio_pci] CPU: 0 PID: 781237 Comm: CPU 0/KVM Not tainted 6.10.0-08682-gcad9f11498ea #6 Hardware name: IBM 3931 A01 701 (LPAR) Krnl PSW : 0704c00180000000 000003d93deb0122 (kvm_handle_sie_intercept+0x432/0x4d0 [kvm]) R:0 T:1 IO:1 EX:1 Key:0 M:1 W:0 P:0 AS:3 CC:0 PM:0 RI:0 EA:3 Krnl GPRS: 000003d900000027 000003d900000023 0000000000000028 000002cd00000000 000002d063a00900 00000359c6daf708 00000000000bebb5 0000000000001eff 000002cfd82e9000 000002cfd80bc000 0000000000001011 000003d93deda412 000003ff8962df98 000003d93de77ce0 000003d93deb011e 00000359c6daf960 Krnl Code: 000003d93deb0112: c020fffe7259 larl %r2,000003d93de7e5c4 000003d93deb0118: c0e53fa8beac brasl %r14,000003d9bd3c7e70 #000003d93deb011e: af000000 mc 0,0 >000003d93deb0122: a728ffea lhi %r2,-22 000003d93deb0126: a7f4fe24 brc 15,000003d93deafd6e 000003d93deb012a: 9101f0b0 tm 176(%r15),1 000003d93deb012e: a774fe48 brc 7,000003d93deafdbe 000003d93deb0132: 40a0f0ae sth %r10,174(%r15) Call Trace: [<000003d93deb0122>] kvm_handle_sie_intercept+0x432/0x4d0 [kvm] ([<000003d93deb011e>] kvm_handle_sie_intercept+0x42e/0x4d0 [kvm]) [<000003d93deacc10>] vcpu_post_run+0x1d0/0x3b0 [kvm] [<000003d93deaceda>] __vcpu_run+0xea/0x2d0 [kvm] [<000003d93dead9da>] kvm_arch_vcpu_ioctl_run+0x16a/0x430 [kvm] [<000003d93de93ee0>] kvm_vcpu_ioctl+0x190/0x7c0 [kvm] [<000003d9bd728b4e>] vfs_ioctl+0x2e/0x70 [<000003d9bd72a092>] __s390x_sys_ioctl+0xc2/0xd0 [<000003d9be0e9222>] __do_syscall+0x1f2/0x2e0 [<000003d9be0f9a90>] system_call+0x70/0x98 Last Breaking-Event-Address: [<000003d9bd3c7f58>] __warn_printk+0xe8/0xf0 Cc: stable@vger.kernel.org Reported-by: Christian Borntraeger Fixes: fe0ef0030463 ("KVM: s390: sort out physical vs virtual pointers usage") Signed-off-by: Michael Mueller Tested-by: Christian Borntraeger Reviewed-by: Janosch Frank Link: https://lore.kernel.org/r/20240801123109.2782155-1-mimu@linux.ibm.com Message-ID: <20240801123109.2782155-1-mimu@linux.ibm.com> Signed-off-by: Janosch Frank arch/s390/kvm/kvm-s390.h | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) commit 33330bcf031818e60a816db0cfd3add9eecc3b28 Author: Anders Roxell Date: Mon Aug 5 11:22:34 2024 +0200 scripts: kconfig: merge_config: config files: add a trailing newline When merging files without trailing newlines at the end of the file, two config fragments end up at the same row if file1.config doens't have a trailing newline at the end of the file. file1.config "CONFIG_1=y" file2.config "CONFIG_2=y" ./scripts/kconfig/merge_config.sh -m .config file1.config file2.config This will generate a .config looking like this. cat .config ... CONFIG_1=yCONFIG_2=y" Making sure so we add a newline at the end of every config file that is passed into the script. Signed-off-by: Anders Roxell Signed-off-by: Masahiro Yamada scripts/kconfig/merge_config.sh | 2 ++ 1 file changed, 2 insertions(+) commit e2006140ad2e01a02ed0aff49cc2ae3ceeb11f8d Author: Mika Westerberg Date: Thu Jun 13 15:05:03 2024 +0300 thunderbolt: Mark XDomain as unplugged when router is removed I noticed that when we do discrete host router NVM upgrade and it gets hot-removed from the PCIe side as a result of NVM firmware authentication, if there is another host connected with enabled paths we hang in tearing them down. This is due to fact that the Thunderbolt networking driver also tries to cleanup the paths and ends up blocking in tb_disconnect_xdomain_paths() waiting for the domain lock. However, at this point we already cleaned the paths in tb_stop() so there is really no need for tb_disconnect_xdomain_paths() to do that anymore. Furthermore it already checks if the XDomain is unplugged and bails out early so take advantage of that and mark the XDomain as unplugged when we remove the parent router. Cc: stable@vger.kernel.org Signed-off-by: Mika Westerberg drivers/thunderbolt/switch.c | 1 + 1 file changed, 1 insertion(+) commit 6fc9aacad49e3fbecd270c266850d50c453d52ef Author: Alexandre Courbot Date: Sun Aug 4 14:50:57 2024 +0900 Makefile: add $(srctree) to dependency of compile_commands.json target When trying to build compile_commands.json for an external module against the kernel built in a separate output directory, the following error is displayed: make[1]: *** No rule to make target 'scripts/clang-tools/gen_compile_commands.py', needed by 'compile_commands.json'. Stop. This is because gen_compile_commands.py was previously looked up using a relative path to $(srctree), but commit b1992c3772e6 ("kbuild: use $(src) instead of $(srctree)/$(src) for source directory") stopped defining VPATH for external module builds. Prefixing gen_compile_commands.py with $(srctree) fixes the problem. Fixes: b1992c3772e6 ("kbuild: use $(src) instead of $(srctree)/$(src) for source directory") Signed-off-by: Alexandre Courbot Reviewed-by: Nicolas Schier Signed-off-by: Masahiro Yamada Makefile | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 8fcd8d1e63c05c48b3ac16d0c3e2cd6a7a5c8ec4 Author: Masahiro Yamada Date: Fri Jul 26 04:23:14 2024 +0900 kbuild: clean up code duplication in cmd_fdtoverlay When resolving a merge conflict, Linus noticed the fdtoverlay command duplication introduced by commit 49636c5680b9 ("kbuild: verify dtoverlay files against schema"). He suggested a clean-up. I eliminated the duplication and refactored the code a little further. No functional changes are intended, except for the short logs. The log will look as follows: $ make ARCH=arm64 defconfig dtbs_check [ snip ] DTC [C] arch/arm64/boot/dts/freescale/imx93-tqma9352-mba93xxca.dtb DTC [C] arch/arm64/boot/dts/freescale/imx93-tqma9352-mba93xxla.dtb DTC [C] arch/arm64/boot/dts/freescale/imx93-var-som-symphony.dtb DTC [C] arch/arm64/boot/dts/freescale/imx95-19x19-evk.dtb DTC arch/arm64/boot/dts/freescale/imx8mm-venice-gw72xx-0x-imx219.dtbo OVL [C] arch/arm64/boot/dts/freescale/imx8mm-venice-gw72xx-0x-imx219.dtb The tag [C] indicates that the schema check is executed. Link: https://lore.kernel.org/lkml/CAHk-=wiF3yeWehcvqY-4X7WNb8n4yw_5t0H1CpEpKi7JMjaMfw@mail.gmail.com/#t Requested-by: Linus Torvalds Signed-off-by: Masahiro Yamada Reviewed-by: Nicolas Schier scripts/Makefile.lib | 28 ++++++++++------------------ 1 file changed, 10 insertions(+), 18 deletions(-) commit c4c8f369b6a6d21ce27286de1501137771e01dc3 Author: Uros Bizjak Date: Mon Aug 5 09:30:29 2024 +0200 workqueue: Correct declaration of cpu_pwq in struct workqueue_struct cpu_pwq is used in various percpu functions that expect variable in __percpu address space. Correct the declaration of cpu_pwq to struct pool_workqueue __rcu * __percpu *cpu_pwq to declare the variable as __percpu pointer. The patch also fixes following sparse errors: workqueue.c:380:37: warning: duplicate [noderef] workqueue.c:380:37: error: multiple address spaces given: __rcu & __percpu workqueue.c:2271:15: error: incompatible types in comparison expression (different address spaces): workqueue.c:2271:15: struct pool_workqueue [noderef] __rcu * workqueue.c:2271:15: struct pool_workqueue [noderef] __percpu * and uncovers a couple of exisiting "incorrect type in assignment" warnings (from __rcu address space), which this patch does not address. Found by GCC's named address space checks. There were no changes in the resulting object files. Signed-off-by: Uros Bizjak Cc: Tejun Heo Cc: Lai Jiangshan Signed-off-by: Tejun Heo kernel/workqueue.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 8bc35475ef1a23b0e224f3242eb11c76cab0ea88 Author: Tejun Heo Date: Mon Aug 5 09:37:25 2024 -1000 workqueue: Fix spruious data race in __flush_work() When flushing a work item for cancellation, __flush_work() knows that it exclusively owns the work item through its PENDING bit. 134874e2eee9 ("workqueue: Allow cancel_work_sync() and disable_work() from atomic contexts on BH work items") added a read of @work->data to determine whether to use busy wait for BH work items that are being canceled. While the read is safe when @from_cancel, @work->data was read before testing @from_cancel to simplify code structure: data = *work_data_bits(work); if (from_cancel && !WARN_ON_ONCE(data & WORK_STRUCT_PWQ) && (data & WORK_OFFQ_BH)) { While the read data was never used if !@from_cancel, this could trigger KCSAN data race detection spuriously: ================================================================== BUG: KCSAN: data-race in __flush_work / __flush_work write to 0xffff8881223aa3e8 of 8 bytes by task 3998 on cpu 0: instrument_write include/linux/instrumented.h:41 [inline] ___set_bit include/asm-generic/bitops/instrumented-non-atomic.h:28 [inline] insert_wq_barrier kernel/workqueue.c:3790 [inline] start_flush_work kernel/workqueue.c:4142 [inline] __flush_work+0x30b/0x570 kernel/workqueue.c:4178 flush_work kernel/workqueue.c:4229 [inline] ... read to 0xffff8881223aa3e8 of 8 bytes by task 50 on cpu 1: __flush_work+0x42a/0x570 kernel/workqueue.c:4188 flush_work kernel/workqueue.c:4229 [inline] flush_delayed_work+0x66/0x70 kernel/workqueue.c:4251 ... value changed: 0x0000000000400000 -> 0xffff88810006c00d Reorganize the code so that @from_cancel is tested before @work->data is accessed. The only problem is triggering KCSAN detection spuriously. This shouldn't need READ_ONCE() or other access qualifiers. No functional changes. Signed-off-by: Tejun Heo Reported-by: syzbot+b3e4f2f51ed645fd5df2@syzkaller.appspotmail.com Fixes: 134874e2eee9 ("workqueue: Allow cancel_work_sync() and disable_work() from atomic contexts on BH work items") Link: http://lkml.kernel.org/r/000000000000ae429e061eea2157@google.com Cc: Jens Axboe kernel/workqueue.c | 45 +++++++++++++++++++++++++-------------------- 1 file changed, 25 insertions(+), 20 deletions(-) commit 98cc1730c89467fc26e2dc2ceb2a014f332daa97 Author: Lai Jiangshan Date: Thu Jul 25 09:04:37 2024 +0800 workqueue: Remove incorrect "WARN_ON_ONCE(!list_empty(&worker->entry));" from dying worker The commit 68f83057b913 ("workqueue: Reap workers via kthread_stop() and remove detach_completion") changes the procedure of destroying workers; the dying workers are kept in the cull_list in wake_dying_workers() with the pool lock held and removed from the cull_list by the newly added reap_dying_workers() without the pool lock. This can cause a warning if the dying worker is wokenup earlier than reaped as reported by Marc: 2024/07/23 18:01:21 [M83LP63]: [ 157.267727] ------------[ cut here ]------------ 2024/07/23 18:01:21 [M83LP63]: [ 157.267735] WARNING: CPU: 21 PID: 725 at kernel/workqueue.c:3340 worker_thread+0x54e/0x558 2024/07/23 18:01:21 [M83LP63]: [ 157.267746] Modules linked in: binfmt_misc nft_fib_inet nft_fib_ipv4 nft_fib_ipv6 nft_fib nft_reject_inet nf_reject_ipv4 nf_reject_ipv6 nft_reject nft_ct nft_chain_nat nf_nat nf_conntrack nf_defrag_ipv6 nf_defrag_ipv4 ip_set nf_tables sunrpc dm_service_time s390_trng vfio_ccw mdev vfio_iommu_type1 vfio sch_fq_codel 2024/07/23 18:01:21 [M83LP63]: loop dm_multipath configfs nfnetlink lcs ctcm fsm zfcp scsi_transport_fc ghash_s390 prng chacha_s390 libchacha aes_s390 des_s390 libdes sha3_512_s390 sha3_256_s390 sha512_s390 sha256_s390 sha1_s390 sha_common scm_block eadm_sch scsi_dh_rdac scsi_dh_emc scsi_dh_alua pkey zcrypt rng_core autofs4 2024/07/23 18:01:21 [M83LP63]: [ 157.267792] CPU: 21 PID: 725 Comm: kworker/dying Not tainted 6.10.0-rc2-00239-g68f83057b913 #95 2024/07/23 18:01:21 [M83LP63]: [ 157.267796] Hardware name: IBM 3906 M04 704 (LPAR) 2024/07/23 18:01:21 [M83LP63]: [ 157.267802] R:0 T:1 IO:1 EX:1 Key:0 M:1 W:0 P:0 AS:3 CC:1 PM:0 RI:0 EA:3 2024/07/23 18:01:21 [M83LP63]: [ 157.267797] Krnl PSW : 0704d00180000000 000003d600fcd9fa (worker_thread+0x552/0x558) 2024/07/23 18:01:21 [M83LP63]: [ 157.267806] Krnl GPRS: 6479696e6700776f 000002c901b62780 000003d602493ec8 000002c914954600 2024/07/23 18:01:21 [M83LP63]: [ 157.267809] 0000000000000000 0000000000000008 000002c901a85400 000002c90719e840 2024/07/23 18:01:21 [M83LP63]: [ 157.267811] 000002c90719e880 000002c901a85420 000002c91127adf0 000002c901a85400 2024/07/23 18:01:21 [M83LP63]: [ 157.267813] 000002c914954600 0000000000000000 000003d600fcd772 000003560452bd98 2024/07/23 18:01:21 [M83LP63]: [ 157.267822] Krnl Code: 000003d600fcd9ec: c0e500674262 brasl %r14,000003d601cb5eb0 2024/07/23 18:01:21 [M83LP63]: [ 157.267822] 000003d600fcd9f2: a7f4ffc8 brc 15,000003d600fcd982 2024/07/23 18:01:21 [M83LP63]: [ 157.267822] #000003d600fcd9f6: af000000 mc 0,0 2024/07/23 18:01:21 [M83LP63]: [ 157.267822] >000003d600fcd9fa: a7f4fec2 brc 15,000003d600fcd77e 2024/07/23 18:01:21 [M83LP63]: [ 157.267822] 000003d600fcd9fe: 0707 bcr 0,%r7 2024/07/23 18:01:21 [M83LP63]: [ 157.267822] 000003d600fcda00: c00400682e10 brcl 0,000003d601cd3620 2024/07/23 18:01:21 [M83LP63]: [ 157.267822] 000003d600fcda06: eb7ff0500024 stmg %r7,%r15,80(%r15) 2024/07/23 18:01:21 [M83LP63]: [ 157.267822] 000003d600fcda0c: b90400ef lgr %r14,%r15 2024/07/23 18:01:21 [M83LP63]: [ 157.267853] Call Trace: 2024/07/23 18:01:21 [M83LP63]: [ 157.267855] [<000003d600fcd9fa>] worker_thread+0x552/0x558 2024/07/23 18:01:21 [M83LP63]: [ 157.267859] ([<000003d600fcd772>] worker_thread+0x2ca/0x558) 2024/07/23 18:01:21 [M83LP63]: [ 157.267862] [<000003d600fd6c80>] kthread+0x120/0x128 2024/07/23 18:01:21 [M83LP63]: [ 157.267865] [<000003d600f5305c>] __ret_from_fork+0x3c/0x58 2024/07/23 18:01:21 [M83LP63]: [ 157.267868] [<000003d601cc746a>] ret_from_fork+0xa/0x30 2024/07/23 18:01:21 [M83LP63]: [ 157.267873] Last Breaking-Event-Address: 2024/07/23 18:01:21 [M83LP63]: [ 157.267874] [<000003d600fcd778>] worker_thread+0x2d0/0x558 Since the procedure of destroying workers is changed, the WARN_ON_ONCE() becomes incorrect and should be removed. Cc: Marc Hartmayer Link: https://lore.kernel.org/lkml/87le1sjd2e.fsf@linux.ibm.com/ Reported-by: Marc Hartmayer Fixes: 68f83057b913 ("workqueue: Reap workers via kthread_stop() and remove detach_completion") Cc: stable@vger.kernel.org # v6.11+ Signed-off-by: Lai Jiangshan Signed-off-by: Tejun Heo kernel/workqueue.c | 1 - 1 file changed, 1 deletion(-) commit 38f7e14519d39cf524ddc02d4caee9b337dad703 Author: Will Deacon Date: Tue Jul 30 12:44:31 2024 +0100 workqueue: Fix UBSAN 'subtraction overflow' error in shift_and_mask() UBSAN reports the following 'subtraction overflow' error when booting in a virtual machine on Android: | Internal error: UBSAN: integer subtraction overflow: 00000000f2005515 [#1] PREEMPT SMP | Modules linked in: | CPU: 0 PID: 1 Comm: swapper/0 Not tainted 6.10.0-00006-g3cbe9e5abd46-dirty #4 | Hardware name: linux,dummy-virt (DT) | pstate: 600000c5 (nZCv daIF -PAN -UAO -TCO -DIT -SSBS BTYPE=--) | pc : cancel_delayed_work+0x34/0x44 | lr : cancel_delayed_work+0x2c/0x44 | sp : ffff80008002ba60 | x29: ffff80008002ba60 x28: 0000000000000000 x27: 0000000000000000 | x26: 0000000000000000 x25: 0000000000000000 x24: 0000000000000000 | x23: 0000000000000000 x22: 0000000000000000 x21: ffff1f65014cd3c0 | x20: ffffc0e84c9d0da0 x19: ffffc0e84cab3558 x18: ffff800080009058 | x17: 00000000247ee1f8 x16: 00000000247ee1f8 x15: 00000000bdcb279d | x14: 0000000000000001 x13: 0000000000000075 x12: 00000a0000000000 | x11: ffff1f6501499018 x10: 00984901651fffff x9 : ffff5e7cc35af000 | x8 : 0000000000000001 x7 : 3d4d455453595342 x6 : 000000004e514553 | x5 : ffff1f6501499265 x4 : ffff1f650ff60b10 x3 : 0000000000000620 | x2 : ffff80008002ba78 x1 : 0000000000000000 x0 : 0000000000000000 | Call trace: | cancel_delayed_work+0x34/0x44 | deferred_probe_extend_timeout+0x20/0x70 | driver_register+0xa8/0x110 | __platform_driver_register+0x28/0x3c | syscon_init+0x24/0x38 | do_one_initcall+0xe4/0x338 | do_initcall_level+0xac/0x178 | do_initcalls+0x5c/0xa0 | do_basic_setup+0x20/0x30 | kernel_init_freeable+0x8c/0xf8 | kernel_init+0x28/0x1b4 | ret_from_fork+0x10/0x20 | Code: f9000fbf 97fffa2f 39400268 37100048 (d42aa2a0) | ---[ end trace 0000000000000000 ]--- | Kernel panic - not syncing: UBSAN: integer subtraction overflow: Fatal exception This is due to shift_and_mask() using a signed immediate to construct the mask and being called with a shift of 31 (WORK_OFFQ_POOL_SHIFT) so that it ends up decrementing from INT_MIN. Use an unsigned constant '1U' to generate the mask in shift_and_mask(). Cc: Tejun Heo Cc: Lai Jiangshan Fixes: 1211f3b21c2a ("workqueue: Preserve OFFQ bits in cancel[_sync] paths") Signed-off-by: Will Deacon Signed-off-by: Tejun Heo kernel/workqueue.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 44732f1dad20457d64c525549cd63dcef2563c23 Author: Nikita Shubin Date: Fri Jul 19 17:30:16 2024 +0300 workqueue: doc: Fix function name, remove markers - s/alloc_ordered_queue()/alloc_ordered_workqueue()/ - remove markers to convert it into a link. Signed-off-by: Nikita Shubin Signed-off-by: Tejun Heo Documentation/core-api/workqueue.rst | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 92c4ee25208d0f35dafc3213cdf355fbe449e078 Author: Nikolay Aleksandrov Date: Fri Aug 2 11:07:30 2024 +0300 net: bridge: mcast: wait for previous gc cycles when removing port syzbot hit a use-after-free[1] which is caused because the bridge doesn't make sure that all previous garbage has been collected when removing a port. What happens is: CPU 1 CPU 2 start gc cycle remove port acquire gc lock first wait for lock call br_multicasg_gc() directly acquire lock now but free port the port can be freed while grp timers still running Make sure all previous gc cycles have finished by using flush_work before freeing the port. [1] BUG: KASAN: slab-use-after-free in br_multicast_port_group_expired+0x4c0/0x550 net/bridge/br_multicast.c:861 Read of size 8 at addr ffff888071d6d000 by task syz.5.1232/9699 CPU: 1 PID: 9699 Comm: syz.5.1232 Not tainted 6.10.0-rc5-syzkaller-00021-g24ca36a562d6 #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/07/2024 Call Trace: __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0x116/0x1f0 lib/dump_stack.c:114 print_address_description mm/kasan/report.c:377 [inline] print_report+0xc3/0x620 mm/kasan/report.c:488 kasan_report+0xd9/0x110 mm/kasan/report.c:601 br_multicast_port_group_expired+0x4c0/0x550 net/bridge/br_multicast.c:861 call_timer_fn+0x1a3/0x610 kernel/time/timer.c:1792 expire_timers kernel/time/timer.c:1843 [inline] __run_timers+0x74b/0xaf0 kernel/time/timer.c:2417 __run_timer_base kernel/time/timer.c:2428 [inline] __run_timer_base kernel/time/timer.c:2421 [inline] run_timer_base+0x111/0x190 kernel/time/timer.c:2437 Reported-by: syzbot+263426984509be19c9a0@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=263426984509be19c9a0 Fixes: e12cec65b554 ("net: bridge: mcast: destroy all entries via gc") Signed-off-by: Nikolay Aleksandrov Link: https://patch.msgid.link/20240802080730.3206303-1-razor@blackwall.org Signed-off-by: Jakub Kicinski net/bridge/br_multicast.c | 4 +--- 1 file changed, 1 insertion(+), 3 deletions(-) commit 9a2fa1472083580b6c66bdaf291f591e1170123a Author: Al Viro Date: Sat Aug 3 18:02:00 2024 -0400 fix bitmap corruption on close_range() with CLOSE_RANGE_UNSHARE copy_fd_bitmaps(new, old, count) is expected to copy the first count/BITS_PER_LONG bits from old->full_fds_bits[] and fill the rest with zeroes. What it does is copying enough words (BITS_TO_LONGS(count/BITS_PER_LONG)), then memsets the rest. That works fine, *if* all bits past the cutoff point are clear. Otherwise we are risking garbage from the last word we'd copied. For most of the callers that is true - expand_fdtable() has count equal to old->max_fds, so there's no open descriptors past count, let alone fully occupied words in ->open_fds[], which is what bits in ->full_fds_bits[] correspond to. The other caller (dup_fd()) passes sane_fdtable_size(old_fdt, max_fds), which is the smallest multiple of BITS_PER_LONG that covers all opened descriptors below max_fds. In the common case (copying on fork()) max_fds is ~0U, so all opened descriptors will be below it and we are fine, by the same reasons why the call in expand_fdtable() is safe. Unfortunately, there is a case where max_fds is less than that and where we might, indeed, end up with junk in ->full_fds_bits[] - close_range(from, to, CLOSE_RANGE_UNSHARE) with * descriptor table being currently shared * 'to' being above the current capacity of descriptor table * 'from' being just under some chunk of opened descriptors. In that case we end up with observably wrong behaviour - e.g. spawn a child with CLONE_FILES, get all descriptors in range 0..127 open, then close_range(64, ~0U, CLOSE_RANGE_UNSHARE) and watch dup(0) ending up with descriptor #128, despite #64 being observably not open. The minimally invasive fix would be to deal with that in dup_fd(). If this proves to add measurable overhead, we can go that way, but let's try to fix copy_fd_bitmaps() first. * new helper: bitmap_copy_and_expand(to, from, bits_to_copy, size). * make copy_fd_bitmaps() take the bitmap size in words, rather than bits; it's 'count' argument is always a multiple of BITS_PER_LONG, so we are not losing any information, and that way we can use the same helper for all three bitmaps - compiler will see that count is a multiple of BITS_PER_LONG for the large ones, so it'll generate plain memcpy()+memset(). Reproducer added to tools/testing/selftests/core/close_range_test.c Cc: stable@vger.kernel.org Signed-off-by: Al Viro fs/file.c | 30 +++++++++------------ include/linux/bitmap.h | 12 +++++++++ tools/testing/selftests/core/close_range_test.c | 35 +++++++++++++++++++++++++ 3 files changed, 60 insertions(+), 17 deletions(-) commit f32e90c0688a3d1f8079ac18ed39b752d22e92bd Author: Thorsten Blum Date: Tue Jul 23 18:53:31 2024 +0200 gcc-plugins: randstruct: Remove GCC 4.7 or newer requirement Since the kernel currently requires GCC 5.1 as a minimum, remove the unnecessary GCC version >= 4.7 check. Signed-off-by: Thorsten Blum Link: https://lore.kernel.org/r/20240723165332.1947-1-thorsten.blum@toblux.com Signed-off-by: Kees Cook scripts/gcc-plugins/randomize_layout_plugin.c | 4 ---- 1 file changed, 4 deletions(-) commit f91f7ac900e7342e0fd66093dfbf7cb8cb585a99 Author: Petr Pavlu Date: Wed Jul 17 15:00:23 2024 +0200 refcount: Report UAF for refcount_sub_and_test(0) when counter==0 When a reference counter is at zero and refcount_sub_and_test() is invoked to subtract zero, the function accepts this request without any warning and returns true. This behavior does not seem ideal because the counter being already at zero indicates a use-after-free. Furthermore, returning true by refcount_sub_and_test() in this case potentially results in a double-free done by its caller. Modify the underlying function __refcount_sub_and_test() to warn about this case as a use-after-free and have it return false to avoid the potential double-free. Signed-off-by: Petr Pavlu Acked-by: Peter Zijlstra (Intel) Link: https://lore.kernel.org/r/20240717130023.5675-1-petr.pavlu@suse.com Signed-off-by: Kees Cook drivers/misc/lkdtm/refcount.c | 16 ++++++++++++++++ include/linux/refcount.h | 4 ++-- 2 files changed, 18 insertions(+), 2 deletions(-) commit b446a2dae984fa5bd56dd7c3a02a426f87e05813 Merge: c813111d19e6 170c966cbe27 Author: Linus Torvalds Date: Mon Aug 5 14:31:12 2024 -0700 Merge tag 'linux_kselftest-fixes-6.11-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/shuah/linux-kselftest Pull kselftest fix from Shuah Khan: "A single fix to the conditional in ksft.py script which incorrectly flags a test suite failed when there are skipped tests in the mix. The logic is fixed to take skipped tests into account and report the test as passed" * tag 'linux_kselftest-fixes-6.11-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/shuah/linux-kselftest: selftests: ksft: Fix finished() helper exit code on skipped tests commit d3a785e4f983f523380e023d8a05fb6d04402957 Author: Dmitry Baryshkov Date: Thu Jun 27 00:45:57 2024 +0300 drm/msm/dpu: take plane rotation into account for wide planes Take into account the plane rotation and flipping when calculating src positions for the wide plane parts. This is not an issue yet, because rotation is only supported for the UBWC planes and wide UBWC planes are rejected anyway because in parallel multirect case only the half of the usual width is supported for tiled formats. However it's better to fix this now rather than stumbling upon it later. Fixes: 80e8ae3b38ab ("drm/msm/dpu: add support for wide planes") Reviewed-by: Abhinav Kumar Signed-off-by: Dmitry Baryshkov Patchwork: https://patchwork.freedesktop.org/patch/601059/ Link: https://lore.kernel.org/r/20240627-dpu-virtual-wide-v5-3-5efb90cbb8be@linaro.org Signed-off-by: Abhinav Kumar drivers/gpu/drm/msm/disp/dpu1/dpu_plane.c | 12 ++++++++++++ 1 file changed, 12 insertions(+) commit cb18195914e353ece0e789e365a5a16872169805 Author: Dmitry Baryshkov Date: Thu Jun 27 00:45:56 2024 +0300 drm/msm/dpu: relax YUV requirements YUV formats require only CSC to be enabled. Even decimated formats should not require scaler. Relax the requirement and don't check for the scaler block while checking if YUV format can be enabled. Fixes: 25fdd5933e4c ("drm/msm: Add SDM845 DPU support") Signed-off-by: Dmitry Baryshkov Reviewed-by: Abhinav Kumar Patchwork: https://patchwork.freedesktop.org/patch/601049/ Link: https://lore.kernel.org/r/20240627-dpu-virtual-wide-v5-2-5efb90cbb8be@linaro.org Signed-off-by: Abhinav Kumar drivers/gpu/drm/msm/disp/dpu1/dpu_plane.c | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-) commit 2db13c4a631505029ada9404e09a2b06a268c1c4 Author: Dmitry Baryshkov Date: Thu Jun 27 00:45:55 2024 +0300 drm/msm/dpu: limit QCM2290 to RGB formats only The QCM2290 doesn't have CSC blocks, so it can not support YUV formats even on ViG blocks. Fix the formats declared by _VIG_SBLK_NOSCALE(). Fixes: 5334087ee743 ("drm/msm: add support for QCM2290 MDSS") Signed-off-by: Dmitry Baryshkov Reviewed-by: Abhinav Kumar Patchwork: https://patchwork.freedesktop.org/patch/601048/ Link: https://lore.kernel.org/r/20240627-dpu-virtual-wide-v5-1-5efb90cbb8be@linaro.org Signed-off-by: Abhinav Kumar drivers/gpu/drm/msm/disp/dpu1/dpu_hw_catalog.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) commit bfa1a6283be390947d3649c482e5167186a37016 Author: Dmitry Baryshkov Date: Tue Jun 25 00:13:41 2024 +0300 drm/msm/dpu: cleanup FB if dpu_format_populate_layout fails If the dpu_format_populate_layout() fails, then FB is prepared, but not cleaned up. This ends up leaking the pin_count on the GEM object and causes a splat during DRM file closure: msm_obj->pin_count WARNING: CPU: 2 PID: 569 at drivers/gpu/drm/msm/msm_gem.c:121 update_lru_locked+0xc4/0xcc [...] Call trace: update_lru_locked+0xc4/0xcc put_pages+0xac/0x100 msm_gem_free_object+0x138/0x180 drm_gem_object_free+0x1c/0x30 drm_gem_object_handle_put_unlocked+0x108/0x10c drm_gem_object_release_handle+0x58/0x70 idr_for_each+0x68/0xec drm_gem_release+0x28/0x40 drm_file_free+0x174/0x234 drm_release+0xb0/0x160 __fput+0xc0/0x2c8 __fput_sync+0x50/0x5c __arm64_sys_close+0x38/0x7c invoke_syscall+0x48/0x118 el0_svc_common.constprop.0+0x40/0xe0 do_el0_svc+0x1c/0x28 el0_svc+0x4c/0x120 el0t_64_sync_handler+0x100/0x12c el0t_64_sync+0x190/0x194 irq event stamp: 129818 hardirqs last enabled at (129817): [] console_unlock+0x118/0x124 hardirqs last disabled at (129818): [] el1_dbg+0x24/0x8c softirqs last enabled at (129808): [] handle_softirqs+0x4c8/0x4e8 softirqs last disabled at (129785): [] __do_softirq+0x14/0x20 Fixes: 25fdd5933e4c ("drm/msm: Add SDM845 DPU support") Signed-off-by: Dmitry Baryshkov Reviewed-by: Abhinav Kumar Patchwork: https://patchwork.freedesktop.org/patch/600714/ Link: https://lore.kernel.org/r/20240625-dpu-mode-config-width-v5-1-501d984d634f@linaro.org Signed-off-by: Abhinav Kumar drivers/gpu/drm/msm/disp/dpu1/dpu_plane.c | 3 +++ 1 file changed, 3 insertions(+) commit 319aca883bfa1b85ee08411541b51b9a934ac858 Author: Abhinav Kumar Date: Thu Jul 25 15:04:50 2024 -0700 drm/msm/dp: reset the link phy params before link training Before re-starting link training reset the link phy params namely the pre-emphasis and voltage swing levels otherwise the next link training begins at the previously cached levels which can result in link training failures. Fixes: 8ede2ecc3e5e ("drm/msm/dp: Add DP compliance tests on Snapdragon Chipsets") Reviewed-by: Dmitry Baryshkov Tested-by: Dmitry Baryshkov # SM8350-HDK Reviewed-by: Stephen Boyd Patchwork: https://patchwork.freedesktop.org/patch/605946/ Link: https://lore.kernel.org/r/20240725220450.131245-1-quic_abhinavk@quicinc.com Signed-off-by: Abhinav Kumar drivers/gpu/drm/msm/dp/dp_ctrl.c | 2 ++ 1 file changed, 2 insertions(+) commit aedf02e46eb549dac8db4821a6b9f0c6bf6e3990 Author: Abhinav Kumar Date: Wed Jul 31 12:17:22 2024 -0700 drm/msm/dpu: move dpu_encoder's connector assignment to atomic_enable() For cases where the crtc's connectors_changed was set without enable/active getting toggled , there is an atomic_enable() call followed by an atomic_disable() but without an atomic_mode_set(). This results in a NULL ptr access for the dpu_encoder_get_drm_fmt() call in the atomic_enable() as the dpu_encoder's connector was cleared in the atomic_disable() but not re-assigned as there was no atomic_mode_set() call. Fix the NULL ptr access by moving the assignment for atomic_enable() and also use drm_atomic_get_new_connector_for_encoder() to get the connector from the atomic_state. Fixes: 25fdd5933e4c ("drm/msm: Add SDM845 DPU support") Reported-by: Dmitry Baryshkov Closes: https://gitlab.freedesktop.org/drm/msm/-/issues/59 Suggested-by: Dmitry Baryshkov Reviewed-by: Dmitry Baryshkov Tested-by: Dmitry Baryshkov # SM8350-HDK Patchwork: https://patchwork.freedesktop.org/patch/606729/ Link: https://lore.kernel.org/r/20240731191723.3050932-1-quic_abhinavk@quicinc.com Signed-off-by: Abhinav Kumar drivers/gpu/drm/msm/disp/dpu1/dpu_encoder.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) commit ff0ce721ec213499ec5a532041fb3a1db2dc5ecb Author: Waiman Long Date: Sun Aug 4 21:30:17 2024 -0400 cgroup/cpuset: Eliminate unncessary sched domains rebuilds in hotplug It was found that some hotplug operations may cause multiple rebuild_sched_domains_locked() calls. Some of those intermediate calls may use cpuset states not in the final correct form leading to incorrect sched domain setting. Fix this problem by using the existing force_rebuild flag to inhibit immediate rebuild_sched_domains_locked() calls if set and only doing one final call at the end. Also renaming the force_rebuild flag to force_sd_rebuild to make its meaning for clear. Signed-off-by: Waiman Long Signed-off-by: Tejun Heo kernel/cgroup/cpuset.c | 33 +++++++++++++++++---------------- 1 file changed, 17 insertions(+), 16 deletions(-) commit 311a1bdc44a8e06024df4fd3392be0dfc8298655 Author: Waiman Long Date: Sun Aug 4 21:30:16 2024 -0400 cgroup/cpuset: Clear effective_xcpus on cpus_allowed clearing only if cpus.exclusive not set Commit e2ffe502ba45 ("cgroup/cpuset: Add cpuset.cpus.exclusive for v2") adds a user writable cpuset.cpus.exclusive file for setting exclusive CPUs to be used for the creation of partitions. Since then effective_xcpus depends on both the cpuset.cpus and cpuset.cpus.exclusive setting. If cpuset.cpus.exclusive is set, effective_xcpus will depend only on cpuset.cpus.exclusive. When it is not set, effective_xcpus will be set according to the cpuset.cpus value when the cpuset becomes a valid partition root. When cpuset.cpus is being cleared by the user, effective_xcpus should only be cleared when cpuset.cpus.exclusive is not set. However, that is not currently the case. # cd /sys/fs/cgroup/ # mkdir test # echo +cpuset > cgroup.subtree_control # cd test # echo 3 > cpuset.cpus.exclusive # cat cpuset.cpus.exclusive.effective 3 # echo > cpuset.cpus # cat cpuset.cpus.exclusive.effective // was cleared Fix it by clearing effective_xcpus only if cpuset.cpus.exclusive is not set. Fixes: e2ffe502ba45 ("cgroup/cpuset: Add cpuset.cpus.exclusive for v2") Cc: stable@vger.kernel.org # v6.7+ Reported-by: Chen Ridong Signed-off-by: Waiman Long Signed-off-by: Tejun Heo kernel/cgroup/cpuset.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) commit 959ab6350add903e352890af53e86663739fcb9a Author: Chen Ridong Date: Sun Aug 4 21:30:15 2024 -0400 cgroup/cpuset: fix panic caused by partcmd_update We find a bug as below: BUG: unable to handle page fault for address: 00000003 PGD 0 P4D 0 Oops: 0000 [#1] PREEMPT SMP NOPTI CPU: 3 PID: 358 Comm: bash Tainted: G W I 6.6.0-10893-g60d6 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.15.0-1 04/4 RIP: 0010:partition_sched_domains_locked+0x483/0x600 Code: 01 48 85 d2 74 0d 48 83 05 29 3f f8 03 01 f3 48 0f bc c2 89 c0 48 9 RSP: 0018:ffffc90000fdbc58 EFLAGS: 00000202 RAX: 0000000100000003 RBX: ffff888100b3dfa0 RCX: 0000000000000000 RDX: 0000000000000000 RSI: 0000000000000000 RDI: 000000000002fe80 RBP: ffff888100b3dfb0 R08: 0000000000000001 R09: 0000000000000000 R10: ffffc90000fdbcb0 R11: 0000000000000004 R12: 0000000000000002 R13: ffff888100a92b48 R14: 0000000000000000 R15: 0000000000000000 FS: 00007f44a5425740(0000) GS:ffff888237d80000(0000) knlGS:0000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000000100030973 CR3: 000000010722c000 CR4: 00000000000006e0 Call Trace: ? show_regs+0x8c/0xa0 ? __die_body+0x23/0xa0 ? __die+0x3a/0x50 ? page_fault_oops+0x1d2/0x5c0 ? partition_sched_domains_locked+0x483/0x600 ? search_module_extables+0x2a/0xb0 ? search_exception_tables+0x67/0x90 ? kernelmode_fixup_or_oops+0x144/0x1b0 ? __bad_area_nosemaphore+0x211/0x360 ? up_read+0x3b/0x50 ? bad_area_nosemaphore+0x1a/0x30 ? exc_page_fault+0x890/0xd90 ? __lock_acquire.constprop.0+0x24f/0x8d0 ? __lock_acquire.constprop.0+0x24f/0x8d0 ? asm_exc_page_fault+0x26/0x30 ? partition_sched_domains_locked+0x483/0x600 ? partition_sched_domains_locked+0xf0/0x600 rebuild_sched_domains_locked+0x806/0xdc0 update_partition_sd_lb+0x118/0x130 cpuset_write_resmask+0xffc/0x1420 cgroup_file_write+0xb2/0x290 kernfs_fop_write_iter+0x194/0x290 new_sync_write+0xeb/0x160 vfs_write+0x16f/0x1d0 ksys_write+0x81/0x180 __x64_sys_write+0x21/0x30 x64_sys_call+0x2f25/0x4630 do_syscall_64+0x44/0xb0 entry_SYSCALL_64_after_hwframe+0x78/0xe2 RIP: 0033:0x7f44a553c887 It can be reproduced with cammands: cd /sys/fs/cgroup/ mkdir test cd test/ echo +cpuset > ../cgroup.subtree_control echo root > cpuset.cpus.partition cat /sys/fs/cgroup/cpuset.cpus.effective 0-3 echo 0-3 > cpuset.cpus // taking away all cpus from root This issue is caused by the incorrect rebuilding of scheduling domains. In this scenario, test/cpuset.cpus.partition should be an invalid root and should not trigger the rebuilding of scheduling domains. When calling update_parent_effective_cpumask with partcmd_update, if newmask is not null, it should recheck newmask whether there are cpus is available for parect/cs that has tasks. Fixes: 0c7f293efc87 ("cgroup/cpuset: Add cpuset.cpus.exclusive.effective for v2") Cc: stable@vger.kernel.org # v6.7+ Signed-off-by: Chen Ridong Signed-off-by: Waiman Long Signed-off-by: Tejun Heo kernel/cgroup/cpuset.c | 2 ++ 1 file changed, 2 insertions(+) commit d19d5b8d8f6dab942ce5ddbcf34bf7275e778250 Author: Abhinav Kumar Date: Mon Aug 5 13:20:08 2024 -0700 drm/msm/dp: fix the max supported bpp logic Fix the dp_panel_get_supported_bpp() API to return the minimum supported bpp correctly for relevant cases and use this API to correct the behavior of DP driver which hard-codes the max supported bpp to 30. This is incorrect because the number of lanes and max data rate supported by the lanes need to be taken into account. Replace the hardcoded limit with the appropriate math which accounts for the accurate number of lanes and max data rate. changes in v2: - Fix the dp_panel_get_supported_bpp() and use it - Drop the max_t usage as dp_panel_get_supported_bpp() already returns the min_bpp correctly now changes in v3: - replace min_t with just min as all params are u32 Fixes: c943b4948b58 ("drm/msm/dp: add displayPort driver support") Reported-by: Dmitry Baryshkov Closes: https://gitlab.freedesktop.org/drm/msm/-/issues/43 Tested-by: Dmitry Baryshkov # SM8350-HDK Reviewed-by: Stephen Boyd Patchwork: https://patchwork.freedesktop.org/patch/607073/ Link: https://lore.kernel.org/r/20240805202009.1120981-1-quic_abhinavk@quicinc.com Signed-off-by: Stephen Boyd Signed-off-by: Abhinav Kumar drivers/gpu/drm/msm/dp/dp_panel.c | 19 ++++++++++--------- 1 file changed, 10 insertions(+), 9 deletions(-) commit df24373435f5899a2a98b7d377479c8d4376613b Author: Dmitry Baryshkov Date: Fri Aug 2 22:47:34 2024 +0300 drm/msm/dpu: don't play tricks with debug macros DPU debugging macros need to be converted to a proper drm_debug_* macros, however this is a going an intrusive patch, not suitable for a fix. Wire DPU_DEBUG and DPU_DEBUG_DRIVER to always use DRM_DEBUG_DRIVER to make sure that DPU debugging messages always end up in the drm debug messages and are controlled via the usual drm.debug mask. I don't think that it is a good idea for a generic DPU_DEBUG macro to be tied to DRM_UT_KMS. It is used to report a debug message from driver, so by default it should go to the DRM_UT_DRIVER channel. While refactoring debug macros later on we might end up with particular messages going to ATOMIC or KMS, but DRIVER should be the default. Fixes: 25fdd5933e4c ("drm/msm: Add SDM845 DPU support") Signed-off-by: Dmitry Baryshkov Reviewed-by: Abhinav Kumar Patchwork: https://patchwork.freedesktop.org/patch/606932/ Link: https://lore.kernel.org/r/20240802-dpu-fix-wb-v2-2-7eac9eb8e895@linaro.org Signed-off-by: Abhinav Kumar drivers/gpu/drm/msm/disp/dpu1/dpu_kms.h | 14 ++------------ 1 file changed, 2 insertions(+), 12 deletions(-) commit 26fef9d0bbeba6bf5d18386bd20aff2c83caa0ed Author: Arnd Bergmann Date: Mon Aug 5 22:35:43 2024 +0200 syscalls: fix fstat() entry again The previous patch to fix the newfstatat() syscall entry ended up breaking fstat() instead. Unfortunately these two are not handled the same way, so I messed this one up the exact opposite way. Fixes: 343416f0c11c ("syscalls: fix syscall macros for newfstat/newfstatat") Signed-off-by: Arnd Bergmann scripts/syscall.tbl | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 7fef1eb0b013eaa42019a95a08f71368e5a22dba Author: Takahiro Itazuri Date: Tue Jun 6 16:46:28 2023 +0100 docs: KVM: Fix register ID of SPSR_FIQ Fixes the register ID of SPSR_FIQ. SPSR_FIQ is a 64-bit register and the 64-bit register size mask is 0x0030000000000000ULL. Fixes: fd3bc912d3d1 ("KVM: Documentation: Document arm64 core registers in detail") Signed-off-by: Takahiro Itazuri Acked-by: Marc Zyngier Link: https://lore.kernel.org/r/20230606154628.95498-1-itazur@amazon.com Signed-off-by: Oliver Upton Documentation/virt/kvm/api.rst | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 04c90681144c40619524367c69e40736a6fa690c Author: Jared McArthur Date: Thu Aug 1 16:04:14 2024 -0500 arm64: dts: ti: k3-j722s: Fix gpio-range for main_pmx0 Commit 5e5c50964e2e ("arm64: dts: ti: k3-j722s: Add gpio-ranges properties") introduced pinmux range definition for gpio-ranges, however missed a hole within gpio-range for main_pmx0. As a result, automatic mapping of GPIO to pin control for gpios within the main_pmx0 domain is broken. Fix this by correcting the gpio-range. Fixes: 5e5c50964e2e ("arm64: dts: ti: k3-j722s: Add gpio-ranges properties") Signed-off-by: Jared McArthur Link: https://lore.kernel.org/r/20240801210414.715306-4-j-mcarthur@ti.com Signed-off-by: Nishanth Menon arch/arm64/boot/dts/ti/k3-j722s-main.dtsi | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) commit 98897a300859dca62f834a5d1f60267032a9fe54 Author: Jared McArthur Date: Thu Aug 1 16:04:13 2024 -0500 arm64: dts: ti: k3-am62p: Fix gpio-range for main_pmx0 Commit d72d73a44c3c ("arm64: dts: ti: k3-am62p: Add gpio-ranges properties") introduced pinmux range definition for gpio-ranges, however missed a hole within gpio-range for main_pmx0. As a result, automatic mapping of GPIO to pin control for gpios within the main_pmx0 domain is broken. Fix this by correcting the gpio-range. Fixes: d72d73a44c3c ("arm64: dts: ti: k3-am62p: Add gpio-ranges properties") Signed-off-by: Jared McArthur Link: https://lore.kernel.org/r/20240801210414.715306-3-j-mcarthur@ti.com Signed-off-by: Nishanth Menon arch/arm64/boot/dts/ti/k3-am62p-main.dtsi | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) commit 4e436f6fb95e507131df78c0d98052237db60ecc Author: Jared McArthur Date: Thu Aug 1 16:04:12 2024 -0500 arm64: dts: ti: k3-am62p: Add gpio-ranges for mcu_gpio0 Commit d72d73a44c3c ("arm64: dts: ti: k3-am62p: Add gpio-ranges properties") introduced pinmux range definition for gpio-ranges, however missed introducing the range description for the mcu_gpio node. As a result, automatic mapping of GPIO to pin control for mcu gpios is broken. Fix this by introducing the proper ranges. Fixes: d72d73a44c3c ("arm64: dts: ti: k3-am62p: Add gpio-ranges properties") Signed-off-by: Jared McArthur Link: https://lore.kernel.org/r/20240801210414.715306-2-j-mcarthur@ti.com Signed-off-by: Nishanth Menon arch/arm64/boot/dts/ti/k3-am62p-j722s-common-mcu.dtsi | 2 ++ 1 file changed, 2 insertions(+) commit 5062d9c0cbbc202e495e9b20f147f64ef5cc2897 Author: Sicelo A. Mhlongo Date: Mon Jul 22 13:31:11 2024 +0200 ARM: dts: omap3-n900: correct the accelerometer orientation Negate the values reported for the accelerometer z-axis in order to match Documentation/devicetree/bindings/iio/mount-matrix.txt. Fixes: 14a213dcb004 ("ARM: dts: n900: use iio driver for accelerometer") Signed-off-by: Sicelo A. Mhlongo Reviewed-By: Andreas Kemnade Link: https://lore.kernel.org/r/20240722113137.3240847-1-absicsz@gmail.com Signed-off-by: Kevin Hilman arch/arm/boot/dts/ti/omap/omap3-n900.dts | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit e42066df07c0fcedebb32ed56f8bc39b4bf86337 Author: Richard Fitzgerald Date: Mon Aug 5 15:08:39 2024 +0100 ASoC: cs35l56: Handle OTP read latency over SoundWire Use the late-read buffer in the CS35L56 SoundWire interface to read OTP memory. The OTP memory has a longer access latency than chip registers and cannot guarantee to return the data value in the SoundWire control response if the bus clock is >4.8 MHz. The Cirrus SoundWire peripheral IP exposes the bridge-to-bus read buffer and status bits. For a read from OTP the bridge status bits are polled to wait for the OTP data to be loaded into the read buffer and the data is then read from there. Signed-off-by: Richard Fitzgerald Fixes: e1830f66f6c6 ("ASoC: cs35l56: Add helper functions for amp calibration") Link: https://patch.msgid.link/20240805140839.26042-1-rf@opensource.cirrus.com Signed-off-by: Mark Brown include/sound/cs35l56.h | 5 +++ sound/soc/codecs/cs35l56-sdw.c | 77 ++++++++++++++++++++++++++++++++++++++++++ 2 files changed, 82 insertions(+) commit 9a1af1e218779724ff29ca75f2b9397dc3ed11e7 Author: Johan Hovold Date: Mon Jul 29 15:13:51 2024 +0200 ASoC: codecs: lpass-macro: fix missing codec version Recent changes that started checking the codec version broke audio on the Lenovo ThinkPad X13s: wsa_macro 3240000.codec: Unsupported Codec version (0) wsa_macro 3240000.codec: probe with driver wsa_macro failed with error -22 rx_macro 3200000.rxmacro: Unsupported Codec version (0) rx_macro 3200000.rxmacro: probe with driver rx_macro failed with error -22 Add the missing codec version to the lookup table so that the codec drivers probe successfully. Note that I'm just assuming that this is a 2.0 codec based on the fact that this device uses the older register layout. Fixes: 378918d59181 ("ASoC: codecs: lpass-macro: add helpers to get codec version") Fixes: dbacef05898d ("ASoC: codec: lpass-rx-macro: prepare driver to accomdate new codec versions") Fixes: 727de4fbc546 ("ASoC: codecs: lpass-wsa-macro: Correct support for newer v2.5 version") Signed-off-by: Johan Hovold Reviewed-by: Krzysztof Kozlowski Link: https://patch.msgid.link/20240729131351.27886-1-johan+linaro@kernel.org Signed-off-by: Mark Brown sound/soc/codecs/lpass-va-macro.c | 2 ++ 1 file changed, 2 insertions(+) commit b53b831919a0dc4e6631ebe0497ab2a4d8bef014 Author: Kees Cook Date: Tue Jul 16 14:38:33 2024 -0700 dmaengine: stm32-dma3: Set lli_size after allocation With the new __counted_by annotation, the "lli_size" variable needs to valid for accesses to the "lli" array. This requirement is not met in stm32_dma3_chan_desc_alloc(), since "lli_size" starts at "0", so "lli" index "0" will not be considered valid during the initialization for loop. Fix this by setting lli_size immediately after allocation (similar to how this is handled in stm32_mdma_alloc_desc() for the node/count relationship). Fixes: f561ec8b2b33 ("dmaengine: Add STM32 DMA3 support") Signed-off-by: Kees Cook Reviewed-by: Gustavo A. R. Silva Link: https://lore.kernel.org/r/20240716213830.work.951-kees@kernel.org Signed-off-by: Vinod Koul drivers/dma/stm32/stm32-dma3.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 5e5c793c7fc47219998465361d94510fdf55d83f Author: Kees Cook Date: Tue Jul 16 14:57:06 2024 -0700 dmaengine: ti: omap-dma: Initialize sglen after allocation With the new __counted_by annocation, the "sglen" struct member must be set before accessing the "sg" array. This initialization was done in other places where a new struct omap_desc is allocated, but these cases were missed. Set "sglen" after allocation. Fixes: b85178611c11 ("dmaengine: ti: omap-dma: Annotate struct omap_desc with __counted_by") Signed-off-by: Kees Cook Reviewed-by: Gustavo A. R. Silva Link: https://lore.kernel.org/r/20240716215702.work.802-kees@kernel.org Signed-off-by: Vinod Koul drivers/dma/ti/omap-dma.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) commit 2ebc36b9581df31eed271e5de61fc8a8b66dbc56 Author: Serge Semin Date: Fri Aug 2 10:50:51 2024 +0300 dmaengine: dw: Unify ret-val local variables naming Currently there are two names utilized in the driver to keep the functions call status: ret and err. For the sake of unification convert to using the first version only. Signed-off-by: Serge Semin Acked-by: Andy Shevchenko Link: https://lore.kernel.org/r/20240802075100.6475-7-fancer.lancer@gmail.com Signed-off-by: Vinod Koul drivers/dma/dw/core.c | 20 ++++++++++---------- drivers/dma/dw/platform.c | 20 ++++++++++---------- 2 files changed, 20 insertions(+), 20 deletions(-) commit d8fa0802f63502c0409d02c6b701d51841a6f1bd Author: Serge Semin Date: Fri Aug 2 10:50:50 2024 +0300 dmaengine: dw: Simplify max-burst calculation procedure In order to have a more coherent DW AHB DMA slave configuration method - dwc_config() - let's simplify the source and destination channel max-burst calculation procedure: 1. Create the max-burst verification method as it has been just done for the memory and peripheral address widths. Thus the dwc_config() method will turn to a set of the verification methods execution. 2. Since both the generic DW AHB DMA and Intel iDMA 32-bit engines support the power-of-2 bursts only, then the specified by the client driver max-burst values can be converted to being power-of-2 right in the max-burst verification method. 3. Since max-burst encoded value is required on the CTL_LO fields calculation stage, the encode_maxburst() callback can be easily dropped from the dw_dma structure meanwhile the encoding procedure will be executed right in the CTL_LO register value calculation. Thus the update will provide the next positive effects: the internal DMA-slave config structure will contain only the real DMA-transfer config values, which will be encoded to the DMA-controller register fields only when it's required on the buffer mapping; the redundant encode_maxburst() callback will be dropped simplifying the internal HW-abstraction API; dwc_config() will look more readable executing the verification functions one-by-one. Signed-off-by: Serge Semin Acked-by: Andy Shevchenko Link: https://lore.kernel.org/r/20240802075100.6475-6-fancer.lancer@gmail.com Signed-off-by: Vinod Koul drivers/dma/dw/core.c | 30 +++++++++++++++++++++--------- drivers/dma/dw/dw.c | 9 ++++----- drivers/dma/dw/idma32.c | 9 ++++----- drivers/dma/dw/regs.h | 1 - 4 files changed, 29 insertions(+), 20 deletions(-) commit 3acb301d33749a8974e61ecda16a5f5441fc9628 Author: Serge Semin Date: Fri Aug 2 10:50:49 2024 +0300 dmaengine: dw: Define encode_maxburst() above prepare_ctllo() callbacks As a preparatory change before dropping the encode_maxburst() callbacks let's move dw_dma_encode_maxburst() and idma32_encode_maxburst() to being defined above the dw_dma_prepare_ctllo() and idma32_prepare_ctllo() methods respectively. That's required since the former methods will be called from the later ones directly. Signed-off-by: Serge Semin Acked-by: Andy Shevchenko Link: https://lore.kernel.org/r/20240802075100.6475-5-fancer.lancer@gmail.com Signed-off-by: Vinod Koul drivers/dma/dw/dw.c | 18 +++++++++--------- drivers/dma/dw/idma32.c | 10 +++++----- 2 files changed, 14 insertions(+), 14 deletions(-) commit 1fd6fe89055e6dbb4be8f16b8dcab8602e3603d6 Author: Serge Semin Date: Fri Aug 2 10:50:48 2024 +0300 dmaengine: dw: Simplify prepare CTL_LO methods Currently the CTL LO fields are calculated on the platform-specific basis. It's implemented by means of the prepare_ctllo() callbacks using the ternary operator within the local variables init block at the beginning of the block scope. The functions code currently is relatively hard to comprehend and isn't that optimal since implies four conditional statements executed and two additional local variables defined. Let's simplify the DW AHB DMA prepare_ctllo() method by unrolling the ternary operators into the normal if-else statement, dropping redundant master-interface ID variables and initializing the local variables based on the singly evaluated DMA-transfer direction check. Thus the method will look much more readable since now the fields content can be easily inferred right from the if-else branch. Provide the same update in the Intel DMA32 core driver for the sake of the driver code unification. Note besides of the effects described above this update is basically a preparation before dropping the max burst encoding callback. The dropping will require to call the burst fields calculation methods right in the prepare_ctllo() callbacks. It would have made the later functions code even more complex should they were left in the original state. Signed-off-by: Serge Semin Acked-by: Andy Shevchenko Link: https://lore.kernel.org/r/20240802075100.6475-4-fancer.lancer@gmail.com Signed-off-by: Vinod Koul drivers/dma/dw/dw.c | 21 +++++++++++++++------ drivers/dma/dw/idma32.c | 8 ++++++-- 2 files changed, 21 insertions(+), 8 deletions(-) commit d04b21bfa1c50a2ade4816cab6fdc91827b346b1 Author: Serge Semin Date: Fri Aug 2 10:50:47 2024 +0300 dmaengine: dw: Add memory bus width verification Currently in case of the DEV_TO_MEM or MEM_TO_DEV DMA transfers the memory data width (single transfer width) is determined based on the buffer length, buffer base address or DMA master-channel max address width capability. It isn't enough in case of the channel disabling prior the block transfer is finished. Here is what DW AHB DMA IP-core databook says regarding the port suspension (DMA-transfer pause) implementation in the controller: "When CTLx.SRC_TR_WIDTH < CTLx.DST_TR_WIDTH and the CFGx.CH_SUSP bit is high, the CFGx.FIFO_EMPTY is asserted once the contents of the FIFO do not permit a single word of CTLx.DST_TR_WIDTH to be formed. However, there may still be data in the channel FIFO, but not enough to form a single transfer of CTLx.DST_TR_WIDTH. In this scenario, once the channel is disabled, the remaining data in the channel FIFO is not transferred to the destination peripheral." So in case if the port gets to be suspended and then disabled it's possible to have the data silently discarded even though the controller reported that FIFO is empty and the CTLx.BLOCK_TS indicated the dropped data already received from the source device. This looks as if the data somehow got lost on a way from the peripheral device to memory and causes problems for instance in the DW APB UART driver, which pauses and disables the DMA-transfer as soon as the recv data timeout happens. Here is the way it looks: Memory <------- DMA FIFO <------ UART FIFO <---------------- UART DST_TR_WIDTH -+--------| | | | | | | No more data Current lvl -+--------| |---------+- DMA-burst lvl | | |---------+- Leftover data | | |---------+- SRC_TR_WIDTH -+--------+-------+---------+ In the example above: no more data is getting received over the UART port and BLOCK_TS is not even close to be fully received; some data is left in the UART FIFO, but not enough to perform a bursted DMA-xfer to the DMA FIFO; some data is left in the DMA FIFO, but not enough to be passed further to the system memory in a single transfer. In this situation the 8250 UART driver catches the recv timeout interrupt, pauses the DMA-transfer and terminates it completely, after which the IRQ handler manually fetches the leftover data from the UART FIFO into the recv-buffer. But since the DMA-channel has been disabled with the data left in the DMA FIFO, that data will be just discarded and the recv-buffer will have a gap of the "current lvl" size in the recv-buffer at the tail of the lately received data portion. So the data will be lost just due to the misconfigured DMA transfer. Note this is only relevant for the case of the transfer suspension and _disabling_. No problem will happen if the transfer will be re-enabled afterwards or the block transfer is fully completed. In the later case the "FIFO flush mode" will be executed at the transfer final stage in order to push out the data left in the DMA FIFO. In order to fix the denoted problem the DW AHB DMA-engine driver needs to make sure that the _bursted_ source transfer width is greater or equal to the single destination transfer (note the HW databook describes more strict constraint than actually required). Since the peripheral-device side is prescribed by the client driver logic, the memory-side can be only used for that. The solution can be easily implemented for the DEV_TO_MEM transfers just by adjusting the memory-channel address width. Sadly it's not that easy for the MEM_TO_DEV transfers since the mem-to-dma burst size is normally dynamically determined by the controller. So the only thing that can be done is to make sure that memory-side address width is greater than the peripheral device address width. Fixes: a09820043c9e ("dw_dmac: autoconfigure data_width or get it via platform data") Signed-off-by: Serge Semin Acked-by: Andy Shevchenko Link: https://lore.kernel.org/r/20240802075100.6475-3-fancer.lancer@gmail.com Signed-off-by: Vinod Koul drivers/dma/dw/core.c | 51 ++++++++++++++++++++++++++++++++++++++++++++------- 1 file changed, 44 insertions(+), 7 deletions(-) commit b336268dde75cb09bd795cb24893d52152a9191f Author: Serge Semin Date: Fri Aug 2 10:50:46 2024 +0300 dmaengine: dw: Add peripheral bus width verification Currently the src_addr_width and dst_addr_width fields of the dma_slave_config structure are mapped to the CTLx.SRC_TR_WIDTH and CTLx.DST_TR_WIDTH fields of the peripheral bus side in order to have the properly aligned data passed to the target device. It's done just by converting the passed peripheral bus width to the encoded value using the __ffs() function. This implementation has several problematic sides: 1. __ffs() is undefined if no bit exist in the passed value. Thus if the specified addr-width is DMA_SLAVE_BUSWIDTH_UNDEFINED, __ffs() may return unexpected value depending on the platform-specific implementation. 2. DW AHB DMA-engine permits having the power-of-2 transfer width limited by the DMAH_Mk_HDATA_WIDTH IP-core synthesize parameter. Specifying bus-width out of that constraints scope will definitely cause unexpected result since the destination reg will be only partly touched than the client driver implied. Let's fix all of that by adding the peripheral bus width verification method and calling it in dwc_config() which is supposed to be executed before preparing any transfer. The new method will make sure that the passed source or destination address width is valid and if undefined then the driver will just fallback to the 1-byte width transfer. Fixes: 029a40e97d0d ("dmaengine: dw: provide DMA capabilities") Signed-off-by: Serge Semin Acked-by: Andy Shevchenko Link: https://lore.kernel.org/r/20240802075100.6475-2-fancer.lancer@gmail.com Signed-off-by: Vinod Koul drivers/dma/dw/core.c | 38 ++++++++++++++++++++++++++++++++++++++ 1 file changed, 38 insertions(+) commit b93d16bee557302d4e588375ececd833cc048acc Author: Gaosheng Cui Date: Sat Aug 3 14:10:41 2024 +0800 i2c: qcom-geni: Add missing clk_disable_unprepare in geni_i2c_runtime_resume Add the missing clk_disable_unprepare() before return in geni_i2c_runtime_resume(). Fixes: 14d02fbadb5d ("i2c: qcom-geni: add desc struct to prepare support for I2C Master Hub variant") Signed-off-by: Gaosheng Cui Reviewed-by: Vladimir Zapolskiy Signed-off-by: Andi Shyti drivers/i2c/busses/i2c-qcom-geni.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) commit c813111d19e65b6336a6352eae9c1ff5c40f722f Merge: de9c2c66ad8e a371d558e6f3 Author: Linus Torvalds Date: Mon Aug 5 09:23:00 2024 -0700 Merge tag 'slab-fixes-for-6.11-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/vbabka/slab Pull slab fix from Vlastimil Babka: "Since v6.8 we've had a subtle breakage in SLUB with KFENCE enabled, that can cause a crash. It hasn't been found earlier due to quite specific conditions necessary (OOM during kmem_cache_alloc_bulk())" * tag 'slab-fixes-for-6.11-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/vbabka/slab: mm, slub: do not call do_slab_free for kfence object commit 5af9b304bc6010723c02f74de0bfd24ff19b1a10 Author: Piyush Mehta Date: Mon Aug 5 11:29:07 2024 +0530 phy: xilinx: phy-zynqmp: Fix SGMII linkup failure on resume On a few Kria KR260 Robotics Starter Kit the PS-GEM SGMII linkup is not happening after the resume. This is because serdes registers are reset when FPD is off (in suspend state) and needs to be reprogrammed in the resume path with the same default initialization as done in the first stage bootloader psu_init routine. To address the failure introduce a set of serdes registers to be saved in the suspend path and then restore it on resume. Fixes: 4a33bea00314 ("phy: zynqmp: Add PHY driver for the Xilinx ZynqMP Gigabit Transceiver") Signed-off-by: Piyush Mehta Signed-off-by: Radhey Shyam Pandey Link: https://lore.kernel.org/r/1722837547-2578381-1-git-send-email-radhey.shyam.pandey@amd.com Signed-off-by: Vinod Koul drivers/phy/xilinx/phy-zynqmp.c | 56 +++++++++++++++++++++++++++++++++++++++++ 1 file changed, 56 insertions(+) commit 1fb0847392e220890c9cf8908e3ab8e7e1227ff6 Author: Cristian Ciocaltea Date: Thu Jul 11 14:26:55 2024 +0300 drm/bridge-connector: Fix double free in error handling paths The recent switch to drmm allocation in drm_bridge_connector_init() may cause double free on bridge_connector in some of the error handling paths. Drop the explicit kfree() calls on bridge_connector. Fixes: c12907be57b1 ("drm/bridge-connector: switch to using drmm allocations") Signed-off-by: Cristian Ciocaltea Signed-off-by: default avatarRobert Foss Reviewed-by: Dmitry Baryshkov Link: https://patchwork.freedesktop.org/patch/msgid/20240711-bridge-connector-fix-dbl-free-v1-1-d558b2d0eb93@collabora.com drivers/gpu/drm/drm_bridge_connector.c | 8 ++------ 1 file changed, 2 insertions(+), 6 deletions(-) commit 5916be8a53de6401871bdd953f6c60237b47d6d3 Author: Thomas Gleixner Date: Sat Aug 3 17:07:51 2024 +0200 timekeeping: Fix bogus clock_was_set() invocation in do_adjtimex() The addition of the bases argument to clock_was_set() fixed up all call sites correctly except for do_adjtimex(). This uses CLOCK_REALTIME instead of CLOCK_SET_WALL as argument. CLOCK_REALTIME is 0. As a result the effect of that clock_was_set() notification is incomplete and might result in timers expiring late because the hrtimer code does not re-evaluate the affected clock bases. Use CLOCK_SET_WALL instead of CLOCK_REALTIME to tell the hrtimers code which clock bases need to be re-evaluated. Fixes: 17a1b8826b45 ("hrtimer: Add bases argument to clock_was_set()") Signed-off-by: Thomas Gleixner Cc: stable@vger.kernel.org Link: https://lore.kernel.org/all/877ccx7igo.ffs@tglx kernel/time/timekeeping.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 06c03c8edce333b9ad9c6b207d93d3a5ae7c10c0 Author: Justin Stitt Date: Fri May 17 00:47:10 2024 +0000 ntp: Safeguard against time_constant overflow Using syzkaller with the recently reintroduced signed integer overflow sanitizer produces this UBSAN report: UBSAN: signed-integer-overflow in ../kernel/time/ntp.c:738:18 9223372036854775806 + 4 cannot be represented in type 'long' Call Trace: handle_overflow+0x171/0x1b0 __do_adjtimex+0x1236/0x1440 do_adjtimex+0x2be/0x740 The user supplied time_constant value is incremented by four and then clamped to the operating range. Before commit eea83d896e31 ("ntp: NTP4 user space bits update") the user supplied value was sanity checked to be in the operating range. That change removed the sanity check and relied on clamping after incrementing which does not work correctly when the user supplied value is in the overflow zone of the '+ 4' operation. The operation requires CAP_SYS_TIME and the side effect of the overflow is NTP getting out of sync. Similar to the fixups for time_maxerror and time_esterror, clamp the user space supplied value to the operating range. [ tglx: Switch to clamping ] Fixes: eea83d896e31 ("ntp: NTP4 user space bits update") Signed-off-by: Justin Stitt Signed-off-by: Thomas Gleixner Cc: Miroslav Lichvar Cc: stable@vger.kernel.org Link: https://lore.kernel.org/all/20240517-b4-sio-ntp-c-v2-1-f3a80096f36f@google.com Closes: https://github.com/KSPP/linux/issues/352 kernel/time/ntp.c | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-) commit 87d571d6fb77ec342a985afa8744bb9bb75b3622 Author: Justin Stitt Date: Fri May 17 20:22:44 2024 +0000 ntp: Clamp maxerror and esterror to operating range Using syzkaller alongside the newly reintroduced signed integer overflow sanitizer spits out this report: UBSAN: signed-integer-overflow in ../kernel/time/ntp.c:461:16 9223372036854775807 + 500 cannot be represented in type 'long' Call Trace: handle_overflow+0x171/0x1b0 second_overflow+0x2d6/0x500 accumulate_nsecs_to_secs+0x60/0x160 timekeeping_advance+0x1fe/0x890 update_wall_time+0x10/0x30 time_maxerror is unconditionally incremented and the result is checked against NTP_PHASE_LIMIT, but the increment itself can overflow, resulting in wrap-around to negative space. Before commit eea83d896e31 ("ntp: NTP4 user space bits update") the user supplied value was sanity checked to be in the operating range. That change removed the sanity check and relied on clamping in handle_overflow() which does not work correctly when the user supplied value is in the overflow zone of the '+ 500' operation. The operation requires CAP_SYS_TIME and the side effect of the overflow is NTP getting out of sync. Miroslav confirmed that the input value should be clamped to the operating range and the same applies to time_esterror. The latter is not used by the kernel, but the value still should be in the operating range as it was before the sanity check got removed. Clamp them to the operating range. [ tglx: Changed it to clamping and included time_esterror ] Fixes: eea83d896e31 ("ntp: NTP4 user space bits update") Signed-off-by: Justin Stitt Signed-off-by: Thomas Gleixner Cc: Miroslav Lichvar Link: https://lore.kernel.org/all/20240517-b4-sio-ntp-usec-v2-1-d539180f2b79@google.com Closes: https://github.com/KSPP/linux/issues/354 kernel/time/ntp.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) commit 9438f970296f9c3a6dd340ae0ad01d2f056c88e6 Author: Francesco Dolcini Date: Wed Jul 31 07:48:04 2024 +0200 arm64: dts: ti: k3-am62-verdin-dahlia: Keep CTRL_SLEEP_MOCI# regulator on This reverts commit 3935fbc87ddebea5439f3ab6a78b1e83e976bf88. CTRL_SLEEP_MOCI# is a signal that is defined for all the SoM implementing the Verdin family specification, this signal is supposed to control the power enable in the carrier board when the system is in deep sleep mode. However this is not possible with Texas Instruments AM62 SoC, IOs output buffer is disabled in deep sleep and IOs are in tri-state mode. Given that we cannot properly control this pin, force it to be always high to minimize potential issues. Fixes: 3935fbc87dde ("arm64: dts: ti: k3-am62-verdin-dahlia: support sleep-moci") Cc: Link: https://e2e.ti.com/support/processors-group/processors/f/processors-forum/1361669/am625-gpio-output-state-in-deep-sleep/5244802 Signed-off-by: Francesco Dolcini Link: https://lore.kernel.org/r/20240731054804.6061-1-francesco@dolcini.it Signed-off-by: Nishanth Menon arch/arm64/boot/dts/ti/k3-am62-verdin-dahlia.dtsi | 22 ---------------------- arch/arm64/boot/dts/ti/k3-am62-verdin.dtsi | 6 ------ 2 files changed, 28 deletions(-) commit 042b8711a0beafb2c3b888bebe3c300ab4c817fa Author: AngeloGioacchino Del Regno Date: Thu Jul 18 10:24:10 2024 +0200 drm/mediatek: Set sensible cursor width/height values to fix crash Hardware-speaking, there is no feature-reduced cursor specific plane, so this driver reserves the last all Overlay plane as a Cursor plane, but sets the maximum cursor width/height to the maximum value that the full overlay plane can use. While this could be ok, it raises issues with common userspace using libdrm (especially Mutter, but other compositors too) which will crash upon performing allocations and/or using said cursor plane. Reduce the maximum width/height for the cursor to 512x512 pixels, value taken from IGT's maximum cursor size test, which succeeds. Signed-off-by: AngeloGioacchino Del Regno Reviewed-by: Fei Shao Tested-by: Fei Shao Reviewed-by: Daniel Stone Reviewed-by: CK Hu Link: https://patchwork.kernel.org/project/dri-devel/patch/20240718082410.204459-1-angelogioacchino.delregno@collabora.com/ Signed-off-by: Chun-Kuang Hu drivers/gpu/drm/mediatek/mtk_drm_drv.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) commit 15b7a03205b31bc5623378c190d22b7ff60026f1 Author: Takashi Iwai Date: Mon Aug 5 15:01:28 2024 +0200 ALSA: line6: Fix racy access to midibuf There can be concurrent accesses to line6 midibuf from both the URB completion callback and the rawmidi API access. This could be a cause of KMSAN warning triggered by syzkaller below (so put as reported-by here). This patch protects the midibuf call of the former code path with a spinlock for avoiding the possible races. Reported-by: syzbot+78eccfb8b3c9a85fc6c5@syzkaller.appspotmail.com Closes: https://lore.kernel.org/00000000000000949c061df288c5@google.com Cc: Link: https://patch.msgid.link/20240805130129.10872-1-tiwai@suse.de Signed-off-by: Takashi Iwai sound/usb/line6/driver.c | 5 +++++ 1 file changed, 5 insertions(+) commit ce4a995884ecedb98ba00e2e0b8ce94cde2060ce Author: Arnd Bergmann Date: Fri Jul 19 11:59:31 2024 +0200 drm/omap: add CONFIG_MMU dependency Compile-testing with CONFIG_MMU disabled causes a link error in omapdrm: arm-linux-gnueabi-ld: drivers/gpu/drm/omapdrm/omap_gem.o: in function `omap_gem_fault_2d': omap_gem.c:(.text+0x36e): undefined reference to `vmf_insert_mixed' arm-linux-gnueabi-ld: drivers/gpu/drm/omapdrm/omap_gem.o: in function `omap_gem_fault': omap_gem.c:(.text+0x74a): undefined reference to `vmf_insert_mixed' Avoid this by adding a Kconfig dependency. Fixes: dc6fcaaba5a5 ("drm/omap: Allow build with COMPILE_TEST=y") Signed-off-by: Arnd Bergmann Signed-off-by: Tomi Valkeinen Link: https://patchwork.freedesktop.org/patch/msgid/20240719095942.3841009-1-arnd@kernel.org drivers/gpu/drm/omapdrm/Kconfig | 1 + 1 file changed, 1 insertion(+) commit dc268085e499666b9f4f0fcb4c5a94e1c0b193b3 Author: Richard Fitzgerald Date: Mon Aug 5 12:42:22 2024 +0100 ASoC: cs-amp-lib: Fix NULL pointer crash if efi.get_variable is NULL Call efi_rt_services_supported() to check that efi.get_variable exists before calling it. Signed-off-by: Richard Fitzgerald Fixes: 1cad8725f2b9 ("ASoC: cs-amp-lib: Add helpers for factory calibration data") Link: https://patch.msgid.link/20240805114222.15722-1-rf@opensource.cirrus.com Signed-off-by: Mark Brown sound/soc/codecs/cs-amp-lib.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 2c3640b82213cf2beb7c1cc3cfce2ecf5349b0de Author: Simon Trimmer Date: Mon Aug 5 10:27:21 2024 +0000 ASoC: cs35l56: Stop creating ALSA controls for firmware coefficients A number of laptops have gone to market with old firmware versions that export controls that have since been hidden, but we can't just install a newer firmware because the firmware for each product is customized and qualified by the OEM. The issue is that alsactl save and restore has no idea what controls are good to persist which can lead to misconfiguration. There is no reason that the UCM or user should need to interact with any of the ALSA controls for the firmware coefficients so they can be removed entirely. Fixes: e49611252900 ("ASoC: cs35l56: Add driver for Cirrus Logic CS35L56") Signed-off-by: Simon Trimmer Link: https://patch.msgid.link/20240805102721.30102-3-simont@opensource.cirrus.com Signed-off-by: Mark Brown sound/soc/codecs/cs35l56.c | 11 +++++++++++ 1 file changed, 11 insertions(+) commit 45b4acab4cac79503663f0a4be9eb3752db04d4b Author: Simon Trimmer Date: Mon Aug 5 10:27:20 2024 +0000 ASoC: wm_adsp: Add control_add callback and export wm_adsp_control_add() The callback allows codec drivers to affect how firmware coefficients are added as controls. For example a codec driver may selectively add controls by choosing to call wm_adsp_control_add() based on some filter logic. Signed-off-by: Simon Trimmer Link: https://patch.msgid.link/20240805102721.30102-2-simont@opensource.cirrus.com Signed-off-by: Mark Brown sound/soc/codecs/wm_adsp.c | 17 ++++++++++++++--- sound/soc/codecs/wm_adsp.h | 3 +++ 2 files changed, 17 insertions(+), 3 deletions(-) commit 50359c9c3cb3e55e840e3485f5ee37da5b2b16b6 Author: Alexander Stein Date: Wed Jul 17 10:03:33 2024 +0200 pmdomain: imx: scu-pd: Remove duplicated clocks These clocks are already added to the list. Remove the duplicates ones. Fixes: a67d780720ff ("genpd: imx: scu-pd: add more PDs") Signed-off-by: Alexander Stein Cc: stable@vger.kernel.org Link: https://lore.kernel.org/r/20240717080334.2210988-1-alexander.stein@ew.tq-group.com Signed-off-by: Ulf Hansson drivers/pmdomain/imx/scu-pd.c | 5 ----- 1 file changed, 5 deletions(-) commit 7ab107544b777c3bd7feb9fe447367d8edd5b202 Author: Daniele Palmas Date: Thu Aug 1 15:55:12 2024 +0200 net: usb: qmi_wwan: fix memory leak for not ip packets Free the unused skb when not ip packets arrive. Fixes: c6adf77953bc ("net: usb: qmi_wwan: add qmap mux protocol support") Signed-off-by: Daniele Palmas Acked-by: Bjørn Mork Signed-off-by: David S. Miller drivers/net/usb/qmi_wwan.c | 1 + 1 file changed, 1 insertion(+) commit 268762d0bbe778952ebda77a9ae8b8b3b584ae61 Merge: 14ab4792ee12 4ba8d9708370 Author: David S. Miller Date: Mon Aug 5 11:10:22 2024 +0100 Merge branch 'virtio-net-rq-coalescing' into main Heng Qi says: ==================== virtio-net: unbreak vq resizing if vq coalescing is not supported Currently, if the driver does not negotiate the vq coalescing feature but supports vq resize, the vq resize action, which could have been successfully executed, is interrupted due to the failure in configuring the vq coalescing parameters. This issue needs to be fixed. Changelog ========= v3->v4: - Add a comment for patch[2/2]. v2->v3: - Break out the feature check and the fix into separate patches. v1->v2: - Rephrase the subject. - Put the feature check inside the virtnet_send_{r,t}x_ctrl_coal_vq_cmd. ==================== Signed-off-by: David S. Miller commit 4ba8d97083707409822264fd1776aad7233f353e Author: Heng Qi Date: Thu Aug 1 21:23:38 2024 +0800 virtio-net: unbreak vq resizing when coalescing is not negotiated Don't break the resize action if the vq coalescing feature named VIRTIO_NET_F_VQ_NOTF_COAL is not negotiated. Fixes: f61fe5f081cf ("virtio-net: fix the vq coalescing setting for vq resize") Signed-off-by: Heng Qi Reviewed-by: Xuan Zhuo Acked-by: Eugenio Pé rez Acked-by: Jason Wang Signed-off-by: David S. Miller drivers/net/virtio_net.c | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) commit b50f2af9fbc5c00103ca8b72752b15310bd77762 Author: Heng Qi Date: Thu Aug 1 21:23:37 2024 +0800 virtio-net: check feature before configuring the vq coalescing command Virtio spec says: The driver MUST have negotiated the VIRTIO_NET_F_VQ_NOTF_COAL feature when issuing commands VIRTIO_NET_CTRL_NOTF_COAL_VQ_SET and VIRTIO_NET_CTRL_NOTF_COAL_VQ_GET. So we add the feature negotiation check to virtnet_send_{r,t}x_ctrl_coal_vq_cmd as a basis for the next bugfix patch. Suggested-by: Michael S. Tsirkin Signed-off-by: Heng Qi Acked-by: Jason Wang Signed-off-by: David S. Miller drivers/net/virtio_net.c | 6 ++++++ 1 file changed, 6 insertions(+) commit 1b85bdb0fadb42f5ef75ddcd259fc1ef13ec04de Author: Dnyaneshwar Bhadane Date: Thu Aug 1 16:41:41 2024 +0530 drm/i915/display: correct dual pps handling for MTL_PCH+ On the PCH side the second PPS was introduced in ICP+.Add condition On MTL_PCH and greater platform also having the second PPS. Note that DG1/2 south block only has the single PPS, so need to exclude the fake DG1/2 PCHs Closes: https://gitlab.freedesktop.org/drm/i915/kernel/-/issues/11488 Fixes: 93cbc1accbce ("drm/i915/mtl: Add fake PCH for Meteor Lake") Cc: # v6.9+ Signed-off-by: Dnyaneshwar Bhadane Reviewed-by: Jani Nikula Signed-off-by: Jani Nikula Link: https://patchwork.freedesktop.org/patch/msgid/20240801111141.574854-1-dnyaneshwar.bhadane@intel.com (cherry picked from commit da1878b61c8d480c361ba6a39ce8a31c80b65826) Signed-off-by: Joonas Lahtinen drivers/gpu/drm/i915/display/intel_backlight.c | 3 +++ drivers/gpu/drm/i915/display/intel_pps.c | 3 +++ 2 files changed, 6 insertions(+) commit 38055789d15155109b41602ad719d770af507030 Author: Baochen Qiang Date: Thu Aug 1 18:04:07 2024 +0300 wifi: ath12k: use 128 bytes aligned iova in transmit path for WCN7850 In transmit path, it is likely that the iova is not aligned to PCIe TLP max payload size, which is 128 for WCN7850. Normally in such cases hardware is expected to split the packet into several parts in a manner such that they, other than the first one, have aligned iova. However due to hardware limitations, WCN7850 does not behave like that properly with some specific unaligned iova in transmit path. This easily results in target hang in a KPI transmit test: packet send/receive failure, WMI command send timeout etc. Also fatal error seen in PCIe level: ... Capabilities: ... ... DevSta: ... FatalErr+ ... ... ... Work around this by manually moving/reallocating payload buffer such that we can map it to a 128 bytes aligned iova. The moving requires sufficient head room or tail room in skb: for the former we can do ourselves a favor by asking some extra bytes when registering with mac80211, while for the latter we can do nothing. Moving/reallocating buffer consumes additional CPU cycles, but the good news is that an aligned iova increases PCIe efficiency. In my tests on some X86 platforms the KPI results are almost consistent. Since this is seen only with WCN7850, add a new hardware parameter to differentiate from others. Tested-on: WCN7850 hw2.0 PCI WLAN.HMT.1.0.c5-00481-QCAHMTSWPL_V1.0_V2.0_SILICONZ-3 Signed-off-by: Baochen Qiang Cc: Tested-by: Mark Pearson Signed-off-by: Kalle Valo Link: https://patch.msgid.link/20240715023814.20242-1-quic_bqiang@quicinc.com drivers/net/wireless/ath/ath12k/dp_tx.c | 72 +++++++++++++++++++++++++++++++++ drivers/net/wireless/ath/ath12k/hw.c | 6 +++ drivers/net/wireless/ath/ath12k/hw.h | 4 ++ drivers/net/wireless/ath/ath12k/mac.c | 1 + 4 files changed, 83 insertions(+) commit 203ed203fcc223d80737a7799f8244646363b739 Author: Krzysztof Kozlowski Date: Tue Jul 2 16:54:17 2024 +0200 arm64: dts: layerscape: fix thermal node names length Linux kernel expects thermal zone node names to be maximum of 19 characters (see THERMAL_NAME_LENGTH, including terminating NUL byte) and bindings/dtbs_check points that: fsl-ls2088a-rdb.dtb: thermal-zones: 'core-cluster1-thermal', 'core-cluster2-thermal', 'core-cluster3-thermal', 'core-cluster4-thermal' do not match any of the regexes: '^[a-zA-Z][a-zA-Z0-9\\-]{1,10}-thermal$', 'pinctrl-[0-9]+' Name longer than 19 characters leads to driver probe errors when registering such thermal zone. Signed-off-by: Krzysztof Kozlowski Signed-off-by: Shawn Guo arch/arm64/boot/dts/freescale/fsl-ls1028a.dtsi | 2 +- arch/arm64/boot/dts/freescale/fsl-ls1043a.dtsi | 2 +- arch/arm64/boot/dts/freescale/fsl-ls1046a.dtsi | 2 +- arch/arm64/boot/dts/freescale/fsl-ls1088a.dtsi | 2 +- arch/arm64/boot/dts/freescale/fsl-ls208xa.dtsi | 8 ++++---- arch/arm64/boot/dts/freescale/fsl-lx2160a.dtsi | 2 +- 6 files changed, 9 insertions(+), 9 deletions(-) commit 312c04cee408a8448ec8b639fe7f0434017d7161 Author: Stefan Binding Date: Thu Aug 1 16:50:44 2024 +0100 ALSA: hda: cs35l41: Stop creating ALSA Controls for firmware coefficients When the CS35L41 loads its firmware, it has a number of controls to affect its behaviour. Currently, these controls are exposed as ALSA Controls. These controls were never intended to be exposed to users but the firmware doesn't mark them hidden, so make the driver ignore them. Any changes in the coefficients handled by these controls needs to be matched to the individual system by SSID, which is already handled using the tuning file, when firmware is loaded, so UCM should not be setting these controls anyway. Signed-off-by: Stefan Binding Link: https://patch.msgid.link/20240801155047.456540-1-sbinding@opensource.cirrus.com Signed-off-by: Takashi Iwai sound/pci/hda/cs35l41_hda.c | 13 ------------- 1 file changed, 13 deletions(-) commit 34e1b1bb73244219b3b3e24911e56c6e7b2b679e Author: Simon Trimmer Date: Thu Aug 1 14:31:39 2024 +0000 ALSA: hda: cs35l56: Stop creating ALSA controls for firmware coefficients A number of laptops have gone to market with old firmware versions that export controls that have since been hidden, but we can't just install a newer firmware because the firmware for each product is customized and qualified by the OEM. The issue is that alsactl save and restore has no idea what controls are good to persist which can lead to misconfiguration. There is no reason that the UCM or user should need to interact with any of the ALSA controls for the firmware coefficients so they can be removed entirely, this also simplifies the driver. Signed-off-by: Simon Trimmer Link: https://patch.msgid.link/20240801143139.34549-1-simont@opensource.cirrus.com Signed-off-by: Takashi Iwai sound/pci/hda/cs35l56_hda.c | 38 +------------------------------------- sound/pci/hda/cs35l56_hda.h | 1 - 2 files changed, 1 insertion(+), 38 deletions(-) commit b7fd10333713e9984cc9b9c04f3681f80efdc809 Author: Konrad Dybcio Date: Thu Jul 11 11:37:57 2024 +0200 pinctrl: qcom: x1e80100: Update PDC hwirq map The current map seems to be out of sync (and includes a duplicate entry for GPIO193..). Replace it with the map present in shipping devices' ACPI tables. This new one seems more complete, as it e.g. contains GPIO145 (PCIE6a WAKE#) Fixes: 05e4941d97ef ("pinctrl: qcom: Add X1E80100 pinctrl driver") Signed-off-by: Konrad Dybcio Reviewed-by: Abel Vesa Reviewed-by: Rajendra Nayak Link: https://lore.kernel.org/20240711-topic-x1e_pdc_tlmm-v1-1-e278b249d793@linaro.org Signed-off-by: Linus Walleij drivers/pinctrl/qcom/pinctrl-x1e80100.c | 27 +++++++++++++++------------ 1 file changed, 15 insertions(+), 12 deletions(-) commit 8c8acb8f26cbde665b233dd1b9bbcbb9b86822dc Author: Masami Hiramatsu (Google) Date: Fri Aug 2 22:53:15 2024 +0900 kprobes: Fix to check symbol prefixes correctly Since str_has_prefix() takes the prefix as the 2nd argument and the string as the first, is_cfi_preamble_symbol() always fails to check the prefix. Fix the function parameter order so that it correctly check the prefix. Link: https://lore.kernel.org/all/172260679559.362040.7360872132937227206.stgit@devnote2/ Fixes: de02f2ac5d8c ("kprobes: Prohibit probing on CFI preamble symbol") Signed-off-by: Masami Hiramatsu (Google) kernel/kprobes.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) commit 0e8b53979ac86eddb3fd76264025a70071a25574 Author: Menglong Dong Date: Mon Aug 5 14:01:21 2024 +0900 bpf: kprobe: remove unused declaring of bpf_kprobe_override After the commit 66665ad2f102 ("tracing/kprobe: bpf: Compare instruction pointer with original one"), "bpf_kprobe_override" is not used anywhere anymore, and we can remove it now. Link: https://lore.kernel.org/all/20240710085939.11520-1-dongml2@chinatelecom.cn/ Fixes: 66665ad2f102 ("tracing/kprobe: bpf: Compare instruction pointer with original one") Signed-off-by: Menglong Dong Acked-by: Jiri Olsa Signed-off-by: Masami Hiramatsu (Google) include/linux/trace_events.h | 1 - 1 file changed, 1 deletion(-) commit 206f533a0a7c683982af473079c4111f4a0f9f5e Author: Dmitry Torokhov Date: Sun Aug 4 17:50:25 2024 -0700 Input: uinput - reject requests with unreasonable number of slots From: Dmitry Torokhov When exercising uinput interface syzkaller may try setting up device with a really large number of slots, which causes memory allocation failure in input_mt_init_slots(). While this allocation failure is handled properly and request is rejected, it results in syzkaller reports. Additionally, such request may put undue burden on the system which will try to free a lot of memory for a bogus request. Fix it by limiting allowed number of slots to 100. This can easily be extended if we see devices that can track more than 100 contacts. Reported-by: Tetsuo Handa Reported-by: syzbot Closes: https://syzkaller.appspot.com/bug?extid=0122fa359a69694395d5 Link: https://lore.kernel.org/r/Zqgi7NYEbpRsJfa2@google.com Signed-off-by: Dmitry Torokhov drivers/input/misc/uinput.c | 14 ++++++++++++++ 1 file changed, 14 insertions(+) commit fc289d3e8698f9b11edad6d73f371ebf35944c57 Author: Felix Kaechele Date: Sat Aug 3 23:13:10 2024 -0400 Input: edt-ft5x06 - add support for FocalTech FT8201 The driver supports the FT8201 chip as well. It registers up to 10 touch points. Tested on: Lenovo ThinkSmart View (CD-18781Y), LCM: BOE TV080WXM-LL4 Signed-off-by: Felix Kaechele Link: https://lore.kernel.org/r/20240804031310.331871-3-felix@kaechele.ca Signed-off-by: Dmitry Torokhov drivers/input/touchscreen/edt-ft5x06.c | 6 ++++++ 1 file changed, 6 insertions(+) commit 70d76b0e85ad126358baec1b44f797e61e3ebecc Author: Felix Kaechele Date: Sat Aug 3 23:13:09 2024 -0400 dt-bindings: input: touchscreen: edt-ft5x06: Document FT8201 support Document FocalTech FT8201 support by adding the compatible. Signed-off-by: Felix Kaechele Acked-by: Krzysztof Kozlowski Link: https://lore.kernel.org/r/20240804031310.331871-2-felix@kaechele.ca Signed-off-by: Dmitry Torokhov Documentation/devicetree/bindings/input/touchscreen/edt-ft5x06.yaml | 1 + 1 file changed, 1 insertion(+) commit de9c2c66ad8e787abec7c9d7eff4f8c3cdd28aed Author: Linus Torvalds Date: Sun Aug 4 13:50:53 2024 -0700 Linux 6.11-rc2 Makefile | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit b88f55389ad27f05ed84af9e1026aa64dbfabc9a Author: Tetsuo Handa Date: Sun Aug 4 18:48:10 2024 +0900 profiling: remove profile=sleep support The kernel sleep profile is no longer working due to a recursive locking bug introduced by commit 42a20f86dc19 ("sched: Add wrapper for get_wchan() to keep task blocked") Booting with the 'profile=sleep' kernel command line option added or executing # echo -n sleep > /sys/kernel/profiling after boot causes the system to lock up. Lockdep reports kthreadd/3 is trying to acquire lock: ffff93ac82e08d58 (&p->pi_lock){....}-{2:2}, at: get_wchan+0x32/0x70 but task is already holding lock: ffff93ac82e08d58 (&p->pi_lock){....}-{2:2}, at: try_to_wake_up+0x53/0x370 with the call trace being lock_acquire+0xc8/0x2f0 get_wchan+0x32/0x70 __update_stats_enqueue_sleeper+0x151/0x430 enqueue_entity+0x4b0/0x520 enqueue_task_fair+0x92/0x6b0 ttwu_do_activate+0x73/0x140 try_to_wake_up+0x213/0x370 swake_up_locked+0x20/0x50 complete+0x2f/0x40 kthread+0xfb/0x180 However, since nobody noticed this regression for more than two years, let's remove 'profile=sleep' support based on the assumption that nobody needs this functionality. Fixes: 42a20f86dc19 ("sched: Add wrapper for get_wchan() to keep task blocked") Cc: stable@vger.kernel.org # v5.16+ Signed-off-by: Tetsuo Handa Signed-off-by: Linus Torvalds Documentation/admin-guide/kernel-parameters.txt | 4 +--- include/linux/profile.h | 1 - kernel/profile.c | 11 +---------- kernel/sched/stats.c | 10 ---------- 4 files changed, 2 insertions(+), 24 deletions(-) commit 3a07703a523045cbdb0a5fa5e0902a9145ee43e9 Author: Dan Carpenter Date: Mon Jul 8 12:04:33 2024 -0500 phy: exynos5-usbdrd: fix error code in probe() Return negative -ENOMEM instead of positive ENOMEM. Fixes: 497ddafe915e ("phy: exynos5-usbdrd: convert Vbus supplies to regulator_bulk") Signed-off-by: Dan Carpenter Reviewed-by: Peter Griffin Reviewed-by: André Draszik Reviewed-by: Sam Protsenko Link: https://lore.kernel.org/r/a956a3e2-c6ce-4f07-ad80-ec8a96e00d16@stanley.mountain Signed-off-by: Vinod Koul drivers/phy/samsung/phy-exynos5-usbdrd.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit ce52c2532299c7ccfd34a52db8d071e890a78c59 Author: Xu Yang Date: Thu Aug 1 20:46:42 2024 +0800 phy: fsl-imx8mq-usb: fix tuning parameter name According to fsl,imx8mq-usb-phy.yaml, this tuning parameter should be fsl,phy-pcs-tx-deemph-3p5db-attenuation-db. Fixes: 63c85ad0cd81 ("phy: fsl-imx8mp-usb: add support for phy tuning") Cc: stable@vger.kernel.org Signed-off-by: Xu Yang Reviewed-by: Alexander Stein Link: https://lore.kernel.org/r/20240801124642.1152838-1-xu.yang_2@nxp.com Signed-off-by: Vinod Koul drivers/phy/freescale/phy-fsl-imx8mq-usb.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 0e8a0504da59041e775a95db3ebc1a6211423593 Author: Abel Vesa Date: Thu Aug 1 13:40:24 2024 +0300 phy: qcom: qmp-pcie: Fix X1E80100 PCIe Gen4 PHY initialisation Update the PCIe Gen4 PHY init sequence with the latest based on internal Qualcomm documentation. Fixes: 606060ce8fd0 ("phy: qcom-qmp-pcie: Add support for X1E80100 g3x2 and g4x2 PCIE") Signed-off-by: Abel Vesa Link: https://lore.kernel.org/r/20240801-x1e80100-phy-qmp-pcie-fix-config-v2-1-cdc0f22b4169@linaro.org Signed-off-by: Vinod Koul drivers/phy/qualcomm/phy-qcom-qmp-pcie.c | 23 ++++++++++++++++------- 1 file changed, 16 insertions(+), 7 deletions(-) commit a5dbd76a89423eca9f8de338350f2666aacfb432 Merge: 61ca6c78295e dd35a0933269 Author: Linus Torvalds Date: Sun Aug 4 08:57:08 2024 -0700 Merge tag 'x86-urgent-2024-08-04' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull x86 fixes from Thomas Gleixner: - Prevent a deadlock on cpu_hotplug_lock in the aperf/mperf driver. A recent change in the ACPI code which consolidated code pathes moved the invocation of init_freq_invariance_cppc() to be moved to a CPU hotplug handler. The first invocation on AMD CPUs ends up enabling a static branch which dead locks because the static branch enable tries to acquire cpu_hotplug_lock but that lock is already held write by the hotplug machinery. Use static_branch_enable_cpuslocked() instead and take the hotplug lock read for the Intel code path which is invoked from the architecture code outside of the CPU hotplug operations. - Fix the number of reserved bits in the sev_config structure bit field so that the bitfield does not exceed 64 bit. - Add missing Zen5 model numbers - Fix the alignment assumptions of pti_clone_pgtable() and clone_entry_text() on 32-bit: The code assumes PMD aligned code sections, but on 32-bit the kernel entry text is not PMD aligned. So depending on the code size and location, which is configuration and compiler dependent, entry text can cross a PMD boundary. As the start is not PMD aligned adding PMD size to the start address is larger than the end address which results in partially mapped entry code for user space. That causes endless recursion on the first entry from userspace (usually #PF). Cure this by aligning the start address in the addition so it ends up at the next PMD start address. clone_entry_text() enforces PMD mapping, but on 32-bit the tail might eventually be PTE mapped, which causes a map fail because the PMD for the tail is not a large page mapping. Use PTI_LEVEL_KERNEL_IMAGE for the clone() invocation which resolves to PTE on 32-bit and PMD on 64-bit. - Zero the 8-byte case for get_user() on range check failure on 32-bit The recend consolidation of the 8-byte get_user() case broke the zeroing in the failure case again. Establish it by clearing ECX before the range check and not afterwards as that obvioulsy can't be reached when the range check fails * tag 'x86-urgent-2024-08-04' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: x86/uaccess: Zero the 8-byte get_range case on failure on 32-bit x86/mm: Fix pti_clone_entry_text() for i386 x86/mm: Fix pti_clone_pgtable() alignment assumption x86/setup: Parse the builtin command line before merging x86/CPU/AMD: Add models 0x60-0x6f to the Zen5 range x86/sev: Fix __reserved field in sev_config x86/aperfmperf: Fix deadlock on cpu_hotplug_lock commit 61ca6c78295e242d4b681003112bfcdc54597489 Merge: 6cc82dc2bd11 f2655ac2c06a Author: Linus Torvalds Date: Sun Aug 4 08:50:16 2024 -0700 Merge tag 'timers-urgent-2024-08-04' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull timer fixes from Thomas Gleixner: "Two fixes for the timer/clocksource code: - The recent fix to make the take over of the broadcast timer more reliable retrieves a per CPU pointer in preemptible context. This went unnoticed in testing as some compilers hoist the access into the non-preemotible section where the pointer is actually used, but obviously compilers can rightfully invoke it where the code put it. Move it into the non-preemptible section right to the actual usage side to cure it. - The clocksource watchdog is supposed to emit a warning when the retry count is greater than one and the number of retries reaches the limit. The condition is backwards and warns always when the count is greater than one. Fixup the condition to prevent spamming dmesg" * tag 'timers-urgent-2024-08-04' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: clocksource: Fix brown-bag boolean thinko in cs_watchdog_read() tick/broadcast: Move per CPU pointer access into the atomic section commit 6cc82dc2bd1196141ffd5ebc99ecb52f9537443b Merge: 1ddeb0ef3cb7 fe7a11c78d2a Author: Linus Torvalds Date: Sun Aug 4 08:46:14 2024 -0700 Merge tag 'sched-urgent-2024-08-04' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull scheduler fixes from Thomas Gleixner: - When stime is larger than rtime due to accounting imprecision, then utime = rtime - stime becomes negative. As this is unsigned math, the result becomes a huge positive number. Cure it by resetting stime to rtime in that case, so utime becomes 0. - Restore consistent state when sched_cpu_deactivate() fails. When offlining a CPU fails in sched_cpu_deactivate() after the SMT present counter has been decremented, then the function aborts but fails to increment the SMT present counter and leaves it imbalanced. Consecutive operations cause it to underflow. Add the missing fixup for the error path. For SMT accounting the runqueue needs to marked online again in the error exit path to restore consistent state. * tag 'sched-urgent-2024-08-04' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: sched/core: Fix unbalance set_rq_online/offline() in sched_cpu_deactivate() sched/core: Introduce sched_set_rq_on/offline() helper sched/smt: Fix unbalance sched_smt_present dec/inc sched/smt: Introduce sched_smt_present_inc/dec() helper sched/cputime: Fix mul_u64_u64_div_u64() precision for cputime commit 1ddeb0ef3cb724615d2d3aa8b35e5e241c474b51 Merge: 953f776459a8 f73cefa3b72e Author: Linus Torvalds Date: Sun Aug 4 08:42:18 2024 -0700 Merge tag 'perf-urgent-2024-08-04' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull x86 perf fixes from Thomas Gleixner: - Move the smp_processor_id() invocation back into the non-preemtible region, so that the result is valid to use - Add the missing package C2 residency counters for Sierra Forest CPUs to make the newly added support actually useful * tag 'perf-urgent-2024-08-04' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: perf/x86: Fix smp_processor_id()-in-preemptible warnings perf/x86/intel/cstate: Add pkg C2 residency counter for Sierra Forest commit 953f776459a83f00ac940dd67c96d226d7041550 Merge: 3bc70ad12097 6be6cba9c437 Author: Linus Torvalds Date: Sun Aug 4 08:36:57 2024 -0700 Merge tag 'irq-urgent-2024-08-04' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull irq fixes from Thomas Gleixner: "A couple of fixes for interrupt chip drivers: - Make sure to skip the clear register space in the MBIGEN driver when calculating the node register index. Otherwise the clear register is clobbered and the wrong node registers are accessed. - Fix a signed/unsigned confusion in the loongarch CPU driver which converts an error code to a huge "valid" interrupt number. - Convert the mesion GPIO interrupt controller lock to a raw spinlock so it works on RT. - Add a missing static to a internal function in the pic32 EVIC driver" * tag 'irq-urgent-2024-08-04' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: irqchip/mbigen: Fix mbigen node address layout irqchip/meson-gpio: Convert meson_gpio_irq_controller::lock to 'raw_spinlock_t' irqchip/irq-pic32-evic: Add missing 'static' to internal function irqchip/loongarch-cpu: Fix return value of lpic_gsi_to_irq() commit 3bc70ad12097c19cd6c687bc5b12c31da14b63f7 Merge: ff58838015c1 224fa3552029 Author: Linus Torvalds Date: Sun Aug 4 08:32:31 2024 -0700 Merge tag 'locking-urgent-2024-08-04' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull locking fixes from Thomas Gleixner: "Two fixes for locking and jump labels: - Ensure that the atomic_cmpxchg() conditions are correct and evaluating to true on any non-zero value except 1. The missing check of the return value leads to inconsisted state of the jump label counter. - Add a missing type conversion in the paravirt spinlock code which makes loongson build again" * tag 'locking-urgent-2024-08-04' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: jump_label: Fix the fix, brown paper bags galore locking/pvqspinlock: Correct the type of "old" variable in pv_kick_node() commit ff58838015c14a12cb8c003b9d6fc062b49e8d9e Author: Rob Herring (Arm) Date: Tue Jul 30 15:00:30 2024 -0600 arm: dts: arm: versatile-ab: Fix duplicate clock node name Commit 04f08ef291d4 ("arm/arm64: dts: arm: Use generic clock and regulator nodenames") renamed nodes and created 2 "clock-24000000" nodes (at different paths). The kernel can't handle these duplicate names even though they are at different paths. Fix this by renaming one of the nodes to "clock-pclk". This name is aligned with other Arm boards (those didn't have a known frequency to use in the node name). Fixes: 04f08ef291d4 ("arm/arm64: dts: arm: Use generic clock and regulator nodenames") Reported-by: Guenter Roeck Signed-off-by: Rob Herring (Arm) Tested-by: Guenter Roeck Reviewed-by: Linus Walleij Tested-by: Linus Walleij Signed-off-by: Linus Torvalds arch/arm/boot/dts/arm/versatile-ab.dts | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 3f3f6d6123c3eb8bcae6c87776130d560250be77 Merge: 3c41df428e99 a91bfa67601c Author: Linus Torvalds Date: Sun Aug 4 08:18:40 2024 -0700 Merge tag '6.11-rc1-smb-client-fixes' of git://git.samba.org/sfrench/cifs-2.6 Pull smb client fixes from Steve French: - two reparse point fixes - minor cleanup - additional trace point (to help debug a recent problem) * tag '6.11-rc1-smb-client-fixes' of git://git.samba.org/sfrench/cifs-2.6: cifs: update internal version number smb: client: fix FSCTL_GET_REPARSE_POINT against NetApp smb3: add dynamic tracepoints for shutdown ioctl cifs: Remove cifs_aio_ctx smb: client: handle lack of FSCTL_GET_REPARSE_POINT support commit 3c41df428e9989eee79ed86d809a59ac03ac7c31 Merge: defaf1a2113a e2ed53694e53 Author: Linus Torvalds Date: Sun Aug 4 08:12:33 2024 -0700 Merge tag 'media/v6.11-2' of git://git.kernel.org/pub/scm/linux/kernel/git/mchehab/linux-media Pull media fixes from Mauro Carvalho Chehab: - two Kconfig fixes - one fix for the UVC driver addressing probing time detection of a UVC custom controls - one fix related to PDF generation * tag 'media/v6.11-2' of git://git.kernel.org/pub/scm/linux/kernel/git/mchehab/linux-media: media: v4l: Fix missing tabular column hint for Y14P format media: intel/ipu6: select AUXILIARY_BUS in Kconfig media: ipu-bridge: fix ipu6 Kconfig dependencies media: uvcvideo: Fix custom control mapping probing commit f17c06c6608ad4ecd2ccf321753fb511812d821b Author: Richard Fitzgerald Date: Fri Aug 2 16:22:14 2024 +0100 i2c: Fix conditional for substituting empty ACPI functions Add IS_ENABLED(CONFIG_I2C) to the conditional around a bunch of ACPI functions. The conditional around these functions depended only on CONFIG_ACPI. But the functions are implemented in I2C core, so are only present if CONFIG_I2C is enabled. Signed-off-by: Richard Fitzgerald Signed-off-by: Wolfram Sang include/linux/i2c.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit f6c29f710c1ff2590109f83be3e212b86c01e0f3 Author: Guenter Roeck Date: Tue Jul 30 07:19:41 2024 -0700 i2c: smbus: Send alert notifications to all devices if source not found If a SMBus alert is received and the originating device is not found, the reason may be that the address reported on the SMBus alert address is corrupted, for example because multiple devices asserted alert and do not correctly implement SMBus arbitration. If this happens, call alert handlers on all devices connected to the given I2C bus, in the hope that this cleans up the situation. This change reliably fixed the problem on a system with multiple devices on a single bus. Example log where the device on address 0x18 (ADM1021) and on address 0x4c (ADT7461A) both had the alert line asserted: smbus_alert 3-000c: SMBALERT# from dev 0x0c, flag 0 smbus_alert 3-000c: no driver alert()! smbus_alert 3-000c: SMBALERT# from dev 0x0c, flag 0 smbus_alert 3-000c: no driver alert()! lm90 3-0018: temp1 out of range, please check! lm90 3-0018: Disabling ALERT# lm90 3-0029: Everything OK lm90 3-002a: Everything OK lm90 3-004c: temp1 out of range, please check! lm90 3-004c: temp2 out of range, please check! lm90 3-004c: Disabling ALERT# Fixes: b5527a7766f0 ("i2c: Add SMBus alert support") Signed-off-by: Guenter Roeck [wsa: fixed a typo in the commit message] Signed-off-by: Wolfram Sang drivers/i2c/i2c-smbus.c | 38 +++++++++++++++++++++++++++++++++++--- 1 file changed, 35 insertions(+), 3 deletions(-) commit 14ab4792ee120c022f276a7e4768f4dcb08f0cdd Author: Dmitry Safonov <0x7f454c46@gmail.com> Date: Thu Aug 1 01:13:28 2024 +0100 net/tcp: Disable TCP-AO static key after RCU grace period The lifetime of TCP-AO static_key is the same as the last tcp_ao_info. On the socket destruction tcp_ao_info ceases to be with RCU grace period, while tcp-ao static branch is currently deferred destructed. The static key definition is : DEFINE_STATIC_KEY_DEFERRED_FALSE(tcp_ao_needed, HZ); which means that if RCU grace period is delayed by more than a second and tcp_ao_needed is in the process of disablement, other CPUs may yet see tcp_ao_info which atent dead, but soon-to-be. And that breaks the assumption of static_key_fast_inc_not_disabled(). See the comment near the definition: > * The caller must make sure that the static key can't get disabled while > * in this function. It doesn't patch jump labels, only adds a user to > * an already enabled static key. Originally it was introduced in commit eb8c507296f6 ("jump_label: Prevent key->enabled int overflow"), which is needed for the atomic contexts, one of which would be the creation of a full socket from a request socket. In that atomic context, it's known by the presence of the key (md5/ao) that the static branch is already enabled. So, the ref counter for that static branch is just incremented instead of holding the proper mutex. static_key_fast_inc_not_disabled() is just a helper for such usage case. But it must not be used if the static branch could get disabled in parallel as it's not protected by jump_label_mutex and as a result, races with jump_label_update() implementation details. Happened on netdev test-bot[1], so not a theoretical issue: [] jump_label: Fatal kernel bug, unexpected op at tcp_inbound_hash+0x1a7/0x870 [ffffffffa8c4e9b7] (eb 50 0f 1f 44 != 66 90 0f 1f 00)) size:2 type:1 [] ------------[ cut here ]------------ [] kernel BUG at arch/x86/kernel/jump_label.c:73! [] Oops: invalid opcode: 0000 [#1] PREEMPT SMP KASAN NOPTI [] CPU: 3 PID: 243 Comm: kworker/3:3 Not tainted 6.10.0-virtme #1 [] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.3-0-ga6ed6b701f0a-prebuilt.qemu.org 04/01/2014 [] Workqueue: events jump_label_update_timeout [] RIP: 0010:__jump_label_patch+0x2f6/0x350 ... [] Call Trace: [] [] arch_jump_label_transform_queue+0x6c/0x110 [] __jump_label_update+0xef/0x350 [] __static_key_slow_dec_cpuslocked.part.0+0x3c/0x60 [] jump_label_update_timeout+0x2c/0x40 [] process_one_work+0xe3b/0x1670 [] worker_thread+0x587/0xce0 [] kthread+0x28a/0x350 [] ret_from_fork+0x31/0x70 [] ret_from_fork_asm+0x1a/0x30 [] [] Modules linked in: veth [] ---[ end trace 0000000000000000 ]--- [] RIP: 0010:__jump_label_patch+0x2f6/0x350 [1]: https://netdev-3.bots.linux.dev/vmksft-tcp-ao-dbg/results/696681/5-connect-deny-ipv6/stderr Cc: stable@kernel.org Fixes: 67fa83f7c86a ("net/tcp: Add static_key for TCP-AO") Signed-off-by: Dmitry Safonov <0x7f454c46@gmail.com> Reviewed-by: Eric Dumazet Signed-off-by: David S. Miller net/ipv4/tcp_ao.c | 43 ++++++++++++++++++++++++++++++------------- 1 file changed, 30 insertions(+), 13 deletions(-) commit defaf1a2113a22b00dfa1abc0fd2014820eaf065 Merge: d3426a6ed9d8 7c632fc3ce64 Author: Linus Torvalds Date: Sat Aug 3 15:12:56 2024 -0700 Merge tag 'scsi-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi Pull SCSI fixes from James Bottomley: "One core change that reverts the double message print patch in sd.c (it was causing regressions on embedded systems). The rest are driver fixes in ufs, mpt3sas and mpi3mr" * tag 'scsi-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi: scsi: ufs: exynos: Don't resume FMP when crypto support is disabled scsi: mpt3sas: Avoid IOMMU page faults on REPORT ZONES scsi: mpi3mr: Avoid IOMMU page faults on REPORT ZONES scsi: ufs: core: Do not set link to OFF state while waking up from hibernation scsi: Revert "scsi: sd: Do not repeat the starting disk message" scsi: ufs: core: Fix deadlock during RTC update scsi: ufs: core: Bypass quick recovery if force reset is needed scsi: ufs: core: Check LSDBS cap when !mcq commit d3426a6ed9d8398bfee2a1c5cd0ae50f2f4494a8 Merge: 1dd950f2888f 7bf888fa26e8 Author: Linus Torvalds Date: Sat Aug 3 09:09:25 2024 -0700 Merge tag 'xfs-6.11-fixes-1' of git://git.kernel.org/pub/scm/fs/xfs/xfs-linux Pull xfs fixes from Chandan Babu: - Fix memory leak when corruption is detected during scrubbing parent pointers - Allow SECURE namespace xattrs to use reserved block pool to in order to prevent ENOSPC - Save stack space by passing tracepoint's char array to file_path() instead of another stack variable - Remove unused parameter in macro XFS_DQUOT_LOGRES - Replace comma with semicolon in a couple of places * tag 'xfs-6.11-fixes-1' of git://git.kernel.org/pub/scm/fs/xfs/xfs-linux: xfs: convert comma to semicolon xfs: convert comma to semicolon xfs: remove unused parameter in macro XFS_DQUOT_LOGRES xfs: fix file_path handling in tracepoints xfs: allow SECURE namespace xattrs to use reserved block pool xfs: fix a memory leak commit 1dd950f2888f63ec163f3f142161e21a66685e35 Merge: b6547e54864b 7ae04ba36b38 Author: Linus Torvalds Date: Sat Aug 3 09:03:21 2024 -0700 Merge tag 'parisc-for-6.11-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/deller/parisc-linux Pull parisc architecture fixes from Helge Deller: - fix unaligned memory accesses when calling BPF functions - adjust memory size constants to fix possible DMA corruptions * tag 'parisc-for-6.11-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/deller/parisc-linux: parisc: fix a possible DMA corruption parisc: fix unaligned accesses in BPF commit de80af5c2ffd9c3f02792f6979296cb6f74e82e5 Author: Francesco Dolcini Date: Wed Jul 31 16:06:57 2024 +0200 iio: adc: ads1119: Fix IRQ flags Remove IRQF_TRIGGER_FALLING flag from irq request, this should come from the platform firmware and should not be hard-coded into the driver. Add IRQF_ONESHOT flag to the irq request, the interrupt should not be re-activated in interrupt context, it should be done only after the device irq handler run. Fixes: a9306887eba4 ("iio: adc: ti-ads1119: Add driver") Signed-off-by: Francesco Dolcini Reviwed-by: João Paulo Gonçalves Link: https://patch.msgid.link/20240731140657.88265-1-francesco@dolcini.it Signed-off-by: Jonathan Cameron drivers/iio/adc/ti-ads1119.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit b6547e54864b998af21fdcaa0a88cf8e7efe641a Author: Linus Torvalds Date: Fri Aug 2 18:12:06 2024 -0700 runtime constants: deal with old decrepit linkers The runtime constants linker script depended on documented linker behavior [1]: "If an output section’s name is the same as the input section’s name and is representable as a C identifier, then the linker will automatically PROVIDE two symbols: __start_SECNAME and __stop_SECNAME, where SECNAME is the name of the section. These indicate the start address and end address of the output section respectively" to just automatically define the symbol names for the bounds of the runtime constant arrays. It turns out that this isn't actually something we can rely on, with old linkers not generating these automatic symbols. It looks to have been introduced in binutils-2.29 back in 2017, and we still support building with versions all the way back to binutils-2.25 (from 2015). And yes, Oleg actually seems to be using such ancient versions of binutils. So instead of depending on the implicit symbols from "section names match and are representable C identifiers", just do this all manually. It's not like it causes us any extra pain, we already have to do that for all the other sections that we use that often have special characters in them. Reported-and-tested-by: Oleg Nesterov Link: https://sourceware.org/binutils/docs/ld/Input-Section-Example.html [1] Link: https://lore.kernel.org/all/20240802114518.GA20924@redhat.com/ Signed-off-by: Linus Torvalds include/asm-generic/vmlinux.lds.h | 11 +++++------ 1 file changed, 5 insertions(+), 6 deletions(-) commit 8a3dcc970dc57b358c8db2702447bf0af4e0d83a Author: Matteo Martelli Date: Tue Jul 30 10:11:53 2024 +0200 iio: fix scale application in iio_convert_raw_to_processed_unlocked When the scale_type is IIO_VAL_INT_PLUS_MICRO or IIO_VAL_INT_PLUS_NANO the scale passed as argument is only applied to the fractional part of the value. Fix it by also multiplying the integer part by the scale provided. Fixes: 48e44ce0f881 ("iio:inkern: Add function to read the processed value") Signed-off-by: Matteo Martelli Link: https://patch.msgid.link/20240730-iio-fix-scale-v1-1-6246638c8daa@gmail.com Cc: Signed-off-by: Jonathan Cameron drivers/iio/inkern.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) commit 2f6b92d0f69f04d9e2ea0db1228ab7f82f3173af Author: Dumitru Ceclan Date: Wed Jul 31 15:37:23 2024 +0300 iio: adc: ad7124: fix config comparison The ad7124_find_similar_live_cfg() computes the compare size by substracting the address of the cfg struct from the address of the live field. Because the live field is the first field in the struct, the result is 0. Also, the memcmp() call is made from the start of the cfg struct, which includes the live and cfg_slot fields, which are not relevant for the comparison. Fix by grouping the relevant fields with struct_group() and use the size of the group to compute the compare size; make the memcmp() call from the address of the group. Fixes: 7b8d045e497a ("iio: adc: ad7124: allow more than 8 channels") Signed-off-by: Dumitru Ceclan Reviewed-by: Nuno Sa Link: https://patch.msgid.link/20240731-ad7124-fix-v1-2-46a76aa4b9be@analog.com Cc: Signed-off-by: Jonathan Cameron drivers/iio/adc/ad7124.c | 26 +++++++++++++++----------- 1 file changed, 15 insertions(+), 11 deletions(-) commit 96f9ab0d5933c1c00142dd052f259fce0bc3ced2 Author: Dumitru Ceclan Date: Wed Jul 31 15:37:22 2024 +0300 iio: adc: ad7124: fix chip ID mismatch The ad7124_soft_reset() function has the assumption that the chip will assert the "power-on reset" bit in the STATUS register after a software reset without any delay. The POR bit =0 is used to check if the chip initialization is done. A chip ID mismatch probe error appears intermittently when the probe continues too soon and the ID register does not contain the expected value. Fix by adding a 200us delay after the software reset command is issued. Fixes: b3af341bbd96 ("iio: adc: Add ad7124 support") Signed-off-by: Dumitru Ceclan Reviewed-by: Nuno Sa Link: https://patch.msgid.link/20240731-ad7124-fix-v1-1-46a76aa4b9be@analog.com Cc: Signed-off-by: Jonathan Cameron drivers/iio/adc/ad7124.c | 1 + 1 file changed, 1 insertion(+) commit e2ed53694e5356a55fd539a4d8dc56c2fa42b2ff Merge: 914f8961879d 66558537cb8c Author: Hans Verkuil Date: Sat Aug 3 11:01:04 2024 +0200 Merge tag 'tags/fixes-media-uvc-20230722' of git://git.kernel.org/pub/scm/linux/kernel/git/pinchartl/linux.git uvcvideo v6.11 regression fix: fix custom control mapping probing Signed-off-by: Hans Verkuil commit f874d7210d882cb1c58a8e3da66f61cdc63cd4b4 Author: Li Feng Date: Thu Jul 18 16:07:22 2024 +0800 scsi: sd: Keep the discard mode stable There is a scenario where a large number of discard commands are issued when the iscsi initiator connects to the target and then performs a session rescan operation. There is a time window, most of the commands are in UNMAP mode, and some discard commands become WRITE SAME with UNMAP. The discard mode has been negotiated during the SCSI probe. If the mode is temporarily changed from UNMAP to WRITE SAME with UNMAP, an I/O ERROR may occur because the target may not implement WRITE SAME with UNMAP. Keep the discard mode stable to fix this issue. Signed-off-by: Li Feng Link: https://lore.kernel.org/r/20240718080751.313102-2-fengli@smartx.com Reviewed-by: Christoph Hellwig Reviewed-by: Martin K. Petersen Signed-off-by: Martin K. Petersen drivers/scsi/sd.c | 6 ++---- 1 file changed, 2 insertions(+), 4 deletions(-) commit fba917b169bea5f8f2ee300e19d5f7a6341a5251 Author: Praveen Kaligineedi Date: Thu Aug 1 13:56:19 2024 -0700 gve: Fix use of netif_carrier_ok() GVE driver wrongly relies on netif_carrier_ok() to check the interface administrative state when resources are being allocated/deallocated for queue(s). netif_carrier_ok() needs to be replaced with netif_running() for all such cases. Administrative state is the result of "ip link set dev up/down". It reflects whether the administrator wants to use the device for traffic and the corresponding resources have been allocated. Fixes: 5f08cd3d6423 ("gve: Alloc before freeing when adjusting queues") Signed-off-by: Praveen Kaligineedi Reviewed-by: Shailend Chand Reviewed-by: Willem de Bruijn Link: https://patch.msgid.link/20240801205619.987396-1-pkaligineedi@google.com Signed-off-by: Jakub Kicinski drivers/net/ethernet/google/gve/gve_ethtool.c | 2 +- drivers/net/ethernet/google/gve/gve_main.c | 12 ++++++------ 2 files changed, 7 insertions(+), 7 deletions(-) commit 89108cb5c28527c1882df2987394e5c261a1f4aa Author: Kyle Swenson Date: Wed Jul 31 15:42:14 2024 +0000 net: pse-pd: tps23881: Fix the device ID check The DEVID register contains two pieces of information: the device ID in the upper nibble, and the silicon revision number in the lower nibble. The driver should work fine with any silicon revision, so let's mask that out in the device ID check. Fixes: 20e6d190ffe1 ("net: pse-pd: Add TI TPS23881 PSE controller driver") Signed-off-by: Kyle Swenson Reviewed-by: Thomas Petazzoni Acked-by: Oleksij Rempel Link: https://patch.msgid.link/20240731154152.4020668-1-kyle.swenson@est.tech Signed-off-by: Jakub Kicinski drivers/net/pse-pd/tps23881.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) commit 9ab0faa7f9ffe31296dbb9bbe6f76c72c14eea18 Author: Kuniyuki Iwashima Date: Wed Jul 31 16:46:24 2024 -0700 sctp: Fix null-ptr-deref in reuseport_add_sock(). syzbot reported a null-ptr-deref while accessing sk2->sk_reuseport_cb in reuseport_add_sock(). [0] The repro first creates a listener with SO_REUSEPORT. Then, it creates another listener on the same port and concurrently closes the first listener. The second listen() calls reuseport_add_sock() with the first listener as sk2, where sk2->sk_reuseport_cb is not expected to be cleared concurrently, but the close() does clear it by reuseport_detach_sock(). The problem is SCTP does not properly synchronise reuseport_alloc(), reuseport_add_sock(), and reuseport_detach_sock(). The caller of reuseport_alloc() and reuseport_{add,detach}_sock() must provide synchronisation for sockets that are classified into the same reuseport group. Otherwise, such sockets form multiple identical reuseport groups, and all groups except one would be silently dead. 1. Two sockets call listen() concurrently 2. No socket in the same group found in sctp_ep_hashtable[] 3. Two sockets call reuseport_alloc() and form two reuseport groups 4. Only one group hit first in __sctp_rcv_lookup_endpoint() receives incoming packets Also, the reported null-ptr-deref could occur. TCP/UDP guarantees that would not happen by holding the hash bucket lock. Let's apply the locking strategy to __sctp_hash_endpoint() and __sctp_unhash_endpoint(). [0]: Oops: general protection fault, probably for non-canonical address 0xdffffc0000000002: 0000 [#1] PREEMPT SMP KASAN PTI KASAN: null-ptr-deref in range [0x0000000000000010-0x0000000000000017] CPU: 1 UID: 0 PID: 10230 Comm: syz-executor119 Not tainted 6.10.0-syzkaller-12585-g301927d2d2eb #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/27/2024 RIP: 0010:reuseport_add_sock+0x27e/0x5e0 net/core/sock_reuseport.c:350 Code: 00 0f b7 5d 00 bf 01 00 00 00 89 de e8 1b a4 ff f7 83 fb 01 0f 85 a3 01 00 00 e8 6d a0 ff f7 49 8d 7e 12 48 89 f8 48 c1 e8 03 <42> 0f b6 04 28 84 c0 0f 85 4b 02 00 00 41 0f b7 5e 12 49 8d 7e 14 RSP: 0018:ffffc9000b947c98 EFLAGS: 00010202 RAX: 0000000000000002 RBX: ffff8880252ddf98 RCX: ffff888079478000 RDX: 0000000000000000 RSI: 0000000000000001 RDI: 0000000000000012 RBP: 0000000000000001 R08: ffffffff8993e18d R09: 1ffffffff1fef385 R10: dffffc0000000000 R11: fffffbfff1fef386 R12: ffff8880252ddac0 R13: dffffc0000000000 R14: 0000000000000000 R15: 0000000000000000 FS: 00007f24e45b96c0(0000) GS:ffff8880b9300000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007ffcced5f7b8 CR3: 00000000241be000 CR4: 00000000003506f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: __sctp_hash_endpoint net/sctp/input.c:762 [inline] sctp_hash_endpoint+0x52a/0x600 net/sctp/input.c:790 sctp_listen_start net/sctp/socket.c:8570 [inline] sctp_inet_listen+0x767/0xa20 net/sctp/socket.c:8625 __sys_listen_socket net/socket.c:1883 [inline] __sys_listen+0x1b7/0x230 net/socket.c:1894 __do_sys_listen net/socket.c:1902 [inline] __se_sys_listen net/socket.c:1900 [inline] __x64_sys_listen+0x5a/0x70 net/socket.c:1900 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7f24e46039b9 Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 91 1a 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b0 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007f24e45b9228 EFLAGS: 00000246 ORIG_RAX: 0000000000000032 RAX: ffffffffffffffda RBX: 00007f24e468e428 RCX: 00007f24e46039b9 RDX: 00007f24e46039b9 RSI: 0000000000000003 RDI: 0000000000000004 RBP: 00007f24e468e420 R08: 00007f24e45b96c0 R09: 00007f24e45b96c0 R10: 00007f24e45b96c0 R11: 0000000000000246 R12: 00007f24e468e42c R13: 00007f24e465a5dc R14: 0020000000000001 R15: 00007ffcced5f7d8 Modules linked in: Fixes: 6ba845740267 ("sctp: process sk_reuseport in sctp_get_port_local") Reported-by: syzbot+e6979a5d2f10ecb700e4@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=e6979a5d2f10ecb700e4 Tested-by: syzbot+e6979a5d2f10ecb700e4@syzkaller.appspotmail.com Signed-off-by: Kuniyuki Iwashima Acked-by: Xin Long Link: https://patch.msgid.link/20240731234624.94055-1-kuniyu@amazon.com Signed-off-by: Jakub Kicinski net/sctp/input.c | 19 +++++++++++-------- 1 file changed, 11 insertions(+), 8 deletions(-) commit eeef5f183f1c1bdc3ea42b26ded1da2a8a5c69d9 Author: Stephen Hemminger Date: Thu Aug 1 09:28:42 2024 -0700 MAINTAINERS: update status of sky2 and skge drivers The old SysKonnect NIc's are not used or actively maintained anymore. My sky2 NIC's are all in box in back corner of attic. Signed-off-by: Stephen Hemminger Link: https://patch.msgid.link/20240801162930.212299-1-stephen@networkplumber.org Signed-off-by: Jakub Kicinski MAINTAINERS | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 17712b7ea0756799635ba159cc773082230ed028 Merge: d9ef02e56f0f c3fca4fb83f7 Author: Linus Torvalds Date: Fri Aug 2 14:18:31 2024 -0700 Merge tag 'io_uring-6.11-20240802' of git://git.kernel.dk/linux Pull io_uring fixes from Jens Axboe: "Two minor tweaks for the NAPI handling, both from Olivier: - Kill two unused list definitions - Ensure that multishot NAPI doesn't age away" * tag 'io_uring-6.11-20240802' of git://git.kernel.dk/linux: io_uring: remove unused local list heads in NAPI functions io_uring: keep multishot request NAPI timeout current commit d9ef02e56f0fd3668b6d7cb17f9399ea53f12edd Merge: 041b1061d892 a09074228977 Author: Linus Torvalds Date: Fri Aug 2 14:10:11 2024 -0700 Merge tag 'thermal-6.11-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm Pull thermal control fixes from Rafael Wysocki: "These fix a few issues related to the MSI IRQs management in the int340x thermal driver, fix a thermal core issue that may lead to missing trip point crossing events and update the thermal core documentation. Specifics: - Fix MSI error path cleanup in int340x, allow it to work with a subset of thermal MSI IRQs if some of them are not working and make it free all MSI IRQs on module exit (Srinivas Pandruvada) - Fix a thermal core issue that may lead to missing trip point crossing events in some cases when thermal_zone_set_trips() is used and update the thermal core documentation (Rafael Wysocki)" * tag 'thermal-6.11-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm: thermal: core: Update thermal zone registration documentation thermal: trip: Avoid skipping trips in thermal_zone_set_trips() thermal: intel: int340x: Free MSI IRQ vectors on module exit thermal: intel: int340x: Allow limited thermal MSI support thermal: intel: int340x: Fix kernel warning during MSI cleanup commit 041b1061d89203e933cb385d70d0e85f90a08417 Merge: 1c4246294c98 cfb00a357864 Author: Linus Torvalds Date: Fri Aug 2 13:46:43 2024 -0700 Merge tag 'arm64-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux Pull arm64 fixes from Catalin Marinas: - Expand the speculative SSBS errata workaround to more CPUs - Ensure jump label changes are visible to all CPUs with a kick_all_cpus_sync() (and also enable jump label batching as part of the fix) - The shadow call stack sanitiser is currently incompatible with Rust, make CONFIG_RUST conditional on !CONFIG_SHADOW_CALL_STACK * tag 'arm64-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux: arm64: jump_label: Ensure patched jump_labels are visible to all CPUs rust: SHADOW_CALL_STACK is incompatible with Rust arm64: errata: Expand speculative SSBS workaround (again) arm64: cputype: Add Cortex-A725 definitions arm64: cputype: Add Cortex-X1C definitions commit 12653ec36112ab55fa06c01db7c4432653d30a8d Author: Qu Wenruo Date: Fri Jul 19 18:56:46 2024 +0930 btrfs: avoid using fixed char array size for tree names [BUG] There is a bug report that using the latest trunk GCC 15, btrfs would cause unterminated-string-initialization warning: linux-6.6/fs/btrfs/print-tree.c:29:49: error: initializer-string for array of ‘char’ is too long [-Werror=unterminated-string-initialization] 29 | { BTRFS_BLOCK_GROUP_TREE_OBJECTID, "BLOCK_GROUP_TREE" }, | ^~~~~~~~~~~~~~~~~~ [CAUSE] To print tree names we have an array of root_name_map structure, which uses "char name[16];" to store the name string of a tree. But the following trees have names exactly at 16 chars length: - "BLOCK_GROUP_TREE" - "RAID_STRIPE_TREE" This means we will have no space for the terminating '\0', and can lead to unexpected access when printing the name. [FIX] Instead of "char name[16];" use "const char *" instead. Since the name strings are all read-only data, and are all NULL terminated by default, there is not much need to bother the length at all. Reported-by: Sam James Reported-by: Alejandro Colomar Fixes: edde81f1abf29 ("btrfs: add raid stripe tree pretty printer") Fixes: 9c54e80ddc6bd ("btrfs: add code to support the block group root") CC: stable@vger.kernel.org # 6.1+ Suggested-by: Alejandro Colomar Reviewed-by: Johannes Thumshirn Reviewed-by: Alejandro Colomar Signed-off-by: Qu Wenruo Reviewed-by: David Sterba Signed-off-by: David Sterba fs/btrfs/print-tree.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit e0391e92f9ab4fb3dbdeb139c967dcfa7ac4b115 Author: Filipe Manana Date: Fri Aug 2 09:38:51 2024 +0100 btrfs: fix double inode unlock for direct IO sync writes If we do a direct IO sync write, at btrfs_sync_file(), and we need to skip inode logging or we get an error starting a transaction or an error when flushing delalloc, we end up unlocking the inode when we shouldn't under the 'out_release_extents' label, and then unlock it again at btrfs_direct_write(). Fix that by checking if we have to skip inode unlocking under that label. Reported-by: syzbot+7dbbb74af6291b5a5a8b@syzkaller.appspotmail.com Link: https://lore.kernel.org/linux-btrfs/000000000000dfd631061eaeb4bc@google.com/ Fixes: 939b656bc8ab ("btrfs: fix corruption after buffer fault in during direct IO append write") Reviewed-by: Josef Bacik Signed-off-by: Filipe Manana Signed-off-by: David Sterba fs/btrfs/file.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) commit 19d837bc881b2f9f72f9eb506b46c2e2d983896d Author: Sebastian Ott Date: Tue Jul 23 12:12:04 2024 +0200 KVM: arm64: vgic: fix unexpected unlock sparse warnings Get rid of unexpected unlock sparse warnings in vgic code by adding an annotation to vgic_queue_irq_unlock(). arch/arm64/kvm/vgic/vgic.c:334:17: warning: context imbalance in 'vgic_queue_irq_unlock' - unexpected unlock arch/arm64/kvm/vgic/vgic.c:419:5: warning: context imbalance in 'kvm_vgic_inject_irq' - different lock contexts for basic block Signed-off-by: Sebastian Ott Reviewed-by: Marc Zyngier Link: https://lore.kernel.org/r/20240723101204.7356-4-sebott@redhat.com Signed-off-by: Oliver Upton arch/arm64/kvm/vgic/vgic.c | 2 +- arch/arm64/kvm/vgic/vgic.h | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) commit 0aa34b37a78d063da58838b84b20a68a94d919fd Author: Sebastian Ott Date: Tue Jul 23 12:12:03 2024 +0200 KVM: arm64: fix kdoc warnings in W=1 builds Fix kdoc warnings by adding missing function parameter descriptions or by conversion to a normal comment. Signed-off-by: Sebastian Ott Reviewed-by: Marc Zyngier Link: https://lore.kernel.org/r/20240723101204.7356-3-sebott@redhat.com Signed-off-by: Oliver Upton arch/arm64/kvm/arm.c | 1 + arch/arm64/kvm/vgic/vgic-irqfd.c | 7 ++++--- arch/arm64/kvm/vgic/vgic-its.c | 18 +++++++++++------- arch/arm64/kvm/vgic/vgic-v3.c | 2 +- 4 files changed, 17 insertions(+), 11 deletions(-) commit 963a08e586bd45fd55f4c1752e98029ce83fc091 Author: Sebastian Ott Date: Tue Jul 23 12:12:02 2024 +0200 KVM: arm64: fix override-init warnings in W=1 builds Add -Wno-override-init to the build flags for sys_regs.c, handle_exit.c, and switch.c to fix warnings like the following: arch/arm64/kvm/hyp/vhe/switch.c:271:43: warning: initialized field overwritten [-Woverride-init] 271 | [ESR_ELx_EC_CP15_32] = kvm_hyp_handle_cp15_32, | Signed-off-by: Sebastian Ott Reviewed-by: Marc Zyngier Link: https://lore.kernel.org/r/20240723101204.7356-2-sebott@redhat.com Signed-off-by: Oliver Upton arch/arm64/kvm/Makefile | 3 +++ arch/arm64/kvm/hyp/nvhe/Makefile | 2 ++ arch/arm64/kvm/hyp/vhe/Makefile | 2 ++ 3 files changed, 7 insertions(+) commit 32b9a52f88a5713bf8a02dae66f2ad69705de69f Author: Danilo Krummrich Date: Tue Jul 23 16:20:52 2024 +0200 KVM: arm64: free kvm->arch.nested_mmus with kvfree() kvm->arch.nested_mmus is allocated with kvrealloc(), hence free it with kvfree() instead of kfree(). Fixes: 4f128f8e1aaa ("KVM: arm64: nv: Support multiple nested Stage-2 mmu structures") Signed-off-by: Danilo Krummrich Reviewed-by: Marc Zyngier Link: https://lore.kernel.org/r/20240723142204.758796-1-dakr@kernel.org Signed-off-by: Oliver Upton arch/arm64/kvm/nested.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 90ec3a8a7fd0d43026fcca979713e077d4883b56 Author: Richard Fitzgerald Date: Fri Aug 2 16:22:13 2024 +0100 spi: Add empty versions of ACPI functions Provide empty versions of acpi_spi_count_resources(), acpi_spi_device_alloc() and acpi_spi_find_controller_by_adev() if the real functions are not being built. This commit fixes two problems with the original definitions: 1) There wasn't an empty version of these functions 2) The #if only depended on CONFIG_ACPI. But the functions are implemented in the core spi.c so CONFIG_SPI_MASTER must also be enabled for the real functions to exist. Signed-off-by: Richard Fitzgerald Link: https://patch.msgid.link/20240802152215.20831-2-rf@opensource.cirrus.com Signed-off-by: Mark Brown include/linux/spi/spi.h | 19 ++++++++++++++++++- 1 file changed, 18 insertions(+), 1 deletion(-) commit 1c4246294c9841c50805cec0627030c083e019c6 Merge: 725d410facf9 31634d7597d8 Author: Linus Torvalds Date: Fri Aug 2 10:33:06 2024 -0700 Merge tag 'ceph-for-6.11-rc2' of https://github.com/ceph/ceph-client Pull ceph fix from Ilya Dryomov: "A fix for a potential hang in the MDS when cap revocation races with the client releasing the caps in question, marked for stable" * tag 'ceph-for-6.11-rc2' of https://github.com/ceph/ceph-client: ceph: force sending a cap update msg back to MDS for revoke op commit 725d410facf9f232832bf6ea14a0c8814d890e06 Merge: 948752d2e010 1773014a9759 Author: Linus Torvalds Date: Fri Aug 2 10:17:49 2024 -0700 Merge tag 'for-linus' of git://git.kernel.org/pub/scm/virt/kvm/kvm Pull kvm updates from Paolo Bonzini: "The bulk of the changes here is a largish change to guest_memfd, delaying the clearing and encryption of guest-private pages until they are actually added to guest page tables. This started as "let's make it impossible to misuse the API" for SEV-SNP; but then it ballooned a bit. The new logic is generally simpler and more ready for hugepage support in guest_memfd. Summary: - fix latent bug in how usage of large pages is determined for confidential VMs - fix "underline too short" in docs - eliminate log spam from limited APIC timer periods - disallow pre-faulting of memory before SEV-SNP VMs are initialized - delay clearing and encrypting private memory until it is added to guest page tables - this change also enables another small cleanup: the checks in SNP_LAUNCH_UPDATE that limit it to non-populated, private pages can now be moved in the common kvm_gmem_populate() function - fix compilation error that the RISC-V merge introduced in selftests" * tag 'for-linus' of git://git.kernel.org/pub/scm/virt/kvm/kvm: KVM: x86/mmu: fix determination of max NPT mapping level for private pages KVM: riscv: selftests: Fix compile error KVM: guest_memfd: abstract how prepared folios are recorded KVM: guest_memfd: let kvm_gmem_populate() operate only on private gfns KVM: extend kvm_range_has_memory_attributes() to check subset of attributes KVM: cleanup and add shortcuts to kvm_range_has_memory_attributes() KVM: guest_memfd: move check for already-populated page to common code KVM: remove kvm_arch_gmem_prepare_needed() KVM: guest_memfd: make kvm_gmem_prepare_folio() operate on a single struct kvm KVM: guest_memfd: delay kvm_gmem_prepare_folio() until the memory is passed to the guest KVM: guest_memfd: return locked folio from __kvm_gmem_get_pfn KVM: rename CONFIG_HAVE_KVM_GMEM_* to CONFIG_HAVE_KVM_ARCH_GMEM_* KVM: guest_memfd: do not go through struct page KVM: guest_memfd: delay folio_mark_uptodate() until after successful preparation KVM: guest_memfd: return folio from __kvm_gmem_get_pfn() KVM: x86: disallow pre-fault for SNP VMs before initialization KVM: Documentation: Fix title underline too short warning KVM: x86: Eliminate log spam from limited APIC timer periods commit 1773014a975919195be71646fc2c2cad1570fce4 Merge: 29b5bbf7e97f aca0ec970d76 Author: Paolo Bonzini Date: Fri Aug 2 12:31:48 2024 -0400 Merge branch 'kvm-fixes' into HEAD * fix latent bug in how usage of large pages is determined for confidential VMs * fix "underline too short" in docs * eliminate log spam from limited APIC timer periods * disallow pre-faulting of memory before SEV-SNP VMs are initialized * delay clearing and encrypting private memory until it is added to guest page tables * this change also enables another small cleanup: the checks in SNP_LAUNCH_UPDATE that limit it to non-populated, private pages can now be moved in the common kvm_gmem_populate() function commit 948752d2e010e11b56a877975e7e9158d6d31823 Merge: 66242ef25eed 3b6564427aea Author: Linus Torvalds Date: Fri Aug 2 09:33:35 2024 -0700 Merge tag 'riscv-for-linus-6.11-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/riscv/linux Pull RISC-V fixes from Palmer Dabbelt: - A fix to avoid dropping some of the internal pseudo-extensions, which breaks *envcfg dependency parsing - The kernel entry address is now aligned in purgatory, which avoids a misaligned load that can lead to crash on systems that don't support misaligned accesses early in boot - The FW_SFENCE_VMA_RECEIVED perf event was duplicated in a handful of perf JSON configurations, one of them been updated to FW_SFENCE_VMA_ASID_SENT - The starfive cache driver is now restricted to 64-bit systems, as it isn't 32-bit clean - A fix for to avoid aliasing legacy-mode perf counters with software perf counters - VM_FAULT_SIGSEGV is now handled in the page fault code - A fix for stalls during CPU hotplug due to IPIs being disabled - A fix for memblock bounds checking. This manifests as a crash on systems with discontinuous memory maps that have regions that don't fit in the linear map * tag 'riscv-for-linus-6.11-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/riscv/linux: riscv: Fix linear mapping checks for non-contiguous memory regions RISC-V: Enable the IPI before workqueue_online_cpu() riscv/mm: Add handling for VM_FAULT_SIGSEGV in mm_fault_error() perf: riscv: Fix selecting counters in legacy mode cache: StarFive: Require a 64-bit system perf arch events: Fix duplicate RISC-V SBI firmware event name riscv/purgatory: align riscv_kernel_entry riscv: cpufeature: Do not drop Linux-internal extensions commit 29b5bbf7e97fb4aee55df17a38f5bc192b1928ae Merge: 8400291e289e dd4a799bcc13 Author: Paolo Bonzini Date: Fri Aug 2 12:31:29 2024 -0400 Merge tag 'kvm-riscv-fixes-6.11-1' of https://github.com/kvm-riscv/linux into HEAD KVM/riscv fixes for 6.11, take #1 - Fix compile error in get-reg-list selftests commit 66242ef25eedc5b48d46c4b60f5d453763adf2b8 Merge: 29ccb40f2b54 33bd8d153c33 Author: Linus Torvalds Date: Fri Aug 2 09:29:54 2024 -0700 Merge tag 's390-6.11-3' of git://git.kernel.org/pub/scm/linux/kernel/git/s390/linux Pull s390 fixes from Vasily Gorbik: - remove unused empty CPU alternatives header file - fix recently and erroneously removed exception handling when loading an invalid floating point register - ptdump fixes to reflect the recent changes due to the uncoupling of physical vs virtual kernel address spaces - changes to avoid the unnecessary splitting of large pages in kernel mappings - add the missing MODULE_DESCRIPTION for the CIO modules * tag 's390-6.11-3' of git://git.kernel.org/pub/scm/linux/kernel/git/s390/linux: s390: Keep inittext section writable s390/vmlinux.lds.S: Move ro_after_init section behind rodata section s390/mm: Get rid of RELOC_HIDE() s390/mm/ptdump: Improve sorting of markers s390/mm/ptdump: Add support for relocated lowcore mapping s390/mm/ptdump: Fix handling of identity mapping area s390/cio: Add missing MODULE_DESCRIPTION() macros s390/alternatives: Remove unused empty header file s390/fpu: Re-add exception handling in load_fpu_state() commit f2655ac2c06a15558e51ed6529de280e1553c86e Author: Paul E. McKenney Date: Fri Aug 2 08:46:15 2024 -0700 clocksource: Fix brown-bag boolean thinko in cs_watchdog_read() The current "nretries > 1 || nretries >= max_retries" check in cs_watchdog_read() will always evaluate to true, and thus pr_warn(), if nretries is greater than 1. The intent is instead to never warn on the first try, but otherwise warn if the successful retry was the last retry. Therefore, change that "||" to "&&". Fixes: db3a34e17433 ("clocksource: Retry clock read if long delays detected") Reported-by: Borislav Petkov Signed-off-by: Paul E. McKenney Signed-off-by: Thomas Gleixner Cc: stable@vger.kernel.org Link: https://lore.kernel.org/all/20240802154618.4149953-2-paulmck@kernel.org kernel/time/clocksource.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 29ccb40f2b543ccb1d143e54e8227b80d277bc2f Merge: 6b779f8a8648 343416f0c11c Author: Linus Torvalds Date: Fri Aug 2 09:14:48 2024 -0700 Merge tag 'asm-generic-fixes-6.11-1' of git://git.kernel.org/pub/scm/linux/kernel/git/arnd/asm-generic Pull asm-generic fixes from Arnd Bergmann: "These are three important bug fixes for the cross-architecture tree, fixing a regression with the new syscall.tbl file, the inconsistent numbering for the new uretprobe syscall and a bug with iowrite64be on alpha" * tag 'asm-generic-fixes-6.11-1' of git://git.kernel.org/pub/scm/linux/kernel/git/arnd/asm-generic: syscalls: fix syscall macros for newfstat/newfstatat uretprobe: change syscall number, again alpha: fix ioread64be()/iowrite64be() helpers commit 6b779f8a8648848d74c24b07d0e2436c00211788 Merge: 29b4a6996c24 478689b5990d Author: Linus Torvalds Date: Fri Aug 2 09:04:57 2024 -0700 Merge tag 'sound-6.11-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound Pull sound fixes from Takashi Iwai: "A small collection of fixes: - Revert of FireWire changes that caused a long-time regression - Another long-time regression fix for AMD HDMI - MIDI2 UMP fixes - HD-audio Conexant codec fixes and a quirk" * tag 'sound-6.11-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound: ALSA: hda: Conditionally use snooping for AMD HDMI ALSA: usb-audio: Correct surround channels in UAC1 channel map ALSA: seq: ump: Explicitly reset RPN with Null RPN ALSA: seq: ump: Transmit RPN/NRPN message at each MSB/LSB data reception ALSA: seq: ump: Use the common RPN/bank conversion context ALSA: ump: Explicitly reset RPN with Null RPN ALSA: ump: Transmit RPN/NRPN message at each MSB/LSB data reception Revert "ALSA: firewire-lib: operate for period elapse event in process context" Revert "ALSA: firewire-lib: obsolete workqueue for period update" ALSA: hda/realtek: Add quirk for Acer Aspire E5-574G ALSA: seq: ump: Optimize conversions from SysEx to UMP ALSA: hda/conexant: Mute speakers at suspend / shutdown ALSA: hda/generic: Add a helper to mute speakers at suspend/shutdown ALSA: hda: conexant: Fix headset auto detect fail in the polling mode commit 29b4a6996c244f0d360537d6a4a0996468372c17 Merge: 454e2370b985 27ce65f65258 Author: Linus Torvalds Date: Fri Aug 2 08:59:09 2024 -0700 Merge tag 'drm-fixes-2024-08-02' of https://gitlab.freedesktop.org/drm/kernel Pull drm fixes from Dave Airlie: "Regular weekly fixes. This is a bit larger than usual but doesn't seem too crazy. Most of it is vmwgfx changes that fix a bunch of issues with wayland userspaces with dma-buf/external buffers and modesetting fixes. Otherwise it's kinda spread out, v3d fixes some new ioctls, nouveau has regression revert and fixes, amdgpu, i915 and ast have some small fixes, and some core fixes spread about. client: - fix error code atomic: - allow damage clips with async flips - allow explicit sync with async flips kselftests: - fix dmabuf-heaps test panic: - fix schedule_work in panic paths panel: - fix OrangePi Neo orientation gpuvm: - fix missing dependency amdgpu: - SMU 14.x update - Fix contiguous VRAM handling for IB parsing - GFX 12 fix - Regression fix for old APUs i915: - Static analysis fix for int overflow - Fix for HDCP2_STREAM_STATUS macro and removal of PWR_CLK_STATE for gen12 nouveau: - revert busy wait change that caused a resume regression - fix buffer placement fault on dynamic pm s/r - fix refcount underflow ast: - fix black screen on resume - wake during connector status detect v3d: - fix issues with perf/timestamp ioctls vmwgfx: - fix deadlock in dma-buf fence polling - fix screen surface refcounting - fix dumb buffer handling - fix support for external buffers - fix overlay with screen targets - trigger modeset on screen moves" * tag 'drm-fixes-2024-08-02' of https://gitlab.freedesktop.org/drm/kernel: (31 commits) Revert "nouveau: rip out busy fence waits" nouveau: set placement to original placement on uvmm validate. drm/atomic: Allow userspace to use damage clips with async flips drm/atomic: Allow userspace to use explicit sync with atomic async flips drm/i915: Fix possible int overflow in skl_ddi_calculate_wrpll() drm/i915/hdcp: Fix HDCP2_STREAM_STATUS macro drm/ast: astdp: Wake up during connector status detection i915/perf: Remove code to update PWR_CLK_STATE for gen12 kselftests: dmabuf-heaps: Ensure the driver name is null-terminated drm/client: Fix error code in drm_client_buffer_vmap_local() drm/amdgpu: Fix APU handling in amdgpu_pm_load_smu_firmware() drm/amdgpu: increase mes log buffer size for gfx12 drm/amdgpu: fix contiguous handling for IB parsing v2 drm/amdgpu/pm: support gpu_metrics sysfs interface for smu v14.0.2/3 drm/vmwgfx: Trigger a modeset when the screen moves drm/vmwgfx: Fix overlay when using Screen Targets drm/vmwgfx: Add basic support for external buffers drm/vmwgfx: Fix handling of dumb buffers drm/vmwgfx: Make sure the screen surface is ref counted drm/vmwgfx: Fix a deadlock in dma buf fence polling ... commit a91bfa67601c07ff9d31731fd2d624b47b0039f2 Author: Steve French Date: Fri Jul 26 18:44:16 2024 -0500 cifs: update internal version number To 2.50 Signed-off-by: Steve French fs/smb/client/cifsfs.h | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) commit ddecea00f87f0c46e9c8339a7c89fb2ff891521a Author: Paulo Alcantara Date: Thu Aug 1 18:12:39 2024 -0300 smb: client: fix FSCTL_GET_REPARSE_POINT against NetApp NetApp server requires the file to be open with FILE_READ_EA access in order to support FSCTL_GET_REPARSE_POINT, otherwise it will return STATUS_INVALID_DEVICE_REQUEST. It doesn't make any sense because there's no requirement for FILE_READ_EA bit to be set nor STATUS_INVALID_DEVICE_REQUEST being used for something other than "unsupported reparse points" in MS-FSA. To fix it and improve compatibility, set FILE_READ_EA & SYNCHRONIZE bits to match what Windows client currently does. Tested-by: Sebastian Steinbeisser Acked-by: Tom Talpey Signed-off-by: Paulo Alcantara (Red Hat) Signed-off-by: Steve French fs/smb/client/smb2inode.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) commit 69ca1f57555f74142a4c241703c307cb31b54667 Author: Steve French Date: Tue Jul 30 00:26:21 2024 -0500 smb3: add dynamic tracepoints for shutdown ioctl For debugging an umount failure in xfstests generic/043 generic/044 in some configurations, we needed more information on the shutdown ioctl which was suspected of being related to the cause, so tracepoints are added in this patch e.g. "trace-cmd record -e smb3_shutdown_enter -e smb3_shutdown_done -e smb3_shutdown_err" Sample output: godown-47084 [011] ..... 3313.756965: smb3_shutdown_enter: flags=0x1 tid=0x733b3e75 godown-47084 [011] ..... 3313.756968: smb3_shutdown_done: flags=0x1 tid=0x733b3e75 Tested-by: Anthony Nandaa (Microsoft) Signed-off-by: Steve French fs/smb/client/ioctl.c | 32 +++++++++++++++++++++++++------- fs/smb/client/trace.h | 51 ++++++++++++++++++++++++++++++++++++++++++++++++++- 2 files changed, 75 insertions(+), 8 deletions(-) commit cd936507986e38535e7c98940c186e9a97b87184 Author: David Howells Date: Wed Jul 31 11:30:00 2024 +0100 cifs: Remove cifs_aio_ctx Remove struct cifs_aio_ctx and its associated alloc/release functions as it is no longer used, the functions being taken over by netfslib. Signed-off-by: David Howells cc: Steve French cc: linux-cifs@vger.kernel.org Signed-off-by: Steve French fs/smb/client/cifsglob.h | 24 --------------------- fs/smb/client/cifsproto.h | 2 -- fs/smb/client/misc.c | 54 ----------------------------------------------- 3 files changed, 80 deletions(-) commit 4b96024ef2296b1d323af327cae5e52809b61420 Author: Paulo Alcantara Date: Wed Jul 31 10:23:39 2024 -0300 smb: client: handle lack of FSCTL_GET_REPARSE_POINT support As per MS-FSA 2.1.5.10.14, support for FSCTL_GET_REPARSE_POINT is optional and if the server doesn't support it, STATUS_INVALID_DEVICE_REQUEST must be returned for the operation. If we find files with reparse points and we can't read them due to lack of client or server support, just ignore it and then treat them as regular files or junctions. Fixes: 5f71ebc41294 ("smb: client: parse reparse point flag in create response") Reported-by: Sebastian Steinbeisser Tested-by: Sebastian Steinbeisser Acked-by: Tom Talpey Signed-off-by: Paulo Alcantara (Red Hat) Signed-off-by: Steve French fs/smb/client/inode.c | 17 +++++++++++++++-- fs/smb/client/reparse.c | 4 ++++ fs/smb/client/reparse.h | 19 +++++++++++++++++-- fs/smb/client/smb2inode.c | 2 ++ 4 files changed, 38 insertions(+), 4 deletions(-) commit 454e2370b9851519a8f27d1965fe25a9a38b5ac5 Merge: bbea34e693f4 89fb4dfacbb3 Author: Linus Torvalds Date: Fri Aug 2 08:54:16 2024 -0700 Merge tag 'ata-6.11-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/libata/linux Pull ata fix from Damien Le Moal: - Add missing power-domains property to the device tree bindings for the Rockchip Designware AHCI adapter (from Heiko) * tag 'ata-6.11-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/libata/linux: dt-bindings: ata: rockchip-dwc-ahci: add missing power-domains commit bbea34e693f4cc62d594efc7ef7629900d97b9a8 Merge: c0ecd6388360 8aa37bde1a7b Author: Linus Torvalds Date: Fri Aug 2 08:52:27 2024 -0700 Merge tag 'pull-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs Pull vfs fix from Al Viro: "do_dup2() out-of-bounds array speculation fix" * tag 'pull-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs: protect the fetch of ->fd[fd] in do_dup2() from mispredictions commit cfb00a35786414e7c0e6226b277d9f09657eae74 Author: Will Deacon Date: Wed Jul 31 14:36:01 2024 +0100 arm64: jump_label: Ensure patched jump_labels are visible to all CPUs Although the Arm architecture permits concurrent modification and execution of NOP and branch instructions, it still requires some synchronisation to ensure that other CPUs consistently execute the newly written instruction: > When the modified instructions are observable, each PE that is > executing the modified instructions must execute an ISB or perform a > context synchronizing event to ensure execution of the modified > instructions Prior to commit f6cc0c501649 ("arm64: Avoid calling stop_machine() when patching jump labels"), the arm64 jump_label patching machinery performed synchronisation using stop_machine() after each modification, however this was problematic when flipping static keys from atomic contexts (namely, the arm_arch_timer CPU hotplug startup notifier) and so we switched to the _nosync() patching routines to avoid "scheduling while atomic" BUG()s during boot. In hindsight, the analysis of the issue in f6cc0c501649 isn't quite right: it cites the use of IPIs in the default patching routines as the cause of the lockup, whereas stop_machine() does not rely on IPIs and the I-cache invalidation is performed using __flush_icache_range(), which elides the call to kick_all_cpus_sync(). In fact, the blocking wait for other CPUs is what triggers the BUG() and the problem remains even after f6cc0c501649, for example because we could block on the jump_label_mutex. Eventually, the arm_arch_timer driver was fixed to avoid the static key entirely in commit a862fc2254bd ("clocksource/arm_arch_timer: Remove use of workaround static key"). This all leaves the jump_label patching code in a funny situation on arm64 as we do not synchronise with other CPUs to reduce the likelihood of a bug which no longer exists. Consequently, toggling a static key on one CPU cannot be assumed to take effect on other CPUs, leading to potential issues, for example with missing preempt notifiers. Rather than revert f6cc0c501649 and go back to stop_machine() for each patch site, implement arch_jump_label_transform_apply() and kick all the other CPUs with an IPI at the end of patching. Cc: Alexander Potapenko Cc: Mark Rutland Cc: Marc Zyngier Fixes: f6cc0c501649 ("arm64: Avoid calling stop_machine() when patching jump labels") Signed-off-by: Will Deacon Reviewed-by: Catalin Marinas Reviewed-by: Marc Zyngier Link: https://lore.kernel.org/r/20240731133601.3073-1-will@kernel.org Signed-off-by: Catalin Marinas arch/arm64/include/asm/jump_label.h | 1 + arch/arm64/kernel/jump_label.c | 11 +++++++++-- 2 files changed, 10 insertions(+), 2 deletions(-) commit fca5b78511e98bdff2cdd55c172b23200a7b3404 Author: Barak Biber Date: Thu Aug 1 09:26:04 2024 -0300 iommu: Restore lost return in iommu_report_device_fault() When iommu_report_device_fault gets called with a partial fault it is supposed to collect the fault into the group and then return. Instead the return was accidently deleted which results in trying to process the fault and an eventual crash. Deleting the return was a typo, put it back. Fixes: 3dfa64aecbaf ("iommu: Make iommu_report_device_fault() return void") Signed-off-by: Barak Biber Signed-off-by: Jason Gunthorpe Reviewed-by: Lu Baolu Link: https://lore.kernel.org/r/0-v1-e7153d9c8cee+1c6-iommu_fault_fix_jgg@nvidia.com Signed-off-by: Joerg Roedel drivers/iommu/io-pgfault.c | 1 + 1 file changed, 1 insertion(+) commit 343416f0c11c42bed07f6db03ca599f4f1771b17 Author: Arnd Bergmann Date: Thu Aug 1 14:27:23 2024 +0200 syscalls: fix syscall macros for newfstat/newfstatat The __NR_newfstat and __NR_newfstatat macros accidentally got renamed in the conversion to the syscall.tbl format, dropping the 'new' portion of the name. In an unrelated change, the two syscalls are no longer architecture specific but are once more defined on all 64-bit architectures, so the 'newstat' ABI keyword can be dropped from the table as a simplification. Fixes: Fixes: 4fe53bf2ba0a ("syscalls: add generic scripts/syscall.tbl") Closes: https://lore.kernel.org/lkml/838053e0-b186-4e9f-9668-9a3384a71f23@app.fastmail.com/T/#t Reported-by: Florian Weimer Signed-off-by: Arnd Bergmann arch/arm64/kernel/Makefile.syscalls | 2 +- arch/loongarch/kernel/Makefile.syscalls | 3 ++- arch/riscv/kernel/Makefile.syscalls | 2 +- scripts/syscall.tbl | 4 ++-- 4 files changed, 6 insertions(+), 5 deletions(-) commit 54233a4254036efca91b9bffbd398ecf39e90555 Author: Arnd Bergmann Date: Tue Jul 30 17:30:40 2024 +0200 uretprobe: change syscall number, again Despite multiple attempts to get the syscall number assignment right for the newly added uretprobe syscall, we ended up with a bit of a mess: - The number is defined as 467 based on the assumption that the xattrat family of syscalls would use 463 through 466, but those did not make it into 6.11. - The include/uapi/asm-generic/unistd.h file still lists the number 463, but the new scripts/syscall.tbl that was supposed to have the same data lists 467 instead as the number for arc, arm64, csky, hexagon, loongarch, nios2, openrisc and riscv. None of these architectures actually provide a uretprobe syscall. - All the other architectures (powerpc, arm, mips, ...) don't list this syscall at all. There are two ways to make it consistent again: either list it with the same syscall number on all architectures, or only list it on x86 but not in scripts/syscall.tbl and asm-generic/unistd.h. Based on the most recent discussion, it seems like we won't need it anywhere else, so just remove the inconsistent assignment and instead move the x86 number to the next available one in the architecture specific range, which is 335. Fixes: 5c28424e9a34 ("syscalls: Fix to add sys_uretprobe to syscall.tbl") Fixes: 190fec72df4a ("uprobe: Wire up uretprobe system call") Fixes: 63ded110979b ("uprobe: Change uretprobe syscall scope and number") Acked-by: Masami Hiramatsu (Google) Reviewed-by: Jiri Olsa Signed-off-by: Arnd Bergmann arch/x86/entry/syscalls/syscall_64.tbl | 2 +- include/uapi/asm-generic/unistd.h | 5 +---- scripts/syscall.tbl | 1 - tools/testing/selftests/bpf/prog_tests/uprobe_syscall.c | 2 +- 4 files changed, 3 insertions(+), 7 deletions(-) commit 93afd028fb5f06a46a32375fd1f0473451eb1c5a Author: Charles Keepax Date: Fri Aug 2 11:57:34 2024 +0100 ASoC: cs42l43: Cache shutter IRQ control pointers The microphone/speaker privacy shutter ALSA control handlers need to call pm_runtime_resume, since the hardware needs to be powered up to check the hardware state of the shutter. The IRQ handler for the shutters also needs to notify the ALSA control to inform user-space the shutters updated. However this leads to a mutex inversion, between the sdw_dev_lock and the controls_rwsem. To avoid this mutex inversion cache the kctl pointers before the IRQ handler, which avoids the need to lookup the control and take the controls_rwsem. Suggested-by: Jaroslav Kysela Signed-off-by: Charles Keepax Link: https://patch.msgid.link/20240802105734.2309788-5-ckeepax@opensource.cirrus.com Signed-off-by: Mark Brown sound/soc/codecs/cs42l43.c | 73 +++++++++++++++++++++++++++++++++++----------- sound/soc/codecs/cs42l43.h | 2 ++ 2 files changed, 58 insertions(+), 17 deletions(-) commit 4791c422981350d0de4ad02a14a08b99c766d06f Author: Charles Keepax Date: Fri Aug 2 11:57:33 2024 +0100 ASoC: cs35l45: Use new snd_soc_component_get_kcontrol_locked() helper No longer any need to hard code the addition of the name prefix, use the new helper function. Signed-off-by: Charles Keepax Link: https://patch.msgid.link/20240802105734.2309788-4-ckeepax@opensource.cirrus.com Signed-off-by: Mark Brown sound/soc/codecs/cs35l45.c | 11 ++--------- 1 file changed, 2 insertions(+), 9 deletions(-) commit c8a132e2e032b00828d51141ab34f9aeb24f44ae Author: Charles Keepax Date: Fri Aug 2 11:57:32 2024 +0100 ASoC: soc-component: Add new snd_soc_component_get_kcontrol() helpers Add new helper functions snd_soc_component_get_kcontrol() and snd_soc_component_get_kcontrol_locked() that returns a kcontrol by name, but will factor in the components name_prefix, to handle situations where multiple components are present with the same controls. Signed-off-by: Charles Keepax Link: https://patch.msgid.link/20240802105734.2309788-3-ckeepax@opensource.cirrus.com Signed-off-by: Mark Brown include/sound/soc-component.h | 5 +++++ sound/soc/soc-component.c | 42 ++++++++++++++++++++++++++++++++++-------- 2 files changed, 39 insertions(+), 8 deletions(-) commit becfa08bfefa2cbb22c84d9e583e81387f2f3bf2 Author: Charles Keepax Date: Fri Aug 2 11:57:31 2024 +0100 ASoC: cs42l43: Remove redundant semi-colon at end of function Signed-off-by: Charles Keepax Link: https://patch.msgid.link/20240802105734.2309788-2-ckeepax@opensource.cirrus.com Signed-off-by: Mark Brown sound/soc/codecs/cs42l43.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 64a66f4a3c89b4602ee1e6cd23b28729fc4562b3 Author: Pedro Henrique Kopper Date: Thu Aug 1 13:41:50 2024 -0300 cpufreq: intel_pstate: Update Balance performance EPP for Emerald Rapids On Intel Emerald Rapids machines, we ship the Energy Performance Preference (EPP) default for balance_performance as 128. However, during an internal investigation together with Intel, we have determined that 32 is a more suitable value. This leads to significant improvements in both performance and energy: POV-Ray: 32% faster | 12% less energy OpenSSL: 12% faster | energy within 1% Build Linux Kernel: 29% faster | 18% less energy Therefore, we should move the default EPP for balance_performance to 32. This is in line with what has already been done for Sapphire Rapids. Signed-off-by: Pedro Henrique Kopper Acked-by: Srinivas Pandruvada Link: https://patch.msgid.link/Zqu6zjVMoiXwROBI@capivara Signed-off-by: Rafael J. Wysocki drivers/cpufreq/intel_pstate.c | 1 + 1 file changed, 1 insertion(+) commit a09074228977c24c677c10282f506fa11f88eb93 Author: Rafael J. Wysocki Date: Thu Aug 1 18:39:28 2024 +0200 thermal: core: Update thermal zone registration documentation The thermal sysfs API document is outdated. One of the problems with it is that is still documents thermal_zone_device_register() which does not exit any more and it does not reflect the current thermal zone operations definition. Replace the thermal_zone_device_register() description in it with a thermal_zone_device_register_with_trips() description, including an update of the thermal zone operations list. Signed-off-by: Rafael J. Wysocki Reviewed-by: Lukasz Luba Link: https://patch.msgid.link/2767845.mvXUDI8C0e@rjwysocki.net Documentation/driver-api/thermal/sysfs-api.rst | 65 ++++++++++++-------------- 1 file changed, 30 insertions(+), 35 deletions(-) commit 1b8f9c1fb464968a5b18d3acc1da8c00bad24fad Author: Jason Gerecke Date: Tue Jul 30 08:51:55 2024 -0700 HID: wacom: Defer calculation of resolution until resolution_code is known The Wacom driver maps the HID_DG_TWIST usage to ABS_Z (rather than ABS_RZ) for historic reasons. When the code to support twist was introduced in commit 50066a042da5 ("HID: wacom: generic: Add support for height, tilt, and twist usages"), we were careful to write it in such a way that it had HID calculate the resolution of the twist axis assuming ABS_RZ instead (so that we would get correct angular behavior). This was broken with the introduction of commit 08a46b4190d3 ("HID: wacom: Set a default resolution for older tablets"), which moved the resolution calculation to occur *before* the adjustment from ABS_Z to ABS_RZ occurred. This commit moves the calculation of resolution after the point that we are finished setting things up for its proper use. Signed-off-by: Jason Gerecke Fixes: 08a46b4190d3 ("HID: wacom: Set a default resolution for older tablets") Cc: stable@vger.kernel.org Signed-off-by: Jiri Kosina drivers/hid/wacom_wac.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) commit c8000deb68365b461b324d68c7ea89d730f0bb85 Author: Dmitry Savin Date: Tue Jul 16 23:27:57 2024 +0100 HID: multitouch: Add support for GT7868Q GT7868Q has incorrect data in the report and needs a fixup. The change enables haptic touchpad on Lenovo ThinkBook 13x Gen 4 and has been tested on the device. Signed-off-by: Dmitry Savin Signed-off-by: Jiri Kosina drivers/hid/hid-ids.h | 2 ++ drivers/hid/hid-multitouch.c | 33 +++++++++++++++++++++++++++++++++ 2 files changed, 35 insertions(+) commit 97155021ae17b86985121b33cf8098bcde00d497 Author: Olivier Sobrie Date: Tue Jul 23 10:44:35 2024 +0200 HID: amd_sfh: free driver_data after destroying hid device HID driver callbacks aren't called anymore once hid_destroy_device() has been called. Hence, hid driver_data should be freed only after the hid_destroy_device() function returned as driver_data is used in several callbacks. I observed a crash with kernel 6.10.0 on my T14s Gen 3, after enabling KASAN to debug memory allocation, I got this output: [ 13.050438] ================================================================== [ 13.054060] BUG: KASAN: slab-use-after-free in amd_sfh_get_report+0x3ec/0x530 [amd_sfh] [ 13.054809] psmouse serio1: trackpoint: Synaptics TrackPoint firmware: 0x02, buttons: 3/3 [ 13.056432] Read of size 8 at addr ffff88813152f408 by task (udev-worker)/479 [ 13.060970] CPU: 5 PID: 479 Comm: (udev-worker) Not tainted 6.10.0-arch1-2 #1 893bb55d7f0073f25c46adbb49eb3785fefd74b0 [ 13.063978] Hardware name: LENOVO 21CQCTO1WW/21CQCTO1WW, BIOS R22ET70W (1.40 ) 03/21/2024 [ 13.067860] Call Trace: [ 13.069383] input: TPPS/2 Synaptics TrackPoint as /devices/platform/i8042/serio1/input/input8 [ 13.071486] [ 13.071492] dump_stack_lvl+0x5d/0x80 [ 13.074870] snd_hda_intel 0000:33:00.6: enabling device (0000 -> 0002) [ 13.078296] ? amd_sfh_get_report+0x3ec/0x530 [amd_sfh 05f43221435b5205f734cd9da29399130f398a38] [ 13.082199] print_report+0x174/0x505 [ 13.085776] ? __pfx__raw_spin_lock_irqsave+0x10/0x10 [ 13.089367] ? srso_alias_return_thunk+0x5/0xfbef5 [ 13.093255] ? amd_sfh_get_report+0x3ec/0x530 [amd_sfh 05f43221435b5205f734cd9da29399130f398a38] [ 13.097464] kasan_report+0xc8/0x150 [ 13.101461] ? amd_sfh_get_report+0x3ec/0x530 [amd_sfh 05f43221435b5205f734cd9da29399130f398a38] [ 13.105802] amd_sfh_get_report+0x3ec/0x530 [amd_sfh 05f43221435b5205f734cd9da29399130f398a38] [ 13.110303] amdtp_hid_request+0xb8/0x110 [amd_sfh 05f43221435b5205f734cd9da29399130f398a38] [ 13.114879] ? srso_alias_return_thunk+0x5/0xfbef5 [ 13.119450] sensor_hub_get_feature+0x1d3/0x540 [hid_sensor_hub 3f13be3016ff415bea03008d45d99da837ee3082] [ 13.124097] hid_sensor_parse_common_attributes+0x4d0/0xad0 [hid_sensor_iio_common c3a5cbe93969c28b122609768bbe23efe52eb8f5] [ 13.127404] ? srso_alias_return_thunk+0x5/0xfbef5 [ 13.131925] ? __pfx_hid_sensor_parse_common_attributes+0x10/0x10 [hid_sensor_iio_common c3a5cbe93969c28b122609768bbe23efe52eb8f5] [ 13.136455] ? _raw_spin_lock_irqsave+0x96/0xf0 [ 13.140197] ? __pfx__raw_spin_lock_irqsave+0x10/0x10 [ 13.143602] ? devm_iio_device_alloc+0x34/0x50 [industrialio 3d261d5e5765625d2b052be40e526d62b1d2123b] [ 13.147234] ? srso_alias_return_thunk+0x5/0xfbef5 [ 13.150446] ? __devm_add_action+0x167/0x1d0 [ 13.155061] hid_gyro_3d_probe+0x120/0x7f0 [hid_sensor_gyro_3d 63da36a143b775846ab2dbb86c343b401b5e3172] [ 13.158581] ? srso_alias_return_thunk+0x5/0xfbef5 [ 13.161814] platform_probe+0xa2/0x150 [ 13.165029] really_probe+0x1e3/0x8a0 [ 13.168243] __driver_probe_device+0x18c/0x370 [ 13.171500] driver_probe_device+0x4a/0x120 [ 13.175000] __driver_attach+0x190/0x4a0 [ 13.178521] ? __pfx___driver_attach+0x10/0x10 [ 13.181771] bus_for_each_dev+0x106/0x180 [ 13.185033] ? __pfx__raw_spin_lock+0x10/0x10 [ 13.188229] ? __pfx_bus_for_each_dev+0x10/0x10 [ 13.191446] ? srso_alias_return_thunk+0x5/0xfbef5 [ 13.194382] bus_add_driver+0x29e/0x4d0 [ 13.197328] driver_register+0x1a5/0x360 [ 13.200283] ? __pfx_hid_gyro_3d_platform_driver_init+0x10/0x10 [hid_sensor_gyro_3d 63da36a143b775846ab2dbb86c343b401b5e3172] [ 13.203362] do_one_initcall+0xa7/0x380 [ 13.206432] ? __pfx_do_one_initcall+0x10/0x10 [ 13.210175] ? srso_alias_return_thunk+0x5/0xfbef5 [ 13.213211] ? kasan_unpoison+0x44/0x70 [ 13.216688] do_init_module+0x238/0x750 [ 13.219696] load_module+0x5011/0x6af0 [ 13.223096] ? kasan_save_stack+0x30/0x50 [ 13.226743] ? kasan_save_track+0x14/0x30 [ 13.230080] ? kasan_save_free_info+0x3b/0x60 [ 13.233323] ? poison_slab_object+0x109/0x180 [ 13.236778] ? __pfx_load_module+0x10/0x10 [ 13.239703] ? poison_slab_object+0x109/0x180 [ 13.243070] ? srso_alias_return_thunk+0x5/0xfbef5 [ 13.245924] ? init_module_from_file+0x13d/0x150 [ 13.248745] ? srso_alias_return_thunk+0x5/0xfbef5 [ 13.251503] ? init_module_from_file+0xdf/0x150 [ 13.254198] init_module_from_file+0xdf/0x150 [ 13.256826] ? __pfx_init_module_from_file+0x10/0x10 [ 13.259428] ? kasan_save_track+0x14/0x30 [ 13.261959] ? srso_alias_return_thunk+0x5/0xfbef5 [ 13.264471] ? kasan_save_free_info+0x3b/0x60 [ 13.267026] ? poison_slab_object+0x109/0x180 [ 13.269494] ? srso_alias_return_thunk+0x5/0xfbef5 [ 13.271949] ? srso_alias_return_thunk+0x5/0xfbef5 [ 13.274324] ? _raw_spin_lock+0x85/0xe0 [ 13.276671] ? __pfx__raw_spin_lock+0x10/0x10 [ 13.278963] ? __rseq_handle_notify_resume+0x1a6/0xad0 [ 13.281193] idempotent_init_module+0x23b/0x650 [ 13.283420] ? __pfx_idempotent_init_module+0x10/0x10 [ 13.285619] ? __pfx___seccomp_filter+0x10/0x10 [ 13.287714] ? srso_alias_return_thunk+0x5/0xfbef5 [ 13.289828] ? __fget_light+0x57/0x420 [ 13.291870] ? srso_alias_return_thunk+0x5/0xfbef5 [ 13.293880] ? security_capable+0x74/0xb0 [ 13.295820] __x64_sys_finit_module+0xbe/0x130 [ 13.297874] do_syscall_64+0x82/0x190 [ 13.299898] ? srso_alias_return_thunk+0x5/0xfbef5 [ 13.301905] ? irqtime_account_irq+0x3d/0x1f0 [ 13.303877] ? srso_alias_return_thunk+0x5/0xfbef5 [ 13.305753] ? __irq_exit_rcu+0x4e/0x130 [ 13.307577] ? srso_alias_return_thunk+0x5/0xfbef5 [ 13.309489] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 13.311371] RIP: 0033:0x7a21f96ade9d [ 13.313234] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 90 f3 0f 1e fa 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 8b 0d 63 de 0c 00 f7 d8 64 89 01 48 [ 13.317051] RSP: 002b:00007ffeae934e78 EFLAGS: 00000246 ORIG_RAX: 0000000000000139 [ 13.319024] RAX: ffffffffffffffda RBX: 00005987276bfcf0 RCX: 00007a21f96ade9d [ 13.321100] RDX: 0000000000000004 RSI: 00007a21f8eda376 RDI: 000000000000001c [ 13.323314] RBP: 00007a21f8eda376 R08: 0000000000000001 R09: 00007ffeae934ec0 [ 13.325505] R10: 0000000000000050 R11: 0000000000000246 R12: 0000000000020000 [ 13.327637] R13: 00005987276c1250 R14: 0000000000000000 R15: 00005987276c4530 [ 13.329737] [ 13.333945] Allocated by task 139: [ 13.336111] kasan_save_stack+0x30/0x50 [ 13.336121] kasan_save_track+0x14/0x30 [ 13.336125] __kasan_kmalloc+0xaa/0xb0 [ 13.336129] amdtp_hid_probe+0xb1/0x440 [amd_sfh] [ 13.336138] amd_sfh_hid_client_init+0xb8a/0x10f0 [amd_sfh] [ 13.336144] sfh_init_work+0x47/0x120 [amd_sfh] [ 13.336150] process_one_work+0x673/0xeb0 [ 13.336155] worker_thread+0x795/0x1250 [ 13.336160] kthread+0x290/0x350 [ 13.336164] ret_from_fork+0x34/0x70 [ 13.336169] ret_from_fork_asm+0x1a/0x30 [ 13.338175] Freed by task 139: [ 13.340064] kasan_save_stack+0x30/0x50 [ 13.340072] kasan_save_track+0x14/0x30 [ 13.340076] kasan_save_free_info+0x3b/0x60 [ 13.340081] poison_slab_object+0x109/0x180 [ 13.340085] __kasan_slab_free+0x32/0x50 [ 13.340089] kfree+0xe5/0x310 [ 13.340094] amdtp_hid_remove+0xb2/0x160 [amd_sfh] [ 13.340102] amd_sfh_hid_client_deinit+0x324/0x640 [amd_sfh] [ 13.340107] amd_sfh_hid_client_init+0x94a/0x10f0 [amd_sfh] [ 13.340113] sfh_init_work+0x47/0x120 [amd_sfh] [ 13.340118] process_one_work+0x673/0xeb0 [ 13.340123] worker_thread+0x795/0x1250 [ 13.340127] kthread+0x290/0x350 [ 13.340132] ret_from_fork+0x34/0x70 [ 13.340136] ret_from_fork_asm+0x1a/0x30 [ 13.342482] The buggy address belongs to the object at ffff88813152f400 which belongs to the cache kmalloc-64 of size 64 [ 13.347357] The buggy address is located 8 bytes inside of freed 64-byte region [ffff88813152f400, ffff88813152f440) [ 13.347367] The buggy address belongs to the physical page: [ 13.355409] page: refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x13152f [ 13.355416] anon flags: 0x2ffff8000000000(node=0|zone=2|lastcpupid=0x1ffff) [ 13.355423] page_type: 0xffffefff(slab) [ 13.355429] raw: 02ffff8000000000 ffff8881000428c0 ffffea0004c43a00 0000000000000005 [ 13.355435] raw: 0000000000000000 0000000000200020 00000001ffffefff 0000000000000000 [ 13.355439] page dumped because: kasan: bad access detected [ 13.357295] Memory state around the buggy address: [ 13.357299] ffff88813152f300: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc [ 13.357303] ffff88813152f380: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc [ 13.357306] >ffff88813152f400: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc [ 13.357309] ^ [ 13.357311] ffff88813152f480: 00 00 00 00 00 fc fc fc fc fc fc fc fc fc fc fc [ 13.357315] ffff88813152f500: 00 00 00 00 00 00 00 06 fc fc fc fc fc fc fc fc [ 13.357318] ================================================================== [ 13.357405] Disabling lock debugging due to kernel taint [ 13.383534] Oops: general protection fault, probably for non-canonical address 0xe0a1bc4140000013: 0000 [#1] PREEMPT SMP KASAN NOPTI [ 13.383544] KASAN: maybe wild-memory-access in range [0x050e020a00000098-0x050e020a0000009f] [ 13.383551] CPU: 3 PID: 479 Comm: (udev-worker) Tainted: G B 6.10.0-arch1-2 #1 893bb55d7f0073f25c46adbb49eb3785fefd74b0 [ 13.383561] Hardware name: LENOVO 21CQCTO1WW/21CQCTO1WW, BIOS R22ET70W (1.40 ) 03/21/2024 [ 13.383565] RIP: 0010:amd_sfh_get_report+0x81/0x530 [amd_sfh] [ 13.383580] Code: 89 fa 48 c1 ea 03 80 3c 02 00 0f 85 78 03 00 00 48 b8 00 00 00 00 00 fc ff df 4c 8b 63 08 49 8d 7c 24 10 48 89 fa 48 c1 ea 03 <0f> b6 04 02 84 c0 74 08 3c 03 0f 8e 1a 03 00 00 45 8b 74 24 10 45 [ 13.383585] RSP: 0018:ffff8881261f7388 EFLAGS: 00010212 [ 13.383592] RAX: dffffc0000000000 RBX: ffff88813152f400 RCX: 0000000000000002 [ 13.383597] RDX: 00a1c04140000013 RSI: 0000000000000008 RDI: 050e020a0000009b [ 13.383600] RBP: ffff88814d010000 R08: 0000000000000002 R09: fffffbfff3ddb8c0 [ 13.383604] R10: ffffffff9eedc607 R11: ffff88810ce98000 R12: 050e020a0000008b [ 13.383607] R13: ffff88814d010000 R14: dffffc0000000000 R15: 0000000000000004 [ 13.383611] FS: 00007a21f94d0880(0000) GS:ffff8887e7d80000(0000) knlGS:0000000000000000 [ 13.383615] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 13.383618] CR2: 00007e0014c438f0 CR3: 000000012614c000 CR4: 0000000000f50ef0 [ 13.383622] PKRU: 55555554 [ 13.383625] Call Trace: [ 13.383629] [ 13.383632] ? __die_body.cold+0x19/0x27 [ 13.383644] ? die_addr+0x46/0x70 [ 13.383652] ? exc_general_protection+0x150/0x240 [ 13.383664] ? asm_exc_general_protection+0x26/0x30 [ 13.383674] ? amd_sfh_get_report+0x81/0x530 [amd_sfh 05f43221435b5205f734cd9da29399130f398a38] [ 13.383686] ? amd_sfh_get_report+0x3ec/0x530 [amd_sfh 05f43221435b5205f734cd9da29399130f398a38] [ 13.383697] amdtp_hid_request+0xb8/0x110 [amd_sfh 05f43221435b5205f734cd9da29399130f398a38] [ 13.383706] ? srso_alias_return_thunk+0x5/0xfbef5 [ 13.383713] sensor_hub_get_feature+0x1d3/0x540 [hid_sensor_hub 3f13be3016ff415bea03008d45d99da837ee3082] [ 13.383727] hid_sensor_parse_common_attributes+0x4d0/0xad0 [hid_sensor_iio_common c3a5cbe93969c28b122609768bbe23efe52eb8f5] [ 13.383739] ? srso_alias_return_thunk+0x5/0xfbef5 [ 13.383745] ? __pfx_hid_sensor_parse_common_attributes+0x10/0x10 [hid_sensor_iio_common c3a5cbe93969c28b122609768bbe23efe52eb8f5] [ 13.383753] ? _raw_spin_lock_irqsave+0x96/0xf0 [ 13.383762] ? __pfx__raw_spin_lock_irqsave+0x10/0x10 [ 13.383768] ? devm_iio_device_alloc+0x34/0x50 [industrialio 3d261d5e5765625d2b052be40e526d62b1d2123b] [ 13.383790] ? srso_alias_return_thunk+0x5/0xfbef5 [ 13.383795] ? __devm_add_action+0x167/0x1d0 [ 13.383806] hid_gyro_3d_probe+0x120/0x7f0 [hid_sensor_gyro_3d 63da36a143b775846ab2dbb86c343b401b5e3172] [ 13.383818] ? srso_alias_return_thunk+0x5/0xfbef5 [ 13.383826] platform_probe+0xa2/0x150 [ 13.383832] really_probe+0x1e3/0x8a0 [ 13.383838] __driver_probe_device+0x18c/0x370 [ 13.383844] driver_probe_device+0x4a/0x120 [ 13.383851] __driver_attach+0x190/0x4a0 [ 13.383857] ? __pfx___driver_attach+0x10/0x10 [ 13.383863] bus_for_each_dev+0x106/0x180 [ 13.383868] ? __pfx__raw_spin_lock+0x10/0x10 [ 13.383874] ? __pfx_bus_for_each_dev+0x10/0x10 [ 13.383880] ? srso_alias_return_thunk+0x5/0xfbef5 [ 13.383887] bus_add_driver+0x29e/0x4d0 [ 13.383895] driver_register+0x1a5/0x360 [ 13.383902] ? __pfx_hid_gyro_3d_platform_driver_init+0x10/0x10 [hid_sensor_gyro_3d 63da36a143b775846ab2dbb86c343b401b5e3172] [ 13.383910] do_one_initcall+0xa7/0x380 [ 13.383919] ? __pfx_do_one_initcall+0x10/0x10 [ 13.383927] ? srso_alias_return_thunk+0x5/0xfbef5 [ 13.383933] ? kasan_unpoison+0x44/0x70 [ 13.383943] do_init_module+0x238/0x750 [ 13.383955] load_module+0x5011/0x6af0 [ 13.383962] ? kasan_save_stack+0x30/0x50 [ 13.383968] ? kasan_save_track+0x14/0x30 [ 13.383973] ? kasan_save_free_info+0x3b/0x60 [ 13.383980] ? poison_slab_object+0x109/0x180 [ 13.383993] ? __pfx_load_module+0x10/0x10 [ 13.384007] ? poison_slab_object+0x109/0x180 [ 13.384012] ? srso_alias_return_thunk+0x5/0xfbef5 [ 13.384018] ? init_module_from_file+0x13d/0x150 [ 13.384025] ? srso_alias_return_thunk+0x5/0xfbef5 [ 13.384032] ? init_module_from_file+0xdf/0x150 [ 13.384037] init_module_from_file+0xdf/0x150 [ 13.384044] ? __pfx_init_module_from_file+0x10/0x10 [ 13.384050] ? kasan_save_track+0x14/0x30 [ 13.384055] ? srso_alias_return_thunk+0x5/0xfbef5 [ 13.384060] ? kasan_save_free_info+0x3b/0x60 [ 13.384066] ? poison_slab_object+0x109/0x180 [ 13.384071] ? srso_alias_return_thunk+0x5/0xfbef5 [ 13.384080] ? srso_alias_return_thunk+0x5/0xfbef5 [ 13.384085] ? _raw_spin_lock+0x85/0xe0 [ 13.384091] ? __pfx__raw_spin_lock+0x10/0x10 [ 13.384096] ? __rseq_handle_notify_resume+0x1a6/0xad0 [ 13.384106] idempotent_init_module+0x23b/0x650 [ 13.384114] ? __pfx_idempotent_init_module+0x10/0x10 [ 13.384120] ? __pfx___seccomp_filter+0x10/0x10 [ 13.384129] ? srso_alias_return_thunk+0x5/0xfbef5 [ 13.384135] ? __fget_light+0x57/0x420 [ 13.384142] ? srso_alias_return_thunk+0x5/0xfbef5 [ 13.384147] ? security_capable+0x74/0xb0 [ 13.384157] __x64_sys_finit_module+0xbe/0x130 [ 13.384164] do_syscall_64+0x82/0x190 [ 13.384174] ? srso_alias_return_thunk+0x5/0xfbef5 [ 13.384179] ? irqtime_account_irq+0x3d/0x1f0 [ 13.384188] ? srso_alias_return_thunk+0x5/0xfbef5 [ 13.384193] ? __irq_exit_rcu+0x4e/0x130 [ 13.384201] ? srso_alias_return_thunk+0x5/0xfbef5 [ 13.384206] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 13.384212] RIP: 0033:0x7a21f96ade9d [ 13.384263] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 90 f3 0f 1e fa 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 8b 0d 63 de 0c 00 f7 d8 64 89 01 48 [ 13.384267] RSP: 002b:00007ffeae934e78 EFLAGS: 00000246 ORIG_RAX: 0000000000000139 [ 13.384273] RAX: ffffffffffffffda RBX: 00005987276bfcf0 RCX: 00007a21f96ade9d [ 13.384277] RDX: 0000000000000004 RSI: 00007a21f8eda376 RDI: 000000000000001c [ 13.384280] RBP: 00007a21f8eda376 R08: 0000000000000001 R09: 00007ffeae934ec0 [ 13.384284] R10: 0000000000000050 R11: 0000000000000246 R12: 0000000000020000 [ 13.384288] R13: 00005987276c1250 R14: 0000000000000000 R15: 00005987276c4530 [ 13.384297] [ 13.384299] Modules linked in: soundwire_amd(+) hid_sensor_gyro_3d(+) hid_sensor_magn_3d hid_sensor_accel_3d soundwire_generic_allocation amdxcp hid_sensor_trigger drm_exec industrialio_triggered_buffer soundwire_bus gpu_sched kvm_amd kfifo_buf qmi_helpers joydev drm_buddy hid_sensor_iio_common mousedev snd_soc_core industrialio i2c_algo_bit mac80211 snd_compress drm_suballoc_helper kvm snd_hda_intel drm_ttm_helper ac97_bus snd_pcm_dmaengine snd_intel_dspcfg ttm thinkpad_acpi(+) snd_intel_sdw_acpi hid_sensor_hub snd_rpl_pci_acp6x drm_display_helper snd_hda_codec hid_multitouch libarc4 snd_acp_pci platform_profile think_lmi(+) hid_generic firmware_attributes_class wmi_bmof cec snd_acp_legacy_common sparse_keymap rapl snd_hda_core psmouse cfg80211 pcspkr snd_pci_acp6x snd_hwdep video snd_pcm snd_pci_acp5x snd_timer snd_rn_pci_acp3x ucsi_acpi snd_acp_config snd sp5100_tco rfkill snd_soc_acpi typec_ucsi thunderbolt amd_sfh k10temp mhi soundcore i2c_piix4 snd_pci_acp3x typec i2c_hid_acpi roles i2c_hid wmi acpi_tad amd_pmc [ 13.384454] mac_hid i2c_dev crypto_user loop nfnetlink zram ip_tables x_tables dm_crypt cbc encrypted_keys trusted asn1_encoder tee dm_mod crct10dif_pclmul crc32_pclmul polyval_clmulni polyval_generic gf128mul ghash_clmulni_intel serio_raw sha512_ssse3 atkbd sha256_ssse3 libps2 sha1_ssse3 vivaldi_fmap nvme aesni_intel crypto_simd nvme_core cryptd ccp xhci_pci i8042 nvme_auth xhci_pci_renesas serio vfat fat btrfs blake2b_generic libcrc32c crc32c_generic crc32c_intel xor raid6_pq [ 13.384552] ---[ end trace 0000000000000000 ]--- KASAN reports a use-after-free of hid->driver_data in function amd_sfh_get_report(). The backtrace indicates that the function is called by amdtp_hid_request() which is one of the callbacks of hid device. The current make sure that driver_data is freed only once hid_destroy_device() returned. Note that I observed the crash both on v6.9.9 and v6.10.0. The code seems to be as it was from the early days of the driver. Signed-off-by: Olivier Sobrie Acked-by: Basavaraj Natikar Signed-off-by: Jiri Kosina drivers/hid/amd-sfh-hid/amd_sfh_hid.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) commit d1aa95e86f178dc597e80228cd9bd81fc3510f34 Author: Luke D. Jones Date: Thu Jul 25 10:31:25 2024 +1200 hid-asus: add ROG Ally X prod ID to quirk list The new ASUS ROG Ally X functions almost exactly the same as the previous model, so we can use the same quirks. Signed-off-by: Luke D. Jones Signed-off-by: Jiri Kosina drivers/hid/hid-asus.c | 3 +++ drivers/hid/hid-ids.h | 1 + 2 files changed, 4 insertions(+) commit 62b45bab010d1b0cea6166f818f1cd0666a6d8d8 Author: Dave Airlie Date: Mon Jul 15 18:35:51 2024 +1000 drm/test: fix the gem shmem test to map the sg table. The test here creates an sg table, but never maps it, when we get to drm_gem_shmem_free, the helper tries to unmap and this causes warnings on some platforms and debug kernels. This also sets a 64-bit dma mask, as I see an swiotlb warning if I stick with the default 32-bit one. Fixes: 93032ae634d4 ("drm/test: add a test suite for GEM objects backed by shmem") Cc: stable@vger.kernel.org Signed-off-by: Dave Airlie Reviewed-by: Michael J. Ruhl Acked-by: Daniel Vetter Reviewed-by: Marco Pagani Link: https://patchwork.freedesktop.org/patch/msgid/20240715083551.777807-1-airlied@gmail.com Signed-off-by: Maxime Ripard drivers/gpu/drm/tests/drm_gem_shmem_test.c | 11 +++++++++++ 1 file changed, 11 insertions(+) commit 113fd6372a5bb3689aba8ef5b8a265ed1529a78f Author: Ma Ke Date: Fri Aug 2 12:47:36 2024 +0800 drm/client: fix null pointer dereference in drm_client_modeset_probe In drm_client_modeset_probe(), the return value of drm_mode_duplicate() is assigned to modeset->mode, which will lead to a possible NULL pointer dereference on failure of drm_mode_duplicate(). Add a check to avoid npd. Cc: stable@vger.kernel.org Fixes: cf13909aee05 ("drm/fb-helper: Move out modeset config code") Signed-off-by: Ma Ke Reviewed-by: Thomas Zimmermann Signed-off-by: Thomas Zimmermann Link: https://patchwork.freedesktop.org/patch/msgid/20240802044736.1570345-1-make24@iscas.ac.cn drivers/gpu/drm/drm_client_modeset.c | 5 +++++ 1 file changed, 5 insertions(+) commit ab3de2c7ec91db6a3cf5fc07765852c81ca7d6ef Author: Aapo Vienamo Date: Thu Jun 20 13:43:03 2024 +0300 thunderbolt: Fix memory leaks in {port|retimer}_sb_regs_write() Add missing free_page() call for the memory allocated by validate_and_copy_from_user(). Fixes: 6d241fa00159 ("thunderbolt: Add sideband register access to debugfs") Signed-off-by: Aapo Vienamo Reviewed-by: Przemek Kitszel Signed-off-by: Mika Westerberg drivers/thunderbolt/debugfs.c | 10 ++++++---- 1 file changed, 6 insertions(+), 4 deletions(-) commit 27ce65f65258cf2f2855162cbeef59659a81fac4 Author: Dave Airlie Date: Fri Aug 2 14:38:28 2024 +1000 Revert "nouveau: rip out busy fence waits" This reverts commit d45bb9c5f7a6f7b6e47939856b28cb1da0cdc119. Just got a report that this causes some suspend/resume issues, so back it out and I'll investigate it later. Reported-by: Mike Galbraith Signed-off-by: Dave Airlie drivers/gpu/drm/nouveau/nouveau_bo.c | 2 +- drivers/gpu/drm/nouveau/nouveau_chan.c | 2 +- drivers/gpu/drm/nouveau/nouveau_dmem.c | 2 +- drivers/gpu/drm/nouveau/nouveau_fence.c | 30 +++++++++++++++++++++++++++++- drivers/gpu/drm/nouveau/nouveau_fence.h | 2 +- drivers/gpu/drm/nouveau/nouveau_gem.c | 2 +- 6 files changed, 34 insertions(+), 6 deletions(-) commit 4eb399741ff67452eeaf099f366045042401cf3c Merge: 7b9b765168be 9c685f61722d Author: Dave Airlie Date: Fri Aug 2 12:14:28 2024 +1000 Merge tag 'drm-misc-fixes-2024-08-01' of https://gitlab.freedesktop.org/drm/misc/kernel into drm-fixes A couple drm_panic fixes, several v3d fixes to increase the new timestamp API safety, several fixes for vmwgfx for various modesetting issues, PM fixes for ast, async flips improvements and two fixes for nouveau to fix resource refcounting and buffer placement. Signed-off-by: Dave Airlie From: Maxime Ripard Link: https://patchwork.freedesktop.org/patch/msgid/20240801-interesting-antique-bat-2fe4c0@houat commit ffed586b8c4f1fdb772ee350e229863f145defb5 Author: Shin'ichiro Kawasaki Date: Thu Aug 1 14:42:34 2024 +0900 scsi: sd: Move sd_read_cpr() out of the q->limits_lock region Commit 804e498e0496 ("sd: convert to the atomic queue limits API") introduced pairs of function calls to queue_limits_start_update() and queue_limits_commit_update(). These two functions lock and unlock q->limits_lock. In sd_revalidate_disk(), sd_read_cpr() is called after queue_limits_start_update() call and before queue_limits_commit_update() call. sd_read_cpr() locks q->sysfs_dir_lock and &q->sysfs_lock. Then new lock dependencies were created between q->limits_lock, q->sysfs_dir_lock and q->sysfs_lock, as follows: sd_revalidate_disk queue_limits_start_update mutex_lock(&q->limits_lock) sd_read_cpr disk_set_independent_access_ranges mutex_lock(&q->sysfs_dir_lock) mutex_lock(&q->sysfs_lock) mutex_unlock(&q->sysfs_lock) mutex_unlock(&q->sysfs_dir_lock) queue_limits_commit_update mutex_unlock(&q->limits_lock) However, the three locks already had reversed dependencies in other places. Then the new dependencies triggered the lockdep WARN "possible circular locking dependency detected" [1]. This WARN was observed by running the blktests test case srp/002. To avoid the WARN, move the sd_read_cpr() call in sd_revalidate_disk() after the queue_limits_commit_update() call. In other words, move the sd_read_cpr() call out of the q->limits_lock region. [1] https://lore.kernel.org/linux-scsi/vlmv53ni3ltwxplig5qnw4xsl2h6ccxijfbqzekx76vxoim5a5@dekv7q3es3tx/ Fixes: 804e498e0496 ("sd: convert to the atomic queue limits API") Signed-off-by: Shin'ichiro Kawasaki Link: https://lore.kernel.org/r/20240801054234.540532-1-shinichiro.kawasaki@wdc.com Tested-by: Luca Coelho Reviewed-by: Damien Le Moal Reviewed-by: Christoph Hellwig Reviewed-by: Bart Van Assche Signed-off-by: Martin K. Petersen drivers/scsi/sd.c | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-) commit ab9fd06cb8f0db0854291833fc40c789e43a361f Author: Vamshi Gajjela Date: Wed Jul 24 19:21:26 2024 +0530 scsi: ufs: core: Fix hba->last_dme_cmd_tstamp timestamp updating logic The ufshcd_add_delay_before_dme_cmd() always introduces a delay of MIN_DELAY_BEFORE_DME_CMDS_US between DME commands even when it's not required. The delay is added when the UFS host controller supplies the quirk UFSHCD_QUIRK_DELAY_BEFORE_DME_CMDS. Fix the logic to update hba->last_dme_cmd_tstamp to ensure subsequent DME commands have the correct delay in the range of 0 to MIN_DELAY_BEFORE_DME_CMDS_US. Update the timestamp at the end of the function to ensure it captures the latest time after any necessary delay has been applied. Signed-off-by: Vamshi Gajjela Link: https://lore.kernel.org/r/20240724135126.1786126-1-vamshigajjela@google.com Fixes: cad2e03d8607 ("ufs: add support to allow non standard behaviours (quirks)") Cc: stable@vger.kernel.org Reviewed-by: Bart Van Assche Signed-off-by: Martin K. Petersen drivers/ufs/core/ufshcd.c | 11 ++++++++--- 1 file changed, 8 insertions(+), 3 deletions(-) commit 16dc75e500a37bc9a2fcc39d0c776a90ca06a34f Merge: 183d46ff422e 4d2868b5d191 Author: Jakub Kicinski Date: Thu Aug 1 18:24:51 2024 -0700 Merge branch 'mptcp-fix-endpoints-with-signal-and-subflow-flags' Matthieu Baerts says: ==================== mptcp: fix endpoints with 'signal' and 'subflow' flags When looking at improving the user experience around the MPTCP endpoints setup, I noticed that setting an endpoint with both the 'signal' and the 'subflow' flags -- as it has been done in the past by users according to bug reports we got -- was resulting on only announcing the endpoint, but not using it to create subflows: the 'subflow' flag was then ignored. My initial thought was to modify IPRoute2 to warn the user when the two flags were set, but it doesn't sound normal to ignore one of them. I then looked at modifying the kernel not to allow having the two flags set, but when discussing about that with Mat, we thought it was maybe not ideal to do that, as there might be use-cases, we might break some configs. Then I saw it was working before v5.17. So instead, I fixed the support on the kernel side (patch 5) using Paolo's suggestion. This also includes a fix on the options side (patch 1: for v5.11+), an explicit deny of some options combinations (patch 2: for v5.18+), and some refactoring (patches 3 and 4) to ease the inclusion of the patch 5. While at it, I added a new selftest (patch 7) to validate this case -- including a modification of the chk_add_nr helper to inverse the sides were the counters are checked (patch 6) -- and allowed ADD_ADDR echo just after the MP_JOIN 3WHS. The selftests modification have the same Fixes tag as the previous commit, but no 'Cc: Stable': if the backport can work, that's good -- but it still need to be verified by running the selftests -- if not, no need to worry, many CIs will use the selftests from the last stable version to validate previous stable releases. ==================== Link: https://patch.msgid.link/20240731-upstream-net-20240731-mptcp-endp-subflow-signal-v1-0-c8a9b036493b@kernel.org Signed-off-by: Jakub Kicinski commit 4d2868b5d191c74262f7407972d68d1bf3245d6a Author: Matthieu Baerts (NGI0) Date: Wed Jul 31 13:05:59 2024 +0200 selftests: mptcp: join: test both signal & subflow It should be quite uncommon to set both the subflow and the signal flags: the initiator of the connection is typically the one creating new subflows, not the other peer, then no need to announce additional local addresses, and use it to create subflows. But some people might be confused about the flags, and set both "just to be sure at least the right one is set". To verify the previous fix, and avoid future regressions, this specific case is now validated: the client announces a new address, and initiates a new subflow from the same address. While working on this, another bug has been noticed, where the client reset the new subflow because an ADD_ADDR echo got received as the 3rd ACK: this new test also explicitly checks that no RST have been sent by the client and server. The 'Fixes' tag here below is the same as the one from the previous commit: this patch here is not fixing anything wrong in the selftests, but it validates the previous fix for an issue introduced by this commit ID. Fixes: 86e39e04482b ("mptcp: keep track of local endpoint still available for each msk") Reviewed-by: Mat Martineau Signed-off-by: Matthieu Baerts (NGI0) Link: https://patch.msgid.link/20240731-upstream-net-20240731-mptcp-endp-subflow-signal-v1-7-c8a9b036493b@kernel.org Signed-off-by: Jakub Kicinski tools/testing/selftests/net/mptcp/mptcp_join.sh | 15 +++++++++++++++ 1 file changed, 15 insertions(+) commit bec1f3b119ebc613d08dfbcdbaef01a79aa7de92 Author: Matthieu Baerts (NGI0) Date: Wed Jul 31 13:05:58 2024 +0200 selftests: mptcp: join: ability to invert ADD_ADDR check In the following commit, the client will initiate the ADD_ADDR, instead of the server. We need to way to verify the ADD_ADDR have been correctly sent. Note: the default expected counters for when the port number is given are never changed by the caller, no need to accept them as parameter then. The 'Fixes' tag here below is the same as the one from the previous commit: this patch here is not fixing anything wrong in the selftests, but it validates the previous fix for an issue introduced by this commit ID. Fixes: 86e39e04482b ("mptcp: keep track of local endpoint still available for each msk") Reviewed-by: Mat Martineau Signed-off-by: Matthieu Baerts (NGI0) Link: https://patch.msgid.link/20240731-upstream-net-20240731-mptcp-endp-subflow-signal-v1-6-c8a9b036493b@kernel.org Signed-off-by: Jakub Kicinski tools/testing/selftests/net/mptcp/mptcp_join.sh | 40 ++++++++++++++++--------- 1 file changed, 26 insertions(+), 14 deletions(-) commit 85df533a787bf07bf4367ce2a02b822ff1fba1a3 Author: Matthieu Baerts (NGI0) Date: Wed Jul 31 13:05:57 2024 +0200 mptcp: pm: do not ignore 'subflow' if 'signal' flag is also set Up to the 'Fixes' commit, having an endpoint with both the 'signal' and 'subflow' flags, resulted in the creation of a subflow and an address announcement using the address linked to this endpoint. After this commit, only the address announcement was done, ignoring the 'subflow' flag. That's because the same bitmap is used for the two flags. It is OK to keep this single bitmap, the already selected local endpoint simply have to be re-used, but not via select_local_address() not to look at the just modified bitmap. Note that it is unusual to set the two flags together: creating a new subflow using a new local address will implicitly advertise it to the other peer. So in theory, no need to advertise it explicitly as well. Maybe there are use-cases -- the subflow might not reach the other peer that way, we can ask the other peer to try initiating the new subflow without delay -- or very likely the user is confused, and put both flags "just to be sure at least the right one is set". Still, if it is allowed, the kernel should do what has been asked: using this endpoint to announce the address and to create a new subflow from it. An alternative is to forbid the use of the two flags together, but that's probably too late, there are maybe use-cases, and it was working before. This patch will avoid people complaining subflows are not created using the endpoint they added with the 'subflow' and 'signal' flag. Note that with the current patch, the subflow might not be created in some corner cases, e.g. if the 'subflows' limit was reached when sending the ADD_ADDR, but changed later on. It is probably not worth splitting id_avail_bitmap per target ('signal', 'subflow'), which will add another large field to the msk "just" to track (again) endpoints. Anyway, currently when the limits are changed, the kernel doesn't check if new subflows can be created or removed, because we would need to keep track of the received ADD_ADDR, and more. It sounds OK to assume that the limits should be properly configured before establishing new connections. Fixes: 86e39e04482b ("mptcp: keep track of local endpoint still available for each msk") Cc: stable@vger.kernel.org Suggested-by: Paolo Abeni Reviewed-by: Mat Martineau Signed-off-by: Matthieu Baerts (NGI0) Link: https://patch.msgid.link/20240731-upstream-net-20240731-mptcp-endp-subflow-signal-v1-5-c8a9b036493b@kernel.org Signed-off-by: Jakub Kicinski net/mptcp/pm_netlink.c | 16 ++++++++++++---- 1 file changed, 12 insertions(+), 4 deletions(-) commit cd7c957f936f8cb80d03e5152f4013aae65bd986 Author: Matthieu Baerts (NGI0) Date: Wed Jul 31 13:05:56 2024 +0200 mptcp: pm: don't try to create sf if alloc failed It sounds better to avoid wasting cycles and / or put extreme memory pressure on the system by trying to create new subflows if it was not possible to add a new item in the announce list. While at it, a warning is now printed if the entry was already in the list as it should not happen with the in-kernel path-manager. With this PM, mptcp_pm_alloc_anno_list() should only fail in case of memory pressure. Fixes: b6c08380860b ("mptcp: remove addr and subflow in PM netlink") Cc: stable@vger.kernel.org Suggested-by: Paolo Abeni Reviewed-by: Mat Martineau Signed-off-by: Matthieu Baerts (NGI0) Link: https://patch.msgid.link/20240731-upstream-net-20240731-mptcp-endp-subflow-signal-v1-4-c8a9b036493b@kernel.org Signed-off-by: Jakub Kicinski net/mptcp/pm_netlink.c | 10 ++++++---- 1 file changed, 6 insertions(+), 4 deletions(-) commit c95eb32ced823a00be62202b43966b07b2f20b7f Author: Matthieu Baerts (NGI0) Date: Wed Jul 31 13:05:55 2024 +0200 mptcp: pm: reduce indentation blocks That will simplify the following commits. No functional changes intended. Suggested-by: Paolo Abeni Reviewed-by: Mat Martineau Signed-off-by: Matthieu Baerts (NGI0) Link: https://patch.msgid.link/20240731-upstream-net-20240731-mptcp-endp-subflow-signal-v1-3-c8a9b036493b@kernel.org Signed-off-by: Jakub Kicinski net/mptcp/pm_netlink.c | 19 +++++++++++-------- 1 file changed, 11 insertions(+), 8 deletions(-) commit 8af1f11865f259c882cce71d32f85ee9004e2660 Author: Matthieu Baerts (NGI0) Date: Wed Jul 31 13:05:54 2024 +0200 mptcp: pm: deny endp with signal + subflow + port As mentioned in the 'Fixes' commit, the port flag is only supported by the 'signal' flag, and not by the 'subflow' one. Then if both the 'signal' and 'subflow' flags are set, the problem is the same: the feature cannot work with the 'subflow' flag. Technically, if both the 'signal' and 'subflow' flags are set, it will be possible to create the listening socket, but not to establish a subflow using this source port. So better to explicitly deny it, not to create some confusions because the expected behaviour is not possible. Fixes: 09f12c3ab7a5 ("mptcp: allow to use port and non-signal in set_flags") Cc: stable@vger.kernel.org Reviewed-by: Mat Martineau Signed-off-by: Matthieu Baerts (NGI0) Link: https://patch.msgid.link/20240731-upstream-net-20240731-mptcp-endp-subflow-signal-v1-2-c8a9b036493b@kernel.org Signed-off-by: Jakub Kicinski net/mptcp/pm_netlink.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) commit d67c5649c1541dc93f202eeffc6f49220a4ed71d Author: Matthieu Baerts (NGI0) Date: Wed Jul 31 13:05:53 2024 +0200 mptcp: fully established after ADD_ADDR echo on MPJ Before this patch, receiving an ADD_ADDR echo on the just connected MP_JOIN subflow -- initiator side, after the MP_JOIN 3WHS -- was resulting in an MP_RESET. That's because only ACKs with a DSS or ADD_ADDRs without the echo bit were allowed. Not allowing the ADD_ADDR echo after an MP_CAPABLE 3WHS makes sense, as we are not supposed to send an ADD_ADDR before because it requires to be in full established mode first. For the MP_JOIN 3WHS, that's different: the ADD_ADDR can be sent on a previous subflow, and the ADD_ADDR echo can be received on the recently created one. The other peer will already be in fully established, so it is allowed to send that. We can then relax the conditions here to accept the ADD_ADDR echo for MPJ subflows. Fixes: 67b12f792d5e ("mptcp: full fully established support after ADD_ADDR") Cc: stable@vger.kernel.org Reviewed-by: Mat Martineau Signed-off-by: Matthieu Baerts (NGI0) Link: https://patch.msgid.link/20240731-upstream-net-20240731-mptcp-endp-subflow-signal-v1-1-c8a9b036493b@kernel.org Signed-off-by: Jakub Kicinski net/mptcp/options.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) commit 7b9b765168beb8b7c7c26e60c9b7c86befc31e2b Merge: 774c6f271080 5b5115726601 Author: Dave Airlie Date: Fri Aug 2 11:19:14 2024 +1000 Merge tag 'drm-intel-fixes-2024-08-01' of https://gitlab.freedesktop.org/drm/i915/kernel into drm-fixes - Static analysis fix for int overflow - Fix for HDCP2_STREAM_STATUS macro and removal of PWR_CLK_STATE for gen12 Signed-off-by: Dave Airlie From: Joonas Lahtinen Link: https://patchwork.freedesktop.org/patch/msgid/ZqslBkcZlInYdYgm@jlahtine-mobl.ger.corp.intel.com commit 774c6f271080fea23e7780e063c665af8679f3af Merge: 8400291e289e d2860084ecca Author: Dave Airlie Date: Fri Aug 2 08:21:34 2024 +1000 Merge tag 'amd-drm-fixes-6.11-2024-07-27' of https://gitlab.freedesktop.org/agd5f/linux into drm-fixes amd-drm-fixes-6.11-2024-07-27: amdgpu: - SMU 14.x update - Fix contiguous VRAM handling for IB parsing - GFX 12 fix - Regression fix for old APUs Signed-off-by: Dave Airlie From: Alex Deucher Link: https://patchwork.freedesktop.org/patch/msgid/20240728025407.2115881-1-alexander.deucher@amd.com commit 8aa37bde1a7b645816cda8b80df4753ecf172bf1 Author: Al Viro Date: Thu Aug 1 15:22:22 2024 -0400 protect the fetch of ->fd[fd] in do_dup2() from mispredictions both callers have verified that fd is not greater than ->max_fds; however, misprediction might end up with tofree = fdt->fd[fd]; being speculatively executed. That's wrong for the same reasons why it's wrong in close_fd()/file_close_fd_locked(); the same solution applies - array_index_nospec(fd, fdt->max_fds) could differ from fd only in case of speculative execution on mispredicted path. Cc: stable@vger.kernel.org Signed-off-by: Al Viro fs/file.c | 1 + 1 file changed, 1 insertion(+) commit dd35a0933269c636635b6af89dc6fa1782791e56 Author: David Gow Date: Wed Jul 31 15:30:29 2024 +0800 x86/uaccess: Zero the 8-byte get_range case on failure on 32-bit While zeroing the upper 32 bits of an 8-byte getuser on 32-bit x86 was fixed by commit 8c860ed825cb ("x86/uaccess: Fix missed zeroing of ia32 u64 get_user() range checking") it was broken again in commit 8a2462df1547 ("x86/uaccess: Improve the 8-byte getuser() case"). This is because the register which holds the upper 32 bits (%ecx) is being cleared _after_ the check_range, so if the range check fails, %ecx is never cleared. This can be reproduced with: ./tools/testing/kunit/kunit.py run --arch i386 usercopy Instead, clear %ecx _before_ check_range in the 8-byte case. This reintroduces a bit of the ugliness we were trying to avoid by adding another #ifndef CONFIG_X86_64, but at least keeps check_range from needing a separate bad_get_user_8 jump. Fixes: 8a2462df1547 ("x86/uaccess: Improve the 8-byte getuser() case") Signed-off-by: David Gow Signed-off-by: Thomas Gleixner Acked-by: Linus Torvalds Link: https://lore.kernel.org/all/20240731073031.4045579-1-davidgow@google.com arch/x86/lib/getuser.S | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) commit 3b6564427aea83b7a35a15ca278291d50a1edcfc Author: Stuart Menefy Date: Sat Jun 22 12:42:16 2024 +0100 riscv: Fix linear mapping checks for non-contiguous memory regions The RISC-V kernel already has checks to ensure that memory which would lie outside of the linear mapping is not used. However those checks use memory_limit, which is used to implement the mem= kernel command line option (to limit the total amount of memory, not its address range). When memory is made up of two or more non-contiguous memory banks this check is incorrect. Two changes are made here: - add a call in setup_bootmem() to memblock_cap_memory_range() which will cause any memory which falls outside the linear mapping to be removed from the memory regions. - remove the check in create_linear_mapping_page_table() which was intended to remove memory which is outside the liner mapping based on memory_limit, as it is no longer needed. Note a check for mapping more memory than memory_limit (to implement mem=) is unnecessary because of the existing call to memblock_enforce_memory_limit(). This issue was seen when booting on a SV39 platform with two memory banks: 0x00,80000000 1GiB 0x20,00000000 32GiB This memory range is 158GiB from top to bottom, but the linear mapping is limited to 128GiB, so the lower block of RAM will be mapped at PAGE_OFFSET, and the upper block straddles the top of the linear mapping. This causes the following Oops: [ 0.000000] Linux version 6.10.0-rc2-gd3b8dd5b51dd-dirty (stuart.menefy@codasip.com) (riscv64-codasip-linux-gcc (GCC) 13.2.0, GNU ld (GNU Binutils) 2.41.0.20231213) #20 SMP Sat Jun 22 11:34:22 BST 2024 [ 0.000000] memblock_add: [0x0000000080000000-0x00000000bfffffff] early_init_dt_add_memory_arch+0x4a/0x52 [ 0.000000] memblock_add: [0x0000002000000000-0x00000027ffffffff] early_init_dt_add_memory_arch+0x4a/0x52 ... [ 0.000000] memblock_alloc_try_nid: 23724 bytes align=0x8 nid=-1 from=0x0000000000000000 max_addr=0x0000000000000000 early_init_dt_alloc_memory_arch+0x1e/0x48 [ 0.000000] memblock_reserve: [0x00000027ffff5350-0x00000027ffffaffb] memblock_alloc_range_nid+0xb8/0x132 [ 0.000000] Unable to handle kernel paging request at virtual address fffffffe7fff5350 [ 0.000000] Oops [#1] [ 0.000000] Modules linked in: [ 0.000000] CPU: 0 PID: 0 Comm: swapper Not tainted 6.10.0-rc2-gd3b8dd5b51dd-dirty #20 [ 0.000000] Hardware name: codasip,a70x (DT) [ 0.000000] epc : __memset+0x8c/0x104 [ 0.000000] ra : memblock_alloc_try_nid+0x74/0x84 [ 0.000000] epc : ffffffff805e88c8 ra : ffffffff806148f6 sp : ffffffff80e03d50 [ 0.000000] gp : ffffffff80ec4158 tp : ffffffff80e0bec0 t0 : fffffffe7fff52f8 [ 0.000000] t1 : 00000027ffffb000 t2 : 5f6b636f6c626d65 s0 : ffffffff80e03d90 [ 0.000000] s1 : 0000000000005cac a0 : fffffffe7fff5350 a1 : 0000000000000000 [ 0.000000] a2 : 0000000000005cac a3 : fffffffe7fffaff8 a4 : 000000000000002c [ 0.000000] a5 : ffffffff805e88c8 a6 : 0000000000005cac a7 : 0000000000000030 [ 0.000000] s2 : fffffffe7fff5350 s3 : ffffffffffffffff s4 : 0000000000000000 [ 0.000000] s5 : ffffffff8062347e s6 : 0000000000000000 s7 : 0000000000000001 [ 0.000000] s8 : 0000000000002000 s9 : 00000000800226d0 s10: 0000000000000000 [ 0.000000] s11: 0000000000000000 t3 : ffffffff8080a928 t4 : ffffffff8080a928 [ 0.000000] t5 : ffffffff8080a928 t6 : ffffffff8080a940 [ 0.000000] status: 0000000200000100 badaddr: fffffffe7fff5350 cause: 000000000000000f [ 0.000000] [] __memset+0x8c/0x104 [ 0.000000] [] early_init_dt_alloc_memory_arch+0x1e/0x48 [ 0.000000] [] __unflatten_device_tree+0x52/0x114 [ 0.000000] [] unflatten_device_tree+0x9e/0xb8 [ 0.000000] [] setup_arch+0xd4/0x5bc [ 0.000000] [] start_kernel+0x76/0x81a [ 0.000000] Code: b823 02b2 bc23 02b2 b023 04b2 b423 04b2 b823 04b2 (bc23) 04b2 [ 0.000000] ---[ end trace 0000000000000000 ]--- [ 0.000000] Kernel panic - not syncing: Attempted to kill the idle task! [ 0.000000] ---[ end Kernel panic - not syncing: Attempted to kill the idle task! ]--- The problem is that memblock (unaware that some physical memory cannot be used) has allocated memory from the top of memory but which is outside the linear mapping region. Signed-off-by: Stuart Menefy Fixes: c99127c45248 ("riscv: Make sure the linear mapping does not use the kernel mapping") Reviewed-by: David McKay Reviewed-by: Alexandre Ghiti Link: https://lore.kernel.org/r/20240622114217.2158495-1-stuart.menefy@codasip.com Signed-off-by: Palmer Dabbelt arch/riscv/mm/init.c | 15 +++++++++++---- 1 file changed, 11 insertions(+), 4 deletions(-) commit c0ecd6388360d930440cc5554026818895199923 Merge: 183d46ff422e 5560a612c20d Author: Linus Torvalds Date: Thu Aug 1 11:30:15 2024 -0700 Merge tag 'pci-v6.11-fixes-1' of git://git.kernel.org/pub/scm/linux/kernel/git/pci/pci Pull PCI fixes from Bjorn Helgaas: - Fix a pci_intx() regression that caused driver reload to fail with "Resources present before probing" (Philipp Stanner) - Fix a pciehp regression that clobbered the upper bits of RAID status LEDs on NVMe devices behind an Intel VMD (Blazej Kucman) * tag 'pci-v6.11-fixes-1' of git://git.kernel.org/pub/scm/linux/kernel/git/pci/pci: PCI: pciehp: Retain Power Indicator bits for userspace indicators PCI: Fix devres regression in pci_intx() commit aca0ec970d7644954caf01a40c5538d4400c01bd Author: Ackerley Tng Date: Thu Aug 1 17:39:55 2024 +0000 KVM: x86/mmu: fix determination of max NPT mapping level for private pages The `if (req_max_level)` test was meant ignore req_max_level if PG_LEVEL_NONE was returned. Hence, this function should return max_level instead of the ignored req_max_level. This is only a latent issue for now, since guest_memfd does not support large pages. Signed-off-by: Ackerley Tng Message-ID: <20240801173955.1975034-1-ackerleytng@google.com> Fixes: f32fb32820b1 ("KVM: x86: Add hook for determining max NPT mapping level") Signed-off-by: Paolo Bonzini arch/x86/kvm/mmu/mmu.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 5560a612c20d3daacbf5da7913deefa5c31742f4 Author: Blazej Kucman Date: Mon Jul 22 16:14:40 2024 +0200 PCI: pciehp: Retain Power Indicator bits for userspace indicators The sysfs "attention" file normally controls the Slot Control Attention Indicator with 0 (off), 1 (on), 2 (blink) settings. 576243b3f9ea ("PCI: pciehp: Allow exclusive userspace control of indicators") added pciehp_set_raw_indicator_status() to allow userspace to directly control all four bits in both the Attention Indicator and the Power Indicator fields via the "attention" file. This is used on Intel VMD bridges so utilities like "ledmon" can use sysfs "attention" to control up to 16 indicators for NVMe device RAID status. abaaac4845a0 ("PCI: hotplug: Use FIELD_GET/PREP()") broke this by masking the sysfs data with PCI_EXP_SLTCTL_AIC, which discards the upper two bits intended for the Power Indicator Control field (PCI_EXP_SLTCTL_PIC). For NVMe devices behind an Intel VMD, ledmon settings that use the PCI_EXP_SLTCTL_PIC bits, i.e., ATTENTION_REBUILD (0x5), ATTENTION_LOCATE (0x7), ATTENTION_FAILURE (0xD), ATTENTION_OFF (0xF), no longer worked correctly. Mask with PCI_EXP_SLTCTL_AIC | PCI_EXP_SLTCTL_PIC to retain both the Attention Indicator and the Power Indicator bits. Fixes: abaaac4845a0 ("PCI: hotplug: Use FIELD_GET/PREP()") Link: https://lore.kernel.org/r/20240722141440.7210-1-blazej.kucman@intel.com Signed-off-by: Blazej Kucman [bhelgaas: commit log] Signed-off-by: Bjorn Helgaas Cc: stable@vger.kernel.org # v6.7+ drivers/pci/hotplug/pciehp_hpc.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) commit 00f89ae4e759a7eef07e4188e1534af7dd2c7e9c Author: Philipp Stanner Date: Thu Jul 25 14:07:30 2024 +0200 PCI: Fix devres regression in pci_intx() pci_intx() becomes managed if pcim_enable_device() has been called in advance. Commit 25216afc9db5 ("PCI: Add managed pcim_intx()") changed this behavior so that pci_intx() always leads to creation of a separate device resource for itself, whereas earlier, a shared resource was used for all PCI devres operations. Unfortunately, pci_intx() seems to be used in some drivers' remove() paths; in the managed case this causes a device resource to be created on driver detach, which causes .probe() to fail if the driver is reloaded: pci 0000:00:1f.2: Resources present before probing Fix the regression by only redirecting pci_intx() to its managed twin pcim_intx() if the pci_command changes. Link: https://lore.kernel.org/r/20240725120729.59788-2-pstanner@redhat.com Fixes: 25216afc9db5 ("PCI: Add managed pcim_intx()") Reported-by: Damien Le Moal Closes: https://lore.kernel.org/all/b8f4ba97-84fc-4b7e-ba1a-99de2d9f0118@kernel.org/ Signed-off-by: Philipp Stanner [bhelgaas: add error message to commit log] Signed-off-by: Bjorn Helgaas Tested-by: Damien Le Moal drivers/pci/pci.c | 15 ++++++++------- 1 file changed, 8 insertions(+), 7 deletions(-) commit 183d46ff422ef9f3d755b6808ef3faa6d009ba3a Merge: 21b136cc63d2 25010bfdf8bb Author: Linus Torvalds Date: Thu Aug 1 09:42:09 2024 -0700 Merge tag 'net-6.11-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net Pull networking fixes from Paolo Abeni: "Including fixes from wireless, bleutooth, BPF and netfilter. Current release - regressions: - core: drop bad gso csum_start and offset in virtio_net_hdr - wifi: mt76: fix null pointer access in mt792x_mac_link_bss_remove - eth: tun: add missing bpf_net_ctx_clear() in do_xdp_generic() - phy: aquantia: only poll GLOBAL_CFG regs on aqr113, aqr113c and aqr115c Current release - new code bugs: - smc: prevent UAF in inet_create() - bluetooth: btmtk: fix kernel crash when entering btmtk_usb_suspend - eth: bnxt: reject unsupported hash functions Previous releases - regressions: - sched: act_ct: take care of padding in struct zones_ht_key - netfilter: fix null-ptr-deref in iptable_nat_table_init(). - tcp: adjust clamping window for applications specifying SO_RCVBUF Previous releases - always broken: - ethtool: rss: small fixes to spec and GET - mptcp: - fix signal endpoint re-add - pm: fix backup support in signal endpoints - wifi: ath12k: fix soft lockup on suspend - eth: bnxt_en: fix RSS logic in __bnxt_reserve_rings() - eth: ice: fix AF_XDP ZC timeout and concurrency issues - eth: mlx5: - fix missing lock on sync reset reload - fix error handling in irq_pool_request_irq" * tag 'net-6.11-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net: (76 commits) mptcp: fix duplicate data handling mptcp: fix bad RCVPRUNED mib accounting ipv6: fix ndisc_is_useropt() handling for PIO igc: Fix double reset adapter triggered from a single taprio cmd net: MAINTAINERS: Demote Qualcomm IPA to "maintained" net: wan: fsl_qmc_hdlc: Discard received CRC net: wan: fsl_qmc_hdlc: Convert carrier_lock spinlock to a mutex net/mlx5e: Add a check for the return value from mlx5_port_set_eth_ptys net/mlx5e: Fix CT entry update leaks of modify header context net/mlx5e: Require mlx5 tc classifier action support for IPsec prio capability net/mlx5: Fix missing lock on sync reset reload net/mlx5: Lag, don't use the hardcoded value of the first port net/mlx5: DR, Fix 'stack guard page was hit' error in dr_rule net/mlx5: Fix error handling in irq_pool_request_irq net/mlx5: Always drain health in shutdown callback net: Add skbuff.h to MAINTAINERS r8169: don't increment tx_dropped in case of NETDEV_TX_BUSY netfilter: iptables: Fix potential null-ptr-deref in ip6table_nat_table_init(). netfilter: iptables: Fix null-ptr-deref in iptable_nat_table_init(). net: drop bad gso csum_start and offset in virtio_net_hdr ... commit 1e7bec1f7d6533f08bc1c4ee94930c02361db86c Author: Josef Bacik Date: Mon Jul 29 11:05:48 2024 -0400 btrfs: emit a warning about space cache v1 being deprecated We've been wanting to get rid of this for a while, add a message to indicate that this feature is going away and when so we can finally have a date when we're going to remove it. The output looks like this BTRFS warning (device nvme0n1): space cache v1 is being deprecated and will be removed in a future release, please use -o space_cache=v2 Reviewed-by: Qu Wenruo Reviewed-by: Neal Gompa Signed-off-by: Josef Bacik Reviewed-by: David Sterba Signed-off-by: David Sterba fs/btrfs/super.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) commit 30479f31d44d47ed00ae0c7453d9b253537005b2 Author: Boris Burkov Date: Fri Jul 19 16:49:08 2024 -0700 btrfs: fix qgroup reserve leaks in cow_file_range In the buffered write path, the dirty page owns the qgroup reserve until it creates an ordered_extent. Therefore, any errors that occur before the ordered_extent is created must free that reservation, or else the space is leaked. The fstest generic/475 exercises various IO error paths, and is able to trigger errors in cow_file_range where we fail to get to allocating the ordered extent. Note that because we *do* clear delalloc, we are likely to remove the inode from the delalloc list, so the inodes/pages to not have invalidate/launder called on them in the commit abort path. This results in failures at the unmount stage of the test that look like: BTRFS: error (device dm-8 state EA) in cleanup_transaction:2018: errno=-5 IO failure BTRFS: error (device dm-8 state EA) in btrfs_replace_file_extents:2416: errno=-5 IO failure BTRFS warning (device dm-8 state EA): qgroup 0/5 has unreleased space, type 0 rsv 28672 ------------[ cut here ]------------ WARNING: CPU: 3 PID: 22588 at fs/btrfs/disk-io.c:4333 close_ctree+0x222/0x4d0 [btrfs] Modules linked in: btrfs blake2b_generic libcrc32c xor zstd_compress raid6_pq CPU: 3 PID: 22588 Comm: umount Kdump: loaded Tainted: G W 6.10.0-rc7-gab56fde445b8 #21 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Arch Linux 1.16.3-1-1 04/01/2014 RIP: 0010:close_ctree+0x222/0x4d0 [btrfs] RSP: 0018:ffffb4465283be00 EFLAGS: 00010202 RAX: 0000000000000001 RBX: ffffa1a1818e1000 RCX: 0000000000000001 RDX: 0000000000000000 RSI: ffffb4465283bbe0 RDI: ffffa1a19374fcb8 RBP: ffffa1a1818e13c0 R08: 0000000100028b16 R09: 0000000000000000 R10: 0000000000000003 R11: 0000000000000003 R12: ffffa1a18ad7972c R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 FS: 00007f9168312b80(0000) GS:ffffa1a4afcc0000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f91683c9140 CR3: 000000010acaa000 CR4: 00000000000006f0 Call Trace: ? close_ctree+0x222/0x4d0 [btrfs] ? __warn.cold+0x8e/0xea ? close_ctree+0x222/0x4d0 [btrfs] ? report_bug+0xff/0x140 ? handle_bug+0x3b/0x70 ? exc_invalid_op+0x17/0x70 ? asm_exc_invalid_op+0x1a/0x20 ? close_ctree+0x222/0x4d0 [btrfs] generic_shutdown_super+0x70/0x160 kill_anon_super+0x11/0x40 btrfs_kill_super+0x11/0x20 [btrfs] deactivate_locked_super+0x2e/0xa0 cleanup_mnt+0xb5/0x150 task_work_run+0x57/0x80 syscall_exit_to_user_mode+0x121/0x130 do_syscall_64+0xab/0x1a0 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7f916847a887 ---[ end trace 0000000000000000 ]--- BTRFS error (device dm-8 state EA): qgroup reserved space leaked Cases 2 and 3 in the out_reserve path both pertain to this type of leak and must free the reserved qgroup data. Because it is already an error path, I opted not to handle the possible errors in btrfs_free_qgroup_data. Reviewed-by: Qu Wenruo Signed-off-by: Boris Burkov Signed-off-by: David Sterba fs/btrfs/inode.c | 3 +++ 1 file changed, 3 insertions(+) commit 872617a0896fc7510b0b8f25d323670424461cfc Author: Boris Burkov Date: Thu Jul 18 14:46:23 2024 -0700 btrfs: implement launder_folio for clearing dirty page reserve In the buffered write path, dirty pages can be said to "own" the qgroup reservation until they create an ordered_extent. It is possible for there to be outstanding dirty pages when a transaction is aborted, in which case there is no cancellation path for freeing this reservation and it is leaked. We do already walk the list of outstanding delalloc inodes in btrfs_destroy_delalloc_inodes() and call invalidate_inode_pages2() on them. This does *not* call btrfs_invalidate_folio(), as one might guess, but rather calls launder_folio() and release_folio(). Since this is a reservation associated with dirty pages only, rather than something associated with the private bit (ordered_extent is cancelled separately already in the cleanup transaction path), implementing this release should be done via launder_folio. Reviewed-by: Qu Wenruo Signed-off-by: Boris Burkov Signed-off-by: David Sterba fs/btrfs/inode.c | 7 +++++++ 1 file changed, 7 insertions(+) commit 63447b7dd40c6a9ae8d3bb70c11f4c46731823e3 Author: Qu Wenruo Date: Fri Mar 8 13:40:31 2024 +1030 btrfs: scrub: update last_physical after scrubbing one stripe Currently sctx->stat.last_physical only got updated in the following cases: - When the last stripe of a non-RAID56 chunk is scrubbed This implies a pitfall, if the last stripe is at the chunk boundary, and we finished the scrub of the whole chunk, we won't update last_physical at all until the next chunk. - When a P/Q stripe of a RAID56 chunk is scrubbed This leads the following two problems: - sctx->stat.last_physical is not updated for a almost full chunk This is especially bad, affecting scrub resume, as the resume would start from last_physical, causing unnecessary re-scrub. - "btrfs scrub status" will not report any progress for a long time Fix the problem by properly updating @last_physical after each stripe is scrubbed. And since we're here, for the sake of consistency, use spin lock to protect the update of @last_physical, just like all the remaining call sites touching sctx->stat. Reported-by: Michel Palleau Link: https://lore.kernel.org/linux-btrfs/CAMFk-+igFTv2E8svg=cQ6o3e6CrR5QwgQ3Ok9EyRaEvvthpqCQ@mail.gmail.com/ Reviewed-by: Johannes Thumshirn Signed-off-by: Qu Wenruo Reviewed-by: David Sterba Signed-off-by: David Sterba fs/btrfs/scrub.c | 9 +++++++++ 1 file changed, 9 insertions(+) commit 33eb1e5db351e2c0e652d878b66b8a6d4d013135 Author: Qu Wenruo Date: Fri Mar 8 13:40:30 2024 +1030 btrfs: factor out stripe length calculation into a helper Currently there are two locations which need to calculate the real length of a stripe (which can be at the end of a chunk, and the chunk size may not always be 64K aligned). Factor them into a helper as we're going to have a third user soon. Reviewed-by: Johannes Thumshirn Signed-off-by: Qu Wenruo Reviewed-by: David Sterba Signed-off-by: David Sterba fs/btrfs/scrub.c | 16 ++++++++++------ 1 file changed, 10 insertions(+), 6 deletions(-) commit f126745da81783fb1d082e67bf14c6795e489a88 Author: Alice Ryhl Date: Mon Jul 29 14:22:49 2024 +0000 rust: SHADOW_CALL_STACK is incompatible with Rust When using the shadow call stack sanitizer, all code must be compiled with the -ffixed-x18 flag, but this flag is not currently being passed to Rust. This results in crashes that are extremely difficult to debug. To ensure that nobody else has to go through the same debugging session that I had to, prevent configurations that enable both SHADOW_CALL_STACK and RUST. It is rather common for people to backport 724a75ac9542 ("arm64: rust: Enable Rust support for AArch64"), so I recommend applying this fix all the way back to 6.1. Cc: stable@vger.kernel.org # 6.1 and later Fixes: 724a75ac9542 ("arm64: rust: Enable Rust support for AArch64") Signed-off-by: Alice Ryhl Acked-by: Miguel Ojeda Link: https://lore.kernel.org/r/20240729-shadow-call-stack-v4-1-2a664b082ea4@google.com Signed-off-by: Catalin Marinas init/Kconfig | 1 + 1 file changed, 1 insertion(+) commit adeec61a4723fd3e39da68db4cc4d924e6d7f641 Author: Mark Rutland Date: Thu Aug 1 11:18:03 2024 +0100 arm64: errata: Expand speculative SSBS workaround (again) A number of Arm Ltd CPUs suffer from errata whereby an MSR to the SSBS special-purpose register does not affect subsequent speculative instructions, permitting speculative store bypassing for a window of time. We worked around this for a number of CPUs in commits: * 7187bb7d0b5c7dfa ("arm64: errata: Add workaround for Arm errata 3194386 and 3312417") * 75b3c43eab594bfb ("arm64: errata: Expand speculative SSBS workaround") Since then, similar errata have been published for a number of other Arm Ltd CPUs, for which the same mitigation is sufficient. This is described in their respective Software Developer Errata Notice (SDEN) documents: * Cortex-A76 (MP052) SDEN v31.0, erratum 3324349 https://developer.arm.com/documentation/SDEN-885749/3100/ * Cortex-A77 (MP074) SDEN v19.0, erratum 3324348 https://developer.arm.com/documentation/SDEN-1152370/1900/ * Cortex-A78 (MP102) SDEN v21.0, erratum 3324344 https://developer.arm.com/documentation/SDEN-1401784/2100/ * Cortex-A78C (MP138) SDEN v16.0, erratum 3324346 https://developer.arm.com/documentation/SDEN-1707916/1600/ * Cortex-A78C (MP154) SDEN v10.0, erratum 3324347 https://developer.arm.com/documentation/SDEN-2004089/1000/ * Cortex-A725 (MP190) SDEN v5.0, erratum 3456106 https://developer.arm.com/documentation/SDEN-2832921/0500/ * Cortex-X1 (MP077) SDEN v21.0, erratum 3324344 https://developer.arm.com/documentation/SDEN-1401782/2100/ * Cortex-X1C (MP136) SDEN v16.0, erratum 3324346 https://developer.arm.com/documentation/SDEN-1707914/1600/ * Neoverse-N1 (MP050) SDEN v32.0, erratum 3324349 https://developer.arm.com/documentation/SDEN-885747/3200/ * Neoverse-V1 (MP076) SDEN v19.0, erratum 3324341 https://developer.arm.com/documentation/SDEN-1401781/1900/ Note that due to the manner in which Arm develops IP and tracks errata, some CPUs share a common erratum number and some CPUs have multiple erratum numbers for the same HW issue. On parts without SB, it is necessary to use ISB for the workaround. The spec_bar() macro used in the mitigation will expand to a "DSB SY; ISB" sequence in this case, which is sufficient on all affected parts. Enable the existing mitigation by adding the relevant MIDRs to erratum_spec_ssbs_list. The list is sorted alphanumerically (involving moving Neoverse-V3 after Neoverse-V2) so that this is easy to audit and potentially extend again in future. The Kconfig text is also updated to clarify the set of affected parts and the mitigation. Signed-off-by: Mark Rutland Cc: James Morse Cc: Will Deacon Reviewed-by: Anshuman Khandual Acked-by: Will Deacon Link: https://lore.kernel.org/r/20240801101803.1982459-4-mark.rutland@arm.com Signed-off-by: Catalin Marinas Documentation/arch/arm64/silicon-errata.rst | 18 ++++++++++++++++++ arch/arm64/Kconfig | 22 ++++++++++++++++------ arch/arm64/kernel/cpu_errata.c | 11 ++++++++++- 3 files changed, 44 insertions(+), 7 deletions(-) commit 9ef54a384526911095db465e77acc1cb5266b32c Author: Mark Rutland Date: Thu Aug 1 11:18:02 2024 +0100 arm64: cputype: Add Cortex-A725 definitions Add cputype definitions for Cortex-A725. These will be used for errata detection in subsequent patches. These values can be found in the Cortex-A725 TRM: https://developer.arm.com/documentation/107652/0001/ ... in table A-247 ("MIDR_EL1 bit descriptions"). Signed-off-by: Mark Rutland Cc: James Morse Cc: Will Deacon Reviewed-by: Anshuman Khandual Link: https://lore.kernel.org/r/20240801101803.1982459-3-mark.rutland@arm.com Signed-off-by: Catalin Marinas arch/arm64/include/asm/cputype.h | 2 ++ 1 file changed, 2 insertions(+) commit 58d245e03c324d083a0ec3b9ab8ebd46ec9848d7 Author: Mark Rutland Date: Thu Aug 1 11:18:01 2024 +0100 arm64: cputype: Add Cortex-X1C definitions Add cputype definitions for Cortex-X1C. These will be used for errata detection in subsequent patches. These values can be found in the Cortex-X1C TRM: https://developer.arm.com/documentation/101968/0002/ ... in section B2.107 ("MIDR_EL1, Main ID Register, EL1"). Signed-off-by: Mark Rutland Cc: James Morse Cc: Will Deacon Reviewed-by: Anshuman Khandual Link: https://lore.kernel.org/r/20240801101803.1982459-2-mark.rutland@arm.com Signed-off-by: Catalin Marinas arch/arm64/include/asm/cputype.h | 2 ++ 1 file changed, 2 insertions(+) commit 3908ba2e0b2476e2ec13e15967bf6a37e449f2af Author: Nick Hu Date: Wed Jul 17 11:17:14 2024 +0800 RISC-V: Enable the IPI before workqueue_online_cpu() Sometimes the hotplug cpu stalls at the arch_cpu_idle() for a while after workqueue_online_cpu(). When cpu stalls at the idle loop, the reschedule IPI is pending. However the enable bit is not enabled yet so the cpu stalls at WFI until watchdog timeout. Therefore enable the IPI before the workqueue_online_cpu() to fix the issue. Fixes: 63c5484e7495 ("workqueue: Add multiple affinity scopes and interface to select them") Signed-off-by: Nick Hu Reviewed-by: Anup Patel Link: https://lore.kernel.org/r/20240717031714.1946036-1-nick.hu@sifive.com Signed-off-by: Palmer Dabbelt arch/riscv/kernel/sbi-ipi.c | 2 +- include/linux/cpuhotplug.h | 1 + 2 files changed, 2 insertions(+), 1 deletion(-) commit 0c710050c47d45eb77b28c271cddefc5c785cb40 Author: Zhe Qiao Date: Wed Jul 31 16:45:47 2024 +0800 riscv/mm: Add handling for VM_FAULT_SIGSEGV in mm_fault_error() Handle VM_FAULT_SIGSEGV in the page fault path so that we correctly kill the process and we don't BUG() the kernel. Fixes: 07037db5d479 ("RISC-V: Paging and MMU") Signed-off-by: Zhe Qiao Reviewed-by: Alexandre Ghiti Link: https://lore.kernel.org/r/20240731084547.85380-1-qiaozhe@iscas.ac.cn Signed-off-by: Palmer Dabbelt arch/riscv/mm/fault.c | 17 +++++++++-------- 1 file changed, 9 insertions(+), 8 deletions(-) commit 941a8e9b7a86763ac52d5bf6ccc9986d37fde628 Author: Shifrin Dmitry Date: Mon Jul 29 15:58:58 2024 +0300 perf: riscv: Fix selecting counters in legacy mode It is required to check event type before checking event config. Events with the different types can have the same config. This check is missed for legacy mode code For such perf usage: sysctl -w kernel.perf_user_access=2 perf stat -e cycles,L1-dcache-loads -- driver will try to force both events to CYCLE counter. This commit implements event type check before forcing events on the special counters. Signed-off-by: Shifrin Dmitry Reviewed-by: Atish Patra Fixes: cc4c07c89aad ("drivers: perf: Implement perf event mmap support in the SBI backend") Link: https://lore.kernel.org/r/20240729125858.630653-1-dmitry.shifrin@syntacore.com Signed-off-by: Palmer Dabbelt drivers/perf/riscv_pmu_sbi.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 57e5c814e91577a464484cc4b1a56ff86371a713 Author: Palmer Dabbelt Date: Mon Jul 22 08:45:20 2024 -0700 cache: StarFive: Require a 64-bit system This has a bunch of {read,write}q() calls, so it won't work on 32-bit systems. I don't think there's any 32-bit StarFive systems, so for now just require 64-bit. Fixes: cabff60ca77d ("cache: Add StarFive StarLink cache management") Acked-by: Conor Dooley Reviewed-by: Emil Renner Berthing Link: https://lore.kernel.org/r/20240722154519.25375-2-palmer@rivosinc.com Signed-off-by: Palmer Dabbelt drivers/cache/Kconfig | 1 + 1 file changed, 1 insertion(+) commit 63ba5b0fb4f54db256ec43b3062b2606b383055d Author: Eric Lin Date: Fri Jul 19 19:50:18 2024 +0800 perf arch events: Fix duplicate RISC-V SBI firmware event name Currently, the RISC-V firmware JSON file has duplicate event name "FW_SFENCE_VMA_RECEIVED". According to the RISC-V SBI PMU extension[1], the event name should be "FW_SFENCE_VMA_ASID_SENT". Before this patch: $ perf list firmware: fw_access_load [Load access trap event. Unit: cpu] fw_access_store [Store access trap event. Unit: cpu] .... fw_set_timer [Set timer event. Unit: cpu] fw_sfence_vma_asid_received [Received SFENCE.VMA with ASID request from other HART event. Unit: cpu] fw_sfence_vma_received [Sent SFENCE.VMA with ASID request to other HART event. Unit: cpu] After this patch: $ perf list firmware: fw_access_load [Load access trap event. Unit: cpu] fw_access_store [Store access trap event. Unit: cpu] ..... fw_set_timer [Set timer event. Unit: cpu] fw_sfence_vma_asid_received [Received SFENCE.VMA with ASID request from other HART event. Unit: cpu] fw_sfence_vma_asid_sent [Sent SFENCE.VMA with ASID request to other HART event. Unit: cpu] fw_sfence_vma_received [Received SFENCE.VMA request from other HART event. Unit: cpu] Link: https://github.com/riscv-non-isa/riscv-sbi-doc/blob/master/src/ext-pmu.adoc#event-firmware-events-type-15 [1] Fixes: 8f0dcb4e7364 ("perf arch events: riscv sbi firmware std event files") Fixes: c4f769d4093d ("perf vendor events riscv: add Sifive U74 JSON file") Fixes: acbf6de674ef ("perf vendor events riscv: Add StarFive Dubhe-80 JSON file") Fixes: 7340c6df49df ("perf vendor events riscv: add T-HEAD C9xx JSON file") Fixes: f5102e31c209 ("riscv: andes: Support specifying symbolic firmware and hardware raw event") Signed-off-by: Eric Lin Reviewed-by: Samuel Holland Reviewed-by: Nikita Shubin Reviewed-by: Inochi Amaoto Reviewed-by: Andrew Jones Reviewed-by: Atish Patra Link: https://lore.kernel.org/r/20240719115018.27356-1-eric.lin@sifive.com Signed-off-by: Palmer Dabbelt tools/perf/pmu-events/arch/riscv/andes/ax45/firmware.json | 2 +- tools/perf/pmu-events/arch/riscv/riscv-sbi-firmware.json | 2 +- tools/perf/pmu-events/arch/riscv/sifive/u74/firmware.json | 2 +- tools/perf/pmu-events/arch/riscv/starfive/dubhe-80/firmware.json | 2 +- tools/perf/pmu-events/arch/riscv/thead/c900-legacy/firmware.json | 2 +- 5 files changed, 5 insertions(+), 5 deletions(-) commit fb197c5d2fd24b9af3d4697d0cf778645846d6d5 Author: Daniel Maslowski Date: Fri Jul 19 19:04:37 2024 +0200 riscv/purgatory: align riscv_kernel_entry When alignment handling is delegated to the kernel, everything must be word-aligned in purgatory, since the trap handler is then set to the kexec one. Without the alignment, hitting the exception would ultimately crash. On other occasions, the kernel's handler would take care of exceptions. This has been tested on a JH7110 SoC with oreboot and its SBI delegating unaligned access exceptions and the kernel configured to handle them. Fixes: 736e30af583fb ("RISC-V: Add purgatory") Signed-off-by: Daniel Maslowski Reviewed-by: Alexandre Ghiti Link: https://lore.kernel.org/r/20240719170437.247457-1-cyrevolt@gmail.com Signed-off-by: Palmer Dabbelt arch/riscv/purgatory/entry.S | 2 ++ 1 file changed, 2 insertions(+) commit b07ce24df7fee54189a7bca583bcda81a5448198 Author: Arnd Bergmann Date: Mon Jul 29 23:44:59 2024 +0200 alpha: fix ioread64be()/iowrite64be() helpers Compile-testing the crypto/caam driver on alpha showed a pre-existing problem on alpha with iowrite64be() missing: ERROR: modpost: "iowrite64be" [drivers/crypto/caam/caam_jr.ko] undefined! The prototypes were added a while ago when we started using asm-generic/io.h, but the implementation was still missing. At some point the ioread64/iowrite64 helpers were added, but the big-endian versions are still missing, and the generic version (using readq/writeq) is would not work here. Change it to wrap ioread64()/iowrite64() instead. Fixes: beba3771d9e0 ("crypto: caam: Make CRYPTO_DEV_FSL_CAAM dependent of COMPILE_TEST") Fixes: e19d4ebc536d ("alpha: add full ioread64/iowrite64 implementation") Fixes: 7e772dad9913 ("alpha: Use generic ") Closes: https://lore.kernel.org/all/CAHk-=wgEyzSxTs467NDOVfBSzWvUS6ztcwhiy=M3xog==KBmTw@mail.gmail.com/ Tested-by: Guenter Roeck Reviewed-by: Linus Walleij Signed-off-by: Arnd Bergmann arch/alpha/include/asm/io.h | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) commit 3db03fb4995ef85fc41e86262ead7b4852f4bcf0 Author: Peter Zijlstra Date: Thu Aug 1 12:42:25 2024 +0200 x86/mm: Fix pti_clone_entry_text() for i386 While x86_64 has PMD aligned text sections, i386 does not have this luxery. Notably ALIGN_ENTRY_TEXT_END is empty and _etext has PAGE alignment. This means that text on i386 can be page granular at the tail end, which in turn means that the PTI text clones should consistently account for this. Make pti_clone_entry_text() consistent with pti_clone_kernel_text(). Fixes: 16a3fe634f6a ("x86/mm/pti: Clone kernel-image on PTE level for 32 bit") Signed-off-by: Peter Zijlstra (Intel) arch/x86/mm/pti.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 41e71dbb0e0a0fe214545fe64af031303a08524c Author: Peter Zijlstra Date: Wed Jul 31 18:31:05 2024 +0200 x86/mm: Fix pti_clone_pgtable() alignment assumption Guenter reported dodgy crashes on an i386-nosmp build using GCC-11 that had the form of endless traps until entry stack exhaust and then #DF from the stack guard. It turned out that pti_clone_pgtable() had alignment assumptions on the start address, notably it hard assumes start is PMD aligned. This is true on x86_64, but very much not true on i386. These assumptions can cause the end condition to malfunction, leading to a 'short' clone. Guess what happens when the user mapping has a short copy of the entry text? Use the correct increment form for addr to avoid alignment assumptions. Fixes: 16a3fe634f6a ("x86/mm/pti: Clone kernel-image on PTE level for 32 bit") Reported-by: Guenter Roeck Tested-by: Guenter Roeck Suggested-by: Thomas Gleixner Signed-off-by: Peter Zijlstra (Intel) Link: https://lkml.kernel.org/r/20240731163105.GG33588@noisy.programming.kicks-ass.net arch/x86/mm/pti.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) commit 7354eb7f1558466e92e926802d36e69e42938ea9 Author: Curtis Malainey Date: Wed Jul 31 14:21:44 2024 -0700 ASoC: SOF: Remove libraries from topology lookups Default firmware shipped in open source are not licensed for 3P libraries, therefore topologies should not reference them. If a OS wants to use 3P (that they have licensed) then they should use the appropriate topology override mechanisms. Fixes: 8a7d5d85ed2161 ("ASoC: SOF: mediatek: mt8195: Add devicetree support to select topologies") Signed-off-by: Curtis Malainey Cc: Wojciech Macek Reviewed-by: AngeloGioacchino Del Regno Link: https://patch.msgid.link/20240731212153.921327-1-cujomalainey@chromium.org Signed-off-by: Mark Brown sound/soc/sof/mediatek/mt8195/mt8195.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 31634d7597d8c57894b6c98eeefc9e58cf842993 Author: Xiubo Li Date: Fri Jul 12 12:40:19 2024 +0800 ceph: force sending a cap update msg back to MDS for revoke op If a client sends out a cap update dropping caps with the prior 'seq' just before an incoming cap revoke request, then the client may drop the revoke because it believes it's already released the requested capabilities. This causes the MDS to wait indefinitely for the client to respond to the revoke. It's therefore always a good idea to ack the cap revoke request with the bumped up 'seq'. Currently if the cap->issued equals to the newcaps the check_caps() will do nothing, we should force flush the caps. Cc: stable@vger.kernel.org Link: https://tracker.ceph.com/issues/61782 Signed-off-by: Xiubo Li Reviewed-by: Venky Shankar Signed-off-by: Ilya Dryomov fs/ceph/caps.c | 35 ++++++++++++++++++++++++----------- fs/ceph/super.h | 7 ++++--- 2 files changed, 28 insertions(+), 14 deletions(-) commit a6e9c391d45b5865b61e569146304cff72821a5d Author: Camila Alvarez Date: Tue Jul 30 19:42:43 2024 -0400 HID: cougar: fix slab-out-of-bounds Read in cougar_report_fixup report_fixup for the Cougar 500k Gaming Keyboard was not verifying that the report descriptor size was correct before accessing it Reported-by: syzbot+24c0361074799d02c452@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=24c0361074799d02c452 Signed-off-by: Camila Alvarez Reviewed-by: Silvan Jegen Signed-off-by: Jiri Kosina drivers/hid/hid-cougar.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 9374ae912dbb1eed8139ed75fd2c0f1b30ca454d Author: Mengqi Zhang Date: Tue Jul 16 09:37:04 2024 +0800 mmc: mtk-sd: receive cmd8 data when hs400 tuning fail When we use cmd8 as the tuning command in hs400 mode, the command response sent back by some eMMC devices cannot be correctly sampled by MTK eMMC controller at some weak sample timing. In this case, command timeout error may occur. So we must receive the following data to make sure the next cmd8 send correctly. Signed-off-by: Mengqi Zhang Fixes: c4ac38c6539b ("mmc: mtk-sd: Add HS400 online tuning support") Cc: stable@vger.stable.com Link: https://lore.kernel.org/r/20240716013704.10578-1-mengqi.zhang@mediatek.com Signed-off-by: Ulf Hansson drivers/mmc/host/mtk-sd.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) commit 25010bfdf8bbedc64c5c04d18f846412f5367d26 Merge: 2b4a32daa6de 68cc924729ff Author: Paolo Abeni Date: Thu Aug 1 12:30:15 2024 +0200 Merge branch 'mptcp-fix-duplicate-data-handling' Matthieu Baerts says: ==================== mptcp: fix duplicate data handling In some cases, the subflow-level's copied_seq counter was incorrectly increased, leading to an unexpected subflow reset. Patch 1/2 fixes the RCVPRUNED MIB counter that was attached to the wrong event since its introduction in v5.14, backported to v5.11. Patch 2/2 fixes the copied_seq counter issues, is present since v5.10. Signed-off-by: Matthieu Baerts (NGI0) ==================== Link: https://patch.msgid.link/20240731-upstream-net-20240731-mptcp-dup-data-v1-0-bde833fa628a@kernel.org Signed-off-by: Paolo Abeni commit 68cc924729ffcfe90d0383177192030a9aeb2ee4 Author: Paolo Abeni Date: Wed Jul 31 12:10:15 2024 +0200 mptcp: fix duplicate data handling When a subflow receives and discards duplicate data, the mptcp stack assumes that the consumed offset inside the current skb is zero. With multiple subflows receiving data simultaneously such assertion does not held true. As a result the subflow-level copied_seq will be incorrectly increased and later on the same subflow will observe a bad mapping, leading to subflow reset. Address the issue taking into account the skb consumed offset in mptcp_subflow_discard_data(). Fixes: 04e4cd4f7ca4 ("mptcp: cleanup mptcp_subflow_discard_data()") Cc: stable@vger.kernel.org Link: https://github.com/multipath-tcp/mptcp_net-next/issues/501 Signed-off-by: Paolo Abeni Reviewed-by: Mat Martineau Signed-off-by: Matthieu Baerts (NGI0) Signed-off-by: Paolo Abeni net/mptcp/subflow.c | 16 ++++++++++++---- 1 file changed, 12 insertions(+), 4 deletions(-) commit 0a567c2a10033bf04ed618368d179bce6977984b Author: Paolo Abeni Date: Wed Jul 31 12:10:14 2024 +0200 mptcp: fix bad RCVPRUNED mib accounting Since its introduction, the mentioned MIB accounted for the wrong event: wake-up being skipped as not-needed on some edge condition instead of incoming skb being dropped after landing in the (subflow) receive queue. Move the increment in the correct location. Fixes: ce599c516386 ("mptcp: properly account bulk freed memory") Cc: stable@vger.kernel.org Signed-off-by: Paolo Abeni Reviewed-by: Mat Martineau Signed-off-by: Matthieu Baerts (NGI0) Signed-off-by: Paolo Abeni net/mptcp/protocol.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) commit 2b4a32daa6de7ff4c978c07878880ab2bb475932 Merge: a46c68debf3b c22921df777d Author: Paolo Abeni Date: Thu Aug 1 12:08:28 2024 +0200 Merge tag 'nf-24-07-31' of git://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf Pablo Neira Ayuso says: ==================== Netfilter fixes for net The following patchset contains Netfilter fixes for net: Fix a possible null-ptr-deref sometimes triggered by iptables-restore at boot time. Register iptables {ipv4,ipv6} nat table pernet in first place to fix this issue. Patch #1 and #2 from Kuniyuki Iwashima. netfilter pull request 24-07-31 * tag 'nf-24-07-31' of git://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf: netfilter: iptables: Fix potential null-ptr-deref in ip6table_nat_table_init(). netfilter: iptables: Fix null-ptr-deref in iptable_nat_table_init(). ==================== Link: https://patch.msgid.link/20240731213046.6194-1-pablo@netfilter.org Signed-off-by: Paolo Abeni commit a46c68debf3be3a477a69ccbf0a1d050df841676 Author: Maciej Żenczykowski Date: Mon Jul 29 17:17:48 2024 -0700 ipv6: fix ndisc_is_useropt() handling for PIO The current logic only works if the PIO is between two other ND user options. This fixes it so that the PIO can also be either before or after other ND user options (for example the first or last option in the RA). side note: there's actually Android tests verifying a portion of the old broken behaviour, so: https://android-review.googlesource.com/c/kernel/tests/+/3196704 fixes those up. Cc: Jen Linkova Cc: Lorenzo Colitti Cc: Patrick Rohr Cc: David Ahern Cc: YOSHIFUJI Hideaki / 吉藤英明 Cc: Jakub Kicinski Signed-off-by: Maciej Żenczykowski Fixes: 048c796beb6e ("ipv6: adjust ndisc_is_useropt() to also return true for PIO") Link: https://patch.msgid.link/20240730001748.147636-1-maze@google.com Signed-off-by: Paolo Abeni net/ipv6/ndisc.c | 34 ++++++++++++++++++---------------- 1 file changed, 18 insertions(+), 16 deletions(-) commit f4973130d255dd4811006f5822d4fa4d0de9d712 Author: Satya Priya Kakitapalli Date: Wed Jul 31 11:59:12 2024 +0530 clk: qcom: clk-alpha-pll: Update set_rate for Zonda PLL The Zonda PLL has a 16 bit signed alpha and in the cases where the alpha value is greater than 0.5, the L value needs to be adjusted accordingly. Thus update the logic to handle the signed alpha val. Fixes: f21b6bfecc27 ("clk: qcom: clk-alpha-pll: add support for zonda pll") Cc: stable@vger.kernel.org Signed-off-by: Satya Priya Kakitapalli Reviewed-by: Dmitry Baryshkov Link: https://lore.kernel.org/r/20240731062916.2680823-5-quic_skakitap@quicinc.com Signed-off-by: Bjorn Andersson drivers/clk/qcom/clk-alpha-pll.c | 16 ++++++++++++++++ 1 file changed, 16 insertions(+) commit 85e8ee59dfde1a7b847fbed0778391392cd985cb Author: Satya Priya Kakitapalli Date: Wed Jul 31 11:59:11 2024 +0530 clk: qcom: clk-alpha-pll: Fix zonda set_rate failure when PLL is disabled Currently, clk_zonda_pll_set_rate polls for the PLL to lock even if the PLL is disabled. However, if the PLL is disabled then LOCK_DET will never assert and we'll return an error. There is no reason to poll LOCK_DET if the PLL is already disabled, so skip polling in this case. Fixes: f21b6bfecc27 ("clk: qcom: clk-alpha-pll: add support for zonda pll") Cc: stable@vger.kernel.org Signed-off-by: Satya Priya Kakitapalli Reviewed-by: Dmitry Baryshkov Link: https://lore.kernel.org/r/20240731062916.2680823-4-quic_skakitap@quicinc.com Signed-off-by: Bjorn Andersson drivers/clk/qcom/clk-alpha-pll.c | 3 +++ 1 file changed, 3 insertions(+) commit 4ad1ed6ef27cab94888bb3c740c14042d5c0dff2 Author: Satya Priya Kakitapalli Date: Wed Jul 31 11:59:10 2024 +0530 clk: qcom: clk-alpha-pll: Fix the trion pll postdiv set rate API Correct the pll postdiv shift used in clk_trion_pll_postdiv_set_rate API. The shift value is not same for different types of plls and should be taken from the pll's .post_div_shift member. Fixes: 548a909597d5 ("clk: qcom: clk-alpha-pll: Add support for Trion PLLs") Cc: stable@vger.kernel.org Signed-off-by: Satya Priya Kakitapalli Reviewed-by: Dmitry Baryshkov Link: https://lore.kernel.org/r/20240731062916.2680823-3-quic_skakitap@quicinc.com Signed-off-by: Bjorn Andersson drivers/clk/qcom/clk-alpha-pll.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) commit 2c4553e6c485a96b5d86989eb9654bf20e51e6dd Author: Satya Priya Kakitapalli Date: Wed Jul 31 11:59:09 2024 +0530 clk: qcom: clk-alpha-pll: Fix the pll post div mask The PLL_POST_DIV_MASK should be 0 to (width - 1) bits. Fix it. Fixes: 1c3541145cbf ("clk: qcom: support for 2 bit PLL post divider") Cc: stable@vger.kernel.org Reviewed-by: Konrad Dybcio Signed-off-by: Satya Priya Kakitapalli Link: https://lore.kernel.org/r/20240731062916.2680823-2-quic_skakitap@quicinc.com Signed-off-by: Bjorn Andersson drivers/clk/qcom/clk-alpha-pll.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit b9e7fc0aeda79031a101610b2fcb12bf031056e9 Author: Faizal Rahim Date: Tue Jul 30 10:33:02 2024 -0700 igc: Fix double reset adapter triggered from a single taprio cmd Following the implementation of "igc: Add TransmissionOverrun counter" patch, when a taprio command is triggered by user, igc processes two commands: TAPRIO_CMD_REPLACE followed by TAPRIO_CMD_STATS. However, both commands unconditionally pass through igc_tsn_offload_apply() which evaluates and triggers reset adapter. The double reset causes issues in the calculation of adapter->qbv_count in igc. TAPRIO_CMD_REPLACE command is expected to reset the adapter since it activates qbv. It's unexpected for TAPRIO_CMD_STATS to do the same because it doesn't configure any driver-specific TSN settings. So, the evaluation in igc_tsn_offload_apply() isn't needed for TAPRIO_CMD_STATS. To address this, commands parsing are relocated to igc_tsn_enable_qbv_scheduling(). Commands that don't require an adapter reset will exit after processing, thus avoiding igc_tsn_offload_apply(). Fixes: d3750076d464 ("igc: Add TransmissionOverrun counter") Signed-off-by: Faizal Rahim Acked-by: Vinicius Costa Gomes Reviewed-by: Vladimir Oltean Tested-by: Mor Bar-Gabay Signed-off-by: Tony Nguyen Link: https://patch.msgid.link/20240730173304.865479-1-anthony.l.nguyen@intel.com Signed-off-by: Jakub Kicinski drivers/net/ethernet/intel/igc/igc_main.c | 33 ++++++++++++++++--------------- 1 file changed, 17 insertions(+), 16 deletions(-) commit 4efce726e0cbc723178eea5b944e13775f628ecc Author: Krzysztof Kozlowski Date: Tue Jul 30 12:40:16 2024 +0200 net: MAINTAINERS: Demote Qualcomm IPA to "maintained" To the best of my knowledge, Alex Elder is not being paid to support Qualcomm IPA networking drivers, so drop the status from "supported" to "maintained". Signed-off-by: Krzysztof Kozlowski Acked-by: Alex Elder Link: https://patch.msgid.link/20240730104016.22103-1-krzysztof.kozlowski@linaro.org Signed-off-by: Jakub Kicinski MAINTAINERS | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit e549360069b4a57e111b8222fc072f3c7c1688ab Author: Herve Codina Date: Tue Jul 30 08:31:33 2024 +0200 net: wan: fsl_qmc_hdlc: Discard received CRC Received frame from QMC contains the CRC. Upper layers don't need this CRC and tcpdump mentioned trailing junk data due to this CRC presence. As some other HDLC driver, simply discard this CRC. Fixes: d0f2258e79fd ("net: wan: Add support for QMC HDLC") Cc: stable@vger.kernel.org Signed-off-by: Herve Codina Reviewed-by: Simon Horman Link: https://patch.msgid.link/20240730063133.179598-1-herve.codina@bootlin.com Signed-off-by: Jakub Kicinski drivers/net/wan/fsl_qmc_hdlc.c | 24 ++++++++++++++++++------ 1 file changed, 18 insertions(+), 6 deletions(-) commit c4d6a347ba7babdf9d90a0eb24048c266cae0532 Author: Herve Codina Date: Tue Jul 30 08:31:04 2024 +0200 net: wan: fsl_qmc_hdlc: Convert carrier_lock spinlock to a mutex The carrier_lock spinlock protects the carrier detection. While it is held, framer_get_status() is called which in turn takes a mutex. This is not correct and can lead to a deadlock. A run with PROVE_LOCKING enabled detected the issue: [ BUG: Invalid wait context ] ... c204ddbc (&framer->mutex){+.+.}-{3:3}, at: framer_get_status+0x40/0x78 other info that might help us debug this: context-{4:4} 2 locks held by ifconfig/146: #0: c0926a38 (rtnl_mutex){+.+.}-{3:3}, at: devinet_ioctl+0x12c/0x664 #1: c2006a40 (&qmc_hdlc->carrier_lock){....}-{2:2}, at: qmc_hdlc_framer_set_carrier+0x30/0x98 Avoid the spinlock usage and convert carrier_lock to a mutex. Fixes: 54762918ca85 ("net: wan: fsl_qmc_hdlc: Add framer support") Cc: stable@vger.kernel.org Signed-off-by: Herve Codina Reviewed-by: Simon Horman Link: https://patch.msgid.link/20240730063104.179553-1-herve.codina@bootlin.com Signed-off-by: Jakub Kicinski drivers/net/wan/fsl_qmc_hdlc.c | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) commit fe16667f2959ec89488a872efbd9782bed250d10 Merge: 8f73ef829858 3f8e82a020a5 Author: Jakub Kicinski Date: Wed Jul 31 18:04:53 2024 -0700 Merge branch 'mlx5-misc-fixes-2024-07-30' Tariq Toukan says: ==================== mlx5 misc fixes 2024-07-30 This patchset provides misc bug fixes from the team to the mlx5 core and Eth drivers. ==================== Link: https://patch.msgid.link/20240730061638.1831002-1-tariqt@nvidia.com Signed-off-by: Jakub Kicinski commit 3f8e82a020a5c22f9b791f4ac499b8e18007fbda Author: Shahar Shitrit Date: Tue Jul 30 09:16:37 2024 +0300 net/mlx5e: Add a check for the return value from mlx5_port_set_eth_ptys Since the documentation for mlx5_toggle_port_link states that it should only be used after setting the port register, we add a check for the return value from mlx5_port_set_eth_ptys to ensure the register was successfully set before calling it. Fixes: 667daedaecd1 ("net/mlx5e: Toggle link only after modifying port parameters") Signed-off-by: Shahar Shitrit Reviewed-by: Carolina Jubran Signed-off-by: Tariq Toukan Reviewed-by: Wojciech Drewek Link: https://patch.msgid.link/20240730061638.1831002-9-tariqt@nvidia.com Signed-off-by: Jakub Kicinski drivers/net/ethernet/mellanox/mlx5/core/en_ethtool.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) commit 025f2b85a5e5a46df14ecf162c3c80a957a36d0b Author: Chris Mi Date: Tue Jul 30 09:16:36 2024 +0300 net/mlx5e: Fix CT entry update leaks of modify header context The cited commit allocates a new modify header to replace the old one when updating CT entry. But if failed to allocate a new one, eg. exceed the max number firmware can support, modify header will be an error pointer that will trigger a panic when deallocating it. And the old modify header point is copied to old attr. When the old attr is freed, the old modify header is lost. Fix it by restoring the old attr to attr when failed to allocate a new modify header context. So when the CT entry is freed, the right modify header context will be freed. And the panic of accessing error pointer is also fixed. Fixes: 94ceffb48eac ("net/mlx5e: Implement CT entry update") Signed-off-by: Chris Mi Signed-off-by: Tariq Toukan Reviewed-by: Wojciech Drewek Link: https://patch.msgid.link/20240730061638.1831002-8-tariqt@nvidia.com Signed-off-by: Jakub Kicinski drivers/net/ethernet/mellanox/mlx5/core/en/tc_ct.c | 1 + 1 file changed, 1 insertion(+) commit 06827e27fdcd197557be72b2229dbd362303794f Author: Rahul Rameshbabu Date: Tue Jul 30 09:16:35 2024 +0300 net/mlx5e: Require mlx5 tc classifier action support for IPsec prio capability Require mlx5 classifier action support when creating IPSec chains in offload path. MLX5_IPSEC_CAP_PRIO should only be set if CONFIG_MLX5_CLS_ACT is enabled. If CONFIG_MLX5_CLS_ACT=n and MLX5_IPSEC_CAP_PRIO is set, configuring IPsec offload will fail due to the mlxx5 ipsec chain rules failing to be created due to lack of classifier action support. Fixes: fa5aa2f89073 ("net/mlx5e: Use chains for IPsec policy priority offload") Signed-off-by: Rahul Rameshbabu Reviewed-by: Leon Romanovsky Signed-off-by: Tariq Toukan Reviewed-by: Wojciech Drewek Link: https://patch.msgid.link/20240730061638.1831002-7-tariqt@nvidia.com Signed-off-by: Jakub Kicinski drivers/net/ethernet/mellanox/mlx5/core/en_accel/ipsec_offload.c | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) commit 572f9caa9e7295f8c8822e4122c7ae8f1c412ff9 Author: Moshe Shemesh Date: Tue Jul 30 09:16:34 2024 +0300 net/mlx5: Fix missing lock on sync reset reload On sync reset reload work, when remote host updates devlink on reload actions performed on that host, it misses taking devlink lock before calling devlink_remote_reload_actions_performed() which results in triggering lock assert like the following: WARNING: CPU: 4 PID: 1164 at net/devlink/core.c:261 devl_assert_locked+0x3e/0x50 … CPU: 4 PID: 1164 Comm: kworker/u96:6 Tainted: G S W 6.10.0-rc2+ #116 Hardware name: Supermicro SYS-2028TP-DECTR/X10DRT-PT, BIOS 2.0 12/18/2015 Workqueue: mlx5_fw_reset_events mlx5_sync_reset_reload_work [mlx5_core] RIP: 0010:devl_assert_locked+0x3e/0x50 … Call Trace: ? __warn+0xa4/0x210 ? devl_assert_locked+0x3e/0x50 ? report_bug+0x160/0x280 ? handle_bug+0x3f/0x80 ? exc_invalid_op+0x17/0x40 ? asm_exc_invalid_op+0x1a/0x20 ? devl_assert_locked+0x3e/0x50 devlink_notify+0x88/0x2b0 ? mlx5_attach_device+0x20c/0x230 [mlx5_core] ? __pfx_devlink_notify+0x10/0x10 ? process_one_work+0x4b6/0xbb0 process_one_work+0x4b6/0xbb0 […] Fixes: 84a433a40d0e ("net/mlx5: Lock mlx5 devlink reload callbacks") Signed-off-by: Moshe Shemesh Reviewed-by: Maor Gottlieb Signed-off-by: Tariq Toukan Reviewed-by: Wojciech Drewek Link: https://patch.msgid.link/20240730061638.1831002-6-tariqt@nvidia.com Signed-off-by: Jakub Kicinski drivers/net/ethernet/mellanox/mlx5/core/fw_reset.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) commit 3fda84dc090390573cfbd0b1d70372663315de21 Author: Mark Bloch Date: Tue Jul 30 09:16:33 2024 +0300 net/mlx5: Lag, don't use the hardcoded value of the first port The cited commit didn't change the body of the loop as it should. It shouldn't be using MLX5_LAG_P1. Fixes: 7e978e7714d6 ("net/mlx5: Lag, use actual number of lag ports") Signed-off-by: Mark Bloch Signed-off-by: Tariq Toukan Reviewed-by: Wojciech Drewek Link: https://patch.msgid.link/20240730061638.1831002-5-tariqt@nvidia.com Signed-off-by: Jakub Kicinski drivers/net/ethernet/mellanox/mlx5/core/lag/lag.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 94a3ad6c081381fa9ee523781789802b4ed00faf Author: Yevgeny Kliteynik Date: Tue Jul 30 09:16:32 2024 +0300 net/mlx5: DR, Fix 'stack guard page was hit' error in dr_rule This patch reduces the size of hw_ste_arr_optimized array that is allocated on stack from 640 bytes (5 match STEs + 5 action STES) to 448 bytes (2 match STEs + 5 action STES). This fixes the 'stack guard page was hit' issue, while still fitting majority of the usecases (up to 2 match STEs). Signed-off-by: Yevgeny Kliteynik Reviewed-by: Alex Vesker Signed-off-by: Tariq Toukan Reviewed-by: Wojciech Drewek Link: https://patch.msgid.link/20240730061638.1831002-4-tariqt@nvidia.com Signed-off-by: Jakub Kicinski drivers/net/ethernet/mellanox/mlx5/core/steering/dr_rule.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit a4557b0b57c40871ff00da4f623cf79211e052f3 Author: Shay Drory Date: Tue Jul 30 09:16:31 2024 +0300 net/mlx5: Fix error handling in irq_pool_request_irq In case mlx5_irq_alloc fails, the previously allocated index remains in the XArray, which could lead to inconsistencies. Fix it by adding error handling that erases the allocated index from the XArray if mlx5_irq_alloc returns an error. Fixes: c36326d38d93 ("net/mlx5: Round-Robin EQs over IRQs") Signed-off-by: Shay Drory Reviewed-by: Maher Sanalla Signed-off-by: Tariq Toukan Reviewed-by: Wojciech Drewek Link: https://patch.msgid.link/20240730061638.1831002-3-tariqt@nvidia.com Signed-off-by: Jakub Kicinski drivers/net/ethernet/mellanox/mlx5/core/irq_affinity.c | 10 +++++++--- 1 file changed, 7 insertions(+), 3 deletions(-) commit 1b75da22ed1e6171e261bc9265370162553d5393 Author: Shay Drory Date: Tue Jul 30 09:16:30 2024 +0300 net/mlx5: Always drain health in shutdown callback There is no point in recovery during device shutdown. if health work started need to wait for it to avoid races and NULL pointer access. Hence, drain health WQ on shutdown callback. Fixes: 1958fc2f0712 ("net/mlx5: SF, Add auxiliary device driver") Fixes: d2aa060d40fa ("net/mlx5: Cancel health poll before sending panic teardown command") Signed-off-by: Shay Drory Reviewed-by: Moshe Shemesh Signed-off-by: Tariq Toukan Reviewed-by: Wojciech Drewek Link: https://patch.msgid.link/20240730061638.1831002-2-tariqt@nvidia.com Signed-off-by: Jakub Kicinski drivers/net/ethernet/mellanox/mlx5/core/main.c | 2 +- drivers/net/ethernet/mellanox/mlx5/core/sf/dev/driver.c | 1 + 2 files changed, 2 insertions(+), 1 deletion(-) commit 8f73ef82985890e484efaed816b172fdf35c87aa Author: Breno Leitao Date: Tue Jul 30 09:14:03 2024 -0700 net: Add skbuff.h to MAINTAINERS The network maintainers need to be copied if the skbuff.h is touched. This also helps git-send-email to figure out the proper maintainers when touching the file. Signed-off-by: Breno Leitao Reviewed-by: Simon Horman Link: https://patch.msgid.link/20240730161404.2028175-1-leitao@debian.org Signed-off-by: Jakub Kicinski MAINTAINERS | 1 + 1 file changed, 1 insertion(+) commit d516b187a9cc2e842030dd005be2735db3e8f395 Author: Heiner Kallweit Date: Tue Jul 30 21:51:52 2024 +0200 r8169: don't increment tx_dropped in case of NETDEV_TX_BUSY The skb isn't consumed in case of NETDEV_TX_BUSY, therefore don't increment the tx_dropped counter. Fixes: 188f4af04618 ("r8169: use NETDEV_TX_{BUSY/OK}") Cc: stable@vger.kernel.org Suggested-by: Jakub Kicinski Signed-off-by: Heiner Kallweit Reviewed-by: Wojciech Drewek Link: https://patch.msgid.link/bbba9c48-8bac-4932-9aa1-d2ed63bc9433@gmail.com Signed-off-by: Jakub Kicinski drivers/net/ethernet/realtek/r8169_main.c | 8 ++------ 1 file changed, 2 insertions(+), 6 deletions(-) commit 601df205896da88e654d7c97d4579fa4af0b4adf Merge: 0bf50cead4c4 7764b9622db4 Author: Jakub Kicinski Date: Wed Jul 31 17:49:00 2024 -0700 Merge tag 'for-netdev' of https://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf Daniel Borkmann says: ==================== pull-request: bpf 2024-07-31 We've added 2 non-merge commits during the last 2 day(s) which contain a total of 2 files changed, 2 insertions(+), 2 deletions(-). The main changes are: 1) Fix BPF selftest build after tree sync with regards to a _GNU_SOURCE macro redefined compilation error, from Stanislav Fomichev. 2) Fix a wrong test in the ASSERT_OK() check in uprobe_syscall BPF selftest, from Jiri Olsa. * tag 'for-netdev' of https://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf: bpf/selftests: Fix ASSERT_OK condition check in uprobe_syscall test selftests/bpf: Filter out _GNU_SOURCE when compiling test_cpp ==================== Link: https://patch.msgid.link/20240731115706.19677-1-daniel@iogearbox.net Signed-off-by: Jakub Kicinski commit 9c685f61722d30a22d55bb8a48f7a48bb2e19bcc Author: Dave Airlie Date: Wed May 15 12:55:41 2024 +1000 nouveau: set placement to original placement on uvmm validate. When a buffer is evicted for memory pressure or TTM evict all, the placement is set to the eviction domain, this means the buffer never gets revalidated on the next exec to the correct domain. I think this should be fine to use the initial domain from the object creation, as least with VM_BIND this won't change after init so this should be the correct answer. Fixes: b88baab82871 ("drm/nouveau: implement new VM_BIND uAPI") Cc: Danilo Krummrich Cc: # v6.6 Signed-off-by: Dave Airlie Signed-off-by: Danilo Krummrich Link: https://patchwork.freedesktop.org/patch/msgid/20240515025542.2156774-1-airlied@gmail.com drivers/gpu/drm/nouveau/nouveau_uvmm.c | 1 + 1 file changed, 1 insertion(+) commit 39a3396558fb97e6e7d4c1eb04c2166da31904a9 Author: Drew Fustini Date: Tue Jul 30 23:14:40 2024 -0700 clk: thead: fix dependency on clk_ignore_unused Add the CLK_IGNORE_UNUSED flag to the vp-axi clock (CLK_VP_AXI) to avoid depending on clk_ignore_unused in the cmdline. Without this fix, the emmc-sdio clock (CLK_EMMC_SDIO) fails to work after vp-axi is disabled. Signed-off-by: Drew Fustini Link: https://lore.kernel.org/r/20240731061439.3807172-1-drew@pdp7.com Fixes: ae81b69fd2b1 ("clk: thead: Add support for T-Head TH1520 AP_SUBSYS clocks") Signed-off-by: Stephen Boyd drivers/clk/thead/clk-th1520-ap.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit c22921df777de5606f1047b1345b8d22ef1c0b34 Author: Kuniyuki Iwashima Date: Thu Jul 25 12:28:21 2024 -0700 netfilter: iptables: Fix potential null-ptr-deref in ip6table_nat_table_init(). ip6table_nat_table_init() accesses net->gen->ptr[ip6table_nat_net_ops.id], but the function is exposed to user space before the entry is allocated via register_pernet_subsys(). Let's call register_pernet_subsys() before xt_register_template(). Fixes: fdacd57c79b7 ("netfilter: x_tables: never register tables by default") Signed-off-by: Kuniyuki Iwashima Reviewed-by: Florian Westphal Signed-off-by: Pablo Neira Ayuso net/ipv6/netfilter/ip6table_nat.c | 14 +++++++++----- 1 file changed, 9 insertions(+), 5 deletions(-) commit 5830aa863981d43560748aa93589c0695191d95d Author: Kuniyuki Iwashima Date: Thu Jul 25 12:28:20 2024 -0700 netfilter: iptables: Fix null-ptr-deref in iptable_nat_table_init(). We had a report that iptables-restore sometimes triggered null-ptr-deref at boot time. [0] The problem is that iptable_nat_table_init() is exposed to user space before the kernel fully initialises netns. In the small race window, a user could call iptable_nat_table_init() that accesses net_generic(net, iptable_nat_net_id), which is available only after registering iptable_nat_net_ops. Let's call register_pernet_subsys() before xt_register_template(). [0]: bpfilter: Loaded bpfilter_umh pid 11702 Started bpfilter BUG: kernel NULL pointer dereference, address: 0000000000000013 PF: supervisor write access in kernel mode PF: error_code(0x0002) - not-present page PGD 0 P4D 0 PREEMPT SMP NOPTI CPU: 2 PID: 11879 Comm: iptables-restor Not tainted 6.1.92-99.174.amzn2023.x86_64 #1 Hardware name: Amazon EC2 c6i.4xlarge/, BIOS 1.0 10/16/2017 RIP: 0010:iptable_nat_table_init (net/ipv4/netfilter/iptable_nat.c:87 net/ipv4/netfilter/iptable_nat.c:121) iptable_nat Code: 10 4c 89 f6 48 89 ef e8 0b 19 bb ff 41 89 c4 85 c0 75 38 41 83 c7 01 49 83 c6 28 41 83 ff 04 75 dc 48 8b 44 24 08 48 8b 0c 24 <48> 89 08 4c 89 ef e8 a2 3b a2 cf 48 83 c4 10 44 89 e0 5b 5d 41 5c RSP: 0018:ffffbef902843cd0 EFLAGS: 00010246 RAX: 0000000000000013 RBX: ffff9f4b052caa20 RCX: ffff9f4b20988d80 RDX: 0000000000000000 RSI: 0000000000000064 RDI: ffffffffc04201c0 RBP: ffff9f4b29394000 R08: ffff9f4b07f77258 R09: ffff9f4b07f77240 R10: 0000000000000000 R11: ffff9f4b09635388 R12: 0000000000000000 R13: ffff9f4b1a3c6c00 R14: ffff9f4b20988e20 R15: 0000000000000004 FS: 00007f6284340000(0000) GS:ffff9f51fe280000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000000000000013 CR3: 00000001d10a6005 CR4: 00000000007706e0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 PKRU: 55555554 Call Trace: ? show_trace_log_lvl (arch/x86/kernel/dumpstack.c:259) ? show_trace_log_lvl (arch/x86/kernel/dumpstack.c:259) ? xt_find_table_lock (net/netfilter/x_tables.c:1259) ? __die_body.cold (arch/x86/kernel/dumpstack.c:478 arch/x86/kernel/dumpstack.c:420) ? page_fault_oops (arch/x86/mm/fault.c:727) ? exc_page_fault (./arch/x86/include/asm/irqflags.h:40 ./arch/x86/include/asm/irqflags.h:75 arch/x86/mm/fault.c:1470 arch/x86/mm/fault.c:1518) ? asm_exc_page_fault (./arch/x86/include/asm/idtentry.h:570) ? iptable_nat_table_init (net/ipv4/netfilter/iptable_nat.c:87 net/ipv4/netfilter/iptable_nat.c:121) iptable_nat xt_find_table_lock (net/netfilter/x_tables.c:1259) xt_request_find_table_lock (net/netfilter/x_tables.c:1287) get_info (net/ipv4/netfilter/ip_tables.c:965) ? security_capable (security/security.c:809 (discriminator 13)) ? ns_capable (kernel/capability.c:376 kernel/capability.c:397) ? do_ipt_get_ctl (net/ipv4/netfilter/ip_tables.c:1656) ? bpfilter_send_req (net/bpfilter/bpfilter_kern.c:52) bpfilter nf_getsockopt (net/netfilter/nf_sockopt.c:116) ip_getsockopt (net/ipv4/ip_sockglue.c:1827) __sys_getsockopt (net/socket.c:2327) __x64_sys_getsockopt (net/socket.c:2342 net/socket.c:2339 net/socket.c:2339) do_syscall_64 (arch/x86/entry/common.c:51 arch/x86/entry/common.c:81) entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:121) RIP: 0033:0x7f62844685ee Code: 48 8b 0d 45 28 0f 00 f7 d8 64 89 01 48 83 c8 ff c3 66 2e 0f 1f 84 00 00 00 00 00 90 f3 0f 1e fa 49 89 ca b8 37 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 0a c3 66 0f 1f 84 00 00 00 00 00 48 8b 15 09 RSP: 002b:00007ffd1f83d638 EFLAGS: 00000246 ORIG_RAX: 0000000000000037 RAX: ffffffffffffffda RBX: 00007ffd1f83d680 RCX: 00007f62844685ee RDX: 0000000000000040 RSI: 0000000000000000 RDI: 0000000000000004 RBP: 0000000000000004 R08: 00007ffd1f83d670 R09: 0000558798ffa2a0 R10: 00007ffd1f83d680 R11: 0000000000000246 R12: 00007ffd1f83e3b2 R13: 00007f628455baa0 R14: 00007ffd1f83d7b0 R15: 00007f628457a008 Modules linked in: iptable_nat(+) bpfilter rpcsec_gss_krb5 auth_rpcgss nfsv4 dns_resolver nfs lockd grace fscache veth xt_state xt_connmark xt_nat xt_statistic xt_MASQUERADE xt_mark xt_addrtype ipt_REJECT nf_reject_ipv4 nft_chain_nat nf_nat xt_conntrack nf_conntrack nf_defrag_ipv6 nf_defrag_ipv4 xt_comment nft_compat nf_tables nfnetlink overlay nls_ascii nls_cp437 vfat fat ghash_clmulni_intel aesni_intel ena crypto_simd ptp cryptd i8042 pps_core serio button sunrpc sch_fq_codel configfs loop dm_mod fuse dax dmi_sysfs crc32_pclmul crc32c_intel efivarfs CR2: 0000000000000013 Fixes: fdacd57c79b7 ("netfilter: x_tables: never register tables by default") Reported-by: Takahiro Kawahara Signed-off-by: Kuniyuki Iwashima Reviewed-by: Florian Westphal Signed-off-by: Pablo Neira Ayuso net/ipv4/netfilter/iptable_nat.c | 18 ++++++++++-------- 1 file changed, 10 insertions(+), 8 deletions(-) commit bf514327c324bc8af64f359b341cc9b189c096fd Author: Borislav Petkov (AMD) Date: Tue Jul 30 16:15:12 2024 +0200 x86/setup: Parse the builtin command line before merging Commit in Fixes was added as a catch-all for cases where the cmdline is parsed before being merged with the builtin one. And promptly one issue appeared, see Link below. The microcode loader really needs to parse it that early, but the merging happens later. Reshuffling the early boot nightmare^W code to handle that properly would be a painful exercise for another day so do the chicken thing and parse the builtin cmdline too before it has been merged. Fixes: 0c40b1c7a897 ("x86/setup: Warn when option parsing is done too early") Reported-by: Mike Lothian Signed-off-by: Borislav Petkov (AMD) Signed-off-by: Thomas Gleixner Reviewed-by: Thomas Gleixner Link: https://lore.kernel.org/all/20240730152108.GAZqkE5Dfi9AuKllRw@fat_crate.local Link: https://lore.kernel.org/r/20240722152330.GCZp55ck8E_FT4kPnC@fat_crate.local arch/x86/include/asm/cmdline.h | 4 ++++ arch/x86/kernel/setup.c | 2 +- arch/x86/lib/cmdline.c | 25 ++++++++++++++++++------- 3 files changed, 23 insertions(+), 8 deletions(-) commit f85de245c6a8e2654e1e9158588bcf78e38cd5a5 Author: André Almeida Date: Tue Jul 2 18:22:15 2024 -0300 drm/atomic: Allow userspace to use damage clips with async flips Allow userspace to use damage clips with atomic async flips. Damage clips are useful for partial plane updates, which can be helpful for clients that want to do flips asynchronously. Fixes: 0e26cc72c71c ("drm: Refuse to async flip with atomic prop changes") Signed-off-by: André Almeida Reviewed-by: Simon Ser Signed-off-by: Simon Ser Link: https://patchwork.freedesktop.org/patch/msgid/20240702212215.109696-2-andrealmeid@igalia.com drivers/gpu/drm/drm_atomic_uapi.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) commit e0fa4132bfae725a60c50d53bac80ec31fc20d89 Author: André Almeida Date: Tue Jul 2 18:22:14 2024 -0300 drm/atomic: Allow userspace to use explicit sync with atomic async flips Allow userspace to use explicit synchronization with atomic async flips. That means that the flip will wait for some hardware fence, and then will flip as soon as possible (async) in regard of the vblank. Fixes: 0e26cc72c71c ("drm: Refuse to async flip with atomic prop changes") Signed-off-by: André Almeida Reviewed-by: Simon Ser Signed-off-by: Simon Ser Link: https://patchwork.freedesktop.org/patch/msgid/20240702212215.109696-1-andrealmeid@igalia.com drivers/gpu/drm/drm_atomic_uapi.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) commit 170c966cbe274e664288cfc12ee919d5e706dc50 Author: Laura Nao Date: Tue Jul 30 12:29:28 2024 +0200 selftests: ksft: Fix finished() helper exit code on skipped tests The Python finished() helper currently exits with KSFT_FAIL when there are only passed and skipped tests. Fix the logic to exit with KSFT_PASS instead, making it consistent with its C and bash counterparts (ksft_finished() and ktap_finished() respectively). Reviewed-by: Nícolas F. R. A. Prado Fixes: dacf1d7a78bf ("kselftest: Add test to verify probe of devices from discoverable buses") Signed-off-by: Laura Nao Reviewed-by: Muhammad Usama Anjum Signed-off-by: Shuah Khan tools/testing/selftests/kselftest/ksft.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 684890a0185dabf5920c43b639133adc4c2632cf Author: John Keeping Date: Wed Jul 31 10:33:09 2024 +0100 Input: adc-joystick - fix optional value handling The abs-fuzz and abs-flat properties are documented as optional. When these are absent, fwnode_property_read_u32() will leave the input unchanged, meaning that an axis either picks up the value for the previous axis or an uninitialized value. Explicitly set these values to zero when they are unspecified to match the documented behaviour in the device tree bindings. Signed-off-by: John Keeping Link: https://lore.kernel.org/r/20240731093310.3696919-1-jkeeping@inmusicbrands.com Signed-off-by: Dmitry Torokhov drivers/input/joystick/adc-joystick.c | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) commit 478689b5990deb626a0b3f1ebf165979914d6be4 Author: Takashi Iwai Date: Wed Jul 31 19:05:15 2024 +0200 ALSA: hda: Conditionally use snooping for AMD HDMI The recent regression report revealed that the use of WC pages for AMD HDMI device together with AMD IOMMU leads to unexpected truncation or noises. The issue seems triggered by the change in the kernel core memory allocation that enables IOMMU driver to use always S/G buffers. Meanwhile, the use of WC pages has been a workaround for the similar issue with standard pages in the past. So, now we need to apply the workaround conditionally, namely, only when IOMMU isn't in place. This patch modifies the workaround code to check the DMA ops at first and apply the snoop-off only when needed. Fixes: f5ff79fddf0e ("dma-mapping: remove CONFIG_DMA_REMAP") Link: https://bugzilla.kernel.org/show_bug.cgi?id=219087 Link: https://patch.msgid.link/20240731170521.31714-1-tiwai@suse.de Signed-off-by: Takashi Iwai sound/pci/hda/hda_controller.h | 2 +- sound/pci/hda/hda_intel.c | 10 +++++++++- 2 files changed, 10 insertions(+), 2 deletions(-) commit 21b136cc63d2a9ddd60d4699552b69c214b32964 Author: Linus Torvalds Date: Tue Jul 30 15:44:16 2024 -0700 minmax: fix up min3() and max3() too David Laight pointed out that we should deal with the min3() and max3() mess too, which still does excessive expansion. And our current macros are actually rather broken. In particular, the macros did this: #define min3(x, y, z) min((typeof(x))min(x, y), z) #define max3(x, y, z) max((typeof(x))max(x, y), z) and that not only is a nested expansion of possibly very complex arguments with all that involves, the typing with that "typeof()" cast is completely wrong. For example, imagine what happens in max3() if 'x' happens to be a 'unsigned char', but 'y' and 'z' are 'unsigned long'. The types are compatible, and there's no warning - but the result is just random garbage. No, I don't think we've ever hit that issue in practice, but since we now have sane infrastructure for doing this right, let's just use it. It fixes any excessive expansion, and also avoids these kinds of broken type issues. Requested-by: David Laight Acked-by: Arnd Bergmann Signed-off-by: Linus Torvalds include/linux/minmax.h | 12 ++++++++++-- 1 file changed, 10 insertions(+), 2 deletions(-) commit b75a22e7d4f23dcd4f78ed2ff368a3d2a4556c0c Author: Samuel Holland Date: Thu Jul 18 14:29:59 2024 -0700 riscv: cpufeature: Do not drop Linux-internal extensions The Linux-internal Xlinuxenvcfg ISA extension is omitted from the riscv_isa_ext array because it has no DT binding and should not appear in /proc/cpuinfo. The logic added in commit 625034abd52a ("riscv: add ISA extensions validation callback") assumes all extensions are included in riscv_isa_ext, and so riscv_resolve_isa() wrongly drops Xlinuxenvcfg from the final ISA string. Instead, accept such Linux-internal ISA extensions as if they have no validation callback. Fixes: 625034abd52a ("riscv: add ISA extensions validation callback") Signed-off-by: Samuel Holland Reviewed-by: Andrew Jones Link: https://lore.kernel.org/r/20240718213011.2600150-1-samuel.holland@sifive.com Signed-off-by: Palmer Dabbelt arch/riscv/kernel/cpufeature.c | 14 ++++++-------- 1 file changed, 6 insertions(+), 8 deletions(-) commit b4c1f33a5d59f577814d87704c45a745a35d8bd9 Author: Kanchan Joshi Date: Tue Jul 30 16:01:38 2024 +0530 nvme: reorganize nvme_ns_head fields shuffle few fields to reduce the holes within nvme_ns_head. On x86_64, the size is reduced to 1104 bytes from 1120 bytes. Signed-off-by: Kanchan Joshi Reviewed-by: Sagi Grimberg Reviewed-by: Christoph Hellwig Signed-off-by: Keith Busch drivers/nvme/host/nvme.h | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-) commit 73d148ccb9e1b62cdcb65e1c6a461229446a55a2 Author: Kanchan Joshi Date: Tue Jul 30 16:01:37 2024 +0530 nvme: change data type of lba_shift u8 fits the need, so stop using int for it. Signed-off-by: Kanchan Joshi Reviewed-by: Sagi Grimberg Reviewed-by: Christoph Hellwig Signed-off-by: Keith Busch drivers/nvme/host/nvme.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 6339b7edada2d0c4661bc4200f1adfc80f2e24aa Author: Kanchan Joshi Date: Tue Jul 30 16:01:36 2024 +0530 nvme: remove a field from nvme_ns_head pi_offset field is not required to be present in nvme_ns_head. Signed-off-by: Kanchan Joshi Reviewed-by: Sagi Grimberg Reviewed-by: Christoph Hellwig Signed-off-by: Keith Busch drivers/nvme/host/core.c | 16 ++++++++-------- drivers/nvme/host/nvme.h | 1 - 2 files changed, 8 insertions(+), 9 deletions(-) commit e1cf752ede8e82c2d084868c50a1ca6cdb07c9c4 Author: Francesco Dolcini Date: Wed Jun 12 11:29:34 2024 +0200 dt-bindings: eeprom: at25: add fujitsu,mb85rs256 compatible The fujitsu,mb85rs256 is a 256 Kbit SPI memory FRAM in the same family as the two existing fujitsu,mb85rs* compatibles and at25 compatible. Signed-off-by: Francesco Dolcini Acked-by: Krzysztof Kozlowski Link: https://lore.kernel.org/r/20240612092934.12282-1-francesco@dolcini.it Signed-off-by: Rob Herring (Arm) Documentation/devicetree/bindings/eeprom/at25.yaml | 1 + 1 file changed, 1 insertion(+) commit 33bd8d153c337ba9b30a2e5994437ca703ab4ed8 Author: Heiko Carstens Date: Mon Jul 29 13:06:44 2024 +0200 s390: Keep inittext section writable There is no added security by making the inittext section non-writable, however it does split part of the kernel mapping into 4K mappings instead of 1M mappings: ---[ Kernel Image Start ]--- 0x000003ffe0000000-0x000003ffe0e00000 14M PMD RO X 0x000003ffe0e00000-0x000003ffe0ec7000 796K PTE RO X 0x000003ffe0ec7000-0x000003ffe0f00000 228K PTE RO NX 0x000003ffe0f00000-0x000003ffe1300000 4M PMD RO NX 0x000003ffe1300000-0x000003ffe1353000 332K PTE RO NX 0x000003ffe1353000-0x000003ffe1400000 692K PTE RW NX 0x000003ffe1400000-0x000003ffe1500000 1M PMD RW NX 0x000003ffe1500000-0x000003ffe1700000 2M PTE RW NX <--- 0x000003ffe1700000-0x000003ffe1800000 1M PMD RW NX 0x000003ffe1800000-0x000003ffe187e000 504K PTE RW NX ---[ Kernel Image End ]--- Keep the inittext writable and enable instruction execution protection (aka noexec) later to prevent this. This also allows to use the generic free_initmem() implementation. ---[ Kernel Image Start ]--- 0x000003ffe0000000-0x000003ffe0e00000 14M PMD RO X 0x000003ffe0e00000-0x000003ffe0ec7000 796K PTE RO X 0x000003ffe0ec7000-0x000003ffe0f00000 228K PTE RO NX 0x000003ffe0f00000-0x000003ffe1300000 4M PMD RO NX 0x000003ffe1300000-0x000003ffe1353000 332K PTE RO NX 0x000003ffe1353000-0x000003ffe1400000 692K PTE RW NX 0x000003ffe1400000-0x000003ffe1800000 4M PMD RW NX <--- 0x000003ffe1800000-0x000003ffe187e000 504K PTE RW NX ---[ Kernel Image End ]--- Reviewed-by: Alexander Gordeev Signed-off-by: Heiko Carstens Signed-off-by: Vasily Gorbik arch/s390/mm/init.c | 9 ++------- arch/s390/mm/vmem.c | 3 --- 2 files changed, 2 insertions(+), 10 deletions(-) commit 75c10d5377d8821efafed32e4d72068d9c1f8ec0 Author: Heiko Carstens Date: Mon Jul 29 13:06:43 2024 +0200 s390/vmlinux.lds.S: Move ro_after_init section behind rodata section The .data.rel.ro and .got section were added between the rodata and ro_after_init data section, which adds an RW mapping in between all RO mapping of the kernel image: ---[ Kernel Image Start ]--- 0x000003ffe0000000-0x000003ffe0e00000 14M PMD RO X 0x000003ffe0e00000-0x000003ffe0ec7000 796K PTE RO X 0x000003ffe0ec7000-0x000003ffe0f00000 228K PTE RO NX 0x000003ffe0f00000-0x000003ffe1300000 4M PMD RO NX 0x000003ffe1300000-0x000003ffe1331000 196K PTE RO NX 0x000003ffe1331000-0x000003ffe13b3000 520K PTE RW NX <--- 0x000003ffe13b3000-0x000003ffe13d5000 136K PTE RO NX 0x000003ffe13d5000-0x000003ffe1400000 172K PTE RW NX 0x000003ffe1400000-0x000003ffe1500000 1M PMD RW NX 0x000003ffe1500000-0x000003ffe1700000 2M PTE RW NX 0x000003ffe1700000-0x000003ffe1800000 1M PMD RW NX 0x000003ffe1800000-0x000003ffe187e000 504K PTE RW NX ---[ Kernel Image End ]--- Move the ro_after_init data section again right behind the rodata section to prevent interleaving RO and RW mappings: ---[ Kernel Image Start ]--- 0x000003ffe0000000-0x000003ffe0e00000 14M PMD RO X 0x000003ffe0e00000-0x000003ffe0ec7000 796K PTE RO X 0x000003ffe0ec7000-0x000003ffe0f00000 228K PTE RO NX 0x000003ffe0f00000-0x000003ffe1300000 4M PMD RO NX 0x000003ffe1300000-0x000003ffe1353000 332K PTE RO NX 0x000003ffe1353000-0x000003ffe1400000 692K PTE RW NX 0x000003ffe1400000-0x000003ffe1500000 1M PMD RW NX 0x000003ffe1500000-0x000003ffe1700000 2M PTE RW NX 0x000003ffe1700000-0x000003ffe1800000 1M PMD RW NX 0x000003ffe1800000-0x000003ffe187e000 504K PTE RW NX ---[ Kernel Image End ]--- Reviewed-by: Alexander Gordeev Signed-off-by: Heiko Carstens Signed-off-by: Vasily Gorbik arch/s390/kernel/vmlinux.lds.S | 17 +++++++++-------- 1 file changed, 9 insertions(+), 8 deletions(-) commit 1e72ba5566d90a668c1c0fbde319cec03454fd20 Author: Heiko Carstens Date: Mon Jul 29 15:45:58 2024 +0200 s390/mm: Get rid of RELOC_HIDE() Since __va(0) does not translate to NULL anymore remove RELOC_HIDE() which was only added to get rid of a compile warning with clang W=1: arch/s390/mm/vmem.c:666:36: warning: performing pointer arithmetic on a null pointer has undefined behavior [-Wnull-pointer-arithmetic] 666 | __set_memory_4k(__va(0), __va(0) + ident_map_size); | ~~~~~~~ ^ Reviewed-by: Alexander Gordeev Signed-off-by: Heiko Carstens Signed-off-by: Vasily Gorbik arch/s390/mm/vmem.c | 10 ++-------- 1 file changed, 2 insertions(+), 8 deletions(-) commit 7e12284c523be33f34d43b2bf8627ab0c8af2388 Author: Heiko Carstens Date: Tue Jul 23 20:49:55 2024 +0200 s390/mm/ptdump: Improve sorting of markers Use the sort() from lib/sort.c to sort markers instead of the private implementation. The current implementation does not sort markers properly if they have to be moved downwards: ---[ Real Memory Copy Area Start ]--- 0x0000035b903ff000-0x0000035b90400000 4K PTE I ---[ vmalloc Area Start ]--- ---[ Real Memory Copy Area End ]--- Add a new member to each marker which indicates if a marker is start of an area. If addresses of areas are equal consider an address which defines the start of an area higher than the address which defines the end of an area. In result the output is sorted as intended: ---[ Real Memory Copy Area Start ]--- 0x0000019cedcff000-0x0000019cedd00000 4K PTE I ---[ Real Memory Copy Area End ]--- ---[ vmalloc Area Start ]--- Reviewed-by: Alexander Gordeev Signed-off-by: Heiko Carstens Signed-off-by: Vasily Gorbik arch/s390/mm/dump_pagetables.c | 100 ++++++++++++++++++++++------------------- 1 file changed, 53 insertions(+), 47 deletions(-) commit 7e4d4cfed6483303436687f1db9a28a377c6ab2a Author: Heiko Carstens Date: Tue Jul 23 20:49:54 2024 +0200 s390/mm/ptdump: Add support for relocated lowcore mapping The page table dumper contains a hard coded assumption that the first mapped area starts at address zero. With a relocated lowcore this is not true anymore. Subsequently the first entry (lowcore) is printed as if it would contain everything from address zero until the end of the location of the lowcore area. Fix this by adding a single "Kernel Virtual Address Space" entry, which always starts at address zero. It ends when the lowcore area starts which is either address zero, or its relocated address. Reviewed-by: Sven Schnelle Signed-off-by: Heiko Carstens Signed-off-by: Vasily Gorbik arch/s390/mm/dump_pagetables.c | 35 ++++++++++++++++++++++------------- 1 file changed, 22 insertions(+), 13 deletions(-) commit 373953444ce542db43535861fb8ebf3a1e05669c Author: Heiko Carstens Date: Tue Jul 23 20:49:53 2024 +0200 s390/mm/ptdump: Fix handling of identity mapping area Since virtual and real addresses are not the same anymore the assumption that the kernel image is contained within the identity mapping is also not true anymore. Fix this by adding two explicit areas and at the correct locations: one for the 8kb lowcore area, and one for the identity mapping. Fixes: c98d2ecae08f ("s390/mm: Uncouple physical vs virtual address spaces") Reviewed-by: Alexander Gordeev Signed-off-by: Heiko Carstens Signed-off-by: Vasily Gorbik arch/s390/mm/dump_pagetables.c | 21 ++++++++++++--------- 1 file changed, 12 insertions(+), 9 deletions(-) commit c8e4d73eae835a1b9f6fc29f2577770ea8ca0c03 Author: Jeff Johnson Date: Mon Jul 15 08:58:51 2024 -0700 s390/cio: Add missing MODULE_DESCRIPTION() macros With ARCH=s390, make allmodconfig && make W=1 C=1 reports: WARNING: modpost: missing MODULE_DESCRIPTION() in drivers/s390/cio/ccwgroup.o WARNING: modpost: missing MODULE_DESCRIPTION() in drivers/s390/cio/vfio_ccw.o Add the missing invocations of the MODULE_DESCRIPTION() macro. Reviewed-by: Eric Farman Reviewed-by: Vineeth Vijayan Signed-off-by: Jeff Johnson Link: https://lore.kernel.org/r/20240715-md-s390-drivers-s390-cio-v2-1-97eaa6971124@quicinc.com Signed-off-by: Vasily Gorbik drivers/s390/cio/ccwgroup.c | 1 + drivers/s390/cio/vfio_ccw_drv.c | 1 + 2 files changed, 2 insertions(+) commit 0a34c027a3dd756bdc17762db3acaeacdabacaf0 Author: Heiko Carstens Date: Sat Jul 27 19:34:27 2024 +0200 s390/alternatives: Remove unused empty header file Remove the unused and empty arch/s390/kernel/alternative.h header file which was added by mistake. Fixes: 5ade5be4edf8 ("s390: Add infrastructure to patch lowcore accesses") Signed-off-by: Heiko Carstens Signed-off-by: Vasily Gorbik arch/s390/kernel/alternative.h | 0 1 file changed, 0 insertions(+), 0 deletions(-) commit 4734406c39238cbeafe66f0060084caa3247ff53 Author: Heiko Carstens Date: Thu Jul 25 11:31:52 2024 +0200 s390/fpu: Re-add exception handling in load_fpu_state() With the recent rewrite of the fpu code exception handling for the lfpc instruction within load_fpu_state() was erroneously removed. Add it again to prevent that loading invalid floating point register values cause an unhandled specification exception. Fixes: 8c09871a950a ("s390/fpu: limit save and restore to used registers") Cc: stable@vger.kernel.org Reported-by: Aristeu Rozanski Tested-by: Aristeu Rozanski Reviewed-by: Vasily Gorbik Signed-off-by: Heiko Carstens Signed-off-by: Vasily Gorbik arch/s390/kernel/fpu.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit b7b7e1ab7619deb3b299b5e5c619c3e6f183a12d Author: Takashi Iwai Date: Wed Jul 31 16:19:41 2024 +0200 ALSA: usb-audio: Correct surround channels in UAC1 channel map USB-audio driver puts SNDRV_CHMAP_SL and _SR as left and right surround channels for UAC1 channel map, respectively. But they should have been SNDRV_CHMAP_RL and _RR; the current value *_SL and _SR are rather "side" channels, not "surround". I guess I took those mistakenly when I read the spec mentioning "surround left". This patch corrects those entries to be the right channels. Suggested-by: Sylvain BERTRAND Closes: https://lore.kernel.orgZ/qIyJD8lhd8hFhlC@freedom Fixes: 04324ccc75f9 ("ALSA: usb-audio: add channel map support") Cc: Link: https://patch.msgid.link/20240731142018.24750-1-tiwai@suse.de Signed-off-by: Takashi Iwai sound/usb/stream.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) commit 9da8aa3b3ca05b22be5ba312771e6df4366e56cc Author: Francesco Dolcini Date: Wed Jul 31 13:48:28 2024 +0200 ASoC: nau8822: Lower debug print priority NAU8822 codec PLL parameters are not an information that the general user should care about, this print is supposed to be used for debugging, adjust the debug print priority accordingly. Signed-off-by: Francesco Dolcini Link: https://patch.msgid.link/20240731114828.61238-1-francesco@dolcini.it Signed-off-by: Mark Brown sound/soc/codecs/nau8822.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 00af4f3dda1461ec90d892edc10bec6d3c50c554 Author: Marek Marczykowski-Górecki Date: Mon Jul 15 12:44:53 2024 +0200 USB: serial: debug: do not echo input by default This driver is intended as a "client" end of the console connection. When connected to a host it's supposed to receive debug logs, and possibly allow to interact with whatever debug console is available there. Feeding messages back, depending on a configuration may cause log messages be executed as shell commands (which can be really bad if one is unlucky, imagine a log message like "prevented running `rm -rf /home`"). In case of Xen, it exposes sysrq-like debug interface, and feeding it its own logs will pretty quickly hit 'R' for "instant reboot". Contrary to a classic serial console, the USB one cannot be configured ahead of time, as the device shows up only when target OS is up. And at the time device is opened to execute relevant ioctl, it's already too late, especially when logs start flowing shortly after device is initialized. Avoid the issue by changing default to no echo for this type of devices. Signed-off-by: Marek Marczykowski-Górecki [ johan: amend summary; disable also ECHONL ] Cc: stable@vger.kernel.org Signed-off-by: Johan Hovold drivers/usb/serial/usb_debug.c | 7 +++++++ 1 file changed, 7 insertions(+) commit 98ea612dd1150adb61cd2a0e93875e1cc77e6b87 Author: Takashi Iwai Date: Wed Jul 31 15:05:26 2024 +0200 ALSA: seq: ump: Explicitly reset RPN with Null RPN RPN with 127:127 is treated as a Null RPN, just to reset the parameters, and it's not translated to MIDI2. Although the current code can work as is in most cases, better to implement the RPN reset explicitly for Null message. Link: https://patch.msgid.link/20240731130528.12600-6-tiwai@suse.de Signed-off-by: Takashi Iwai sound/core/seq/seq_ump_convert.c | 21 ++++++++++++++++----- 1 file changed, 16 insertions(+), 5 deletions(-) commit a4ff92ff0bdd731eca9f0b50b1cbb5aba89be4b2 Author: Takashi Iwai Date: Wed Jul 31 15:05:25 2024 +0200 ALSA: seq: ump: Transmit RPN/NRPN message at each MSB/LSB data reception Just like the core UMP conversion helper, we need to deal with the partially-filled RPN/NRPN data in the sequencer UMP converter as well. Link: https://patch.msgid.link/20240731130528.12600-5-tiwai@suse.de Signed-off-by: Takashi Iwai sound/core/seq/seq_ump_convert.c | 74 ++++++++++++++++++++++++---------------- 1 file changed, 44 insertions(+), 30 deletions(-) commit a683030606fa5ff8b722a5e28839d19288011ede Author: Takashi Iwai Date: Wed Jul 31 15:05:24 2024 +0200 ALSA: seq: ump: Use the common RPN/bank conversion context The UMP core conversion helper API already defines the context needed to record the bank and RPN/NRPN values, and we can simply re-use the same struct instead of re-defining the same content as a different name. Link: https://patch.msgid.link/20240731130528.12600-4-tiwai@suse.de Signed-off-by: Takashi Iwai sound/core/seq/seq_ports.h | 14 ++------------ sound/core/seq/seq_ump_convert.c | 10 +++++----- 2 files changed, 7 insertions(+), 17 deletions(-) commit 50a6dd19dca9446475f023eaa652016bfe5b1cbe Author: Takashi Iwai Date: Wed Jul 31 15:05:23 2024 +0200 ALSA: ump: Explicitly reset RPN with Null RPN RPN with 127:127 is treated as a Null RPN, just to reset the parameters, and it's not translated to MIDI2. Although the current code can work as is in most cases, better to implement the RPN reset explicitly for Null message. Link: https://patch.msgid.link/20240731130528.12600-3-tiwai@suse.de Signed-off-by: Takashi Iwai sound/core/ump_convert.c | 19 ++++++++++++++----- 1 file changed, 14 insertions(+), 5 deletions(-) commit e6ce8a28c768dbbad3f818db286cd0f4c7a921a8 Author: Takashi Iwai Date: Wed Jul 31 15:05:22 2024 +0200 ALSA: ump: Transmit RPN/NRPN message at each MSB/LSB data reception The UMP 1.1 spec says that an RPN/NRPN should be sent when one of the following occurs: * a CC 38 is received * a subsequent CC 6 is received * a CC 98, 99, 100, and 101 is received, indicating the last RPN/NRPN message has ended and a new one has started That said, we should send a partial data even if it's not fully filled. Let's change the UMP conversion helper code to follow that rule. Link: https://patch.msgid.link/20240731130528.12600-2-tiwai@suse.de Signed-off-by: Takashi Iwai include/sound/ump_convert.h | 1 + sound/core/ump_convert.c | 49 +++++++++++++++++++++++++++++---------------- 2 files changed, 33 insertions(+), 17 deletions(-) commit 15fffc6a5624b13b428bb1c6e9088e32a55eb82c Author: Dan Williams Date: Fri Jul 12 12:42:09 2024 -0700 driver core: Fix uevent_show() vs driver detach race uevent_show() wants to de-reference dev->driver->name. There is no clean way for a device attribute to de-reference dev->driver unless that attribute is defined via (struct device_driver).dev_groups. Instead, the anti-pattern of taking the device_lock() in the attribute handler risks deadlocks with code paths that remove device attributes while holding the lock. This deadlock is typically invisible to lockdep given the device_lock() is marked lockdep_set_novalidate_class(), but some subsystems allocate a local lockdep key for @dev->mutex to reveal reports of the form: ====================================================== WARNING: possible circular locking dependency detected 6.10.0-rc7+ #275 Tainted: G OE N ------------------------------------------------------ modprobe/2374 is trying to acquire lock: ffff8c2270070de0 (kn->active#6){++++}-{0:0}, at: __kernfs_remove+0xde/0x220 but task is already holding lock: ffff8c22016e88f8 (&cxl_root_key){+.+.}-{3:3}, at: device_release_driver_internal+0x39/0x210 which lock already depends on the new lock. the existing dependency chain (in reverse order) is: -> #1 (&cxl_root_key){+.+.}-{3:3}: __mutex_lock+0x99/0xc30 uevent_show+0xac/0x130 dev_attr_show+0x18/0x40 sysfs_kf_seq_show+0xac/0xf0 seq_read_iter+0x110/0x450 vfs_read+0x25b/0x340 ksys_read+0x67/0xf0 do_syscall_64+0x75/0x190 entry_SYSCALL_64_after_hwframe+0x76/0x7e -> #0 (kn->active#6){++++}-{0:0}: __lock_acquire+0x121a/0x1fa0 lock_acquire+0xd6/0x2e0 kernfs_drain+0x1e9/0x200 __kernfs_remove+0xde/0x220 kernfs_remove_by_name_ns+0x5e/0xa0 device_del+0x168/0x410 device_unregister+0x13/0x60 devres_release_all+0xb8/0x110 device_unbind_cleanup+0xe/0x70 device_release_driver_internal+0x1c7/0x210 driver_detach+0x47/0x90 bus_remove_driver+0x6c/0xf0 cxl_acpi_exit+0xc/0x11 [cxl_acpi] __do_sys_delete_module.isra.0+0x181/0x260 do_syscall_64+0x75/0x190 entry_SYSCALL_64_after_hwframe+0x76/0x7e The observation though is that driver objects are typically much longer lived than device objects. It is reasonable to perform lockless de-reference of a @driver pointer even if it is racing detach from a device. Given the infrequency of driver unregistration, use synchronize_rcu() in module_remove_driver() to close any potential races. It is potentially overkill to suffer synchronize_rcu() just to handle the rare module removal racing uevent_show() event. Thanks to Tetsuo Handa for the debug analysis of the syzbot report [1]. Fixes: c0a40097f0bc ("drivers: core: synchronize really_probe() and dev_uevent()") Reported-by: syzbot+4762dd74e32532cda5ff@syzkaller.appspotmail.com Reported-by: Tetsuo Handa Closes: http://lore.kernel.org/5aa5558f-90a4-4864-b1b1-5d6784c5607d@I-love.SAKURA.ne.jp [1] Link: http://lore.kernel.org/669073b8ea479_5fffa294c1@dwillia2-xfh.jf.intel.com.notmuch Cc: stable@vger.kernel.org Cc: Ashish Sangwan Cc: Namjae Jeon Cc: Dirk Behme Cc: Greg Kroah-Hartman Cc: Rafael J. Wysocki Signed-off-by: Dan Williams Link: https://lore.kernel.org/r/172081332794.577428.9738802016494057132.stgit@dwillia2-xfh.jf.intel.com Signed-off-by: Greg Kroah-Hartman drivers/base/core.c | 13 ++++++++----- drivers/base/module.c | 4 ++++ 2 files changed, 12 insertions(+), 5 deletions(-) commit ffcf2eb4bfa24f7256de53a95182c3e3e23fdc6c Author: David Collins Date: Thu Jul 25 09:46:33 2024 -0700 spmi: pmic-arb: add missing newline in dev_err format strings dev_err() format strings should end with '\n'. Several such format strings in the spmi-pmic-arb driver are missing it. Add newlines where needed. Fixes: 02922ccbb330 ("spmi: pmic-arb: Register controller for bus instead of arbiter") Signed-off-by: David Collins Link: https://lore.kernel.org/r/20240703221248.3640490-1-quic_collinsd@quicinc.com Reviewed-by: Bjorn Andersson Signed-off-by: Stephen Boyd Link: https://lore.kernel.org/r/20240725164636.3362690-4-sboyd@kernel.org Signed-off-by: Greg Kroah-Hartman drivers/spmi/spmi-pmic-arb.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) commit f38ba5459ced3441852f37f20fcfb7bd39d20f62 Author: Konrad Dybcio Date: Thu Jul 25 09:46:32 2024 -0700 spmi: pmic-arb: Pass the correct of_node to irq_domain_add_tree Currently, irqchips for all of the subnodes (which represent a given bus master) point to the parent wrapper node. This is no bueno, as no interrupts arrive, ever (because nothing references that node). Fix that by passing a reference to the respective master's of_node. Worth noting, this is a NOP for devices with only a single master described. Signed-off-by: Konrad Dybcio Link: https://lore.kernel.org/r/20240522-topic-spmi_multi_master_irqfix-v2-1-7ec92a862b9f@linaro.org Reviewed-by: Abel Vesa Tested-by: Dmitry Baryshkov Reviewed-by: Dmitry Baryshkov Fixes: 02922ccbb330 ("spmi: pmic-arb: Register controller for bus instead of arbiter") Cc: stable@vger.kernel.org Signed-off-by: Stephen Boyd Reviewed-by: Bjorn Andersson Link: https://lore.kernel.org/r/20240725164636.3362690-3-sboyd@kernel.org Signed-off-by: Greg Kroah-Hartman drivers/spmi/spmi-pmic-arb.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) commit 2c10a20f5e84ab777d29ed921d4c78d66de6d0fb Author: Mukesh Ojha Date: Thu Jul 25 11:55:10 2024 +0530 binder_alloc: Fix sleeping function called from invalid context 36c55ce8703c ("binder_alloc: Replace kcalloc with kvcalloc to mitigate OOM issues") introduced schedule while atomic issue. [ 2689.152635][ T4275] BUG: sleeping function called from invalid context at mm/vmalloc.c:2847 [ 2689.161291][ T4275] in_atomic(): 1, irqs_disabled(): 0, non_block: 0, pid: 4275, name: kworker/1:140 [ 2689.170708][ T4275] preempt_count: 1, expected: 0 [ 2689.175572][ T4275] RCU nest depth: 0, expected: 0 [ 2689.180521][ T4275] INFO: lockdep is turned off. [ 2689.180523][ T4275] Preemption disabled at: [ 2689.180525][ T4275] [] binder_alloc_deferred_release+0x2c/0x388 .. .. [ 2689.213419][ T4275] __might_resched+0x174/0x178 [ 2689.213423][ T4275] __might_sleep+0x48/0x7c [ 2689.213426][ T4275] vfree+0x4c/0x15c [ 2689.213430][ T4275] kvfree+0x24/0x44 [ 2689.213433][ T4275] binder_alloc_deferred_release+0x2c0/0x388 [ 2689.213436][ T4275] binder_proc_dec_tmpref+0x15c/0x2a8 [ 2689.213440][ T4275] binder_deferred_func+0xa8/0x8ec [ 2689.213442][ T4275] process_one_work+0x254/0x59c [ 2689.213447][ T4275] worker_thread+0x274/0x3ec [ 2689.213450][ T4275] kthread+0x110/0x134 [ 2689.213453][ T4275] ret_from_fork+0x10/0x20 Fix it by moving the place of kvfree outside of spinlock context. Fixes: 36c55ce8703c ("binder_alloc: Replace kcalloc with kvcalloc to mitigate OOM issues") Acked-by: Carlos Llamas Signed-off-by: Mukesh Ojha Link: https://lore.kernel.org/r/20240725062510.2856662-1-quic_mojha@quicinc.com Signed-off-by: Greg Kroah-Hartman drivers/android/binder_alloc.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 11512c197d387b59569d3a93af93de204d3bdaa6 Author: Carlos Llamas Date: Mon Jul 22 15:05:11 2024 +0000 binder: fix descriptor lookup for context manager In commit 15d9da3f818c ("binder: use bitmap for faster descriptor lookup"), it was incorrectly assumed that references to the context manager node should always get descriptor zero assigned to them. However, if the context manager dies and a new process takes its place, then assigning descriptor zero to the new context manager might lead to collisions, as there could still be references to the older node. This issue was reported by syzbot with the following trace: kernel BUG at drivers/android/binder.c:1173! Internal error: Oops - BUG: 00000000f2000800 [#1] PREEMPT SMP Modules linked in: CPU: 1 PID: 447 Comm: binder-util Not tainted 6.10.0-rc6-00348-g31643d84b8c3 #10 Hardware name: linux,dummy-virt (DT) pstate: 60000005 (nZCv daif -PAN -UAO -TCO -DIT -SSBS BTYPE=--) pc : binder_inc_ref_for_node+0x500/0x544 lr : binder_inc_ref_for_node+0x1e4/0x544 sp : ffff80008112b940 x29: ffff80008112b940 x28: ffff0e0e40310780 x27: 0000000000000000 x26: 0000000000000001 x25: ffff0e0e40310738 x24: ffff0e0e4089ba34 x23: ffff0e0e40310b00 x22: ffff80008112bb50 x21: ffffaf7b8f246970 x20: ffffaf7b8f773f08 x19: ffff0e0e4089b800 x18: 0000000000000000 x17: 0000000000000000 x16: 0000000000000000 x15: 000000002de4aa60 x14: 0000000000000000 x13: 2de4acf000000000 x12: 0000000000000020 x11: 0000000000000018 x10: 0000000000000020 x9 : ffffaf7b90601000 x8 : ffff0e0e48739140 x7 : 0000000000000000 x6 : 000000000000003f x5 : ffff0e0e40310b28 x4 : 0000000000000000 x3 : ffff0e0e40310720 x2 : ffff0e0e40310728 x1 : 0000000000000000 x0 : ffff0e0e40310710 Call trace: binder_inc_ref_for_node+0x500/0x544 binder_transaction+0xf68/0x2620 binder_thread_write+0x5bc/0x139c binder_ioctl+0xef4/0x10c8 [...] This patch adds back the previous behavior of assigning the next non-zero descriptor if references to previous context managers still exist. It amends both strategies, the newer dbitmap code and also the legacy slow_desc_lookup_olocked(), by allowing them to start looking for available descriptors at a given offset. Fixes: 15d9da3f818c ("binder: use bitmap for faster descriptor lookup") Cc: stable@vger.kernel.org Reported-and-tested-by: syzbot+3dae065ca76952a67257@syzkaller.appspotmail.com Closes: https://lore.kernel.org/all/000000000000c1c0a0061d1e6979@google.com/ Reviewed-by: Alice Ryhl Signed-off-by: Carlos Llamas Link: https://lore.kernel.org/r/20240722150512.4192473-1-cmllamas@google.com Signed-off-by: Greg Kroah-Hartman drivers/android/binder.c | 15 ++++++--------- drivers/android/dbitmap.h | 22 +++++++--------------- 2 files changed, 13 insertions(+), 24 deletions(-) commit d1009d04a0fefe4df86285cbb37c78aa0b7ab852 Author: Jeff Johnson Date: Wed Jul 17 09:17:07 2024 -0700 char: add missing NetWinder MODULE_DESCRIPTION() macros Since commit 1fffe7a34c89 ("script: modpost: emit a warning when the description is missing"), a module without a MODULE_DESCRIPTION() will result in a warning with make W=1. The following warnings are being observed in drivers/char when CONFIG_ARCH_NETWINDER is enabled: WARNING: modpost: missing MODULE_DESCRIPTION() in drivers/char/ds1620.o WARNING: modpost: missing MODULE_DESCRIPTION() in drivers/char/nwbutton.o WARNING: modpost: missing MODULE_DESCRIPTION() in drivers/char/nwflash.o Add the missing invocations of the MODULE_DESCRIPTION() macro. Signed-off-by: Jeff Johnson Link: https://lore.kernel.org/r/20240717-md-arm-drivers-char-nw-v1-1-fee7a8505e9e@quicinc.com Signed-off-by: Greg Kroah-Hartman drivers/char/ds1620.c | 1 + drivers/char/nwbutton.c | 1 + drivers/char/nwflash.c | 1 + 3 files changed, 3 insertions(+) commit f528cd55853968db8e959ff0e4c2c43e561e7b83 Author: Arnd Bergmann Date: Fri Jul 19 12:38:23 2024 +0200 misc: mrvl-cn10k-dpi: add PCI_IOV dependency I found one more missing dependency in the new driver: when building without CONFIG_PCI_IOV, pci_sriov_configure_simple() cannot be called directly: drivers/misc/mrvl_cn10k_dpi.c: In function 'dpi_remove': include/linux/stddef.h:9:14: error: called object is not a function or function pointer 9 | #define NULL ((void *)0) | ^ include/linux/pci.h:2416:41: note: in expansion of macro 'NULL' 2416 | #define pci_sriov_configure_simple NULL | ^~~~ drivers/misc/mrvl_cn10k_dpi.c:652:9: note: in expansion of macro 'pci_sriov_configure_simple' 652 | pci_sriov_configure_simple(pdev, 0); Add this to the Kconfig file as well. Fixes: 5f67eef6dff3 ("misc: mrvl-cn10k-dpi: add Octeon CN10K DPI administrative driver") Signed-off-by: Arnd Bergmann Tested-by: Vamsi Attunuru Link: https://lore.kernel.org/r/20240719103858.1292094-1-arnd@kernel.org Signed-off-by: Greg Kroah-Hartman drivers/misc/Kconfig | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit e6cd0dc91ef9d24edda553343e64eb6b542c21dd Author: Armin Wolf Date: Sun Jul 14 01:48:13 2024 +0200 eeprom: ee1004: Fix locking issues in ee1004_probe() Currently, the devres-based management of ee1004_bus_data has several issues when it comes to locking: 1. It does not call mutex_unlock() before returning an error. 2. When encountering an error, it deadlocks when trying to recursively lock a mutex. Fix this by moving the mutex-protected bus data initialization into a separate function so that devm_add_action_or_reset() is called without the mutex being held. Reported-by: Dan Carpenter Fixes: 55d57ef6fa97 ("eeprom: ee1004: Use devres for bus data cleanup") Signed-off-by: Armin Wolf Reviewed-by: Dan Carpenter Link: https://lore.kernel.org/r/20240713234813.21746-1-W_Armin@gmx.de Signed-off-by: Greg Kroah-Hartman drivers/misc/eeprom/ee1004.c | 85 ++++++++++++++++++++++++++------------------ 1 file changed, 51 insertions(+), 34 deletions(-) commit be62f1289df01b7083f9ee5daf2a27d81355d666 Author: Jeff Johnson Date: Tue Jul 30 07:43:21 2024 -0700 fsi: add missing MODULE_DESCRIPTION() macros make allmodconfig && make W=1 C=1 reports: WARNING: modpost: missing MODULE_DESCRIPTION() in drivers/fsi/fsi-core.o WARNING: modpost: missing MODULE_DESCRIPTION() in drivers/fsi/fsi-master-hub.o WARNING: modpost: missing MODULE_DESCRIPTION() in drivers/fsi/fsi-master-aspeed.o WARNING: modpost: missing MODULE_DESCRIPTION() in drivers/fsi/fsi-master-gpio.o WARNING: modpost: missing MODULE_DESCRIPTION() in drivers/fsi/fsi-master-ast-cf.o WARNING: modpost: missing MODULE_DESCRIPTION() in drivers/fsi/fsi-scom.o Add the missing invocations of the MODULE_DESCRIPTION() macro, and fix the copy/paste of the module description comment in fsi-master-ast-cf.c. Reviewed-by: Eddie James Signed-off-by: Jeff Johnson Link: https://lore.kernel.org/r/20240730-module_description_orphans-v1-4-7094088076c8@quicinc.com Signed-off-by: Greg Kroah-Hartman drivers/fsi/fsi-core.c | 1 + drivers/fsi/fsi-master-aspeed.c | 1 + drivers/fsi/fsi-master-ast-cf.c | 3 ++- drivers/fsi/fsi-master-gpio.c | 1 + drivers/fsi/fsi-master-hub.c | 1 + drivers/fsi/fsi-scom.c | 1 + 6 files changed, 7 insertions(+), 1 deletion(-) commit 86fee2877f3427df5876159a182aa70d10964cdf Author: Greg Kroah-Hartman Date: Tue Jul 30 18:09:32 2024 +0200 Documentation: embargoed-hardware-issues.rst: add a section documenting the "early access" process Over the past years there have been many "misunderstandings" and "confusion" as to who is, and is not, allowed early access to the changes created by the members of the embargoed hardware issue teams working on a specific problem. The current process, while it does work, is "difficult" for many companies to understand and agree with. Because of this, there has been numerous attempts by many companies to work around the process by lies, subterfuge, and other side channels sometimes involving unsuspecting lawyers. Cut all of that out, and put the responsibility of distributing code on the silicon vendor affected, as they already have legal agreements in place that cover this type of distribution. When this distribution happens, the developers involved MUST be notified of this happening, to be kept aware of the situation at all times. The wording here has been hashed out by many different companies and lawyers involved in the process, as well as community members and everyone now agrees that the proposed change here should work better than what is currently happening. This change has been approved by a review from a large number of different open source legal members, representing the companies involved in this process. Link: https://lore.kernel.org/r/2024073035-bagel-vertigo-e0dd@gregkh Co-developed-by: Thomas Gleixner Signed-off-by: Thomas Gleixner Co-developed-by: Michael Dolan Signed-off-by: Michael Dolan Co-developed-by: Greg Kroah-Hartman Signed-off-by: Greg Kroah-Hartman .../process/embargoed-hardware-issues.rst | 31 ++++++++++++++++++++++ 1 file changed, 31 insertions(+) commit a2e4bdca2c361260609d47dff6c0e36ef2b41d4c Author: Greg Kroah-Hartman Date: Tue Jul 30 18:09:31 2024 +0200 Documentation: embargoed-hardware-issues.rst: minor cleanups and fixes The embargoed-hardware-issues.rst file needed a bunch of minor grammar, punctuation, and syntax cleanups based on feedback we have gotten over the past few years. The main change here is the term "silicon" being used over "hardware" to differentiate between companies that make a chip (i.e. a CPU) and those that take the chip and put it into their system. No process changes are made here at all, only clarification for the way the current process works. All of these changes have been approved by a review from a large number of different open source legal members, representing the companies involved in this process. Acked-by: Jonathan Corbet Link: https://lore.kernel.org/r/2024073032-outsource-sniff-e8ea@gregkh Co-developed-by: Thomas Gleixner Signed-off-by: Thomas Gleixner Co-developed-by: Michael Dolan Signed-off-by: Michael Dolan Co-developed-by: Greg Kroah-Hartman Signed-off-by: Greg Kroah-Hartman .../process/embargoed-hardware-issues.rst | 122 +++++++++++---------- 1 file changed, 65 insertions(+), 57 deletions(-) commit cd04d50979502a1a965869dcd246d44db1bf0153 Author: Andrew Ballance Date: Mon Jul 8 19:44:26 2024 -0500 rust: firmware: fix invalid rustdoc link remove an extra quote from the doc comment so that rustdoc no longer genertes a link to a nonexistent file. Signed-off-by: Andrew Ballance Reviewed-by: Danilo Krummrich Acked-by: Miguel Ojeda Fixes: de6582833db0 ("rust: add firmware abstractions") Link: https://lore.kernel.org/r/20240709004426.44854-1-andrewjballance@gmail.com Signed-off-by: Greg Kroah-Hartman rust/kernel/firmware.rs | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit f73cefa3b72eaa90abfc43bf6d68137ba059d4b1 Author: Li Huafei Date: Tue Jul 30 06:09:28 2024 +0800 perf/x86: Fix smp_processor_id()-in-preemptible warnings The following bug was triggered on a system built with CONFIG_DEBUG_PREEMPT=y: # echo p > /proc/sysrq-trigger BUG: using smp_processor_id() in preemptible [00000000] code: sh/117 caller is perf_event_print_debug+0x1a/0x4c0 CPU: 3 UID: 0 PID: 117 Comm: sh Not tainted 6.11.0-rc1 #109 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.13.0-1ubuntu1.1 04/01/2014 Call Trace: dump_stack_lvl+0x4f/0x60 check_preemption_disabled+0xc8/0xd0 perf_event_print_debug+0x1a/0x4c0 __handle_sysrq+0x140/0x180 write_sysrq_trigger+0x61/0x70 proc_reg_write+0x4e/0x70 vfs_write+0xd0/0x430 ? handle_mm_fault+0xc8/0x240 ksys_write+0x9c/0xd0 do_syscall_64+0x96/0x190 entry_SYSCALL_64_after_hwframe+0x4b/0x53 This is because the commit d4b294bf84db ("perf/x86: Hybrid PMU support for counters") took smp_processor_id() outside the irq critical section. If a preemption occurs in perf_event_print_debug() and the task is migrated to another cpu, we may get incorrect pmu debug information. Move smp_processor_id() back inside the irq critical section to fix this issue. Fixes: d4b294bf84db ("perf/x86: Hybrid PMU support for counters") Signed-off-by: Li Huafei Reviewed-and-tested-by: K Prateek Nayak Signed-off-by: Peter Zijlstra (Intel) Reviewed-by: Kan Liang Link: https://lore.kernel.org/r/20240729220928.325449-1-lihuafei1@huawei.com arch/x86/events/core.c | 22 ++++++++++++---------- 1 file changed, 12 insertions(+), 10 deletions(-) commit 224fa3552029a3d14bec7acf72ded8171d551b88 Author: Peter Zijlstra Date: Wed Jul 31 12:43:21 2024 +0200 jump_label: Fix the fix, brown paper bags galore Per the example of: !atomic_cmpxchg(&key->enabled, 0, 1) the inverse was written as: atomic_cmpxchg(&key->enabled, 1, 0) except of course, that while !old is only true for old == 0, old is true for everything except old == 0. Fix it to read: atomic_cmpxchg(&key->enabled, 1, 0) == 1 such that only the 1->0 transition returns true and goes on to disable the keys. Fixes: 83ab38ef0a0b ("jump_label: Fix concurrency issues in static_key_slow_dec()") Reported-by: Darrick J. Wong Signed-off-by: Peter Zijlstra (Intel) Tested-by: Darrick J. Wong Link: https://lkml.kernel.org/r/20240731105557.GY33588@noisy.programming.kicks-ass.net kernel/jump_label.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) commit 6881e75237a84093d0986f56223db3724619f26e Author: Thomas Gleixner Date: Wed Jul 31 12:23:51 2024 +0200 tick/broadcast: Move per CPU pointer access into the atomic section The recent fix for making the take over of the broadcast timer more reliable retrieves a per CPU pointer in preemptible context. This went unnoticed as compilers hoist the access into the non-preemptible region where the pointer is actually used. But of course it's valid that the compiler keeps it at the place where the code puts it which rightfully triggers: BUG: using smp_processor_id() in preemptible [00000000] code: caller is hotplug_cpu__broadcast_tick_pull+0x1c/0xc0 Move it to the actual usage site which is in a non-preemptible region. Fixes: f7d43dd206e7 ("tick/broadcast: Make takeover of broadcast hrtimer reliable") Reported-by: David Wang <00107082@163.com> Signed-off-by: Thomas Gleixner Tested-by: Yu Liao Cc: stable@vger.kernel.org Link: https://lore.kernel.org/all/87ttg56ers.ffs@tglx kernel/time/tick-broadcast.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) commit 6e20753da6bc651e02378a0cdb78f16c42098c88 Author: Max Krummenacher Date: Thu Jul 25 15:20:45 2024 +0200 tty: vt: conmakehash: cope with abs_srctree no longer in env conmakehash uses getenv("abs_srctree") from the environment to strip the absolute path from the generated sources. However since commit e2bad142bb3d ("kbuild: unexport abs_srctree and abs_objtree") this environment variable no longer gets set. Instead use basename() to indicate the used file in a comment of the generated source file. Fixes: 3bd85c6c97b2 ("tty: vt: conmakehash: Don't mention the full path of the input in output") Cc: stable Signed-off-by: Max Krummenacher Link: https://lore.kernel.org/stable/20240725132056.9151-1-max.oss.09%40gmail.com Link: https://lore.kernel.org/r/20240725132056.9151-1-max.oss.09@gmail.com Signed-off-by: Greg Kroah-Hartman drivers/tty/vt/conmakehash.c | 20 +++++++------------- 1 file changed, 7 insertions(+), 13 deletions(-) commit d955d7cecb51b1a3ef4849886f39688aba3f60b3 Merge: f844793f2d37 f8ce49be2743 Author: Rafael J. Wysocki Date: Wed Jul 31 12:31:27 2024 +0200 Merge branch 'thermal-intel' Merge fixes for the int340x thermal driver handling of MSI IRQs: - Fix MSI error path cleanup in int340x, allow it to work with a subset of thermal MSI IRQs if some of them are not working and make it free all MSI IRQs on module exit (Srinivas Pandruvada). * thermal-intel: thermal: intel: int340x: Free MSI IRQ vectors on module exit thermal: intel: int340x: Allow limited thermal MSI support thermal: intel: int340x: Fix kernel warning during MSI cleanup commit 7d3b793faaab1305994ce568b59d61927235f57b Author: Hugo Villeneuve Date: Tue Jul 23 08:53:01 2024 -0400 serial: sc16is7xx: fix invalid FIFO access with special register set When enabling access to the special register set, Receiver time-out and RHR interrupts can happen. In this case, the IRQ handler will try to read from the FIFO thru the RHR register at address 0x00, but address 0x00 is mapped to DLL register, resulting in erroneous FIFO reading. Call graph example: sc16is7xx_startup(): entry sc16is7xx_ms_proc(): entry sc16is7xx_set_termios(): entry sc16is7xx_set_baud(): DLH/DLL = $009C --> access special register set sc16is7xx_port_irq() entry --> IIR is 0x0C sc16is7xx_handle_rx() entry sc16is7xx_fifo_read(): --> unable to access FIFO (RHR) because it is mapped to DLL (LCR=LCR_CONF_MODE_A) sc16is7xx_set_baud(): exit --> Restore access to general register set Fix the problem by claiming the efr_lock mutex when accessing the Special register set. Fixes: dfeae619d781 ("serial: sc16is7xx") Cc: stable@vger.kernel.org Signed-off-by: Hugo Villeneuve Link: https://lore.kernel.org/r/20240723125302.1305372-3-hugo@hugovil.com Signed-off-by: Greg Kroah-Hartman drivers/tty/serial/sc16is7xx.c | 4 ++++ 1 file changed, 4 insertions(+) commit 133f4c00b8b2bfcacead9b81e7e8edfceb4b06c4 Author: Hugo Villeneuve Date: Tue Jul 23 08:53:00 2024 -0400 serial: sc16is7xx: fix TX fifo corruption Sometimes, when a packet is received on channel A at almost the same time as a packet is about to be transmitted on channel B, we observe with a logic analyzer that the received packet on channel A is transmitted on channel B. In other words, the Tx buffer data on channel B is corrupted with data from channel A. The problem appeared since commit 4409df5866b7 ("serial: sc16is7xx: change EFR lock to operate on each channels"), which changed the EFR locking to operate on each channel instead of chip-wise. This commit has introduced a regression, because the EFR lock is used not only to protect the EFR registers access, but also, in a very obscure and undocumented way, to protect access to the data buffer, which is shared by the Tx and Rx handlers, but also by each channel of the IC. Fix this regression first by switching to kfifo_out_linear_ptr() in sc16is7xx_handle_tx() to eliminate the need for a shared Rx/Tx buffer. Secondly, replace the chip-wise Rx buffer with a separate Rx buffer for each channel. Fixes: 4409df5866b7 ("serial: sc16is7xx: change EFR lock to operate on each channels") Cc: stable@vger.kernel.org Signed-off-by: Hugo Villeneuve Link: https://lore.kernel.org/r/20240723125302.1305372-2-hugo@hugovil.com Signed-off-by: Greg Kroah-Hartman drivers/tty/serial/sc16is7xx.c | 21 +++++++++++---------- 1 file changed, 11 insertions(+), 10 deletions(-) commit f844793f2d374ffb7f2231f4d36cd4bc52f12de0 Author: Rafael J. Wysocki Date: Tue Jul 30 16:41:18 2024 +0200 thermal: trip: Avoid skipping trips in thermal_zone_set_trips() Say there are 3 trip points A, B, C sorted in ascending temperature order with no hysteresis. If the zone temerature is exactly equal to B, thermal_zone_set_trips() will set the boundaries to A and C and the hardware will not catch any crossing of B (either way) until either A or C is crossed and the boundaries are changed. To avoid that, use non-strict inequalities when comparing the trip threshold to the zone temperature in thermal_zone_set_trips(). In the example above, it will cause both boundaries to be set to B, which is desirable because an interrupt will trigger when the zone temperature becomes different from B regardless of which way it goes. That will allow a new interval to be set depending on the direction of the zone temperature change. Fixes: 893bae92237d ("thermal: trip: Make thermal_zone_set_trips() use trip thresholds") Signed-off-by: Rafael J. Wysocki Link: https://patch.msgid.link/12509184.O9o76ZdvQC@rjwysocki.net drivers/thermal/thermal_trip.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) commit 6eabce6608d6f3440f4c03aa3d3ef50a47a3d193 Author: George Kennedy Date: Wed Jul 17 07:24:38 2024 -0500 serial: core: check uartclk for zero to avoid divide by zero Calling ioctl TIOCSSERIAL with an invalid baud_base can result in uartclk being zero, which will result in a divide by zero error in uart_get_divisor(). The check for uartclk being zero in uart_set_info() needs to be done before other settings are made as subsequent calls to ioctl TIOCSSERIAL for the same port would be impacted if the uartclk check was done where uartclk gets set. Oops: divide error: 0000 PREEMPT SMP KASAN PTI RIP: 0010:uart_get_divisor (drivers/tty/serial/serial_core.c:580) Call Trace: serial8250_get_divisor (drivers/tty/serial/8250/8250_port.c:2576 drivers/tty/serial/8250/8250_port.c:2589) serial8250_do_set_termios (drivers/tty/serial/8250/8250_port.c:502 drivers/tty/serial/8250/8250_port.c:2741) serial8250_set_termios (drivers/tty/serial/8250/8250_port.c:2862) uart_change_line_settings (./include/linux/spinlock.h:376 ./include/linux/serial_core.h:608 drivers/tty/serial/serial_core.c:222) uart_port_startup (drivers/tty/serial/serial_core.c:342) uart_startup (drivers/tty/serial/serial_core.c:368) uart_set_info (drivers/tty/serial/serial_core.c:1034) uart_set_info_user (drivers/tty/serial/serial_core.c:1059) tty_set_serial (drivers/tty/tty_io.c:2637) tty_ioctl (drivers/tty/tty_io.c:2647 drivers/tty/tty_io.c:2791) __x64_sys_ioctl (fs/ioctl.c:52 fs/ioctl.c:907 fs/ioctl.c:893 fs/ioctl.c:893) do_syscall_64 (arch/x86/entry/common.c:52 (discriminator 1) arch/x86/entry/common.c:83 (discriminator 1)) entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:130) Reported-by: syzkaller Cc: stable@vger.kernel.org Signed-off-by: George Kennedy Rule: add Link: https://lore.kernel.org/stable/1721148848-9784-1-git-send-email-george.kennedy%40oracle.com Link: https://lore.kernel.org/r/1721219078-3209-1-git-send-email-george.kennedy@oracle.com Signed-off-by: Greg Kroah-Hartman drivers/tty/serial/serial_core.c | 8 ++++++++ 1 file changed, 8 insertions(+) commit 3114f77e9453daa292ec0906f313a715c69b5943 Author: Kuppuswamy Sathyanarayanan Date: Tue Jul 30 15:59:30 2024 +0000 platform/x86/intel/ifs: Initialize union ifs_status to zero If the IFS scan test exits prematurely due to a timeout before completing a single run, the union ifs_status remains uninitialized, leading to incorrect test status reporting. To prevent this, always initialize the union ifs_status to zero. Fixes: 2b40e654b73a ("platform/x86/intel/ifs: Add scan test support") Suggested-by: Ilpo Järvinen Reviewed-by: Jithu Joseph Reviewed-by: Ashok Raj Signed-off-by: Kuppuswamy Sathyanarayanan Link: https://lore.kernel.org/r/20240730155930.1754744-1-sathyanarayanan.kuppuswamy@linux.intel.com Reviewed-by: Ilpo Järvinen Signed-off-by: Ilpo Järvinen drivers/platform/x86/intel/ifs/runtest.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 6e73c490445ae77c52f62fcf9a49193d17c6f79a Author: Luis Felipe Hernandez Date: Tue Jul 30 20:15:59 2024 -0400 platform/x86: msi-wmi-platform: Fix spelling mistakes There were a few instances of typos that lead could to confusion when reading. The following words have been corrected: Binay -> Binary singe -> single chaged -> changed Signed-off-by: Luis Felipe Hernandez Reviewed-by: Armin Wolf Acked-by: Randy Dunlap Link: https://lore.kernel.org/r/20240731001602.259338-1-luis.hernandez093@gmail.com Reviewed-by: Ilpo Järvinen Signed-off-by: Ilpo Järvinen Documentation/wmi/devices/msi-wmi-platform.rst | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) commit 3dab73ab925a51ab05543b491bf17463a48ca323 Author: Edmund Raile Date: Tue Jul 30 19:53:29 2024 +0000 Revert "ALSA: firewire-lib: operate for period elapse event in process context" Commit 7ba5ca32fe6e ("ALSA: firewire-lib: operate for period elapse event in process context") removed the process context workqueue from amdtp_domain_stream_pcm_pointer() and update_pcm_pointers() to remove its overhead. With RME Fireface 800, this lead to a regression since Kernels 5.14.0, causing an AB/BA deadlock competition for the substream lock with eventual system freeze under ALSA operation: thread 0: * (lock A) acquire substream lock by snd_pcm_stream_lock_irq() in snd_pcm_status64() * (lock B) wait for tasklet to finish by calling tasklet_unlock_spin_wait() in tasklet_disable_in_atomic() in ohci_flush_iso_completions() of ohci.c thread 1: * (lock B) enter tasklet * (lock A) attempt to acquire substream lock, waiting for it to be released: snd_pcm_stream_lock_irqsave() in snd_pcm_period_elapsed() in update_pcm_pointers() in process_ctx_payloads() in process_rx_packets() of amdtp-stream.c ? tasklet_unlock_spin_wait ohci_flush_iso_completions firewire_ohci amdtp_domain_stream_pcm_pointer snd_firewire_lib snd_pcm_update_hw_ptr0 snd_pcm snd_pcm_status64 snd_pcm ? native_queued_spin_lock_slowpath _raw_spin_lock_irqsave snd_pcm_period_elapsed snd_pcm process_rx_packets snd_firewire_lib irq_target_callback snd_firewire_lib handle_it_packet firewire_ohci context_tasklet firewire_ohci Restore the process context work queue to prevent deadlock AB/BA deadlock competition for ALSA substream lock of snd_pcm_stream_lock_irq() in snd_pcm_status64() and snd_pcm_stream_lock_irqsave() in snd_pcm_period_elapsed(). revert commit 7ba5ca32fe6e ("ALSA: firewire-lib: operate for period elapse event in process context") Replace inline description to prevent future deadlock. Cc: stable@vger.kernel.org Fixes: 7ba5ca32fe6e ("ALSA: firewire-lib: operate for period elapse event in process context") Reported-by: edmund.raile Closes: https://lore.kernel.org/r/kwryofzdmjvzkuw6j3clftsxmoolynljztxqwg76hzeo4simnl@jn3eo7pe642q/ Signed-off-by: Edmund Raile Reviewed-by: Takashi Sakamoto Signed-off-by: Takashi Iwai Link: https://patch.msgid.link/20240730195318.869840-3-edmund.raile@protonmail.com sound/firewire/amdtp-stream.c | 23 +++++++++-------------- 1 file changed, 9 insertions(+), 14 deletions(-) commit 6ccf9984d6be3c2f804087b736db05c2ec42664b Author: Edmund Raile Date: Tue Jul 30 19:53:26 2024 +0000 Revert "ALSA: firewire-lib: obsolete workqueue for period update" prepare resolution of AB/BA deadlock competition for substream lock: restore workqueue previously used for process context: revert commit b5b519965c4c ("ALSA: firewire-lib: obsolete workqueue for period update") Cc: stable@vger.kernel.org Link: https://lore.kernel.org/r/kwryofzdmjvzkuw6j3clftsxmoolynljztxqwg76hzeo4simnl@jn3eo7pe642q/ Signed-off-by: Edmund Raile Reviewed-by: Takashi Sakamoto Signed-off-by: Takashi Iwai Link: https://patch.msgid.link/20240730195318.869840-2-edmund.raile@protonmail.com sound/firewire/amdtp-stream.c | 15 +++++++++++++++ sound/firewire/amdtp-stream.h | 1 + 2 files changed, 16 insertions(+) commit b1dad2f091382b0049c72dab8153779248fa8016 Author: Harshit Mogalapalli Date: Wed Jul 24 09:23:51 2024 -0700 usb: typec: tipd: Delete extra semi-colon There shouldn't be a ; at the end of the function, delete it. Signed-off-by: Harshit Mogalapalli Reviewed-by: Javier Carrasco Reviewed-by: Heikki Krogerus Link: https://lore.kernel.org/r/20240724162356.992763-2-harshit.m.mogalapalli@oracle.com Signed-off-by: Greg Kroah-Hartman drivers/usb/typec/tipd/core.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 8290b567621ba4e3ccf45ec9d67e0507196c5ddc Author: Harshit Mogalapalli Date: Wed Jul 24 09:23:50 2024 -0700 usb: typec: tipd: Fix dereferencing freeing memory in tps6598x_apply_patch() release_firmware() already frees fw, fix this my moving release_firmware after the dereference. Fixes: 916b8e5fa73d ("usb: typec: tipd: add error log to provide firmware name and size") Signed-off-by: Harshit Mogalapalli Reviewed-by: Heikki Krogerus Reviewed-by: Javier Carrasco Link: https://lore.kernel.org/r/20240724162356.992763-1-harshit.m.mogalapalli@oracle.com Signed-off-by: Greg Kroah-Hartman drivers/usb/typec/tipd/core.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 5a444bea37e2759549ef72bfe83d1c8712e76b3d Author: Prashanth K Date: Tue Jul 30 18:27:54 2024 +0530 usb: gadget: u_serial: Set start_delayed during suspend Upstream commit aba3a8d01d62 ("usb: gadget: u_serial: add suspend resume callbacks") added started_delayed flag, so that new ports which are opened after USB suspend can start IO while resuming. But if the port was already opened, and gadget suspend kicks in afterwards, start_delayed will never be set. This causes resume to bail out before calling gs_start_io(). Fix this by setting start_delayed during suspend. Fixes: aba3a8d01d62 ("usb: gadget: u_serial: add suspend resume callbacks") Cc: stable@vger.kernel.org Signed-off-by: Prashanth K Link: https://lore.kernel.org/r/20240730125754.576326-1-quic_prashk@quicinc.com Signed-off-by: Greg Kroah-Hartman drivers/usb/gadget/function/u_serial.c | 1 + 1 file changed, 1 insertion(+) commit 3c526089a663e25ac78b6a61d84a52a83680d0c3 Author: Dan Carpenter Date: Fri Jul 12 09:05:50 2024 -0500 usb: typec: tcpci: Fix error code in tcpci_check_std_output_cap() The tcpci_check_std_output_cap() function is supposed to return negative error codes but it's declared as type bool so the error handling doesn't work. Declare it as an int instead. Fixes: 62ce9ef14797 ("usb: typec: tcpci: add support to set connector orientation") Signed-off-by: Dan Carpenter Reviewed-by: Heikki Krogerus Reviewed-by: Marco Felsch Link: https://lore.kernel.org/r/b0880888-6719-4614-91fc-8ee63b71d304@stanley.mountain Signed-off-by: Greg Kroah-Hartman drivers/usb/typec/tcpm/tcpci.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit e885f5f1f2b43575aa8e4e31404132d77d6663d1 Author: Konrad Dybcio Date: Mon Jul 29 10:42:58 2024 +0200 usb: typec: fsa4480: Check if the chip is really there Currently, the driver will happily register the switch/mux devices, and so long as the i2c master doesn't complain, the user would never know there's something wrong. Add a device id check (based on [1]) and return -ENODEV if the read fails or returns nonsense. Checking the value on a Qualcomm SM6115P-based Lenovo Tab P11 tablet, the ID mentioned in the datasheet does indeed show up: fsa4480 1-0042: Found FSA4480 v1.1 (Vendor ID = 0) [1] https://www.onsemi.com/pdf/datasheet/fsa4480-d.pdf Fixes: 1dc246320c6b ("usb: typec: mux: Add On Semi fsa4480 driver") Cc: stable Reviewed-by: Dmitry Baryshkov Signed-off-by: Konrad Dybcio Link: https://lore.kernel.org/r/20240729-topic-fs4480_check-v3-1-f5bf732d3424@kernel.org Signed-off-by: Greg Kroah-Hartman drivers/usb/typec/mux/fsa4480.c | 14 ++++++++++++++ 1 file changed, 14 insertions(+) commit 973a57891608a98e894db2887f278777f564de18 Author: Chris Wulff Date: Wed Jul 24 21:04:20 2024 -0400 usb: gadget: core: Check for unset descriptor Make sure the descriptor has been set before looking at maxpacket. This fixes a null pointer panic in this case. This may happen if the gadget doesn't properly set up the endpoint for the current speed, or the gadget descriptors are malformed and the descriptor for the speed/endpoint are not found. No current gadget driver is known to have this problem, but this may cause a hard-to-find bug during development of new gadgets. Fixes: 54f83b8c8ea9 ("USB: gadget: Reject endpoints with 0 maxpacket value") Cc: stable@vger.kernel.org Signed-off-by: Chris Wulff Link: https://lore.kernel.org/r/20240725010419.314430-2-crwulff@gmail.com Signed-off-by: Greg Kroah-Hartman drivers/usb/gadget/udc/core.c | 10 ++++------ 1 file changed, 4 insertions(+), 6 deletions(-) commit afdcfd3d6fcdeca2735ca8d994c5f2d24a368f0a Author: Oliver Neukum Date: Tue Jul 9 13:38:41 2024 +0200 usb: vhci-hcd: Do not drop references before new references are gained At a few places the driver carries stale pointers to references that can still be used. Make sure that does not happen. This strictly speaking closes ZDI-CAN-22273, though there may be similar races in the driver. Signed-off-by: Oliver Neukum Cc: stable Acked-by: Shuah Khan Link: https://lore.kernel.org/r/20240709113851.14691-1-oneukum@suse.com Signed-off-by: Greg Kroah-Hartman drivers/usb/usbip/vhci_hcd.c | 9 ++++++--- 1 file changed, 6 insertions(+), 3 deletions(-) commit 76a7bfc445b8e9893c091e24ccfd4f51dfdc0a70 Author: Chris Wulff Date: Sun Jul 21 15:23:15 2024 -0400 usb: gadget: u_audio: Check return codes from usb_ep_enable and config_ep_by_speed. These functions can fail if descriptors are malformed, or missing, for the selected USB speed. Fixes: eb9fecb9e69b ("usb: gadget: f_uac2: split out audio core") Fixes: 24f779dac8f3 ("usb: gadget: f_uac2/u_audio: add feedback endpoint support") Cc: stable@vger.kernel.org Signed-off-by: Chris Wulff Link: https://lore.kernel.org/r/20240721192314.3532697-2-crwulff@gmail.com Signed-off-by: Greg Kroah-Hartman drivers/usb/gadget/function/u_audio.c | 42 ++++++++++++++++++++++++++++------- 1 file changed, 34 insertions(+), 8 deletions(-) commit 228a953e61d6d608a3facc1c3a27b9fb03c99de7 Author: Takashi Iwai Date: Wed Jul 17 11:50:53 2024 +0200 usb: gadget: midi2: Fix the response for FB info with block 0xff When the block number 0xff is given to Function Block Discovery message, the device should return the information of all Function Blocks, but currently the gadget driver treats it as an error. Implement the proper behavior for the block 0xff instead. Fixes: 8b645922b223 ("usb: gadget: Add support for USB MIDI 2.0 function driver") Cc: stable@vger.kernel.org Signed-off-by: Takashi Iwai Link: https://lore.kernel.org/r/20240717095102.10493-1-tiwai@suse.de Signed-off-by: Greg Kroah-Hartman drivers/usb/gadget/function/f_midi2.c | 21 +++++++++++++++------ 1 file changed, 15 insertions(+), 6 deletions(-) commit 16d731890db94e23d5483402494ef378f2271ba1 Author: Alexander Stein Date: Wed Jul 31 09:19:50 2024 +0200 dt-bindings: usb: microchip,usb2514: Add USB2517 compatible USB2517 is a 7-port variant of this USB hub. Add an USB compatible based on USB vendor & product ID. Signed-off-by: Alexander Stein Acked-by: Krzysztof Kozlowski Link: https://lore.kernel.org/r/20240731071950.989113-1-alexander.stein@ew.tq-group.com Signed-off-by: Greg Kroah-Hartman Documentation/devicetree/bindings/usb/microchip,usb2514.yaml | 1 + 1 file changed, 1 insertion(+) commit 3ca06e90a7ceb06aaba8a9dc1c59d970824dab23 Merge: 8400291e289e df8c0b8a03e8 Author: Greg Kroah-Hartman Date: Wed Jul 31 10:16:19 2024 +0200 Merge tag 'usb-serial-6.11-rc1' of ssh://gitolite.kernel.org/pub/scm/linux/kernel/git/johan/usb-serial into usb-linus Johan writes: USB-serial updates for 6.11-rc1 Here are the USB-serial updates for 6.11-rc1, including: - add missing module descriptions - add flexible array annotation in garmin_gps Included are also various clean ups. All have been in linux-next with no reported issues. * tag 'usb-serial-6.11-rc1' of ssh://gitolite.kernel.org/pub/scm/linux/kernel/git/johan/usb-serial: USB: serial: garmin_gps: use struct_size() to allocate pkt USB: serial: garmin_gps: annotate struct garmin_packet with __counted_by USB: serial: add missing MODULE_DESCRIPTION() macros USB: serial: spcp8x5: remove unused struct 'spcp8x5_usb_ctrl_arg' commit e4fc196f5ba36eb7b9758cf2c73df49a44199895 Merge: e254e0c5baea b8e947e9f64c Author: Linus Torvalds Date: Tue Jul 30 19:28:36 2024 -0700 Merge tag 'for-6.11-rc1-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/kdave/linux Pull btrfs fixes from David Sterba: - fix regression in extent map rework when handling insertion of overlapping compressed extent - fix unexpected file length when appending to a file using direct io and buffer not faulted in - in zoned mode, fix accounting of unusable space when flipping read-only block group back to read-write - fix page locking when COWing an inline range, assertion failure found by syzbot - fix calculation of space info in debugging print - tree-checker, add validation of data reference item - fix a few -Wmaybe-uninitialized build warnings * tag 'for-6.11-rc1-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/kdave/linux: btrfs: initialize location to fix -Wmaybe-uninitialized in btrfs_lookup_dentry() btrfs: fix corruption after buffer fault in during direct IO append write btrfs: zoned: fix zone_unusable accounting on making block group read-write again btrfs: do not subtract delalloc from avail bytes btrfs: make cow_file_range_inline() honor locked_page on error btrfs: fix corrupt read due to bad offset of a compressed extent map btrfs: tree-checker: validate dref root and objectid commit e254e0c5baeae28717d1b312821e6ded29e7d969 Merge: c91a7dee0555 d27087c76e3c Author: Linus Torvalds Date: Tue Jul 30 19:22:41 2024 -0700 Merge tag 'perf-tools-fixes-for-v6.11-2024-07-30' of git://git.kernel.org/pub/scm/linux/kernel/git/perf/perf-tools Pull perf tools fixes from Namhyung Kim: "Some more build fixes and a random crash fix: - Fix cross-build by setting pkg-config env according to the arch - Fix static build for missing library dependencies - Fix Segfault when callchain has no symbols" * tag 'perf-tools-fixes-for-v6.11-2024-07-30' of git://git.kernel.org/pub/scm/linux/kernel/git/perf/perf-tools: perf docs: Document cross compilation perf: build: Link lib 'zstd' for static build perf: build: Link lib 'lzma' for static build perf: build: Only link libebl.a for old libdw perf: build: Set Python configuration for cross compilation perf: build: Setup PKG_CONFIG_LIBDIR for cross compilation perf tool: fix dereferencing NULL al->maps commit 0bf50cead4c4710d9f704778c32ab8af47ddf070 Merge: 89add40066f9 963fb4612295 Author: Jakub Kicinski Date: Tue Jul 30 18:41:10 2024 -0700 Merge branch '100GbE' of git://git.kernel.org/pub/scm/linux/kernel/git/tnguy/net-queue Tony Nguyen says: ==================== ice: fix AF_XDP ZC timeout and concurrency issues Maciej Fijalkowski says: Changes included in this patchset address an issue that customer has been facing when AF_XDP ZC Tx sockets were used in combination with flow control and regular Tx traffic. After executing: ethtool --set-priv-flags $dev link-down-on-close on ethtool -A $dev rx on tx on launching multiple ZC Tx sockets on $dev + pinging remote interface (so that regular Tx traffic is present) and then going through down/up of $dev, Tx timeout occurred and then most of the time ice driver was unable to recover from that state. These patches combined together solve the described above issue on customer side. Main focus here is to forbid producing Tx descriptors when either carrier is not yet initialized or process of bringing interface down has already started. v1: https://lore.kernel.org/netdev/20240708221416.625850-1-anthony.l.nguyen@intel.com/ * '100GbE' of git://git.kernel.org/pub/scm/linux/kernel/git/tnguy/net-queue: ice: xsk: fix txq interrupt mapping ice: add missing WRITE_ONCE when clearing ice_rx_ring::xdp_prog ice: improve updating ice_{t,r}x_ring::xsk_pool ice: toggle netif_carrier when setting up XSK pool ice: modify error handling when setting XSK pool in ndo_bpf ice: replace synchronize_rcu with synchronize_net ice: don't busy wait for Rx queue disable in ice_qp_dis() ice: respect netif readiness in AF_XDP ZC related ndo's ==================== Link: https://patch.msgid.link/20240729200716.681496-1-anthony.l.nguyen@intel.com Signed-off-by: Jakub Kicinski commit 89add40066f9ed9abe5f7f886fe5789ff7e0c50e Author: Willem de Bruijn Date: Mon Jul 29 16:10:12 2024 -0400 net: drop bad gso csum_start and offset in virtio_net_hdr Tighten csum_start and csum_offset checks in virtio_net_hdr_to_skb for GSO packets. The function already checks that a checksum requested with VIRTIO_NET_HDR_F_NEEDS_CSUM is in skb linear. But for GSO packets this might not hold for segs after segmentation. Syzkaller demonstrated to reach this warning in skb_checksum_help offset = skb_checksum_start_offset(skb); ret = -EINVAL; if (WARN_ON_ONCE(offset >= skb_headlen(skb))) By injecting a TSO packet: WARNING: CPU: 1 PID: 3539 at net/core/dev.c:3284 skb_checksum_help+0x3d0/0x5b0 ip_do_fragment+0x209/0x1b20 net/ipv4/ip_output.c:774 ip_finish_output_gso net/ipv4/ip_output.c:279 [inline] __ip_finish_output+0x2bd/0x4b0 net/ipv4/ip_output.c:301 iptunnel_xmit+0x50c/0x930 net/ipv4/ip_tunnel_core.c:82 ip_tunnel_xmit+0x2296/0x2c70 net/ipv4/ip_tunnel.c:813 __gre_xmit net/ipv4/ip_gre.c:469 [inline] ipgre_xmit+0x759/0xa60 net/ipv4/ip_gre.c:661 __netdev_start_xmit include/linux/netdevice.h:4850 [inline] netdev_start_xmit include/linux/netdevice.h:4864 [inline] xmit_one net/core/dev.c:3595 [inline] dev_hard_start_xmit+0x261/0x8c0 net/core/dev.c:3611 __dev_queue_xmit+0x1b97/0x3c90 net/core/dev.c:4261 packet_snd net/packet/af_packet.c:3073 [inline] The geometry of the bad input packet at tcp_gso_segment: [ 52.003050][ T8403] skb len=12202 headroom=244 headlen=12093 tailroom=0 [ 52.003050][ T8403] mac=(168,24) mac_len=24 net=(192,52) trans=244 [ 52.003050][ T8403] shinfo(txflags=0 nr_frags=1 gso(size=1552 type=3 segs=0)) [ 52.003050][ T8403] csum(0x60000c7 start=199 offset=1536 ip_summed=3 complete_sw=0 valid=0 level=0) Mitigate with stricter input validation. csum_offset: for GSO packets, deduce the correct value from gso_type. This is already done for USO. Extend it to TSO. Let UFO be: udp[46]_ufo_fragment ignores these fields and always computes the checksum in software. csum_start: finding the real offset requires parsing to the transport header. Do not add a parser, use existing segmentation parsing. Thanks to SKB_GSO_DODGY, that also catches bad packets that are hw offloaded. Again test both TSO and USO. Do not test UFO for the above reason, and do not test UDP tunnel offload. GSO packet are almost always CHECKSUM_PARTIAL. USO packets may be CHECKSUM_NONE since commit 10154dbded6d6 ("udp: Allow GSO transmit from devices with no checksum offload"), but then still these fields are initialized correctly in udp4_hwcsum/udp6_hwcsum_outgoing. So no need to test for ip_summed == CHECKSUM_PARTIAL first. This revises an existing fix mentioned in the Fixes tag, which broke small packets with GSO offload, as detected by kselftests. Link: https://syzkaller.appspot.com/bug?extid=e1db31216c789f552871 Link: https://lore.kernel.org/netdev/20240723223109.2196886-1-kuba@kernel.org Fixes: e269d79c7d35 ("net: missing check virtio") Cc: stable@vger.kernel.org Signed-off-by: Willem de Bruijn Link: https://patch.msgid.link/20240729201108.1615114-1-willemdebruijn.kernel@gmail.com Signed-off-by: Jakub Kicinski include/linux/virtio_net.h | 16 +++++----------- net/ipv4/tcp_offload.c | 3 +++ net/ipv4/udp_offload.c | 4 ++++ 3 files changed, 12 insertions(+), 11 deletions(-) commit a7f3abcf635767b2e19c4c55c4c35756595ebc86 Author: Bartosz Golaszewski Date: Mon Jul 29 17:03:14 2024 +0200 net: phy: aquantia: only poll GLOBAL_CFG regs on aqr113, aqr113c and aqr115c Commit 708405f3e56e ("net: phy: aquantia: wait for the GLOBAL_CFG to start returning real values") introduced a workaround for an issue observed on aqr115c. However there were never any reports of it happening on other models and the workaround has been reported to cause and issue on aqr113c (and it may cause the same on any other model not supporting 10M mode). Let's limit the impact of the workaround to aqr113, aqr113c and aqr115c and poll the 100M GLOBAL_CFG register instead as both models are known to support it correctly. Reported-by: Jon Hunter Closes: https://lore.kernel.org/lkml/7c0140be-4325-4005-9068-7e0fc5ff344d@nvidia.com/ Fixes: 708405f3e56e ("net: phy: aquantia: wait for the GLOBAL_CFG to start returning real values") Tested-by: Jon Hunter Signed-off-by: Bartosz Golaszewski Reviewed-by: Antoine Tenart Link: https://patch.msgid.link/20240729150315.65798-1-brgl@bgdev.pl Signed-off-by: Jakub Kicinski drivers/net/phy/aquantia/aquantia_main.c | 29 +++++++++++++++++++++-------- 1 file changed, 21 insertions(+), 8 deletions(-) commit e61dd678601eac53d501dda1eb1bcffec7b11bd6 Author: Kent Overstreet Date: Tue Jul 30 18:21:32 2024 -0400 bcachefs: Fix double free of ca->buckets_nouse Reported-by: Dan Carpenter Fixes: ffcbec6076 ("bcachefs: Kill opts.buckets_nouse") Signed-off-by: Kent Overstreet fs/bcachefs/super.c | 1 - 1 file changed, 1 deletion(-) commit 84383b5ef4cd21b4a67de92afdc05a03b5247db9 Author: Raju Lakkaraju Date: Thu Jul 25 12:41:25 2024 +0530 net: phy: micrel: Fix the KSZ9131 MDI-X status issue The MDIX status is not accurately reflecting the current state after the link partner has manually altered its MDIX configuration while operating in forced mode. Access information about Auto mdix completion and pair selection from the KSZ9131's Auto/MDI/MDI-X status register Fixes: b64e6a8794d9 ("net: phy: micrel: Add PHY Auto/MDI/MDI-X set driver for KSZ9131") Signed-off-by: Raju Lakkaraju Reviewed-by: Andrew Lunn Link: https://patch.msgid.link/20240725071125.13960-1-Raju.Lakkaraju@microchip.com Signed-off-by: Jakub Kicinski drivers/net/phy/micrel.c | 34 +++++++++++++++++++--------------- 1 file changed, 19 insertions(+), 15 deletions(-) commit 7764b9622db4382b2797b54a70f292c8da6ef417 Author: Jiri Olsa Date: Fri Jul 26 20:08:47 2024 +0200 bpf/selftests: Fix ASSERT_OK condition check in uprobe_syscall test Fixing ASSERT_OK condition check in uprobe_syscall test, otherwise we return from test on pipe success. Signed-off-by: Jiri Olsa Signed-off-by: Andrii Nakryiko Acked-by: Yonghong Song Link: https://lore.kernel.org/bpf/20240726180847.684584-1-jolsa@kernel.org tools/testing/selftests/bpf/prog_tests/uprobe_syscall.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit c91a7dee0555f6f9d3702d86312382e4c4729d0a Merge: 22f546873149 df615907f1bf Author: Linus Torvalds Date: Tue Jul 30 12:53:52 2024 -0700 Merge tag 'chrome-platform-fixes-for-v6.11-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/chrome-platform/linux Pull chrome-platform fix from Tzung-Bi Shih: "Fix a race condition that sends multiple host commands at a time" * tag 'chrome-platform-fixes-for-v6.11-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/chrome-platform/linux: platform/chrome: cros_ec_proto: Lock device when updating MKBP version commit fce6a1eefb2a1db706fa17ca21e3e7107811d2e8 Author: Konrad Dybcio Date: Fri Jul 26 13:18:24 2024 +0200 MAINTAINERS: Update Konrad Dybcio's email address Use my @kernel.org address everywhere. Signed-off-by: Konrad Dybcio Signed-off-by: Konrad Dybcio Acked-by: Neil Armstrong Link: https://lore.kernel.org/r/20240726-topic-konrad_email-v1-2-f94665da2919@kernel.org Signed-off-by: Bjorn Andersson MAINTAINERS | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) commit 72c93f3e0dcdc05fceafcb32e79352a45716d181 Author: Konrad Dybcio Date: Fri Jul 26 13:18:23 2024 +0200 mailmap: Add an entry for Konrad Dybcio Map my old addresses. Signed-off-by: Konrad Dybcio Signed-off-by: Konrad Dybcio Acked-by: Neil Armstrong Link: https://lore.kernel.org/r/20240726-topic-konrad_email-v1-1-f94665da2919@kernel.org Signed-off-by: Bjorn Andersson .mailmap | 2 ++ 1 file changed, 2 insertions(+) commit 6be6cba9c4371d27f78d900ccfe34bb880d9ee20 Author: Yipeng Zou Date: Tue Jul 30 09:44:00 2024 +0800 irqchip/mbigen: Fix mbigen node address layout The mbigen interrupt chip has its per node registers located in a contiguous region of page sized chunks. The code maps them into virtual address space as a contiguous region and determines the address of a node by using the node ID as index. mbigen chip |-----------------|------------|--------------| mgn_node_0 mgn_node_1 ... mgn_node_i |--------------| |--------------| |----------------------| [0x0000, 0x0x0FFF] [0x1000, 0x1FFF] [i*0x1000, (i+1)*0x1000 - 1] This works correctly up to 10 nodes, but then fails because the 11th's array slot is used for the MGN_CLEAR registers. mbigen chip |-----------|--------|--------|---------------|--------| mgn_node_0 mgn_node_1 ... mgn_clear_register ... mgn_node_i |-----------------| [0xA000, 0xAFFF] Skip the MGN_CLEAR register space when calculating the offset for node IDs greater than or equal to ten. Fixes: a6c2f87b8820 ("irqchip/mbigen: Implement the mbigen irq chip operation functions") Signed-off-by: Yipeng Zou Signed-off-by: Thomas Gleixner Link: https://lore.kernel.org/all/20240730014400.1751530-1-zouyipeng@huawei.com drivers/irqchip/irq-mbigen.c | 20 ++++++++++++++++---- 1 file changed, 16 insertions(+), 4 deletions(-) commit 22f5468731491e53356ba7c028f0fdea20b18e2c Author: Linus Torvalds Date: Tue Jul 30 10:36:47 2024 -0700 minmax: improve macro expansion and type checking This clarifies the rules for min()/max()/clamp() type checking and makes them a much more efficient macro expansion. In particular, we now look at the type and range of the inputs to see whether they work together, generating a mask of acceptable comparisons, and then just verifying that the inputs have a shared case: - an expression with a signed type can be used for (1) signed comparisons (2) unsigned comparisons if it is statically known to have a non-negative value - an expression with an unsigned type can be used for (3) unsigned comparison (4) signed comparisons if the type is smaller than 'int' and thus the C integer promotion rules will make it signed anyway Here rule (1) and (3) are obvious, and rule (2) is important in order to allow obvious trivial constants to be used together with unsigned values. Rule (4) is not necessarily a good idea, but matches what we used to do, and we have extant cases of this situation in the kernel. Notably with bcachefs having an expression like min(bch2_bucket_sectors_dirty(a), ca->mi.bucket_size) where bch2_bucket_sectors_dirty() returns an 's64', and 'ca->mi.bucket_size' is of type 'u16'. Technically that bcachefs comparison is clearly sensible on a C type level, because the 'u16' will go through the normal C integer promotion, and become 'int', and then we're comparing two signed values and everything looks sane. However, it's not entirely clear that a 'min(s64,u16)' operation makes a lot of conceptual sense, and it's possible that we will remove rule (4). After all, the _reason_ we have these complicated type checks is exactly that the C type promotion rules are not very intuitive. But at least for now the rule is in place for backwards compatibility. Also note that rule (2) existed before, but is hugely relaxed by this commit. It used to be true only for the simplest compile-time non-negative integer constants. The new macro model will allow cases where the compiler can trivially see that an expression is non-negative even if it isn't necessarily a constant. For example, the amdgpu driver does min_t(size_t, sizeof(fru_info->serial), pia[addr] & 0x3F)); because our old 'min()' macro would see that 'pia[addr] & 0x3F' is of type 'int' and clearly not a C constant expression, so doing a 'min()' with a 'size_t' is a signedness violation. Our new 'min()' macro still sees that 'pia[addr] & 0x3F' is of type 'int', but is smart enough to also see that it is clearly non-negative, and thus would allow that case without any complaints. Cc: Arnd Bergmann Cc: David Laight Cc: Lorenzo Stoakes Signed-off-by: Linus Torvalds include/linux/compiler.h | 9 ++++++ include/linux/minmax.h | 74 ++++++++++++++++++++++++++++++++++++++---------- 2 files changed, 68 insertions(+), 15 deletions(-) commit e4c4638b6a10427d30e29d22351c375886025f47 Author: Geert Uytterhoeven Date: Tue Jul 30 15:35:47 2024 +0200 spi: spidev: Add missing spi_device_id for bh2228fv When the of_device_id entry for "rohm,bh2228fv" was added, the corresponding spi_device_id was forgotten, causing a warning message during boot-up: SPI driver spidev has no spi_device_id for rohm,bh2228fv Fix module autoloading and shut up the warning by adding the missing entry. Fixes: fc28d1c1fe3b3e2f ("spi: spidev: add correct compatible for Rohm BH2228FV") Signed-off-by: Geert Uytterhoeven Link: https://patch.msgid.link/cb571d4128f41175f31319cd9febc829417ea167.1722346539.git.geert+renesas@glider.be Signed-off-by: Mark Brown drivers/spi/spidev.c | 1 + 1 file changed, 1 insertion(+) commit af441750df42f610bd308c579a9c1ec84ee2b3c6 Merge: e2d124de0017 aa4f76ef09a9 Author: Mark Brown Date: Tue Jul 30 17:01:12 2024 +0100 ASoC: fsl_micfil: Check the difference for i.MX8 and Merge series from Shengjiu Wang : There are some register difference for i.MX8 and i.MX9 REG_MICFIL_FIFO_CTRL definition is updated. REG_MICFIL_FSYNC_CTRL, REG_MICFIL_VERID, REG_MICFIL_PARAM are added from i.MX9. commit 0aa3ca956c46d849775eae1816cef8fe4bc8b50e Author: Dan Carpenter Date: Wed Jul 24 11:06:56 2024 -0500 net: mvpp2: Don't re-use loop iterator This function has a nested loop. The problem is that both the inside and outside loop use the same variable as an iterator. I found this via static analysis so I'm not sure the impact. It could be that it loops forever or, more likely, the loop exits early. Fixes: 3a616b92a9d1 ("net: mvpp2: Add TX flow control support for jumbo frames") Signed-off-by: Dan Carpenter Reviewed-by: Simon Horman Link: https://patch.msgid.link/eaa8f403-7779-4d81-973d-a9ecddc0bf6f@stanley.mountain Signed-off-by: Jakub Kicinski drivers/net/ethernet/marvell/mvpp2/mvpp2_main.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) commit f8ce49be2743541bdc9e184fab1cfd736031ab66 Author: Srinivas Pandruvada Date: Tue Jul 23 07:02:28 2024 -0700 thermal: intel: int340x: Free MSI IRQ vectors on module exit On module exit call proc_thermal_free_msi() to free vectors allocated by pci_alloc_irq_vectors(). Fixes: 7a9a8c5faf41 ("thermal: intel: int340x: Support MSI interrupt for Lunar Lake") Signed-off-by: Srinivas Pandruvada Reviewed-by: Zhang Rui Link: https://patch.msgid.link/20240723140228.865919-4-srinivas.pandruvada@linux.intel.com Signed-off-by: Rafael J. Wysocki drivers/thermal/intel/int340x_thermal/processor_thermal_device_pci.c | 3 +++ 1 file changed, 3 insertions(+) commit b85a2d300a37641456c238591a056404436675c2 Author: Srinivas Pandruvada Date: Tue Jul 23 07:02:27 2024 -0700 thermal: intel: int340x: Allow limited thermal MSI support On some Lunar Lake pre-production systems, not all the MSI thermal vectors are valid. In that case instead of failing module load, continue with partial thermal interrupt support. pci_alloc_irq_vectors() can return less than expected maximum vectors. In that case call devm_request_threaded_irq() only for current maximum vectors. Fixes: 7a9a8c5faf41 ("thermal: intel: int340x: Support MSI interrupt for Lunar Lake") Reported-by: Yijun Shen Tested-by: Yijun Shen Signed-off-by: Srinivas Pandruvada Reviewed-by: Zhang Rui Link: https://patch.msgid.link/20240723140228.865919-3-srinivas.pandruvada@linux.intel.com Signed-off-by: Rafael J. Wysocki .../intel/int340x_thermal/processor_thermal_device_pci.c | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) commit b630a04121519c0f93f9cc8994147191cc3c17b4 Author: Srinivas Pandruvada Date: Tue Jul 23 07:02:26 2024 -0700 thermal: intel: int340x: Fix kernel warning during MSI cleanup On some pre-production Lunar Lake systems, there is a kernel warning: remove_proc_entry: removing non-empty directory 'irq/172' WARNING: CPU: 0 PID: 501 at fs/proc/generic.c:717 remove_proc_entry+0x1b4/0x1e0 ... ... remove_proc_entry+0x1b4/0x1e0 report_bug+0x182/0x1b0 handle_bug+0x51/0xa0 exc_invalid_op+0x18/0x80 asm_exc_invalid_op+0x1b/0x20 remove_proc_entry+0x1b4/0x1e0 remove_proc_entry+0x1b4/0x1e0 unregister_irq_proc+0xf2/0x120 free_desc+0x41/0xe0 irq_domain_free_irqs+0x138/0x1c0 irq_free_descs+0x52/0x80 irq_domain_free_irqs+0x151/0x1c0 msi_domain_free_locked.part.0+0x17e/0x1c0 msi_domain_free_irqs_all_locked+0x74/0xc0 pci_msi_teardown_msi_irqs+0x50/0x60 pci_free_msi_irqs+0x12/0x40 pci_free_irq_vectors+0x58/0x70 On these systems, not all the MSI thermal vectors are valid. This causes devm_request_threaded_irq() to fail for some vectors. As part of the clean up on this error, pci_free_irq_vectors() is called without calling devm_free_irq(). This causes the above warning. Add a function proc_thermal_free_msi() to call devm_free_irq() for all successfully registered IRQ handlers, then call pci_free_irq_vectors(). Call this function for MSI cleanup. Fixes: 7a9a8c5faf41 ("thermal: intel: int340x: Support MSI interrupt for Lunar Lake") Reported-by: Yijun Shen Tested-by: Yijun Shen Signed-off-by: Srinivas Pandruvada Reviewed-by: Zhang Rui Link: https://patch.msgid.link/20240723140228.865919-2-srinivas.pandruvada@linux.intel.com Signed-off-by: Rafael J. Wysocki .../intel/int340x_thermal/processor_thermal_device_pci.c | 16 ++++++++++++++-- 1 file changed, 14 insertions(+), 2 deletions(-) commit 5b511572660190db1dc8ba412efd0be0d3781ab6 Author: Nikita Zhandarovich Date: Mon Jul 29 10:40:35 2024 -0700 drm/i915: Fix possible int overflow in skl_ddi_calculate_wrpll() On the off chance that clock value ends up being too high (by means of skl_ddi_calculate_wrpll() having been called with big enough value of crtc_state->port_clock * 1000), one possible consequence may be that the result will not be able to fit into signed int. Fix this issue by moving conversion of clock parameter from kHz to Hz into the body of skl_ddi_calculate_wrpll(), as well as casting the same parameter to u64 type while calculating the value for AFE clock. This both mitigates the overflow problem and avoids possible erroneous integer promotion mishaps. Found by Linux Verification Center (linuxtesting.org) with static analysis tool SVACE. Fixes: 82d354370189 ("drm/i915/skl: Implementation of SKL DPLL programming") Cc: stable@vger.kernel.org Signed-off-by: Nikita Zhandarovich Reviewed-by: Jani Nikula Signed-off-by: Jani Nikula Link: https://patchwork.freedesktop.org/patch/msgid/20240729174035.25727-1-n.zhandarovich@fintech.ru (cherry picked from commit 833cf12846aa19adf9b76bc79c40747726f3c0c1) Signed-off-by: Joonas Lahtinen drivers/gpu/drm/i915/display/intel_dpll_mgr.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) commit 555069117390a5d581863bc797fb546bb4417c31 Author: Suraj Kandpal Date: Tue Jul 30 09:25:05 2024 +0530 drm/i915/hdcp: Fix HDCP2_STREAM_STATUS macro Fix HDCP2_STREAM_STATUS macro, it called pipe instead of port never threw a compile error as no one used it. --v2 -Add Fixes [Jani] Fixes: d631b984cc90 ("drm/i915/hdcp: Add HDCP 2.2 stream register") Signed-off-by: Suraj Kandpal Reviewed-by: Jani Nikula Link: https://patchwork.freedesktop.org/patch/msgid/20240730035505.3759899-1-suraj.kandpal@intel.com (cherry picked from commit 73d7cd542bbd0a7c6881ea0df5255f190a1e7236) Signed-off-by: Joonas Lahtinen drivers/gpu/drm/i915/display/intel_hdcp_regs.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit a0e6fbf22439f796b51ea583a68eb763b0a99393 Author: Stephan Gerhold Date: Mon Jul 15 14:15:39 2024 +0200 arm64: dts: qcom: x1e80100-crd: Fix backlight The backlight does not work correctly with the current display panel configuration: It works after boot, but once the display gets disabled it is not possible to get it back on. It turns out that the ATNA45AF01 panel needs exactly the same non-standard power sequence as implemented by the panel-samsung-atna33xc20 driver for sc7180-trogdor-homestar. Switch the panel in the DT to the new compatible and make two more changes to make it work correctly: 1. Add the missing GPIO for the panel EL_ON3 line (EDP_BL_EN on CRD and enable-gpios in the DT). 2. Drop the regulator-always-on for the panel regulator. The panel does not seem to power off properly if the regulator stays on. Fixes: d7e03cce0400 ("arm64: dts: qcom: x1e80100-crd: Enable more support") Reviewed-by: Konrad Dybcio Signed-off-by: Stephan Gerhold Reviewed-by: Johan Hovold Tested-by: Johan Hovold Link: https://lore.kernel.org/r/20240715-x1e80100-crd-backlight-v2-3-31b7f2f658a3@linaro.org Signed-off-by: Bjorn Andersson arch/arm64/boot/dts/qcom/x1e80100-crd.dts | 17 +++++++++++++++-- 1 file changed, 15 insertions(+), 2 deletions(-) commit 86c71c0e893d58447e4a9e5c0d1c2c0f89c1b9e1 Author: Johan Hovold Date: Mon Jul 22 11:54:59 2024 +0200 arm64: dts: qcom: x1e80100-yoga-slim7x: fix missing PCIe4 gpios Add the missing PCIe4 perst, wake and clkreq GPIOs and pin config. Fixes: 45247fe17db2 ("arm64: dts: qcom: x1e80100: add Lenovo Thinkpad Yoga slim 7x devicetree") Signed-off-by: Johan Hovold Reviewed-by: Konrad Dybcio Link: https://lore.kernel.org/r/20240722095459.27437-13-johan+linaro@kernel.org Signed-off-by: Bjorn Andersson .../boot/dts/qcom/x1e80100-lenovo-yoga-slim7x.dts | 29 ++++++++++++++++++++++ 1 file changed, 29 insertions(+) commit 750b8a3b5a4476cf000f3db1fe46293c97fcd979 Author: Johan Hovold Date: Mon Jul 22 11:54:58 2024 +0200 arm64: dts: qcom: x1e80100-yoga-slim7x: disable PCIe6a perst pull down Disable the PCIe6a perst pull-down resistor to save some power. Signed-off-by: Johan Hovold Reviewed-by: Konrad Dybcio Link: https://lore.kernel.org/r/20240722095459.27437-12-johan+linaro@kernel.org Signed-off-by: Bjorn Andersson arch/arm64/boot/dts/qcom/x1e80100-lenovo-yoga-slim7x.dts | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit a655dacf2a35a35eadd95f0ba8fe9cf70359eeb9 Author: Johan Hovold Date: Mon Jul 22 11:54:57 2024 +0200 arm64: dts: qcom: x1e80100-yoga-slim7x: fix up PCIe6a pinctrl node The PCIe6a pinctrl node appears to have been copied from the sc8280xp CRD dts (via the x1e80100 CRD dts), which has the NVMe on pcie2a and uses some funny indentation. Fix up the node name to match the x1e80100 use and label and use only tabs for indentation. Signed-off-by: Johan Hovold Reviewed-by: Konrad Dybcio Link: https://lore.kernel.org/r/20240722095459.27437-11-johan+linaro@kernel.org Signed-off-by: Bjorn Andersson arch/arm64/boot/dts/qcom/x1e80100-lenovo-yoga-slim7x.dts | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-) commit b90567c262fc3a3e703f3091499dec799a6147ab Author: Johan Hovold Date: Mon Jul 22 11:54:56 2024 +0200 arm64: dts: qcom: x1e80100-yoga-slim7x: fix PCIe4 PHY supply The PCIe4 PHY is powered by vreg_l3i (not vreg_l3j) on the CRD reference design so assume the same applies to the Lenovo Yoga Slim 7x. Fixes: 45247fe17db2 ("arm64: dts: qcom: x1e80100: add Lenovo Thinkpad Yoga slim 7x devicetree") Signed-off-by: Johan Hovold Reviewed-by: Konrad Dybcio Link: https://lore.kernel.org/r/20240722095459.27437-10-johan+linaro@kernel.org Signed-off-by: Bjorn Andersson arch/arm64/boot/dts/qcom/x1e80100-lenovo-yoga-slim7x.dts | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit e7f3f3cbbfef84729ad6c10eb589957e7b28b95a Author: Johan Hovold Date: Mon Jul 22 11:54:55 2024 +0200 arm64: dts: qcom: x1e80100-vivobook-s15: fix missing PCIe4 gpios Add the missing PCIe4 perst, wake and clkreq GPIOs and pin config. Fixes: d0e2f8f62dff ("arm64: dts: qcom: Add device tree for ASUS Vivobook S 15") Signed-off-by: Johan Hovold Reviewed-by: Konrad Dybcio Link: https://lore.kernel.org/r/20240722095459.27437-9-johan+linaro@kernel.org Signed-off-by: Bjorn Andersson .../boot/dts/qcom/x1e80100-asus-vivobook-s15.dts | 29 ++++++++++++++++++++++ 1 file changed, 29 insertions(+) commit d7ff5d1868d1cfd1c06a601a7cfa2dbb6dba4be9 Author: Johan Hovold Date: Mon Jul 22 11:54:54 2024 +0200 arm64: dts: qcom: x1e80100-vivobook-s15: disable PCIe6a perst pull down Disable the PCIe6a perst pull-down resistor to save some power. Signed-off-by: Johan Hovold Reviewed-by: Konrad Dybcio Link: https://lore.kernel.org/r/20240722095459.27437-8-johan+linaro@kernel.org Signed-off-by: Bjorn Andersson arch/arm64/boot/dts/qcom/x1e80100-asus-vivobook-s15.dts | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit c67b3dfd8d69164f70ab3aaff889fca1e536c909 Author: Johan Hovold Date: Mon Jul 22 11:54:53 2024 +0200 arm64: dts: qcom: x1e80100-vivobook-s15: fix up PCIe6a pinctrl node The PCIe6a pinctrl node appears to have been copied from the sc8280xp CRD dts (via the x1e80100 CRD dts), which has the NVMe on pcie2a. Fix up the node name to match the x1e80100 use and label. Signed-off-by: Johan Hovold Reviewed-by: Konrad Dybcio Link: https://lore.kernel.org/r/20240722095459.27437-7-johan+linaro@kernel.org Signed-off-by: Bjorn Andersson arch/arm64/boot/dts/qcom/x1e80100-asus-vivobook-s15.dts | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit e89fe0596c62363082cabbaa5ccb38989e714e68 Author: Johan Hovold Date: Mon Jul 22 11:54:52 2024 +0200 arm64: dts: qcom: x1e80100-vivobook-s15: fix PCIe4 PHY supply The PCIe4 PHY is powered by vreg_l3i (not vreg_l3j) on the CRD reference design so assume the same applies to the Asus Vivobook S15. Fixes: d0e2f8f62dff ("arm64: dts: qcom: Add device tree for ASUS Vivobook S 15") Signed-off-by: Johan Hovold Reviewed-by: Konrad Dybcio Link: https://lore.kernel.org/r/20240722095459.27437-6-johan+linaro@kernel.org Signed-off-by: Bjorn Andersson arch/arm64/boot/dts/qcom/x1e80100-asus-vivobook-s15.dts | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-) commit 2ac90e4d2b6d6823ca10642ef39595ff1181c3fa Author: Johan Hovold Date: Mon Jul 22 11:54:51 2024 +0200 arm64: dts: qcom: x1e80100-qcp: fix missing PCIe4 gpios Add the missing PCIe4 perst, wake and clkreq GPIOs and pin config. Fixes: f9a9c11471da ("arm64: dts: qcom: x1e80100-qcp: Enable more support") Cc: stable@vger.kernel.org # 6.9 Signed-off-by: Johan Hovold Reviewed-by: Konrad Dybcio Link: https://lore.kernel.org/r/20240722095459.27437-5-johan+linaro@kernel.org Signed-off-by: Bjorn Andersson arch/arm64/boot/dts/qcom/x1e80100-qcp.dts | 29 +++++++++++++++++++++++++++++ 1 file changed, 29 insertions(+) commit 12661b333374c892f9053261b4bceb346a709ea4 Author: Johan Hovold Date: Mon Jul 22 11:54:50 2024 +0200 arm64: dts: qcom: x1e80100-qcp: disable PCIe6a perst pull down Disable the PCIe6a perst pull-down resistor to save some power. Signed-off-by: Johan Hovold Reviewed-by: Konrad Dybcio Reviewed-by: Abel Vesa Link: https://lore.kernel.org/r/20240722095459.27437-4-johan+linaro@kernel.org Signed-off-by: Bjorn Andersson arch/arm64/boot/dts/qcom/x1e80100-qcp.dts | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 0aab6eaac72ac140dfc5e0a38bf3178497762e43 Author: Johan Hovold Date: Mon Jul 22 11:54:49 2024 +0200 arm64: dts: qcom: x1e80100-qcp: fix up PCIe6a pinctrl node The PCIe6a pinctrl node appears to have been copied from the sc8280xp CRD dts, which has the NVMe on pcie2a and uses some funny indentation. Fix up the node name to match the x1e80100 use and label and use only tabs for indentation. Signed-off-by: Johan Hovold Reviewed-by: Konrad Dybcio Reviewed-by: Abel Vesa Link: https://lore.kernel.org/r/20240722095459.27437-3-johan+linaro@kernel.org Signed-off-by: Bjorn Andersson arch/arm64/boot/dts/qcom/x1e80100-qcp.dts | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-) commit f03dd49f884f428ba71efe23383ff842f4f15e0e Author: Johan Hovold Date: Mon Jul 22 11:54:48 2024 +0200 arm64: dts: qcom: x1e80100-qcp: fix PCIe4 PHY supply The PCIe4 PHY is powered by vreg_l3i (not vreg_l3j) on the CRD so assume the same applies to the QCP. Fixes: f9a9c11471da ("arm64: dts: qcom: x1e80100-qcp: Enable more support") Cc: stable@vger.kernel.org # 6.9 Signed-off-by: Johan Hovold Reviewed-by: Konrad Dybcio Reviewed-by: Abel Vesa Link: https://lore.kernel.org/r/20240722095459.27437-2-johan+linaro@kernel.org Signed-off-by: Bjorn Andersson arch/arm64/boot/dts/qcom/x1e80100-qcp.dts | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 42b33ad188466292eaac9825544b8be8deddb3cb Author: Johan Hovold Date: Mon Jul 22 11:42:47 2024 +0200 arm64: dts: qcom: x1e80100-crd: fix missing PCIe4 gpios Add the missing PCIe4 perst, wake and clkreq GPIOs and pin config. Fixes: d7e03cce0400 ("arm64: dts: qcom: x1e80100-crd: Enable more support") Cc: stable@vger.kernel.org # 6.9 Reviewed-by: Konrad Dybcio Signed-off-by: Johan Hovold Link: https://lore.kernel.org/r/20240722094249.26471-7-johan+linaro@kernel.org Signed-off-by: Bjorn Andersson arch/arm64/boot/dts/qcom/x1e80100-crd.dts | 29 +++++++++++++++++++++++++++++ 1 file changed, 29 insertions(+) commit 8a6e1dbf1362e78081e71b2690750e9556136f26 Author: Johan Hovold Date: Mon Jul 22 11:42:46 2024 +0200 arm64: dts: qcom: x1e80100-crd: disable PCIe6a perst pull down Disable the PCIe6a perst pull-down resistor to save some power. Reviewed-by: Konrad Dybcio Signed-off-by: Johan Hovold Link: https://lore.kernel.org/r/20240722094249.26471-6-johan+linaro@kernel.org Signed-off-by: Bjorn Andersson arch/arm64/boot/dts/qcom/x1e80100-crd.dts | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 6e3902c499544291ac4fd1a1bb69f2e9037a0e86 Author: Johan Hovold Date: Mon Jul 22 11:42:45 2024 +0200 arm64: dts: qcom: x1e80100-crd: fix up PCIe6a pinctrl node The PCIe6a pinctrl node appears to have been copied from the sc8280xp CRD dts, which has the NVMe on pcie2a and uses some funny indentation. Fix up the node name to match the x1e80100 use and label and use only tabs for indentation. Reviewed-by: Konrad Dybcio Signed-off-by: Johan Hovold Link: https://lore.kernel.org/r/20240722094249.26471-5-johan+linaro@kernel.org Signed-off-by: Bjorn Andersson arch/arm64/boot/dts/qcom/x1e80100-crd.dts | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-) commit 98abf2fbd179017833c38edc9f3b587c69d07e2a Author: Johan Hovold Date: Mon Jul 22 11:42:44 2024 +0200 arm64: dts: qcom: x1e80100: add missing PCIe minimum OPP Add the missing PCIe CX performance level votes to avoid relying on other drivers (e.g. USB) to maintain the nominal performance level required for Gen3 speeds. Fixes: 5eb83fc10289 ("arm64: dts: qcom: x1e80100: Add PCIe nodes") Cc: stable@vger.kernel.org # 6.9 Signed-off-by: Johan Hovold Reviewed-by: Konrad Dybcio Link: https://lore.kernel.org/r/20240722094249.26471-4-johan+linaro@kernel.org Signed-off-by: Bjorn Andersson arch/arm64/boot/dts/qcom/x1e80100.dtsi | 2 ++ 1 file changed, 2 insertions(+) commit f8fa1f2f6412bffa71972f9506b72992d0e6e485 Author: Johan Hovold Date: Mon Jul 22 11:42:43 2024 +0200 arm64: dts: qcom: x1e80100: fix PCIe domain numbers The current PCIe domain numbers are off by one and do not match the numbers that the UEFI firmware (and Windows) uses. Fixes: 5eb83fc10289 ("arm64: dts: qcom: x1e80100: Add PCIe nodes") Cc: stable@vger.kernel.org # 6.9 Reviewed-by: Konrad Dybcio Signed-off-by: Johan Hovold Link: https://lore.kernel.org/r/20240722094249.26471-3-johan+linaro@kernel.org Signed-off-by: Bjorn Andersson arch/arm64/boot/dts/qcom/x1e80100.dtsi | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) commit 30f593fa0088b89f479f7358640687b3cbca93d4 Author: Johan Hovold Date: Mon Jul 22 11:42:42 2024 +0200 arm64: dts: qcom: x1e80100-crd: fix PCIe4 PHY supply The PCIe4 PHY is powered by vreg_l3i (not vreg_l3j). Fixes: d7e03cce0400 ("arm64: dts: qcom: x1e80100-crd: Enable more support") Cc: stable@vger.kernel.org # 6.9 Signed-off-by: Johan Hovold Reviewed-by: Abel Vesa Link: https://lore.kernel.org/r/20240722094249.26471-2-johan+linaro@kernel.org Signed-off-by: Bjorn Andersson arch/arm64/boot/dts/qcom/x1e80100-crd.dts | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit b8e947e9f64cac9df85a07672b658df5b2bcff07 Author: David Sterba Date: Mon Jul 29 21:59:24 2024 +0200 btrfs: initialize location to fix -Wmaybe-uninitialized in btrfs_lookup_dentry() Some arch + compiler combinations report a potentially unused variable location in btrfs_lookup_dentry(). This is a false alert as the variable is passed by value and always valid or there's an error. The compilers cannot probably reason about that although btrfs_inode_by_name() is in the same file. > + /kisskb/src/fs/btrfs/inode.c: error: 'location.objectid' may be used +uninitialized in this function [-Werror=maybe-uninitialized]: => 5603:9 > + /kisskb/src/fs/btrfs/inode.c: error: 'location.type' may be used +uninitialized in this function [-Werror=maybe-uninitialized]: => 5674:5 m68k-gcc8/m68k-allmodconfig mips-gcc8/mips-allmodconfig powerpc-gcc5/powerpc-all{mod,yes}config powerpc-gcc5/ppc64_defconfig Initialize it to zero, this should fix the warnings and won't change the behaviour as btrfs_inode_by_name() accepts only a root or inode item types, otherwise returns an error. Reported-by: Geert Uytterhoeven Tested-by: Geert Uytterhoeven Link: https://lore.kernel.org/linux-btrfs/bd4e9928-17b3-9257-8ba7-6b7f9bbb639a@linux-m68k.org/ Reviewed-by: Qu Wenruo Signed-off-by: David Sterba fs/btrfs/inode.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit bf5641eccf71bcd13a849930e190563c3a19815d Author: Perry Yuan Date: Mon Jul 29 08:46:26 2024 +0200 x86/CPU/AMD: Add models 0x60-0x6f to the Zen5 range Add some new Zen5 models for the 0x1A family. [ bp: Merge the 0x60 and 0x70 ranges. ] Signed-off-by: Perry Yuan Signed-off-by: Borislav Petkov (AMD) Link: https://lore.kernel.org/r/20240729064626.24297-1-bp@kernel.org arch/x86/kernel/cpu/amd.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit f558120cd709682b739207b48cf7479fd9568431 Author: Alexandra Winter Date: Mon Jul 29 14:28:16 2024 +0200 net/iucv: fix use after free in iucv_sock_close() iucv_sever_path() is called from process context and from bh context. iucv->path is used as indicator whether somebody else is taking care of severing the path (or it is already removed / never existed). This needs to be done with atomic compare and swap, otherwise there is a small window where iucv_sock_close() will try to work with a path that has already been severed and freed by iucv_callback_connrej() called by iucv_tasklet_fn(). Example: [452744.123844] Call Trace: [452744.123845] ([<0000001e87f03880>] 0x1e87f03880) [452744.123966] [<00000000d593001e>] iucv_path_sever+0x96/0x138 [452744.124330] [<000003ff801ddbca>] iucv_sever_path+0xc2/0xd0 [af_iucv] [452744.124336] [<000003ff801e01b6>] iucv_sock_close+0xa6/0x310 [af_iucv] [452744.124341] [<000003ff801e08cc>] iucv_sock_release+0x3c/0xd0 [af_iucv] [452744.124345] [<00000000d574794e>] __sock_release+0x5e/0xe8 [452744.124815] [<00000000d5747a0c>] sock_close+0x34/0x48 [452744.124820] [<00000000d5421642>] __fput+0xba/0x268 [452744.124826] [<00000000d51b382c>] task_work_run+0xbc/0xf0 [452744.124832] [<00000000d5145710>] do_notify_resume+0x88/0x90 [452744.124841] [<00000000d5978096>] system_call+0xe2/0x2c8 [452744.125319] Last Breaking-Event-Address: [452744.125321] [<00000000d5930018>] iucv_path_sever+0x90/0x138 [452744.125324] [452744.125325] Kernel panic - not syncing: Fatal exception in interrupt Note that bh_lock_sock() is not serializing the tasklet context against process context, because the check for sock_owned_by_user() and corresponding handling is missing. Ideas for a future clean-up patch: A) Correct usage of bh_lock_sock() in tasklet context, as described in Link: https://lore.kernel.org/netdev/1280155406.2899.407.camel@edumazet-laptop/ Re-enqueue, if needed. This may require adding return values to the tasklet functions and thus changes to all users of iucv. B) Change iucv tasklet into worker and use only lock_sock() in af_iucv. Fixes: 7d316b945352 ("af_iucv: remove IUCV-pathes completely") Reviewed-by: Halil Pasic Signed-off-by: Alexandra Winter Link: https://patch.msgid.link/20240729122818.947756-1-wintera@linux.ibm.com Signed-off-by: Paolo Abeni net/iucv/af_iucv.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) commit 942810c0e89277d738b7f1b6f379d0a5877999f6 Author: Shyam Sundar S K Date: Tue Jul 23 18:54:50 2024 +0530 platform/x86/amd/pmf: Add new ACPI ID AMDI0107 Add new ACPI ID AMDI0107 used by upcoming AMD platform to the PMF supported list of devices. Signed-off-by: Shyam Sundar S K Link: https://lore.kernel.org/r/20240723132451.3488326-1-Shyam-sundar.S-k@amd.com Reviewed-by: Ilpo Järvinen Signed-off-by: Ilpo Järvinen drivers/platform/x86/amd/pmf/core.c | 3 +++ 1 file changed, 3 insertions(+) commit 426463d94d45d37c233e480231a40b9b35f10e49 Author: Shyam Sundar S K Date: Thu Jul 18 20:31:19 2024 +0530 platform/x86/amd/pmc: Send OS_HINT command for new AMD platform To initiate the HW deep state transition, the OS_HINT command has to be sent to the PMFW. Add this support to the platforms that belong to family 1Ah model 60h series. Signed-off-by: Shyam Sundar S K Reviewed-by: Ilpo Järvinen Link: https://lore.kernel.org/r/20240718150119.3427190-1-Shyam-sundar.S-k@amd.com Signed-off-by: Ilpo Järvinen drivers/platform/x86/amd/pmc/pmc.c | 2 ++ drivers/platform/x86/amd/pmc/pmc.h | 1 + 2 files changed, 3 insertions(+) commit 4c83ee4bf32ea8e57ae2321906c067d69ad7c41b Author: Luke D. Jones Date: Mon Jul 29 14:08:31 2024 +1200 platform/x86/amd: pmf: Add quirk for ROG Ally X The ASUS ROG Ally X has the same issue as the G14 where it advertises SPS support but doesn't use it. Signed-off-by: Luke D. Jones Link: https://lore.kernel.org/r/20240729020831.28117-1-luke@ljones.dev Reviewed-by: Ilpo Järvinen Signed-off-by: Ilpo Järvinen drivers/platform/x86/amd/pmf/pmf-quirks.c | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-) commit e075c3b13a0a142dcd3151b25d29a24f31b7b640 Author: Hans de Goede Date: Mon Jul 29 14:04:43 2024 +0200 platform/x86: intel-vbtn: Protect ACPI notify handler against recursion Since commit e2ffcda16290 ("ACPI: OSL: Allow Notify () handlers to run on all CPUs") ACPI notify handlers like the intel-vbtn notify_handler() may run on multiple CPU cores racing with themselves. This race gets hit on Dell Venue 7140 tablets when undocking from the keyboard, causing the handler to try and register priv->switches_dev twice, as can be seen from the dev_info() message getting logged twice: [ 83.861800] intel-vbtn INT33D6:00: Registering Intel Virtual Switches input-dev after receiving a switch event [ 83.861858] input: Intel Virtual Switches as /devices/pci0000:00/0000:00:1f.0/PNP0C09:00/INT33D6:00/input/input17 [ 83.861865] intel-vbtn INT33D6:00: Registering Intel Virtual Switches input-dev after receiving a switch event After which things go seriously wrong: [ 83.861872] sysfs: cannot create duplicate filename '/devices/pci0000:00/0000:00:1f.0/PNP0C09:00/INT33D6:00/input/input17' ... [ 83.861967] kobject: kobject_add_internal failed for input17 with -EEXIST, don't try to register things with the same name in the same directory. [ 83.877338] BUG: kernel NULL pointer dereference, address: 0000000000000018 ... Protect intel-vbtn notify_handler() from racing with itself with a mutex to fix this. Fixes: e2ffcda16290 ("ACPI: OSL: Allow Notify () handlers to run on all CPUs") Reported-by: En-Wei Wu Closes: https://bugs.launchpad.net/ubuntu/+source/linux/+bug/2073001 Tested-by: Kostadin Stoilov Signed-off-by: Hans de Goede Link: https://lore.kernel.org/r/20240729120443.14779-1-hdegoede@redhat.com Reviewed-by: Ilpo Järvinen Signed-off-by: Ilpo Järvinen drivers/platform/x86/intel/vbtn.c | 9 +++++++++ 1 file changed, 9 insertions(+) commit 5127c42c77de18651aa9e8e0a3ced190103b449c Author: Devyn Liu Date: Tue Jul 30 11:20:40 2024 +0800 spi: hisi-kunpeng: Add verification for the max_frequency provided by the firmware If the value of max_speed_hz is 0, it may cause a division by zero error in hisi_calc_effective_speed(). The value of max_speed_hz is provided by firmware. Firmware is generally considered as a trusted domain. However, as division by zero errors can cause system failure, for defense measure, the value of max_speed is validated here. So 0 is regarded as invalid and an error code is returned. Signed-off-by: Devyn Liu Reviewed-by: Jay Fang Link: https://patch.msgid.link/20240730032040.3156393-3-liudingyuan@huawei.com Signed-off-by: Mark Brown drivers/spi/spi-hisi-kunpeng.c | 3 +++ 1 file changed, 3 insertions(+) commit c3c4f22b7c814a6ee485ce294065836f8ede30fa Author: Devyn Liu Date: Tue Jul 30 11:20:39 2024 +0800 spi: hisi-kunpeng: Add validation for the minimum value of speed_hz The speed specified by the user is used to calculate the clk_div based on the max_speed_hz in hisi_calc_effective_speed. A very low speed value can lead to a clk_div larger than the variable range. Avoid this by setting the min_speed_hz so that such a small speed value is rejected. __spi_validate() in spi.c will return -EINVAL for the specified speed_hz lower than min_speed_hz. Signed-off-by: Devyn Liu Reviewed-by: Jay Fang Link: https://patch.msgid.link/20240730032040.3156393-2-liudingyuan@huawei.com Signed-off-by: Mark Brown drivers/spi/spi-hisi-kunpeng.c | 1 + 1 file changed, 1 insertion(+) commit c3fca4fb83f7c84cd1e1aa9fe3a0e220ce8f30fb Author: Olivier Langlois Date: Mon Jul 29 19:13:35 2024 -0400 io_uring: remove unused local list heads in NAPI functions These lists are unused, remove them. Signed-off-by: Olivier Langlois Reviewed-by: Pavel Begunkov Link: https://lore.kernel.org/r/0a0ae3e955aed0f3e3d29882fb3d3cb575e0009b.1722294947.git.olivier@trillion01.com Signed-off-by: Jens Axboe io_uring/napi.c | 2 -- 1 file changed, 2 deletions(-) commit 2c762be5b798c443612c1bb9b011de4fdaebd1c5 Author: Olivier Langlois Date: Mon Jul 29 19:03:33 2024 -0400 io_uring: keep multishot request NAPI timeout current This refresh statement was originally present in the original patch: https://lore.kernel.org/netdev/20221121191437.996297-2-shr@devkernel.io/ It has been removed with no explanation in v6: https://lore.kernel.org/netdev/20230201222254.744422-2-shr@devkernel.io/ It is important to make the refresh for multishot requests, because if no new requests using the same NAPI device are added to the ring, the entry will become stale and be removed silently. The unsuspecting user will not know that their ring had busy polling for only 60 seconds before being pruned. Signed-off-by: Olivier Langlois Reviewed-by: Pavel Begunkov Fixes: 8d0c12a80cdeb ("io-uring: add napi busy poll support") Cc: stable@vger.kernel.org Link: https://lore.kernel.org/r/0fe61a019ec61e5708cd117cb42ed0dab95e1617.1722294646.git.olivier@trillion01.com Signed-off-by: Jens Axboe io_uring/poll.c | 1 + 1 file changed, 1 insertion(+) commit df615907f1bf907260af01ccb904d0e9304b5278 Author: Patryk Duda Date: Tue Jul 30 10:44:25 2024 +0000 platform/chrome: cros_ec_proto: Lock device when updating MKBP version The cros_ec_get_host_command_version_mask() function requires that the caller must have ec_dev->lock mutex before calling it. This requirement was not met and as a result it was possible that two commands were sent to the device at the same time. The problem was observed while using UART backend which doesn't use any additional locks, unlike SPI backend which locks the controller until response is received. Fixes: f74c7557ed0d ("platform/chrome: cros_ec_proto: Update version on GET_NEXT_EVENT failure") Cc: stable@vger.kernel.org Signed-off-by: Patryk Duda Link: https://lore.kernel.org/r/20240730104425.607083-1-patrykd@google.com Signed-off-by: Tzung-Bi Shih drivers/platform/chrome/cros_ec_proto.c | 2 ++ 1 file changed, 2 insertions(+) commit a371d558e6f3aed977a8a7346350557de5d25190 Author: Rik van Riel Date: Mon Jul 29 14:19:28 2024 -0400 mm, slub: do not call do_slab_free for kfence object In 782f8906f805 the freeing of kfence objects was moved from deep inside do_slab_free to the wrapper functions outside. This is a nice change, but unfortunately it missed one spot in __kmem_cache_free_bulk. This results in a crash like this: BUG skbuff_head_cache (Tainted: G S B E ): Padding overwritten. 0xffff88907fea0f00-0xffff88907fea0fff @offset=3840 slab_err (mm/slub.c:1129) free_to_partial_list (mm/slub.c:? mm/slub.c:4036) slab_pad_check (mm/slub.c:864 mm/slub.c:1290) check_slab (mm/slub.c:?) free_to_partial_list (mm/slub.c:3171 mm/slub.c:4036) kmem_cache_alloc_bulk (mm/slub.c:? mm/slub.c:4495 mm/slub.c:4586 mm/slub.c:4635) napi_build_skb (net/core/skbuff.c:348 net/core/skbuff.c:527 net/core/skbuff.c:549) All the other callers to do_slab_free appear to be ok. Add a kfence_free check in __kmem_cache_free_bulk to avoid the crash. Reported-by: Chris Mason Fixes: 782f8906f805 ("mm/slub: free KFENCE objects in slab_free_hook()") Cc: stable@kernel.org Signed-off-by: Rik van Riel Signed-off-by: Vlastimil Babka mm/slub.c | 3 +++ 1 file changed, 3 insertions(+) commit 2fe5273f149cc882c371f9954b5fdbd1bd8c9b5c Author: D. Wythe Date: Mon Jul 29 11:40:15 2024 +0800 net/smc: prevent UAF in inet_create() Following syzbot repro crashes the kernel: socketpair(0x2, 0x1, 0x100, &(0x7f0000000140)) (fail_nth: 13) Fix this by not calling sk_common_release() from smc_create_clcsk(). Stack trace: socket: no more sockets ------------[ cut here ]------------ refcount_t: underflow; use-after-free. WARNING: CPU: 1 PID: 5092 at lib/refcount.c:28 refcount_warn_saturate+0x15a/0x1d0 lib/refcount.c:28 Modules linked in: CPU: 1 PID: 5092 Comm: syz-executor424 Not tainted 6.10.0-syzkaller-04483-g0be9ae5486cd #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/27/2024 RIP: 0010:refcount_warn_saturate+0x15a/0x1d0 lib/refcount.c:28 Code: 80 f3 1f 8c e8 e7 69 a8 fc 90 0f 0b 90 90 eb 99 e8 cb 4f e6 fc c6 05 8a 8d e8 0a 01 90 48 c7 c7 e0 f3 1f 8c e8 c7 69 a8 fc 90 <0f> 0b 90 90 e9 76 ff ff ff e8 a8 4f e6 fc c6 05 64 8d e8 0a 01 90 RSP: 0018:ffffc900034cfcf0 EFLAGS: 00010246 RAX: 3b9fcde1c862f700 RBX: ffff888022918b80 RCX: ffff88807b39bc00 RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 RBP: 0000000000000003 R08: ffffffff815878a2 R09: fffffbfff1c39d94 R10: dffffc0000000000 R11: fffffbfff1c39d94 R12: 00000000ffffffe9 R13: 1ffff11004523165 R14: ffff888022918b28 R15: ffff888022918b00 FS: 00005555870e7380(0000) GS:ffff8880b9500000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000000020000140 CR3: 000000007582e000 CR4: 00000000003506f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: inet_create+0xbaf/0xe70 __sock_create+0x490/0x920 net/socket.c:1571 sock_create net/socket.c:1622 [inline] __sys_socketpair+0x2ca/0x720 net/socket.c:1769 __do_sys_socketpair net/socket.c:1822 [inline] __se_sys_socketpair net/socket.c:1819 [inline] __x64_sys_socketpair+0x9b/0xb0 net/socket.c:1819 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7fbcb9259669 Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 a1 1a 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007fffe931c6d8 EFLAGS: 00000246 ORIG_RAX: 0000000000000035 RAX: ffffffffffffffda RBX: 00007fffe931c6f0 RCX: 00007fbcb9259669 RDX: 0000000000000100 RSI: 0000000000000001 RDI: 0000000000000002 RBP: 0000000000000002 R08: 00007fffe931c476 R09: 00000000000000a0 R10: 0000000020000140 R11: 0000000000000246 R12: 00007fffe931c6ec R13: 431bde82d7b634db R14: 0000000000000001 R15: 0000000000000001 Link: https://lore.kernel.org/r/20240723175809.537291-1-edumazet@google.com/ Fixes: d25a92ccae6b ("net/smc: Introduce IPPROTO_SMC") Reported-by: syzbot Signed-off-by: D. Wythe Reviewed-by: Eric Dumazet Reviewed-by: Wenjia Zhang Link: https://patch.msgid.link/1722224415-30999-1-git-send-email-alibuda@linux.alibaba.com Signed-off-by: Paolo Abeni net/smc/af_smc.c | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) commit 0cd55ef92a4a94fabc6e7d5fb2e8dfced1860d88 Merge: 039564d2fd37 f833470c2783 Author: Paolo Abeni Date: Tue Jul 30 10:27:32 2024 +0200 Merge branch 'mptcp-fix-inconsistent-backup-usage' Matthieu Baerts says: ==================== mptcp: fix inconsistent backup usage In all the MPTCP backup related tests, the backup flag was set on one side, and the expected behaviour is to have both sides respecting this decision. That's also the "natural" way, and what the users seem to expect. On the scheduler side, only the 'backup' field was checked, which is supposed to be set only if the other peer flagged a subflow as backup. But in various places, this flag was also set when the local host flagged the subflow as backup, certainly to have the expected behaviour mentioned above. Patch 1 modifies the packet scheduler to check if the backup flag has been set on both directions, not to change its behaviour after having applied the following patches. That's what the default packet scheduler should have done since the beginning in v5.7. Patch 2 fixes the backup flag being mirrored on the MPJ+SYN+ACK by accident since its introduction in v5.7. Instead, the received and sent backup flags are properly distinguished in requests. Patch 3 stops setting the received backup flag as well when sending an MP_PRIO, something that was done since the MP_PRIO support in v5.12. Patch 4 adds related and missing MIB counters to be able to easily check if MP_JOIN are sent with a backup flag. Certainly because these counters were not there, the behaviour that is fixed by patches here was not properly verified. Patch 5 validates the previous patch by extending the MPTCP Join selftest. Patch 6 fixes the backup support in signal endpoints: if a signal endpoint had the backup flag, it was not set in the MPJ+SYN+ACK as expected. It was only set for ongoing connections, but not future ones as expected, since the introduction of the backup flag in endpoints in v5.10. Patch 7 validates the previous patch by extending the MPTCP Join selftest as well. Signed-off-by: Matthieu Baerts (NGI0) --- Matthieu Baerts (NGI0) (7): mptcp: sched: check both directions for backup mptcp: distinguish rcv vs sent backup flag in requests mptcp: pm: only set request_bkup flag when sending MP_PRIO mptcp: mib: count MPJ with backup flag selftests: mptcp: join: validate backup in MPJ mptcp: pm: fix backup support in signal endpoints selftests: mptcp: join: check backup support in signal endp include/trace/events/mptcp.h | 2 +- net/mptcp/mib.c | 2 + net/mptcp/mib.h | 2 + net/mptcp/options.c | 2 +- net/mptcp/pm.c | 12 +++++ net/mptcp/pm_netlink.c | 19 ++++++- net/mptcp/pm_userspace.c | 18 +++++++ net/mptcp/protocol.c | 10 ++-- net/mptcp/protocol.h | 4 ++ net/mptcp/subflow.c | 10 ++++ tools/testing/selftests/net/mptcp/mptcp_join.sh | 72 ++++++++++++++++++++----- 11 files changed, 132 insertions(+), 21 deletions(-) ==================== Link: https://patch.msgid.link/20240727-upstream-net-20240727-mptcp-backup-signal-v1-0-f50b31604cf1@kernel.org Signed-off-by: Paolo Abeni commit f833470c27832136d4416d8fc55d658082af0989 Author: Matthieu Baerts (NGI0) Date: Sat Jul 27 12:01:29 2024 +0200 selftests: mptcp: join: check backup support in signal endp Before the previous commit, 'signal' endpoints with the 'backup' flag were ignored when sending the MP_JOIN. The MPTCP Join selftest has then been modified to validate this case: the "single address, backup" test, is now validating the MP_JOIN with a backup flag as it is what we expect it to do with such name. The previous version has been kept, but renamed to "single address, switch to backup" to avoid confusions. The "single address with port, backup" test is also now validating the MPJ with a backup flag, which makes more sense than checking the switch to backup with an MP_PRIO. The "mpc backup both sides" test is now validating that the backup flag is also set in MP_JOIN from and to the addresses used in the initial subflow, using the special ID 0. The 'Fixes' tag here below is the same as the one from the previous commit: this patch here is not fixing anything wrong in the selftests, but it validates the previous fix for an issue introduced by this commit ID. Fixes: 4596a2c1b7f5 ("mptcp: allow creating non-backup subflows") Cc: stable@vger.kernel.org Reviewed-by: Mat Martineau Signed-off-by: Matthieu Baerts (NGI0) Signed-off-by: Paolo Abeni tools/testing/selftests/net/mptcp/mptcp_join.sh | 34 ++++++++++++++++++++----- 1 file changed, 28 insertions(+), 6 deletions(-) commit 6834097fc38c5416701c793da94558cea49c0a1f Author: Matthieu Baerts (NGI0) Date: Sat Jul 27 12:01:28 2024 +0200 mptcp: pm: fix backup support in signal endpoints There was a support for signal endpoints, but only when the endpoint's flag was changed during a connection. If an endpoint with the signal and backup was already present, the MP_JOIN reply was not containing the backup flag as expected. That's confusing to have this inconsistent behaviour. On the other hand, the infrastructure to set the backup flag in the SYN + ACK + MP_JOIN was already there, it was just never set before. Now when requesting the local ID from the path-manager, the backup status is also requested. Note that when the userspace PM is used, the backup flag can be set if the local address was already used before with a backup flag, e.g. if the address was announced with the 'backup' flag, or a subflow was created with the 'backup' flag. Fixes: 4596a2c1b7f5 ("mptcp: allow creating non-backup subflows") Cc: stable@vger.kernel.org Closes: https://github.com/multipath-tcp/mptcp_net-next/issues/507 Reviewed-by: Mat Martineau Signed-off-by: Matthieu Baerts (NGI0) Signed-off-by: Paolo Abeni net/mptcp/pm.c | 12 ++++++++++++ net/mptcp/pm_netlink.c | 18 ++++++++++++++++++ net/mptcp/pm_userspace.c | 18 ++++++++++++++++++ net/mptcp/protocol.h | 3 +++ net/mptcp/subflow.c | 3 +++ 5 files changed, 54 insertions(+) commit 935ff5bb8a1cfcdf8e60c8f5c794d0bbbc234437 Author: Matthieu Baerts (NGI0) Date: Sat Jul 27 12:01:27 2024 +0200 selftests: mptcp: join: validate backup in MPJ A peer can notify the other one that a subflow has to be treated as "backup" by two different ways: either by sending a dedicated MP_PRIO notification, or by setting the backup flag in the MP_JOIN handshake. The selftests were previously monitoring the former, but not the latter. This is what is now done here by looking at these new MIB counters when validating the 'backup' cases: MPTcpExtMPJoinSynBackupRx MPTcpExtMPJoinSynAckBackupRx The 'Fixes' tag here below is the same as the one from the previous commit: this patch here is not fixing anything wrong in the selftests, but it will help to validate a new fix for an issue introduced by this commit ID. Fixes: 4596a2c1b7f5 ("mptcp: allow creating non-backup subflows") Cc: stable@vger.kernel.org Reviewed-by: Mat Martineau Signed-off-by: Matthieu Baerts (NGI0) Signed-off-by: Paolo Abeni tools/testing/selftests/net/mptcp/mptcp_join.sh | 42 +++++++++++++++++++------ 1 file changed, 32 insertions(+), 10 deletions(-) commit 4dde0d72ccec500c60c798e036b852e013d6e124 Author: Matthieu Baerts (NGI0) Date: Sat Jul 27 12:01:26 2024 +0200 mptcp: mib: count MPJ with backup flag Without such counters, it is difficult to easily debug issues with MPJ not having the backup flags on production servers. This is not strictly a fix, but it eases to validate the following patches without requiring to take packet traces, to query ongoing connections with Netlink with admin permissions, or to guess by looking at the behaviour of the packet scheduler. Also, the modification is self contained, isolated, well controlled, and the increments are done just after others, there from the beginning. It looks then safe, and helpful to backport this. Fixes: 4596a2c1b7f5 ("mptcp: allow creating non-backup subflows") Cc: stable@vger.kernel.org Reviewed-by: Mat Martineau Signed-off-by: Matthieu Baerts (NGI0) Signed-off-by: Paolo Abeni net/mptcp/mib.c | 2 ++ net/mptcp/mib.h | 2 ++ net/mptcp/subflow.c | 6 ++++++ 3 files changed, 10 insertions(+) commit 4258b94831bb7ff28ab80e3c8d94db37db930728 Author: Matthieu Baerts (NGI0) Date: Sat Jul 27 12:01:25 2024 +0200 mptcp: pm: only set request_bkup flag when sending MP_PRIO The 'backup' flag from mptcp_subflow_context structure is supposed to be set only when the other peer flagged a subflow as backup, not the opposite. Fixes: 067065422fcd ("mptcp: add the outgoing MP_PRIO support") Cc: stable@vger.kernel.org Reviewed-by: Mat Martineau Signed-off-by: Matthieu Baerts (NGI0) Signed-off-by: Paolo Abeni net/mptcp/pm_netlink.c | 1 - 1 file changed, 1 deletion(-) commit efd340bf3d7779a3a8ec954d8ec0fb8a10f24982 Author: Matthieu Baerts (NGI0) Date: Sat Jul 27 12:01:24 2024 +0200 mptcp: distinguish rcv vs sent backup flag in requests When sending an MP_JOIN + SYN + ACK, it is possible to mark the subflow as 'backup' by setting the flag with the same name. Before this patch, the backup was set if the other peer set it in its MP_JOIN + SYN request. It is not correct: the backup flag should be set in the MPJ+SYN+ACK only if the host asks for it, and not mirroring what was done by the other peer. It is then required to have a dedicated bit for each direction, similar to what is done in the subflow context. Fixes: f296234c98a8 ("mptcp: Add handling of incoming MP_JOIN requests") Cc: stable@vger.kernel.org Reviewed-by: Mat Martineau Signed-off-by: Matthieu Baerts (NGI0) Signed-off-by: Paolo Abeni net/mptcp/options.c | 2 +- net/mptcp/protocol.h | 1 + net/mptcp/subflow.c | 1 + 3 files changed, 3 insertions(+), 1 deletion(-) commit b6a66e521a2032f7fcba2af5a9bcbaeaa19b7ca3 Author: Matthieu Baerts (NGI0) Date: Sat Jul 27 12:01:23 2024 +0200 mptcp: sched: check both directions for backup The 'mptcp_subflow_context' structure has two items related to the backup flags: - 'backup': the subflow has been marked as backup by the other peer - 'request_bkup': the backup flag has been set by the host Before this patch, the scheduler was only looking at the 'backup' flag. That can make sense in some cases, but it looks like that's not what we wanted for the general use, because either the path-manager was setting both of them when sending an MP_PRIO, or the receiver was duplicating the 'backup' flag in the subflow request. Note that the use of these two flags in the path-manager are going to be fixed in the next commits, but this change here is needed not to modify the behaviour. Fixes: f296234c98a8 ("mptcp: Add handling of incoming MP_JOIN requests") Cc: stable@vger.kernel.org Reviewed-by: Mat Martineau Signed-off-by: Matthieu Baerts (NGI0) Signed-off-by: Paolo Abeni include/trace/events/mptcp.h | 2 +- net/mptcp/protocol.c | 10 ++++++---- 2 files changed, 7 insertions(+), 5 deletions(-) commit 0ce91928ec62d189b5c51816e325f02587b53118 Author: Thomas Zimmermann Date: Wed Jul 17 16:24:16 2024 +0200 drm/ast: astdp: Wake up during connector status detection Power up the ASTDP connector for connection status detection if the connector is not active. Keep it powered if a display is attached. This fixes a bug where the connector does not come back after disconnecting the display. The encoder's atomic_disable turns off power on the physical connector. Further HPD reads will fail, thus preventing the driver from detecting re-connected displays. For connectors that are actively used, only test the HPD flag without touching power. Fixes: f81bb0ac7872 ("drm/ast: report connection status on Display Port.") Cc: Jocelyn Falempe Cc: Thomas Zimmermann Cc: Dave Airlie Cc: dri-devel@lists.freedesktop.org Cc: # v6.6+ Signed-off-by: Thomas Zimmermann Reviewed-by: Jocelyn Falempe Link: https://patchwork.freedesktop.org/patch/msgid/20240717143319.104012-2-tzimmermann@suse.de drivers/gpu/drm/ast/ast_dp.c | 7 +++++++ drivers/gpu/drm/ast/ast_drv.h | 1 + drivers/gpu/drm/ast/ast_mode.c | 29 +++++++++++++++++++++++++++-- 3 files changed, 35 insertions(+), 2 deletions(-) commit c14e4114582c20276467226387d5bae7310a849e Author: Pavan Kumar Paluri Date: Mon Jul 29 13:08:08 2024 -0500 x86/sev: Fix __reserved field in sev_config sev_config currently has debug, ghcbs_initialized, and use_cas fields. However, __reserved count has not been updated. Fix this. Fixes: 34ff65901735 ("x86/sev: Use kernel provided SVSM Calling Areas") Signed-off-by: Pavan Kumar Paluri Signed-off-by: Borislav Petkov (AMD) Link: https://lore.kernel.org/r/20240729180808.366587-1-papaluri@amd.com arch/x86/coco/sev/core.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 11dcda9b7a3407abe941092c87e7bc7e2da9e97b Merge: a1ff5a7d78a0 291e4baf7001 Author: Maxime Ripard Date: Tue Jul 30 09:13:51 2024 +0200 Merge drm-misc/drm-misc-next-fixes into drm-misc-fixes There's a patch left in drm-misc-next-fixes, let's bring it into drm-misc-fixes. Signed-off-by: Maxime Ripard commit a1ff5a7d78a036d6c2178ee5acd6ba4946243800 Merge: b5fbf924f125 8400291e289e Author: Maxime Ripard Date: Tue Jul 30 09:09:23 2024 +0200 Merge drm/drm-fixes into drm-misc-fixes Let's start the new drm-misc-fixes cycle by bringing in 6.11-rc1. Signed-off-by: Maxime Ripard commit 914f8961879de6fadd166ebd75151a778481e09a Author: Jean-Michel Hautbois Date: Sat Jun 8 18:41:27 2024 +0200 media: v4l: Fix missing tabular column hint for Y14P format The original patch added two columns in the flat-table of Luma-Only Image Formats, without updating hints to latex: above it. This results in wrong column count in the output of Sphinx's latex builder. Fix it. Reported-by: Akira Yokosawa Closes: https://lore.kernel.org/linux-media/bdbc27ba-5098-49fb-aabf-753c81361cc7@gmail.com/ Fixes: adb1d4655e53 ("media: v4l: Add V4L2-PIX-FMT-Y14P format") Cc: stable@vger.kernel.org # for v6.10 Signed-off-by: Jean-Michel Hautbois Signed-off-by: Hans Verkuil Documentation/userspace-api/media/v4l/pixfmt-yuv-luma.rst | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) commit 423a77ae3a3f916809ff3ab1c8db6d3d580c3120 Author: Bingbu Cao Date: Wed Jul 17 15:40:50 2024 +0800 media: intel/ipu6: select AUXILIARY_BUS in Kconfig Intel IPU6 PCI driver need register its devices on auxiliary bus, so it needs to select the AUXILIARY_BUS in Kconfig. Reported-by: kernel test robot Closes: https://lore.kernel.org/oe-kbuild-all/202407161833.7BEFXejx-lkp@intel.com/ Fixes: c70281cc83d6 ("media: intel/ipu6: add Kconfig and Makefile") Signed-off-by: Bingbu Cao Cc: stable@vger.kernel.org # for v6.10 Signed-off-by: Sakari Ailus Signed-off-by: Hans Verkuil drivers/media/pci/intel/ipu6/Kconfig | 1 + 1 file changed, 1 insertion(+) commit d7b5f7537c8282e1e1919408d0b6c69877fd35f8 Author: Arnd Bergmann Date: Fri Jul 19 11:53:50 2024 +0200 media: ipu-bridge: fix ipu6 Kconfig dependencies Commit 4670c8c3fb04 ("media: ipu-bridge: Fix Kconfig dependencies") changed how IPU_BRIDGE dependencies are handled for all drivers, but the IPU6 variant was added the old way, which causes build time warnings when I2C is turned off: WARNING: unmet direct dependencies detected for IPU_BRIDGE Depends on [n]: MEDIA_SUPPORT [=m] && PCI [=y] && MEDIA_PCI_SUPPORT [=y] && (ACPI [=y] || COMPILE_TEST [=y]) && I2C [=n] Selected by [m]: - VIDEO_INTEL_IPU6 [=m] && MEDIA_SUPPORT [=m] && PCI [=y] && MEDIA_PCI_SUPPORT [=y] && (ACPI [=y] || COMPILE_TEST [=y]) && VIDEO_DEV [=m] && X86 [=y] && X86_64 [=y] && HAS_DMA [=y] To make it consistent with the other IPU drivers as well as avoid this warning, change the 'select' into 'depends on'. Fixes: c70281cc83d6 ("media: intel/ipu6: add Kconfig and Makefile") Signed-off-by: Arnd Bergmann [Sakari Ailus: Alternatively depend on !IPU_BRIDGE.] Cc: stable@vger.kernel.org # for v6.10 Signed-off-by: Sakari Ailus Signed-off-by: Hans Verkuil drivers/media/pci/intel/ipu6/Kconfig | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 7c632fc3ce64c05bae4addbdfa174f98d0431ca4 Merge: 8400291e289e 47398f49dab8 Author: Martin K. Petersen Date: Mon Jul 29 21:46:16 2024 -0400 Merge branch '6.11/scsi-queue' into 6.11/scsi-fixes Pull outstanding commits from 6.11 queue into fixes. Signed-off-by: Martin K. Petersen commit 94ede2a3e9135764736221c080ac7c0ad993dc2d Author: Linus Torvalds Date: Mon Jul 29 16:34:17 2024 -0700 profiling: remove stale percpu flip buffer variables For some reason I didn't see this issue on my arm64 or x86-64 builds, but Stephen Rothwell reports that commit 2accfdb7eff6 ("profiling: attempt to remove per-cpu profile flip buffer") left these static variables around, and the powerpc build is unhappy about them: kernel/profile.c:52:28: warning: 'cpu_profile_flip' defined but not used [-Wunused-variable] 52 | static DEFINE_PER_CPU(int, cpu_profile_flip); | ^~~~~~~~~~~~~~~~ .. So remove these stale left-over remnants too. Fixes: 2accfdb7eff6 ("profiling: attempt to remove per-cpu profile flip buffer") Reported-by: Stephen Rothwell Signed-off-by: Linus Torvalds kernel/profile.c | 6 ------ 1 file changed, 6 deletions(-) commit 41c24102af7b6236277a214428b203d51a3462df Author: Stanislav Fomichev Date: Thu Jul 25 14:40:29 2024 -0700 selftests/bpf: Filter out _GNU_SOURCE when compiling test_cpp Jakub reports build failures when merging linux/master with net tree: CXX test_cpp In file included from :454: :2:9: error: '_GNU_SOURCE' macro redefined [-Werror,-Wmacro-redefined] 2 | #define _GNU_SOURCE | ^ :445:9: note: previous definition is here 445 | #define _GNU_SOURCE 1 The culprit is commit cc937dad85ae ("selftests: centralize -D_GNU_SOURCE= to CFLAGS in lib.mk") which unconditionally added -D_GNU_SOUCE to CLFAGS. Apparently clang++ also unconditionally adds it for the C++ targets [0] which causes a conflict. Add small change in the selftests makefile to filter it out for test_cpp. Not sure which tree it should go via, targeting bpf for now, but net might be better? 0: https://stackoverflow.com/questions/11670581/why-is-gnu-source-defined-by-default-and-how-to-turn-it-off Signed-off-by: Stanislav Fomichev Signed-off-by: Andrii Nakryiko Acked-by: Jiri Olsa Link: https://lore.kernel.org/bpf/20240725214029.1760809-1-sdf@fomichev.me tools/testing/selftests/bpf/Makefile | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 6b5faec9f564ea627c66064a4a6a5904fe5a07dd Merge: 10826505f523 facdbdfe0e62 Author: Linus Torvalds Date: Mon Jul 29 13:07:05 2024 -0700 Merge tag 'for-linus-2024072901' of git://git.kernel.org/pub/scm/linux/kernel/git/hid/hid Pull HID fixes from Benjamin Tissoires: - fixes for HID-BPF after the merge with the bpf tree (Arnd Bergmann and Benjamin Tissoires) - some tool type fix for the Wacom driver (Tatsunosuke Tobita) - a reorder of the sensor discovery to ensure the HID AMD SFH is removed when no sensors are available (Basavaraj Natikar) * tag 'for-linus-2024072901' of git://git.kernel.org/pub/scm/linux/kernel/git/hid/hid: selftests/hid: add test for attaching multiple time the same struct_ops HID: bpf: prevent the same struct_ops to be attached more than once selftests/hid: disable struct_ops auto-attach selftests/hid: fix bpf_wq new API HID: amd_sfh: Move sensor discovery before HID device initialization hid: bpf: add BPF_JIT dependency HID: wacom: more appropriate tool type categorization HID: wacom: Modify pen IDs commit 10826505f52357c7c9e12358db97a3acbe82e958 Merge: cec6937dd1aa 6d834691da47 Author: Linus Torvalds Date: Mon Jul 29 12:53:37 2024 -0700 Merge tag 'for_linus' of git://git.kernel.org/pub/scm/linux/kernel/git/mst/vhost Pull virtio fixes from Michael Tsirkin: "The biggest thing here is the adminq change - but it looks like the only way to avoid headq blocking causing indefinite stalls. This fixes three issues: - Prevent admin commands on one VF blocking another. This prevents a bad VF from blocking a good one, as well as fixing a scalability issue with large # of VFs - Correctly return error on command failure on octeon. We used to treat failed commands as a success. - Fix modpost warning when building virtio_dma_buf. Harmless, but the fix is trivial" * tag 'for_linus' of git://git.kernel.org/pub/scm/linux/kernel/git/mst/vhost: virtio_pci_modern: remove admin queue serialization lock virtio_pci_modern: use completion instead of busy loop to wait on admin cmd result virtio_pci_modern: pass cmd as an identification token virtio_pci_modern: create admin queue of queried size virtio: create admin queues alongside other virtqueues virtio_pci: pass vq info as an argument to vp_setup_vq() virtio: push out code to vp_avq_index() virtio_pci_modern: treat vp_dev->admin_vq.info.vq pointer as static virtio_pci: introduce vector allocation fallback for slow path virtqueues virtio_pci: pass vector policy enum to vp_find_one_vq_msix() virtio_pci: pass vector policy enum to vp_find_vqs_msix() virtio_pci: simplify vp_request_msix_vectors() call a bit virtio_pci: push out single vq find code to vp_find_one_vq_msix() vdpa/octeon_ep: Fix error code in octep_process_mbox() virtio: add missing MODULE_DESCRIPTION() macro commit 0710c3d304f67f9b68f5082214e311ec8f82bd82 Author: Konrad Dybcio Date: Fri Jul 26 13:18:25 2024 +0200 dt-bindings: Batch-update Konrad Dybcio's email Use my @kernel.org address everywhere. Signed-off-by: Konrad Dybcio Acked-by: Krzysztof Kozlowski Link: https://lore.kernel.org/r/20240726-topic-konrad_email-v1-3-f94665da2919@kernel.org Signed-off-by: Rob Herring (Arm) Documentation/devicetree/bindings/clock/qcom,dispcc-sm6350.yaml | 2 +- Documentation/devicetree/bindings/clock/qcom,gcc-msm8994.yaml | 2 +- Documentation/devicetree/bindings/clock/qcom,gcc-sm6125.yaml | 2 +- Documentation/devicetree/bindings/clock/qcom,gcc-sm6350.yaml | 2 +- Documentation/devicetree/bindings/clock/qcom,sm6115-gpucc.yaml | 2 +- Documentation/devicetree/bindings/clock/qcom,sm6125-gpucc.yaml | 2 +- Documentation/devicetree/bindings/clock/qcom,sm6350-camcc.yaml | 2 +- Documentation/devicetree/bindings/clock/qcom,sm6375-dispcc.yaml | 2 +- Documentation/devicetree/bindings/clock/qcom,sm6375-gcc.yaml | 2 +- Documentation/devicetree/bindings/clock/qcom,sm6375-gpucc.yaml | 2 +- Documentation/devicetree/bindings/clock/qcom,sm8350-videocc.yaml | 2 +- Documentation/devicetree/bindings/clock/qcom,sm8450-gpucc.yaml | 2 +- Documentation/devicetree/bindings/display/msm/qcom,sm6375-mdss.yaml | 2 +- .../devicetree/bindings/display/panel/asus,z00t-tm5p5-nt35596.yaml | 2 +- Documentation/devicetree/bindings/display/panel/sony,td4353-jdi.yaml | 2 +- Documentation/devicetree/bindings/interconnect/qcom,sc7280-rpmh.yaml | 2 +- Documentation/devicetree/bindings/interconnect/qcom,sc8280xp-rpmh.yaml | 2 +- Documentation/devicetree/bindings/interconnect/qcom,sm8450-rpmh.yaml | 2 +- Documentation/devicetree/bindings/iommu/qcom,iommu.yaml | 2 +- Documentation/devicetree/bindings/pinctrl/qcom,mdm9607-tlmm.yaml | 2 +- Documentation/devicetree/bindings/pinctrl/qcom,sm6350-tlmm.yaml | 2 +- Documentation/devicetree/bindings/pinctrl/qcom,sm6375-tlmm.yaml | 2 +- Documentation/devicetree/bindings/remoteproc/qcom,rpm-proc.yaml | 2 +- Documentation/devicetree/bindings/soc/qcom/qcom,rpm-master-stats.yaml | 2 +- 24 files changed, 24 insertions(+), 24 deletions(-) commit 70eac5c3c49195a323387ec237f17f9801cbdb25 Author: Dumitru Ceclan Date: Tue Jul 23 14:13:22 2024 +0300 iio: adc: ad7173: Fix incorrect compatible string Wrong compatible strings are used for AD411x devices. Fix by adding the missing "adi," prefix. Fixes: 13d12e3ad12d ("iio: adc: ad7173: Add support for AD411x devices") Signed-off-by: Dumitru Ceclan Reviewed-by: Nuno Sa Link: https://patch.msgid.link/20240723111322.324947-1-dumitru.ceclan@analog.com Signed-off-by: Jonathan Cameron drivers/iio/adc/ad7173.c | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) commit 84c65d8008764a8fb4e627ff02de01ec4245f2c4 Author: David Lechner Date: Tue Jul 23 11:32:21 2024 -0500 iio: buffer-dmaengine: fix releasing dma channel on error If dma_get_slave_caps() fails, we need to release the dma channel before returning an error to avoid leaking the channel. Fixes: 2d6ca60f3284 ("iio: Add a DMAengine framework based buffer") Signed-off-by: David Lechner Link: https://patch.msgid.link/20240723-iio-fix-dmaengine-free-on-error-v1-1-2c7cbc9b92ff@baylibre.com Cc: Signed-off-by: Jonathan Cameron drivers/iio/buffer/industrialio-buffer-dmaengine.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) commit 90826e08468ba7fb35d8b39645b22d9e80004afe Author: Guillaume Stols Date: Tue Jul 2 12:52:51 2024 +0000 iio: adc: ad7606: remove frstdata check for serial mode The current implementation attempts to recover from an eventual glitch in the clock by checking frstdata state after reading the first channel's sample: If frstdata is low, it will reset the chip and return -EIO. This will only work in parallel mode, where frstdata pin is set low after the 2nd sample read starts. For the serial mode, according to the datasheet, "The FRSTDATA output returns to a logic low following the 16th SCLK falling edge.", thus after the Xth pulse, X being the number of bits in a sample, the check will always be true, and the driver will not work at all in serial mode if frstdata(optional) is defined in the devicetree as it will reset the chip, and return -EIO every time read_sample is called. Hence, this check must be removed for serial mode. Fixes: b9618c0cacd7 ("staging: IIO: ADC: New driver for AD7606/AD7606-6/AD7606-4") Signed-off-by: Guillaume Stols Reviewed-by: Nuno Sa Link: https://patch.msgid.link/20240702-cleanup-ad7606-v3-1-18d5ea18770e@baylibre.com Cc: Signed-off-by: Jonathan Cameron drivers/iio/adc/ad7606.c | 28 ++------------------------ drivers/iio/adc/ad7606.h | 2 ++ drivers/iio/adc/ad7606_par.c | 48 +++++++++++++++++++++++++++++++++++++++++--- 3 files changed, 49 insertions(+), 29 deletions(-) commit b48aa991758999d4e8f9296c5bbe388f293ef465 Author: Aleksandr Mishin Date: Wed Jul 3 18:45:06 2024 +0300 staging: iio: frequency: ad9834: Validate frequency parameter value In ad9834_write_frequency() clk_get_rate() can return 0. In such case ad9834_calc_freqreg() call will lead to division by zero. Checking 'if (fout > (clk_freq / 2))' doesn't protect in case of 'fout' is 0. ad9834_write_frequency() is called from ad9834_write(), where fout is taken from text buffer, which can contain any value. Modify parameters checking. Found by Linux Verification Center (linuxtesting.org) with SVACE. Fixes: 12b9d5bf76bf ("Staging: IIO: DDS: AD9833 / AD9834 driver") Suggested-by: Dan Carpenter Signed-off-by: Aleksandr Mishin Reviewed-by: Dan Carpenter Link: https://patch.msgid.link/20240703154506.25584-1-amishin@t-argos.ru Cc: Signed-off-by: Jonathan Cameron drivers/staging/iio/frequency/ad9834.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit cec6937dd1aae1b38d147bd190cb895d06cf96d0 Author: Linus Torvalds Date: Mon Jul 29 12:05:06 2024 -0700 task_work: make TWA_NMI_CURRENT handling conditional on IRQ_WORK The TWA_NMI_CURRENT handling very much depends on IRQ_WORK, but that isn't universally enabled everywhere. Maybe the IRQ_WORK infrastructure should just be unconditional - x86 ends up indirectly enabling it through unconditionally enabling PERF_EVENTS, for example. But it also gets enabled by having SMP support, or even if you just have PRINTK enabled. But in the meantime TWA_NMI_CURRENT causes tons of build failures on various odd minimal configs. Which did show up in linux-next, but despite that nobody bothered to fix it or even inform me until -rc1 was out. Fixes: 466e4d801cd4 ("task_work: Add TWA_NMI_CURRENT as an additional notify mode") Reported-by: Naresh Kamboju Reported-by: kernelci.org bot Reported-by: Guenter Roeck Cc: Peter Zijlstra Cc: Sebastian Andrzej Siewior Signed-off-by: Linus Torvalds kernel/task_work.c | 6 ++++++ 1 file changed, 6 insertions(+) commit e2d124de0017b7649963e956eb7b80bc84848eb3 Merge: 45d763fe503e dcb6631d0515 Author: Mark Brown Date: Mon Jul 29 19:34:05 2024 +0100 ASoC: codecs: wcd93xx/wsa88xx: Correct Soundwire ports Merge series from Krzysztof Kozlowski : Incorrect mask of Soundwire ports - one bit too long/big - was passed. Theoretically, too wide mask could cause an out of bounds read in sdw_get_slave_dpn_prop() in stream.c, however only in the case of buggy driver, e.g. adding incorrect number of ports via sdw_stream_add_slave(). Not adding Cc-stable because I don't think the issue can lead to real out-of-bounds read. commit 950aeefb34923fe3c28ade35fe05f24e2c5b1d55 Author: Nicolin Chen Date: Wed Jul 17 22:01:30 2024 -0700 iommufd/device: Fix hwpt at err_unresv in iommufd_device_do_replace() The rewind routine should remove the reserved iovas added to the new hwpt. Fixes: 89db31635c87 ("iommufd: Derive iommufd_hwpt_paging from iommufd_hw_pagetable") Cc: stable@vger.kernel.org Link: https://patch.msgid.link/r/20240718050130.1956804-1-nicolinc@nvidia.com Signed-off-by: Nicolin Chen Reviewed-by: Kevin Tian Signed-off-by: Jason Gunthorpe drivers/iommu/iommufd/device.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 2accfdb7eff65f390c4308b0e9cb7c3fe48ad63c Author: Linus Torvalds Date: Mon Jul 29 10:58:28 2024 -0700 profiling: attempt to remove per-cpu profile flip buffer This is the really old legacy kernel profiling code, which has long since been obviated by "real profiling" (ie 'prof' and company), and mainly remains as a source of syzbot reports. There are anecdotal reports that people still use it for boot-time profiling, but it's unlikely that such use would care about the old NUMA optimizations in this code from 2004 (commit ad02973d42: "profile: 512x Altix timer interrupt livelock fix" in the BK import archive at [1]) So in order to head off future syzbot reports, let's try to simplify this code and get rid of the per-cpu profile buffers that are quite a large portion of the complexity footprint of this thing (including CPU hotplug callbacks etc). It's unlikely anybody will actually notice, or possibly, as Thomas put it: "Only people who indulge in nostalgia will notice :)". That said, if it turns out that this code is actually actively used by somebody, we can always revert this removal. Thus the "attempt" in the summary line. [ Note: in a small nod to "the profiling code can cause NUMA problems", this also removes the "increment the last entry in the profiling array on any unknown hits" logic. That would account any program counter in a module to that single counter location, and might exacerbate any NUMA cacheline bouncing issues ] Link: https://lore.kernel.org/all/CAHk-=wgs52BxT4Zjmjz8aNvHWKxf5_ThBY4bYL1Y6CTaNL2dTw@mail.gmail.com/ Link: https://git.kernel.org/pub/scm/linux/kernel/git/tglx/history.git [1] Cc: Thomas Gleixner Cc: Tetsuo Handa Signed-off-by: Linus Torvalds include/linux/cpuhotplug.h | 1 - kernel/profile.c | 183 +-------------------------------------------- 2 files changed, 2 insertions(+), 182 deletions(-) commit 7c51f7bbf057f82aeba3390c39ef61b244181c09 Author: Tetsuo Handa Date: Sat Jul 27 19:59:57 2024 +0900 profiling: remove prof_cpu_mask syzbot is reporting uninit-value at profile_hits(), for there is a race window between if (!alloc_cpumask_var(&prof_cpu_mask, GFP_KERNEL)) return -ENOMEM; cpumask_copy(prof_cpu_mask, cpu_possible_mask); in profile_init() and cpumask_available(prof_cpu_mask) && cpumask_test_cpu(smp_processor_id(), prof_cpu_mask)) in profile_tick(); prof_cpu_mask remains uninitialzed until cpumask_copy() completes while cpumask_available(prof_cpu_mask) returns true as soon as alloc_cpumask_var(&prof_cpu_mask) completes. We could replace alloc_cpumask_var() with zalloc_cpumask_var() and call cpumask_copy() from create_proc_profile() on only UP kernels, for profile_online_cpu() calls cpumask_set_cpu() as needed via cpuhp_setup_state(CPUHP_AP_ONLINE_DYN) on SMP kernels. But this patch removes prof_cpu_mask because it seems unnecessary. The cpumask_test_cpu(smp_processor_id(), prof_cpu_mask) test in profile_tick() is likely always true due to a CPU cannot call profile_tick() if that CPU is offline and cpumask_set_cpu(cpu, prof_cpu_mask) is called when that CPU becomes online and cpumask_clear_cpu(cpu, prof_cpu_mask) is called when that CPU becomes offline . This test could be false during transition between online and offline. But according to include/linux/cpuhotplug.h , CPUHP_PROFILE_PREPARE belongs to PREPARE section, which means that the CPU subjected to profile_dead_cpu() cannot be inside profile_tick() (i.e. no risk of use-after-free bug) because interrupt for that CPU is disabled during PREPARE section. Therefore, this test is guaranteed to be true, and can be removed. (Since profile_hits() checks prof_buffer != NULL, we don't need to check prof_buffer != NULL here unless get_irq_regs() or user_mode() is such slow that we want to avoid when prof_buffer == NULL). do_profile_hits() is called from profile_tick() from timer interrupt only if cpumask_test_cpu(smp_processor_id(), prof_cpu_mask) is true and prof_buffer is not NULL. But syzbot is also reporting that sometimes do_profile_hits() is called while current thread is still doing vzalloc(), where prof_buffer must be NULL at this moment. This indicates that multiple threads concurrently tried to write to /sys/kernel/profiling interface, which caused that somebody else try to re-allocate prof_buffer despite somebody has already allocated prof_buffer. Fix this by using serialization. Reported-by: syzbot Closes: https://syzkaller.appspot.com/bug?extid=b1a83ab2a9eb9321fbdd Signed-off-by: Tetsuo Handa Tested-by: syzbot Signed-off-by: Linus Torvalds kernel/ksysfs.c | 7 +++++++ kernel/profile.c | 46 ++++++---------------------------------------- 2 files changed, 13 insertions(+), 40 deletions(-) commit 99d3bf5f7377d42f8be60a6b9cb60fb0be34dceb Author: Tetsuo Handa Date: Mon Jul 29 21:51:30 2024 +0900 Input: MT - limit max slots syzbot is reporting too large allocation at input_mt_init_slots(), for num_slots is supplied from userspace using ioctl(UI_DEV_CREATE). Since nobody knows possible max slots, this patch chose 1024. Reported-by: syzbot Closes: https://syzkaller.appspot.com/bug?extid=0122fa359a69694395d5 Suggested-by: Dmitry Torokhov Signed-off-by: Tetsuo Handa Signed-off-by: Linus Torvalds drivers/input/input-mt.c | 3 +++ 1 file changed, 3 insertions(+) commit 3894840a7a11aa06cc3b0d5a2d1b5f6878127903 Merge: dc1c8034e31b d7ac67b94390 Author: Linus Torvalds Date: Mon Jul 29 10:33:51 2024 -0700 Merge tag 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/rmk/linux Pull ARM updates from Russell King: - ftrace: don't assume stack frames are contiguous in memory - remove unused mod_inwind_map structure - spelling fixes - allow use of LD dead code/data elimination - fix callchain_trace() return value - add support for stackleak gcc plugin - correct some reset asm function prototypes for CFI [ Missed the merge window because Russell forgot to push out ] * tag 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/rmk/linux: ARM: 9408/1: mm: CFI: Fix some erroneous reset prototypes ARM: 9407/1: Add support for STACKLEAK gcc plugin ARM: 9406/1: Fix callchain_trace() return value ARM: 9404/1: arm32: enable HAVE_LD_DEAD_CODE_DATA_ELIMINATION ARM: 9403/1: Alpine: Spelling s/initialiing/initializing/ ARM: 9402/1: Kconfig: Spelling s/Cortex A-/Cortex-A/ ARM: 9400/1: Remove unused struct 'mod_unwind_map' commit 939b656bc8ab203fdbde26ccac22bcb7f0985be5 Author: Filipe Manana Date: Fri Jul 26 11:12:52 2024 +0100 btrfs: fix corruption after buffer fault in during direct IO append write During an append (O_APPEND write flag) direct IO write if the input buffer was not previously faulted in, we can corrupt the file in a way that the final size is unexpected and it includes an unexpected hole. The problem happens like this: 1) We have an empty file, with size 0, for example; 2) We do an O_APPEND direct IO with a length of 4096 bytes and the input buffer is not currently faulted in; 3) We enter btrfs_direct_write(), lock the inode and call generic_write_checks(), which calls generic_write_checks_count(), and that function sets the iocb position to 0 with the following code: if (iocb->ki_flags & IOCB_APPEND) iocb->ki_pos = i_size_read(inode); 4) We call btrfs_dio_write() and enter into iomap, which will end up calling btrfs_dio_iomap_begin() and that calls btrfs_get_blocks_direct_write(), where we update the i_size of the inode to 4096 bytes; 5) After btrfs_dio_iomap_begin() returns, iomap will attempt to access the page of the write input buffer (at iomap_dio_bio_iter(), with a call to bio_iov_iter_get_pages()) and fail with -EFAULT, which gets returned to btrfs at btrfs_direct_write() via btrfs_dio_write(); 6) At btrfs_direct_write() we get the -EFAULT error, unlock the inode, fault in the write buffer and then goto to the label 'relock'; 7) We lock again the inode, do all the necessary checks again and call again generic_write_checks(), which calls generic_write_checks_count() again, and there we set the iocb's position to 4K, which is the current i_size of the inode, with the following code pointed above: if (iocb->ki_flags & IOCB_APPEND) iocb->ki_pos = i_size_read(inode); 8) Then we go again to btrfs_dio_write() and enter iomap and the write succeeds, but it wrote to the file range [4K, 8K), leaving a hole in the [0, 4K) range and an i_size of 8K, which goes against the expectations of having the data written to the range [0, 4K) and get an i_size of 4K. Fix this by not unlocking the inode before faulting in the input buffer, in case we get -EFAULT or an incomplete write, and not jumping to the 'relock' label after faulting in the buffer - instead jump to a location immediately before calling iomap, skipping all the write checks and relocking. This solves this problem and it's fine even in case the input buffer is memory mapped to the same file range, since only holding the range locked in the inode's io tree can cause a deadlock, it's safe to keep the inode lock (VFS lock), as was fixed and described in commit 51bd9563b678 ("btrfs: fix deadlock due to page faults during direct IO reads and writes"). A sample reproducer provided by a reporter is the following: $ cat test.c #ifndef _GNU_SOURCE #define _GNU_SOURCE #endif #include #include #include #include #include int main(int argc, char *argv[]) { if (argc < 2) { fprintf(stderr, "Usage: %s \n", argv[0]); return 1; } int fd = open(argv[1], O_WRONLY | O_CREAT | O_TRUNC | O_DIRECT | O_APPEND, 0644); if (fd < 0) { perror("creating test file"); return 1; } char *buf = mmap(NULL, 4096, PROT_READ, MAP_PRIVATE | MAP_ANONYMOUS, -1, 0); ssize_t ret = write(fd, buf, 4096); if (ret < 0) { perror("pwritev2"); return 1; } struct stat stbuf; ret = fstat(fd, &stbuf); if (ret < 0) { perror("stat"); return 1; } printf("size: %llu\n", (unsigned long long)stbuf.st_size); return stbuf.st_size == 4096 ? 0 : 1; } A test case for fstests will be sent soon. Reported-by: Hanna Czenczek Link: https://lore.kernel.org/linux-btrfs/0b841d46-12fe-4e64-9abb-871d8d0de271@redhat.com/ Fixes: 8184620ae212 ("btrfs: fix lost file sync on direct IO write with nowait and dsync iocb") CC: stable@vger.kernel.org # 6.1+ Tested-by: Hanna Czenczek Reviewed-by: Josef Bacik Signed-off-by: Filipe Manana Signed-off-by: David Sterba fs/btrfs/ctree.h | 1 + fs/btrfs/direct-io.c | 38 ++++++++++++++++++++++++++++---------- fs/btrfs/file.c | 17 ++++++++++++++--- 3 files changed, 43 insertions(+), 13 deletions(-) commit 8cd44dd1d17a23d5cc8c443c659ca57aa76e2fa5 Author: Naohiro Aota Date: Wed Feb 15 09:18:02 2023 +0900 btrfs: zoned: fix zone_unusable accounting on making block group read-write again When btrfs makes a block group read-only, it adds all free regions in the block group to space_info->bytes_readonly. That free space excludes reserved and pinned regions. OTOH, when btrfs makes the block group read-write again, it moves all the unused regions into the block group's zone_unusable. That unused region includes reserved and pinned regions. As a result, it counts too much zone_unusable bytes. Fortunately (or unfortunately), having erroneous zone_unusable does not affect the calculation of space_info->bytes_readonly, because free space (num_bytes in btrfs_dec_block_group_ro) calculation is done based on the erroneous zone_unusable and it reduces the num_bytes just to cancel the error. This behavior can be easily discovered by adding a WARN_ON to check e.g, "bg->pinned > 0" in btrfs_dec_block_group_ro(), and running fstests test case like btrfs/282. Fix it by properly considering pinned and reserved in btrfs_dec_block_group_ro(). Also, add a WARN_ON and introduce btrfs_space_info_update_bytes_zone_unusable() to catch a similar mistake. Fixes: 169e0da91a21 ("btrfs: zoned: track unusable bytes for zones") CC: stable@vger.kernel.org # 5.15+ Signed-off-by: Naohiro Aota Reviewed-by: Josef Bacik Reviewed-by: Johannes Thumshirn Signed-off-by: David Sterba fs/btrfs/block-group.c | 13 ++++++++----- fs/btrfs/extent-tree.c | 3 ++- fs/btrfs/free-space-cache.c | 4 +++- fs/btrfs/space-info.c | 2 +- fs/btrfs/space-info.h | 1 + include/trace/events/btrfs.h | 8 ++++++++ 6 files changed, 23 insertions(+), 8 deletions(-) commit d89c285d28491d8f10534c262ac9e6bdcbe1b4d2 Author: Naohiro Aota Date: Thu Jul 11 23:50:58 2024 +0900 btrfs: do not subtract delalloc from avail bytes The block group's avail bytes printed when dumping a space info subtract the delalloc_bytes. However, as shown in btrfs_add_reserved_bytes() and btrfs_free_reserved_bytes(), it is added or subtracted along with "reserved" for the delalloc case, which means the "delalloc_bytes" is a part of the "reserved" bytes. So, excluding it to calculate the avail space counts delalloc_bytes twice, which can lead to an invalid result. Fixes: e50b122b832b ("btrfs: print available space for a block group when dumping a space info") CC: stable@vger.kernel.org # 6.6+ Signed-off-by: Naohiro Aota Reviewed-by: Boris Burkov Signed-off-by: David Sterba fs/btrfs/space-info.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) commit 478574370bef7951fbd9ef5155537d6cbed49472 Author: Boris Burkov Date: Mon Jul 22 16:49:45 2024 -0700 btrfs: make cow_file_range_inline() honor locked_page on error The btrfs buffered write path runs through __extent_writepage() which has some tricky return value handling for writepage_delalloc(). Specifically, when that returns 1, we exit, but for other return values we continue and end up calling btrfs_folio_end_all_writers(). If the folio has been unlocked (note that we check the PageLocked bit at the start of __extent_writepage()), this results in an assert panic like this one from syzbot: BTRFS: error (device loop0 state EAL) in free_log_tree:3267: errno=-5 IO failure BTRFS warning (device loop0 state EAL): Skipping commit of aborted transaction. BTRFS: error (device loop0 state EAL) in cleanup_transaction:2018: errno=-5 IO failure assertion failed: folio_test_locked(folio), in fs/btrfs/subpage.c:871 ------------[ cut here ]------------ kernel BUG at fs/btrfs/subpage.c:871! Oops: invalid opcode: 0000 [#1] PREEMPT SMP KASAN PTI CPU: 1 PID: 5090 Comm: syz-executor225 Not tainted 6.10.0-syzkaller-05505-gb1bc554e009e #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/27/2024 RIP: 0010:btrfs_folio_end_all_writers+0x55b/0x610 fs/btrfs/subpage.c:871 Code: e9 d3 fb ff ff e8 25 22 c2 fd 48 c7 c7 c0 3c 0e 8c 48 c7 c6 80 3d 0e 8c 48 c7 c2 60 3c 0e 8c b9 67 03 00 00 e8 66 47 ad 07 90 <0f> 0b e8 6e 45 b0 07 4c 89 ff be 08 00 00 00 e8 21 12 25 fe 4c 89 RSP: 0018:ffffc900033d72e0 EFLAGS: 00010246 RAX: 0000000000000045 RBX: 00fff0000000402c RCX: 663b7a08c50a0a00 RDX: 0000000000000000 RSI: 0000000080000000 RDI: 0000000000000000 RBP: ffffc900033d73b0 R08: ffffffff8176b98c R09: 1ffff9200067adfc R10: dffffc0000000000 R11: fffff5200067adfd R12: 0000000000000001 R13: dffffc0000000000 R14: 0000000000000000 R15: ffffea0001cbee80 FS: 0000000000000000(0000) GS:ffff8880b9500000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f5f076012f8 CR3: 000000000e134000 CR4: 00000000003506f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: __extent_writepage fs/btrfs/extent_io.c:1597 [inline] extent_write_cache_pages fs/btrfs/extent_io.c:2251 [inline] btrfs_writepages+0x14d7/0x2760 fs/btrfs/extent_io.c:2373 do_writepages+0x359/0x870 mm/page-writeback.c:2656 filemap_fdatawrite_wbc+0x125/0x180 mm/filemap.c:397 __filemap_fdatawrite_range mm/filemap.c:430 [inline] __filemap_fdatawrite mm/filemap.c:436 [inline] filemap_flush+0xdf/0x130 mm/filemap.c:463 btrfs_release_file+0x117/0x130 fs/btrfs/file.c:1547 __fput+0x24a/0x8a0 fs/file_table.c:422 task_work_run+0x24f/0x310 kernel/task_work.c:222 exit_task_work include/linux/task_work.h:40 [inline] do_exit+0xa2f/0x27f0 kernel/exit.c:877 do_group_exit+0x207/0x2c0 kernel/exit.c:1026 __do_sys_exit_group kernel/exit.c:1037 [inline] __se_sys_exit_group kernel/exit.c:1035 [inline] __x64_sys_exit_group+0x3f/0x40 kernel/exit.c:1035 x64_sys_call+0x2634/0x2640 arch/x86/include/generated/asm/syscalls_64.h:232 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7f5f075b70c9 Code: Unable to access opcode bytes at 0x7f5f075b709f. I was hitting the same issue by doing hundreds of accelerated runs of generic/475, which also hits IO errors by design. I instrumented that reproducer with bpftrace and found that the undesirable folio_unlock was coming from the following callstack: folio_unlock+5 __process_pages_contig+475 cow_file_range_inline.constprop.0+230 cow_file_range+803 btrfs_run_delalloc_range+566 writepage_delalloc+332 __extent_writepage # inlined in my stacktrace, but I added it here extent_write_cache_pages+622 Looking at the bisected-to patch in the syzbot report, Josef realized that the logic of the cow_file_range_inline error path subtly changing. In the past, on error, it jumped to out_unlock in cow_file_range(), which honors the locked_page, so when we ultimately call folio_end_all_writers(), the folio of interest is still locked. After the change, we always unlocked ignoring the locked_page, on both success and error. On the success path, this all results in returning 1 to __extent_writepage(), which skips the folio_end_all_writers() call, which makes it OK to have unlocked. Fix the bug by wiring the locked_page into cow_file_range_inline() and only setting locked_page to NULL on success. Reported-by: syzbot+a14d8ac9af3a2a4fd0c8@syzkaller.appspotmail.com Fixes: 0586d0a89e77 ("btrfs: move extent bit and page cleanup into cow_file_range_inline") CC: stable@vger.kernel.org # 6.10+ Reviewed-by: Qu Wenruo Signed-off-by: Boris Burkov Signed-off-by: David Sterba fs/btrfs/inode.c | 16 ++++++++++------ 1 file changed, 10 insertions(+), 6 deletions(-) commit 963fb4612295a5c35b1b89c8bff3bdd4f9127af6 Author: Maciej Fijalkowski Date: Fri Jul 26 20:17:16 2024 +0200 ice: xsk: fix txq interrupt mapping ice_cfg_txq_interrupt() internally handles XDP Tx ring. Do not use ice_for_each_tx_ring() in ice_qvec_cfg_msix() as this causing us to treat XDP ring that belongs to queue vector as Tx ring and therefore misconfiguring the interrupts. Fixes: 2d4238f55697 ("ice: Add support for AF_XDP") Reviewed-by: Shannon Nelson Tested-by: Chandan Kumar Rout (A Contingent Worker at Intel) Signed-off-by: Maciej Fijalkowski Signed-off-by: Tony Nguyen drivers/net/ethernet/intel/ice/ice_xsk.c | 24 ++++++++++++++---------- 1 file changed, 14 insertions(+), 10 deletions(-) commit 6044ca26210ba72b3dcc649fae1cbedd9e6ab018 Author: Maciej Fijalkowski Date: Fri Jul 26 20:17:15 2024 +0200 ice: add missing WRITE_ONCE when clearing ice_rx_ring::xdp_prog It is read by data path and modified from process context on remote cpu so it is needed to use WRITE_ONCE to clear the pointer. Fixes: efc2214b6047 ("ice: Add support for XDP") Reviewed-by: Shannon Nelson Tested-by: Chandan Kumar Rout (A Contingent Worker at Intel) Signed-off-by: Maciej Fijalkowski Signed-off-by: Tony Nguyen drivers/net/ethernet/intel/ice/ice_txrx.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit ebc33a3f8d0aeddf19fd5827add24b82ae171829 Author: Maciej Fijalkowski Date: Fri Jul 26 20:17:14 2024 +0200 ice: improve updating ice_{t,r}x_ring::xsk_pool xsk_buff_pool pointers that ice ring structs hold are updated via ndo_bpf that is executed in process context while it can be read by remote CPU at the same time within NAPI poll. Use synchronize_net() after pointer update and {READ,WRITE}_ONCE() when working with mentioned pointer. Fixes: 2d4238f55697 ("ice: Add support for AF_XDP") Reviewed-by: Shannon Nelson Tested-by: Chandan Kumar Rout (A Contingent Worker at Intel) Signed-off-by: Maciej Fijalkowski Signed-off-by: Tony Nguyen drivers/net/ethernet/intel/ice/ice.h | 11 ++-- drivers/net/ethernet/intel/ice/ice_base.c | 4 +- drivers/net/ethernet/intel/ice/ice_main.c | 2 +- drivers/net/ethernet/intel/ice/ice_txrx.c | 8 ++- drivers/net/ethernet/intel/ice/ice_xsk.c | 103 +++++++++++++++++++----------- drivers/net/ethernet/intel/ice/ice_xsk.h | 14 ++-- 6 files changed, 87 insertions(+), 55 deletions(-) commit 9da75a511c5558fa3da56759984fd1fa859186f0 Author: Maciej Fijalkowski Date: Fri Jul 26 20:17:13 2024 +0200 ice: toggle netif_carrier when setting up XSK pool This so we prevent Tx timeout issues. One of conditions checked on running in the background dev_watchdog() is netif_carrier_ok(), so let us turn it off when we disable the queues that belong to a q_vector where XSK pool is being configured. Turn carrier on in ice_qp_ena() only when ice_get_link_status() tells us that physical link is up. Fixes: 2d4238f55697 ("ice: Add support for AF_XDP") Reviewed-by: Shannon Nelson Tested-by: Chandan Kumar Rout (A Contingent Worker at Intel) Signed-off-by: Maciej Fijalkowski Signed-off-by: Tony Nguyen drivers/net/ethernet/intel/ice/ice_xsk.c | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-) commit d5922717994911e8f0eab736f3ba0d968c158823 Author: Maciej Fijalkowski Date: Fri Jul 26 20:17:12 2024 +0200 ice: modify error handling when setting XSK pool in ndo_bpf Don't bail out right when spotting an error within ice_qp_{dis,ena}() but rather track error and go through whole flow of disabling and enabling queue pair. Fixes: 2d4238f55697 ("ice: Add support for AF_XDP") Reviewed-by: Shannon Nelson Tested-by: Chandan Kumar Rout (A Contingent Worker at Intel) Signed-off-by: Maciej Fijalkowski Signed-off-by: Tony Nguyen drivers/net/ethernet/intel/ice/ice_xsk.c | 30 ++++++++++++++++-------------- 1 file changed, 16 insertions(+), 14 deletions(-) commit 405d9999aa0b4ae467ef391d1d9c7e0d30ad0841 Author: Maciej Fijalkowski Date: Fri Jul 26 20:17:11 2024 +0200 ice: replace synchronize_rcu with synchronize_net Given that ice_qp_dis() is called under rtnl_lock, synchronize_net() can be called instead of synchronize_rcu() so that XDP rings can finish its job in a faster way. Also let us do this as earlier in XSK queue disable flow. Additionally, turn off regular Tx queue before disabling irqs and NAPI. Fixes: 2d4238f55697 ("ice: Add support for AF_XDP") Reviewed-by: Shannon Nelson Tested-by: Chandan Kumar Rout (A Contingent Worker at Intel) Signed-off-by: Maciej Fijalkowski Signed-off-by: Tony Nguyen drivers/net/ethernet/intel/ice/ice_xsk.c | 9 ++++----- 1 file changed, 4 insertions(+), 5 deletions(-) commit 1ff72a2f67791cd4ddad19ed830445f57b30e992 Author: Maciej Fijalkowski Date: Fri Jul 26 20:17:10 2024 +0200 ice: don't busy wait for Rx queue disable in ice_qp_dis() When ice driver is spammed with multiple xdpsock instances and flow control is enabled, there are cases when Rx queue gets stuck and unable to reflect the disable state in QRX_CTRL register. Similar issue has previously been addressed in commit 13a6233b033f ("ice: Add support to enable/disable all Rx queues before waiting"). To workaround this, let us simply not wait for a disabled state as later patch will make sure that regardless of the encountered error in the process of disabling a queue pair, the Rx queue will be enabled. Fixes: 2d4238f55697 ("ice: Add support for AF_XDP") Reviewed-by: Shannon Nelson Tested-by: Chandan Kumar Rout (A Contingent Worker at Intel) Signed-off-by: Maciej Fijalkowski Signed-off-by: Tony Nguyen drivers/net/ethernet/intel/ice/ice_xsk.c | 4 +--- 1 file changed, 1 insertion(+), 3 deletions(-) commit ec145a18687fec8dd97eeb4f30057fa4debef577 Author: Michal Kubiak Date: Fri Jul 26 20:17:09 2024 +0200 ice: respect netif readiness in AF_XDP ZC related ndo's Address a scenario in which XSK ZC Tx produces descriptors to XDP Tx ring when link is either not yet fully initialized or process of stopping the netdev has already started. To avoid this, add checks against carrier readiness in ice_xsk_wakeup() and in ice_xmit_zc(). One could argue that bailing out early in ice_xsk_wakeup() would be sufficient but given the fact that we produce Tx descriptors on behalf of NAPI that is triggered for Rx traffic, the latter is also needed. Bringing link up is an asynchronous event executed within ice_service_task so even though interface has been brought up there is still a time frame where link is not yet ok. Without this patch, when AF_XDP ZC Tx is used simultaneously with stack Tx, Tx timeouts occur after going through link flap (admin brings interface down then up again). HW seem to be unable to transmit descriptor to the wire after HW tail register bump which in turn causes bit __QUEUE_STATE_STACK_XOFF to be set forever as netdev_tx_completed_queue() sees no cleaned bytes on the input. Fixes: 126cdfe1007a ("ice: xsk: Improve AF_XDP ZC Tx and use batching API") Fixes: 2d4238f55697 ("ice: Add support for AF_XDP") Reviewed-by: Shannon Nelson Tested-by: Chandan Kumar Rout (A Contingent Worker at Intel) Signed-off-by: Michal Kubiak Signed-off-by: Maciej Fijalkowski Signed-off-by: Tony Nguyen drivers/net/ethernet/intel/ice/ice_xsk.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) commit 7ec5bd247a0d6fb23ab7da2bedd9c3f1f9333c3b Author: Kanchan Joshi Date: Mon Jul 29 12:01:33 2024 +0530 nvme: remove unused parameter First parameter of nvme_init_integrity() is unused. Remove it, and modify the callers. Signed-off-by: Kanchan Joshi Reviewed-by: Sagi Grimberg Reviewed-by: Christoph Hellwig Signed-off-by: Keith Busch drivers/nvme/host/core.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) commit 7ae04ba36b381bffe2471eff3a93edced843240f Author: Mikulas Patocka Date: Sat Jul 27 20:22:52 2024 +0200 parisc: fix a possible DMA corruption ARCH_DMA_MINALIGN was defined as 16 - this is too small - it may be possible that two unrelated 16-byte allocations share a cache line. If one of these allocations is written using DMA and the other is written using cached write, the value that was written with DMA may be corrupted. This commit changes ARCH_DMA_MINALIGN to be 128 on PA20 and 32 on PA1.1 - that's the largest possible cache line size. As different parisc microarchitectures have different cache line size, we define arch_slab_minalign(), cache_line_size() and dma_get_cache_alignment() so that the kernel may tune slab cache parameters dynamically, based on the detected cache line size. Signed-off-by: Mikulas Patocka Cc: stable@vger.kernel.org Signed-off-by: Helge Deller arch/parisc/Kconfig | 1 + arch/parisc/include/asm/cache.h | 11 ++++++++++- 2 files changed, 11 insertions(+), 1 deletion(-) commit 1fd2c10acb7b35d72101a4619ee5b2cddb9efd3a Author: Mikulas Patocka Date: Sat Jul 27 12:11:02 2024 +0200 parisc: fix unaligned accesses in BPF There were spurious unaligned access warnings when calling BPF code. Sometimes, the warnings were triggered with any incoming packet, making the machine hard to use. The reason for the warnings is this: on parisc64, pointers to functions are not really pointers to functions, they are pointers to 16-byte descriptor. The first 8 bytes of the descriptor is a pointer to the function and the next 8 bytes of the descriptor is the content of the "dp" register. This descriptor is generated in the function bpf_jit_build_prologue. The problem is that the function bpf_int_jit_compile advertises 4-byte alignment when calling bpf_jit_binary_alloc, bpf_jit_binary_alloc randomizes the returned array and if the array happens to be not aligned on 8-byte boundary, the descriptor generated in bpf_jit_build_prologue is also not aligned and this triggers the unaligned access warning. Fix this by advertising 8-byte alignment on parisc64 when calling bpf_jit_binary_alloc. Signed-off-by: Mikulas Patocka Cc: stable@vger.kernel.org Signed-off-by: Helge Deller arch/parisc/net/bpf_jit_core.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit f872d4af79fe8c71ae291ce8875b477e1669a6c7 Author: Arseniy Krasnov Date: Mon Jul 29 16:18:50 2024 +0300 irqchip/meson-gpio: Convert meson_gpio_irq_controller::lock to 'raw_spinlock_t' This lock is acquired under irq_desc::lock with interrupts disabled. When PREEMPT_RT is enabled, 'spinlock_t' becomes preemptible, which results in invalid lock acquire context; [ BUG: Invalid wait context ] swapper/0/1 is trying to lock: ffff0000008fed30 (&ctl->lock){....}-{3:3}, at: meson_gpio_irq_update_bits0 other info that might help us debug this: context-{5:5} 3 locks held by swapper/0/1: #0: ffff0000003cd0f8 (&dev->mutex){....}-{4:4}, at: __driver_attach+0x90c #1: ffff000004714650 (&desc->request_mutex){+.+.}-{4:4}, at: __setup_irq0 #2: ffff0000047144c8 (&irq_desc_lock_class){-.-.}-{2:2}, at: __setup_irq0 stack backtrace: CPU: 1 PID: 1 Comm: swapper/0 Not tainted 6.9.9-sdkernel #1 Call trace: _raw_spin_lock_irqsave+0x60/0x88 meson_gpio_irq_update_bits+0x34/0x70 meson8_gpio_irq_set_type+0x78/0xc4 meson_gpio_irq_set_type+0x30/0x60 __irq_set_trigger+0x60/0x180 __setup_irq+0x30c/0x6e0 request_threaded_irq+0xec/0x1a4 Fixes: 215f4cc0fb20 ("irqchip/meson: Add support for gpio interrupt controller") Signed-off-by: Arseniy Krasnov Signed-off-by: Thomas Gleixner Cc: stable@vger.kernel.org Link: https://lore.kernel.org/all/20240729131850.3015508-1-avkrasnov@salutedevices.com drivers/irqchip/irq-meson-gpio.c | 14 +++++++------- 1 file changed, 7 insertions(+), 7 deletions(-) commit 0f7ced7d620ecc7a986843d6aeec41cce3116f41 Author: Jonathan Cameron Date: Mon Jul 29 11:55:04 2024 +0100 x86/aperfmperf: Fix deadlock on cpu_hotplug_lock The broken patch results in a call to init_freq_invariance_cppc() in a CPU hotplug handler in both the path for initially present CPUs and those hotplugged later. That function includes a one time call to amd_set_max_freq_ratio() which in turn calls freq_invariance_enable() that has a static_branch_enable() which takes the cpu_hotlug_lock which is already held. Avoid the deadlock by using static_branch_enable_cpuslocked() as the lock will always be already held. The equivalent path on Intel does not already hold this lock, so take it around the call to freq_invariance_enable(), which results in it being held over the call to register_syscall_ops, which looks to be safe to do. Fixes: c1385c1f0ba3 ("ACPI: processor: Simplify initial onlining to use same path for cold and hotplug") Closes: https://lore.kernel.org/all/CABXGCsPvqBfL5hQDOARwfqasLRJ_eNPBbCngZ257HOe=xbWDkA@mail.gmail.com/ Reported-by: Mikhail Gavrilov Suggested-by: Thomas Gleixner Signed-off-by: Jonathan Cameron Signed-off-by: Borislav Petkov (AMD) Reviewed-by: Thomas Gleixner Tested-by: Mikhail Gavrilov Tested-by: Borislav Petkov (AMD) Link: https://lore.kernel.org/r/20240729105504.2170-1-Jonathan.Cameron@huawei.com arch/x86/kernel/cpu/aperfmperf.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) commit 45d763fe503e6e0f180f873b750aea307e73fdcf Author: Paul Handrigan Date: Fri Jul 26 10:11:11 2024 -0500 ASoC: cs530x: Change IN HPF Select kcontrol name Change to the IN HPF Select kcontrol to the correct name IN DEC Filter Select. Signed-off-by: Paul Handrigan Link: https://patch.msgid.link/20240726151111.3247774-1-paulha@opensource.cirrus.com Signed-off-by: Mark Brown sound/soc/codecs/cs530x.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) commit c118478665f467e57d06b2354de65974b246b82b Author: Bruno Ancona Date: Sun Jul 28 22:50:32 2024 -0600 ASoC: amd: yc: Support mic on HP 14-em0002la Add support for the internal microphone for HP 14-em0002la laptop using a quirk entry. Signed-off-by: Bruno Ancona Link: https://patch.msgid.link/20240729045032.223230-1-brunoanconasala@gmail.com Signed-off-by: Mark Brown sound/soc/amd/yc/acp6x-mach.c | 7 +++++++ 1 file changed, 7 insertions(+) commit 6b99068d5ea0aa295f15f30afc98db74d056ec7b Author: Jerome Audu Date: Sat Jul 27 15:40:15 2024 +0200 ASoC: sti: add missing probe entry for player and reader This patch addresses a regression in the ASoC STI drivers that was introduced in Linux version 6.6.y. The issue originated from a series of patches (see https://lore.kernel.org/all/87wmy5b0wt.wl-kuninori.morimoto.gx@renesas.com/) that unintentionally omitted necessary probe functions for the player and reader components. Probe function in `sound/soc/sti/sti_uniperif.c:415` is being replaced by another probe function located at `sound/soc/sti/sti_uniperif.c:453`, which should instead be derived from the player and reader components. This patch correctly reinserts the missing probe entries, restoring the intended functionality. Fixes: 9f625f5e6cf9 ("ASoC: sti: merge DAI call back functions into ops") Signed-off-by: Jerome Audu Link: https://patch.msgid.link/20240727-sti-audio-fix-v2-1-208bde546c3f@free.fr Signed-off-by: Mark Brown sound/soc/sti/sti_uniperif.c | 2 +- sound/soc/sti/uniperif.h | 1 + sound/soc/sti/uniperif_player.c | 1 + sound/soc/sti/uniperif_reader.c | 1 + 4 files changed, 4 insertions(+), 1 deletion(-) commit dcb6631d05152930e2ea70fd2abfd811b0e970b5 Author: Krzysztof Kozlowski Date: Fri Jul 26 16:10:46 2024 +0200 ASoC: codecs: wsa884x: Correct Soundwire ports mask Device has up to WSA884X_MAX_SWR_PORTS number of ports and the array assigned to prop.sink_dpn_prop has 0..WSA884X_MAX_SWR_PORTS-1 elements. On the other hand, GENMASK(high, low) creates an inclusive mask between , so we need the mask from 0 up to WSA884X_MAX_SWR_PORTS-1. Theoretically, too wide mask could cause an out of bounds read in sdw_get_slave_dpn_prop() in stream.c, however only in the case of buggy driver, e.g. adding incorrect number of ports via sdw_stream_add_slave(). Fixes: aa21a7d4f68a ("ASoC: codecs: wsa884x: Add WSA884x family of speakers") Signed-off-by: Krzysztof Kozlowski Link: https://patch.msgid.link/20240726-asoc-wcd-wsa-swr-ports-genmask-v1-6-d4d7a8b56f05@linaro.org Signed-off-by: Mark Brown sound/soc/codecs/wsa884x.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 6801ac36f25690e14955f7f9eace1eaa29edbdd0 Author: Krzysztof Kozlowski Date: Fri Jul 26 16:10:45 2024 +0200 ASoC: codecs: wsa883x: Correct Soundwire ports mask Device has up to WSA883X_MAX_SWR_PORTS number of ports and the array assigned to prop.sink_dpn_prop has 0..WSA883X_MAX_SWR_PORTS-1 elements. On the other hand, GENMASK(high, low) creates an inclusive mask between , so we need the mask from 0 up to WSA883X_MAX_SWR_PORTS-1. Theoretically, too wide mask could cause an out of bounds read in sdw_get_slave_dpn_prop() in stream.c, however only in the case of buggy driver, e.g. adding incorrect number of ports via sdw_stream_add_slave(). Fixes: 43b8c7dc85a1 ("ASoC: codecs: add wsa883x amplifier support") Signed-off-by: Krzysztof Kozlowski Link: https://patch.msgid.link/20240726-asoc-wcd-wsa-swr-ports-genmask-v1-5-d4d7a8b56f05@linaro.org Signed-off-by: Mark Brown sound/soc/codecs/wsa883x.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit eb11c3bb64ad0a05aeacdb01039863aa2aa3614b Author: Krzysztof Kozlowski Date: Fri Jul 26 16:10:44 2024 +0200 ASoC: codecs: wsa881x: Correct Soundwire ports mask Device has up to WSA881X_MAX_SWR_PORTS number of ports and the array assigned to prop.sink_dpn_prop has 0..WSA881X_MAX_SWR_PORTS-1 elements. On the other hand, GENMASK(high, low) creates an inclusive mask between , so we need the mask from 0 up to WSA881X_MAX_SWR_PORTS-1. Theoretically, too wide mask could cause an out of bounds read in sdw_get_slave_dpn_prop() in stream.c, however only in the case of buggy driver, e.g. adding incorrect number of ports via sdw_stream_add_slave(). Fixes: a0aab9e1404a ("ASoC: codecs: add wsa881x amplifier support") Signed-off-by: Krzysztof Kozlowski Link: https://patch.msgid.link/20240726-asoc-wcd-wsa-swr-ports-genmask-v1-4-d4d7a8b56f05@linaro.org Signed-off-by: Mark Brown sound/soc/codecs/wsa881x.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 74a79977c4e1d09eced33e6e22f875a5bb3fad29 Author: Krzysztof Kozlowski Date: Fri Jul 26 16:10:43 2024 +0200 ASoC: codecs: wcd939x-sdw: Correct Soundwire ports mask Device has up to WCD939X_MAX_TX_SWR_PORTS (or WCD939X_MAX_RX_SWR_PORTS for sink) number of ports and the array assigned to prop.src_dpn_prop and prop.sink_dpn_prop has 0..WCD939X_MAX_TX_SWR_PORTS-1 elements. On the other hand, GENMASK(high, low) creates an inclusive mask between , so we need the mask from 0 up to WCD939X_MAX_TX_SWR_PORTS-1. Theoretically, too wide mask could cause an out of bounds read in sdw_get_slave_dpn_prop() in stream.c, however only in the case of buggy driver, e.g. adding incorrect number of ports via sdw_stream_add_slave(). Fixes: be2af391cea0 ("ASoC: codecs: Add WCD939x Soundwire devices driver") Signed-off-by: Krzysztof Kozlowski Link: https://patch.msgid.link/20240726-asoc-wcd-wsa-swr-ports-genmask-v1-3-d4d7a8b56f05@linaro.org Signed-off-by: Mark Brown sound/soc/codecs/wcd939x-sdw.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) commit 3f6fb03dae9c7dfba7670858d29e03c8faaa89fe Author: Krzysztof Kozlowski Date: Fri Jul 26 16:10:42 2024 +0200 ASoC: codecs: wcd938x-sdw: Correct Soundwire ports mask Device has up to WCD938X_MAX_SWR_PORTS number of ports and the array assigned to prop.src_dpn_prop and prop.sink_dpn_prop has 0..WCD938X_MAX_SWR_PORTS-1 elements. On the other hand, GENMASK(high, low) creates an inclusive mask between , so we need the mask from 0 up to WCD938X_MAX_SWR_PORTS-1. Theoretically, too wide mask could cause an out of bounds read in sdw_get_slave_dpn_prop() in stream.c, however only in the case of buggy driver, e.g. adding incorrect number of ports via sdw_stream_add_slave(). Fixes: 16572522aece ("ASoC: codecs: wcd938x-sdw: add SoundWire driver") Signed-off-by: Krzysztof Kozlowski Link: https://patch.msgid.link/20240726-asoc-wcd-wsa-swr-ports-genmask-v1-2-d4d7a8b56f05@linaro.org Signed-off-by: Mark Brown sound/soc/codecs/wcd938x-sdw.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) commit aebb1813c279ce8f3a2dfa3f86def0c0ec1cbb8d Author: Krzysztof Kozlowski Date: Fri Jul 26 16:10:41 2024 +0200 ASoC: codecs: wcd937x-sdw: Correct Soundwire ports mask Device has up to WCD937X_MAX_TX_SWR_PORTS (or WCD937X_MAX_SWR_PORTS for sink) number of ports and the array assigned to prop.src_dpn_prop and prop.sink_dpn_prop has 0..WCD937X_MAX_TX_SWR_PORTS-1 elements. On the other hand, GENMASK(high, low) creates an inclusive mask between , so we need the mask from 0 up to WCD937X_MAX_TX_SWR_PORTS-1. Theoretically, too wide mask could cause an out of bounds read in sdw_get_slave_dpn_prop() in stream.c, however only in the case of buggy driver, e.g. adding incorrect number of ports via sdw_stream_add_slave(). Fixes: c99a515ff153 ("ASoC: codecs: wcd937x-sdw: add SoundWire driver") Signed-off-by: Krzysztof Kozlowski Link: https://patch.msgid.link/20240726-asoc-wcd-wsa-swr-ports-genmask-v1-1-d4d7a8b56f05@linaro.org Signed-off-by: Mark Brown sound/soc/codecs/wcd937x-sdw.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) commit aa4f76ef09a993efa9b5fab6ddf5d6d324baaea3 Author: Shengjiu Wang Date: Thu Jul 25 16:54:54 2024 +0800 ASoC: fsl_micfil: Differentiate register access permission for platforms On i.MX9x platforms, the REG_MICFIL_FSYNC_CTRL, REG_MICFIL_VERID, REG_MICFIL_PARAM are added, but they are not existed on i.MX8x platforms. Use the existed micfil->soc->use_verid to distinguish the access permission for these platforms. Signed-off-by: Shengjiu Wang Link: https://patch.msgid.link/1721897694-6088-3-git-send-email-shengjiu.wang@nxp.com Signed-off-by: Mark Brown sound/soc/fsl/fsl_micfil.c | 18 ++++++++++++++---- 1 file changed, 14 insertions(+), 4 deletions(-) commit 4ddd51ccff911a2e9e961307692532a325f6c78a Author: Shengjiu Wang Date: Thu Jul 25 16:54:53 2024 +0800 ASoC: fsl_micfil: Expand the range of FIFO watermark mask On the i.MX9x platforms, the mask of FIFO watermark is 0x1F, on i.MX8x platforms, the mask of FIFO watermark is 0X7. So use the mask 0x1F for all platforms to make them compatible. Signed-off-by: Shengjiu Wang Link: https://patch.msgid.link/1721897694-6088-2-git-send-email-shengjiu.wang@nxp.com Signed-off-by: Mark Brown sound/soc/fsl/fsl_micfil.c | 2 +- sound/soc/fsl/fsl_micfil.h | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) commit 039564d2fd37b122ec0d268e2ee6334e7169e225 Merge: 9415d375d852 7c70bcc2a84c Author: David S. Miller Date: Mon Jul 29 13:31:28 2024 +0100 Merge branch 'mptcp-endpoint-readd-fixes' into main Matthieu Baerts says: ==================== mptcp: fix signal endpoint readd Issue #501 [1] showed that the Netlink PM currently doesn't correctly support removal and re-add of signal endpoints. Patches 1 and 2 address the issue: the first one in the userspace path- manager, introduced in v5.19 ; and the second one in the in-kernel path- manager, introduced in v5.7. Patch 3 introduces a related selftest. There is no 'Fixes' tag, because it might be hard to backport it automatically, as missing helpers in Bash will not be caught when compiling the kernel or the selftests. The last two patches address two small issues in the MPTCP selftests, one introduced in v6.6., and the other one in v5.17. Link: https://github.com/multipath-tcp/mptcp_net-next/issues/501 [1] ==================== Signed-off-by: Matthieu Baerts (NGI0) Signed-off-by: David S. Miller commit 7c70bcc2a84cf925f655ea1ac4b8088062b144a3 Author: Liu Jing Date: Sat Jul 27 11:04:03 2024 +0200 selftests: mptcp: always close input's FD if opened In main_loop_s function, when the open(cfg_input, O_RDONLY) function is run, the last fd is not closed if the "--cfg_repeat > 0" branch is not taken. Fixes: 05be5e273c84 ("selftests: mptcp: add disconnect tests") Cc: stable@vger.kernel.org Signed-off-by: Liu Jing Reviewed-by: Matthieu Baerts (NGI0) Signed-off-by: Matthieu Baerts (NGI0) Signed-off-by: David S. Miller tools/testing/selftests/net/mptcp/mptcp_connect.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) commit 4a2f48992ddf4b8c2fba846c6754089edae6db5a Author: Paolo Abeni Date: Sat Jul 27 11:04:02 2024 +0200 selftests: mptcp: fix error path pm_nl_check_endpoint() currently calls an not existing helper to mark the test as failed. Fix the wrong call. Fixes: 03668c65d153 ("selftests: mptcp: join: rework detailed report") Cc: stable@vger.kernel.org Signed-off-by: Paolo Abeni Reviewed-by: Matthieu Baerts (NGI0) Signed-off-by: Matthieu Baerts (NGI0) Signed-off-by: David S. Miller tools/testing/selftests/net/mptcp/mptcp_join.sh | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit b5e2fb832f48bc01d937a053e0550a1465a2f05d Author: Paolo Abeni Date: Sat Jul 27 11:04:01 2024 +0200 selftests: mptcp: add explicit test case for remove/readd Delete and re-create a signal endpoint and ensure that the PM actually deletes and re-create the subflow. Signed-off-by: Paolo Abeni Reviewed-by: Matthieu Baerts (NGI0) Signed-off-by: Matthieu Baerts (NGI0) Signed-off-by: David S. Miller tools/testing/selftests/net/mptcp/mptcp_join.sh | 29 +++++++++++++++++++++++++ 1 file changed, 29 insertions(+) commit 4b317e0eb287bd30a1b329513531157c25e8b692 Author: Paolo Abeni Date: Sat Jul 27 11:04:00 2024 +0200 mptcp: fix NL PM announced address accounting Currently the per connection announced address counter is never decreased. As a consequence, after connection establishment, if the NL PM deletes an endpoint and adds a new/different one, no additional subflow is created for the new endpoint even if the current limits allow that. Address the issue properly updating the signaled address counter every time the NL PM removes such addresses. Fixes: 01cacb00b35c ("mptcp: add netlink-based PM") Cc: stable@vger.kernel.org Signed-off-by: Paolo Abeni Reviewed-by: Matthieu Baerts (NGI0) Signed-off-by: Matthieu Baerts (NGI0) Signed-off-by: David S. Miller net/mptcp/pm_netlink.c | 10 ++++++---- 1 file changed, 6 insertions(+), 4 deletions(-) commit 167b93258d1e2230ee3e8a97669b4db4cc9e90aa Author: Paolo Abeni Date: Sat Jul 27 11:03:59 2024 +0200 mptcp: fix user-space PM announced address accounting Currently the per-connection announced address counter is never decreased. When the user-space PM is in use, this just affect the information exposed via diag/sockopt, but it could still foul the PM to wrong decision. Add the missing accounting for the user-space PM's sake. Fixes: 8b1c94da1e48 ("mptcp: only send RM_ADDR in nl_cmd_remove") Cc: stable@vger.kernel.org Signed-off-by: Paolo Abeni Reviewed-by: Matthieu Baerts (NGI0) Signed-off-by: Matthieu Baerts (NGI0) Signed-off-by: David S. Miller net/mptcp/pm_netlink.c | 17 +++++++++++++---- 1 file changed, 13 insertions(+), 4 deletions(-) commit 0ba521d6948ecb4acf1276494dfed127fe096ca6 Author: Miguel Ojeda Date: Thu Jul 25 20:46:44 2024 +0200 rust: macros: indent list item in `module!`'s docs Like commit e516211f615f ("rust: macros: indent list item in `paste!`'s docs"), but for `module!`. Reviewed-by: Trevor Gross Link: https://lore.kernel.org/r/20240725184644.135185-1-ojeda@kernel.org Signed-off-by: Miguel Ojeda rust/macros/lib.rs | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 4bc14b9cfaa2149d41baef2f2620e9f82d9847d7 Author: Umesh Nerlige Ramappa Date: Fri Jun 28 17:56:43 2024 -0700 i915/perf: Remove code to update PWR_CLK_STATE for gen12 PWR_CLK_STATE only needs to be modified up until gen11. For gen12 this code is not applicable. Remove code to update context image with PWR_CLK_STATE for gen12. Fixes: 00a7f0d7155c ("drm/i915/tgl: Add perf support on TGL") Signed-off-by: Umesh Nerlige Ramappa Reviewed-by: Ashutosh Dixit Link: https://patchwork.freedesktop.org/patch/msgid/20240629005643.3050678-1-umesh.nerlige.ramappa@intel.com (cherry picked from commit 7b5bdae7740eb6a3d09f9cd4e4b07362a15b86b3) Signed-off-by: Joonas Lahtinen drivers/gpu/drm/i915/i915_perf.c | 33 --------------------------------- 1 file changed, 33 deletions(-) commit 3c0b6f924e1259ade38587ea719b693f6f6f2f3e Author: Mavroudis Chatzilazaridis Date: Sun Jul 28 12:36:04 2024 +0000 ALSA: hda/realtek: Add quirk for Acer Aspire E5-574G ALC255_FIXUP_ACER_LIMIT_INT_MIC_BOOST fixes combo jack detection and limits the internal microphone boost that causes clipping on this model. Signed-off-by: Mavroudis Chatzilazaridis Cc: Link: https://patch.msgid.link/20240728123601.144017-1-mavchatz@protonmail.com Signed-off-by: Takashi Iwai sound/pci/hda/patch_realtek.c | 1 + 1 file changed, 1 insertion(+) commit 137d9e76ae0b51d9b39c17e2675dae09de5f16e3 Merge: 8400291e289e cc5049007d72 Author: Nishanth Menon Date: Mon Jul 29 06:36:08 2024 -0500 Merge tag 'ti-k3-dt-for-v6.11-part2' into ti-k3-dts-next Late fixes towards v6.11-rc1 First patch fixes warning splat seen on J784S4 due to overlapping serdes0 lane. Second patch cleans up the serdes0 references for readability Signed-off-by: Nishanth Menon commit 9415d375d8520e0ed55f0c0b058928da9a5b5b3d Author: Kuniyuki Iwashima Date: Fri Jul 26 17:19:53 2024 -0700 rtnetlink: Don't ignore IFLA_TARGET_NETNSID when ifname is specified in rtnl_dellink(). The cited commit accidentally replaced tgt_net with net in rtnl_dellink(). As a result, IFLA_TARGET_NETNSID is ignored if the interface is specified with IFLA_IFNAME or IFLA_ALT_IFNAME. Let's pass tgt_net to rtnl_dev_get(). Fixes: cc6090e985d7 ("net: rtnetlink: introduce helper to get net_device instance by ifname") Signed-off-by: Kuniyuki Iwashima Reviewed-by: Jakub Kicinski Signed-off-by: David S. Miller net/core/rtnetlink.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 799a829507506924add8a7620493adc1c3cfda30 Author: Andy Chiu Date: Fri Jul 26 15:06:50 2024 +0800 net: axienet: start napi before enabling Rx/Tx softirq may get lost if an Rx interrupt comes before we call napi_enable. Move napi_enable in front of axienet_setoptions(), which turns on the device, to address the issue. Link: https://lists.gnu.org/archive/html/qemu-devel/2024-07/msg06160.html Fixes: cc37610caaf8 ("net: axienet: implement NAPI and GRO receive") Signed-off-by: Andy Chiu Reviewed-by: Eric Dumazet Signed-off-by: David S. Miller drivers/net/ethernet/xilinx/xilinx_axienet_main.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 05f76b2d634e65ab34472802d9b142ea9e03f74e Author: Subash Abhinov Kasiviswanathan Date: Fri Jul 26 13:41:05 2024 -0700 tcp: Adjust clamping window for applications specifying SO_RCVBUF tp->scaling_ratio is not updated based on skb->len/skb->truesize once SO_RCVBUF is set leading to the maximum window scaling to be 25% of rcvbuf after commit dfa2f0483360 ("tcp: get rid of sysctl_tcp_adv_win_scale") and 50% of rcvbuf after commit 697a6c8cec03 ("tcp: increase the default TCP scaling ratio"). 50% tries to emulate the behavior of older kernels using sysctl_tcp_adv_win_scale with default value. Systems which were using a different values of sysctl_tcp_adv_win_scale in older kernels ended up seeing reduced download speeds in certain cases as covered in https://lists.openwall.net/netdev/2024/05/15/13 While the sysctl scheme is no longer acceptable, the value of 50% is a bit conservative when the skb->len/skb->truesize ratio is later determined to be ~0.66. Applications not specifying SO_RCVBUF update the window scaling and the receiver buffer every time data is copied to userspace. This computation is now used for applications setting SO_RCVBUF to update the maximum window scaling while ensuring that the receive buffer is within the application specified limit. Fixes: dfa2f0483360 ("tcp: get rid of sysctl_tcp_adv_win_scale") Signed-off-by: Sean Tranchetti Signed-off-by: Subash Abhinov Kasiviswanathan Reviewed-by: Eric Dumazet Signed-off-by: David S. Miller net/ipv4/tcp_input.c | 23 ++++++++++++++++------- 1 file changed, 16 insertions(+), 7 deletions(-) commit fe7a11c78d2a9bdb8b50afc278a31ac177000948 Author: Yang Yingliang Date: Wed Jul 3 11:16:10 2024 +0800 sched/core: Fix unbalance set_rq_online/offline() in sched_cpu_deactivate() If cpuset_cpu_inactive() fails, set_rq_online() need be called to rollback. Fixes: 120455c514f7 ("sched: Fix hotplug vs CPU bandwidth control") Cc: stable@kernel.org Signed-off-by: Yang Yingliang Signed-off-by: Peter Zijlstra (Intel) Link: https://lore.kernel.org/r/20240703031610.587047-5-yangyingliang@huaweicloud.com kernel/sched/core.c | 1 + 1 file changed, 1 insertion(+) commit 2f027354122f58ee846468a6f6b48672fff92e9b Author: Yang Yingliang Date: Wed Jul 3 11:16:09 2024 +0800 sched/core: Introduce sched_set_rq_on/offline() helper Introduce sched_set_rq_on/offline() helper, so it can be called in normal or error path simply. No functional changed. Cc: stable@kernel.org Signed-off-by: Yang Yingliang Signed-off-by: Peter Zijlstra (Intel) Link: https://lore.kernel.org/r/20240703031610.587047-4-yangyingliang@huaweicloud.com kernel/sched/core.c | 40 ++++++++++++++++++++++++++-------------- 1 file changed, 26 insertions(+), 14 deletions(-) commit e22f910a26cc2a3ac9c66b8e935ef2a7dd881117 Author: Yang Yingliang Date: Wed Jul 3 11:16:08 2024 +0800 sched/smt: Fix unbalance sched_smt_present dec/inc I got the following warn report while doing stress test: jump label: negative count! WARNING: CPU: 3 PID: 38 at kernel/jump_label.c:263 static_key_slow_try_dec+0x9d/0xb0 Call Trace: __static_key_slow_dec_cpuslocked+0x16/0x70 sched_cpu_deactivate+0x26e/0x2a0 cpuhp_invoke_callback+0x3ad/0x10d0 cpuhp_thread_fun+0x3f5/0x680 smpboot_thread_fn+0x56d/0x8d0 kthread+0x309/0x400 ret_from_fork+0x41/0x70 ret_from_fork_asm+0x1b/0x30 Because when cpuset_cpu_inactive() fails in sched_cpu_deactivate(), the cpu offline failed, but sched_smt_present is decremented before calling sched_cpu_deactivate(), it leads to unbalanced dec/inc, so fix it by incrementing sched_smt_present in the error path. Fixes: c5511d03ec09 ("sched/smt: Make sched_smt_present track topology") Cc: stable@kernel.org Signed-off-by: Yang Yingliang Signed-off-by: Peter Zijlstra (Intel) Reviewed-by: Chen Yu Reviewed-by: Tim Chen Link: https://lore.kernel.org/r/20240703031610.587047-3-yangyingliang@huaweicloud.com kernel/sched/core.c | 1 + 1 file changed, 1 insertion(+) commit 31b164e2e4af84d08d2498083676e7eeaa102493 Author: Yang Yingliang Date: Wed Jul 3 11:16:07 2024 +0800 sched/smt: Introduce sched_smt_present_inc/dec() helper Introduce sched_smt_present_inc/dec() helper, so it can be called in normal or error path simply. No functional changed. Cc: stable@kernel.org Signed-off-by: Yang Yingliang Signed-off-by: Peter Zijlstra (Intel) Link: https://lore.kernel.org/r/20240703031610.587047-2-yangyingliang@huaweicloud.com kernel/sched/core.c | 26 +++++++++++++++++++------- 1 file changed, 19 insertions(+), 7 deletions(-) commit 77baa5bafcbe1b2a15ef9c37232c21279c95481c Author: Zheng Zucheng Date: Fri Jul 26 02:32:35 2024 +0000 sched/cputime: Fix mul_u64_u64_div_u64() precision for cputime In extreme test scenarios: the 14th field utime in /proc/xx/stat is greater than sum_exec_runtime, utime = 18446744073709518790 ns, rtime = 135989749728000 ns In cputime_adjust() process, stime is greater than rtime due to mul_u64_u64_div_u64() precision problem. before call mul_u64_u64_div_u64(), stime = 175136586720000, rtime = 135989749728000, utime = 1416780000. after call mul_u64_u64_div_u64(), stime = 135989949653530 unsigned reversion occurs because rtime is less than stime. utime = rtime - stime = 135989749728000 - 135989949653530 = -199925530 = (u64)18446744073709518790 Trigger condition: 1). User task run in kernel mode most of time 2). ARM64 architecture 3). TICK_CPU_ACCOUNTING=y CONFIG_VIRT_CPU_ACCOUNTING_NATIVE is not set Fix mul_u64_u64_div_u64() conversion precision by reset stime to rtime Fixes: 3dc167ba5729 ("sched/cputime: Improve cputime_adjust()") Signed-off-by: Zheng Zucheng Signed-off-by: Peter Zijlstra (Intel) Cc: Link: https://lkml.kernel.org/r/20240726023235.217771-1-zhengzucheng@huawei.com kernel/sched/cputime.c | 6 ++++++ 1 file changed, 6 insertions(+) commit b1d0e15c8725d21a73c22c099418a63940261041 Author: Zhenyu Wang Date: Wed Jul 17 11:16:09 2024 +0800 perf/x86/intel/cstate: Add pkg C2 residency counter for Sierra Forest Package C2 residency counter is also available on Sierra Forest. So add it support in srf_cstates. Fixes: 3877d55a0db2 ("perf/x86/intel/cstate: Add Sierra Forest support") Signed-off-by: Zhenyu Wang Signed-off-by: Peter Zijlstra (Intel) Reviewed-by: Kan Liang Tested-by: Wendy Wang Link: https://lore.kernel.org/r/20240717031609.74513-1-zhenyuw@linux.intel.com arch/x86/events/intel/cstate.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) commit 6623b0217d0c9bed80bfa43b778ce1c0eb03b497 Author: Uros Bizjak Date: Sun Jul 21 18:45:41 2024 +0200 locking/pvqspinlock: Correct the type of "old" variable in pv_kick_node() "enum vcpu_state" is not compatible with "u8" type for all targets, resulting in: error: initialization of 'u8 *' {aka 'unsigned char *'} from incompatible pointer type 'enum vcpu_state *' for LoongArch. Correct the type of "old" variable to "u8". Fixes: fea0e1820b51 ("locking/pvqspinlock: Use try_cmpxchg() in qspinlock_paravirt.h") Closes: https://lore.kernel.org/lkml/20240719024010.3296488-1-maobibo@loongson.cn/ Reported-by: Bibo Mao Signed-off-by: Uros Bizjak Signed-off-by: Peter Zijlstra (Intel) Acked-by: Waiman Long Link: https://lore.kernel.org/r/20240721164552.50175-1-ubizjak@gmail.com kernel/locking/qspinlock_paravirt.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit e96a79b19a8499ce2f22ccf0e6b0192e9dcff001 Merge: 9da49aa80d68 0d6ccfe6b319 Author: David S. Miller Date: Mon Jul 29 10:59:08 2024 +0100 Merge branch 'ethtool-rss-fixes' into main Jakub Kicinski says; ==================== ethtool: more RSS fixes More fixes for RSS setting. First two patches fix my own bugs in bnxt conversion to the new API. The third patch fixes what seems to be a 10 year old issue (present since the Linux RSS API was created). Fourth patch fixes an issue with the XArray state being out of sync. And then a small test. ==================== Signed-off-by: David S. Miller commit 0d6ccfe6b319d56da63b7d7cfbcecd92780a680d Author: Jakub Kicinski Date: Thu Jul 25 15:23:53 2024 -0700 selftests: drv-net: rss_ctx: check for all-zero keys We had a handful of bugs relating to key being either all 0 or just reported incorrectly as all 0. Check for this in the tests. Signed-off-by: Jakub Kicinski Reviewed-by: Petr Machata Signed-off-by: David S. Miller tools/testing/selftests/drivers/net/hw/rss_ctx.py | 37 +++++++++++++++++++++-- 1 file changed, 34 insertions(+), 3 deletions(-) commit dc9755370e1c5965d16dff98c9877f5b1847e367 Author: Jakub Kicinski Date: Thu Jul 25 15:23:52 2024 -0700 ethtool: fix the state of additional contexts with old API We expect drivers implementing the new create/modify/destroy API to populate the defaults in struct ethtool_rxfh_context. In legacy API ctx isn't even passed, and rxfh.indir / rxfh.key are NULL so drivers can't give us defaults even if they want to. Call get_rxfh() to fetch the values. We can reuse rxfh_dev for the get_rxfh(), rxfh stores the input from the user. This fixes IOCTL reporting 0s instead of the default key / indir table for drivers using legacy API. Add a check to try to catch drivers using the new API but not populating the key. Fixes: 7964e7884643 ("net: ethtool: use the tracking array for get_rxfh on custom RSS contexts") Signed-off-by: Jakub Kicinski Reviewed-by: Edward Cree Signed-off-by: David S. Miller net/ethtool/ioctl.c | 38 ++++++++++++++++++++++++++++++-------- 1 file changed, 30 insertions(+), 8 deletions(-) commit 7195f0ef7f5b8c678cf28de7c9b619cb908b482c Author: Jakub Kicinski Date: Thu Jul 25 15:23:51 2024 -0700 ethtool: fix setting key and resetting indir at once The indirection table and the key follow struct ethtool_rxfh in user memory. To reset the indirection table user space calls SET_RXFH with table of size 0 (OTOH to say "no change" it should use -1 / ~0). The logic for calculating the offset where they key sits is incorrect in this case, as kernel would still offset by the full table length, while for the reset there is no indir table and key is immediately after the struct. $ ethtool -X eth0 default hkey 01:02:03... $ ethtool -x eth0 [...] RSS hash key: 00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00 [...] Fixes: 3de0b592394d ("ethtool: Support for configurable RSS hash key") Signed-off-by: Jakub Kicinski Signed-off-by: David S. Miller net/ethtool/ioctl.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) commit 9dbad38336a9c9a6e77df07c6c770ff6cf55c365 Author: Jakub Kicinski Date: Thu Jul 25 15:23:50 2024 -0700 eth: bnxt: populate defaults in the RSS context struct As described in the kdoc for .create_rxfh_context we are responsible for populating the defaults. The core will not call .get_rxfh for non-0 context. The problem can be easily observed since Netlink doesn't currently use the cache. Using netlink ethtool: $ ethtool -x eth0 context 1 [...] RSS hash key: 13:60:cd:60:14:d3:55:36:86:df:90:f2:96:14:e2:21:05:57:a8:8f:a5:12:5e:54:62:7f:fd:3c:15:7e:76:05:71:42:a2:9a:73:80:09:9c RSS hash function: toeplitz: on xor: off crc32: off But using IOCTL ethtool shows: $ ./ethtool-old -x eth0 context 1 [...] RSS hash key: 00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00 RSS hash function: Operation not supported Fixes: 7964e7884643 ("net: ethtool: use the tracking array for get_rxfh on custom RSS contexts") Signed-off-by: Jakub Kicinski Reviewed-by: Pavan Chebbi Signed-off-by: David S. Miller drivers/net/ethernet/broadcom/bnxt/bnxt_ethtool.c | 4 ++++ 1 file changed, 4 insertions(+) commit daefd348a5938d2256d304b57a9e787a83bb58d9 Author: Jakub Kicinski Date: Thu Jul 25 15:23:49 2024 -0700 eth: bnxt: reject unsupported hash functions In commit under Fixes I split the bnxt_set_rxfh_context() function, and attached the appropriate chunks to new ops. I missed that bnxt_set_rxfh_context() gets called after some initial checks in bnxt_set_rxfh(), namely that the hash function is Toeplitz. Fixes: 5c466b4d4e75 ("eth: bnxt: move from .set_rxfh to .create_rxfh_context and friends") Signed-off-by: Jakub Kicinski Reviewed-by: Pavan Chebbi Signed-off-by: David S. Miller drivers/net/ethernet/broadcom/bnxt/bnxt_ethtool.c | 10 ++++++++-- 1 file changed, 8 insertions(+), 2 deletions(-) commit 9da49aa80d686582bc3a027112a30484c9be6b6e Author: Jeongjun Park Date: Fri Jul 26 06:40:49 2024 +0900 tun: Add missing bpf_net_ctx_clear() in do_xdp_generic() There are cases where do_xdp_generic returns bpf_net_context without clearing it. This causes various memory corruptions, so the missing bpf_net_ctx_clear must be added. Reported-by: syzbot+44623300f057a28baf1e@syzkaller.appspotmail.com Fixes: fecef4cd42c6 ("tun: Assign missing bpf_net_context.") Signed-off-by: Jeongjun Park Acked-by: Jason Wang Reviewed-by: Willem de Bruijn Reported-by: syzbot+3c2b6d5d4bec3b904933@syzkaller.appspotmail.com Reported-by: syzbot+707d98c8649695eaf329@syzkaller.appspotmail.com Reported-by: syzbot+c226757eb784a9da3e8b@syzkaller.appspotmail.com Reported-by: syzbot+61a1cfc2b6632363d319@syzkaller.appspotmail.com Reported-by: syzbot+709e4c85c904bcd62735@syzkaller.appspotmail.com Signed-off-by: David S. Miller net/core/dev.c | 1 + 1 file changed, 1 insertion(+) commit a4765eb49cd94a7653c1a643b03d4facc5d87aa5 Author: Luca Ceresoli Date: Wed Jul 17 14:25:20 2024 +0200 irqchip/irq-pic32-evic: Add missing 'static' to internal function Fix build error reported by gcc 12: drivers/irqchip/irq-pic32-evic.c:164:5: error: no previous prototype for ‘pic32_irq_domain_xlate’ [-Werror=missing-prototypes] 164 | int pic32_irq_domain_xlate(struct irq_domain *d, struct device_node *ctrlr, | ^~~~~~~~~~~~~~~~~~~~~~ Signed-off-by: Luca Ceresoli Signed-off-by: Thomas Gleixner Link: https://lore.kernel.org/r/20240717-irq-pic32-evic-fix-build-static-v1-1-5129085589c6@bootlin.com drivers/irqchip/irq-pic32-evic.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) commit 37c526f00bc1c4f847fc800085f8f009d2e11be6 Author: Guenter Roeck Date: Mon Jan 10 09:28:56 2022 -0800 i2c: smbus: Improve handling of stuck alerts The following messages were observed while testing alert functionality on systems with multiple I2C devices on a single bus if alert was active on more than one chip. smbus_alert 3-000c: SMBALERT# from dev 0x0c, flag 0 smbus_alert 3-000c: no driver alert()! and: smbus_alert 3-000c: SMBALERT# from dev 0x28, flag 0 Once it starts, this message repeats forever at high rate. There is no device at any of the reported addresses. Analysis shows that this is seen if multiple devices have the alert pin active. Apparently some devices do not support SMBus arbitration correctly. They keep sending address bits after detecting an address collision and handle the collision not at all or too late. Specifically, address 0x0c is seen with ADT7461A at address 0x4c and ADM1021 at address 0x18 if alert is active on both chips. Address 0x28 is seen with ADT7483 at address 0x2a and ADT7461 at address 0x4c if alert is active on both chips. Once the system is in bad state (alert is set by more than one chip), it often only recovers by power cycling. To reduce the impact of this problem, abort the endless loop in smbus_alert() if the same address is read more than once and not handled by a driver. Fixes: b5527a7766f0 ("i2c: Add SMBus alert support") Signed-off-by: Guenter Roeck [wsa: it also fixed an interrupt storm in one of my experiments] Tested-by: Wolfram Sang [wsa: rebased, moved a comment as well, improved the 'invalid' value] Signed-off-by: Wolfram Sang drivers/i2c/i2c-smbus.c | 32 +++++++++++++++++++++++++------- 1 file changed, 25 insertions(+), 7 deletions(-) commit 291e4baf70019f17a81b7b47aeb186b27d222159 Author: Zenghui Yu Date: Mon Jul 29 10:46:04 2024 +0800 kselftests: dmabuf-heaps: Ensure the driver name is null-terminated Even if a vgem device is configured in, we will skip the import_vgem_fd() test almost every time. TAP version 13 1..11 # Testing heap: system # ======================================= # Testing allocation and importing: ok 1 # SKIP Could not open vgem -1 The problem is that we use the DRM_IOCTL_VERSION ioctl to query the driver version information but leave the name field a non-null-terminated string. Terminate it properly to actually test against the vgem device. While at it, let's check the length of the driver name is exactly 4 bytes and return early otherwise (in case there is a name like "vgemfoo" that gets converted to "vgem\0" unexpectedly). Signed-off-by: Zenghui Yu Signed-off-by: Daniel Vetter Link: https://patchwork.freedesktop.org/patch/msgid/20240729024604.2046-1-yuzenghui@huawei.com tools/testing/selftests/dmabuf-heaps/dmabuf-heap.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) commit b5fbf924f125ba3638cfdc21c0515eb7e76264ca Author: Dan Carpenter Date: Wed Jul 24 11:09:54 2024 -0500 drm/client: Fix error code in drm_client_buffer_vmap_local() This function accidentally returns zero/success on the failure path. It leads to locking issues and an uninitialized *map_copy in the caller. Fixes: b4b0193e83cb ("drm/fbdev-generic: Fix locking with drm_client_buffer_vmap_local()") Signed-off-by: Dan Carpenter Reviewed-by: Dmitry Osipenko Reviewed-by: Thomas Zimmermann Signed-off-by: Thomas Zimmermann Link: https://patchwork.freedesktop.org/patch/msgid/89d13df3-747c-4c5d-b122-d081aef5110a@stanley.mountain drivers/gpu/drm/drm_client.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit dd4a799bcc13992dd8be9708e5c585f55226b567 Author: Yong-Xuan Wang Date: Fri Jul 26 16:49:29 2024 +0800 KVM: riscv: selftests: Fix compile error Fix compile error introduced by commit d27c34a73514 ("KVM: riscv: selftests: Add some Zc* extensions to get-reg-list test"). These 4 lines should be end with ";". Fixes: d27c34a73514 ("KVM: riscv: selftests: Add some Zc* extensions to get-reg-list test") Signed-off-by: Yong-Xuan Wang Reviewed-by: Clément Léger Link: https://lore.kernel.org/r/20240726084931.28924-5-yongxuan.wang@sifive.com Signed-off-by: Anup Patel tools/testing/selftests/kvm/riscv/get-reg-list.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) commit 7bf888fa26e8f22bed4bc3965ab2a2953104ff96 Author: Chen Ni Date: Tue Jul 16 16:01:12 2024 +0800 xfs: convert comma to semicolon Replace a comma between expression statements by a semicolon. Fixes: 178b48d588ea ("xfs: remove the for_each_xbitmap_ helpers") Signed-off-by: Chen Ni Reviewed-by: Darrick J. Wong Signed-off-by: Chandan Babu R fs/xfs/scrub/agheader_repair.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 8c2263b9231754f341e204124801c60de969298c Author: Chen Ni Date: Tue Jul 9 15:36:32 2024 +0800 xfs: convert comma to semicolon Replace a comma between expression statements by a semicolon. Signed-off-by: Chen Ni Fixes: 8f4b980ee67f ("xfs: pass the attr value to put_listent when possible") Reviewed-by: Dave Chinner Reviewed-by: Darrick J. Wong Signed-off-by: Chandan Babu R fs/xfs/xfs_attr_list.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit af5d92f2fad818663da2ce073b6fe15b9d56ffdc Author: Julian Sun Date: Sun Jul 21 07:27:01 2024 -0400 xfs: remove unused parameter in macro XFS_DQUOT_LOGRES In the macro definition of XFS_DQUOT_LOGRES, a parameter is accepted, but it is not used. Hence, it should be removed. This patch has only passed compilation test, but it should be fine. Signed-off-by: Julian Sun Reviewed-by: Darrick J. Wong Signed-off-by: Chandan Babu R fs/xfs/libxfs/xfs_quota_defs.h | 2 +- fs/xfs/libxfs/xfs_trans_resv.c | 28 ++++++++++++++-------------- 2 files changed, 15 insertions(+), 15 deletions(-) commit 19ebc8f84ea12e18dd6c8d3ecaf87bcf4666eee1 Author: Darrick J. Wong Date: Wed Jul 10 22:43:53 2024 -0700 xfs: fix file_path handling in tracepoints Since file_path() takes the output buffer as one of its arguments, we might as well have it format directly into the tracepoint's char array instead of wasting stack space. Fixes: 3934e8ebb7cc6 ("xfs: create a big array data structure") Fixes: 5076a6040ca16 ("xfs: support in-memory buffer cache targets") Reported-by: kernel test robot Closes: https://lore.kernel.org/oe-kbuild-all/202403290419.HPcyvqZu-lkp@intel.com/ Signed-off-by: Darrick J. Wong Reviewed-by: Christoph Hellwig Signed-off-by: Chandan Babu R fs/xfs/scrub/trace.h | 10 ++++------ fs/xfs/xfs_trace.h | 10 ++++------ 2 files changed, 8 insertions(+), 12 deletions(-) commit 39c1ddb064fd38e28571c853f067b134d17cffb2 Author: Eric Sandeen Date: Tue Jul 23 12:26:10 2024 -0500 xfs: allow SECURE namespace xattrs to use reserved block pool We got a report from the podman folks that selinux relabels that happen as part of their process were returning ENOSPC when the filesystem is completely full. This is because xattr changes reserve about 15 blocks for the worst case, but the common case is for selinux contexts to be the sole, in-inode xattr and consume no blocks. We already allow reserved space consumption for XFS_ATTR_ROOT for things such as ACLs, and SECURE namespace attributes are not so very different, so allow them to use the reserved space as well. Code-comment-by: Dave Chinner Signed-off-by: Eric Sandeen Reviewed-by: Darrick J. Wong Reviewed-by: Christoph Hellwig Signed-off-by: Chandan Babu R V2: Remove local variable, add comment. V3: Add Dave's preferred comment V4: Spelling and comment beautification fs/xfs/xfs_xattr.c | 19 ++++++++++++++++++- 1 file changed, 18 insertions(+), 1 deletion(-) commit 80d3d33cdf4b0494b465087eb34d2e29d86e290e Author: Darrick J. Wong Date: Tue Jul 23 22:11:55 2024 -0700 xfs: fix a memory leak kmemleak reported that we don't free the parent pointer names here if we found corruption. Fixes: 0d29a20fbdba8 ("xfs: scrub parent pointers") Signed-off-by: Darrick J. Wong Reviewed-by: Christoph Hellwig Signed-off-by: Chandan Babu R fs/xfs/scrub/parent.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit dc1c8034e31b14a2e5e212104ec508aec44ce1b9 Author: Linus Torvalds Date: Sun Jul 28 20:24:12 2024 -0700 minmax: simplify min()/max()/clamp() implementation Now that we no longer have any C constant expression contexts (ie array size declarations or static initializers) that use min() or max(), we can simpify the implementation by not having to worry about the result staying as a C constant expression. So now we can unconditionally just use temporary variables of the right type, and get rid of the excessive expansion that used to come from the use of __builtin_choose_expr(__is_constexpr(...), .. to pick the specialized code for constant expressions. Another expansion simplification is to pass the temporary variables (in addition to the original expression) to our __types_ok() macro. That may superficially look like it complicates the macro, but when we only want the type of the expression, expanding the temporary variable names is much simpler and smaller than expanding the potentially complicated original expression. As a result, on my machine, doing a $ time make drivers/staging/media/atomisp/pci/isp/kernels/ynr/ynr_1.0/ia_css_ynr.host.i goes from real 0m16.621s user 0m15.360s sys 0m1.221s to real 0m2.532s user 0m2.091s sys 0m0.452s because the token expansion goes down dramatically. In particular, the longest line expansion (which was line 71 of that 'ia_css_ynr.host.c' file) shrinks from 23,338kB (yes, 23MB for one single line) to "just" 1,444kB (now "only" 1.4MB). And yes, that line is still the line from hell, because it's doing multiple levels of "min()/max()" expansion thanks to some of them being hidden inside the uDIGIT_FITTING() macro. Lorenzo has a nice cleanup patch that makes that driver use inline functions instead of macros for sDIGIT_FITTING() and uDIGIT_FITTING(), which will fix that line once and for all, but the 16-fold reduction in this case does show why we need to simplify these helpers. Cc: David Laight Cc: Lorenzo Stoakes Signed-off-by: Linus Torvalds include/linux/minmax.h | 43 ++++++++++++++++++++----------------------- 1 file changed, 20 insertions(+), 23 deletions(-) commit cb04e8b1d2f24c4c2c92f7b7529031fc35a16fed Author: Linus Torvalds Date: Sun Jul 28 17:32:05 2024 -0700 minmax: don't use max() in situations that want a C constant expression We only had a couple of array[] declarations, and changing them to just use 'MAX()' instead of 'max()' fixes the issue. This will allow us to simplify our min/max macros enormously, since they can now unconditionally use temporary variables to avoid using the argument values multiple times. Cc: David Laight Cc: Lorenzo Stoakes Signed-off-by: Linus Torvalds drivers/gpu/drm/amd/pm/swsmu/smu_cmn.c | 2 +- drivers/input/touchscreen/cyttsp4_core.c | 2 +- drivers/irqchip/irq-sun6i-r.c | 2 +- drivers/net/can/usb/etas_es58x/es58x_devlink.c | 2 +- fs/btrfs/tree-checker.c | 2 +- lib/vsprintf.c | 2 +- 6 files changed, 6 insertions(+), 6 deletions(-) commit 60a76f7826b88ebf7697a56fdcd9596b23c2b616 Author: Varadarajan Narayanan Date: Tue Jul 23 15:31:51 2024 +0530 arm64: dts: qcom: ipq5332: Fix interrupt trigger type for usb Trigger type is incorrectly specified as IRQ_TYPE_EDGE_BOTH instead of IRQ_TYPE_LEVEL_HIGH. This trigger type is not supported for SPIs and results in probe failure with -EINVAL. Reviewed-by: Konrad Dybcio Fixes: 927173bf8a0e ("arm64: dts: qcom: Add missing interrupts for qcs404/ipq5332") Signed-off-by: Varadarajan Narayanan Link: https://lore.kernel.org/r/20240723100151.402300-3-quic_varada@quicinc.com Signed-off-by: Bjorn Andersson arch/arm64/boot/dts/qcom/ipq5332.dtsi | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) commit 8bc7cb73df8644423758c79d4504d501c8ef3854 Author: Patrick Wildt Date: Mon Jul 15 21:40:41 2024 +0200 arm64: dts: qcom: x1e80100-yoga: add wifi calibration variant Describe the bus topology for PCIe domain 4 and add the ath12k calibration variant so that the board file (calibration data) can be loaded. Signed-off-by: Patrick Wildt Reviewed-by: Konrad Dybcio Reviewed-by: Manivannan Sadhasivam Reviewed-by: Dmitry Baryshkov Link: https://lore.kernel.org/r/ZpV7OeGNIGGpqNC0@windev.fritz.box Signed-off-by: Bjorn Andersson arch/arm64/boot/dts/qcom/x1e80100-lenovo-yoga-slim7x.dts | 9 +++++++++ arch/arm64/boot/dts/qcom/x1e80100.dtsi | 10 ++++++++++ 2 files changed, 19 insertions(+) commit dbd6bd124e34f9f859271ed9ae2afc39f36c7e8c Author: Arnd Bergmann Date: Fri Jul 19 12:12:31 2024 +0200 soc: qcom: pd-mapper: mark qcom_pdm_domains as __maybe_unused The qcom_pdm_domains[] array is used only when passing it into of_match_node() but is not also referenced by MODULE_DEVICE_TABLE() or the platform driver as a table. When CONFIG_OF is disabled, this causes a harmless build warning: drivers/soc/qcom/qcom_pd_mapper.c:520:34: error: 'qcom_pdm_domains' defined but not used [-Werror=unused-const-variable=] Avoid this by marking the variable as __maybe_unused. This also makes it clear that anything referenced by it will be dropped by the compiler when it is unused. Fixes: 1ebcde047c54 ("soc: qcom: add pd-mapper implementation") Signed-off-by: Arnd Bergmann Reviewed-by: Dmitry Baryshkov Link: https://lore.kernel.org/r/20240719101238.199850-1-arnd@kernel.org Signed-off-by: Bjorn Andersson drivers/soc/qcom/qcom_pd_mapper.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit f9bb896eab221618927ae6a2f1d566567999839d Author: Volodymyr Babchuk Date: Thu Jul 18 11:33:23 2024 +0530 soc: qcom: cmd-db: Map shared memory as WC, not WB Linux does not write into cmd-db region. This region of memory is write protected by XPU. XPU may sometime falsely detect clean cache eviction as "write" into the write protected region leading to secure interrupt which causes an endless loop somewhere in Trust Zone. The only reason it is working right now is because Qualcomm Hypervisor maps the same region as Non-Cacheable memory in Stage 2 translation tables. The issue manifests if we want to use another hypervisor (like Xen or KVM), which does not know anything about those specific mappings. Changing the mapping of cmd-db memory from MEMREMAP_WB to MEMREMAP_WT/WC removes dependency on correct mappings in Stage 2 tables. This patch fixes the issue by updating the mapping to MEMREMAP_WC. I tested this on SA8155P with Xen. Fixes: 312416d9171a ("drivers: qcom: add command DB driver") Cc: stable@vger.kernel.org # 5.4+ Signed-off-by: Volodymyr Babchuk Tested-by: Nikita Travkin # sc7180 WoA in EL2 Signed-off-by: Maulik Shah Tested-by: Pavankumar Kondeti Reviewed-by: Caleb Connolly Link: https://lore.kernel.org/r/20240718-cmd_db_uncached-v2-1-f6cf53164c90@quicinc.com Signed-off-by: Bjorn Andersson drivers/soc/qcom/cmd-db.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 10f98bb9d98137b544b00abb4f9df45e9be7878d Author: Stephan Gerhold Date: Mon Jul 15 14:15:40 2024 +0200 arm64: defconfig: Add CONFIG_DRM_PANEL_SAMSUNG_ATNA33XC20 This is needed for the display panel to work on the Qualcomm sc7180-trogdor-homestar and x1e80100-crd. Signed-off-by: Stephan Gerhold Reviewed-by: Douglas Anderson Reviewed-by: Johan Hovold Link: https://lore.kernel.org/r/20240715-x1e80100-crd-backlight-v2-4-31b7f2f658a3@linaro.org Signed-off-by: Bjorn Andersson arch/arm64/configs/defconfig | 1 + 1 file changed, 1 insertion(+) commit e4ab5d7cb5f19858305395e034f214c92afc3cf5 Author: Andrew Halaney Date: Thu Jul 25 11:23:33 2024 -0500 soc: qcom: pd-mapper: Depend on ARCH_QCOM || COMPILE_TEST The pd-mapper driver doesn't make sense on non Qualcomm systems. Let's follow suit with the rest of the Qualcomm SoC Kconfigs and depend on ARCH_QCOM || COMPILE_TEST to avoid asking users about a config they will not use. Fixes: 1ebcde047c54 ("soc: qcom: add pd-mapper implementation") Signed-off-by: Andrew Halaney Reviewed-by: Dmitry Baryshkov Link: https://lore.kernel.org/r/20240725-pd-mapper-config-v1-1-f26e513608c6@redhat.com Signed-off-by: Bjorn Andersson drivers/soc/qcom/Kconfig | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 9f499b8c791d2983c0a31a543c51d1b2f15e8755 Author: Linus Torvalds Date: Sun Jul 28 17:06:20 2024 -0700 minmax: scsi: fix mis-use of 'clamp()' in sr.c While working on simplifying the minmax functions, and avoiding excessive macro expansion, it turns out that the sr.c use of the 'clamp()' macro has the arguments the wrong way around. The clamp logic is val = clamp(in, low, high); and it returns the input clamped to the low/high limits. But sr.c ddid speed = clamp(0, speed, 0xffff / 177); which clamps the value '0' to the range '[speed, 0xffff / 177]' and ends up being nonsensical. Happily, I don't think anybody ever cared. Fixes: 9fad9d560af5 ("scsi: sr: Fix unintentional arithmetic wraparound") Cc: Justin Stitt Cc: Kees Cook Cc: Martin K. Petersen Signed-off-by: Linus Torvalds drivers/scsi/sr_ioctl.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 89fb4dfacbb33750e0243848f4c54d73e558ba9a Author: Heiko Stuebner Date: Sat Jul 20 22:57:05 2024 +0200 dt-bindings: ata: rockchip-dwc-ahci: add missing power-domains The Rockchip variant of the dwc-ahci controller does have and need power- domains to work, though the binding does not mention them, making dtccheck quite unhappy: DTC_CHK arch/arm64/boot/dts/rockchip/rk3568-odroid-m1.dtb /home/devel/hstuebner/00_git-repos/linux-rockchip/_build-arm64/arch/arm64/boot/dts/rockchip/rk3568-odroid-m1.dtb: sata@fc800000: Unevaluated properties are not allowed ('power-domains' was unexpected) from schema $id: http://devicetree.org/schemas/ata/rockchip,dwc-ahci.yaml# Fix that by adding the missing power-domain property to the binding. Fixes: 85b0e13b19c2 ("dt-bindings: ata: dwc-ahci: add Rockchip RK3588") Signed-off-by: Heiko Stuebner Acked-by: Krzysztof Kozlowski Signed-off-by: Damien Le Moal Documentation/devicetree/bindings/ata/rockchip,dwc-ahci.yaml | 3 +++ 1 file changed, 3 insertions(+) commit 1a251f52cfdc417c84411a056bc142cbd77baef4 Author: Linus Torvalds Date: Sun Jul 28 15:49:18 2024 -0700 minmax: make generic MIN() and MAX() macros available everywhere This just standardizes the use of MIN() and MAX() macros, with the very traditional semantics. The goal is to use these for C constant expressions and for top-level / static initializers, and so be able to simplify the min()/max() macros. These macro names were used by various kernel code - they are very traditional, after all - and all such users have been fixed up, with a few different approaches: - trivial duplicated macro definitions have been removed Note that 'trivial' here means that it's obviously kernel code that already included all the major kernel headers, and thus gets the new generic MIN/MAX macros automatically. - non-trivial duplicated macro definitions are guarded with #ifndef This is the "yes, they define their own versions, but no, the include situation is not entirely obvious, and maybe they don't get the generic version automatically" case. - strange use case #1 A couple of drivers decided that the way they want to describe their versioning is with #define MAJ 1 #define MIN 2 #define DRV_VERSION __stringify(MAJ) "." __stringify(MIN) which adds zero value and I just did my Alexander the Great impersonation, and rewrote that pointless Gordian knot as #define DRV_VERSION "1.2" instead. - strange use case #2 A couple of drivers thought that it's a good idea to have a random 'MIN' or 'MAX' define for a value or index into a table, rather than the traditional macro that takes arguments. These values were re-written as C enum's instead. The new function-line macros only expand when followed by an open parenthesis, and thus don't clash with enum use. Happily, there weren't really all that many of these cases, and a lot of users already had the pattern of using '#ifndef' guarding (or in one case just using '#undef MIN') before defining their own private version that does the same thing. I left such cases alone. Cc: David Laight Cc: Lorenzo Stoakes Signed-off-by: Linus Torvalds arch/um/drivers/mconsole_user.c | 2 ++ drivers/edac/skx_common.h | 1 - drivers/gpu/drm/amd/display/dc/core/dc_stream.c | 2 ++ .../gpu/drm/amd/display/modules/hdcp/hdcp_ddc.c | 2 ++ drivers/gpu/drm/amd/pm/powerplay/hwmgr/ppevvmath.h | 14 +++++++++---- drivers/gpu/drm/radeon/evergreen_cs.c | 2 ++ drivers/hwmon/adt7475.c | 24 +++++++++++----------- drivers/media/dvb-frontends/stv0367_priv.h | 3 +++ drivers/net/fjes/fjes_main.c | 4 +--- drivers/nfc/pn544/i2c.c | 2 -- drivers/platform/x86/sony-laptop.c | 1 - drivers/scsi/isci/init.c | 6 +----- .../pci/hive_isp_css_include/math_support.h | 5 ----- include/linux/minmax.h | 2 ++ kernel/trace/preemptirq_delay_test.c | 2 -- lib/btree.c | 1 - lib/decompress_unlzma.c | 2 ++ mm/zsmalloc.c | 2 -- tools/testing/selftests/mm/mremap_test.c | 2 ++ tools/testing/selftests/seccomp/seccomp_bpf.c | 2 ++ 20 files changed, 43 insertions(+), 38 deletions(-) commit aacf93e87f0d808ef46e621aa56caea336b4433c Author: Masahiro Yamada Date: Sat Jul 27 23:03:00 2024 +0900 rust: fix the default format for CONFIG_{RUSTC,BINDGEN}_VERSION_TEXT Another oddity in these config entries is their default value can fall back to 'n', which is a value for bool or tristate symbols. The '|| echo n' is an incorrect workaround to avoid the syntax error. This is not a big deal, as the entry is hidden by 'depends on RUST' in situations where '$(RUSTC) --version' or '$(BINDGEN) --version' fails. Anyway, it looks odd. The default of a string type symbol should be a double-quoted string literal. Turn it into an empty string when the version command fails. Fixes: 2f7ab1267dc9 ("Kbuild: add Rust support") Signed-off-by: Masahiro Yamada Link: https://lore.kernel.org/r/20240727140302.1806011-2-masahiroy@kernel.org [ Rebased on top of v6.11-rc1. - Miguel ] Signed-off-by: Miguel Ojeda init/Kconfig | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) commit 5ce86c6c861352c9346ebb5c96ed70cb67414aa3 Author: Masahiro Yamada Date: Sat Jul 27 23:02:59 2024 +0900 rust: suppress error messages from CONFIG_{RUSTC,BINDGEN}_VERSION_TEXT While this is a somewhat unusual case, I encountered odd error messages when I ran Kconfig in a foreign architecture chroot. $ make allmodconfig sh: 1: rustc: not found sh: 1: bindgen: not found # # configuration written to .config # The successful execution of 'command -v rustc' does not necessarily mean that 'rustc --version' will succeed. $ sh -c 'command -v rustc' /home/masahiro/.cargo/bin/rustc $ sh -c 'rustc --version' sh: 1: rustc: not found Here, 'rustc' is built for x86, and I ran it in an arm64 system. The current code: command -v $(RUSTC) >/dev/null 2>&1 && $(RUSTC) --version || echo n can be turned into: command -v $(RUSTC) >/dev/null 2>&1 && $(RUSTC) --version 2>/dev/null || echo n However, I did not understand the necessity of 'command -v $(RUSTC)'. I simplified it to: $(RUSTC) --version 2>/dev/null || echo n Fixes: 2f7ab1267dc9 ("Kbuild: add Rust support") Signed-off-by: Masahiro Yamada Link: https://lore.kernel.org/r/20240727140302.1806011-1-masahiroy@kernel.org [ Rebased on top of v6.11-rc1. - Miguel ] Signed-off-by: Miguel Ojeda init/Kconfig | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) commit 8400291e289ee6b2bf9779ff1c83a291501f017b Author: Linus Torvalds Date: Sun Jul 28 14:19:55 2024 -0700 Linux 6.11-rc1 Makefile | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) commit a0c04bd55a467aee3eb647555343ad6971106e86 Merge: 017fa3e89187 3415b10a0394 Author: Linus Torvalds Date: Sun Jul 28 14:02:48 2024 -0700 Merge tag 'kbuild-fixes-v6.11' of git://git.kernel.org/pub/scm/linux/kernel/git/masahiroy/linux-kbuild Pull Kbuild fixes from Masahiro Yamada: - Fix RPM package build error caused by an incorrect locale setup - Mark modules.weakdep as ghost in RPM package - Fix the odd combination of -S and -c in stack protector scripts, which is an error with the latest Clang * tag 'kbuild-fixes-v6.11' of git://git.kernel.org/pub/scm/linux/kernel/git/masahiroy/linux-kbuild: kbuild: Fix '-S -c' in x86 stack protector scripts kbuild: rpm-pkg: ghost modules.weakdep file kbuild: rpm-pkg: Fix C locale setup commit 017fa3e89187848fd056af757769c9e66ac3e93d Author: Linus Torvalds Date: Sun Jul 28 13:50:01 2024 -0700 minmax: simplify and clarify min_t()/max_t() implementation This simplifies the min_t() and max_t() macros by no longer making them work in the context of a C constant expression. That means that you can no longer use them for static initializers or for array sizes in type definitions, but there were only a couple of such uses, and all of them were converted (famous last words) to use MIN_T/MAX_T instead. Cc: David Laight Cc: Lorenzo Stoakes Signed-off-by: Linus Torvalds include/linux/minmax.h | 19 +++++++++++-------- 1 file changed, 11 insertions(+), 8 deletions(-) commit 4477b39c32fdc03363affef4b11d48391e6dc9ff Author: Linus Torvalds Date: Sun Jul 28 13:03:48 2024 -0700 minmax: add a few more MIN_T/MAX_T users Commit 3a7e02c040b1 ("minmax: avoid overly complicated constant expressions in VM code") added the simpler MIN_T/MAX_T macros in order to avoid some excessive expansion from the rather complicated regular min/max macros. The complexity of those macros stems from two issues: (a) trying to use them in situations that require a C constant expression (in static initializers and for array sizes) (b) the type sanity checking and MIN_T/MAX_T avoids both of these issues. Now, in the whole (long) discussion about all this, it was pointed out that the whole type sanity checking is entirely unnecessary for min_t/max_t which get a fixed type that the comparison is done in. But that still leaves min_t/max_t unnecessarily complicated due to worries about the C constant expression case. However, it turns out that there really aren't very many cases that use min_t/max_t for this, and we can just force-convert those. This does exactly that. Which in turn will then allow for much simpler implementations of min_t()/max_t(). All the usual "macros in all upper case will evaluate the arguments multiple times" rules apply. We should do all the same things for the regular min/max() vs MIN/MAX() cases, but that has the added complexity of various drivers defining their own local versions of MIN/MAX, so that needs another level of fixes first. Link: https://lore.kernel.org/all/b47fad1d0cf8449886ad148f8c013dae@AcuMS.aculab.com/ Cc: David Laight Cc: Lorenzo Stoakes Signed-off-by: Linus Torvalds arch/x86/mm/pgtable.c | 2 +- drivers/edac/sb_edac.c | 4 ++-- drivers/gpu/drm/drm_color_mgmt.c | 2 +- drivers/md/dm-integrity.c | 6 +++--- drivers/net/ethernet/stmicro/stmmac/stmmac_main.c | 2 +- net/ipv4/proc.c | 2 +- net/ipv6/proc.c | 2 +- 7 files changed, 10 insertions(+), 10 deletions(-) commit 7e2d0ba732ad649c557b49b0a3ef69d54df256d0 Merge: e172f1e90688 92a286e90203 Author: Linus Torvalds Date: Sun Jul 28 11:51:51 2024 -0700 Merge tag 'ubifs-for-linus-6.11-rc1-take2' of git://git.kernel.org/pub/scm/linux/kernel/git/rw/ubifs Pull UBI and UBIFS updates from Richard Weinberger: - Many fixes for power-cut issues by Zhihao Cheng - Another ubiblock error path fix - ubiblock section mismatch fix - Misc fixes all over the place * tag 'ubifs-for-linus-6.11-rc1-take2' of git://git.kernel.org/pub/scm/linux/kernel/git/rw/ubifs: ubi: Fix ubi_init() ubiblock_exit() section mismatch ubifs: add check for crypto_shash_tfm_digest ubifs: Fix inconsistent inode size when powercut happens during appendant writing ubi: block: fix null-pointer-dereference in ubiblock_create() ubifs: fix kernel-doc warnings ubifs: correct UBIFS_DFS_DIR_LEN macro definition and improve code clarity mtd: ubi: Restore missing cleanup on ubi_init() failure path ubifs: dbg_orphan_check: Fix missed key type checking ubifs: Fix unattached inode when powercut happens in creating ubifs: Fix space leak when powercut happens in linking tmpfile ubifs: Move ui->data initialization after initializing security ubifs: Fix adding orphan entry twice for the same inode ubifs: Remove insert_dead_orphan from replaying orphan process Revert "ubifs: ubifs_symlink: Fix memleak of inode->i_link in error path" ubifs: Don't add xattr inode into orphan area ubifs: Fix unattached xattr inode if powercut happens after deleting mtd: ubi: avoid expensive do_div() on 32-bit machines mtd: ubi: make ubi_class constant ubi: eba: properly rollback inside self_check_eba commit 3415b10a03945b0da4a635e146750dfe5ce0f448 Author: Nathan Chancellor Date: Fri Jul 26 11:05:00 2024 -0700 kbuild: Fix '-S -c' in x86 stack protector scripts After a recent change in clang to stop consuming all instances of '-S' and '-c' [1], the stack protector scripts break due to the kernel's use of -Werror=unused-command-line-argument to catch cases where flags are not being properly consumed by the compiler driver: $ echo | clang -o - -x c - -S -c -Werror=unused-command-line-argument clang: error: argument unused during compilation: '-c' [-Werror,-Wunused-command-line-argument] This results in CONFIG_STACKPROTECTOR getting disabled because CONFIG_CC_HAS_SANE_STACKPROTECTOR is no longer set. '-c' and '-S' both instruct the compiler to stop at different stages of the pipeline ('-S' after compiling, '-c' after assembling), so having them present together in the same command makes little sense. In this case, the test wants to stop before assembling because it is looking at the textual assembly output of the compiler for either '%fs' or '%gs', so remove '-c' from the list of arguments to resolve the error. All versions of GCC continue to work after this change, along with versions of clang that do or do not contain the change mentioned above. Cc: stable@vger.kernel.org Fixes: 4f7fd4d7a791 ("[PATCH] Add the -fstack-protector option to the CFLAGS") Fixes: 60a5317ff0f4 ("x86: implement x86_32 stack protector") Link: https://github.com/llvm/llvm-project/commit/6461e537815f7fa68cef06842505353cf5600e9c [1] Signed-off-by: Nathan Chancellor Signed-off-by: Masahiro Yamada scripts/gcc-x86_32-has-stack-protector.sh | 2 +- scripts/gcc-x86_64-has-stack-protector.sh | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) commit 92a286e90203ce3e6c3a6d945fa36da419c3671f Author: Richard Weinberger Date: Sat Jul 13 09:35:19 2024 +0200 ubi: Fix ubi_init() ubiblock_exit() section mismatch Since ubiblock_exit() is now called from an init function, the __exit section no longer makes sense. Cc: Ben Hutchings Reported-by: kernel test robot Closes: https://lore.kernel.org/oe-kbuild-all/202407131403.wZJpd8n2-lkp@intel.com/ Signed-off-by: Richard Weinberger Reviewed-by: Zhihao Cheng drivers/mtd/ubi/block.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit e172f1e9068807a336c0429b6c57d29bded8d891 Merge: e62f81bbd24d 866d2d36b81d Author: Linus Torvalds Date: Sun Jul 28 10:52:15 2024 -0700 Merge tag 'v6.11-merge' of git://git.kernel.org/pub/scm/linux/kernel/git/lenb/linux Pull turbostat updates from Len Brown: - Enable turbostat extensions to add both perf and PMT (Intel Platform Monitoring Technology) counters via the cmdline - Demonstrate PMT access with built-in support for Meteor Lake's Die C6 counter * tag 'v6.11-merge' of git://git.kernel.org/pub/scm/linux/kernel/git/lenb/linux: tools/power turbostat: version 2024.07.26 tools/power turbostat: Include umask=%x in perf counter's config tools/power turbostat: Document PMT in turbostat.8 tools/power turbostat: Add MTL's PMT DC6 builtin counter tools/power turbostat: Add early support for PMT counters tools/power turbostat: Add selftests for added perf counters tools/power turbostat: Add selftests for SMI, APERF and MPERF counters tools/power turbostat: Move verbose counter messages to level 2 tools/power turbostat: Move debug prints from stdout to stderr tools/power turbostat: Fix typo in turbostat.8 tools/power turbostat: Add perf added counter example to turbostat.8 tools/power turbostat: Fix formatting in turbostat.8 tools/power turbostat: Extend --add option with perf counters tools/power turbostat: Group SMI counter with APERF and MPERF tools/power turbostat: Add ZERO_ARRAY for zero initializing builtin array tools/power turbostat: Replace enum rapl_source and cstate_source with counter_source tools/power turbostat: Remove anonymous union from rapl_counter_info_t tools/power/turbostat: Switch to new Intel CPU model defines commit e62f81bbd24db746c9b1aa29e7b6423211262ac4 Merge: 7b5d48188942 a0328b397f33 Author: Linus Torvalds Date: Sun Jul 28 09:33:28 2024 -0700 Merge tag 'cxl-for-6.11' of git://git.kernel.org/pub/scm/linux/kernel/git/cxl/cxl Pull CXL updates from Dave Jiang: "Core: - A CXL maturity map has been added to the documentation to detail the current state of CXL enabling. It provides the status of the current state of various CXL features to inform current and future contributors of where things are and which areas need contribution. - A notifier handler has been added in order for a newly created CXL memory region to trigger the abstract distance metrics calculation. This should bring parity for CXL memory to the same level vs hotplugged DRAM for NUMA abstract distance calculation. The abstract distance reflects relative performance used for memory tiering handling. - An addition for XOR math has been added to address the CXL DPA to SPA translation. CXL address translation did not support address interleave math with XOR prior to this change. Fixes: - Fix to address race condition in the CXL memory hotplug notifier - Add missing MODULE_DESCRIPTION() for CXL modules - Fix incorrect vendor debug UUID define Misc: - A warning has been added to inform users of an unsupported configuration when mixing CXL VH and RCH/RCD hierarchies - The ENXIO error code has been replaced with EBUSY for inject poison limit reached via debugfs and cxl-test support - Moving the PCI config read in cxl_dvsec_rr_decode() to avoid unnecessary PCI config reads - A refactor to a common struct for DRAM and general media CXL events" * tag 'cxl-for-6.11' of git://git.kernel.org/pub/scm/linux/kernel/git/cxl/cxl: cxl/core/pci: Move reading of control register to immediately before usage cxl: Remove defunct code calculating host bridge target positions cxl/region: Verify target positions using the ordered target list cxl: Restore XOR'd position bits during address translation cxl/core: Fold cxl_trace_hpa() into cxl_dpa_to_hpa() cxl/test: Replace ENXIO with EBUSY for inject poison limit reached cxl/memdev: Replace ENXIO with EBUSY for inject poison limit reached cxl/acpi: Warn on mixed CXL VH and RCH/RCD Hierarchy cxl/core: Fix incorrect vendor debug UUID define Documentation: CXL Maturity Map cxl/region: Simplify cxl_region_nid() cxl/region: Support to calculate memory tier abstract distance cxl/region: Fix a race condition in memory hotplug notifier cxl: add missing MODULE_DESCRIPTION() macros cxl/events: Use a common struct for DRAM and General Media events commit 7b5d48188942178985cc185a17c754539cb9a4d3 Merge: 5437f30d3458 68318904a775 Author: Linus Torvalds Date: Sun Jul 28 09:14:11 2024 -0700 Merge tag 'unicode-next-6.11' of git://git.kernel.org/pub/scm/linux/kernel/git/krisman/unicode Pull unicode update from Gabriel Krisman Bertazi: "Two small fixes to silence the compiler and static analyzers tools from Ben Dooks and Jeff Johnson" * tag 'unicode-next-6.11' of git://git.kernel.org/pub/scm/linux/kernel/git/krisman/unicode: unicode: add MODULE_DESCRIPTION() macros unicode: make utf8 test count static commit d01c14074be79e5f5270498f90530a12583fbf7a Author: Jose Ignacio Tornos Martinez Date: Fri Jul 26 11:00:26 2024 +0200 kbuild: rpm-pkg: ghost modules.weakdep file In the same way as for other similar files, mark as ghost the new file generated by depmod for configured weak dependencies for modules, modules.weakdep, so that although it is not included in the package, claim the ownership on it. Signed-off-by: Jose Ignacio Tornos Martinez Signed-off-by: Masahiro Yamada scripts/package/kernel.spec | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 5437f30d3458ad36e83ab96088d490ebfee844d8 Merge: 6342649c33d2 b6f6a7aa689f Author: Linus Torvalds Date: Sat Jul 27 20:08:07 2024 -0700 Merge tag '6.11-rc-smb-client-fixes-part2' of git://git.samba.org/sfrench/cifs-2.6 Pull more smb client updates from Steve French: - fix for potential null pointer use in init cifs - additional dynamic trace points to improve debugging of some common scenarios - two SMB1 fixes (one addressing reconnect with POSIX extensions, one a mount parsing error) * tag '6.11-rc-smb-client-fixes-part2' of git://git.samba.org/sfrench/cifs-2.6: smb3: add dynamic trace point for session setup key expired failures smb3: add four dynamic tracepoints for copy_file_range and reflink smb3: add dynamic tracepoint for reflink errors cifs: mount with "unix" mount option for SMB1 incorrectly handled cifs: fix reconnect with SMB1 UNIX Extensions cifs: fix potential null pointer use in destroy_workqueue in init_cifs error path commit 6342649c33d232c4e7ac690b98bcddaab10a4d8c Merge: 8c9307474333 f6bb5254b777 Author: Linus Torvalds Date: Sat Jul 27 15:28:53 2024 -0700 Merge tag 'block-6.11-20240726' of git://git.kernel.dk/linux Pull block fixes from Jens Axboe: - NVMe pull request via Keith: - Fix request without payloads cleanup (Leon) - Use new protection information format (Francis) - Improved debug message for lost pci link (Bart) - Another apst quirk (Wang) - Use appropriate sysfs api for printing chars (Markus) - ublk async device deletion fix (Ming) - drbd kerneldoc fixups (Simon) - Fix deadlock between sd removal and release (Yang) * tag 'block-6.11-20240726' of git://git.kernel.dk/linux: nvme-pci: add missing condition check for existence of mapped data ublk: fix UBLK_CMD_DEL_DEV_ASYNC handling block: fix deadlock between sd_remove & sd_release drbd: Add peer_device to Kernel doc nvme-core: choose PIF from QPIF if QPIFS supports and PIF is QTYPE nvme-pci: Fix the instructions for disabling power management nvme: remove redundant bdev local variable nvme-fabrics: Use seq_putc() in __nvmf_concat_opt_tokens() nvme/pci: Add APST quirk for Lenovo N60z laptop commit 8c9307474333d8d100870b45af00bfeb1872c836 Merge: bc4eee85ca6c 358169617602 Author: Linus Torvalds Date: Sat Jul 27 15:22:33 2024 -0700 Merge tag 'io_uring-6.11-20240726' of git://git.kernel.dk/linux Pull io_uring fixes from Jens Axboe: - Fix a syzbot issue for the msg ring cache added in this release. No ill effects from this one, but it did make KMSAN unhappy (me) - Sanitize the NAPI timeout handling, by unifying the value handling into all ktime_t rather than converting back and forth (Pavel) - Fail NAPI registration for IOPOLL rings, it's not supported (Pavel) - Fix a theoretical issue with ring polling and cancelations (Pavel) - Various little cleanups and fixes (Pavel) * tag 'io_uring-6.11-20240726' of git://git.kernel.dk/linux: io_uring/napi: pass ktime to io_napi_adjust_timeout io_uring/napi: use ktime in busy polling io_uring/msg_ring: fix uninitialized use of target_req->flags io_uring: align iowq and task request error handling io_uring: kill REQ_F_CANCEL_SEQ io_uring: simplify io_uring_cmd return io_uring: fix io_match_task must_hold io_uring: don't allow netpolling with SETUP_IOPOLL io_uring: tighten task exit cancellations commit bc4eee85ca6ce5335efe314215841712b5531449 Merge: 910bfc26d16d ef9ca17ca458 Author: Linus Torvalds Date: Sat Jul 27 15:11:59 2024 -0700 Merge tag 'vfs-6.11-rc1.fixes.3' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs Pull vfs fixes from Christian Brauner: "This contains two fixes for this merge window: VFS: - I noticed that it is possible for a privileged user to mount most filesystems with a non-initial user namespace in sb->s_user_ns. When fsopen() is called in a non-init namespace the caller's namespace is recorded in fs_context->user_ns. If the returned file descriptor is then passed to a process privileged in init_user_ns, that process can call fsconfig(fd_fs, FSCONFIG_CMD_CREATE*), creating a new superblock with sb->s_user_ns set to the namespace of the process which called fsopen(). This is problematic as only filesystems that raise FS_USERNS_MOUNT are known to be able to support a non-initial s_user_ns. Others may suffer security issues, on-disk corruption or outright crash the kernel. Prevent that by restricting such delegation to filesystems that allow FS_USERNS_MOUNT. Note, that this delegation requires a privileged process to actually create the superblock so either the privileged process is cooperaing or someone must have tricked a privileged process into operating on a fscontext file descriptor whose origin it doesn't know (a stupid idea). The bug dates back to about 5 years afaict. Misc: - Fix hostfs parsing when the mount request comes in via the legacy mount api. In the legacy mount api hostfs allows to specify the host directory mount without any key. Restore that behavior" * tag 'vfs-6.11-rc1.fixes.3' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs: hostfs: fix the host directory parse when mounting. fs: don't allow non-init s_user_ns for filesystems without FS_USERNS_MOUNT commit d2860084ecca456ce78b251011f7def8d9136dcc Author: Alex Deucher Date: Thu Jul 25 17:30:37 2024 -0400 drm/amdgpu: Fix APU handling in amdgpu_pm_load_smu_firmware() We only need to skip this on modern APUs. It's required on older APUs as it's where start_smu gets called from. Closes: https://gitlab.freedesktop.org/drm/amd/-/issues/3502 Fixes: 064d92436b69 ("drm/amd/pm: avoid to load smu firmware for APUs") Reviewed-by: Tim Huang Signed-off-by: Alex Deucher Cc: Tim Huang (cherry picked from commit 608d886c978cd5f3d8650630568d96c231845227) drivers/gpu/drm/amd/pm/amdgpu_dpm.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) commit 9038e25c80558d48ce33d6d8c168666164dc72e9 Author: Michael Chen Date: Tue Jul 23 17:45:23 2024 -0400 drm/amdgpu: increase mes log buffer size for gfx12 MES firmware requires larger log buffer for gfx12. Allocate proper buffer respectively for gfx11 and gfx12. Signed-off-by: Michael Chen Acked-by: Alex Deucher Signed-off-by: Alex Deucher (cherry picked from commit 739d0f3e1f36738d4cd84166784a8f7a58d69612) drivers/gpu/drm/amd/amdgpu/amdgpu_mes.c | 6 +++--- drivers/gpu/drm/amd/amdgpu/amdgpu_mes.h | 6 +++--- drivers/gpu/drm/amd/amdgpu/mes_v11_0.c | 2 ++ drivers/gpu/drm/amd/amdgpu/mes_v12_0.c | 8 ++++++-- drivers/gpu/drm/amd/include/mes_v11_api_def.h | 3 +++ drivers/gpu/drm/amd/include/mes_v12_api_def.h | 3 +++ 6 files changed, 20 insertions(+), 8 deletions(-) commit f3572db3c049b4d32bb5ba77ad5305616c44c7c1 Author: Christian König Date: Wed Jul 24 09:24:02 2024 +0200 drm/amdgpu: fix contiguous handling for IB parsing v2 Otherwise we won't get correct access to the IB. v2: keep setting AMDGPU_GEM_CREATE_VRAM_CONTIGUOUS to avoid problems in the VRAM backend. Signed-off-by: Christian König Closes: https://gitlab.freedesktop.org/drm/amd/-/issues/3501 Fixes: e362b7c8f8c7 ("drm/amdgpu: Modify the contiguous flags behaviour") Reviewed-by: Alex Deucher Cc: stable@vger.kernel.org Tested-by: Dave Airlie Signed-off-by: Alex Deucher (cherry picked from commit fbfb5f0342253d92c4e446588c428a9d90c3f610) drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c | 16 ++++++++-------- 1 file changed, 8 insertions(+), 8 deletions(-) commit fe26546aeb35c5d1fd69530bb6bfd04e0b5cd489 Author: Kenneth Feng Date: Thu Jul 4 08:14:15 2024 +0800 drm/amdgpu/pm: support gpu_metrics sysfs interface for smu v14.0.2/3 support gpu_metrics sysfs interface for smu v14.0.2/3 Signed-off-by: Kenneth Feng Reviewed-by: Yang Wang Signed-off-by: Alex Deucher (cherry picked from commit 60c30ba7ba2064066ec462236666058cbbf619c1) .../gpu/drm/amd/pm/swsmu/smu14/smu_v14_0_2_ppt.c | 86 +++++++++++++++++++++- 1 file changed, 84 insertions(+), 2 deletions(-) commit 910bfc26d16d07df5a2bfcbc63f0aa9d1397e2ef Merge: ff30564411ff b12634111123 Author: Linus Torvalds Date: Sat Jul 27 13:44:54 2024 -0700 Merge tag 'rust-6.11' of https://github.com/Rust-for-Linux/linux Pull Rust updates from Miguel Ojeda: "The highlight is the establishment of a minimum version for the Rust toolchain, including 'rustc' (and bundled tools) and 'bindgen'. The initial minimum will be the pinned version we currently have, i.e. we are just widening the allowed versions. That covers three stable Rust releases: 1.78.0, 1.79.0, 1.80.0 (getting released tomorrow), plus beta, plus nightly. This should already be enough for kernel developers in distributions that provide recent Rust compiler versions routinely, such as Arch Linux, Debian Unstable (outside the freeze period), Fedora Linux, Gentoo Linux (especially the testing channel), Nix (unstable) and openSUSE Slowroll and Tumbleweed. In addition, the kernel is now being built-tested by Rust's pre-merge CI. That is, every change that is attempting to land into the Rust compiler is tested against the kernel, and it is merged only if it passes. Similarly, the bindgen tool has agreed to build the kernel in their CI too. Thus, with the pre-merge CI in place, both projects hope to avoid unintentional changes to Rust that break the kernel. This means that, in general, apart from intentional changes on their side (that we will need to workaround conditionally on our side), the upcoming Rust compiler versions should generally work. In addition, the Rust project has proposed getting the kernel into stable Rust (at least solving the main blockers) as one of its three flagship goals for 2024H2 [1]. I would like to thank Niko, Sid, Emilio et al. for their help promoting the collaboration between Rust and the kernel. Toolchain and infrastructure: - Support several Rust toolchain versions. - Support several bindgen versions. - Remove 'cargo' requirement and simplify 'rusttest', thanks to 'alloc' having been dropped last cycle. - Provide proper error reporting for the 'rust-analyzer' target. 'kernel' crate: - Add 'uaccess' module with a safe userspace pointers abstraction. - Add 'page' module with a 'struct page' abstraction. - Support more complex generics in workqueue's 'impl_has_work!' macro. 'macros' crate: - Add 'firmware' field support to the 'module!' macro. - Improve 'module!' macro documentation. Documentation: - Provide instructions on what packages should be installed to build the kernel in some popular Linux distributions. - Introduce the new kernel.org LLVM+Rust toolchains. - Explain '#[no_std]'. And a few other small bits" Link: https://rust-lang.github.io/rust-project-goals/2024h2/index.html#flagship-goals [1] * tag 'rust-6.11' of https://github.com/Rust-for-Linux/linux: (26 commits) docs: rust: quick-start: add section on Linux distributions rust: warn about `bindgen` versions 0.66.0 and 0.66.1 rust: start supporting several `bindgen` versions rust: work around `bindgen` 0.69.0 issue rust: avoid assuming a particular `bindgen` build rust: start supporting several compiler versions rust: simplify Clippy warning flags set rust: relax most deny-level lints to warnings rust: allow `dead_code` for never constructed bindings rust: init: simplify from `map_err` to `inspect_err` rust: macros: indent list item in `paste!`'s docs rust: add abstraction for `struct page` rust: uaccess: add typed accessors for userspace pointers uaccess: always export _copy_[from|to]_user with CONFIG_RUST rust: uaccess: add userspace pointers kbuild: rust-analyzer: improve comment documentation kbuild: rust-analyzer: better error handling docs: rust: no_std is used rust: alloc: add __GFP_HIGHMEM flag rust: alloc: fix typo in docs for GFP_NOWAIT ... commit ff30564411ffdcee49d579cb15eb13185a36e253 Merge: 86b405ad8d0d e0ff0cff1f6c Author: Linus Torvalds Date: Sat Jul 27 13:28:39 2024 -0700 Merge tag 'apparmor-pr-2024-07-25' of git://git.kernel.org/pub/scm/linux/kernel/git/jj/linux-apparmor Pull apparmor updates from John Johansen: "Cleanups - optimization: try to avoid refing the label in apparmor_file_open - remove useless static inline function is_deleted - use kvfree_sensitive to free data->data - fix typo in kernel doc Bug fixes: - unpack transition table if dfa is not present - test: add MODULE_DESCRIPTION() - take nosymfollow flag into account - fix possible NULL pointer dereference - fix null pointer deref when receiving skb during sock creation" * tag 'apparmor-pr-2024-07-25' of git://git.kernel.org/pub/scm/linux/kernel/git/jj/linux-apparmor: apparmor: unpack transition table if dfa is not present apparmor: try to avoid refing the label in apparmor_file_open apparmor: test: add MODULE_DESCRIPTION() apparmor: take nosymfollow flag into account apparmor: fix possible NULL pointer dereference apparmor: fix typo in kernel doc apparmor: remove useless static inline function is_deleted apparmor: use kvfree_sensitive to free data->data apparmor: Fix null pointer deref when receiving skb during sock creation commit 86b405ad8d0d2994a7ffbacb8fcf83be8afb952c Merge: 8e333791d460 cc374782b6ca Author: Linus Torvalds Date: Sat Jul 27 13:16:53 2024 -0700 Merge tag 'landlock-6.11-rc1-houdini-fix' of git://git.kernel.org/pub/scm/linux/kernel/git/mic/linux Pull landlock fix from Mickaël Salaün: "Jann Horn reported a sandbox bypass for Landlock. This includes the fix and new tests. This should be backported" * tag 'landlock-6.11-rc1-houdini-fix' of git://git.kernel.org/pub/scm/linux/kernel/git/mic/linux: selftests/landlock: Add cred_transfer test landlock: Don't lose track of restrictions on cred_transfer commit 8e333791d4605dbce611c22f71a86721c9afc336 Merge: bf80f1391a42 3ae08e47742e Author: Linus Torvalds Date: Sat Jul 27 12:54:06 2024 -0700 Merge tag 'gpio-fixes-for-v6.11-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/brgl/linux Pull gpio fix from Bartosz Golaszewski: - don't use sprintf() with non-constant format string * tag 'gpio-fixes-for-v6.11-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/brgl/linux: gpio: virtuser: avoid non-constant format string commit bf80f1391a425081b96f9e04e5c608f854858aaa Merge: b465ed28f712 6dc55268f64b Author: Linus Torvalds Date: Sat Jul 27 12:46:16 2024 -0700 Merge tag 'devicetree-fixes-for-6.11-1' of git://git.kernel.org/pub/scm/linux/kernel/git/robh/linux Pull more devicetree updates from Rob Herring: "Most of this is a treewide change to of_property_for_each_u32() which was small enough to do in one go before rc1 and avoids the need to create of_property_for_each_u32_some_new_name(). - Treewide conversion of of_property_for_each_u32() to drop internal arguments making struct property opaque - Add binding for Amlogic A4 SoC watchdog - Fix constraints for AD7192 'single-channel' property" * tag 'devicetree-fixes-for-6.11-1' of git://git.kernel.org/pub/scm/linux/kernel/git/robh/linux: dt-bindings: iio: adc: ad7192: Fix 'single-channel' constraints of: remove internal arguments from of_property_for_each_u32() dt-bindings: watchdog: add support for Amlogic A4 SoCs commit b465ed28f7125fcc41f3e556db57c42c11892ff5 Merge: 0421621158ed 726d4f528dbc Author: Linus Torvalds Date: Sat Jul 27 12:39:55 2024 -0700 Merge tag 'iommu-fixes-v6.11-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/iommu/linux Pull iommu fixes from Will Deacon: "We're still resolving a regression with the handling of unexpected page faults on SMMUv3, but we're not quite there with a fix yet. - Fix NULL dereference when freeing domain in Unisoc SPRD driver - Separate assignment statements with semicolons in AMD page-table code - Fix Tegra erratum workaround when the CPU is using 16KiB pages" * tag 'iommu-fixes-v6.11-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/iommu/linux: iommu: arm-smmu: Fix Tegra workaround for PAGE_SIZE mappings iommu/amd: Convert comma to semicolon iommu: sprd: Avoid NULL deref in sprd_iommu_hw_en commit 0421621158ed14d0e04321c445c770fc4e99ee59 Merge: ab11658f26bf c1839501fe3e Author: Linus Torvalds Date: Sat Jul 27 12:35:12 2024 -0700 Merge tag 'firewire-fixes-6.11-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/ieee1394/linux1394 Pull firewire fixes from Takashi Sakamoto: "The recent integration of compiler collections introduced the technology to check flexible array length at runtime by providing proper annotations. In v6.10 kernel, a patch was merged into firewire subsystem to utilize it, however the annotation was inadequate. There is also the related change for the flexible array in sound subsystem, but it causes a regression where the data in the payload of isochronous packet is incorrect for some devices. These bugs are now fixed" * tag 'firewire-fixes-6.11-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/ieee1394/linux1394: ALSA: firewire-lib: fix wrong value as length of header for CIP_NO_HEADER case Revert "firewire: Annotate struct fw_iso_packet with __counted_by()" commit ab11658f26bfb5bb62fd7155fe821e511e9a4668 Merge: 560e805047ad fc28d1c1fe3b Author: Linus Torvalds Date: Sat Jul 27 12:29:10 2024 -0700 Merge tag 'spi-fix-v6.11-merge-window' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/spi Pull spi fixes from Mark Brown: "The bulk of this is a series of fixes for the microchip-core driver mostly originating from one of their customers, I also applied an additional patch adding support for controlling the word size which came along with it since it's still the merge window and clearly had a bunch of fairly thorough testing. We also have a fix for the compatible used to bind spidev to the BH2228FV" * tag 'spi-fix-v6.11-merge-window' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/spi: spi: spidev: add correct compatible for Rohm BH2228FV dt-bindings: trivial-devices: fix Rohm BH2228FV compatible string spi: microchip-core: add support for word sizes of 1 to 32 bits spi: microchip-core: ensure TX and RX FIFOs are empty at start of a transfer spi: microchip-core: fix init function not setting the master and motorola modes spi: microchip-core: only disable SPI controller when register value change requires it spi: microchip-core: defer asserting chip select until just before write to TX FIFO spi: microchip-core: fix the issues in the isr commit 560e805047ad38898b423ef456e5368260e199fb Merge: 8f3f7598cb65 e975d955c07c Author: Linus Torvalds Date: Sat Jul 27 12:27:52 2024 -0700 Merge tag 'regulator-fix-v6.11-merge-window' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/regulator Pull regulator fixes from Mark Brown: "These two commits clean up the excessively loose dependencies for the RZG2L USB VBCTRL regulator driver, ensuring it shouldn't prompt for people who can't use it" * tag 'regulator-fix-v6.11-merge-window' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/regulator: regulator: Further restrict RZG2L USB VBCTRL regulator dependencies regulator: renesas-usb-vbus-regulator: Update the default commit 8f3f7598cb657b9ceb6dacb4b97a52811f25f991 Merge: de5f4fbe7bd2 542440fd7b30 Author: Linus Torvalds Date: Sat Jul 27 12:26:09 2024 -0700 Merge tag 'regmap-fix-v6.11-merge-window' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/regmap Pull regmap fix from Mark Brown: "Arnd sent a workaround for a false positive warning which was showing up with GCC 14.1" * tag 'regmap-fix-v6.11-merge-window' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/regmap: regmap: maple: work around gcc-14.1 false-positive warning commit de5f4fbe7bd20a5c464c3b0101ee3b8486f40189 Merge: c85e1497dd10 f99b3feb3b0e Author: Linus Torvalds Date: Sat Jul 27 12:07:18 2024 -0700 Merge tag 'clk-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/clk/linux Pull clk fixes from Stephen Boyd: "A few clk driver fixes for the merge window to fix the build and boot on some SoCs. - Initialize struct clk_init_data in the TI da8xx-cfgchip driver so that stack contents aren't used for things like clk flags leading to unexpected behavior - Don't leak stack contents in a debug print in the new Sophgo clk driver - Disable the new T-Head clk driver on 32-bit targets to fix the build due to a division - Fix Samsung Exynos4 fin_pll wreckage from the clkdev rework done last cycle by using a struct clk_hw directly instead of a struct clk consumer" * tag 'clk-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/clk/linux: clk: samsung: fix getting Exynos4 fin_pll rate from external clocks clk: T-Head: Disable on 32-bit Targets clk: sophgo: clk-sg2042-pll: Fix uninitialized variable in debug output clk: davinci: da8xx-cfgchip: Initialize clk_init_data before use commit c85e1497dd10879f447d6a12f97762c581093e9b Merge: 1fcaa5db40f9 24168c5e6dfb Author: Linus Torvalds Date: Sat Jul 27 10:53:06 2024 -0700 Merge tag 'i3c/for-6.11' of git://git.kernel.org/pub/scm/linux/kernel/git/i3c/linux Pull i3c updates from Alexandre Belloni: "This cycle, there are new features for the Designware controller and fixes for the other IPs: - dw: optional apb clock and power management support, IBI handling fixes - mipi-i3c-hci: IBI handling fixes - svc: a few fixes" * tag 'i3c/for-6.11' of git://git.kernel.org/pub/scm/linux/kernel/git/i3c/linux: dt-bindings: i3c: add header for generic I3C flags i3c: master: svc: Fix error code in svc_i3c_master_do_daa_locked() i3c: master: Enhance i3c_bus_type visibility for device searching & event monitoring i3c: dw: Add power management support i3c: dw: Add some functions for reusability i3c: dw: Save timing registers and other values i3c: master: svc: Improve DAA STOP handle code logic i3c: dw: Add optional apb clock i3c: dw: Use new *_enabled clk API dt-bindings: i3c: dw: Add apb clock binding i3c: master: svc: Convert comma to semicolon i3c: mipi-i3c-hci: Round IBI data chunk size to HW supported value i3c: mipi-i3c-hci: Error out instead on BUG_ON() in IBI DMA setup i3c: mipi-i3c-hci: Set IBI Status and Data Ring base addresses i3c: mipi-i3c-hci: Switch to lower_32_bits()/upper_32_bits() helpers i3c: dw: Remove ibi_capable property i3c: dw: Fix IBI intr programming i3c: dw: Fix clearing queue thld i3c: mipi-i3c-hci: Fix number of DAT/DCT entries for HCI versions < 1.1 i3c: master: svc: resend target address when get NACK commit 1fcaa5db40f960e58f47050337db54eb087fb62a Merge: 7b0acd911ca0 f7c1b0e4ae47 Author: Linus Torvalds Date: Sat Jul 27 10:44:49 2024 -0700 Merge tag 'thermal-6.11-rc1-3' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm Pull thermal control fix from Rafael Wysocki: "Prevent the thermal core from flooding the kernel log with useless messages if thermal zone temperature can never be determined (or its sensor has failed permanently) and make it finally give up and disable defective thermal zones (Rafael Wysocki)" * tag 'thermal-6.11-rc1-3' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm: thermal: core: Back off when polling thermal zones on errors thermal: trip: Split thermal_zone_device_set_mode() commit 7b0acd911ca05b2555d834cd93ffcfab1ade828c Merge: 5256184b6119 4811f7af6090 Author: Linus Torvalds Date: Sat Jul 27 10:26:41 2024 -0700 Merge tag 'mm-hotfixes-stable-2024-07-26-14-33' of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm Pull misc hotfixes from Andrew Morton: "11 hotfixes, 7 of which are cc:stable. 7 are MM, 4 are other" * tag 'mm-hotfixes-stable-2024-07-26-14-33' of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm: nilfs2: handle inconsistent state in nilfs_btnode_create_block() selftests/mm: skip test for non-LPA2 and non-LVA systems mm/page_alloc: fix pcp->count race between drain_pages_zone() vs __rmqueue_pcplist() mm: memcg: add cacheline padding after lruvec in mem_cgroup_per_node alloc_tag: outline and export free_reserved_page() decompress_bunzip2: fix rare decompression failure mm/huge_memory: avoid PMD-size page cache if needed mm: huge_memory: use !CONFIG_64BIT to relax huge page alignment on 32 bit machines mm: fix old/young bit handling in the faulting path dt-bindings: arm: update James Clark's email address MAINTAINERS: mailmap: update James Clark's email address commit 5256184b6119bd1da541d8deb487c2f9131a6c9f Merge: c9f33436d85b f004bf9de057 Author: Linus Torvalds Date: Sat Jul 27 10:19:55 2024 -0700 Merge tag 'timers-urgent-2024-07-26' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull timer migration updates from Thomas Gleixner: "Fixes and minor updates for the timer migration code: - Stop testing the group->parent pointer as it is not guaranteed to be stable over a chain of operations by design. This includes a warning which would be nice to have but it produces false positives due to the racy nature of the check. - Plug a race between CPUs going in and out of idle and a CPU hotplug operation. The latter can create and connect a new hierarchy level which is missed in the concurrent updates of CPUs which go into idle. As a result the events of such a CPU might not be processed and timers go stale. Cure it by splitting the hotplug operation into a prepare and online callback. The prepare callback is guaranteed to run on an online and therefore active CPU. This CPU updates the hierarchy and being online ensures that there is always at least one migrator active which handles the modified hierarchy correctly when going idle. The online callback which runs on the incoming CPU then just marks the CPU active and brings it into operation. - Improve tracing and polish the code further so it is more obvious what's going on" * tag 'timers-urgent-2024-07-26' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: timers/migration: Fix grammar in comment timers/migration: Spare write when nothing changed timers/migration: Rename childmask by groupmask to make naming more obvious timers/migration: Read childmask and parent pointer in a single place timers/migration: Use a single struct for hierarchy walk data timers/migration: Improve tracing timers/migration: Move hierarchy setup into cpuhotplug prepare callback timers/migration: Do not rely always on group->parent commit c9f33436d85b72b2addfd9423eae864cb8dac1da Merge: c17f1224b8d7 52420e483d3e Author: Linus Torvalds Date: Sat Jul 27 10:14:34 2024 -0700 Merge tag 'riscv-for-linus-6.11-mw2' of git://git.kernel.org/pub/scm/linux/kernel/git/riscv/linux Pull more RISC-V updates from Palmer Dabbelt: - Support for NUMA (via SRAT and SLIT), console output (via SPCR), and cache info (via PPTT) on ACPI-based systems. - The trap entry/exit code no longer breaks the return address stack predictor on many systems, which results in an improvement to trap latency. - Support for HAVE_ARCH_STACKLEAK. - The sv39 linear map has been extended to support 128GiB mappings. - The frequency of the mtime CSR is now visible via hwprobe. * tag 'riscv-for-linus-6.11-mw2' of git://git.kernel.org/pub/scm/linux/kernel/git/riscv/linux: (21 commits) RISC-V: Provide the frequency of time CSR via hwprobe riscv: Extend sv39 linear mapping max size to 128G riscv: enable HAVE_ARCH_STACKLEAK riscv: signal: Remove unlikely() from WARN_ON() condition riscv: Improve exception and system call latency RISC-V: Select ACPI PPTT drivers riscv: cacheinfo: initialize cacheinfo's level and type from ACPI PPTT riscv: cacheinfo: remove the useless input parameter (node) of ci_leaf_init() RISC-V: ACPI: Enable SPCR table for console output on RISC-V riscv: boot: remove duplicated targets line trace: riscv: Remove deprecated kprobe on ftrace support riscv: cpufeature: Extract common elements from extension checking riscv: Introduce vendor variants of extension helpers riscv: Add vendor extensions to /proc/cpuinfo riscv: Extend cpufeature.c to detect vendor extensions RISC-V: run savedefconfig for defconfig RISC-V: hwprobe: sort EXT_KEY()s in hwprobe_isa_ext0() alphabetically ACPI: NUMA: replace pr_info with pr_debug in arch_acpi_numa_init ACPI: NUMA: change the ACPI_NUMA to a hidden option ACPI: NUMA: Add handler for SRAT RINTC affinity structure ... commit c17f1224b8d79339e9f2156fdf2966281cdb31df Merge: 3a7e02c040b1 4c006734898a Author: Linus Torvalds Date: Sat Jul 27 09:58:24 2024 -0700 Merge tag 'for-linus-6.11-rc1a-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/xen/tip Pull xen fixes from Juergen Gross: "Two fixes for issues introduced in this merge window: - fix enhanced debugging in the Xen multicall handling - two patches fixing a boot failure when running as dom0 in PVH mode" * tag 'for-linus-6.11-rc1a-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/xen/tip: x86/xen: fix memblock_reserve() usage on PVH x86/xen: move xen_reserve_extra_memory() xen: fix multicall debug data referencing commit 01aa8c869d0cdaf603f42dc1d2302b164c25353a Author: Dr. David Alan Gilbert Date: Sat Jul 27 16:58:24 2024 +0100 blk-throttle: remove more latency dead-code The struct 'latency_bucket' and the #define 'request_bucket_index' are unused since commit bf20ab538c81 ("blk-throttle: remove CONFIG_BLK_DEV_THROTTLING_LOW") and the 'LATENCY_BUCKET_SIZE' #define was only used by the 'request_bucket_index' define. Remove them. Signed-off-by: Dr. David Alan Gilbert Link: https://lore.kernel.org/r/20240727155824.1000042-1-linux@treblig.org Signed-off-by: Jens Axboe block/blk-throttle.c | 11 ----------- 1 file changed, 11 deletions(-) commit d7ac67b94390945872713f9bb0c141bf158c83aa Merge: 657a292d679a 2335c9cb831f Author: Russell King (Oracle) Date: Sat Jul 27 09:13:09 2024 +0100 Merge branches 'fixes' and 'misc' into for-linus commit ef9ca17ca458ac7253ae71b552e601e49311fc48 Author: Hongbo Li Date: Thu Jul 25 14:51:30 2024 +0800 hostfs: fix the host directory parse when mounting. hostfs not keep the host directory when mounting. When the host directory is none (default), fc->source is used as the host root directory, and this is wrong. Here we use `parse_monolithic` to handle the old mount path for parsing the root directory. For new mount path, The `parse_param` is used for the host directory parse. Reported-and-tested-by: Maciej Żenczykowski Fixes: cd140ce9f611 ("hostfs: convert hostfs to use the new mount API") Link: https://lore.kernel.org/all/CANP3RGceNzwdb7w=vPf5=7BCid5HVQDmz1K5kC9JG42+HVAh_g@mail.gmail.com/ Cc: Christian Brauner Signed-off-by: Hongbo Li Link: https://lore.kernel.org/r/20240725065130.1821964-1-lihongbo22@huawei.com [brauner: minor fixes] Signed-off-by: Christian Brauner fs/hostfs/hostfs_kern.c | 65 +++++++++++++++++++++++++++++++++++++++++-------- 1 file changed, 55 insertions(+), 10 deletions(-) commit e1c5ae59c0f22f7fe5c07fb5513a29e4aad868c9 Author: Seth Forshee (DigitalOcean) Date: Wed Jul 24 09:53:59 2024 -0500 fs: don't allow non-init s_user_ns for filesystems without FS_USERNS_MOUNT Christian noticed that it is possible for a privileged user to mount most filesystems with a non-initial user namespace in sb->s_user_ns. When fsopen() is called in a non-init namespace the caller's namespace is recorded in fs_context->user_ns. If the returned file descriptor is then passed to a process priviliged in init_user_ns, that process can call fsconfig(fd_fs, FSCONFIG_CMD_CREATE), creating a new superblock with sb->s_user_ns set to the namespace of the process which called fsopen(). This is problematic. We cannot assume that any filesystem which does not set FS_USERNS_MOUNT has been written with a non-initial s_user_ns in mind, increasing the risk for bugs and security issues. Prevent this by returning EPERM from sget_fc() when FS_USERNS_MOUNT is not set for the filesystem and a non-initial user namespace will be used. sget() does not need to be updated as it always uses the user namespace of the current context, or the initial user namespace if SB_SUBMOUNT is set. Fixes: cb50b348c71f ("convenience helpers: vfs_get_super() and sget_fc()") Reported-by: Christian Brauner Signed-off-by: Seth Forshee (DigitalOcean) Link: https://lore.kernel.org/r/20240724-s_user_ns-fix-v1-1-895d07c94701@kernel.org Reviewed-by: Alexander Mikhalitsyn Signed-off-by: Christian Brauner fs/super.c | 11 +++++++++++ 1 file changed, 11 insertions(+) commit c1839501fe3e67d98635f159dba8b170d08f6521 Author: Takashi Sakamoto Date: Fri Jul 26 00:56:40 2024 +0900 ALSA: firewire-lib: fix wrong value as length of header for CIP_NO_HEADER case In a commit 1d717123bb1a ("ALSA: firewire-lib: Avoid -Wflex-array-member-not-at-end warning"), DEFINE_FLEX() macro was used to handle variable length of array for header field in struct fw_iso_packet structure. The usage of macro has a side effect that the designated initializer assigns the count of array to the given field. Therefore CIP_HEADER_QUADLETS (=2) is assigned to struct fw_iso_packet.header, while the original designated initializer assigns zero to all fields. With CIP_NO_HEADER flag, the change causes invalid length of header in isochronous packet for 1394 OHCI IT context. This bug affects all of devices supported by ALSA fireface driver; RME Fireface 400, 800, UCX, UFX, and 802. This commit fixes the bug by replacing it with the alternative version of macro which corresponds no initializer. Cc: stable@vger.kernel.org Fixes: 1d717123bb1a ("ALSA: firewire-lib: Avoid -Wflex-array-member-not-at-end warning") Reported-by: Edmund Raile Closes: https://lore.kernel.org/r/rrufondjeynlkx2lniot26ablsltnynfaq2gnqvbiso7ds32il@qk4r6xps7jh2/ Reviewed-by: Takashi Iwai Link: https://lore.kernel.org/r/20240725155640.128442-1-o-takashi@sakamocchi.jp Signed-off-by: Takashi Sakamoto sound/firewire/amdtp-stream.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) commit 00e3913b0416fe69d28745c0a2a340e2f76c219c Author: Takashi Sakamoto Date: Fri Jul 26 01:16:48 2024 +0900 Revert "firewire: Annotate struct fw_iso_packet with __counted_by()" This reverts commit d3155742db89df3b3c96da383c400e6ff4d23c25. The header_length field is byte unit, thus it can not express the number of elements in header field. It seems that the argument for counted_by attribute can have no arithmetic expression, therefore this commit just reverts the issued commit. Suggested-by: Gustavo A. R. Silva Link: https://lore.kernel.org/r/20240725161648.130404-1-o-takashi@sakamocchi.jp Signed-off-by: Takashi Sakamoto include/linux/firewire.h | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-) commit 301927d2d2eb8e541357ba850bc7a1a74dbbd670 Merge: 697943657444 df3d6a3e01fd Author: Jakub Kicinski Date: Fri Jul 26 18:27:51 2024 -0700 Merge tag 'for-net-2024-07-26' of git://git.kernel.org/pub/scm/linux/kernel/git/bluetooth/bluetooth Luiz Augusto von Dentz says: ==================== bluetooth pull request for net: - btmtk: Fix kernel crash when entering btmtk_usb_suspend - btmtk: Fix btmtk.c undefined reference build error - btintel: Fail setup on error - hci_sync: Fix suspending with wrong filter policy - hci_event: Fix setting DISCOVERY_FINDING for passive scanning * tag 'for-net-2024-07-26' of git://git.kernel.org/pub/scm/linux/kernel/git/bluetooth/bluetooth: Bluetooth: hci_event: Fix setting DISCOVERY_FINDING for passive scanning Bluetooth: btmtk: remove #ifdef around declarations Bluetooth: btmtk: Fix btmtk.c undefined reference build error harder Bluetooth: btmtk: Fix btmtk.c undefined reference build error Bluetooth: hci_sync: Fix suspending with wrong filter policy Bluetooth: btmtk: Fix kernel crash when entering btmtk_usb_suspend Bluetooth: btintel: Fail setup on error ==================== Link: https://patch.msgid.link/20240726150502.3300832-1-luiz.dentz@gmail.com Signed-off-by: Jakub Kicinski commit 697943657444a7d7123b47bc32019e62533f4863 Author: Alexander Duyck Date: Thu Jul 25 10:03:54 2024 -0700 fbnic: Change kconfig prompt from S390=n to !S390 In testing the recent kernel I found that the fbnic driver couldn't be enabled on x86_64 builds. A bit of digging showed that the fbnic driver was the only one to check for S390 to be n, all others had checked for !S390. Since it is a boolean and not a tristate I am not sure it will be N. So just update it to use the !S390 flag. A quick check via "make menuconfig" verified that after making this change there was an option to select the fbnic driver. Fixes 0e03c643dc93 ("eth: fbnic: fix s390 build.") Signed-off-by: Alexander Duyck Reviewed-by: Joe Damato Link: https://patch.msgid.link/172192698293.1903337.4255690118685300353.stgit@ahduyck-xeon-server.home.arpa Signed-off-by: Jakub Kicinski drivers/net/ethernet/meta/Kconfig | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit f99d93de93c2e650abee890af4f31c29fe12a32a Merge: 225990c487c1 a47f3320bb4b Author: Jakub Kicinski Date: Fri Jul 26 18:22:53 2024 -0700 Merge tag 'wireless-2024-07-26' of git://git.kernel.org/pub/scm/linux/kernel/git/wireless/wireless Johannes Berg says: ==================== Couple of more urgent fixes: * ath12k: wowlan loop iteration issue * ath12k: fix soft lockup on suspend in certain scenarios * mt76: fix crash when removing an interface * mac80211: fix injection crash with some drivers that don't want monitor vif * cfg80211: fix S1G beacon parsing in scan * cfg80211: fix MLO link status reporting on connect * tag 'wireless-2024-07-26' of git://git.kernel.org/pub/scm/linux/kernel/git/wireless/wireless: wifi: ath12k: fix soft lockup on suspend wifi: mt76: mt7921: fix null pointer access in mt792x_mac_link_bss_remove wifi: ath12k: fix reusing outside iterator in ath12k_wow_vif_set_wakeups() wifi: cfg80211: correct S1G beacon length calculation wifi: cfg80211: fix reporting failed MLO links status with cfg80211_connect_done wifi: mac80211: use monitor sdata with driver only if desired ==================== Link: https://patch.msgid.link/20240726122638.942420-3-johannes@sipsolutions.net Signed-off-by: Jakub Kicinski commit 3a7e02c040b130b5545e4b115aada7bacd80a2b6 Author: Linus Torvalds Date: Fri Jul 26 15:32:27 2024 -0700 minmax: avoid overly complicated constant expressions in VM code The minmax infrastructure is overkill for simple constants, and can cause huge expansions because those simple constants are then used by other things. For example, 'pageblock_order' is a core VM constant, but because it was implemented using 'min_t()' and all the type-checking that involves, it actually expanded to something like 2.5kB of preprocessor noise. And when that simple constant was then used inside other expansions: #define pageblock_nr_pages (1UL << pageblock_order) #define pageblock_start_pfn(pfn) ALIGN_DOWN((pfn), pageblock_nr_pages) and we then use that inside a 'max()' macro: case ISOLATE_SUCCESS: update_cached = false; last_migrated_pfn = max(cc->zone->zone_start_pfn, pageblock_start_pfn(cc->migrate_pfn - 1)); the end result was that one statement expanding to 253kB in size. There are probably other cases of this, but this one case certainly stood out. I've added 'MIN_T()' and 'MAX_T()' macros for this kind of "core simple constant with specific type" use. These macros skip the type checking, and as such need to be very sparingly used only for obvious cases that have active issues like this. Reported-by: Lorenzo Stoakes Link: https://lore.kernel.org/all/36aa2cad-1db1-4abf-8dd2-fb20484aabc3@lucifer.local/ Cc: David Laight Signed-off-by: Linus Torvalds include/linux/minmax.h | 7 +++++++ include/linux/pageblock-flags.h | 4 ++-- 2 files changed, 9 insertions(+), 2 deletions(-) commit d6cca7631a4b54a8995e3bc53e5afb11d3b0c8ff Author: Stephan Gerhold Date: Fri Jul 12 12:00:03 2024 +0200 power: supply: qcom_battmgr: Ignore extra __le32 in info payload Some newer ADSP firmware versions on X1E80100 report an extra __le32 at the end of the battery information request payload, causing qcom_battmgr to fail to initialize. Adjust the check to ignore the extra field in the info payload so we can support both old and newer firmware versions. Tested-by: Srinivas Kandagatla Signed-off-by: Stephan Gerhold Tested-by: Johan Hovold Reviewed-by: Dmitry Baryshkov Link: https://lore.kernel.org/r/20240712-x1e80100-battmgr-v1-1-a253d767f493@linaro.org Signed-off-by: Sebastian Reichel drivers/power/supply/qcom_battmgr.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) commit bf9d5cb588755ee41ac12a8976dccf44ae18281b Author: Neil Armstrong Date: Mon Jul 15 14:57:06 2024 +0200 power: supply: qcom_battmgr: return EAGAIN when firmware service is not up The driver returns -ENODEV when the firmware battmrg service hasn't started yet, while per-se -ENODEV is fine, we usually use -EAGAIN to tell the user to retry again later. And the power supply core uses -EGAIN when the device isn't initialized, let's use the same return. This notably causes an infinite spam of: thermal thermal_zoneXX: failed to read out thermal zone (-19) because the thermal core doesn't understand -ENODEV, but only considers -EAGAIN as a non-fatal error. While it didn't appear until now, commit [1] fixes thermal core and no more ignores thermal zones returning an error at first temperature update. [1] 5725f40698b9 ("thermal: core: Call monitor_thermal_zone() if zone temperature is invalid") Link: https://lore.kernel.org/all/2ed4c630-204a-4f80-a37f-f2ca838eb455@linaro.org/ Cc: stable@vger.kernel.org Fixes: 29e8142b5623 ("power: supply: Introduce Qualcomm PMIC GLINK power supply") Signed-off-by: Neil Armstrong Tested-by: Stephan Gerhold Reviewed-by: Stephan Gerhold Link: https://lore.kernel.org/r/20240715-topic-sm8x50-upstream-fix-battmgr-temp-tz-warn-v1-1-16e842ccead7@linaro.org Signed-off-by: Sebastian Reichel drivers/power/supply/qcom_battmgr.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) commit 81af7f2342d162e24ac820c10e68684d9f927663 Author: Hans de Goede Date: Wed Jul 17 22:03:33 2024 +0200 power: supply: axp288_charger: Round constant_charge_voltage writes down Round constant_charge_voltage writes down to the first supported lower value, rather then rounding them up to the first supported higher value. This fixes e.g. writing 4250000 resulting in a value of 4350000 which might be dangerous, instead writing 4250000 will now result in a safe 4200000 value. Fixes: 843735b788a4 ("power: axp288_charger: axp288 charger driver") Cc: stable@vger.kernel.org Signed-off-by: Hans de Goede Link: https://lore.kernel.org/r/20240717200333.56669-2-hdegoede@redhat.com Signed-off-by: Sebastian Reichel drivers/power/supply/axp288_charger.c | 18 +++++++++--------- 1 file changed, 9 insertions(+), 9 deletions(-) commit b34ce4a59cfe9cd0d6f870e6408e8ec88a964585 Author: Hans de Goede Date: Wed Jul 17 22:03:32 2024 +0200 power: supply: axp288_charger: Fix constant_charge_voltage writes info->max_cv is in millivolts, divide the microvolt value being written to constant_charge_voltage by 1000 *before* clamping it to info->max_cv. Before this fix the code always tried to set constant_charge_voltage to max_cv / 1000 = 4 millivolt, which ends up in setting it to 4.1V which is the lowest supported value. Fixes: 843735b788a4 ("power: axp288_charger: axp288 charger driver") Cc: stable@vger.kernel.org Signed-off-by: Hans de Goede Link: https://lore.kernel.org/r/20240717200333.56669-1-hdegoede@redhat.com Signed-off-by: Sebastian Reichel drivers/power/supply/axp288_charger.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) commit e8432ac802a028eaee6b1e86383d7cd8e9fb8431 Author: Linus Torvalds Date: Fri Jul 26 15:09:07 2024 -0700 minmax: avoid overly complex min()/max() macro arguments in xen We have some very fancy min/max macros that have tons of sanity checking to warn about mixed signedness etc. This is all things that a sane compiler should warn about, but there are no sane compiler interfaces for this, and '-Wsign-compare' is broken [1] and not useful. So then we compensate (some would say over-compensate) by doing the checks manually with some truly horrid macro games. And no, we can't just use __builtin_types_compatible_p(), because the whole question of "does it make sense to compare these two values" is a lot more complicated than that. For example, it makes a ton of sense to compare unsigned values with simple constants like "5", even if that is indeed a signed type. So we have these very strange macros to try to make sensible type checking decisions on the arguments to 'min()' and 'max()'. But that can cause enormous code expansion if the min()/max() macros are used with complicated expressions, and particularly if you nest these things so that you get the first big expansion then expanded again. The xen setup.c file ended up ballooning to over 50MB of preprocessed noise that takes 15s to compile (obviously depending on the build host), largely due to one single line. So let's split that one single line to just be simpler. I think it ends up being more legible to humans too at the same time. Now that single file compiles in under a second. Reported-and-reviewed-by: Lorenzo Stoakes Link: https://lore.kernel.org/all/c83c17bb-be75-4c67-979d-54eee38774c6@lucifer.local/ Link: https://staticthinking.wordpress.com/2023/07/25/wsign-compare-is-garbage/ [1] Cc: David Laight Signed-off-by: Linus Torvalds arch/x86/xen/setup.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) commit 4811f7af6090e8f5a398fbdd766f903ef6c0d787 Author: Ryusuke Konishi Date: Thu Jul 25 14:20:07 2024 +0900 nilfs2: handle inconsistent state in nilfs_btnode_create_block() Syzbot reported that a buffer state inconsistency was detected in nilfs_btnode_create_block(), triggering a kernel bug. It is not appropriate to treat this inconsistency as a bug; it can occur if the argument block address (the buffer index of the newly created block) is a virtual block number and has been reallocated due to corruption of the bitmap used to manage its allocation state. So, modify nilfs_btnode_create_block() and its callers to treat it as a possible filesystem error, rather than triggering a kernel bug. Link: https://lkml.kernel.org/r/20240725052007.4562-1-konishi.ryusuke@gmail.com Fixes: a60be987d45d ("nilfs2: B-tree node cache") Signed-off-by: Ryusuke Konishi Reported-by: syzbot+89cc4f2324ed37988b60@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=89cc4f2324ed37988b60 Cc: Signed-off-by: Andrew Morton fs/nilfs2/btnode.c | 25 ++++++++++++++++++++----- fs/nilfs2/btree.c | 4 ++-- 2 files changed, 22 insertions(+), 7 deletions(-) commit f556acc2facdd240de2c7416cd1da48a1dae70ec Author: Dev Jain Date: Thu Jul 18 10:55:04 2024 +0530 selftests/mm: skip test for non-LPA2 and non-LVA systems Post my improvement of the test in e4a4ba415419 ("selftests/mm: va_high_addr_switch: dynamically initialize testcases to enable LPA2 testing"): The test begins to fail on 4k and 16k pages, on non-LPA2 systems. To reduce noise in the CI systems, let us skip the test when higher address space is not implemented. Link: https://lkml.kernel.org/r/20240718052504.356517-1-dev.jain@arm.com Fixes: e4a4ba415419 ("selftests/mm: va_high_addr_switch: dynamically initialize testcases to enable LPA2 testing") Signed-off-by: Dev Jain Reviewed-by: Ryan Roberts Cc: Anshuman Khandual Cc: Mark Brown Signed-off-by: Andrew Morton tools/testing/selftests/mm/va_high_addr_switch.c | 16 +++++++++++++++- 1 file changed, 15 insertions(+), 1 deletion(-) commit 66eca1021a42856d6af2a9802c99e160278aed91 Author: Li Zhijian Date: Tue Jul 23 14:44:28 2024 +0800 mm/page_alloc: fix pcp->count race between drain_pages_zone() vs __rmqueue_pcplist() It's expected that no page should be left in pcp_list after calling zone_pcp_disable() in offline_pages(). Previously, it's observed that offline_pages() gets stuck [1] due to some pages remaining in pcp_list. Cause: There is a race condition between drain_pages_zone() and __rmqueue_pcplist() involving the pcp->count variable. See below scenario: CPU0 CPU1 ---------------- --------------- spin_lock(&pcp->lock); __rmqueue_pcplist() { zone_pcp_disable() { /* list is empty */ if (list_empty(list)) { /* add pages to pcp_list */ alloced = rmqueue_bulk() mutex_lock(&pcp_batch_high_lock) ... __drain_all_pages() { drain_pages_zone() { /* read pcp->count, it's 0 here */ count = READ_ONCE(pcp->count) /* 0 means nothing to drain */ /* update pcp->count */ pcp->count += alloced << order; ... ... spin_unlock(&pcp->lock); In this case, after calling zone_pcp_disable() though, there are still some pages in pcp_list. And these pages in pcp_list are neither movable nor isolated, offline_pages() gets stuck as a result. Solution: Expand the scope of the pcp->lock to also protect pcp->count in drain_pages_zone(), to ensure no pages are left in the pcp list after zone_pcp_disable() [1] https://lore.kernel.org/linux-mm/6a07125f-e720-404c-b2f9-e55f3f166e85@fujitsu.com/ Link: https://lkml.kernel.org/r/20240723064428.1179519-1-lizhijian@fujitsu.com Fixes: 4b23a68f9536 ("mm/page_alloc: protect PCP lists with a spinlock") Signed-off-by: Li Zhijian Reported-by: Yao Xingtao Reviewed-by: Vlastimil Babka Cc: David Hildenbrand Cc: Signed-off-by: Andrew Morton mm/page_alloc.c | 18 +++++++++++------- 1 file changed, 11 insertions(+), 7 deletions(-) commit f59adcf5933271ab7247c4c8938c67be8905b725 Author: Roman Gushchin Date: Tue Jul 23 17:12:44 2024 +0000 mm: memcg: add cacheline padding after lruvec in mem_cgroup_per_node Oliver Sand reported a performance regression caused by commit 98c9daf5ae6b ("mm: memcg: guard memcg1-specific members of struct mem_cgroup_per_node"), which puts some fields of the mem_cgroup_per_node structure under the CONFIG_MEMCG_V1 config option. Apparently it causes a false cache sharing between lruvec and lru_zone_size members of the structure. Fix it by adding an explicit padding after the lruvec member. Even though the padding is not required with CONFIG_MEMCG_V1 set, it seems like the introduced memory overhead is not significant enough to warrant another divergence in the mem_cgroup_per_node layout, so the padding is added unconditionally. Link: https://lkml.kernel.org/r/20240723171244.747521-1-roman.gushchin@linux.dev Fixes: 98c9daf5ae6b ("mm: memcg: guard memcg1-specific members of struct mem_cgroup_per_node") Signed-off-by: Roman Gushchin Reported-by: kernel test robot Closes: https://lore.kernel.org/oe-lkp/202407121335.31a10cb6-oliver.sang@intel.com Tested-by: Oliver Sang Acked-by: Shakeel Butt Cc: Johannes Weiner Cc: Michal Hocko Cc: Muchun Song Cc: Roman Gushchin Signed-off-by: Andrew Morton include/linux/memcontrol.h | 1 + 1 file changed, 1 insertion(+) commit b3bebe44306e23827397d0d774d206e3fa374041 Author: Suren Baghdasaryan Date: Wed Jul 17 14:28:44 2024 -0700 alloc_tag: outline and export free_reserved_page() Outline and export free_reserved_page() because modules use it and it in turn uses page_ext_{get|put} which should not be exported. The same result could be obtained by outlining {get|put}_page_tag_ref() but that would have higher performance impact as these functions are used in more performance critical paths. Link: https://lkml.kernel.org/r/20240717212844.2749975-1-surenb@google.com Fixes: dcfe378c81f7 ("lib: introduce support for page allocation tagging") Signed-off-by: Suren Baghdasaryan Reported-by: kernel test robot Closes: https://lore.kernel.org/oe-kbuild-all/202407080044.DWMC9N9I-lkp@intel.com/ Suggested-by: Christoph Hellwig Suggested-by: Vlastimil Babka Acked-by: Vlastimil Babka Cc: Kees Cook Cc: Kent Overstreet Cc: Pasha Tatashin Cc: Sourav Panda Cc: [6.10] Signed-off-by: Andrew Morton include/linux/mm.h | 16 +--------------- mm/page_alloc.c | 17 +++++++++++++++++ 2 files changed, 18 insertions(+), 15 deletions(-) commit bf6acd5d16057d7accbbb1bf7dc6d8c56eeb4ecc Author: Ross Lagerwall Date: Wed Jul 17 17:20:16 2024 +0100 decompress_bunzip2: fix rare decompression failure The decompression code parses a huffman tree and counts the number of symbols for a given bit length. In rare cases, there may be >= 256 symbols with a given bit length, causing the unsigned char to overflow. This causes a decompression failure later when the code tries and fails to find the bit length for a given symbol. Since the maximum number of symbols is 258, use unsigned short instead. Link: https://lkml.kernel.org/r/20240717162016.1514077-1-ross.lagerwall@citrix.com Fixes: bc22c17e12c1 ("bzip2/lzma: library support for gzip, bzip2 and lzma decompression") Signed-off-by: Ross Lagerwall Cc: Alain Knaff Cc: "H. Peter Anvin" Cc: Signed-off-by: Andrew Morton lib/decompress_bunzip2.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) commit d659b715e94ac039803d7601505d3473393fc0be Author: Gavin Shan Date: Mon Jul 15 10:04:23 2024 +1000 mm/huge_memory: avoid PMD-size page cache if needed xarray can't support arbitrary page cache size. the largest and supported page cache size is defined as MAX_PAGECACHE_ORDER by commit 099d90642a71 ("mm/filemap: make MAX_PAGECACHE_ORDER acceptable to xarray"). However, it's possible to have 512MB page cache in the huge memory's collapsing path on ARM64 system whose base page size is 64KB. 512MB page cache is breaking the limitation and a warning is raised when the xarray entry is split as shown in the following example. [root@dhcp-10-26-1-207 ~]# cat /proc/1/smaps | grep KernelPageSize KernelPageSize: 64 kB [root@dhcp-10-26-1-207 ~]# cat /tmp/test.c : int main(int argc, char **argv) { const char *filename = TEST_XFS_FILENAME; int fd = 0; void *buf = (void *)-1, *p; int pgsize = getpagesize(); int ret = 0; if (pgsize != 0x10000) { fprintf(stdout, "System with 64KB base page size is required!\n"); return -EPERM; } system("echo 0 > /sys/devices/virtual/bdi/253:0/read_ahead_kb"); system("echo 1 > /proc/sys/vm/drop_caches"); /* Open the xfs file */ fd = open(filename, O_RDONLY); assert(fd > 0); /* Create VMA */ buf = mmap(NULL, TEST_MEM_SIZE, PROT_READ, MAP_SHARED, fd, 0); assert(buf != (void *)-1); fprintf(stdout, "mapped buffer at 0x%p\n", buf); /* Populate VMA */ ret = madvise(buf, TEST_MEM_SIZE, MADV_NOHUGEPAGE); assert(ret == 0); ret = madvise(buf, TEST_MEM_SIZE, MADV_POPULATE_READ); assert(ret == 0); /* Collapse VMA */ ret = madvise(buf, TEST_MEM_SIZE, MADV_HUGEPAGE); assert(ret == 0); ret = madvise(buf, TEST_MEM_SIZE, MADV_COLLAPSE); if (ret) { fprintf(stdout, "Error %d to madvise(MADV_COLLAPSE)\n", errno); goto out; } /* Split xarray entry. Write permission is needed */ munmap(buf, TEST_MEM_SIZE); buf = (void *)-1; close(fd); fd = open(filename, O_RDWR); assert(fd > 0); fallocate(fd, FALLOC_FL_KEEP_SIZE | FALLOC_FL_PUNCH_HOLE, TEST_MEM_SIZE - pgsize, pgsize); out: if (buf != (void *)-1) munmap(buf, TEST_MEM_SIZE); if (fd > 0) close(fd); return ret; } [root@dhcp-10-26-1-207 ~]# gcc /tmp/test.c -o /tmp/test [root@dhcp-10-26-1-207 ~]# /tmp/test ------------[ cut here ]------------ WARNING: CPU: 25 PID: 7560 at lib/xarray.c:1025 xas_split_alloc+0xf8/0x128 Modules linked in: nft_fib_inet nft_fib_ipv4 nft_fib_ipv6 nft_fib \ nft_reject_inet nf_reject_ipv4 nf_reject_ipv6 nft_reject nft_ct \ nft_chain_nat nf_nat nf_conntrack nf_defrag_ipv6 nf_defrag_ipv4 \ ip_set rfkill nf_tables nfnetlink vfat fat virtio_balloon drm fuse \ xfs libcrc32c crct10dif_ce ghash_ce sha2_ce sha256_arm64 virtio_net \ sha1_ce net_failover virtio_blk virtio_console failover dimlib virtio_mmio CPU: 25 PID: 7560 Comm: test Kdump: loaded Not tainted 6.10.0-rc7-gavin+ #9 Hardware name: QEMU KVM Virtual Machine, BIOS edk2-20240524-1.el9 05/24/2024 pstate: 83400005 (Nzcv daif +PAN -UAO +TCO +DIT -SSBS BTYPE=--) pc : xas_split_alloc+0xf8/0x128 lr : split_huge_page_to_list_to_order+0x1c4/0x780 sp : ffff8000ac32f660 x29: ffff8000ac32f660 x28: ffff0000e0969eb0 x27: ffff8000ac32f6c0 x26: 0000000000000c40 x25: ffff0000e0969eb0 x24: 000000000000000d x23: ffff8000ac32f6c0 x22: ffffffdfc0700000 x21: 0000000000000000 x20: 0000000000000000 x19: ffffffdfc0700000 x18: 0000000000000000 x17: 0000000000000000 x16: ffffd5f3708ffc70 x15: 0000000000000000 x14: 0000000000000000 x13: 0000000000000000 x12: 0000000000000000 x11: ffffffffffffffc0 x10: 0000000000000040 x9 : ffffd5f3708e692c x8 : 0000000000000003 x7 : 0000000000000000 x6 : ffff0000e0969eb8 x5 : ffffd5f37289e378 x4 : 0000000000000000 x3 : 0000000000000c40 x2 : 000000000000000d x1 : 000000000000000c x0 : 0000000000000000 Call trace: xas_split_alloc+0xf8/0x128 split_huge_page_to_list_to_order+0x1c4/0x780 truncate_inode_partial_folio+0xdc/0x160 truncate_inode_pages_range+0x1b4/0x4a8 truncate_pagecache_range+0x84/0xa0 xfs_flush_unmap_range+0x70/0x90 [xfs] xfs_file_fallocate+0xfc/0x4d8 [xfs] vfs_fallocate+0x124/0x2f0 ksys_fallocate+0x4c/0xa0 __arm64_sys_fallocate+0x24/0x38 invoke_syscall.constprop.0+0x7c/0xd8 do_el0_svc+0xb4/0xd0 el0_svc+0x44/0x1d8 el0t_64_sync_handler+0x134/0x150 el0t_64_sync+0x17c/0x180 Fix it by correcting the supported page cache orders, different sets for DAX and other files. With it corrected, 512MB page cache becomes disallowed on all non-DAX files on ARM64 system where the base page size is 64KB. After this patch is applied, the test program fails with error -EINVAL returned from __thp_vma_allowable_orders() and the madvise() system call to collapse the page caches. Link: https://lkml.kernel.org/r/20240715000423.316491-1-gshan@redhat.com Fixes: 6b24ca4a1a8d ("mm: Use multi-index entries in the page cache") Signed-off-by: Gavin Shan Acked-by: David Hildenbrand Reviewed-by: Ryan Roberts Acked-by: Zi Yan Cc: Baolin Wang Cc: Barry Song Cc: Don Dutile Cc: Matthew Wilcox (Oracle) Cc: Peter Xu Cc: Ryan Roberts Cc: William Kucharski Cc: [5.17+] Signed-off-by: Andrew Morton include/linux/huge_mm.h | 12 +++++++++--- mm/huge_memory.c | 12 ++++++++++-- 2 files changed, 19 insertions(+), 5 deletions(-) commit d9592025000b3cf26c742f3505da7b83aedc26d5 Author: Yang Shi Date: Fri Jul 12 08:58:55 2024 -0700 mm: huge_memory: use !CONFIG_64BIT to relax huge page alignment on 32 bit machines Yves-Alexis Perez reported commit 4ef9ad19e176 ("mm: huge_memory: don't force huge page alignment on 32 bit") didn't work for x86_32 [1]. It is because x86_32 uses CONFIG_X86_32 instead of CONFIG_32BIT. !CONFIG_64BIT should cover all 32 bit machines. [1] https://lore.kernel.org/linux-mm/CAHbLzkr1LwH3pcTgM+aGQ31ip2bKqiqEQ8=FQB+t2c3dhNKNHA@mail.gmail.com/ Link: https://lkml.kernel.org/r/20240712155855.1130330-1-yang@os.amperecomputing.com Fixes: 4ef9ad19e176 ("mm: huge_memory: don't force huge page alignment on 32 bit") Signed-off-by: Yang Shi Reported-by: Yves-Alexis Perez Tested-by: Yves-Alexis Perez Acked-by: David Hildenbrand Cc: Ben Hutchings Cc: Christoph Lameter Cc: Jiri Slaby Cc: Matthew Wilcox (Oracle) Cc: Rik van Riel Cc: Salvatore Bonaccorso Cc: Suren Baghdasaryan Cc: [6.8+] Signed-off-by: Andrew Morton mm/huge_memory.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 4cd7ba16a0afb36550eed7690e73d3e7a743fa96 Author: Ram Tummala Date: Tue Jul 9 18:45:39 2024 -0700 mm: fix old/young bit handling in the faulting path Commit 3bd786f76de2 ("mm: convert do_set_pte() to set_pte_range()") replaced do_set_pte() with set_pte_range() and that introduced a regression in the following faulting path of non-anonymous vmas which caused the PTE for the faulting address to be marked as old instead of young. handle_pte_fault() do_pte_missing() do_fault() do_read_fault() || do_cow_fault() || do_shared_fault() finish_fault() set_pte_range() The polarity of prefault calculation is incorrect. This leads to prefault being incorrectly set for the faulting address. The following check will incorrectly mark the PTE old rather than young. On some architectures this will cause a double fault to mark it young when the access is retried. if (prefault && arch_wants_old_prefaulted_pte()) entry = pte_mkold(entry); On a subsequent fault on the same address, the faulting path will see a non NULL vmf->pte and instead of reaching the do_pte_missing() path, PTE will then be correctly marked young in handle_pte_fault() itself. Due to this bug, performance degradation in the fault handling path will be observed due to unnecessary double faulting. Link: https://lkml.kernel.org/r/20240710014539.746200-1-rtummala@nvidia.com Fixes: 3bd786f76de2 ("mm: convert do_set_pte() to set_pte_range()") Signed-off-by: Ram Tummala Reviewed-by: Yin Fengwei Cc: Alistair Popple Cc: Matthew Wilcox (Oracle) Cc: Yin Fengwei Cc: Signed-off-by: Andrew Morton mm/memory.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 34e526f6182e12b71f6076d43760dc6e0ae175a3 Author: James Clark Date: Tue Jul 9 11:25:11 2024 +0100 dt-bindings: arm: update James Clark's email address My new address is james.clark@linaro.org Link: https://lkml.kernel.org/r/20240709102512.31212-3-james.clark@linaro.org Signed-off-by: James Clark Cc: Bjorn Andersson Cc: Conor Dooley Cc: David S. Miller Cc: Geliang Tang Cc: Hao Zhang Cc: Jakub Kicinski Cc: Jiri Kosina Cc: Kees Cook Cc: Krzysztof Kozlowski Cc: Mao Jinlong Cc: Matthieu Baerts Cc: Matt Ranostay Cc: Mike Leach Cc: Oleksij Rempel Cc: Rob Herring (Arm) Cc: Suzuki K Poulose Signed-off-by: Andrew Morton Documentation/devicetree/bindings/arm/arm,coresight-dummy-sink.yaml | 2 +- Documentation/devicetree/bindings/arm/arm,coresight-dummy-source.yaml | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) commit 5bf6f3c595d38e3e92130373ae4c0799da5026ee Author: James Clark Date: Tue Jul 9 11:25:10 2024 +0100 MAINTAINERS: mailmap: update James Clark's email address My new address is james.clark@linaro.org Link: https://lkml.kernel.org/r/20240709102512.31212-2-james.clark@linaro.org Signed-off-by: James Clark Cc: Bjorn Andersson Cc: Conor Dooley Cc: David S. Miller Cc: Geliang Tang Cc: Hao Zhang Cc: Jakub Kicinski Cc: Jiri Kosina Cc: Kees Cook Cc: Krzysztof Kozlowski Cc: Mao Jinlong Cc: Matthieu Baerts Cc: Matt Ranostay Cc: Mike Leach Cc: Oleksij Rempel Cc: Rob Herring (Arm) Cc: Suzuki K Poulose Signed-off-by: Andrew Morton .mailmap | 1 + MAINTAINERS | 4 ++-- 2 files changed, 3 insertions(+), 2 deletions(-) commit 81a91abab1307d7725fa4620952c0767beae7753 Author: Huacai Chen Date: Tue Jul 23 14:45:08 2024 +0800 irqchip/loongarch-cpu: Fix return value of lpic_gsi_to_irq() lpic_gsi_to_irq() should return a valid Linux interrupt number if acpi_register_gsi() succeeds, and return 0 otherwise. But lpic_gsi_to_irq() converts a negative return value of acpi_register_gsi() to a positive value silently. Convert the return value explicitly. Fixes: e8bba72b396c ("irqchip / ACPI: Introduce ACPI_IRQ_MODEL_LPIC for LoongArch") Reported-by: Miao Wang Signed-off-by: Huacai Chen Signed-off-by: Thomas Gleixner Reviewed-by: Jiaxun Yang Cc: Link: https://lore.kernel.org/r/20240723064508.35560-1-chenhuacai@loongson.cn drivers/irqchip/irq-loongarch-cpu.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) commit 6dc55268f64b780eb8774de3705f791b689853bb Author: Rob Herring (Arm) Date: Tue Jul 23 18:09:03 2024 -0500 dt-bindings: iio: adc: ad7192: Fix 'single-channel' constraints The 'single-channel' property is an uint32, not an array, so 'items' is an incorrect constraint. This didn't matter until dtschema recently changed how properties are decoded. This results in this warning: Documentation/devicetree/bindings/iio/adc/adi,ad7192.example.dtb: adc@0: \ channel@1:single-channel: 1 is not of type 'array' Fixes: caf7b7632b8d ("dt-bindings: iio: adc: ad7192: Add AD7194 support") Reviewed-by: Conor Dooley Link: https://lore.kernel.org/r/20240723230904.1299744-1-robh@kernel.org Signed-off-by: Rob Herring (Arm) Documentation/devicetree/bindings/iio/adc/adi,ad7192.yaml | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-) commit 66a644c09fbed0a19f3708895c1180df78181019 Author: Paolo Bonzini Date: Fri Jul 26 13:45:36 2024 -0400 KVM: guest_memfd: abstract how prepared folios are recorded Right now, large folios are not supported in guest_memfd, and therefore the order used by kvm_gmem_populate() is always 0. In this scenario, using the up-to-date bit to track prepared-ness is nice and easy because we have one bit available per page. In the future, however, we might have large pages that are partially populated; for example, in the case of SEV-SNP, if a large page has both shared and private areas inside, it is necessary to populate it at a granularity that is smaller than that of the guest_memfd's backing store. In that case we will have to track preparedness at a 4K level, probably as a bitmap. In preparation for that, do not use explicitly folio_test_uptodate() and folio_mark_uptodate(). Return the state of the page directly from __kvm_gmem_get_pfn(), so that it is expected to apply to 2^N pages with N=*max_order. The function to mark a range as prepared for now takes just a folio, but is expected to take also an index and order (or something like that) when large pages are introduced. Thanks to Michael Roth for pointing out the issue with large pages. Signed-off-by: Paolo Bonzini virt/kvm/guest_memfd.c | 33 ++++++++++++++++++++------------- 1 file changed, 20 insertions(+), 13 deletions(-) commit e4ee5447927377c55777b73fe497a2455a25f948 Author: Paolo Bonzini Date: Thu Jul 11 18:27:55 2024 -0400 KVM: guest_memfd: let kvm_gmem_populate() operate only on private gfns This check is currently performed by sev_gmem_post_populate(), but it applies to all callers of kvm_gmem_populate(): the point of the function is that the memory is being encrypted and some work has to be done on all the gfns in order to encrypt them. Therefore, check the KVM_MEMORY_ATTRIBUTE_PRIVATE attribute prior to invoking the callback, and stop the operation if a shared page is encountered. Because CONFIG_KVM_PRIVATE_MEM in principle does not require attributes, this makes kvm_gmem_populate() depend on CONFIG_KVM_GENERIC_PRIVATE_MEM (which does require them). Reviewed-by: Michael Roth Signed-off-by: Paolo Bonzini arch/x86/kvm/svm/sev.c | 7 ------- include/linux/kvm_host.h | 2 ++ virt/kvm/guest_memfd.c | 12 ++++++++++++ 3 files changed, 14 insertions(+), 7 deletions(-) commit 4b5f67120a88c713b82907d55a767693382e9e9d Author: Paolo Bonzini Date: Thu Jul 11 18:27:54 2024 -0400 KVM: extend kvm_range_has_memory_attributes() to check subset of attributes While currently there is no other attribute than KVM_MEMORY_ATTRIBUTE_PRIVATE, KVM code such as kvm_mem_is_private() is written to expect their existence. Allow using kvm_range_has_memory_attributes() as a multi-page version of kvm_mem_is_private(), without it breaking later when more attributes are introduced. Reviewed-by: Michael Roth Signed-off-by: Paolo Bonzini arch/x86/kvm/mmu/mmu.c | 2 +- include/linux/kvm_host.h | 2 +- virt/kvm/kvm_main.c | 13 +++++++------ 3 files changed, 9 insertions(+), 8 deletions(-) commit e300614f10bd2f33252c8ba40b34d6c3fbf95d72 Author: Paolo Bonzini Date: Thu Jul 11 18:27:53 2024 -0400 KVM: cleanup and add shortcuts to kvm_range_has_memory_attributes() Use a guard to simplify early returns, and add two more easy shortcuts. If the requested attributes are invalid, the attributes xarray will never show them as set. And if testing a single page, kvm_get_memory_attributes() is more efficient. Reviewed-by: Michael Roth Signed-off-by: Paolo Bonzini virt/kvm/kvm_main.c | 42 ++++++++++++++++++++---------------------- 1 file changed, 20 insertions(+), 22 deletions(-) commit de80252414f32db31eaa14baef511e9bd96021cd Author: Paolo Bonzini Date: Thu Jul 11 18:27:52 2024 -0400 KVM: guest_memfd: move check for already-populated page to common code Do not allow populating the same page twice with startup data. In the case of SEV-SNP, for example, the firmware does not allow it anyway, since the launch-update operation is only possible on pages that are still shared in the RMP. Even if it worked, kvm_gmem_populate()'s callback is meant to have side effects such as updating launch measurements, and updating the same page twice is unlikely to have the desired results. Races between calls to the ioctl are not possible because kvm_gmem_populate() holds slots_lock and the VM should not be running. But again, even if this worked on other confidential computing technology, it doesn't matter to guest_memfd.c whether this is something fishy such as missing synchronization in userspace, or rather something intentional. One of the racers wins, and the page is initialized by either kvm_gmem_prepare_folio() or kvm_gmem_populate(). Anyway, out of paranoia, adjust sev_gmem_post_populate() anyway to use the same errno that kvm_gmem_populate() is using. Reviewed-by: Michael Roth Signed-off-by: Paolo Bonzini arch/x86/kvm/svm/sev.c | 2 +- virt/kvm/guest_memfd.c | 7 +++++++ 2 files changed, 8 insertions(+), 1 deletion(-) commit 7239ed74677af143857d1a96d402476446a0995a Author: Paolo Bonzini Date: Thu Jul 11 18:27:51 2024 -0400 KVM: remove kvm_arch_gmem_prepare_needed() It is enough to return 0 if a guest need not do any preparation. This is in fact how sev_gmem_prepare() works for non-SNP guests, and it extends naturally to Intel hosts: the x86 callback for gmem_prepare is optional and returns 0 if not defined. Reviewed-by: Michael Roth Signed-off-by: Paolo Bonzini arch/x86/kvm/x86.c | 5 ----- include/linux/kvm_host.h | 1 - virt/kvm/guest_memfd.c | 13 +++---------- 3 files changed, 3 insertions(+), 16 deletions(-) commit 6dd761d92f6600342860c618639489bb9c3843ea Author: Paolo Bonzini Date: Thu Jul 11 18:27:50 2024 -0400 KVM: guest_memfd: make kvm_gmem_prepare_folio() operate on a single struct kvm This is now possible because preparation is done by kvm_gmem_get_pfn() instead of fallocate(). In practice this is not a limitation, because even though guest_memfd can be bound to multiple struct kvm, for hardware implementations of confidential computing only one guest (identified by an ASID on SEV-SNP, or an HKID on TDX) will be able to access it. In the case of intra-host migration (not implemented yet for SEV-SNP, but we can use SEV-ES as an idea of how it will work), the new struct kvm inherits the same ASID and preparation need not be repeated. Reviewed-by: Michael Roth Signed-off-by: Paolo Bonzini virt/kvm/guest_memfd.c | 49 +++++++++++++++++++------------------------------ 1 file changed, 19 insertions(+), 30 deletions(-) commit b85524314a3db687a87b190fd878aa1206b94b52 Author: Paolo Bonzini Date: Thu Jul 11 18:27:49 2024 -0400 KVM: guest_memfd: delay kvm_gmem_prepare_folio() until the memory is passed to the guest Initializing the contents of the folio on fallocate() is unnecessarily restrictive. It means that the page is registered with the firmware and then it cannot be touched anymore. In particular, this loses the possibility of using fallocate() to pre-allocate the page for SEV-SNP guests, because kvm_arch_gmem_prepare() then fails. It's only when the guest actually accesses the page (and therefore kvm_gmem_get_pfn() is called) that the page must be cleared from any stale host data and registered with the firmware. The up-to-date flag is clear if this has to be done (i.e. it is the first access and kvm_gmem_populate() has not been called). All in all, there are enough differences between kvm_gmem_get_pfn() and kvm_gmem_populate(), that it's better to separate the two flows completely. Extract the bulk of kvm_gmem_get_folio(), which take a folio and end up setting its up-to-date flag, to a new function kvm_gmem_prepare_folio(); these are now done only by the non-__-prefixed kvm_gmem_get_pfn(). As a bonus, __kvm_gmem_get_pfn() loses its ugly "bool prepare" argument. One difference is that fallocate(PUNCH_HOLE) can now race with a page fault. Potentially this causes a page to be prepared and into the filemap even after fallocate(PUNCH_HOLE). This is harmless, as it can be fixed by another hole punching operation, and can be avoided by clearing the private-page attribute prior to invoking fallocate(PUNCH_HOLE). This way, the page fault will cause an exit to user space. The previous semantics, where fallocate() could be used to prepare the pages in advance of running the guest, can be accessed with KVM_PRE_FAULT_MEMORY. For now, accessing a page in one VM will attempt to call kvm_arch_gmem_prepare() in all of those that have bound the guest_memfd. Cleaning this up is left to a separate patch. Suggested-by: Sean Christopherson Signed-off-by: Paolo Bonzini virt/kvm/guest_memfd.c | 110 +++++++++++++++++++++++++++++-------------------- 1 file changed, 66 insertions(+), 44 deletions(-) commit 78c4293372fe1fe6060727dfbd5643552e3ff86d Author: Paolo Bonzini Date: Thu Jul 11 18:27:48 2024 -0400 KVM: guest_memfd: return locked folio from __kvm_gmem_get_pfn Allow testing the up-to-date flag in the caller without taking the lock again. Reviewed-by: Michael Roth Signed-off-by: Paolo Bonzini virt/kvm/guest_memfd.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) commit 564429a6bd8d26065b2cccffcaa9485359f74de7 Author: Paolo Bonzini Date: Thu Jul 11 18:27:47 2024 -0400 KVM: rename CONFIG_HAVE_KVM_GMEM_* to CONFIG_HAVE_KVM_ARCH_GMEM_* Add "ARCH" to the symbols; shortly, the "prepare" phase will include both the arch-independent step to clear out contents left in the page by the host, and the arch-dependent step enabled by CONFIG_HAVE_KVM_GMEM_PREPARE. For consistency do the same for CONFIG_HAVE_KVM_GMEM_INVALIDATE as well. Reviewed-by: Michael Roth Signed-off-by: Paolo Bonzini arch/x86/kvm/Kconfig | 4 ++-- arch/x86/kvm/x86.c | 4 ++-- include/linux/kvm_host.h | 4 ++-- virt/kvm/Kconfig | 4 ++-- virt/kvm/guest_memfd.c | 6 +++--- 5 files changed, 11 insertions(+), 11 deletions(-) commit 7fbdda31b0a14ff45809fb27182b98dcbcbad5b0 Author: Paolo Bonzini Date: Thu Jul 11 18:27:46 2024 -0400 KVM: guest_memfd: do not go through struct page We have a perfectly usable folio, use it to retrieve the pfn and order. All that's needed is a version of folio_file_page that returns a pfn. Reviewed-by: Michael Roth Signed-off-by: Paolo Bonzini virt/kvm/guest_memfd.c | 27 +++++++++++++++++---------- 1 file changed, 17 insertions(+), 10 deletions(-) commit d04c77d231223563405e8874fa7edfdc65e545fe Author: Paolo Bonzini Date: Thu Jul 11 18:27:45 2024 -0400 KVM: guest_memfd: delay folio_mark_uptodate() until after successful preparation The up-to-date flag as is now is not too useful; it tells guest_memfd not to overwrite the contents of a folio, but it doesn't say that the page is ready to be mapped into the guest. For encrypted guests, mapping a private page requires that the "preparation" phase has succeeded, and at the same time the same page cannot be prepared twice. So, ensure that folio_mark_uptodate() is only called on a prepared page. If kvm_gmem_prepare_folio() or the post_populate callback fail, the folio will not be marked up-to-date; it's not a problem to call clear_highpage() again on such a page prior to the next preparation attempt. Reviewed-by: Michael Roth Signed-off-by: Paolo Bonzini virt/kvm/guest_memfd.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) commit d0d87226f535965b4dafc6ef79246456503a4503 Author: Paolo Bonzini Date: Thu Jul 11 18:27:44 2024 -0400 KVM: guest_memfd: return folio from __kvm_gmem_get_pfn() Right now this is simply more consistent and avoids use of pfn_to_page() and put_page(). It will be put to more use in upcoming patches, to ensure that the up-to-date flag is set at the very end of both the kvm_gmem_get_pfn() and kvm_gmem_populate() flows. Reviewed-by: Michael Roth Signed-off-by: Paolo Bonzini virt/kvm/guest_memfd.c | 37 ++++++++++++++++++++----------------- 1 file changed, 20 insertions(+), 17 deletions(-) commit 5932ca411e533e7ad2b97c47b4357a05fa06c2a5 Author: Paolo Bonzini Date: Wed Jul 17 13:04:48 2024 -0400 KVM: x86: disallow pre-fault for SNP VMs before initialization KVM_PRE_FAULT_MEMORY for an SNP guest can race with sev_gmem_post_populate() in bad ways. The following sequence for instance can potentially trigger an RMP fault: thread A, sev_gmem_post_populate: called thread B, sev_gmem_prepare: places below 'pfn' in a private state in RMP thread A, sev_gmem_post_populate: *vaddr = kmap_local_pfn(pfn + i); thread A, sev_gmem_post_populate: copy_from_user(vaddr, src + i * PAGE_SIZE, PAGE_SIZE); RMP #PF Fix this by only allowing KVM_PRE_FAULT_MEMORY to run after a guest's initial private memory contents have been finalized via KVM_SEV_SNP_LAUNCH_FINISH. Beyond fixing this issue, it just sort of makes sense to enforce this, since the KVM_PRE_FAULT_MEMORY documentation states: "KVM maps memory as if the vCPU generated a stage-2 read page fault" which sort of implies we should be acting on the same guest state that a vCPU would see post-launch after the initial guest memory is all set up. Co-developed-by: Michael Roth Signed-off-by: Michael Roth Signed-off-by: Paolo Bonzini Documentation/virt/kvm/api.rst | 6 ++++++ arch/x86/include/asm/kvm_host.h | 1 + arch/x86/kvm/mmu/mmu.c | 3 +++ arch/x86/kvm/svm/sev.c | 8 ++++++++ arch/x86/kvm/svm/svm.c | 1 + arch/x86/kvm/x86.c | 3 +++ 6 files changed, 22 insertions(+) commit 866d2d36b81d7d0e6d91423b6dd9b1bcfd0510dd Author: Len Brown Date: Fri Jul 26 14:16:28 2024 -0400 tools/power turbostat: version 2024.07.26 Release 2024.07.26: Enable turbostat extensions to add both perf and PMT (Intel Platform Monitoring Technology) counters from the cmdline. Demonstrate PMT access with built-in support for Meteor Lake's Die%c6 counter. This commit: Clean up white-space nits introduced since version 2024.05.10 Signed-off-by: Len Brown tools/power/x86/turbostat/turbostat.c | 105 +++++++++++++++++----------------- 1 file changed, 52 insertions(+), 53 deletions(-) commit 19d076903b95896ce55c7cc3679f795731591ac6 Author: Patryk Wlazlyn Date: Wed Jul 24 13:17:30 2024 +0200 tools/power turbostat: Include umask=%x in perf counter's config Some counters, like cpu/cache-misses/, expose and require umask=%x parameter alongside event=%x in the sysfs perf counter's event file. This change make sure we parse and use it when opening user added counters. Signed-off-by: Patryk Wlazlyn Signed-off-by: Len Brown tools/power/x86/turbostat/turbostat.c | 60 +++++++++++++++++++++++++++++------ 1 file changed, 50 insertions(+), 10 deletions(-) commit 944264a2a99cc4dd4b10eaa9798b6aab80adf4be Author: Patryk Wlazlyn Date: Tue Jul 23 20:12:32 2024 +0200 tools/power turbostat: Document PMT in turbostat.8 Add a general description of the user interface for adding PMT counters with the new --add pmt,... option. Provide a complete example for requesting two counters. Signed-off-by: Patryk Wlazlyn Signed-off-by: Len Brown tools/power/x86/turbostat/turbostat.8 | 65 +++++++++++++++++++++++++++++++++++ 1 file changed, 65 insertions(+) commit 640540beb88363a825524295664acfdb0f5d5fc2 Author: Patryk Wlazlyn Date: Mon Jul 22 22:12:22 2024 +0200 tools/power turbostat: Add MTL's PMT DC6 builtin counter Provide a definition for metadata that allows reading DC6 residency counter via PMT and exposes it as a builtin counter. Note that this residency counter is updated and read via entirely different mechanisms vs the MSR-based residency counters. On MTL processors, there are times when Die%c6 will report above 100%. This is still useful, but don't expect 3 digits of precision... Signed-off-by: Patryk Wlazlyn Signed-off-by: Len Brown tools/power/x86/turbostat/turbostat.c | 70 ++++++++++++++++++++++++++++++++++- 1 file changed, 69 insertions(+), 1 deletion(-) commit f0e4ed752fda6997b41917c94a5478b340178001 Author: Patryk Wlazlyn Date: Mon Jul 22 22:11:03 2024 +0200 tools/power turbostat: Add early support for PMT counters Allows users to read Intel PMT (Platform Monitoring Technology) counters, providing interface similar to one used to add MSR and perf counters. Because PMT is exposed as a raw MMIO range, without metadata, user has to supply the necessary information to find and correctly display the requested counter. Signed-off-by: Patryk Wlazlyn Signed-off-by: Len Brown tools/power/x86/turbostat/turbostat.c | 768 +++++++++++++++++++++++++++++++++- 1 file changed, 766 insertions(+), 2 deletions(-) commit d27087c76e3c859ea05b7581ef7ce8aa5a088dd8 Author: Leo Yan Date: Wed Jul 17 09:22:11 2024 +0100 perf docs: Document cross compilation Records the commands for cross compilation with two methods. The first method relies on Multiarch. The second approach is to explicitly specify the PKG_CONFIG variables, which is widely used in build system (like Buildroot, Yocto, etc). Co-developed-by: James Clark Signed-off-by: James Clark Signed-off-by: Leo Yan Tested-by: Ian Rogers Cc: amadio@gentoo.org Cc: Thomas Richter Link: https://lore.kernel.org/r/20240717082211.524826-7-leo.yan@arm.com Signed-off-by: Namhyung Kim tools/perf/Documentation/Build.txt | 28 ++++++++++++++++++++++++++++ 1 file changed, 28 insertions(+) commit f42596c73872b753ff1799bc7fc79b1100226da1 Author: Leo Yan Date: Wed Jul 17 09:22:10 2024 +0100 perf: build: Link lib 'zstd' for static build When build static perf, Makefile reports the error: Makefile.config:480: No libdw DWARF unwind found, Please install elfutils-devel/libdw-dev >= 0.158 and/or set LIBDW_DIR The libdw has been installed on the system, but the build system fails to build the feature detecting binary 'test-libdw-dwarf-unwind'. The failure is caused by missing to link the lib 'zstd'. Link lib 'zstd' for the static build, in the end, the dwarf feature can be enabled in the static perf. Signed-off-by: Leo Yan Tested-by: Ian Rogers Cc: amadio@gentoo.org Cc: James Clark Cc: Thomas Richter Link: https://lore.kernel.org/r/20240717082211.524826-6-leo.yan@arm.com Signed-off-by: Namhyung Kim tools/build/feature/Makefile | 2 +- tools/perf/Makefile.config | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) commit 91b6a536b40658c24d6f04747ddf852d30f7f259 Author: Leo Yan Date: Wed Jul 17 09:22:09 2024 +0100 perf: build: Link lib 'lzma' for static build The libunwind feature test failed with the static linkage. This is due to the 'lzma' lib is missed, so link it to dismiss building failure. Signed-off-by: Leo Yan Tested-by: Ian Rogers Cc: amadio@gentoo.org Cc: James Clark Cc: Thomas Richter Link: https://lore.kernel.org/r/20240717082211.524826-5-leo.yan@arm.com Signed-off-by: Namhyung Kim tools/build/feature/Makefile | 16 ++++++++-------- 1 file changed, 8 insertions(+), 8 deletions(-) commit 536661da6ea18fe6df5740bc9e9001d097b035ee Author: Leo Yan Date: Wed Jul 17 09:22:08 2024 +0100 perf: build: Only link libebl.a for old libdw Since libdw version 0.177, elfutils has merged libebl.a into libdw (see the commit "libebl: Don't install libebl.a, libebl.h and remove backends from spec." in the elfutils repository). As a result, libebl.a does not exist on Debian Bullseye and newer releases, causing static perf builds to fail on these distributions. This commit checks the libdw version and only links libebl.a if it detects that the libdw version is older than 0.177. Signed-off-by: Leo Yan Tested-by: Ian Rogers Cc: amadio@gentoo.org Cc: James Clark Cc: Thomas Richter Link: https://lore.kernel.org/r/20240717082211.524826-4-leo.yan@arm.com Signed-off-by: Namhyung Kim tools/build/feature/Makefile | 12 +++++++++++- tools/perf/Makefile.config | 12 +++++++++++- 2 files changed, 22 insertions(+), 2 deletions(-) commit cffe29d3b54aa0437bc35440ea64866bbfc418a3 Author: Leo Yan Date: Wed Jul 17 09:22:07 2024 +0100 perf: build: Set Python configuration for cross compilation Python configuration has dedicated folders for different architectures. For example, Python 3.11 has two folders as shown below, one for Arm64 and another for x86_64: /usr/lib/python3.11/config-3.11-aarch64-linux-gnu/ /usr/lib/python3.11/config-3.11-x86_64-linux-gnu/ This commit updates the Python configuration path based on the compiler's machine type, guiding the compiler to find the correct path for Python libraries. It also renames the generated .so file name to match the machine name. Signed-off-by: Leo Yan Tested-by: Ian Rogers Cc: amadio@gentoo.org Cc: James Clark Cc: Thomas Richter Link: https://lore.kernel.org/r/20240717082211.524826-3-leo.yan@arm.com Signed-off-by: Namhyung Kim tools/perf/Makefile.config | 8 ++++++++ 1 file changed, 8 insertions(+) commit 440cf77625e300e683ca0edc39fbc4b6f3175feb Author: Leo Yan Date: Wed Jul 17 09:22:06 2024 +0100 perf: build: Setup PKG_CONFIG_LIBDIR for cross compilation On recent Linux distros like Ubuntu Noble and Debian Bookworm, the 'pkg-config-aarch64-linux-gnu' package is missing. As a result, the aarch64-linux-gnu-pkg-config command is not available, which causes build failures. When a build passes the environment variables PKG_CONFIG_LIBDIR or PKG_CONFIG_PATH, like a user uses make command or a build system (like Yocto, Buildroot, etc) prepares the variables and passes to the Perf's Makefile, the commit keeps these variables for package configuration. Otherwise, this commit sets the PKG_CONFIG_LIBDIR variable to use the Multiarch libs for the cross compilation. Signed-off-by: Leo Yan Tested-by: Ian Rogers Cc: amadio@gentoo.org Cc: Thomas Richter Link: https://lore.kernel.org/r/20240717082211.524826-2-leo.yan@arm.com Signed-off-by: Namhyung Kim tools/build/feature/Makefile | 25 ++++++++++++++++++++++++- tools/perf/Makefile.perf | 27 ++++++++++++++++++++++++++- 2 files changed, 50 insertions(+), 2 deletions(-) commit 4c17736689ccfc44ec7dcc472577f25c34cf8724 Author: Casey Chen Date: Mon Jul 22 15:15:48 2024 -0600 perf tool: fix dereferencing NULL al->maps With 0dd5041c9a0e ("perf addr_location: Add init/exit/copy functions"), when cpumode is 3 (macro PERF_RECORD_MISC_HYPERVISOR), thread__find_map() could return with al->maps being NULL. The path below could add a callchain_cursor_node with NULL ms.maps. add_callchain_ip() thread__find_symbol(.., &al) thread__find_map(.., &al) // al->maps becomes NULL ms.maps = maps__get(al.maps) callchain_cursor_append(..., &ms, ...) node->ms.maps = maps__get(ms->maps) Then the path below would dereference NULL maps and get segfault. fill_callchain_info() maps__machine(node->ms.maps); Fix it by checking if maps is NULL in fill_callchain_info(). Fixes: 0dd5041c9a0e ("perf addr_location: Add init/exit/copy functions") Signed-off-by: Casey Chen Reviewed-by: Ian Rogers Reviewed-by: Arnaldo Carvalho de Melo Acked-by: Namhyung Kim Cc: yzhong@purestorage.com Link: https://lore.kernel.org/r/20240722211548.61455-1-cachen@purestorage.com Signed-off-by: Namhyung Kim tools/perf/util/callchain.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 2f8c4f5062855a83c1f2dbc012c4fa274ce999d4 Merge: eb966e0c5f23 2ccfe94bc3ac Author: Linus Torvalds Date: Fri Jul 26 11:04:28 2024 -0700 Merge tag 'auxdisplay-for-v6.11-tag1' of git://git.kernel.org/pub/scm/linux/kernel/git/geert/linux-m68k Pull auxdisplay updates from Geert Uytterhoeven: - add support for configuring the boot message on line displays - miscellaneous fixes and improvements * tag 'auxdisplay-for-v6.11-tag1' of git://git.kernel.org/pub/scm/linux/kernel/git/geert/linux-m68k: auxdisplay: ht16k33: Drop reference after LED registration auxdisplay: Use sizeof(*pointer) instead of sizeof(type) auxdisplay: hd44780: add missing MODULE_DESCRIPTION() macro auxdisplay: linedisp: add missing MODULE_DESCRIPTION() macro auxdisplay: linedisp: Support configuring the boot message auxdisplay: charlcd: Provide a forward declaration commit eb966e0c5f238ffeacc15543f1d25fb06a5100c2 Merge: 0ba9b1551185 e8b96a66ae01 Author: Linus Torvalds Date: Fri Jul 26 11:01:31 2024 -0700 Merge tag 'sound-fix-6.11-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound Pull sound fixes from Takashi Iwai: "A collection of fixes gathered since the previous pull. We see a bit large LOCs at a HD-audio quirk, but that's only bulk COEF data, hence it's safe to take. In addition to that, there were two minor fixes for MIDI 2.0 handling for ALSA core, and the rest are all rather random small and device-specific fixes" * tag 'sound-fix-6.11-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound: ASoC: fsl-asoc-card: Dynamically allocate memory for snd_soc_dai_link_components ASoC: amd: yc: Support mic on Lenovo Thinkpad E16 Gen 2 ALSA: hda/realtek: Implement sound init sequence for Samsung Galaxy Book3 Pro 360 ALSA: hda/realtek: cs35l41: Fixup remaining asus strix models ASoC: SOF: ipc4-topology: Preserve the DMA Link ID for ChainDMA on unprepare ASoC: SOF: ipc4-topology: Only handle dai_config with HW_PARAMS for ChainDMA ALSA: ump: Force 1 Group for MIDI1 FBs ALSA: ump: Don't update FB name for static blocks ALSA: usb-audio: Add a quirk for Sonix HD USB Camera ASoC: TAS2781: Fix tasdev_load_calibrated_data() ASoC: tegra: select CONFIG_SND_SIMPLE_CARD_UTILS ASoC: Intel: use soc_intel_is_byt_cr() only when IOSF_MBI is reachable ALSA: usb-audio: Move HD Webcam quirk to the right place ALSA: hda: tas2781: mark const variables as __maybe_unused ALSA: usb-audio: Fix microphone sound on HD webcam. ASoC: sof: amd: fix for firmware reload failure in Vangogh platform ASoC: Intel: Fix RT5650 SSP lookup ASOC: SOF: Intel: hda-loader: only wait for HDaudio IOC for IPC4 devices ASoC: SOF: imx8m: Fix DSP control regmap retrieval commit 0ba9b1551185a8b42003b708b6a9c25a9808701e Merge: 65ad409e6388 d4ef5d2b7ee0 Author: Linus Torvalds Date: Fri Jul 26 10:57:07 2024 -0700 Merge tag 'drm-next-2024-07-26' of https://gitlab.freedesktop.org/drm/kernel Pull drm fixes from Dave Airlie: "Fixes for rc1, mostly amdgpu, i915 and xe, with some other misc ones, doesn't seem to be anything too serious. amdgpu: - Bump driver version for GFX12 DCC - DC documention warning fixes - VCN unified queue power fix - SMU fix - RAS fix - Display corruption fix - SDMA 5.2 workaround - GFX12 fixes - Uninitialized variable fix - VCN/JPEG 4.0.3 fixes - Misc display fixes - RAS fixes - VCN4/5 harvest fix - GPU reset fix i915: - Reset intel_dp->link_trained before retraining the link - Don't switch the LTTPR mode on an active link - Do not consider preemption during execlists_dequeue for gen8 - Allow NULL memory region xe: - xe_exec ioctl minor fix on sync entry cleanup upon error - SRIOV: limit VF LMEM provisioning - Wedge mode fixes v3d: - fix indirect dispatch on newer v3d revs panel: - fix panel backlight bindings" * tag 'drm-next-2024-07-26' of https://gitlab.freedesktop.org/drm/kernel: (39 commits) drm/amdgpu: reset vm state machine after gpu reset(vram lost) drm/amdgpu: add missed harvest check for VCN IP v4/v5 drm/amdgpu: Fix eeprom max record count drm/amdgpu: fix ras UE error injection failure issue drm/amd/display: Remove ASSERT if significance is zero in math_ceil2 drm/amd/display: Check for NULL pointer drm/amdgpu/vcn: Use offsets local to VCN/JPEG in VF drm/amdgpu: Add empty HDP flush function to VCN v4.0.3 drm/amdgpu: Add empty HDP flush function to JPEG v4.0.3 drm/amd/amdgpu: Fix uninitialized variable warnings drm/amdgpu: Fix atomics on GFX12 drm/amdgpu/sdma5.2: Update wptr registers as well as doorbell drm/i915: Allow NULL memory region drm/i915/gt: Do not consider preemption during execlists_dequeue for gen8 dt-bindings: display: panel: samsung,atna33xc20: Document ATNA45AF01 drm/xe: Don't suspend device upon wedge drm/xe: Wedge the entire device drm/xe/pf: Limit fair VF LMEM provisioning drm/xe/exec: Fix minor bug related to xe_sync_entry_cleanup drm/amd/display: fix corruption with high refresh rates on DCN 3.0 ... commit f3065f9c3917fa9279992623a2f3282f1fd43515 Author: Patryk Wlazlyn Date: Thu Jul 4 20:11:33 2024 +0200 tools/power turbostat: Add selftests for added perf counters Test adds several perf counters from msr, cstate_core and cstate_pkg groups and checks if the columns for those counters show up. The test skips the counters that are not present. It is not an error, but the test may not be as exhaustive. Signed-off-by: Patryk Wlazlyn Signed-off-by: Len Brown .../selftests/turbostat/added_perf_counters.py | 178 +++++++++++++++++++++ 1 file changed, 178 insertions(+) commit 1f8add13e6c86653da2ec599dfc94e7a8865cdcb Author: Patryk Wlazlyn Date: Wed Jul 3 23:14:14 2024 +0200 tools/power turbostat: Add selftests for SMI, APERF and MPERF counters The test requests BICs that are dependent on SMI, APERF and MPERF counters and checks if the columns show up in the output and the turbostat doesn't crash. Read the counters in both --no-msr and --no-perf mode. The test skips counters that are not present or user does not have permissions to read. It is not an error, but the test may not be as exhaustive. Signed-off-by: Patryk Wlazlyn Signed-off-by: Len Brown .../testing/selftests/turbostat/smi_aperf_mperf.py | 157 +++++++++++++++++++++ 1 file changed, 157 insertions(+) commit 65ad409e6388ea59d8ae73e99857c565da69612e Merge: a6294b5b1fdc 6dc2e98d5f1d Author: Linus Torvalds Date: Fri Jul 26 10:47:53 2024 -0700 Merge tag 's390-6.11-2' of git://git.kernel.org/pub/scm/linux/kernel/git/s390/linux Pull more s390 updates from Vasily Gorbik: - Fix KMSAN build breakage caused by the conflict between s390 and mm-stable trees - Add KMSAN page markers for ptdump - Add runtime constant support - Fix __pa/__va for modules under non-GPL licenses by exporting necessary vm_layout struct with EXPORT_SYMBOL to prevent linkage problems - Fix an endless loop in the CF_DIAG event stop in the CPU Measurement Counter Facility code when the counter set size is zero - Remove the PROTECTED_VIRTUALIZATION_GUEST config option and enable its functionality by default - Support allocation of multiple MSI interrupts per device and improve logging of architecture-specific limitations - Add support for lowcore relocation as a debugging feature to catch all null ptr dereferences in the kernel address space, improving detection beyond the current implementation's limited write access protection - Clean up and rework CPU alternatives to allow for callbacks and early patching for the lowcore relocation * tag 's390-6.11-2' of git://git.kernel.org/pub/scm/linux/kernel/git/s390/linux: (39 commits) s390: Remove protvirt and kvm config guards for uv code s390/boot: Add cmdline option to relocate lowcore s390/kdump: Make kdump ready for lowcore relocation s390/entry: Make system_call() ready for lowcore relocation s390/entry: Make ret_from_fork() ready for lowcore relocation s390/entry: Make __switch_to() ready for lowcore relocation s390/entry: Make restart_int_handler() ready for lowcore relocation s390/entry: Make mchk_int_handler() ready for lowcore relocation s390/entry: Make int handlers ready for lowcore relocation s390/entry: Make pgm_check_handler() ready for lowcore relocation s390/entry: Add base register to CHECK_VMAP_STACK/CHECK_STACK macro s390/entry: Add base register to SIEEXIT macro s390/entry: Add base register to MBEAR macro s390/entry: Make __sie64a() ready for lowcore relocation s390/head64: Make startup code ready for lowcore relocation s390: Add infrastructure to patch lowcore accesses s390/atomic_ops: Disable flag outputs constraint for GCC versions below 14.2.0 s390/entry: Move SIE indicator flag to thread info s390/nmi: Simplify ptregs setup s390/alternatives: Remove alternative facility list ... commit b2e4a5dfafcce87ed2b9aac0b2887f421cd2930a Author: Patryk Wlazlyn Date: Wed Jul 10 14:28:03 2024 +0200 tools/power turbostat: Move verbose counter messages to level 2 Printing information about the source and value during initialization and reading of the counter for each cpu, while useful when debugging, results in too verbose output. Signed-off-by: Patryk Wlazlyn Signed-off-by: Len Brown tools/power/x86/turbostat/turbostat.c | 24 +++++++++++------------- 1 file changed, 11 insertions(+), 13 deletions(-) commit 52e130764ab6bdc439bcf124ac3e15f52ca0c8e5 Author: Patryk Wlazlyn Date: Wed Jul 10 11:34:38 2024 +0200 tools/power turbostat: Move debug prints from stdout to stderr This leaves the stdout cleaner, having only counter data. It makes it easier for programs to parse the output of turbostat, for example selftests. Signed-off-by: Patryk Wlazlyn Signed-off-by: Len Brown tools/power/x86/turbostat/turbostat.c | 17 +++++++++-------- 1 file changed, 9 insertions(+), 8 deletions(-) commit a6294b5b1fdcdcb23c6882f2edb4bae1db3fc096 Merge: 6467dfdfc94c 36639013b346 Author: Linus Torvalds Date: Fri Jul 26 10:39:10 2024 -0700 Merge tag 'arm64-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux Pull arm64 fixes from Will Deacon: "The usual summary below, but the main fix is for the fast GUP lockless page-table walk when we have a combination of compile-time and run-time folding of the p4d and the pud respectively. - Remove some redundant Kconfig conditionals - Fix string output in ptrace selftest - Fix fast GUP crashes in some page-table configurations - Remove obsolete linker option when building the vDSO - Fix some sysreg field definitions for the GIC" * tag 'arm64-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux: arm64: mm: Fix lockless walks with static and dynamic page-table folding arm64/sysreg: Correct the values for GICv4.1 arm64/vdso: Remove --hash-style=sysv kselftest: missing arg in ptrace.c arm64/Kconfig: Remove redundant 'if HAVE_FUNCTION_GRAPH_TRACER' arm64: remove redundant 'if HAVE_ARCH_KASAN' in Kconfig commit c2adcf051be01d3da1e138c178a680514299461b Author: Chang Yu Date: Tue Jul 23 20:40:06 2024 -0700 KVM: Documentation: Fix title underline too short warning Fix "WARNING: Title underline too short" by extending title line to the proper length. Signed-off-by: Chang Yu Message-ID: Signed-off-by: Paolo Bonzini Documentation/virt/kvm/api.rst | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit b6f6a7aa689f1c255e06fee3ca13c9f9e5c12780 Author: Steve French Date: Fri Jul 26 01:06:20 2024 -0500 smb3: add dynamic trace point for session setup key expired failures There are cases where services need to remount (or change their credentials files) when keys have expired, but it can be helpful to have a dynamic trace point to make it easier to notify the service to refresh the storage account key. Here is sample output, one from mount with bad password, one from a reconnect where the password has been changed or expired and reconnect fails (requiring remount with new storage account key) TASK-PID CPU# ||||| TIMESTAMP FUNCTION | | | ||||| | | mount.cifs-11362 [000] ..... 6000.241620: smb3_key_expired: rc=-13 user=testpassu conn_id=0x2 server=localhost addr=127.0.0.1:445 kworker/4:0-8458 [004] ..... 6044.892283: smb3_key_expired: rc=-13 user=testpassu conn_id=0x3 server=localhost addr=127.0.0.1:445 Reviewed-by: Shyam Prasad N Signed-off-by: Steve French fs/smb/client/smb2pdu.c | 8 +++++++- fs/smb/client/trace.h | 40 ++++++++++++++++++++++++++++++++++++++++ 2 files changed, 47 insertions(+), 1 deletion(-) commit 6467dfdfc94cfefed728bb1d9eb78493760469e0 Merge: 732c27539430 3ceccb14f557 Author: Linus Torvalds Date: Fri Jul 26 10:34:42 2024 -0700 Merge tag 'ceph-for-6.11-rc1' of https://github.com/ceph/ceph-client Pull ceph updates from Ilya Dryomov: "A small patchset to address bogus I/O errors and ultimately an assertion failure in the face of watch errors with -o exclusive mappings in RBD marked for stable and some assorted CephFS fixes" * tag 'ceph-for-6.11-rc1' of https://github.com/ceph/ceph-client: rbd: don't assume rbd_is_lock_owner() for exclusive mappings rbd: don't assume RBD_LOCK_STATE_LOCKED for exclusive mappings rbd: rename RBD_LOCK_STATE_RELEASING and releasing_wait ceph: fix incorrect kmalloc size of pagevec mempool ceph: periodically flush the cap releases ceph: convert comma to semicolon in __ceph_dentry_dir_lease_touch() ceph: use cap_wait_list only if debugfs is enabled commit 6629f87b97e0740431b7b29b8dfdfa9d842c4bc5 Author: Steve French Date: Wed Jul 24 11:57:18 2024 -0500 smb3: add four dynamic tracepoints for copy_file_range and reflink Add more dynamic tracepoints to help debug copy_file_range (copychunk) and clone_range ("duplicate extents"). These are tracepoints for entering the function and completing without error. For example: "trace-cmd record -e smb3_copychunk_enter -e smb3_copychunk_done" or "trace-cmd record -e smb3_clone_enter -e smb3_clone_done" Here is sample output: TASK-PID CPU# ||||| TIMESTAMP FUNCTION | | | ||||| | | cp-5964 [005] ..... 2176.168977: smb3_clone_enter: xid=17 sid=0xeb275be4 tid=0x7ffa7cdb source fid=0x1ed02e15 source offset=0x0 target fid=0x1ed02e15 target offset=0x0 len=0xa0000 cp-5964 [005] ..... 2176.170668: smb3_clone_done: xid=17 sid=0xeb275be4 tid=0x7ffa7cdb source fid=0x1ed02e15 source offset=0x0 target fid=0x1ed02e15 target offset=0x0 len=0xa0000 Reviewed-by: Shyam Prasad N Signed-off-by: Steve French fs/smb/client/smb2ops.c | 15 +++++++++++++- fs/smb/client/trace.h | 53 +++++++++++++++++++++++++++++++++++++++++++++++++ 2 files changed, 67 insertions(+), 1 deletion(-) commit 5779d398dbcd74c30a641c209946b8498e668a53 Author: Steve French Date: Tue Jul 23 18:12:40 2024 -0500 smb3: add dynamic tracepoint for reflink errors There are cases where debugging clone_range ("smb2_duplicate_extents" function) and in the future copy_range ("smb2_copychunk_range") can be helpful. Add dynamic trace points for any errors in clone, and a followon patch will add them for copychunk. "trace-cmd record -e smb3_clone_err" Reviewed-by: Shyam Prasad N Signed-off-by: Steve French fs/smb/client/smb2ops.c | 5 +++++ fs/smb/client/trace.h | 57 +++++++++++++++++++++++++++++++++++++++++++++++++ 2 files changed, 62 insertions(+) commit 0005ca2076ad222de34de519c47b0eb80f458877 Author: Jim Mattson Date: Wed Jul 24 12:05:09 2024 -0700 KVM: x86: Eliminate log spam from limited APIC timer periods SAP's vSMP MemoryONE continuously requests a local APIC timer period less than 500 us, resulting in the following kernel log spam: kvm: vcpu 15: requested 70240 ns lapic timer period limited to 500000 ns kvm: vcpu 19: requested 52848 ns lapic timer period limited to 500000 ns kvm: vcpu 15: requested 70256 ns lapic timer period limited to 500000 ns kvm: vcpu 9: requested 70256 ns lapic timer period limited to 500000 ns kvm: vcpu 9: requested 70208 ns lapic timer period limited to 500000 ns kvm: vcpu 9: requested 387520 ns lapic timer period limited to 500000 ns kvm: vcpu 9: requested 70160 ns lapic timer period limited to 500000 ns kvm: vcpu 66: requested 205744 ns lapic timer period limited to 500000 ns kvm: vcpu 9: requested 70224 ns lapic timer period limited to 500000 ns kvm: vcpu 9: requested 70256 ns lapic timer period limited to 500000 ns limit_periodic_timer_frequency: 7569 callbacks suppressed ... To eliminate this spam, change the pr_info_ratelimited() in limit_periodic_timer_frequency() to pr_info_once(). Reported-by: James Houghton Signed-off-by: Jim Mattson Message-ID: <20240724190640.2449291-1-jmattson@google.com> Signed-off-by: Paolo Bonzini arch/x86/kvm/lapic.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 732c275394305b6d71b4bb74f5432d2d91f05257 Merge: dd90ad50cb37 14e9283fb22d Author: Linus Torvalds Date: Fri Jul 26 10:31:03 2024 -0700 Merge tag 'erofs-for-6.11-rc1-2' of git://git.kernel.org/pub/scm/linux/kernel/git/xiang/erofs Pull more erofs updates from Gao Xiang: - Support STATX_DIOALIGN and FS_IOC_GETFSSYSFSPATH - Fix a race of LZ4 decompression due to recent refactoring - Another multi-page folio adaption in erofs_bread() * tag 'erofs-for-6.11-rc1-2' of git://git.kernel.org/pub/scm/linux/kernel/git/xiang/erofs: erofs: convert comma to semicolon erofs: support multi-page folios for erofs_bread() erofs: add support for FS_IOC_GETFSSYSFSPATH erofs: fix race in z_erofs_get_gbuf() erofs: support STATX_DIOALIGN commit dd90ad50cb372056d01a9913ce80aaa526826593 Merge: 4c7be57f2772 bba1f6758a9e Author: Linus Torvalds Date: Fri Jul 26 10:26:33 2024 -0700 Merge tag 'pull-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs Pull struct file leak fixes from Al Viro: "a couple of leaks on failure exits missing fdput()" * tag 'pull-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs: lirc: rc_dev_get_from_fd(): fix file leak powerpc: fix a file leak in kvm_vcpu_ioctl_enable_cap() commit 4c7be57f2772c8ce4e1e43c6a79b8f8d401a4795 Author: Linus Torvalds Date: Tue Jul 23 13:21:02 2024 -0700 arm64: allow installing compressed image by default On arm64 we build compressed images, but "make install" by default will install the old non-compressed one. To actually get the compressed image install, you need to use "make zinstall", which is not the usual way to install a kernel. Which may not sound like much of an issue, but when you deal with multiple architectures (and years of your fingers knowing the regular "make install" incantation), this inconsistency is pretty annoying. But as Will Deacon says: "Sadly, bootloaders being as top quality as you might expect, I don't think we're in a position to rely on decompressor support across the board. Our Image.gz is literally just that -- we don't have a built-in decompressor (nor do I think we want to rush into that again after the fun we had on arm32) and the recent EFI zboot support solves that problem for platforms using EFI. Changing the default 'install' target terrifies me. There are bound to be folks with embedded boards who've scripted this and we could really ruin their day if we quietly give them a compressed kernel that their bootloader doesn't know how to handle :/" So make this conditional on a new "COMPRESSED_INSTALL" option. Cc: Catalin Marinas Acked-by: Will Deacon Signed-off-by: Linus Torvalds arch/arm64/Kconfig | 11 +++++++++++ arch/arm64/Makefile | 10 ++++++++-- 2 files changed, 19 insertions(+), 2 deletions(-) commit 51c4767503d5d3a5a0ae4dcb19b7f7cf38b40c6c Merge: 1722389b0d86 fb9086e95ad8 Author: Linus Torvalds Date: Fri Jul 26 09:50:36 2024 -0700 Merge tag 'bitmap-6.11-rc1' of https://github.com:/norov/linux Pull bitmap updates from Yury Norov: "Random fixes" * tag 'bitmap-6.11-rc1' of https://github.com:/norov/linux: riscv: Remove unnecessary int cast in variable_fls() radix tree test suite: put definition of bitmap_clear() into lib/bitmap.c bitops: Add a comment explaining the double underscore macros lib: bitmap: add missing MODULE_DESCRIPTION() macros cpumask: introduce assign_cpu() macro commit df3d6a3e01fd82cb74b6bb309f7be71e728a3448 Author: Luiz Augusto von Dentz Date: Thu Jul 25 18:28:08 2024 -0400 Bluetooth: hci_event: Fix setting DISCOVERY_FINDING for passive scanning DISCOVERY_FINDING shall only be set for active scanning as passive scanning is not meant to generate MGMT Device Found events causing discovering state to go out of sync since userspace would believe it is discovering when in fact it is just passive scanning. Cc: stable@vger.kernel.org Link: https://bugzilla.kernel.org/show_bug.cgi?id=219088 Fixes: 2e2515c1ba38 ("Bluetooth: hci_event: Set DISCOVERY_FINDING on SCAN_ENABLED") Signed-off-by: Luiz Augusto von Dentz net/bluetooth/hci_core.c | 7 ------- net/bluetooth/hci_event.c | 5 +++-- 2 files changed, 3 insertions(+), 9 deletions(-) commit 7a8c6fb21a7c913ddb99785b14914dab2f934fbd Author: Arnd Bergmann Date: Mon Jul 22 11:27:06 2024 +0200 Bluetooth: btmtk: remove #ifdef around declarations The caller of these functions in btusb.c is guarded with an if(IS_ENABLED()) style check, so dead code is left out, but the declarations are still needed at compile time: drivers/bluetooth/btusb.c: In function 'btusb_mtk_reset': drivers/bluetooth/btusb.c:2705:15: error: implicit declaration of function 'btmtk_usb_subsys_reset' [-Wimplicit-function-declaration] 2705 | err = btmtk_usb_subsys_reset(hdev, btmtk_data->dev_id); | ^~~~~~~~~~~~~~~~~~~~~~ drivers/bluetooth/btusb.c: In function 'btusb_send_frame_mtk': drivers/bluetooth/btusb.c:2720:23: error: implicit declaration of function 'alloc_mtk_intr_urb' [-Wimplicit-function-declaration] 2720 | urb = alloc_mtk_intr_urb(hdev, skb, btusb_tx_complete); | ^~~~~~~~~~~~~~~~~~ drivers/bluetooth/btusb.c:2720:21: error: assignment to 'struct urb *' from 'int' makes pointer from integer without a cast [-Wint-conversion] 2720 | urb = alloc_mtk_intr_urb(hdev, skb, btusb_tx_complete); | ^ Fixes: f0c83a23fcbb ("Bluetooth: btmtk: Fix btmtk.c undefined reference build error") Signed-off-by: Arnd Bergmann Reviewed-by: AngeloGioacchino Del Regno Signed-off-by: Luiz Augusto von Dentz drivers/bluetooth/btmtk.h | 2 -- 1 file changed, 2 deletions(-) commit 61f7a8f975456d7be21100ee0936389142b95a81 Author: Arnd Bergmann Date: Mon Jul 22 11:27:05 2024 +0200 Bluetooth: btmtk: Fix btmtk.c undefined reference build error harder The previous fix was incomplete as the link failure still persists with CONFIG_USB=m when the sdio or serial wrappers for btmtk.c are build-in: btmtk.c:(.text+0x468): undefined reference to `usb_alloc_urb' btmtk.c:(.text+0x488): undefined reference to `usb_free_urb' btmtk.c:(.text+0x500): undefined reference to `usb_anchor_urb' btmtk.c:(.text+0x50a): undefined reference to `usb_submit_urb' btmtk.c:(.text+0x92c): undefined reference to `usb_control_msg' btmtk.c:(.text+0xa92): undefined reference to `usb_unanchor_urb' btmtk.c:(.text+0x11e4): undefined reference to `usb_set_interface' btmtk.c:(.text+0x120a): undefined reference to `usb_kill_anchored_urbs' Disallow this configuration. Fixes: f0c83a23fcbb ("Bluetooth: btmtk: Fix btmtk.c undefined reference build error") Signed-off-by: Arnd Bergmann Signed-off-by: Luiz Augusto von Dentz drivers/bluetooth/Kconfig | 2 ++ 1 file changed, 2 insertions(+) commit f0c83a23fcbb424fdff5b38fbcdda3c04003a210 Author: Chris Lu Date: Fri Jul 19 11:30:19 2024 +0800 Bluetooth: btmtk: Fix btmtk.c undefined reference build error MediaTek moved some usb interface related function to btmtk.c which may cause build failed if BT USB Kconfig wasn't enabled. Fix undefined reference by adding config check. btmtk.c:(.text+0x89c): undefined reference to `usb_alloc_urb' btmtk.c:(.text+0x8e3): undefined reference to `usb_free_urb' btmtk.c:(.text+0x956): undefined reference to `usb_free_urb' btmtk.c:(.text+0xa0e): undefined reference to `usb_anchor_urb' btmtk.c:(.text+0xb43): undefined reference to `usb_autopm_get_interface' btmtk.c:(.text+0xb7e): undefined reference to `usb_autopm_put_interface' btmtk.c:(.text+0xf70): undefined reference to `usb_disable_autosuspend' btmtk.c:(.text+0x133a): undefined reference to `usb_control_msg' Fixes: d019930b0049 ("Bluetooth: btmtk: move btusb_mtk_hci_wmt_sync to btmtk.c") Reported-by: kernel test robot Closes: https://lore.kernel.org/oe-kbuild-all/202407091928.AH0aGZnx-lkp@intel.com/ Signed-off-by: Chris Lu Signed-off-by: Luiz Augusto von Dentz drivers/bluetooth/btmtk.c | 2 ++ drivers/bluetooth/btmtk.h | 2 ++ 2 files changed, 4 insertions(+) commit 96b82af36efaa1787946e021aa3dc5410c05beeb Author: Luiz Augusto von Dentz Date: Mon Jul 15 10:40:03 2024 -0400 Bluetooth: hci_sync: Fix suspending with wrong filter policy When suspending the scan filter policy cannot be 0x00 (no acceptlist) since that means the host has to process every advertisement report waking up the system, so this attempts to check if hdev is marked as suspended and if the resulting filter policy would be 0x00 (no acceptlist) then skip passive scanning if thre no devices in the acceptlist otherwise reset the filter policy to 0x01 so the acceptlist is used since the devices programmed there can still wakeup be system. Fixes: 182ee45da083 ("Bluetooth: hci_sync: Rework hci_suspend_notifier") Signed-off-by: Luiz Augusto von Dentz net/bluetooth/hci_sync.c | 21 +++++++++++++++++++++ 1 file changed, 21 insertions(+) commit d09009bc80d9d0d812b988888c40cd86e52eaf1e Author: Chris Lu Date: Tue Jul 16 15:49:47 2024 +0800 Bluetooth: btmtk: Fix kernel crash when entering btmtk_usb_suspend If MediaTek's Bluetooth setup is unsuccessful, a NULL pointer issue occur when the system is suspended and the anchored kill function is called. To avoid this, add protection to prevent executing the anchored kill function if the setup is unsuccessful. [ 6.922106] Hardware name: Acer Tomato (rev2) board (DT) [ 6.922114] Workqueue: pm pm_runtime_work [ 6.922132] pstate: 804000c9 (Nzcv daIF +PAN -UAO -TCO -DIT -SSBS BTYPE=--) [ 6.922147] pc : usb_kill_anchored_urbs+0x6c/0x1e0 [ 6.922164] lr : usb_kill_anchored_urbs+0x48/0x1e0 [ 6.922181] sp : ffff800080903b60 [ 6.922187] x29: ffff800080903b60 x28: ffff2c7b85c32b80 x27: ffff2c7bbb370930 [ 6.922211] x26: 00000000000f4240 x25: 00000000ffffffff x24: ffffd49ece2dcb48 [ 6.922255] x20: ffffffffffffffd8 x19: 0000000000000000 x18: 0000000000000006 [ 6.922276] x17: 6531656337386238 x16: 3632373862333863 x15: ffff800080903480 [ 6.922297] x14: 0000000000000000 x13: 303278302f303178 x12: ffffd49ecf090e30 [ 6.922318] x11: 0000000000000001 x10: 0000000000000001 x9 : ffffd49ecd2c5bb4 [ 6.922339] x8 : c0000000ffffdfff x7 : ffffd49ecefe0db8 x6 : 00000000000affa8 [ 6.922360] x5 : ffff2c7bbb35dd48 x4 : 0000000000000000 x3 : 0000000000000000 [ 6.922379] x2 : 0000000000000000 x1 : 0000000000000003 x0 : ffffffffffffffd8 [ 6.922400] Call trace: [ 6.922405] usb_kill_anchored_urbs+0x6c/0x1e0 [ 6.922422] btmtk_usb_suspend+0x20/0x38 [btmtk 5f200a97badbdfda4266773fee49acfc8e0224d5] [ 6.922444] btusb_suspend+0xd0/0x210 [btusb 0bfbf19a87ff406c83b87268b87ce1e80e9a829b] [ 6.922469] usb_suspend_both+0x90/0x288 [ 6.922487] usb_runtime_suspend+0x3c/0xa8 [ 6.922507] __rpm_callback+0x50/0x1f0 [ 6.922523] rpm_callback+0x70/0x88 [ 6.922538] rpm_suspend+0xe4/0x5a0 [ 6.922553] pm_runtime_work+0xd4/0xe0 [ 6.922569] process_one_work+0x18c/0x440 [ 6.922588] worker_thread+0x314/0x428 [ 6.922606] kthread+0x128/0x138 [ 6.922621] ret_from_fork+0x10/0x20 [ 6.922644] Code: f100a274 54000520 d503201f d100a260 (b8370000) [ 6.922654] ---[ end trace 0000000000000000 ]--- Fixes: ceac1cb0259d ("Bluetooth: btusb: mediatek: add ISO data transmission functions") Signed-off-by: Chris Lu Reported-by: Nícolas F. R. A. Prado #KernelCI Tested-by: Nícolas F. R. A. Prado Signed-off-by: Luiz Augusto von Dentz drivers/bluetooth/btmtk.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) commit e22a3a9d4134d7e6351a2998771522e74bcc58da Author: Kiran K Date: Wed Jul 3 14:22:42 2024 +0530 Bluetooth: btintel: Fail setup on error Do not attempt to send any hci command to controller if *setup* function fails. Fixes: af395330abed ("Bluetooth: btintel: Add Intel devcoredump support") Signed-off-by: Kiran K Signed-off-by: Luiz Augusto von Dentz drivers/bluetooth/btintel.c | 3 +++ 1 file changed, 3 insertions(+) commit 952b13c215234855d75ef4b5bb0138075e73677c Author: Takashi Iwai Date: Fri Jul 26 16:34:54 2024 +0200 ALSA: seq: ump: Optimize conversions from SysEx to UMP The current conversion from the legacy SysEx event to UMP SysEx packet in the sequencer core has a couple of issues: * The first packet trims the SysEx start byte (0xf0), hence it contains only 5 bytes instead of 6. This isn't wrong, per specification, but it's strange not to fill 6 bytes. * When the SysEx end marker (0xf7) is placed at the first byte of the next packet, it'll end up with an empty data just with the END status. It can be rather folded into the previous packet with the END status. This patch tries to address those issues. The first packet may have 6 bytes even with the SysEx start, and an empty packet with the SysEx end marker is omitted. Fixes: e9e02819a98a ("ALSA: seq: Automatic conversion of UMP events") Cc: Link: https://patch.msgid.link/20240726143455.3254-1-tiwai@suse.de Signed-off-by: Takashi Iwai sound/core/seq/seq_ump_convert.c | 37 +++++++++++++++++++++++-------------- 1 file changed, 23 insertions(+), 14 deletions(-) commit 4f61c8fe35202702426cfc0003e15116a01ba885 Author: Takashi Iwai Date: Fri Jul 26 16:26:20 2024 +0200 ALSA: hda/conexant: Mute speakers at suspend / shutdown Use the new helper to mute speakers at suspend / shutdown for avoiding click noises. Link: https://bugzilla.suse.com/show_bug.cgi?id=1228269 Link: https://patch.msgid.link/20240726142625.2460-2-tiwai@suse.de Signed-off-by: Takashi Iwai sound/pci/hda/patch_conexant.c | 2 ++ 1 file changed, 2 insertions(+) commit 6cd23b26b348fa52c88e1adf9c0e48d68e13f95e Author: Takashi Iwai Date: Fri Jul 26 16:26:19 2024 +0200 ALSA: hda/generic: Add a helper to mute speakers at suspend/shutdown Some devices indicate click noises at suspend or shutdown when the speakers are unmuted. This patch adds a helper, snd_hda_gen_shutup_speakers(), to work around it. The new function is supposed to be called at suspend or shutdown by the codec driver, and it mutes the speakers. The mute status isn't cached, hence the original mute state will be restored at resume again. Link: https://patch.msgid.link/20240726142625.2460-1-tiwai@suse.de Signed-off-by: Takashi Iwai sound/pci/hda/hda_generic.c | 63 +++++++++++++++++++++++++++++++++++++++++++++ sound/pci/hda/hda_generic.h | 1 + 2 files changed, 64 insertions(+) commit 358169617602f6f71b31e5c9532a09b95a34b043 Author: Pavel Begunkov Date: Fri Jul 26 15:24:31 2024 +0100 io_uring/napi: pass ktime to io_napi_adjust_timeout Pass the waiting time for __io_napi_adjust_timeout as ktime and get rid of all timespec64 conversions. It's especially simpler since the caller already have a ktime. Signed-off-by: Pavel Begunkov Link: https://lore.kernel.org/r/4f5b8e8eed4f53a1879e031a6712b25381adc23d.1722003776.git.asml.silence@gmail.com Signed-off-by: Jens Axboe io_uring/io_uring.c | 6 ++++-- io_uring/napi.c | 14 +++----------- io_uring/napi.h | 8 ++++---- 3 files changed, 11 insertions(+), 17 deletions(-) commit 342b2e395d5f34c9f111a818556e617939f83a8c Author: Pavel Begunkov Date: Fri Jul 26 15:24:30 2024 +0100 io_uring/napi: use ktime in busy polling It's more natural to use ktime/ns instead of keeping around usec, especially since we're comparing it against user provided timers, so convert napi busy poll internal handling to ktime. It's also nicer since the type (ktime_t vs unsigned long) now tells the unit of measure. Keep everything as ktime, which we convert to/from micro seconds for IORING_[UN]REGISTER_NAPI. The net/ busy polling works seems to work with usec, however it's not real usec as shift by 10 is used to get it from nsecs, see busy_loop_current_time(), so it's easy to get truncated nsec back and we get back better precision. Note, we can further improve it later by removing the truncation and maybe convincing net/ to use ktime/ns instead. Signed-off-by: Pavel Begunkov Link: https://lore.kernel.org/r/95e7ec8d095069a3ed5d40a4bc6f8b586698bc7e.1722003776.git.asml.silence@gmail.com Signed-off-by: Jens Axboe include/linux/io_uring_types.h | 2 +- io_uring/io_uring.h | 2 +- io_uring/napi.c | 48 ++++++++++++++++++++++++------------------ io_uring/napi.h | 2 +- 4 files changed, 30 insertions(+), 24 deletions(-) commit e60dc98122110594d0290845160f12916192fc6d Author: songxiebing Date: Fri Jul 26 18:07:26 2024 +0800 ALSA: hda: conexant: Fix headset auto detect fail in the polling mode The previous fix (7aeb25908648) only handles the unsol_event reporting during interrupts and does not include the polling mode used to set jackroll_ms, so now we are replacing it with snd_hda_jack_detect_enable_callback. Fixes: 7aeb25908648 ("ALSA: hda/conexant: Fix headset auto detect fail in cx8070 and SN6140") Co-developed-by: bo liu Signed-off-by: bo liu Signed-off-by: songxiebing Link: https://patch.msgid.link/20240726100726.50824-1-soxiebing@163.com Signed-off-by: Takashi Iwai sound/pci/hda/patch_conexant.c | 54 +++++++----------------------------------- 1 file changed, 9 insertions(+), 45 deletions(-) commit e975d955c07cbc2cd6a83a5d8235d8373441fdb9 Author: Mark Brown Date: Fri Jul 26 14:49:41 2024 +0100 regulator: Further restrict RZG2L USB VBCTRL regulator dependencies Since the regulator can't be used without the USB controller also tighten the dependency to match, as well as the default. Reviewed-by: Biju Das Signed-off-by: Mark Brown Link: https://patch.msgid.link/20240726-regulator-restrict-rzg2l-v1-1-640e508896e2@kernel.org Signed-off-by: Mark Brown drivers/regulator/Kconfig | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit f6bb5254b777453618a12d3bbf4a2a487acc8ee2 Merge: 55fbb9a5d64e c31fad147038 Author: Jens Axboe Date: Fri Jul 26 08:06:15 2024 -0600 Merge tag 'nvme-6.11-2024-07-26' of git://git.infradead.org/nvme into block-6.11 Pull NVMe fixes from Keith: "nvme fixes for Linux 6.11 - Fix request without payloads cleanup (Leon) - Use new protection information format (Francis) - Improved debug message for lost pci link (Bart) - Another apst quirk (Wang) - Use appropriate sysfs api for printing chars (Markus)" * tag 'nvme-6.11-2024-07-26' of git://git.infradead.org/nvme: nvme-pci: add missing condition check for existence of mapped data nvme-core: choose PIF from QPIF if QPIFS supports and PIF is QTYPE nvme-pci: Fix the instructions for disabling power management nvme: remove redundant bdev local variable nvme-fabrics: Use seq_putc() in __nvmf_concat_opt_tokens() nvme/pci: Add APST quirk for Lenovo N60z laptop commit 225990c487c1023e7b3aa89beb6a68011fbc0461 Author: Mark Mentovai Date: Thu Jul 25 16:41:44 2024 -0400 net: phy: realtek: add support for RTL8366S Gigabit PHY The PHY built in to the Realtek RTL8366S switch controller was previously supported by genphy_driver. This PHY does not implement MMD operations. Since commit 9b01c885be36 ("net: phy: c22: migrate to genphy_c45_write_eee_adv()"), MMD register reads have been made during phy_probe to determine EEE support. For genphy_driver, these reads are transformed into 802.3 annex 22D clause 45-over-clause 22 mmd_phy_indirect operations that perform MII register writes to MII_MMD_CTRL and MII_MMD_DATA. This overwrites those two MII registers, which on this PHY are reserved and have another function, rendering the PHY unusable while so configured. Proper support for this PHY is restored by providing a phy_driver that declares MMD operations as unsupported by using the helper functions provided for that purpose, while remaining otherwise identical to genphy_driver. Fixes: 9b01c885be36 ("net: phy: c22: migrate to genphy_c45_write_eee_adv()") Reported-by: Russell Senior Closes: https://github.com/openwrt/openwrt/issues/15981 Link: https://github.com/openwrt/openwrt/issues/15739 Signed-off-by: Mark Mentovai Reviewed-by: Maxime Chevallier Signed-off-by: David S. Miller drivers/net/phy/realtek.c | 7 +++++++ 1 file changed, 7 insertions(+) commit 52420e483d3e1562f11a208d3c540b27b5e5dbf4 Author: Palmer Dabbelt Date: Tue Jul 2 11:37:31 2024 +0800 RISC-V: Provide the frequency of time CSR via hwprobe The RISC-V architecture makes a real time counter CSR (via RDTIME instruction) available for applications in U-mode but there is no architected mechanism for an application to discover the frequency the counter is running at. Some applications (e.g., DPDK) use the time counter for basic performance analysis as well as fine grained time-keeping. Add support to the hwprobe system call to export the time CSR frequency to code running in U-mode. Signed-off-by: Yunhui Cui Reviewed-by: Evan Green Reviewed-by: Anup Patel Acked-by: Punit Agrawal Link: https://lore.kernel.org/r/20240702033731.71955-2-cuiyunhui@bytedance.com Signed-off-by: Palmer Dabbelt Documentation/arch/riscv/hwprobe.rst | 2 ++ arch/riscv/include/asm/hwprobe.h | 2 +- arch/riscv/include/uapi/asm/hwprobe.h | 1 + arch/riscv/kernel/sys_hwprobe.c | 5 +++++ 4 files changed, 9 insertions(+), 1 deletion(-) commit 5c8405d763dc2b125b39166bc70be1b8dcc80582 Author: Stuart Menefy Date: Sun Jun 30 12:05:49 2024 +0100 riscv: Extend sv39 linear mapping max size to 128G This harmonizes all virtual addressing modes which can now all map (PGDIR_SIZE * PTRS_PER_PGD) / 4 of physical memory. The RISCV implementation of KASAN requires that the boundary between shallow mappings are aligned on an 8G boundary. In this case we need VMALLOC_START to be 8G aligned. So although we only need to move the start of the linear mapping down by 4GiB to allow 128GiB to be mapped, we actually move it down by 8GiB (creating a 4GiB hole between the linear mapping and KASAN shadow space) to maintain the alignment requirement. Signed-off-by: Stuart Menefy Reviewed-by: Alexandre Ghiti Link: https://lore.kernel.org/r/20240630110550.1731929-1-stuart.menefy@codasip.com Signed-off-by: Palmer Dabbelt Documentation/arch/riscv/vm-layout.rst | 11 ++++++----- arch/riscv/include/asm/page.h | 2 +- 2 files changed, 7 insertions(+), 6 deletions(-) commit 3aa1a7d013dd69d187a7b2daa1a0961b7d4edc71 Merge: ec1dc56b54d6 66381d36771e Author: Palmer Dabbelt Date: Wed Jul 24 07:39:39 2024 -0700 Merge patch series "RISC-V: Select ACPI PPTT drivers" This series adds support for ACPI PPTT via cacheinfo. * b4-shazam-merge: RISC-V: Select ACPI PPTT drivers riscv: cacheinfo: initialize cacheinfo's level and type from ACPI PPTT riscv: cacheinfo: remove the useless input parameter (node) of ci_leaf_init() Link: https://lore.kernel.org/r/20240617131425.7526-1-cuiyunhui@bytedance.com Signed-off-by: Palmer Dabbelt commit ec1dc56b54d679cbfaa7ef7abbf23bdeac029af1 Merge: b5db73fb1825 38738947db38 Author: Palmer Dabbelt Date: Wed Jul 24 07:33:41 2024 -0700 Merge patch "Enable SPCR table for console output on RISC-V" Sia Jee Heng says: The ACPI SPCR code has been used to enable console output for ARM64 and X86. The same code can be reused for RISC-V. Furthermore, SPCR table is mandated for headless system as outlined in the RISC-V BRS Specification, chapter 6. * b4-shazam-merge: RISC-V: ACPI: Enable SPCR table for console output on RISC-V Link: https://lore.kernel.org/r/20240502073751.102093-1-jeeheng.sia@starfivetech.com Signed-off-by: Palmer Dabbelt commit b5db73fb18257cd5d9cb59bc4b779fffa629566a Author: Jisheng Zhang Date: Mon Jun 24 07:53:16 2024 +0800 riscv: enable HAVE_ARCH_STACKLEAK Add support for the stackleak feature. Whenever the kernel returns to user space the kernel stack is filled with a poison value. At the same time, disables the plugin in EFI stub code because EFI stub is out of scope for the protection. Tested on qemu and milkv duo: / # echo STACKLEAK_ERASING > /sys/kernel/debug/provoke-crash/DIRECT [ 38.675575] lkdtm: Performing direct entry STACKLEAK_ERASING [ 38.678448] lkdtm: stackleak stack usage: [ 38.678448] high offset: 288 bytes [ 38.678448] current: 496 bytes [ 38.678448] lowest: 1328 bytes [ 38.678448] tracked: 1328 bytes [ 38.678448] untracked: 448 bytes [ 38.678448] poisoned: 14312 bytes [ 38.678448] low offset: 8 bytes [ 38.689887] lkdtm: OK: the rest of the thread stack is properly erased Signed-off-by: Jisheng Zhang Reviewed-by: Charlie Jenkins Link: https://lore.kernel.org/r/20240623235316.2010-1-jszhang@kernel.org Signed-off-by: Palmer Dabbelt arch/riscv/Kconfig | 1 + arch/riscv/include/asm/thread_info.h | 1 + arch/riscv/kernel/entry.S | 4 ++++ drivers/firmware/efi/libstub/Makefile | 3 ++- 4 files changed, 8 insertions(+), 1 deletion(-) commit 1d20e5d437cfebefb5e6f4d652c3a1561fc23fc7 Author: Zhongqiu Han Date: Thu Jun 20 11:34:34 2024 +0800 riscv: signal: Remove unlikely() from WARN_ON() condition "WARN_ON(unlikely(x))" is excessive. WARN_ON() already uses unlikely() internally. Signed-off-by: Zhongqiu Han Reviewed-by: Bjorn Andersson Reviewed-by: Andy Chiu Link: https://lore.kernel.org/r/20240620033434.3778156-1-quic_zhonhan@quicinc.com Signed-off-by: Palmer Dabbelt arch/riscv/kernel/signal.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 5d5fc33ce58e81e8738816f5ee59f8e85fd3b404 Author: Anton Blanchard Date: Thu Jun 6 23:13:35 2024 -0700 riscv: Improve exception and system call latency Many CPUs implement return address branch prediction as a stack. The RISCV architecture refers to this as a return address stack (RAS). If this gets corrupted then the CPU will mispredict at least one but potentally many function returns. There are two issues with the current RISCV exception code: - We are using the alternate link stack (x5/t0) for the indirect branch which makes the hardware think this is a function return. This will corrupt the RAS. - We modify the return address of handle_exception to point to ret_from_exception. This will also corrupt the RAS. Testing the null system call latency before and after the patch: Visionfive2 (StarFive JH7110 / U74) baseline: 189.87 ns patched: 176.76 ns Lichee pi 4a (T-Head TH1520 / C910) baseline: 666.58 ns patched: 636.90 ns Just over 7% on the U74 and just over 4% on the C910. Signed-off-by: Anton Blanchard Signed-off-by: Cyril Bur Tested-by: Jisheng Zhang Reviewed-by: Jisheng Zhang Link: https://lore.kernel.org/r/20240607061335.2197383-1-cyrilbur@tenstorrent.com Signed-off-by: Palmer Dabbelt arch/riscv/kernel/entry.S | 17 ++++++++++------- arch/riscv/kernel/stacktrace.c | 4 ++-- 2 files changed, 12 insertions(+), 9 deletions(-) commit 24168c5e6dfbdd5b414f048f47f75d64533296ca Author: Carlos Song Date: Mon Jul 15 18:53:51 2024 -0400 dt-bindings: i3c: add header for generic I3C flags Add header file for generic I3C flags to avoid hard code in dts file. Signed-off-by: Carlos Song Reviewed-by: Frank Li Acked-by: Jason Liu Signed-off-by: Frank Li Reviewed-by: Krzysztof Kozlowski Link: https://lore.kernel.org/r/20240715225351.3237284-1-Frank.Li@nxp.com Signed-off-by: Alexandre Belloni Documentation/devicetree/bindings/i3c/i3c.yaml | 5 ++++- MAINTAINERS | 1 + include/dt-bindings/i3c/i3c.h | 16 ++++++++++++++++ 3 files changed, 21 insertions(+), 1 deletion(-) commit b73c983491e0a61331611d2dab1dfccd4464b060 Author: Dan Carpenter Date: Thu Jul 18 13:30:22 2024 -0500 i3c: master: svc: Fix error code in svc_i3c_master_do_daa_locked() This code has a typo so it returns positive EIO instead of negative -EIO. Fix it! Fixes: a7809cb368b9 ("i3c: master: svc: Improve DAA STOP handle code logic") Signed-off-by: Dan Carpenter Reviewed-by: Frank Li Link: https://lore.kernel.org/r/e017edfc-da64-496b-8516-958bec27cd9a@stanley.mountain Signed-off-by: Alexandre Belloni drivers/i3c/master/svc-i3c-master.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 63c33ca0969cf4d4574103b69fb46f58a19a182b Author: Bhoomik Gupta Date: Mon Jul 8 11:08:35 2024 +0530 i3c: master: Enhance i3c_bus_type visibility for device searching & event monitoring Improve the visibility of i3c_bus_type to facilitate searching for i3c devices attached to the i3c bus. Enable other drivers to use bus_register_notifier to monitor i3c bus device events. Signed-off-by: Bhoomik Gupta Link: https://lore.kernel.org/r/20240708053835.3003986-1-bhoomik.gupta@nxp.com Signed-off-by: Alexandre Belloni drivers/i3c/internals.h | 2 -- drivers/i3c/master.c | 1 + include/linux/i3c/master.h | 1 + 3 files changed, 2 insertions(+), 2 deletions(-) commit 62fe9d06f5709caa1fa68055873ff279e05ade37 Author: Aniket Date: Mon Jul 8 06:21:03 2024 +0000 i3c: dw: Add power management support Add support for runtime and system power management. Handle clocks, resets, pads as part of suspend and resume. Restore controller registers that could be lost due to suspend. Finally add get and put calls appropriately in functions which access controller : bus_init, do_daa, send_ccc_cmd, priv_xfers, i2c_xfers, ibi and hot-join. Signed-off-by: Aniket Link: https://lore.kernel.org/r/20240708062103.3296587-4-aniketmaurya@google.com Signed-off-by: Alexandre Belloni drivers/i3c/master/dw-i3c-master.c | 225 ++++++++++++++++++++++++++++++++++--- drivers/i3c/master/dw-i3c-master.h | 1 + 2 files changed, 209 insertions(+), 17 deletions(-) commit effd21743c39a6535f204812006054fa172e4313 Author: Aniket Date: Mon Jul 8 06:21:02 2024 +0000 i3c: dw: Add some functions for reusability Separate logic for setting intr/thld registers in a func. Also modify enable function to take care of setting all fields in DEVICE_CTRL. These functions can be reused later for power management. Signed-off-by: Aniket Link: https://lore.kernel.org/r/20240708062103.3296587-3-aniketmaurya@google.com Signed-off-by: Alexandre Belloni drivers/i3c/master/dw-i3c-master.c | 62 +++++++++++++++++++++----------------- 1 file changed, 35 insertions(+), 27 deletions(-) commit 4e89bc48e66a9aef46a705943d3f81bffb3a2288 Author: Aniket Date: Mon Jul 8 06:21:01 2024 +0000 i3c: dw: Save timing registers and other values Add variables to store timing registers and other values. These variables would be later used to restore registers during resume without recomputation. Signed-off-by: Aniket Link: https://lore.kernel.org/r/20240708062103.3296587-2-aniketmaurya@google.com Signed-off-by: Alexandre Belloni drivers/i3c/master/dw-i3c-master.c | 15 +++++++++++++-- drivers/i3c/master/dw-i3c-master.h | 9 +++++++++ 2 files changed, 22 insertions(+), 2 deletions(-) commit 915d0741e0c8e5fe406f8a8369745a73e2c681ef Author: Frank Li Date: Tue Jul 2 18:31:07 2024 -0400 i3c: master: svc: Improve DAA STOP handle code logic The REQUEST_PROC_DAA command behaves differently from other commands. Sometimes the hardware can auto emit STOP, but in other conditions, it cannot. Improves the code logic to better handle these situations. Hardware can auto emit STOP only when the following conditions are met: - The previous I3C device correctly returns a PID and ACKs an I3C address. - A NACK is received when emitting 7E to try to get the next I3C device's PID. In all other cases, a manual STOP emission is needed. The code is changed to emit STOP when break the while loop and 'return 0' only when the hardware can auto emit STOP. Signed-off-by: Frank Li Reviewed-by: Miquel Raynal Link: https://lore.kernel.org/r/20240702223107.403057-1-Frank.Li@nxp.com Signed-off-by: Alexandre Belloni drivers/i3c/master/svc-i3c-master.c | 61 ++++++++++++++++++++++++++----------- 1 file changed, 43 insertions(+), 18 deletions(-) commit a0d48ebf39cee74f3832d42126b6ddf4497fc07c Author: Aniket Date: Fri Jun 28 15:46:18 2024 +0000 i3c: dw: Add optional apb clock Besides the core clock, IP also has an apb interface clock. Add an optional hook for the same. Signed-off-by: Aniket Link: https://lore.kernel.org/r/20240628154618.327151-1-aniketmaurya@google.com Signed-off-by: Alexandre Belloni drivers/i3c/master/dw-i3c-master.c | 4 ++++ drivers/i3c/master/dw-i3c-master.h | 1 + 2 files changed, 5 insertions(+) commit 54f5079e0dfcce2886178382ee9f03f35cc28325 Author: Aniket Date: Fri Jun 28 15:46:03 2024 +0000 i3c: dw: Use new *_enabled clk API Move to "enabled" variant of clk_get API. It takes care of enable and disable calls during the probe and remove. Signed-off-by: Aniket Link: https://lore.kernel.org/r/20240628154603.326075-1-aniketmaurya@google.com Signed-off-by: Alexandre Belloni drivers/i3c/master/dw-i3c-master.c | 11 +---------- 1 file changed, 1 insertion(+), 10 deletions(-) commit 71134c13ac59fcadbfe39b8f9022a37266c4ed5a Author: Aniket Date: Fri Jun 28 15:45:26 2024 +0000 dt-bindings: i3c: dw: Add apb clock binding Add dt binding for optional apb clock. Core clock is mandatory. Signed-off-by: Aniket Reviewed-by: Krzysztof Kozlowski Link: https://lore.kernel.org/r/20240628154526.324068-1-aniketmaurya@google.com Signed-off-by: Alexandre Belloni Documentation/devicetree/bindings/i3c/snps,dw-i3c-master.yaml | 11 ++++++++++- 1 file changed, 10 insertions(+), 1 deletion(-) commit 48a6dcdafdbe7b9596ac6ecbecc347c2e2413f81 Author: Chen Ni Date: Tue Jul 2 10:47:58 2024 +0800 i3c: master: svc: Convert comma to semicolon Replace a comma between expression statements by a semicolon. Signed-off-by: Chen Ni Link: https://lore.kernel.org/r/20240702024758.1411569-1-nichen@iscas.ac.cn Signed-off-by: Alexandre Belloni drivers/i3c/master/svc-i3c-master.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 4642f7eddb75efb5944ff21e5340ccce66928ff1 Author: Jarkko Nikula Date: Fri Jun 28 16:15:59 2024 +0300 i3c: mipi-i3c-hci: Round IBI data chunk size to HW supported value The dma.c: hci_dma_init() sets the CHUNK_SIZE field in the IBI_SETUP register incorrectly if the calculated ibi_chunk_sz is not exactly 2^(n+2) bytes, where n is 0..6. Fix this by rounding the chunk size up to nearest 2^(n+2) bytes. Signed-off-by: Jarkko Nikula Link: https://lore.kernel.org/r/20240628131559.502822-4-jarkko.nikula@linux.intel.com Signed-off-by: Alexandre Belloni drivers/i3c/master/mipi-i3c-hci/dma.c | 7 +++++++ 1 file changed, 7 insertions(+) commit 8a2be2f1db268ec735419e53ef04ca039fc027dc Author: Jarkko Nikula Date: Fri Jun 28 16:15:58 2024 +0300 i3c: mipi-i3c-hci: Error out instead on BUG_ON() in IBI DMA setup Definitely condition dma_get_cache_alignment * defined value > 256 during driver initialization is not reason to BUG_ON(). Turn that to graceful error out with -EINVAL. Signed-off-by: Jarkko Nikula Link: https://lore.kernel.org/r/20240628131559.502822-3-jarkko.nikula@linux.intel.com Signed-off-by: Alexandre Belloni drivers/i3c/master/mipi-i3c-hci/dma.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) commit 2df1de813a5ccbc89c7c831365e9e2c479aea0c3 Author: Jarkko Nikula Date: Fri Jun 28 16:15:57 2024 +0300 i3c: mipi-i3c-hci: Set IBI Status and Data Ring base addresses IBI Status and Data Ring base address registers are not set so HW obviously cannot update those rings after In-Band Interrupt. Set them to already allocated and mapped ring addresses. Signed-off-by: Jarkko Nikula Link: https://lore.kernel.org/r/20240628131559.502822-2-jarkko.nikula@linux.intel.com Signed-off-by: Alexandre Belloni drivers/i3c/master/mipi-i3c-hci/dma.c | 5 +++++ 1 file changed, 5 insertions(+) commit 74e931f090a1d1a71d460284e87bd668667b98db Author: Jarkko Nikula Date: Fri Jun 28 16:15:56 2024 +0300 i3c: mipi-i3c-hci: Switch to lower_32_bits()/upper_32_bits() helpers Rather than having own lo32()/hi32() helpers for dealing with 32-bit and 64-bit build targets switch to generic lower_32_bits()/upper_32_bits() helpers. Signed-off-by: Jarkko Nikula Link: https://lore.kernel.org/r/20240628131559.502822-1-jarkko.nikula@linux.intel.com Signed-off-by: Alexandre Belloni drivers/i3c/master/mipi-i3c-hci/dma.c | 27 ++++++--------------------- 1 file changed, 6 insertions(+), 21 deletions(-) commit d9deb28f700cbe15800f1835da7994a5c6f03928 Author: Aniket Date: Thu Jun 27 03:41:19 2024 +0000 i3c: dw: Remove ibi_capable property Since DW I3C IP master role always supports IBI, we don't need to keep two variants of master ops and select one using this property. Hence remove the code. Signed-off-by: Aniket Link: https://lore.kernel.org/r/20240627034119.3938050-1-aniketmaurya@google.com Signed-off-by: Alexandre Belloni drivers/i3c/master/ast2600-i3c-master.c | 1 - drivers/i3c/master/dw-i3c-master.c | 23 ++--------------------- drivers/i3c/master/dw-i3c-master.h | 1 - 3 files changed, 2 insertions(+), 23 deletions(-) commit 64bf1459080670f05b8bb9c0cd140befd6780b5e Author: Aniket Date: Fri Jun 7 07:20:30 2024 +0000 i3c: dw: Fix IBI intr programming IBI_SIR_REQ_REJECT register is not present if the IP has IC_HAS_IBI_DATA = 1 set. So don't rely on doing read- modify-write op on this register. Instead maintain a variable to store the sir reject mask and use it to set IBI_SIR_REQ_REJECT. Signed-off-by: Aniket Reviewed-by: Jeremy Kerr Signed-off-by: Alexandre Belloni drivers/i3c/master/dw-i3c-master.c | 15 ++++++++------- drivers/i3c/master/dw-i3c-master.h | 2 +- 2 files changed, 9 insertions(+), 8 deletions(-) commit 8f2cb0327938c786cede21a542fb538ff243a03a Author: Aniket Date: Tue Jun 11 11:26:50 2024 +0000 i3c: dw: Fix clearing queue thld QUEUE_THLD_CTRL_IBI_STAT_MASK is repeated twice. Replace with QUEUE_THLD_CTRL_IBI_DATA_MASK. Signed-off-by: Aniket Signed-off-by: Alexandre Belloni drivers/i3c/master/dw-i3c-master.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit be90ae1ba14a83962b33c4d4c854ef081186b0e4 Author: Jarkko Nikula Date: Fri Jun 14 17:02:08 2024 +0300 i3c: mipi-i3c-hci: Fix number of DAT/DCT entries for HCI versions < 1.1 I was wrong about the TABLE_SIZE field description in the commit 0676bfebf576 ("i3c: mipi-i3c-hci: Fix DAT/DCT entry sizes"). For the MIPI I3C HCI versions 1.0 and earlier the TABLE_SIZE field in the registers DAT_SECTION_OFFSET and DCT_SECTION_OFFSET is indeed defined in DWORDs and not number of entries like it is defined in later versions. Where above fix allowed driver initialization to continue the wrongly interpreted TABLE_SIZE field leads variables DAT_entries being twice and DCT_entries four times as big as they really are. That in turn leads clearing the DAT table over the boundary in the dat_v1.c: hci_dat_v1_init(). So interprete the TABLE_SIZE field in DWORDs for HCI versions < 1.1 and fix number of DAT/DCT entries accordingly. Fixes: 0676bfebf576 ("i3c: mipi-i3c-hci: Fix DAT/DCT entry sizes") Signed-off-by: Jarkko Nikula Signed-off-by: Alexandre Belloni drivers/i3c/master/mipi-i3c-hci/core.c | 8 ++++++++ 1 file changed, 8 insertions(+) commit 9bc7501b0b90f4d0c34b97c14ff1f708ce7ad8f3 Author: Frank Li Date: Mon Jun 3 11:15:27 2024 -0400 i3c: master: svc: resend target address when get NACK According to I3C Spec 1.1.1, 11-Jun-2021, section: 5.1.2.2.3: If the Controller chooses to start an I3C Message with an I3C Dynamic Address, then special provisions shall be made because that same I3C Target may be initiating an IBI or a Controller Role Request. So, one of three things may happen: (skip 1, 2) 3. The Addresses match and the RnW bits also match, and so neither Controller nor Target will ACK since both are expecting the other side to provide ACK. As a result, each side might think it had "won" arbitration, but neither side would continue, as each would subsequently see that the other did not provide ACK. ... For either value of RnW: Due to the NACK, the Controller shall defer the Private Write or Private Read, and should typically transmit the Target ^^^^^^^^^^^^^^^^^^^ Address again after a Repeated START (i.e., the next one or any one prior ^^^^^^^^^^^^^ to a STOP in the Frame). Since the Address Header following a Repeated START is not arbitrated, the Controller will always win (see Section 5.1.2.2.4). Resend target address again if address is not 7E and controller get NACK. Reviewed-by: Miquel Raynal Signed-off-by: Frank Li Signed-off-by: Alexandre Belloni drivers/i3c/master/svc-i3c-master.c | 58 ++++++++++++++++++++++++++++--------- 1 file changed, 44 insertions(+), 14 deletions(-) commit 14e9283fb22d0d259820a5f05c6059678bab9ac5 Author: Chen Ni Date: Wed Jul 24 10:07:21 2024 +0800 erofs: convert comma to semicolon Replace a comma between expression statements by a semicolon. Signed-off-by: Chen Ni Link: https://lore.kernel.org/r/20240724020721.2389738-1-nichen@iscas.ac.cn Reviewed-by: Chao Yu Signed-off-by: Gao Xiang fs/erofs/decompressor_lzma.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 5d3bb77e5fce1d224b94da31abae0a7afed54735 Author: Gao Xiang Date: Tue Jul 23 15:30:24 2024 +0800 erofs: support multi-page folios for erofs_bread() If the requested page is part of the previous multi-page folio, there is no need to call read_mapping_folio() again. Also, get rid of the remaining one of page->index [1] in our codebase. [1] https://lore.kernel.org/r/Zp8fgUSIBGQ1TN0D@casper.infradead.org Cc: Matthew Wilcox Reviewed-by: Chao Yu Signed-off-by: Gao Xiang Link: https://lore.kernel.org/r/20240723073024.875290-1-hsiangkao@linux.alibaba.com fs/erofs/data.c | 30 ++++++++++++------------------ 1 file changed, 12 insertions(+), 18 deletions(-) commit 684b290abc774202ff88897648f24520f40c916b Author: Huang Xiaojia Date: Sat Jul 20 16:23:35 2024 +0800 erofs: add support for FS_IOC_GETFSSYSFSPATH FS_IOC_GETFSSYSFSPATH ioctl exposes /sys/fs path of a given filesystem, potentially standarizing sysfs reporting. This patch add support for FS_IOC_GETFSSYSFSPATH for erofs, "erofs/" will be outputted for bdev cases, "erofs/[domain_id,]" will be outputted for fscache cases. Signed-off-by: Huang Xiaojia Link: https://lore.kernel.org/r/20240720082335.441563-1-huangxiaojia2@huawei.com Reviewed-by: Chao Yu Signed-off-by: Gao Xiang fs/erofs/super.c | 16 ++++++++++++++++ 1 file changed, 16 insertions(+) commit 7dc5537c3f8be87e005f0844a7626c987914f8fd Author: Gao Xiang Date: Mon Jul 22 11:51:10 2024 +0800 erofs: fix race in z_erofs_get_gbuf() In z_erofs_get_gbuf(), the current task may be migrated to another CPU between `z_erofs_gbuf_id()` and `spin_lock(&gbuf->lock)`. Therefore, z_erofs_put_gbuf() will trigger the following issue which was found by stress test: <2>[772156.434168] kernel BUG at fs/erofs/zutil.c:58! .. <4>[772156.435007] <4>[772156.439237] CPU: 0 PID: 3078 Comm: stress Kdump: loaded Tainted: G E 6.10.0-rc7+ #2 <4>[772156.439239] Hardware name: Alibaba Cloud Alibaba Cloud ECS, BIOS 1.0.0 01/01/2017 <4>[772156.439241] pstate: 83400005 (Nzcv daif +PAN -UAO +TCO +DIT -SSBS BTYPE=--) <4>[772156.439243] pc : z_erofs_put_gbuf+0x64/0x70 [erofs] <4>[772156.439252] lr : z_erofs_lz4_decompress+0x600/0x6a0 [erofs] .. <6>[772156.445958] stress (3127): drop_caches: 1 <4>[772156.446120] Call trace: <4>[772156.446121] z_erofs_put_gbuf+0x64/0x70 [erofs] <4>[772156.446761] z_erofs_lz4_decompress+0x600/0x6a0 [erofs] <4>[772156.446897] z_erofs_decompress_queue+0x740/0xa10 [erofs] <4>[772156.447036] z_erofs_runqueue+0x428/0x8c0 [erofs] <4>[772156.447160] z_erofs_readahead+0x224/0x390 [erofs] .. Fixes: f36f3010f676 ("erofs: rename per-CPU buffers to global buffer pool and make it configurable") Cc: # 6.10+ Reviewed-by: Chunhai Guo Reviewed-by: Sandeep Dhavale Reviewed-by: Chao Yu Signed-off-by: Gao Xiang Link: https://lore.kernel.org/r/20240722035110.3456740-1-hsiangkao@linux.alibaba.com fs/erofs/zutil.c | 3 +++ 1 file changed, 3 insertions(+) commit 9c421ef3f6b30ab912eaaa3c3d20cfb921fd8c8f Author: Hongbo Li Date: Thu Jul 18 16:32:43 2024 +0800 erofs: support STATX_DIOALIGN Add support for STATX_DIOALIGN to EROFS, so that direct I/O alignment restrictions are exposed to userspace in a generic way. [Before] ``` ./statx_test /mnt/erofs/testfile statx(/mnt/erofs/testfile) = 0 dio mem align:0 dio offset align:0 ``` [After] ``` ./statx_test /mnt/erofs/testfile statx(/mnt/erofs/testfile) = 0 dio mem align:512 dio offset align:512 ``` Signed-off-by: Hongbo Li Reviewed-by: Chao Yu Signed-off-by: Gao Xiang Link: https://lore.kernel.org/r/20240718083243.2485437-1-hsiangkao@linux.alibaba.com fs/erofs/inode.c | 19 +++++++++++++++++-- 1 file changed, 17 insertions(+), 2 deletions(-) commit a47f3320bb4ba6714abe8dddb36399367b491358 Author: Johan Hovold Date: Tue Jul 9 09:31:32 2024 +0200 wifi: ath12k: fix soft lockup on suspend The ext interrupts are enabled when the firmware has been started, but this may never happen, for example, if the board configuration file is missing. When the system is later suspended, the driver unconditionally tries to disable interrupts, which results in an irq disable imbalance and causes the driver to spin indefinitely in napi_synchronize(). Make sure that the interrupts have been enabled before attempting to disable them. Fixes: d889913205cf ("wifi: ath12k: driver for Qualcomm Wi-Fi 7 devices") Cc: stable@vger.kernel.org # 6.3 Signed-off-by: Johan Hovold Acked-by: Jeff Johnson Link: https://patch.msgid.link/20240709073132.9168-1-johan+linaro@kernel.org Signed-off-by: Johannes Berg drivers/net/wireless/ath/ath12k/pci.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) commit 6557a28f3e3a54cff4f0dcdd1dfa649b26557ab3 Author: Sean Wang Date: Thu Jul 18 16:46:33 2024 -0700 wifi: mt76: mt7921: fix null pointer access in mt792x_mac_link_bss_remove Fix null pointer access in mt792x_mac_link_bss_remove. To prevent null pointer access, we should assign the vif to bss_conf in mt7921_add_interface. This ensures that subsequent operations on the BSS can properly reference the correct vif. [ T843] Call Trace: [ T843] [ T843] ? __die+0x1e/0x60 [ T843] ? page_fault_oops+0x157/0x450 [ T843] ? srso_alias_return_thunk+0x5/0xfbef5 [ T843] ? srso_alias_return_thunk+0x5/0xfbef5 [ T843] ? search_bpf_extables+0x5a/0x80 [ T843] ? srso_alias_return_thunk+0x5/0xfbef5 [ T843] ? exc_page_fault+0x2bb/0x670 [ T843] ? srso_alias_return_thunk+0x5/0xfbef5 [ T843] ? lock_timer_base+0x71/0x90 [ T843] ? asm_exc_page_fault+0x26/0x30 [ T843] ? mt792x_mac_link_bss_remove+0x24/0x110 [mt792x_lib] [ T843] ? mt792x_remove_interface+0x6e/0x90 [mt792x_lib] [ T843] ? ieee80211_do_stop+0x507/0x7e0 [mac80211] [ T843] ? ieee80211_stop+0x53/0x190 [mac80211] [ T843] ? __dev_close_many+0xa5/0x120 [ T843] ? __dev_change_flags+0x18c/0x220 [ T843] ? dev_change_flags+0x21/0x60 [ T843] ? do_setlink+0xdf9/0x11d0 [ T843] ? srso_alias_return_thunk+0x5/0xfbef5 [ T843] ? srso_alias_return_thunk+0x5/0xfbef5 [ T843] ? security_sock_rcv_skb+0x33/0x50 [ T843] ? srso_alias_return_thunk+0x5/0xfbef5 [ T843] ? srso_alias_return_thunk+0x5/0xfbef5 [ T843] ? __nla_validate_parse+0x61/0xd10 [ T843] ? srso_alias_return_thunk+0x5/0xfbef5 [ T843] ? genl_done+0x53/0x80 [ T843] ? srso_alias_return_thunk+0x5/0xfbef5 [ T843] ? netlink_dump+0x357/0x410 [ T843] ? __rtnl_newlink+0x5d6/0x980 [ T843] ? srso_alias_return_thunk+0x5/0xfbef5 [ T843] ? genl_family_rcv_msg_dumpit+0xdf/0xf0 [ T843] ? srso_alias_return_thunk+0x5/0xfbef5 [ T843] ? __kmalloc_cache_noprof+0x44/0x210 [ T843] ? rtnl_newlink+0x42/0x60 [ T843] ? rtnetlink_rcv_msg+0x152/0x3f0 [ T843] ? mptcp_pm_nl_dump_addr+0x180/0x180 [ T843] ? rtnl_calcit.isra.0+0x130/0x130 [ T843] ? netlink_rcv_skb+0x56/0x100 [ T843] ? netlink_unicast+0x199/0x290 [ T843] ? netlink_sendmsg+0x21d/0x490 [ T843] ? __sock_sendmsg+0x78/0x80 [ T843] ? ____sys_sendmsg+0x23f/0x2e0 [ T843] ? srso_alias_return_thunk+0x5/0xfbef5 [ T843] ? copy_msghdr_from_user+0x68/0xa0 [ T843] ? ___sys_sendmsg+0x81/0xd0 [ T843] ? srso_alias_return_thunk+0x5/0xfbef5 [ T843] ? crng_fast_key_erasure+0xbc/0xf0 [ T843] ? srso_alias_return_thunk+0x5/0xfbef5 [ T843] ? get_random_bytes_user+0x126/0x140 [ T843] ? srso_alias_return_thunk+0x5/0xfbef5 [ T843] ? __fdget+0xb1/0xe0 [ T843] ? __sys_sendmsg+0x56/0xa0 [ T843] ? srso_alias_return_thunk+0x5/0xfbef5 [ T843] ? do_syscall_64+0x5f/0x170 [ T843] ? entry_SYSCALL_64_after_hwframe+0x55/0x5d [ T843] Fixes: 1541d63c5fe2 ("wifi: mt76: mt7925: add mt7925_mac_link_bss_remove to remove per-link BSS") Reported-by: Bert Karwatzki Closes: https://lore.kernel.org/linux-wireless/2fee61f8c903d02a900ca3188c3742c7effd102e.camel@web.de/#b Signed-off-by: Sean Wang Tested-by: Bert Karwatzki Link: https://patch.msgid.link/20240718234633.12737-1-sean.wang@kernel.org Signed-off-by: Johannes Berg drivers/net/wireless/mediatek/mt76/mt7921/main.c | 1 + 1 file changed, 1 insertion(+) commit 189d7aae8f5a100b0db8b302debbd445475d01e6 Author: Baochen Qiang Date: Mon Jul 22 11:33:32 2024 +0800 wifi: ath12k: fix reusing outside iterator in ath12k_wow_vif_set_wakeups() Smatch throws below warning: drivers/net/wireless/ath/ath12k/wow.c:434 ath12k_wow_vif_set_wakeups() warn: reusing outside iterator: 'i' drivers/net/wireless/ath/ath12k/wow.c 411 default: 412 break; 413 } 414 415 for (i = 0; i < wowlan->n_patterns; i++) { ^^^^^^^^^^^^^^^^^^^^^^ Here we loop until ->n_patterns 416 const struct cfg80211_pkt_pattern *eth_pattern = &patterns[i]; 417 struct ath12k_pkt_pattern new_pattern = {}; 418 419 if (WARN_ON(eth_pattern->pattern_len > WOW_MAX_PATTERN_SIZE)) 420 return -EINVAL; 421 422 if (ar->ab->wow.wmi_conf_rx_decap_mode == 423 ATH12K_HW_TXRX_NATIVE_WIFI) { 424 ath12k_wow_convert_8023_to_80211(ar, eth_pattern, 425 &new_pattern); 426 427 if (WARN_ON(new_pattern.pattern_len > WOW_MAX_PATTERN_SIZE)) 428 return -EINVAL; 429 } else { 430 memcpy(new_pattern.pattern, eth_pattern->pattern, 431 eth_pattern->pattern_len); 432 433 /* convert bitmask to bytemask */ --> 434 for (i = 0; i < eth_pattern->pattern_len; i++) 435 if (eth_pattern->mask[i / 8] & BIT(i % 8)) 436 new_pattern.bytemask[i] = 0xff; This loop re-uses i and the loop ends with i == eth_pattern->pattern_len. This looks like a bug. Change to use a new iterator 'j' for the inner loop to fix it. Tested-on: WCN7850 hw2.0 PCI WLAN.HMT.1.0-03427-QCAHMTSWPL_V1.0_V2.0_SILICONZ-1.15378.4 Fixes: 4a3c212eee0e ("wifi: ath12k: add basic WoW functionalities") Reported-by: Dan Carpenter Closes: https://lore.kernel.org/all/d4975b95-9c43-45af-a0ab-80253f18c7f2@stanley.mountain/ Signed-off-by: Baochen Qiang Acked-by: Jeff Johnson Link: https://patch.msgid.link/20240722033332.6273-1-quic_bqiang@quicinc.com Signed-off-by: Johannes Berg drivers/net/wireless/ath/ath12k/wow.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) commit 6873cc4416078202882691b424fcca5b5fb1a94d Author: Johannes Berg Date: Wed Jul 24 13:29:12 2024 +0200 wifi: cfg80211: correct S1G beacon length calculation The minimum header length calculation (equivalent to the start of the elements) for the S1G long beacon erroneously required only up to the start of u.s1g_beacon rather than the start of u.s1g_beacon.variable. Fix that, and also shuffle the branches around a bit to not assign useless values that are overwritten later. Reported-by: syzbot+0f3afa93b91202f21939@syzkaller.appspotmail.com Fixes: 9eaffe5078ca ("cfg80211: convert S1G beacon to scan results") Link: https://patch.msgid.link/20240724132912.9662972db7c1.I8779675b5bbda4994cc66f876b6b87a2361c3c0b@changeid Signed-off-by: Johannes Berg net/wireless/scan.c | 11 ++++++++--- 1 file changed, 8 insertions(+), 3 deletions(-) commit baeaabf970b9a90999f62ae27edf63f6cb86c023 Author: Veerendranath Jakkam Date: Wed Jul 24 18:23:27 2024 +0530 wifi: cfg80211: fix reporting failed MLO links status with cfg80211_connect_done Individual MLO links connection status is not copied to EVENT_CONNECT_RESULT data while processing the connect response information in cfg80211_connect_done(). Due to this failed links are wrongly indicated with success status in EVENT_CONNECT_RESULT. To fix this, copy the individual MLO links status to the EVENT_CONNECT_RESULT data. Fixes: 53ad07e9823b ("wifi: cfg80211: support reporting failed links") Signed-off-by: Veerendranath Jakkam Reviewed-by: Carlos Llamas Link: https://patch.msgid.link/20240724125327.3495874-1-quic_vjakkam@quicinc.com [commit message editorial changes] Signed-off-by: Johannes Berg net/wireless/sme.c | 1 + 1 file changed, 1 insertion(+) commit 8f4fa0876231c426f880a2bff25ac49fac67d805 Author: Johannes Berg Date: Thu Jul 25 18:48:36 2024 +0200 wifi: mac80211: use monitor sdata with driver only if desired In commit 0d9c2beed116 ("wifi: mac80211: fix monitor channel with chanctx emulation") I changed mac80211 to always have an internal monitor_sdata to have something to have the chanctx bound to. However, if the driver didn't also have the WANT_MONITOR flag this would cause mac80211 to allocate it without telling the driver (which was intentional) but also use it for later APIs to the driver without it ever having known about it which was _not_ intentional. Check through the code and only use the monitor_sdata in the relevant places (TX, MU-MIMO follow settings, TX power, and interface iteration) when the WANT_MONITOR flag is set. Cc: stable@vger.kernel.org Fixes: 0d9c2beed116 ("wifi: mac80211: fix monitor channel with chanctx emulation") Reported-by: ZeroBeat Closes: https://bugzilla.kernel.org/show_bug.cgi?id=219086 Tested-by: Lorenzo Bianconi Link: https://patch.msgid.link/20240725184836.25d334157a8e.I02574086da2c5cf0e18264ce5807db6f14ffd9c0@changeid Signed-off-by: Johannes Berg net/mac80211/cfg.c | 7 +++++-- net/mac80211/tx.c | 5 +++-- net/mac80211/util.c | 2 +- 3 files changed, 9 insertions(+), 5 deletions(-) commit 2191a54f63225b548fd8346be3611c3219a24738 Author: Eric Dumazet Date: Thu Jul 25 09:27:45 2024 +0000 sched: act_ct: take care of padding in struct zones_ht_key Blamed commit increased lookup key size from 2 bytes to 16 bytes, because zones_ht_key got a struct net pointer. Make sure rhashtable_lookup() is not using the padding bytes which are not initialized. BUG: KMSAN: uninit-value in rht_ptr_rcu include/linux/rhashtable.h:376 [inline] BUG: KMSAN: uninit-value in __rhashtable_lookup include/linux/rhashtable.h:607 [inline] BUG: KMSAN: uninit-value in rhashtable_lookup include/linux/rhashtable.h:646 [inline] BUG: KMSAN: uninit-value in rhashtable_lookup_fast include/linux/rhashtable.h:672 [inline] BUG: KMSAN: uninit-value in tcf_ct_flow_table_get+0x611/0x2260 net/sched/act_ct.c:329 rht_ptr_rcu include/linux/rhashtable.h:376 [inline] __rhashtable_lookup include/linux/rhashtable.h:607 [inline] rhashtable_lookup include/linux/rhashtable.h:646 [inline] rhashtable_lookup_fast include/linux/rhashtable.h:672 [inline] tcf_ct_flow_table_get+0x611/0x2260 net/sched/act_ct.c:329 tcf_ct_init+0xa67/0x2890 net/sched/act_ct.c:1408 tcf_action_init_1+0x6cc/0xb30 net/sched/act_api.c:1425 tcf_action_init+0x458/0xf00 net/sched/act_api.c:1488 tcf_action_add net/sched/act_api.c:2061 [inline] tc_ctl_action+0x4be/0x19d0 net/sched/act_api.c:2118 rtnetlink_rcv_msg+0x12fc/0x1410 net/core/rtnetlink.c:6647 netlink_rcv_skb+0x375/0x650 net/netlink/af_netlink.c:2550 rtnetlink_rcv+0x34/0x40 net/core/rtnetlink.c:6665 netlink_unicast_kernel net/netlink/af_netlink.c:1331 [inline] netlink_unicast+0xf52/0x1260 net/netlink/af_netlink.c:1357 netlink_sendmsg+0x10da/0x11e0 net/netlink/af_netlink.c:1901 sock_sendmsg_nosec net/socket.c:730 [inline] __sock_sendmsg+0x30f/0x380 net/socket.c:745 ____sys_sendmsg+0x877/0xb60 net/socket.c:2597 ___sys_sendmsg+0x28d/0x3c0 net/socket.c:2651 __sys_sendmsg net/socket.c:2680 [inline] __do_sys_sendmsg net/socket.c:2689 [inline] __se_sys_sendmsg net/socket.c:2687 [inline] __x64_sys_sendmsg+0x307/0x4a0 net/socket.c:2687 x64_sys_call+0x2dd6/0x3c10 arch/x86/include/generated/asm/syscalls_64.h:47 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x1e0 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f Local variable key created at: tcf_ct_flow_table_get+0x4a/0x2260 net/sched/act_ct.c:324 tcf_ct_init+0xa67/0x2890 net/sched/act_ct.c:1408 Fixes: 88c67aeb1407 ("sched: act_ct: add netns into the key of tcf_ct_flow_table") Reported-by: syzbot+1b5e4e187cc586d05ea0@syzkaller.appspotmail.com Signed-off-by: Eric Dumazet Cc: Xin Long Reviewed-by: Simon Horman Reviewed-by: Xin Long Signed-off-by: David S. Miller net/sched/act_ct.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) commit 08f3a5c38087d1569e982a121aad1e6acbf145ce Author: Ma Ke Date: Thu Jul 25 10:29:42 2024 +0800 net: usb: sr9700: fix uninitialized variable use in sr_mdio_read It could lead to error happen because the variable res is not updated if the call to sr_share_read_word returns an error. In this particular case error code was returned and res stayed uninitialized. Same issue also applies to sr_read_reg. This can be avoided by checking the return value of sr_share_read_word and sr_read_reg, and propagating the error if the read operation failed. Found by code review. Cc: stable@vger.kernel.org Fixes: c9b37458e956 ("USB2NET : SR9700 : One chip USB 1.1 USB2NET SR9700Device Driver Support") Signed-off-by: Ma Ke Reviewed-by: Shigeru Yoshida Reviewed-by: Hariprasad Kelam Signed-off-by: David S. Miller drivers/net/usb/sr9700.c | 11 +++++++++-- 1 file changed, 9 insertions(+), 2 deletions(-) commit 0823dc64586ba5ea13a7d200a5d33e4c5fa45950 Author: Jason Wang Date: Mon Jul 1 11:31:59 2024 +0800 vhost-vdpa: switch to use vmf_insert_pfn() in the fault handler remap_pfn_page() should not be called in the fault handler as it may change the vma->flags which may trigger lockdep warning since the vma write lock is not held. Actually there's no need to modify the vma->flags as it has been set in the mmap(). So this patch switches to use vmf_insert_pfn() instead. Reported-by: Dragos Tatulea Tested-by: Dragos Tatulea Fixes: ddd89d0a059d ("vhost_vdpa: support doorbell mapping via mmap") Cc: stable@vger.kernel.org Signed-off-by: Jason Wang Message-Id: <20240701033159.18133-1-jasowang@redhat.com> Signed-off-by: Michael S. Tsirkin Reviewed-by: Michal Kubiak drivers/vhost/vdpa.c | 8 +------- 1 file changed, 1 insertion(+), 7 deletions(-) commit 75c3e8a26a35d4f3eee299b3cc7e465f166f4e2d Author: Ian Forbes Date: Mon Jun 24 15:59:51 2024 -0500 drm/vmwgfx: Trigger a modeset when the screen moves When multi-monitor is cycled the X,Y position of the Screen Target will likely change but the resolution will not. We need to trigger a modeset when this occurs in order to recreate the Screen Target with the correct X,Y position. Fixes a bug where multiple displays are shown in a single scrollable host window rather than in 2+ windows on separate host displays. Fixes: 426826933109 ("drm/vmwgfx: Filter modes which exceed graphics memory") Signed-off-by: Ian Forbes Signed-off-by: Zack Rusin Link: https://patchwork.freedesktop.org/patch/msgid/20240624205951.23343-1-ian.forbes@broadcom.com drivers/gpu/drm/vmwgfx/vmwgfx_stdu.c | 29 ++++++++++++++++++++++++++++- 1 file changed, 28 insertions(+), 1 deletion(-) commit d4ef5d2b7ee0cbb5f2d864716140366a618400d6 Merge: 86f259cb7ca1 5659b0c93a1e Author: Dave Airlie Date: Fri Jul 26 09:51:59 2024 +1000 Merge tag 'amd-drm-fixes-6.11-2024-07-25' of https://gitlab.freedesktop.org/agd5f/linux into drm-next amd-drm-fixes-6.11-2024-07-25: amdgpu: - SDMA 5.2 workaround - GFX12 fixes - Uninitialized variable fix - VCN/JPEG 4.0.3 fixes - Misc display fixes - RAS fixes - VCN4/5 harvest fix - GPU reset fix Signed-off-by: Dave Airlie From: Alex Deucher Link: https://patchwork.freedesktop.org/patch/msgid/20240725202900.2155572-1-alexander.deucher@amd.com commit 86f259cb7ca13a7b0a4b9314f01668118c2aba59 Merge: a37cd98cd56e b6f7d984ebf8 Author: Dave Airlie Date: Fri Jul 26 09:51:10 2024 +1000 Merge tag 'drm-misc-next-fixes-2024-07-25' of https://gitlab.freedesktop.org/drm/misc/kernel into drm-next A single fix for a panel compatible Signed-off-by: Dave Airlie From: Maxime Ripard Link: https://patchwork.freedesktop.org/patch/msgid/20240725-frisky-wren-of-tact-f5f504@houat commit 07c10cff663e54dadff7cfb6cf09e266456ed073 Merge: 98ba1d931f61 f96aae91b0d2 Author: Jakub Kicinski Date: Thu Jul 25 16:23:49 2024 -0700 Merge branch 'ethtool-rss-small-fixes-to-spec-and-get' Jakub Kicinski says: ==================== ethtool: rss: small fixes to spec and GET Two small fixes to the ethtool RSS_GET over Netlink. Spec is a bit inaccurate and responses miss an identifier. ==================== Link: https://patch.msgid.link/20240724234249.2621109-1-kuba@kernel.org Signed-off-by: Jakub Kicinski commit f96aae91b0d260f682e630e092ef70a05a718a43 Author: Jakub Kicinski Date: Wed Jul 24 16:42:49 2024 -0700 ethtool: rss: echo the context number back The response to a GET request in Netlink should fully identify the queried object. RSS_GET accepts context id as an input, so it must echo that attribute back to the response. After (assuming context 1 has been created): $ ./cli.py --spec netlink/specs/ethtool.yaml \ --do rss-get \ --json '{"header": {"dev-index": 2}, "context": 1}' {'context': 1, 'header': {'dev-index': 2, 'dev-name': 'eth0'}, [...] Fixes: 7112a04664bf ("ethtool: add netlink based get rss support") Acked-by: Paolo Abeni Reviewed-by: Joe Damato Link: https://patch.msgid.link/20240724234249.2621109-3-kuba@kernel.org Signed-off-by: Jakub Kicinski Documentation/netlink/specs/ethtool.yaml | 1 + Documentation/networking/ethtool-netlink.rst | 1 + net/ethtool/rss.c | 8 +++++++- 3 files changed, 9 insertions(+), 1 deletion(-) commit a40c7a24f97edda025f53cfe8f0bc6a6e3c12fa6 Author: Jakub Kicinski Date: Wed Jul 24 16:42:48 2024 -0700 netlink: specs: correct the spec of ethtool The spec for Ethtool is a bit inaccurate. We don't currently support dump. Context is only accepted as input and not echoed to output (which is a separate bug). Fixes: a353318ebf24 ("tools: ynl: populate most of the ethtool spec") Acked-by: Paolo Abeni Reviewed-by: Joe Damato Link: https://patch.msgid.link/20240724234249.2621109-2-kuba@kernel.org Signed-off-by: Jakub Kicinski Documentation/netlink/specs/ethtool.yaml | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) commit 98ba1d931f611e8f8f519c0405fa0a1a76554bfa Author: Pavan Chebbi Date: Wed Jul 24 15:21:06 2024 -0700 bnxt_en: Fix RSS logic in __bnxt_reserve_rings() In __bnxt_reserve_rings(), the existing code unconditionally sets the default RSS indirection table to default if netif_is_rxfh_configured() returns false. This used to be correct before we added RSS contexts support. For example, if the user is changing the number of ethtool channels, we will enter this path to reserve the new number of rings. We will then set the RSS indirection table to default to cover the new number of rings if netif_is_rxfh_configured() is false. Now, with RSS contexts support, if the user has added or deleted RSS contexts, we may now enter this path to reserve the new number of VNICs. However, netif_is_rxfh_configured() will not return the correct state if we are still in the middle of set_rxfh(). So the existing code may set the indirection table of the default RSS context to default by mistake. Fix it to check if the reservation of the RX rings is changing. Only check netif_is_rxfh_configured() if it is changing. RX rings will not change in the middle of set_rxfh() and this will fix the issue. Fixes: b3d0083caf9a ("bnxt_en: Support RSS contexts in ethtool .{get|set}_rxfh()") Reported-and-tested-by: Jakub Kicinski Link: https://lore.kernel.org/20240625010210.2002310-1-kuba@kernel.org Reviewed-by: Andy Gospodarek Signed-off-by: Pavan Chebbi Signed-off-by: Michael Chan Link: https://patch.msgid.link/20240724222106.147744-1-michael.chan@broadcom.com Signed-off-by: Jakub Kicinski drivers/net/ethernet/broadcom/bnxt/bnxt.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) commit de9f46cb0044a9b9f825d7695ae235863461dc00 Author: Filipe Manana Date: Thu Jul 11 13:33:23 2024 +0100 btrfs: fix corrupt read due to bad offset of a compressed extent map If we attempt to insert a compressed extent map that has a range that overlaps another extent map we have in the inode's extent map tree, we can end up with an incorrect offset after adjusting the new extent map at merge_extent_mapping() because we don't update the extent map's offset. For example consider the following scenario: 1) We have a file extent item for a compressed extent covering the file range [108K, 144K) and currently there's no corresponding extent map in the inode's extent map tree; 2) The inode's size is 141K; 3) We have an encoded write (compressed) into the file range [120K, 128K), which overlaps the existing file extent item. The encoded write creates a matching extent map, adds it to the inode's extent map tree and creates an ordered extent for it. Note that the corresponding file extent item is added to the subvolume tree only when the ordered extent completes (when executing btrfs_finish_one_ordered()); 4) We have a write into the file range [160K, 164K). This writes increases the i_size of the file, and there's a hole between the current i_size (141K) and the start offset of this write, and since the old i_size is in the middle of the block [140K, 144K), we have to write zeroes to the range [141K, 144K) (3072 bytes) and therefore dirty that page. We then call btrfs_set_extent_delalloc() with a start offset of 140K. We then end up at btrfs_find_new_delalloc_bytes() which will call btrfs_get_extent() for the range [140K, 144K); 5) The btrfs_get_extent() doesn't find any extent map in the inode's extent map tree covering the range [140K, 144K), so it searches the subvolume tree for any file extent items covering that range. There it finds the file extent item for the range [108K, 144K), creates a compressed extent map for that range and then calls btrfs_add_extent_mapping() with that extent map and passes the range [140K, 144K) via the "start" and "len" parameters; 6) The call to add_extent_mapping() done by btrfs_add_extent_mapping() fails with -EEXIST because there's an extent map, created at step 2 for the [120K, 128K) range, that covers that overlaps with the range of the given extent map ([108K, 144K)). Then it does a lookup for extent map from step 2 add calls merge_extent_mapping() to adjust the input extent map ([108K, 144K)). That adjust the extent map to a start offset of 128K and a length of 16K (starting just after the extent map from step 2), but it does not update the offset field of the extent map, leaving it with a value of zero instead of updating to a value of 20K (128K - 108K = 20K). As a result any read for the range [128K, 144K) can return incorrect data since we read from a wrong section of the extent (unless both the correct and incorrect ranges happen to have the same data). So fix this by changing merge_extent_mapping() to update the extent map's offset even if it's compressed. Also add a test case to the self tests. This didn't happen before the patchset that does big changes in the extent map structure (which includes the commit in the Fixes tag below) because we kept track of the original start offset in the extent map (member "orig_start") so we could always calculate the correct offset by subtracting that offset from the start offset. A test case for fstests that triggered this problem using send/receive with compressed writes will be added soon. Fixes: 3d2ac9922465 ("btrfs: introduce new members for extent_map") Reviewed-by: Qu Wenruo Signed-off-by: Filipe Manana Signed-off-by: David Sterba fs/btrfs/extent_map.c | 2 +- fs/btrfs/tests/extent-map-tests.c | 99 +++++++++++++++++++++++++++++++++++++++ 2 files changed, 100 insertions(+), 1 deletion(-) commit f333a3c7e8323499aa65038e77fe8f3199d4e283 Author: Qu Wenruo Date: Mon Jul 15 16:07:07 2024 +0930 btrfs: tree-checker: validate dref root and objectid [CORRUPTION] There is a bug report that btrfs flips RO due to a corruption in the extent tree, the involved dumps looks like this: item 188 key (402811572224 168 4096) itemoff 14598 itemsize 79 extent refs 3 gen 3678544 flags 1 ref#0: extent data backref root 13835058055282163977 objectid 281473384125923 offset 81432576 count 1 ref#1: shared data backref parent 1947073626112 count 1 ref#2: shared data backref parent 1156030103552 count 1 BTRFS critical (device vdc1: state EA): unable to find ref byte nr 402811572224 parent 0 root 265 owner 28703026 offset 81432576 slot 189 BTRFS error (device vdc1: state EA): failed to run delayed ref for logical 402811572224 num_bytes 4096 type 178 action 2 ref_mod 1: -2 [CAUSE] The corrupted entry is ref#0 of item 188. The root number 13835058055282163977 is beyond the upper limit for root items (the current limit is 1 << 48), and the objectid also looks suspicious. Only the offset and count is correct. [ENHANCEMENT] Although it's still unknown why we have such many bytes corrupted randomly, we can still enhance the tree-checker for data backrefs by: - Validate the root value For now there should only be 3 types of roots can have data backref: * subvolume trees * data reloc trees * root tree Only for v1 space cache - validate the objectid value The objectid should be a valid inode number. Hopefully we can catch such problem in the future with the new checkers. Reported-by: Kai Krakow Link: https://lore.kernel.org/linux-btrfs/CAMthOuPjg5RDT-G_LXeBBUUtzt3cq=JywF+D1_h+JYxe=WKp-Q@mail.gmail.com/#t Reviewed-by: Filipe Manana Signed-off-by: Qu Wenruo Reviewed-by: David Sterba Signed-off-by: David Sterba fs/btrfs/tree-checker.c | 47 +++++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 47 insertions(+) commit a37cd98cd56e2c53d77d9c45cd4b7b3d91916df7 Merge: 627a24f5f25d 26720dd2b5a1 Author: Dave Airlie Date: Fri Jul 26 06:41:02 2024 +1000 Merge tag 'drm-intel-next-fixes-2024-07-25' of https://gitlab.freedesktop.org/drm/i915/kernel into drm-next - Do not consider preemption during execlists_dequeue for gen8 [gt] (Nitin Gote) - Allow NULL memory region (Jonathan Cavitt) Signed-off-by: Dave Airlie From: Tvrtko Ursulin Link: https://patchwork.freedesktop.org/patch/msgid/ZqICQzyzm/6hDWy4@linux commit 1722389b0d863056d78287a120a1d6cadb8d4f7b Merge: 8bf100092d60 af65ea42bd1d Author: Linus Torvalds Date: Thu Jul 25 13:32:25 2024 -0700 Merge tag 'net-6.11-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net Pull networking fixes from Jakub Kicinski: "Including fixes from bpf and netfilter. A lot of networking people were at a conference last week, busy catching COVID, so relatively short PR. Current release - regressions: - tcp: process the 3rd ACK with sk_socket for TFO and MPTCP Current release - new code bugs: - l2tp: protect session IDR and tunnel session list with one lock, make sure the state is coherent to avoid a warning - eth: bnxt_en: update xdp_rxq_info in queue restart logic - eth: airoha: fix location of the MBI_RX_AGE_SEL_MASK field Previous releases - regressions: - xsk: require XDP_UMEM_TX_METADATA_LEN to actuate tx_metadata_len, the field reuses previously un-validated pad Previous releases - always broken: - tap/tun: drop short frames to prevent crashes later in the stack - eth: ice: add a per-VF limit on number of FDIR filters - af_unix: disable MSG_OOB handling for sockets in sockmap/sockhash" * tag 'net-6.11-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net: (34 commits) tun: add missing verification for short frame tap: add missing verification for short frame mISDN: Fix a use after free in hfcmulti_tx() gve: Fix an edge case for TSO skb validity check bnxt_en: update xdp_rxq_info in queue restart logic tcp: process the 3rd ACK with sk_socket for TFO/MPTCP selftests/bpf: Add XDP_UMEM_TX_METADATA_LEN to XSK TX metadata test xsk: Require XDP_UMEM_TX_METADATA_LEN to actuate tx_metadata_len bpf: Fix a segment issue when downgrading gso_size net: mediatek: Fix potential NULL pointer dereference in dummy net_device handling MAINTAINERS: make Breno the netconsole maintainer MAINTAINERS: Update bonding entry net: nexthop: Initialize all fields in dumped nexthops net: stmmac: Correct byte order of perfect_match selftests: forwarding: skip if kernel not support setting bridge fdb learning limit tipc: Return non-zero value from tipc_udp_addr2str() on error netfilter: nft_set_pipapo_avx2: disable softinterrupts ice: Fix recipe read procedure ice: Add a per-VF limit on number of FDIR filters net: bonding: correctly annotate RCU in bond_should_notify_peers() ... commit 8bf100092d60bf586bbc1a3a2cd833bb212d9d53 Merge: b485625078ca a930fde94ae5 Author: Linus Torvalds Date: Thu Jul 25 13:18:41 2024 -0700 Merge tag 'printk-for-6.11-trivial' of git://git.kernel.org/pub/scm/linux/kernel/git/printk/linux Pull printk updates from Petr Mladek: - trivial printk changes The bigger "real" printk work is still being discussed. * tag 'printk-for-6.11-trivial' of git://git.kernel.org/pub/scm/linux/kernel/git/printk/linux: vsprintf: add missing MODULE_DESCRIPTION() macro printk: Rename console_replay_all() and update context commit b485625078cab3b824a84ce185b6e73733704b5b Merge: bba959f477f2 78eb4ea25cd5 Author: Linus Torvalds Date: Thu Jul 25 12:58:36 2024 -0700 Merge tag 'constfy-sysctl-6.11-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/sysctl/sysctl Pull sysctl constification from Joel Granados: "Treewide constification of the ctl_table argument of proc_handlers using a coccinelle script and some manual code formatting fixups. This is a prerequisite to moving the static ctl_table structs into read-only data section which will ensure that proc_handler function pointers cannot be modified" * tag 'constfy-sysctl-6.11-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/sysctl/sysctl: sysctl: treewide: constify the ctl_table argument of proc_handlers commit bba959f477f2f4a48ab72eda2902db706bbc3793 Merge: 9b2199365487 ae835a96d72c Author: Linus Torvalds Date: Thu Jul 25 12:55:21 2024 -0700 Merge tag 'efi-fixes-for-v6.11-1' of git://git.kernel.org/pub/scm/linux/kernel/git/efi/efi Pull EFI fixes from Ard Biesheuvel: - Wipe screen_info after allocating it from the heap - used by arm32 and EFI zboot, other EFI architectures allocate it statically - Revert to allocating boot_params from the heap on x86 when entering via the native PE entrypoint, to work around a regression on older Dell hardware * tag 'efi-fixes-for-v6.11-1' of git://git.kernel.org/pub/scm/linux/kernel/git/efi/efi: x86/efistub: Revert to heap allocated boot_params for PE entrypoint efi/libstub: Zero initialize heap allocated struct screen_info commit 9b21993654871eda57dfeeee4739fea797a50b1e Merge: 28e7241cb857 9bccbe7b2087 Author: Linus Torvalds Date: Thu Jul 25 12:48:42 2024 -0700 Merge tag 'kgdb-6.11-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/danielt/linux Pull kgdb updates from Daniel Thompson: "Three small changes this cycle: - Clean up an architecture abstraction that is no longer needed because all the architectures have converged. - Actually use the prompt argument to kdb_position_cursor() instead of ignoring it (functionally this fix is a nop but that was due to luck rather than good judgement) - Fix a -Wformat-security warning" * tag 'kgdb-6.11-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/danielt/linux: kdb: Get rid of redundant kdb_curr_task() kdb: Use the passed prompt in kdb_position_cursor() kdb: address -Wformat-security warnings commit 28e7241cb857415fbc8d8d962e2b423c3842e9f9 Merge: f6464295247d 2c716cf17ede Author: Linus Torvalds Date: Thu Jul 25 12:41:53 2024 -0700 Merge tag 'mips_6.11_1' of git://git.kernel.org/pub/scm/linux/kernel/git/mips/linux Pull MIPS updates from Thomas Bogendoerfer: - Use improved timer sync for Loongson64 - Fix address of GCR_ACCESS register - Add missing MODULE_DESCRIPTION * tag 'mips_6.11_1' of git://git.kernel.org/pub/scm/linux/kernel/git/mips/linux: mips: sibyte: add missing MODULE_DESCRIPTION() macro MIPS: SMP-CPS: Fix address for GCR_ACCESS register for CM3 and later MIPS: Loongson64: Switch to SYNC_R4K commit f6464295247dd04b2070e110f0d5659577e393b9 Merge: f9bcc61ad1fb cbade823342c Author: Linus Torvalds Date: Thu Jul 25 12:37:42 2024 -0700 Merge tag 'parisc-for-6.11-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/deller/parisc-linux Pull parisc updates from Helge Deller: "The gettimeofday() and clock_gettime() syscalls are now available as vDSO functions, and Dave added a patch which allows to use NVMe cards in the PCI slots as fast and easy alternative to SCSI discs. Summary: - add gettimeofday() and clock_gettime() vDSO functions - enable PCI_MSI_ARCH_FALLBACKS to allow PCI to PCIe bridge adaptor with PCIe NVME card to function in parisc machines - allow users to reduce kernel unaligned runtime warnings - minor code cleanups" * tag 'parisc-for-6.11-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/deller/parisc-linux: parisc: Add support for CONFIG_SYSCTL_ARCH_UNALIGN_NO_WARN parisc: Use max() to calculate parisc_tlb_flush_threshold parisc: Fix warning at drivers/pci/msi/msi.h:121 parisc: Add 64-bit gettimeofday() and clock_gettime() vDSO functions parisc: Add 32-bit gettimeofday() and clock_gettime() vDSO functions parisc: Clean up unistd.h file commit f9bcc61ad1fbe7dbc6bdd71d31254e429100a009 Merge: c2a96b7f187f 98ff534ec2cd Author: Linus Torvalds Date: Thu Jul 25 12:33:08 2024 -0700 Merge tag 'uml-for-linus-6.11-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/uml/linux Pull UML updates from Richard Weinberger: - Support for preemption - i386 Rust support - Huge cleanup by Benjamin Berg - UBSAN support - Removal of dead code * tag 'uml-for-linus-6.11-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/uml/linux: (41 commits) um: vector: always reset vp->opened um: vector: remove vp->lock um: register power-off handler um: line: always fill *error_out in setup_one_line() um: remove pcap driver from documentation um: Enable preemption in UML um: refactor TLB update handling um: simplify and consolidate TLB updates um: remove force_flush_all from fork_handler um: Do not flush MM in flush_thread um: Delay flushing syscalls until the thread is restarted um: remove copy_context_skas0 um: remove LDT support um: compress memory related stub syscalls while adding them um: Rework syscall handling um: Add generic stub_syscall6 function um: Create signal stack memory assignment in stub_data um: Remove stub-data.h include from common-offsets.h um: time-travel: fix signal blocking race/hang um: time-travel: remove time_exit() ... commit c2a96b7f187fb6a455836d4a6e113947ff11de97 Merge: b2eed73360df b57d5ffc3ab5 Author: Linus Torvalds Date: Thu Jul 25 10:42:22 2024 -0700 Merge tag 'driver-core-6.11-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/driver-core Pull driver core updates from Greg KH: "Here is the big set of driver core changes for 6.11-rc1. Lots of stuff in here, with not a huge diffstat, but apis are evolving which required lots of files to be touched. Highlights of the changes in here are: - platform remove callback api final fixups (Uwe took many releases to get here, finally!) - Rust bindings for basic firmware apis and initial driver-core interactions. It's not all that useful for a "write a whole driver in rust" type of thing, but the firmware bindings do help out the phy rust drivers, and the driver core bindings give a solid base on which others can start their work. There is still a long way to go here before we have a multitude of rust drivers being added, but it's a great first step. - driver core const api changes. This reached across all bus types, and there are some fix-ups for some not-common bus types that linux-next and 0-day testing shook out. This work is being done to help make the rust bindings more safe, as well as the C code, moving toward the end-goal of allowing us to put driver structures into read-only memory. We aren't there yet, but are getting closer. - minor devres cleanups and fixes found by code inspection - arch_topology minor changes - other minor driver core cleanups All of these have been in linux-next for a very long time with no reported problems" * tag 'driver-core-6.11-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/driver-core: (55 commits) ARM: sa1100: make match function take a const pointer sysfs/cpu: Make crash_hotplug attribute world-readable dio: Have dio_bus_match() callback take a const * zorro: make match function take a const pointer driver core: module: make module_[add|remove]_driver take a const * driver core: make driver_find_device() take a const * driver core: make driver_[create|remove]_file take a const * firmware_loader: fix soundness issue in `request_internal` firmware_loader: annotate doctests as `no_run` devres: Correct code style for functions that return a pointer type devres: Initialize an uninitialized struct member devres: Fix memory leakage caused by driver API devm_free_percpu() devres: Fix devm_krealloc() wasting memory driver core: platform: Switch to use kmemdup_array() driver core: have match() callback in struct bus_type take a const * MAINTAINERS: add Rust device abstractions to DRIVER CORE device: rust: improve safety comments MAINTAINERS: add Danilo as FIRMWARE LOADER maintainer MAINTAINERS: add Rust FW abstractions to FIRMWARE LOADER firmware: rust: improve safety comments ... commit b2eed73360dffea91ea64e8f19330c950dd42ebb Merge: 9cf601e86519 63d097d46799 Author: Linus Torvalds Date: Thu Jul 25 10:18:35 2024 -0700 Merge tag 'linux-watchdog-6.11-rc1' of git://www.linux-watchdog.org/linux-watchdog Pull watchdog updates from Wim Van Sebroeck: - make watchdog_class const - rework of the rzg2l_wdt driver - other small fixes and improvements * tag 'linux-watchdog-6.11-rc1' of git://www.linux-watchdog.org/linux-watchdog: dt-bindings: watchdog: dlg,da9062-watchdog: Drop blank space watchdog: rzn1: Convert comma to semicolon watchdog: lenovo_se10_wdt: Convert comma to semicolon dt-bindings: watchdog: renesas,wdt: Document RZ/G3S support watchdog: rzg2l_wdt: Add suspend/resume support watchdog: rzg2l_wdt: Rely on the reset driver for doing proper reset watchdog: rzg2l_wdt: Remove comparison with zero watchdog: rzg2l_wdt: Remove reset de-assert from probe watchdog: rzg2l_wdt: Check return status of pm_runtime_put() watchdog: rzg2l_wdt: Use pm_runtime_resume_and_get() watchdog: rzg2l_wdt: Make the driver depend on PM watchdog: rzg2l_wdt: Restrict the driver to ARCH_RZG2L and ARCH_R9A09G011 watchdog: imx7ulp_wdt: keep already running watchdog enabled watchdog: starfive: Add missing clk_disable_unprepare() watchdog: Make watchdog_class const commit 9cf601e865198c72e2a53118eaf37dcfd9a6cf1f Merge: c33ffdb70cc6 28e8b7406d3a Author: Linus Torvalds Date: Thu Jul 25 10:10:34 2024 -0700 Merge tag 'dma-mapping-6.11-2024-07-24' of git://git.infradead.org/users/hch/dma-mapping Pull dma-mapping fix from Christoph Hellwig: - fix the order of actions in dmam_free_coherent (Lance Richardson) * tag 'dma-mapping-6.11-2024-07-24' of git://git.infradead.org/users/hch/dma-mapping: dma: fix call order in dmam_free_coherent commit e8b96a66ae01d039699bac256c5b6b30b2284170 Merge: dcfed708742c ab53dfdcdd1e Author: Takashi Iwai Date: Thu Jul 25 18:04:55 2024 +0200 Merge tag 'asoc-fix-v6.11-merge-window' of https://git.kernel.org/pub/scm/linux/kernel/git/broonie/sound into for-linus ASoC: Fixes for v6.11 A selection of routine fixes and quirks that came in since the merge window. The fsl-asoc-card change is a fix for systems with multiple cards where updating templates in place leaks data from one card to another. commit af65ea42bd1d28d818b74b9b3b4f8da7ada9f88b Merge: 61ab751451f5 049584807f1d Author: Jakub Kicinski Date: Thu Jul 25 08:07:06 2024 -0700 Merge branch 'tap-tun-harden-by-dropping-short-frame' Dongli Zhang says: ==================== tap/tun: harden by dropping short frame This is to harden all of tap/tun to avoid any short frame smaller than the Ethernet header (ETH_HLEN). While the xen-netback already rejects short frame smaller than ETH_HLEN ... 914 static void xenvif_tx_build_gops(struct xenvif_queue *queue, 915 int budget, 916 unsigned *copy_ops, 917 unsigned *map_ops) 918 { ... ... 1007 if (unlikely(txreq.size < ETH_HLEN)) { 1008 netdev_dbg(queue->vif->dev, 1009 "Bad packet size: %d\n", txreq.size); 1010 xenvif_tx_err(queue, &txreq, extra_count, idx); 1011 break; 1012 } ... the short frame may not be dropped by vhost-net/tap/tun. This fixes CVE-2024-41090 and CVE-2024-41091. ==================== Link: https://patch.msgid.link/20240724170452.16837-1-dongli.zhang@oracle.com Signed-off-by: Jakub Kicinski commit 049584807f1d797fc3078b68035450a9769eb5c3 Author: Dongli Zhang Date: Wed Jul 24 10:04:52 2024 -0700 tun: add missing verification for short frame The cited commit missed to check against the validity of the frame length in the tun_xdp_one() path, which could cause a corrupted skb to be sent downstack. Even before the skb is transmitted, the tun_xdp_one-->eth_type_trans() may access the Ethernet header although it can be less than ETH_HLEN. Once transmitted, this could either cause out-of-bound access beyond the actual length, or confuse the underlayer with incorrect or inconsistent header length in the skb metadata. In the alternative path, tun_get_user() already prohibits short frame which has the length less than Ethernet header size from being transmitted for IFF_TAP. This is to drop any frame shorter than the Ethernet header size just like how tun_get_user() does. CVE: CVE-2024-41091 Inspired-by: https://lore.kernel.org/netdev/1717026141-25716-1-git-send-email-si-wei.liu@oracle.com/ Fixes: 043d222f93ab ("tuntap: accept an array of XDP buffs through sendmsg()") Cc: stable@vger.kernel.org Signed-off-by: Dongli Zhang Reviewed-by: Si-Wei Liu Reviewed-by: Willem de Bruijn Reviewed-by: Paolo Abeni Reviewed-by: Jason Wang Link: https://patch.msgid.link/20240724170452.16837-3-dongli.zhang@oracle.com Signed-off-by: Jakub Kicinski drivers/net/tun.c | 3 +++ 1 file changed, 3 insertions(+) commit ed7f2afdd0e043a397677e597ced0830b83ba0b3 Author: Si-Wei Liu Date: Wed Jul 24 10:04:51 2024 -0700 tap: add missing verification for short frame The cited commit missed to check against the validity of the frame length in the tap_get_user_xdp() path, which could cause a corrupted skb to be sent downstack. Even before the skb is transmitted, the tap_get_user_xdp()-->skb_set_network_header() may assume the size is more than ETH_HLEN. Once transmitted, this could either cause out-of-bound access beyond the actual length, or confuse the underlayer with incorrect or inconsistent header length in the skb metadata. In the alternative path, tap_get_user() already prohibits short frame which has the length less than Ethernet header size from being transmitted. This is to drop any frame shorter than the Ethernet header size just like how tap_get_user() does. CVE: CVE-2024-41090 Link: https://lore.kernel.org/netdev/1717026141-25716-1-git-send-email-si-wei.liu@oracle.com/ Fixes: 0efac27791ee ("tap: accept an array of XDP buffs through sendmsg()") Cc: stable@vger.kernel.org Signed-off-by: Si-Wei Liu Signed-off-by: Dongli Zhang Reviewed-by: Willem de Bruijn Reviewed-by: Paolo Abeni Reviewed-by: Jason Wang Link: https://patch.msgid.link/20240724170452.16837-2-dongli.zhang@oracle.com Signed-off-by: Jakub Kicinski drivers/net/tap.c | 5 +++++ 1 file changed, 5 insertions(+) commit 61ab751451f5ebd0b98e02276a44e23a10110402 Author: Dan Carpenter Date: Wed Jul 24 11:08:18 2024 -0500 mISDN: Fix a use after free in hfcmulti_tx() Don't dereference *sp after calling dev_kfree_skb(*sp). Fixes: af69fb3a8ffa ("Add mISDN HFC multiport driver") Signed-off-by: Dan Carpenter Reviewed-by: Simon Horman Link: https://patch.msgid.link/8be65f5a-c2dd-4ba0-8a10-bfe5980b8cfb@stanley.mountain Signed-off-by: Jakub Kicinski drivers/isdn/hardware/mISDN/hfcmulti.c | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) commit 36e3b949e35964e22b9a57f960660fc599038dd4 Author: Bailey Forrest Date: Wed Jul 24 07:34:31 2024 -0700 gve: Fix an edge case for TSO skb validity check The NIC requires each TSO segment to not span more than 10 descriptors. NIC further requires each descriptor to not exceed 16KB - 1 (GVE_TX_MAX_BUF_SIZE_DQO). The descriptors for an skb are generated by gve_tx_add_skb_no_copy_dqo() for DQO RDA queue format. gve_tx_add_skb_no_copy_dqo() loops through each skb frag and generates a descriptor for the entire frag if the frag size is not greater than GVE_TX_MAX_BUF_SIZE_DQO. If the frag size is greater than GVE_TX_MAX_BUF_SIZE_DQO, it is split into descriptor(s) of size GVE_TX_MAX_BUF_SIZE_DQO and a descriptor is generated for the remainder (frag size % GVE_TX_MAX_BUF_SIZE_DQO). gve_can_send_tso() checks if the descriptors thus generated for an skb would meet the requirement that each TSO-segment not span more than 10 descriptors. However, the current code misses an edge case when a TSO segment spans multiple descriptors within a large frag. This change fixes the edge case. gve_can_send_tso() relies on the assumption that max gso size (9728) is less than GVE_TX_MAX_BUF_SIZE_DQO and therefore within an skb fragment a TSO segment can never span more than 2 descriptors. Fixes: a57e5de476be ("gve: DQO: Add TX path") Signed-off-by: Praveen Kaligineedi Signed-off-by: Bailey Forrest Reviewed-by: Jeroen de Borst Cc: stable@vger.kernel.org Reviewed-by: Willem de Bruijn Link: https://patch.msgid.link/20240724143431.3343722-1-pkaligineedi@google.com Signed-off-by: Jakub Kicinski drivers/net/ethernet/google/gve/gve_tx_dqo.c | 22 +++++++++++++++++++++- 1 file changed, 21 insertions(+), 1 deletion(-) commit b537633ce57b29f4c9687fea6f2d92e1ca7853fc Author: Taehee Yoo Date: Sun Jul 21 05:35:54 2024 +0000 bnxt_en: update xdp_rxq_info in queue restart logic When the netdev_rx_queue_restart() restarts queues, the bnxt_en driver updates(creates and deletes) a page_pool. But it doesn't update xdp_rxq_info, so the xdp_rxq_info is still connected to an old page_pool. So, bnxt_rx_ring_info->page_pool indicates a new page_pool, but bnxt_rx_ring_info->xdp_rxq is still connected to an old page_pool. An old page_pool is no longer used so it is supposed to be deleted by page_pool_destroy() but it isn't. Because the xdp_rxq_info is holding the reference count for it and the xdp_rxq_info is not updated, an old page_pool will not be deleted in the queue restart logic. Before restarting 1 queue: ./tools/net/ynl/samples/page-pool enp10s0f1np1[6] page pools: 4 (zombies: 0) refs: 8192 bytes: 33554432 (refs: 0 bytes: 0) recycling: 0.0% (alloc: 128:8048 recycle: 0:0) After restarting 1 queue: ./tools/net/ynl/samples/page-pool enp10s0f1np1[6] page pools: 5 (zombies: 0) refs: 10240 bytes: 41943040 (refs: 0 bytes: 0) recycling: 20.0% (alloc: 160:10080 recycle: 1920:128) Before restarting queues, an interface has 4 page_pools. After restarting one queue, an interface has 5 page_pools, but it should be 4, not 5. The reason is that queue restarting logic creates a new page_pool and an old page_pool is not deleted due to the absence of an update of xdp_rxq_info logic. Fixes: 2d694c27d32e ("bnxt_en: implement netdev_queue_mgmt_ops") Signed-off-by: Taehee Yoo Reviewed-by: David Wei Reviewed-by: Somnath Kotur Link: https://patch.msgid.link/20240721053554.1233549-1-ap420073@gmail.com Signed-off-by: Jakub Kicinski drivers/net/ethernet/broadcom/bnxt/bnxt.c | 17 +++++++++++++++++ 1 file changed, 17 insertions(+) commit 0db4618e8fabfcc404af4dda23799bba726785a5 Author: Jens Axboe Date: Thu Jul 25 08:41:35 2024 -0600 io_uring/msg_ring: fix uninitialized use of target_req->flags syzbot reports that KMSAN complains that 'nr_tw' is an uninit-value with the following report: BUG: KMSAN: uninit-value in io_req_local_work_add io_uring/io_uring.c:1192 [inline] BUG: KMSAN: uninit-value in io_req_task_work_add_remote+0x588/0x5d0 io_uring/io_uring.c:1240 io_req_local_work_add io_uring/io_uring.c:1192 [inline] io_req_task_work_add_remote+0x588/0x5d0 io_uring/io_uring.c:1240 io_msg_remote_post io_uring/msg_ring.c:102 [inline] io_msg_data_remote io_uring/msg_ring.c:133 [inline] io_msg_ring_data io_uring/msg_ring.c:152 [inline] io_msg_ring+0x1c38/0x1ef0 io_uring/msg_ring.c:305 io_issue_sqe+0x383/0x22c0 io_uring/io_uring.c:1710 io_queue_sqe io_uring/io_uring.c:1924 [inline] io_submit_sqe io_uring/io_uring.c:2180 [inline] io_submit_sqes+0x1259/0x2f20 io_uring/io_uring.c:2295 __do_sys_io_uring_enter io_uring/io_uring.c:3205 [inline] __se_sys_io_uring_enter+0x40c/0x3ca0 io_uring/io_uring.c:3142 __x64_sys_io_uring_enter+0x11f/0x1a0 io_uring/io_uring.c:3142 x64_sys_call+0x2d82/0x3c10 arch/x86/include/generated/asm/syscalls_64.h:427 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x1e0 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f which is the following check: if (nr_tw < nr_wait) return; in io_req_local_work_add(). While nr_tw itself cannot be uninitialized, it does depend on req->flags, which off the msg ring issue path can indeed be uninitialized. Fix this by always clearing the allocated 'req' fully if we can't grab one from the cache itself. Fixes: 50cf5f3842af ("io_uring/msg_ring: add an alloc cache for io_kiocb entries") Reported-by: syzbot+82609b8937a4458106ca@syzkaller.appspotmail.com Link: https://lore.kernel.org/io-uring/000000000000fd3d8d061dfc0e4a@google.com/ Signed-off-by: Jens Axboe io_uring/msg_ring.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) commit f7578df913041f08b680aac2c660ebd71f35af3a Merge: c1668292689a 9b9969c40b0d Author: Jakub Kicinski Date: Thu Jul 25 07:40:24 2024 -0700 Merge tag 'for-netdev' of https://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf Daniel Borkmann says: ==================== pull-request: bpf 2024-07-25 We've added 14 non-merge commits during the last 8 day(s) which contain a total of 19 files changed, 177 insertions(+), 70 deletions(-). The main changes are: 1) Fix af_unix to disable MSG_OOB handling for sockets in BPF sockmap and BPF sockhash. Also add test coverage for this case, from Michal Luczaj. 2) Fix a segmentation issue when downgrading gso_size in the BPF helper bpf_skb_adjust_room(), from Fred Li. 3) Fix a compiler warning in resolve_btfids due to a missing type cast, from Liwei Song. 4) Fix stack allocation for arm64 to align the stack pointer at a 16 byte boundary in the fexit_sleep BPF selftest, from Puranjay Mohan. 5) Fix a xsk regression to require a flag when actuating tx_metadata_len, from Stanislav Fomichev. 6) Fix function prototype BTF dumping in libbpf for prototypes that have no input arguments, from Andrii Nakryiko. 7) Fix stacktrace symbol resolution in perf script for BPF programs containing subprograms, from Hou Tao. * tag 'for-netdev' of https://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf: selftests/bpf: Add XDP_UMEM_TX_METADATA_LEN to XSK TX metadata test xsk: Require XDP_UMEM_TX_METADATA_LEN to actuate tx_metadata_len bpf: Fix a segment issue when downgrading gso_size tools/resolve_btfids: Fix comparison of distinct pointer types warning in resolve_btfids bpf, events: Use prog to emit ksymbol event for main program selftests/bpf: Test sockmap redirect for AF_UNIX MSG_OOB selftests/bpf: Parametrize AF_UNIX redir functions to accept send() flags selftests/bpf: Support SOCK_STREAM in unix_inet_redir_to_connected() af_unix: Disable MSG_OOB handling for sockets in sockmap/sockhash bpftool: Fix typo in usage help libbpf: Fix no-args func prototype BTF dumping syntax MAINTAINERS: Update powerpc BPF JIT maintainers MAINTAINERS: Update email address of Naveen selftests/bpf: fexit_sleep: Fix stack allocation for arm64 ==================== Link: https://patch.msgid.link/20240725114312.32197-1-daniel@iogearbox.net Signed-off-by: Jakub Kicinski commit c31fad1470389666ac7169fe43aa65bf5b7e2cfd Author: Leon Romanovsky Date: Wed Jul 24 13:31:14 2024 +0300 nvme-pci: add missing condition check for existence of mapped data nvme_map_data() is called when request has physical segments, hence the nvme_unmap_data() should have same condition to avoid dereference. Fixes: 4aedb705437f ("nvme-pci: split metadata handling from nvme_map_data / nvme_unmap_data") Signed-off-by: Leon Romanovsky Reviewed-by: Christoph Hellwig Reviewed-by: Nitesh Shetty Signed-off-by: Keith Busch drivers/nvme/host/pci.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) commit ab53dfdcdd1ec8df8729890aefa5b0e3c900afbb Author: Shengjiu Wang Date: Thu Jul 25 11:22:53 2024 +0800 ASoC: fsl-asoc-card: Dynamically allocate memory for snd_soc_dai_link_components The static snd_soc_dai_link_components cause conflict for multiple instances of this generic driver. For example, when there is wm8962 and SPDIF case enabled together, the contaminated snd_soc_dai_link_components will cause another device probe fail. Fixes: 6d174cc4f224 ("ASoC: fsl-asoc-card: merge spdif support from imx-spdif.c") Signed-off-by: Shengjiu Wang Link: https://patch.msgid.link/1721877773-5229-1-git-send-email-shengjiu.wang@nxp.com Signed-off-by: Mark Brown sound/soc/fsl/fsl-asoc-card.c | 46 +++++++++++++++++++++++++++---------------- 1 file changed, 29 insertions(+), 17 deletions(-) commit 36639013b3462c06ff8e3400a427f775b4fc97f5 Author: Will Deacon Date: Thu Jul 25 10:03:45 2024 +0100 arm64: mm: Fix lockless walks with static and dynamic page-table folding Lina reports random oopsen originating from the fast GUP code when 16K pages are used with 4-level page-tables, the fourth level being folded at runtime due to lack of LPA2. In this configuration, the generic implementation of p4d_offset_lockless() will return a 'p4d_t *' corresponding to the 'pgd_t' allocated on the stack of the caller, gup_fast_pgd_range(). This is normally fine, but when the fourth level of page-table is folded at runtime, pud_offset_lockless() will offset from the address of the 'p4d_t' to calculate the address of the PUD in the same page-table page. This results in a stray stack read when the 'p4d_t' has been allocated on the stack and can send the walker into the weeds. Fix the problem by providing our own definition of p4d_offset_lockless() when CONFIG_PGTABLE_LEVELS <= 4 which returns the real page-table pointer rather than the address of the local stack variable. Cc: Catalin Marinas Cc: Ard Biesheuvel Cc: stable@vger.kernel.org Link: https://lore.kernel.org/r/50360968-13fb-4e6f-8f52-1725b3177215@asahilina.net Fixes: 0dd4f60a2c76 ("arm64: mm: Add support for folding PUDs at runtime") Reported-by: Asahi Lina Reviewed-by: Ard Biesheuvel Link: https://lore.kernel.org/r/20240725090345.28461-1-will@kernel.org Signed-off-by: Will Deacon arch/arm64/include/asm/pgtable.h | 22 ++++++++++++++++++++++ 1 file changed, 22 insertions(+) commit 726d4f528dbc98a84d9ce3c749dfdada3dcdd5ca Author: Ashish Mhetre Date: Wed Jul 24 17:31:32 2024 +0000 iommu: arm-smmu: Fix Tegra workaround for PAGE_SIZE mappings PAGE_SIZE can be 16KB for Tegra which is not supported by MMU-500 on both Tegra194 and Tegra234. Retain only valid granularities from pgsize_bitmap which would either be 4KB or 64KB. Signed-off-by: Ashish Mhetre Link: https://lore.kernel.org/r/20240724173132.219978-1-amhetre@nvidia.com Signed-off-by: Will Deacon drivers/iommu/arm/arm-smmu/arm-smmu-nvidia.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 9722c3b66e21ff08aec570d02a97d331087fd70f Author: Luca Ceresoli Date: Wed Jul 24 18:33:06 2024 +0200 of: remove internal arguments from of_property_for_each_u32() The of_property_for_each_u32() macro needs five parameters, two of which are primarily meant as internal variables for the macro itself (in the for() clause). Yet these two parameters are used by a few drivers, and this can be considered misuse or at least bad practice. Now that the kernel uses C11 to build, these two parameters can be avoided by declaring them internally, thus changing this pattern: struct property *prop; const __be32 *p; u32 val; of_property_for_each_u32(np, "xyz", prop, p, val) { ... } to this: u32 val; of_property_for_each_u32(np, "xyz", val) { ... } However two variables cannot be declared in the for clause even with C11, so declare one struct that contain the two variables we actually need. As the variables inside this struct are not meant to be used by users of this macro, give the struct instance the noticeable name "_it" so it is visible during code reviews, helping to avoid new code to use it directly. Most usages are trivially converted as they do not use those two parameters, as expected. The non-trivial cases are: - drivers/clk/clk.c, of_clk_get_parent_name(): easily doable anyway - drivers/clk/clk-si5351.c, si5351_dt_parse(): this is more complex as the checks had to be replicated in a different way, making code more verbose and somewhat uglier, but I refrained from a full rework to keep as much of the original code untouched having no hardware to test my changes All the changes have been build tested. The few for which I have the hardware have been runtime-tested too. Reviewed-by: Andre Przywara # drivers/clk/sunxi/clk-simple-gates.c, drivers/clk/sunxi/clk-sun8i-bus-gates.c Acked-by: Bartosz Golaszewski # drivers/gpio/gpio-brcmstb.c Acked-by: Nicolas Ferre # drivers/irqchip/irq-atmel-aic-common.c Acked-by: Jonathan Cameron # drivers/iio/adc/ti_am335x_adc.c Acked-by: Uwe Kleine-König # drivers/pwm/pwm-samsung.c Acked-by: Richard Leitner # drivers/usb/misc/usb251xb.c Acked-by: Mark Brown # sound/soc/codecs/arizona.c Reviewed-by: Richard Fitzgerald # sound/soc/codecs/arizona.c Acked-by: Michael Ellerman # arch/powerpc/sysdev/xive/spapr.c Acked-by: Stephen Boyd # clk Signed-off-by: Luca Ceresoli Acked-by: Lee Jones Link: https://lore.kernel.org/r/20240724-of_property_for_each_u32-v3-1-bea82ce429e2@bootlin.com Signed-off-by: Rob Herring (Arm) arch/powerpc/sysdev/xive/native.c | 4 +-- arch/powerpc/sysdev/xive/spapr.c | 3 +-- drivers/bus/ti-sysc.c | 4 +-- drivers/clk/clk-conf.c | 4 +-- drivers/clk/clk-si5351.c | 43 ++++++++++++++++++++------------- drivers/clk/clk.c | 12 ++++----- drivers/clk/qcom/common.c | 4 +-- drivers/clk/sunxi/clk-simple-gates.c | 4 +-- drivers/clk/sunxi/clk-sun8i-bus-gates.c | 4 +-- drivers/clocksource/samsung_pwm_timer.c | 4 +-- drivers/gpio/gpio-brcmstb.c | 5 +--- drivers/iio/adc/ti_am335x_adc.c | 4 +-- drivers/irqchip/irq-atmel-aic-common.c | 4 +-- drivers/irqchip/irq-pic32-evic.c | 4 +-- drivers/mfd/ti_am335x_tscadc.c | 4 +-- drivers/pinctrl/nxp/pinctrl-s32cc.c | 4 +-- drivers/pinctrl/pinctrl-k210.c | 4 +-- drivers/pwm/pwm-samsung.c | 4 +-- drivers/tty/sysrq.c | 4 +-- drivers/usb/misc/usb251xb.c | 4 +-- include/linux/of.h | 15 ++++++------ sound/soc/codecs/arizona.c | 12 ++++----- 22 files changed, 61 insertions(+), 93 deletions(-) commit 7b52a9d9ee6c5505a51ebe03703a56a72c75f9de Author: Huqiang Qin Date: Tue Jul 9 16:48:25 2024 +0800 dt-bindings: watchdog: add support for Amlogic A4 SoCs Update dt-binding document for watchdog of Amlogic A4 SoCs. Signed-off-by: Huqiang Qin Signed-off-by: Xianwei Zhao Acked-by: Krzysztof Kozlowski Reviewed-by: Guenter Roeck Link: https://lore.kernel.org/r/20240709-a4-a5_watchdog-v1-1-2ae852e05ec2@amlogic.com Signed-off-by: Rob Herring (Arm) Documentation/devicetree/bindings/watchdog/amlogic,meson-gxbb-wdt.yaml | 1 + 1 file changed, 1 insertion(+) commit 1d9ce4440414c92acb17eece3218fe5c92b141e3 Author: Takashi Iwai Date: Thu Jul 25 08:54:28 2024 +0200 ASoC: amd: yc: Support mic on Lenovo Thinkpad E16 Gen 2 Lenovo Thinkpad E16 Gen 2 AMD model (model 21M5) needs a corresponding quirk entry for making the internal mic working. Link: https://bugzilla.suse.com/show_bug.cgi?id=1228269 Cc: stable@vger.kernel.org Signed-off-by: Takashi Iwai Link: https://patch.msgid.link/20240725065442.9293-1-tiwai@suse.de Signed-off-by: Mark Brown sound/soc/amd/yc/acp6x-mach.c | 7 +++++++ 1 file changed, 7 insertions(+) commit 4c006734898a113a64a528027274a571b04af95a Author: Roger Pau Monne Date: Thu Jul 25 09:31:15 2024 +0200 x86/xen: fix memblock_reserve() usage on PVH The current usage of memblock_reserve() in init_pvh_bootparams() is done before the .bss is zeroed, and that used to be fine when memblock_reserved_init_regions implicitly ended up in the .meminit.data section. However after commit 73db3abdca58c memblock_reserved_init_regions ends up in the .bss section, thus breaking it's usage before the .bss is cleared. Move and rename the call to xen_reserve_extra_memory() so it's done in the x86_init.oem.arch_setup hook, which gets executed after the .bss has been zeroed, but before calling e820__memory_setup(). Fixes: 73db3abdca58c ("init/modpost: conditionally check section mismatch to __meminit*") Signed-off-by: Roger Pau Monné Reviewed-by: Juergen Gross Message-ID: <20240725073116.14626-3-roger.pau@citrix.com> Signed-off-by: Juergen Gross arch/x86/include/asm/xen/hypervisor.h | 5 ----- arch/x86/platform/pvh/enlighten.c | 3 --- arch/x86/xen/enlighten_pvh.c | 15 ++++++++++++--- 3 files changed, 12 insertions(+), 11 deletions(-) commit fc05ea89c9ab45e70cb73e70bc0b9cdd403e0ee1 Author: Roger Pau Monne Date: Thu Jul 25 09:31:14 2024 +0200 x86/xen: move xen_reserve_extra_memory() In preparation for making the function static. No functional change. Signed-off-by: Roger Pau Monné Reviewed-by: Juergen Gross Message-ID: <20240725073116.14626-2-roger.pau@citrix.com> Signed-off-by: Juergen Gross arch/x86/xen/enlighten_pvh.c | 96 ++++++++++++++++++++++---------------------- 1 file changed, 48 insertions(+), 48 deletions(-) commit c1668292689ad2ee16c9c1750a8044b0b0aad663 Author: Matthieu Baerts (NGI0) Date: Wed Jul 24 12:25:16 2024 +0200 tcp: process the 3rd ACK with sk_socket for TFO/MPTCP The 'Fixes' commit recently changed the behaviour of TCP by skipping the processing of the 3rd ACK when a sk->sk_socket is set. The goal was to skip tcp_ack_snd_check() in tcp_rcv_state_process() not to send an unnecessary ACK in case of simultaneous connect(). Unfortunately, that had an impact on TFO and MPTCP. I started to look at the impact on MPTCP, because the MPTCP CI found some issues with the MPTCP Packetdrill tests [1]. Then Paolo Abeni suggested me to look at the impact on TFO with "plain" TCP. For MPTCP, when receiving the 3rd ACK of a request adding a new path (MP_JOIN), sk->sk_socket will be set, and point to the MPTCP sock that has been created when the MPTCP connection got established before with the first path. The newly added 'goto' will then skip the processing of the segment text (step 7) and not go through tcp_data_queue() where the MPTCP options are validated, and some actions are triggered, e.g. sending the MPJ 4th ACK [2] as demonstrated by the new errors when running a packetdrill test [3] establishing a second subflow. This doesn't fully break MPTCP, mainly the 4th MPJ ACK that will be delayed. Still, we don't want to have this behaviour as it delays the switch to the fully established mode, and invalid MPTCP options in this 3rd ACK will not be caught any more. This modification also affects the MPTCP + TFO feature as well, and being the reason why the selftests started to be unstable the last few days [4]. For TFO, the existing 'basic-cookie-not-reqd' test [5] was no longer passing: if the 3rd ACK contains data, and the connection is accept()ed before receiving them, these data would no longer be processed, and thus not ACKed. One last thing about MPTCP, in case of simultaneous connect(), a fallback to TCP will be done, which seems fine: `../common/defaults.sh` 0 socket(..., SOCK_STREAM|SOCK_NONBLOCK, IPPROTO_MPTCP) = 3 +0 connect(3, ..., ...) = -1 EINPROGRESS (Operation now in progress) +0 > S 0:0(0) +0 < S 0:0(0) win 1000 +0 > S. 0:0(0) ack 1 +0 < S. 0:0(0) ack 1 win 65535 +0 > . 1:1(0) ack 1 Simultaneous SYN-data crossing is also not supported by TFO, see [6]. Kuniyuki Iwashima suggested to restrict the processing to SYN+ACK only: that's a more generic solution than the one initially proposed, and also enough to fix the issues described above. Later on, Eric Dumazet mentioned that an ACK should still be sent in reaction to the second SYN+ACK that is received: not sending a DUPACK here seems wrong and could hurt: 0 socket(..., SOCK_STREAM|SOCK_NONBLOCK, IPPROTO_TCP) = 3 +0 connect(3, ..., ...) = -1 EINPROGRESS (Operation now in progress) +0 > S 0:0(0) +0 < S 0:0(0) win 1000 +0 > S. 0:0(0) ack 1 +0 < S. 0:0(0) ack 1 win 1000 +0 > . 1:1(0) ack 1 // <== Here So in this version, the 'goto consume' is dropped, to always send an ACK when switching from TCP_SYN_RECV to TCP_ESTABLISHED. This ACK will be seen as a DUPACK -- with DSACK if SACK has been negotiated -- in case of simultaneous SYN crossing: that's what is expected here. Link: https://github.com/multipath-tcp/mptcp_net-next/actions/runs/9936227696 [1] Link: https://datatracker.ietf.org/doc/html/rfc8684#fig_tokens [2] Link: https://github.com/multipath-tcp/packetdrill/blob/mptcp-net-next/gtests/net/mptcp/syscalls/accept.pkt#L28 [3] Link: https://netdev.bots.linux.dev/contest.html?executor=vmksft-mptcp-dbg&test=mptcp-connect-sh [4] Link: https://github.com/google/packetdrill/blob/master/gtests/net/tcp/fastopen/server/basic-cookie-not-reqd.pkt#L21 [5] Link: https://github.com/google/packetdrill/blob/master/gtests/net/tcp/fastopen/client/simultaneous-fast-open.pkt [6] Fixes: 23e89e8ee7be ("tcp: Don't drop SYN+ACK for simultaneous connect().") Suggested-by: Paolo Abeni Suggested-by: Kuniyuki Iwashima Suggested-by: Eric Dumazet Signed-off-by: Matthieu Baerts (NGI0) Reviewed-by: Eric Dumazet Link: https://patch.msgid.link/20240724-upstream-net-next-20240716-tcp-3rd-ack-consume-sk_socket-v3-1-d48339764ce9@kernel.org Signed-off-by: Paolo Abeni net/ipv4/tcp_input.c | 3 --- 1 file changed, 3 deletions(-) commit 3ceccb14f5576e02b81cc8b105ab81f224bd87f6 Author: Ilya Dryomov Date: Tue Jul 23 18:08:08 2024 +0200 rbd: don't assume rbd_is_lock_owner() for exclusive mappings Expanding on the previous commit, assuming that rbd_is_lock_owner() always returns true (i.e. that we are either in RBD_LOCK_STATE_LOCKED or RBD_LOCK_STATE_QUIESCING) if the mapping is exclusive is wrong too. In case ceph_cls_set_cookie() fails, the lock would be temporarily released even if the mapping is exclusive, meaning that we can end up even in RBD_LOCK_STATE_UNLOCKED. IOW, exclusive mappings are really "just" about disabling automatic lock transitions (as documented in the man page), not about grabbing the lock and holding on to it whatever it takes. Cc: stable@vger.kernel.org Fixes: 637cd060537d ("rbd: new exclusive lock wait/wake code") Signed-off-by: Ilya Dryomov Reviewed-by: Dongsheng Yang drivers/block/rbd.c | 5 ----- 1 file changed, 5 deletions(-) commit 2237ceb71f89837ac47c5dce2aaa2c2b3a337a3c Author: Ilya Dryomov Date: Tue Jul 23 18:07:59 2024 +0200 rbd: don't assume RBD_LOCK_STATE_LOCKED for exclusive mappings Every time a watch is reestablished after getting lost, we need to update the cookie which involves quiescing exclusive lock. For this, we transition from RBD_LOCK_STATE_LOCKED to RBD_LOCK_STATE_QUIESCING roughly for the duration of rbd_reacquire_lock() call. If the mapping is exclusive and I/O happens to arrive in this time window, it's failed with EROFS (later translated to EIO) based on the wrong assumption in rbd_img_exclusive_lock() -- "lock got released?" check there stopped making sense with commit a2b1da09793d ("rbd: lock should be quiesced on reacquire"). To make it worse, any such I/O is added to the acquiring list before EROFS is returned and this sets up for violating rbd_lock_del_request() precondition that the request is either on the running list or not on any list at all -- see commit ded080c86b3f ("rbd: don't move requests to the running list on errors"). rbd_lock_del_request() ends up processing these requests as if they were on the running list which screws up quiescing_wait completion counter and ultimately leads to rbd_assert(!completion_done(&rbd_dev->quiescing_wait)); being triggered on the next watch error. Cc: stable@vger.kernel.org # 06ef84c4e9c4: rbd: rename RBD_LOCK_STATE_RELEASING and releasing_wait Cc: stable@vger.kernel.org Fixes: 637cd060537d ("rbd: new exclusive lock wait/wake code") Signed-off-by: Ilya Dryomov Reviewed-by: Dongsheng Yang drivers/block/rbd.c | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) commit f5c466a0fdb2d9f3650d2e3911b0735f17ba00cf Author: Ilya Dryomov Date: Tue Jul 23 17:54:39 2024 +0200 rbd: rename RBD_LOCK_STATE_RELEASING and releasing_wait ... to RBD_LOCK_STATE_QUIESCING and quiescing_wait to recognize that this state and the associated completion are backing rbd_quiesce_lock(), which isn't specific to releasing the lock. While exclusive lock does get quiesced before it's released, it also gets quiesced before an attempt to update the cookie is made and there the lock is not released as long as ceph_cls_set_cookie() succeeds. Signed-off-by: Ilya Dryomov Reviewed-by: Dongsheng Yang drivers/block/rbd.c | 20 ++++++++++---------- 1 file changed, 10 insertions(+), 10 deletions(-) commit 9b9969c40b0d63a8fca434d4ea01c60a39699aa3 Author: Stanislav Fomichev Date: Fri Jul 12 18:52:52 2024 -0700 selftests/bpf: Add XDP_UMEM_TX_METADATA_LEN to XSK TX metadata test This flag is now required to use tx_metadata_len. Fixes: 40808a237d9c ("selftests/bpf: Add TX side to xdp_metadata") Reported-by: Julian Schindel Signed-off-by: Stanislav Fomichev Signed-off-by: Daniel Borkmann Reviewed-by: Maciej Fijalkowski Link: https://lore.kernel.org/bpf/20240713015253.121248-3-sdf@fomichev.me tools/include/uapi/linux/if_xdp.h | 4 ++++ tools/testing/selftests/bpf/prog_tests/xdp_metadata.c | 3 ++- 2 files changed, 6 insertions(+), 1 deletion(-) commit d5e726d9143c5624135f5dc9e4069799adeef734 Author: Stanislav Fomichev Date: Fri Jul 12 18:52:51 2024 -0700 xsk: Require XDP_UMEM_TX_METADATA_LEN to actuate tx_metadata_len Julian reports that commit 341ac980eab9 ("xsk: Support tx_metadata_len") can break existing use cases which don't zero-initialize xdp_umem_reg padding. Introduce new XDP_UMEM_TX_METADATA_LEN to make sure we interpret the padding as tx_metadata_len only when being explicitly asked. Fixes: 341ac980eab9 ("xsk: Support tx_metadata_len") Reported-by: Julian Schindel Signed-off-by: Stanislav Fomichev Signed-off-by: Daniel Borkmann Reviewed-by: Maciej Fijalkowski Link: https://lore.kernel.org/bpf/20240713015253.121248-2-sdf@fomichev.me Documentation/networking/xsk-tx-metadata.rst | 16 ++++++++++------ include/uapi/linux/if_xdp.h | 4 ++++ net/xdp/xdp_umem.c | 9 ++++++--- 3 files changed, 20 insertions(+), 9 deletions(-) commit fa5ef655615a01533035c6139248c5b33aa27028 Author: Fred Li Date: Fri Jul 19 10:46:53 2024 +0800 bpf: Fix a segment issue when downgrading gso_size Linearize the skb when downgrading gso_size because it may trigger a BUG_ON() later when the skb is segmented as described in [1,2]. Fixes: 2be7e212d5419 ("bpf: add bpf_skb_adjust_room helper") Signed-off-by: Fred Li Signed-off-by: Daniel Borkmann Reviewed-by: Willem de Bruijn Acked-by: Daniel Borkmann Link: https://lore.kernel.org/all/20240626065555.35460-2-dracodingfly@gmail.com [1] Link: https://lore.kernel.org/all/668d5cf1ec330_1c18c32947@willemb.c.googlers.com.notmuch [2] Link: https://lore.kernel.org/bpf/20240719024653.77006-1-dracodingfly@gmail.com net/core/filter.c | 15 +++++++++++---- 1 file changed, 11 insertions(+), 4 deletions(-) commit 16f3a28cf5f876a7f3550d8f4c870a7b41bcfaef Author: Breno Leitao Date: Wed Jul 24 01:05:23 2024 -0700 net: mediatek: Fix potential NULL pointer dereference in dummy net_device handling Move the freeing of the dummy net_device from mtk_free_dev() to mtk_remove(). Previously, if alloc_netdev_dummy() failed in mtk_probe(), eth->dummy_dev would be NULL. The error path would then call mtk_free_dev(), which in turn called free_netdev() assuming dummy_dev was allocated (but it was not), potentially causing a NULL pointer dereference. By moving free_netdev() to mtk_remove(), we ensure it's only called when mtk_probe() has succeeded and dummy_dev is fully allocated. This addresses a potential NULL pointer dereference detected by Smatch[1]. Fixes: b209bd6d0bff ("net: mediatek: mtk_eth_sock: allocate dummy net_device dynamically") Reported-by: Dan Carpenter Closes: https://lore.kernel.org/all/4160f4e0-cbef-4a22-8b5d-42c4d399e1f7@stanley.mountain/ [1] Suggested-by: Dan Carpenter Reviewed-by: Dan Carpenter Signed-off-by: Breno Leitao Reviewed-by: Simon Horman Link: https://patch.msgid.link/20240724080524.2734499-1-leitao@debian.org Signed-off-by: Paolo Abeni drivers/net/ethernet/mediatek/mtk_eth_soc.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) commit e6d08d7ecf1b675b4b174d696badc36706c4233c Merge: 5bdaf3625a07 a16909ae9982 Author: Paolo Abeni Date: Thu Jul 25 11:17:21 2024 +0200 Merge tag 'nf-24-07-24' of git://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf Pablo Neira Ayuso says: ==================== Netfilter fixes for net The following patchset contains a Netfilter fix for net: Patch #1 if FPU is busy, then pipapo set backend falls back to standard set element lookup. Moreover, disable bh while at this. From Florian Westphal. netfilter pull request 24-07-24 * tag 'nf-24-07-24' of git://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf: netfilter: nft_set_pipapo_avx2: disable softinterrupts ==================== Link: https://patch.msgid.link/20240724081305.3152-1-pablo@netfilter.org Signed-off-by: Paolo Abeni commit dcfed708742c7ab5e0c9cfcc673cb4e5fafb18ff Author: Nick Weihs Date: Wed Jul 24 22:47:22 2024 -0700 ALSA: hda/realtek: Implement sound init sequence for Samsung Galaxy Book3 Pro 360 Samsung Galaxy Book3 Pro 360 sends a large amount of data to the codec through hda processing coefficients. This data was captured using a modified version of QEMU, but the actual content of the data remains opaque to me. Elliding any part of the data seems to cause sound to not work. Signed-off-by: Nick Weihs Link: https://patch.msgid.link/20240725054722.42597-1-nick.weihs@gmail.com Signed-off-by: Takashi Iwai sound/pci/hda/patch_realtek.c | 9 ++ sound/pci/hda/samsung_helper.c | 310 +++++++++++++++++++++++++++++++++++++++++ 2 files changed, 319 insertions(+) commit 5bdaf3625a07f20583ad4bcf9f0233473450be10 Merge: 7c938e438c56 19abb9c2b900 Author: Paolo Abeni Date: Thu Jul 25 10:10:05 2024 +0200 Merge branch '100GbE' of git://git.kernel.org/pub/scm/linux/kernel/git/tnguy/net-queue Tony Nguyen says: ==================== This series contains updates to ice driver only. Ahmed enforces the iavf per VF filter limit on ice (PF) driver to prevent possible resource exhaustion. Wojciech corrects assignment of l2 flags read from firmware. * '100GbE' of git://git.kernel.org/pub/scm/linux/kernel/git/tnguy/net-queue: ice: Fix recipe read procedure ice: Add a per-VF limit on number of FDIR filters ==================== Link: https://patch.msgid.link/20240723233242.3146628-1-anthony.l.nguyen@intel.com Signed-off-by: Paolo Abeni commit cb372a505a994cb39aa75acfb8b3bcf94787cf94 Author: Ian Forbes Date: Fri Jul 19 11:36:27 2024 -0500 drm/vmwgfx: Fix overlay when using Screen Targets This code was never updated to support Screen Targets. Fixes a bug where Xv playback displays a green screen instead of actual video contents when 3D acceleration is disabled in the guest. Fixes: c8261a961ece ("vmwgfx: Major KMS refactoring / cleanup in preparation of screen targets") Reported-by: Doug Brown Closes: https://lore.kernel.org/all/bd9cb3c7-90e8-435d-bc28-0e38fee58977@schmorgal.com Signed-off-by: Ian Forbes Tested-by: Doug Brown Signed-off-by: Zack Rusin Link: https://patchwork.freedesktop.org/patch/msgid/20240719163627.20888-1-ian.forbes@broadcom.com drivers/gpu/drm/vmwgfx/vmwgfx_overlay.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 12bed149a3460bb6efbca697b4a46e11c819db86 Author: Zack Rusin Date: Mon Jul 22 14:41:16 2024 -0400 drm/vmwgfx: Add basic support for external buffers Make vmwgfx go through the dma-buf interface to map/unmap imported buffers. The driver used to try to directly manipulate external buffers, assuming that everything that was coming to it had to live in cpu accessible memory. While technically true because what's in the vms is controlled by us, it's semantically completely broken. Fix importing of external buffers by forwarding all memory access requests to the importer. Tested by the vmw_prime basic_vgem test. Signed-off-by: Zack Rusin Reviewed-by: Maaz Mombasawala Reviewed-by: Martin Krastev Link: https://patchwork.freedesktop.org/patch/msgid/20240722184313.181318-5-zack.rusin@broadcom.com drivers/gpu/drm/vmwgfx/vmwgfx_gem.c | 62 ++++++++++++++++++++++++++++++++++--- 1 file changed, 58 insertions(+), 4 deletions(-) commit d6667f0ddf46c671d379cd5fe66ce0a54d2a743a Author: Zack Rusin Date: Mon Jul 22 14:41:15 2024 -0400 drm/vmwgfx: Fix handling of dumb buffers Dumb buffers can be used in kms but also through prime with gallium's resource_from_handle. In the second case the dumb buffers can be rendered by the GPU where with the regular DRM kms interfaces they are mapped and written to by the CPU. Because the same buffer can be written to by the GPU and CPU vmwgfx needs to use vmw_surface (object which properly tracks dirty state of the guest and gpu memory) instead of vmw_bo (which is just guest side memory). Furthermore the dumb buffer handles are expected to be gem objects by a lot of userspace. Make vmwgfx accept gem handles in prime and kms but internally switch to vmw_surface's to properly track the dirty state of the objects between the GPU and CPU. Fixes new kwin and kde on wayland. Signed-off-by: Zack Rusin Fixes: b32233acceff ("drm/vmwgfx: Fix prime import/export") Cc: Broadcom internal kernel review list Cc: dri-devel@lists.freedesktop.org Cc: # v6.9+ Reviewed-by: Maaz Mombasawala Reviewed-by: Martin Krastev Link: https://patchwork.freedesktop.org/patch/msgid/20240722184313.181318-4-zack.rusin@broadcom.com drivers/gpu/drm/vmwgfx/vmw_surface_cache.h | 10 +- drivers/gpu/drm/vmwgfx/vmwgfx_bo.c | 127 +++++--- drivers/gpu/drm/vmwgfx/vmwgfx_bo.h | 15 +- drivers/gpu/drm/vmwgfx/vmwgfx_drv.h | 40 ++- drivers/gpu/drm/vmwgfx/vmwgfx_kms.c | 502 ++++++++++++----------------- drivers/gpu/drm/vmwgfx/vmwgfx_kms.h | 17 +- drivers/gpu/drm/vmwgfx/vmwgfx_ldu.c | 14 +- drivers/gpu/drm/vmwgfx/vmwgfx_prime.c | 32 +- drivers/gpu/drm/vmwgfx/vmwgfx_resource.c | 27 +- drivers/gpu/drm/vmwgfx/vmwgfx_scrn.c | 33 +- drivers/gpu/drm/vmwgfx/vmwgfx_stdu.c | 145 ++++----- drivers/gpu/drm/vmwgfx/vmwgfx_surface.c | 280 +++++++++++++++- 12 files changed, 740 insertions(+), 502 deletions(-) commit 09f34a00272d2311f6e5d64ed8ad824ef78f7487 Author: Zack Rusin Date: Mon Jul 22 14:41:14 2024 -0400 drm/vmwgfx: Make sure the screen surface is ref counted Fix races issues in virtual crc generation by making sure the surface the code uses for crc computation is properly ref counted. Crc generation was trying to be too clever by allowing the surfaces to go in and out of scope, with the hope of always having some kind of screen present. That's not always the code, in particular during atomic disable, so to make sure the surface, when present, is not being actively destroyed at the same time, hold a reference to it. Signed-off-by: Zack Rusin Fixes: 7b0062036c3b ("drm/vmwgfx: Implement virtual crc generation") Cc: Zack Rusin Cc: Broadcom internal kernel review list Cc: dri-devel@lists.freedesktop.org Reviewed-by: Maaz Mombasawala Reviewed-by: Martin Krastev Link: https://patchwork.freedesktop.org/patch/msgid/20240722184313.181318-3-zack.rusin@broadcom.com drivers/gpu/drm/vmwgfx/vmwgfx_vkms.c | 40 ++++++++++++++++++++---------------- 1 file changed, 22 insertions(+), 18 deletions(-) commit e58337100721f3cc0c7424a18730e4f39844934f Author: Zack Rusin Date: Mon Jul 22 14:41:13 2024 -0400 drm/vmwgfx: Fix a deadlock in dma buf fence polling Introduce a version of the fence ops that on release doesn't remove the fence from the pending list, and thus doesn't require a lock to fix poll->fence wait->fence unref deadlocks. vmwgfx overwrites the wait callback to iterate over the list of all fences and update their status, to do that it holds a lock to prevent the list modifcations from other threads. The fence destroy callback both deletes the fence and removes it from the list of pending fences, for which it holds a lock. dma buf polling cb unrefs a fence after it's been signaled: so the poll calls the wait, which signals the fences, which are being destroyed. The destruction tries to acquire the lock on the pending fences list which it can never get because it's held by the wait from which it was called. Old bug, but not a lot of userspace apps were using dma-buf polling interfaces. Fix those, in particular this fixes KDE stalls/deadlock. Signed-off-by: Zack Rusin Fixes: 2298e804e96e ("drm/vmwgfx: rework to new fence interface, v2") Cc: Broadcom internal kernel review list Cc: dri-devel@lists.freedesktop.org Cc: # v6.2+ Reviewed-by: Maaz Mombasawala Reviewed-by: Martin Krastev Link: https://patchwork.freedesktop.org/patch/msgid/20240722184313.181318-2-zack.rusin@broadcom.com drivers/gpu/drm/vmwgfx/vmwgfx_fence.c | 17 +++++++---------- 1 file changed, 7 insertions(+), 10 deletions(-) commit 5659b0c93a1ea02c662a030b322093203f299185 Author: ZhenGuo Yin Date: Fri Jul 19 16:10:40 2024 +0800 drm/amdgpu: reset vm state machine after gpu reset(vram lost) [Why] Page table of compute VM in the VRAM will lost after gpu reset. VRAM won't be restored since compute VM has no shadows. [How] Use higher 32-bit of vm->generation to record a vram_lost_counter. Reset the VM state machine when vm->genertaion is not equal to the new generation token. v2: Check vm->generation instead of calling drm_sched_entity_error in amdgpu_vm_validate. v3: Use new generation token instead of vram_lost_counter for check. Signed-off-by: ZhenGuo Yin Reviewed-by: Christian König Signed-off-by: Alex Deucher Cc: stable@vger.kernel.org (cherry picked from commit 47c0388b0589cb481c294dcb857d25a214c46eb3) drivers/gpu/drm/amd/amdgpu/amdgpu_vm.c | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-) commit fab1ead0ae3a4757afb92ff6909b37d63db17e55 Author: Tim Huang Date: Tue Jul 23 16:54:34 2024 +0800 drm/amdgpu: add missed harvest check for VCN IP v4/v5 To prevent below probe failure, add a check for models with VCN IP v4.0.6 where VCN1 may be harvested. v2: Apply the same check to VCN IP v4.0 and v5.0. [ 54.070117] RIP: 0010:vcn_v4_0_5_start_dpg_mode+0x9be/0x36b0 [amdgpu] [ 54.071055] Code: 80 fb ff 8d 82 00 80 fe ff 81 fe 00 06 00 00 0f 43 c2 49 69 d5 38 0d 00 00 48 8d 71 04 c1 e8 02 4c 01 f2 48 89 b2 50 f6 02 00 <89> 01 48 8b 82 50 f6 02 00 48 8d 48 04 48 89 8a 50 f6 02 00 c7 00 [ 54.072408] RSP: 0018:ffffb17985f736f8 EFLAGS: 00010286 [ 54.072793] RAX: 00000000000000d6 RBX: ffff99a82f680000 RCX: 0000000000000000 [ 54.073315] RDX: ffff99a82f680000 RSI: 0000000000000004 RDI: ffff99a82f680000 [ 54.073835] RBP: ffffb17985f73730 R08: 0000000000000001 R09: 0000000000000000 [ 54.074353] R10: 0000000000000008 R11: ffffb17983c05000 R12: 0000000000000000 [ 54.074879] R13: 0000000000000000 R14: ffff99a82f680000 R15: 0000000000000001 [ 54.075400] FS: 00007f8d9c79a000(0000) GS:ffff99ab2f140000(0000) knlGS:0000000000000000 [ 54.075988] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 54.076408] CR2: 0000000000000000 CR3: 0000000140c3a000 CR4: 0000000000750ef0 [ 54.076927] PKRU: 55555554 [ 54.077132] Call Trace: [ 54.077319] [ 54.077484] ? show_regs+0x69/0x80 [ 54.077747] ? __die+0x28/0x70 [ 54.077979] ? page_fault_oops+0x180/0x4b0 [ 54.078286] ? do_user_addr_fault+0x2d2/0x680 [ 54.078610] ? exc_page_fault+0x84/0x190 [ 54.078910] ? asm_exc_page_fault+0x2b/0x30 [ 54.079224] ? vcn_v4_0_5_start_dpg_mode+0x9be/0x36b0 [amdgpu] [ 54.079941] ? vcn_v4_0_5_start_dpg_mode+0xe6/0x36b0 [amdgpu] [ 54.080617] vcn_v4_0_5_set_powergating_state+0x82/0x19b0 [amdgpu] [ 54.081316] amdgpu_device_ip_set_powergating_state+0x64/0xc0 [amdgpu] [ 54.082057] amdgpu_vcn_ring_begin_use+0x6f/0x1d0 [amdgpu] [ 54.082727] amdgpu_ring_alloc+0x44/0x70 [amdgpu] [ 54.083351] amdgpu_vcn_dec_sw_ring_test_ring+0x40/0x110 [amdgpu] [ 54.084054] amdgpu_ring_test_helper+0x22/0x90 [amdgpu] [ 54.084698] vcn_v4_0_5_hw_init+0x87/0xc0 [amdgpu] [ 54.085307] amdgpu_device_init+0x1f96/0x2780 [amdgpu] [ 54.085951] amdgpu_driver_load_kms+0x1e/0xc0 [amdgpu] [ 54.086591] amdgpu_pci_probe+0x19f/0x550 [amdgpu] [ 54.087215] local_pci_probe+0x48/0xa0 [ 54.087509] pci_device_probe+0xc9/0x250 [ 54.087812] really_probe+0x1a4/0x3f0 [ 54.088101] __driver_probe_device+0x7d/0x170 [ 54.088443] driver_probe_device+0x24/0xa0 [ 54.088765] __driver_attach+0xdd/0x1d0 [ 54.089068] ? __pfx___driver_attach+0x10/0x10 [ 54.089417] bus_for_each_dev+0x8e/0xe0 [ 54.089718] driver_attach+0x22/0x30 [ 54.090000] bus_add_driver+0x120/0x220 [ 54.090303] driver_register+0x62/0x120 [ 54.090606] ? __pfx_amdgpu_init+0x10/0x10 [amdgpu] [ 54.091255] __pci_register_driver+0x62/0x70 [ 54.091593] amdgpu_init+0x67/0xff0 [amdgpu] [ 54.092190] do_one_initcall+0x5f/0x330 [ 54.092495] do_init_module+0x68/0x240 [ 54.092794] load_module+0x201c/0x2110 [ 54.093093] init_module_from_file+0x97/0xd0 [ 54.093428] ? init_module_from_file+0x97/0xd0 [ 54.093777] idempotent_init_module+0x11c/0x2a0 [ 54.094134] __x64_sys_finit_module+0x64/0xc0 [ 54.094476] do_syscall_64+0x58/0x120 [ 54.094767] entry_SYSCALL_64_after_hwframe+0x6e/0x76 Signed-off-by: Tim Huang Reviewed-by: Saleemkhan Jamadar Signed-off-by: Alex Deucher Cc: stable@vger.kernel.org (cherry picked from commit 0b071245ddd98539d4f7493bdd188417fcf2d629) drivers/gpu/drm/amd/amdgpu/vcn_v4_0.c | 6 ++++++ drivers/gpu/drm/amd/amdgpu/vcn_v4_0_5.c | 6 ++++++ drivers/gpu/drm/amd/amdgpu/vcn_v5_0_0.c | 6 ++++++ 3 files changed, 18 insertions(+) commit 1a8825259a9ccc53faddcdec24cf94e0a36b32cc Author: Stanley.Yang Date: Thu Jul 18 10:58:04 2024 +0800 drm/amdgpu: Fix eeprom max record count The eeprom table is empty before initializing, set eeprom table version first before initializing. Changed from V1: Reuse amdgpu_ras_set_eeprom_table_version function Signed-off-by: Stanley.Yang Reviewed-by: Hawking Zhang Signed-off-by: Alex Deucher (cherry picked from commit 015b8a2fdf39a4c288ff24e7b715b8d9198e56dc) drivers/gpu/drm/amd/amdgpu/amdgpu_ras_eeprom.c | 3 +++ 1 file changed, 3 insertions(+) commit afac8c6554ccee54bfd1743755e10af005be3bcf Author: YiPeng Chai Date: Fri Jul 19 20:43:04 2024 +0800 drm/amdgpu: fix ras UE error injection failure issue The ras command shared memory is allocated from VRAM and the response status of the command buffer will not be zero due to gpu being in fatal error state after ras UE error injection. Signed-off-by: YiPeng Chai Reviewed-by: Hawking Zhang Signed-off-by: Alex Deucher (cherry picked from commit 8284951a6e79c6806c675e5f68a4cd425dd56bc4) drivers/gpu/drm/amd/amdgpu/amdgpu_psp.c | 4 +--- 1 file changed, 1 insertion(+), 3 deletions(-) commit 5302d1a06a2cd9855378122a07c9e0942f0f04a9 Author: Rodrigo Siqueira Date: Thu Jul 4 11:54:34 2024 -0600 drm/amd/display: Remove ASSERT if significance is zero in math_ceil2 In the DML math_ceil2 function, there is one ASSERT if the significance is equal to zero. However, significance might be equal to zero sometimes, and this is not an issue for a ceil function, but the current ASSERT will trigger warnings in those cases. This commit removes the ASSERT if the significance is equal to zero to avoid unnecessary noise. Cc: Mario Limonciello Cc: Alex Deucher Cc: stable@vger.kernel.org Reviewed-by: Chaitanya Dhere Signed-off-by: Rodrigo Siqueira Signed-off-by: Aurabindo Pillai Signed-off-by: Alex Deucher (cherry picked from commit 332315885d3ccc6d8fe99700f3c2e4c24aa65ab7) .../dc/dml2/dml21/src/dml2_standalone_libraries/lib_float_math.c | 2 -- 1 file changed, 2 deletions(-) commit 4ab68e168ae1695f7c04fae98930740aaf7c50fa Author: Sung Joon Kim Date: Mon Jul 8 19:29:49 2024 -0400 drm/amd/display: Check for NULL pointer [why & how] Need to make sure plane_state is initialized before accessing its members. Cc: Mario Limonciello Cc: Alex Deucher Cc: stable@vger.kernel.org Reviewed-by: Xi (Alex) Liu Signed-off-by: Sung Joon Kim Signed-off-by: Aurabindo Pillai Signed-off-by: Alex Deucher (cherry picked from commit 295d91cbc700651782a60572f83c24861607b648) drivers/gpu/drm/amd/display/dc/core/dc_surface.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) commit 6728f55590a667c292cee10c009e16d90f48d63a Author: Jane Jian Date: Mon Jul 15 18:48:31 2024 +0800 drm/amdgpu/vcn: Use offsets local to VCN/JPEG in VF For VCN/JPEG 4.0.3, use only the local addressing scheme. - Mask bit higher than AID0 range v2 remain the case for mmhub use master XCC Signed-off-by: Jane Jian Reviewed-by: Lijo Lazar Signed-off-by: Alex Deucher (cherry picked from commit caaf576292f8ccef5cdc0ac16e77b87dbf6e17ab) drivers/gpu/drm/amd/amdgpu/jpeg_v4_0_3.c | 19 +++++++++++-- drivers/gpu/drm/amd/amdgpu/vcn_v4_0_3.c | 46 +++++++++++++++++++++++++++++--- 2 files changed, 60 insertions(+), 5 deletions(-) commit 485432d090016aebf8fb407a44ce7a2f856d11eb Author: Lijo Lazar Date: Mon Dec 11 11:18:42 2023 +0530 drm/amdgpu: Add empty HDP flush function to VCN v4.0.3 VCN 4.0.3 does not HDP flush with RRMT enabled. Instead, mmsch will do the HDP flush. This change is necessary for VCN v4.0.3, no need for backward compatibility Signed-off-by: Lijo Lazar Signed-off-by: Jane Jian Reviewed-by: Hawking Zhang Signed-off-by: Alex Deucher (cherry picked from commit 49cfaebe48e97500a68d5322a8194736b0a2c3cf) drivers/gpu/drm/amd/amdgpu/vcn_v4_0_3.c | 8 ++++++++ 1 file changed, 8 insertions(+) commit 23df34997d386f1442d26f2d8edf44a5b5fee79f Author: Lijo Lazar Date: Mon Dec 11 10:45:38 2023 +0530 drm/amdgpu: Add empty HDP flush function to JPEG v4.0.3 JPEG v4.0.3 doesn't support HDP flush when RRMT is enabled. Instead, mmsch fw will do the flush. This change is necessary for JPEG v4.0.3, no need for backward compatibility Signed-off-by: Lijo Lazar Signed-off-by: Jane Jian Reviewed-by: Hawking Zhang Signed-off-by: Alex Deucher (cherry picked from commit 585e3fdb36f59c5cfed0ae06c852dc1df22b1d60) drivers/gpu/drm/amd/amdgpu/jpeg_v4_0_3.c | 8 ++++++++ 1 file changed, 8 insertions(+) commit df65aabef3c0327c23b840ab5520150df4db6b5f Author: Ma Ke Date: Thu Jul 18 22:17:35 2024 +0800 drm/amd/amdgpu: Fix uninitialized variable warnings Return 0 to avoid returning an uninitialized variable r. Cc: stable@vger.kernel.org Fixes: 230dd6bb6117 ("drm/amd/amdgpu: implement mode2 reset on smu_v13_0_10") Signed-off-by: Ma Ke Signed-off-by: Alex Deucher (cherry picked from commit 6472de66c0aa18d50a4b5ca85f8272e88a737676) drivers/gpu/drm/amd/amdgpu/smu_v13_0_10.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 73048bda46c3085df5fd42840de09523386d3e54 Author: David Belanger Date: Mon Jun 10 16:38:55 2024 -0400 drm/amdgpu: Fix atomics on GFX12 If PCIe supports atomics, configure register to prevent DF from breaking atomics in separate load/store operations. Signed-off-by: David Belanger Reviewed-by: Hawking Zhang Signed-off-by: Alex Deucher (cherry picked from commit 666f14cab21b17ccc1bdfe1e82458aa429b3b7e0) drivers/gpu/drm/amd/amdgpu/Makefile | 3 +- drivers/gpu/drm/amd/amdgpu/amdgpu_df.h | 1 + drivers/gpu/drm/amd/amdgpu/amdgpu_discovery.c | 5 +++ drivers/gpu/drm/amd/amdgpu/df_v4_15.c | 45 ++++++++++++++++++++++ drivers/gpu/drm/amd/amdgpu/df_v4_15.h | 30 +++++++++++++++ drivers/gpu/drm/amd/amdgpu/soc24.c | 4 ++ .../drm/amd/include/asic_reg/df/df_4_15_offset.h | 28 ++++++++++++++ .../drm/amd/include/asic_reg/df/df_4_15_sh_mask.h | 28 ++++++++++++++ 8 files changed, 143 insertions(+), 1 deletion(-) commit a03ebf116303e5d13ba9a2b65726b106cb1e96f6 Author: Alex Deucher Date: Tue Jul 9 17:54:11 2024 -0400 drm/amdgpu/sdma5.2: Update wptr registers as well as doorbell We seem to have a case where SDMA will sometimes miss a doorbell if GFX is entering the powergating state when the doorbell comes in. To workaround this, we can update the wptr via MMIO, however, this is only safe because we disallow gfxoff in begin_ring() for SDMA 5.2 and then allow it again in end_ring(). Enable this workaround while we are root causing the issue with the HW team. Bug: https://gitlab.freedesktop.org/drm/amd/-/issues/3440 Tested-by: Friedrich Vock Signed-off-by: Alex Deucher Cc: stable@vger.kernel.org (cherry picked from commit f2ac52634963fc38e4935e11077b6f7854e5d700) drivers/gpu/drm/amd/amdgpu/sdma_v5_2.c | 12 ++++++++++++ 1 file changed, 12 insertions(+) commit c33ffdb70cc6df4105160f991288e7d2567d7ffa Merge: ad7b0b7b87bb 2a011c3c12e8 Author: Linus Torvalds Date: Wed Jul 24 13:11:28 2024 -0700 Merge tag 'phy-for-6.11' of git://git.kernel.org/pub/scm/linux/kernel/git/phy/linux-phy Pull phy updates from Vinod Koul: "New Support - Samsung Exynos gs101 drd combo phy - Qualcomm SC8180x USB uniphy, IPQ9574 QMP PCIe phy - Airoha EN7581 PCIe phy - Freescale i.MX8Q HSIO SerDes phy - Starfive jh7110 dphy tx Updates: - Resume support for j721e-wiz driver - Updates to Exynos usbdrd driver - Support for optional power domains in g12a usb2-phy driver - Debugfs support and updates to zynqmp driver" * tag 'phy-for-6.11' of git://git.kernel.org/pub/scm/linux/kernel/git/phy/linux-phy: (56 commits) phy: airoha: Add dtime and Rx AEQ IO registers dt-bindings: phy: airoha: Add dtime and Rx AEQ IO registers dt-bindings: phy: rockchip-emmc-phy: Convert to dtschema dt-bindings: phy: qcom,qmp-usb: fix spelling error phy: exynos5-usbdrd: support Exynos USBDRD 3.1 combo phy (HS & SS) phy: exynos5-usbdrd: convert Vbus supplies to regulator_bulk phy: exynos5-usbdrd: convert (phy) register access clock to clk_bulk phy: exynos5-usbdrd: convert core clocks to clk_bulk phy: exynos5-usbdrd: support isolating HS and SS ports independently dt-bindings: phy: samsung,usb3-drd-phy: add gs101 compatible phy: core: Fix documentation of of_phy_get phy: starfive: Correct the dphy configure process phy: zynqmp: Add debugfs support phy: zynqmp: Take the phy mutex in xlate phy: zynqmp: Only wait for PLL lock "primary" instances phy: zynqmp: Store instance instead of type phy: zynqmp: Enable reference clock correctly phy: cadence-torrent: Check return value on register read phy: Fix the cacography in phy-exynos5250-usb2.c phy: phy-rockchip-samsung-hdptx: Select CONFIG_MFD_SYSCON ... commit ad7b0b7b87bb19ea7ee71e165e597f5fbfac76ab Merge: 7a46b17d4c00 fdd3d14ca3c8 Author: Linus Torvalds Date: Wed Jul 24 13:04:43 2024 -0700 Merge tag 'soundwire-6.11-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/vkoul/soundwire Pull soundwire updates from Vinod Koul: - Simplification across subsystem using cleanup.h - Support for debugfs to read/write commands - Few Intel and Qualcomm driver updates * tag 'soundwire-6.11-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/vkoul/soundwire: soundwire: debugfs: simplify with cleanup.h soundwire: cadence: simplify with cleanup.h soundwire: intel_ace2x: simplify with cleanup.h soundwire: intel_ace2x: simplify return path in hw_params soundwire: intel: simplify with cleanup.h soundwire: intel: simplify return path in hw_params soundwire: amd_init: simplify with cleanup.h soundwire: amd: simplify with cleanup.h soundwire: amd: simplify return path in hw_params soundwire: intel_auxdevice: start the bus at default frequency soundwire: intel_auxdevice: add cs42l43 codec to wake_capable_list drivers:soundwire: qcom: cleanup port maask calculations soundwire: bus: simplify by using local slave->prop soundwire: generic_bandwidth_allocation: change port_bo parameter to pointer soundwire: Intel: clarify Copyright information soundwire: intel_ace2.x: add AC timing extensions for PantherLake soundwire: bus: add stream refcount soundwire: debugfs: add interface to read/write commands commit 7a46b17d4c00c2547b5bd82eec9489b19128fd65 Merge: 7a3fad30fd8b b8ec9dba02a7 Author: Linus Torvalds Date: Wed Jul 24 12:34:47 2024 -0700 Merge tag 'dmaengine-6.11-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/vkoul/dmaengine Pull dmaengine updates from Vinod Koul: "New support: - New dmaengine_prep_peripheral_dma_vec() to support transfers using dma vectors and documentation and user in AXI dma - STMicro STM32 DMA3 support and new capabilities of cyclic dma Updates: - Yaml conversion for Freescale imx dma and qdma bindings, sprd sc9860 dma binding - Altera msgdma updates for descriptor management" * tag 'dmaengine-6.11-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/vkoul/dmaengine: (35 commits) dt-bindings: fsl-qdma: fix interrupts 'if' check logic dt-bindings: dma: sprd,sc9860-dma: convert to YAML dmaengine: fsl-dpaa2-qdma: add missing MODULE_DESCRIPTION() macro dmaengine: ti: add missing MODULE_DESCRIPTION() macros dmaengine: ti: cppi41: add missing MODULE_DESCRIPTION() macro dmaengine: virt-dma: add missing MODULE_DESCRIPTION() macro dmaengine: ti: k3-udma: Fix BCHAN count with UHC and HC channels dmaengine: sh: rz-dmac: Fix lockdep assert warning dmaengine: qcom: gpi: clean up the IRQ disable/enable in gpi_reset_chan() dmaengine: fsl-edma: change the memory access from local into remote mode in i.MX 8QM dmaengine: qcom: gpi: remove unused struct 'reg_info' dmaengine: moxart-dma: remove unused struct 'moxart_filter_data' dt-bindings: fsl-qdma: Convert to yaml format dmaengine: fsl-edma: remove redundant "idle" field from fsl_chan dmaengine: fsl-edma: request per-channel IRQ only when channel is allocated dmaengine: stm32-dma3: defer channel registration to specify channel name dmaengine: add channel device name to channel registration dmaengine: stm32-dma3: improve residue granularity dmaengine: stm32-dma3: add device_pause and device_resume ops dmaengine: stm32-dma3: add DMA_MEMCPY capability ... commit 78eb4ea25cd5fdbdae7eb9fdf87b99195ff67508 Author: Joel Granados Date: Wed Jul 24 20:59:29 2024 +0200 sysctl: treewide: constify the ctl_table argument of proc_handlers const qualify the struct ctl_table argument in the proc_handler function signatures. This is a prerequisite to moving the static ctl_table structs into .rodata data which will ensure that proc_handler function pointers cannot be modified. This patch has been generated by the following coccinelle script: ``` virtual patch @r1@ identifier ctl, write, buffer, lenp, ppos; identifier func !~ "appldata_(timer|interval)_handler|sched_(rt|rr)_handler|rds_tcp_skbuf_handler|proc_sctp_do_(hmac_alg|rto_min|rto_max|udp_port|alpha_beta|auth|probe_interval)"; @@ int func( - struct ctl_table *ctl + const struct ctl_table *ctl ,int write, void *buffer, size_t *lenp, loff_t *ppos); @r2@ identifier func, ctl, write, buffer, lenp, ppos; @@ int func( - struct ctl_table *ctl + const struct ctl_table *ctl ,int write, void *buffer, size_t *lenp, loff_t *ppos) { ... } @r3@ identifier func; @@ int func( - struct ctl_table * + const struct ctl_table * ,int , void *, size_t *, loff_t *); @r4@ identifier func, ctl; @@ int func( - struct ctl_table *ctl + const struct ctl_table *ctl ,int , void *, size_t *, loff_t *); @r5@ identifier func, write, buffer, lenp, ppos; @@ int func( - struct ctl_table * + const struct ctl_table * ,int write, void *buffer, size_t *lenp, loff_t *ppos); ``` * Code formatting was adjusted in xfs_sysctl.c to comply with code conventions. The xfs_stats_clear_proc_handler, xfs_panic_mask_proc_handler and xfs_deprecated_dointvec_minmax where adjusted. * The ctl_table argument in proc_watchdog_common was const qualified. This is called from a proc_handler itself and is calling back into another proc_handler, making it necessary to change it as part of the proc_handler migration. Co-developed-by: Thomas Weißschuh Signed-off-by: Thomas Weißschuh Co-developed-by: Joel Granados Signed-off-by: Joel Granados arch/arm64/kernel/armv8_deprecated.c | 2 +- arch/arm64/kernel/fpsimd.c | 2 +- arch/s390/appldata/appldata_base.c | 10 ++--- arch/s390/kernel/debug.c | 2 +- arch/s390/kernel/topology.c | 2 +- arch/s390/mm/cmm.c | 6 +-- arch/x86/kernel/itmt.c | 2 +- drivers/cdrom/cdrom.c | 4 +- drivers/char/random.c | 4 +- drivers/macintosh/mac_hid.c | 2 +- drivers/net/vrf.c | 2 +- drivers/parport/procfs.c | 12 +++--- drivers/perf/arm_pmuv3.c | 2 +- drivers/perf/riscv_pmu_sbi.c | 2 +- fs/coredump.c | 2 +- fs/dcache.c | 2 +- fs/drop_caches.c | 2 +- fs/exec.c | 2 +- fs/file_table.c | 2 +- fs/fs-writeback.c | 2 +- fs/inode.c | 2 +- fs/pipe.c | 2 +- fs/quota/dquot.c | 2 +- fs/xfs/xfs_sysctl.c | 6 +-- include/linux/ftrace.h | 4 +- include/linux/mm.h | 8 ++-- include/linux/perf_event.h | 6 +-- include/linux/security.h | 2 +- include/linux/sysctl.h | 34 ++++++++-------- include/linux/vmstat.h | 4 +- include/linux/writeback.h | 2 +- include/net/ndisc.h | 2 +- include/net/neighbour.h | 6 +-- include/net/netfilter/nf_hooks_lwtunnel.h | 2 +- ipc/ipc_sysctl.c | 6 +-- kernel/bpf/syscall.c | 4 +- kernel/delayacct.c | 2 +- kernel/events/callchain.c | 2 +- kernel/events/core.c | 4 +- kernel/fork.c | 2 +- kernel/hung_task.c | 2 +- kernel/kexec_core.c | 2 +- kernel/kprobes.c | 2 +- kernel/latencytop.c | 2 +- kernel/pid_namespace.c | 2 +- kernel/pid_sysctl.h | 2 +- kernel/printk/internal.h | 2 +- kernel/printk/printk.c | 2 +- kernel/printk/sysctl.c | 2 +- kernel/sched/core.c | 6 +-- kernel/sched/rt.c | 8 ++-- kernel/sched/topology.c | 2 +- kernel/seccomp.c | 2 +- kernel/stackleak.c | 2 +- kernel/sysctl.c | 64 +++++++++++++++---------------- kernel/time/timer.c | 2 +- kernel/trace/ftrace.c | 2 +- kernel/trace/trace.c | 2 +- kernel/trace/trace_events_user.c | 2 +- kernel/trace/trace_stack.c | 2 +- kernel/umh.c | 2 +- kernel/utsname_sysctl.c | 2 +- kernel/watchdog.c | 12 +++--- mm/compaction.c | 6 +-- mm/hugetlb.c | 6 +-- mm/page-writeback.c | 10 ++--- mm/page_alloc.c | 14 +++---- mm/util.c | 6 +-- mm/vmstat.c | 4 +- net/bridge/br_netfilter_hooks.c | 2 +- net/core/neighbour.c | 18 ++++----- net/core/sysctl_net_core.c | 20 +++++----- net/ipv4/devinet.c | 6 +-- net/ipv4/route.c | 2 +- net/ipv4/sysctl_net_ipv4.c | 30 +++++++-------- net/ipv6/addrconf.c | 16 ++++---- net/ipv6/ndisc.c | 2 +- net/ipv6/route.c | 2 +- net/ipv6/sysctl_net_ipv6.c | 4 +- net/mpls/af_mpls.c | 4 +- net/mptcp/ctrl.c | 4 +- net/netfilter/ipvs/ip_vs_ctl.c | 12 +++--- net/netfilter/nf_conntrack_standalone.c | 2 +- net/netfilter/nf_hooks_lwtunnel.c | 2 +- net/netfilter/nf_log.c | 2 +- net/phonet/sysctl.c | 2 +- net/rds/tcp.c | 4 +- net/sctp/sysctl.c | 28 +++++++------- net/sunrpc/sysctl.c | 4 +- net/sunrpc/xprtrdma/svc_rdma.c | 2 +- security/apparmor/lsm.c | 2 +- security/min_addr.c | 2 +- security/yama/yama_lsm.c | 2 +- 93 files changed, 258 insertions(+), 258 deletions(-) commit e0ff0cff1f6cdce0aa596aac04129893201c4162 Author: Georgia Garcia Date: Mon Jun 10 09:51:48 2024 -0300 apparmor: unpack transition table if dfa is not present Due to a bug in earlier userspaces, a transition table may be present even when the dfa is not. Commit 7572fea31e3e ("apparmor: convert fperm lookup to use accept as an index") made the verification check more rigourous regressing old userspaces with the bug. For compatibility reasons allow the orphaned transition table during unpack and discard. Fixes: 7572fea31e3e ("apparmor: convert fperm lookup to use accept as an index") Signed-off-by: Georgia Garcia Signed-off-by: John Johansen security/apparmor/policy_unpack.c | 42 +++++++++++++++++++++++---------------- 1 file changed, 25 insertions(+), 17 deletions(-) commit f4fee216df7d28b87d1c9cc60bcebfecb51c1a05 Author: Mateusz Guzik Date: Thu Jun 20 19:15:27 2024 +0200 apparmor: try to avoid refing the label in apparmor_file_open If the label is not stale (which is the common case), the fact that the passed file object holds a reference can be leverged to avoid the ref/unref cycle. Doing so reduces performance impact of apparmor on parallel open() invocations. When benchmarking on a 24-core vm using will-it-scale's open1_process ("Separate file open"), the results are (ops/s): before: 6092196 after: 8309726 (+36%) Signed-off-by: Mateusz Guzik Signed-off-by: John Johansen security/apparmor/include/cred.h | 20 ++++++++++++++++++++ security/apparmor/lsm.c | 5 +++-- 2 files changed, 23 insertions(+), 2 deletions(-) commit 445d336cd15860f1efb441e6d694f829fbf679eb Author: Dmitry Osipenko Date: Sun Jul 14 23:50:09 2024 +0300 drm/virtio: Fix type of dma-fence context variable Type of DMA fence context is u64. Fence-waiting code uses u32 for the context variable, fix it. Fixes: e4812ab8e6b1 ("drm/virtio: Refactor and optimize job submission code path") Cc: # v6.4+ Signed-off-by: Dmitry Osipenko Reviewed-by: Rob Clark Link: https://patchwork.freedesktop.org/patch/msgid/20240714205009.3408298-1-dmitry.osipenko@collabora.com drivers/gpu/drm/virtio/virtgpu_submit.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 4b954a025591a1c7d3a0c0111b6d4730596046b6 Author: Jeff Johnson Date: Wed May 29 18:21:39 2024 -0700 apparmor: test: add MODULE_DESCRIPTION() Fix the 'make W=1' warning: WARNING: modpost: missing MODULE_DESCRIPTION() in security/apparmor/apparmor_policy_unpack_test.o Signed-off-by: Jeff Johnson Signed-off-by: John Johansen security/apparmor/policy_unpack_test.c | 1 + 1 file changed, 1 insertion(+) commit 33be0cfa5ba522ba88ba25cb95e582932843409b Author: Alexander Mikhalitsyn Date: Fri Jun 28 17:37:12 2024 +0200 apparmor: take nosymfollow flag into account A "nosymfollow" flag was added in commit dab741e0e02b ("Add a "nosymfollow" mount option.") While we don't need to implement any special logic on the AppArmor kernel side to handle it, we should provide user with a correct list of mount flags in audit logs. Signed-off-by: Alexander Mikhalitsyn Reviewed-by: Georgia Garcia Signed-off-by: John Johansen security/apparmor/mount.c | 2 ++ 1 file changed, 2 insertions(+) commit 7a3fad30fd8b4b5e370906b3c554f64026f56c2f Merge: d1e9a63dcd72 ad8070cb1b4b Author: Linus Torvalds Date: Wed Jul 24 10:29:50 2024 -0700 Merge tag 'random-6.11-rc1-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/crng/random Pull random number generator updates from Jason Donenfeld: "This adds getrandom() support to the vDSO. First, it adds a new kind of mapping to mmap(2), MAP_DROPPABLE, which lets the kernel zero out pages anytime under memory pressure, which enables allocating memory that never gets swapped to disk but also doesn't count as being mlocked. Then, the vDSO implementation of getrandom() is introduced in a generic manner and hooked into random.c. Next, this is implemented on x86. (Also, though it's not ready for this pull, somebody has begun an arm64 implementation already) Finally, two vDSO selftests are added. There are also two housekeeping cleanup commits" * tag 'random-6.11-rc1-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/crng/random: MAINTAINERS: add random.h headers to RNG subsection random: note that RNDGETPOOL was removed in 2.6.9-rc2 selftests/vDSO: add tests for vgetrandom x86: vdso: Wire up getrandom() vDSO implementation random: introduce generic vDSO getrandom() implementation mm: add MAP_DROPPABLE for designating always lazily freeable mappings commit d1e9a63dcd7248385bbbccf1650d69e4af914f05 Merge: e44be00289ef f5e5e97c719d Author: Linus Torvalds Date: Wed Jul 24 09:42:51 2024 -0700 Merge tag 'vfs-6.11-rc1.fixes.2' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs Pull vfs fixes from Christian Brauner: "VFS: - The new 64bit mount ids start after the old mount id, i.e., at the first non-32 bit value. However, we started counting one id too late and thus lost 4294967296 as the first valid id. Fix that. - Update a few comments on some vfs_*() creation helpers. - Move copying of the xattr name out from the locks required to start a filesystem write. - Extend the filelock lock UAF fix to the compat code as well. - Now that we added the ability to look up an inode under RCU it's possible that lockless hash lookup can find and lock an inode after it gets I_FREEING set. It then waits until inode teardown in evict() is finished. The flag however is still set after evict() has woken up all waiters. If the inode lock is taken late enough on the waiting side after hash removal and wakeup happened the waiting thread will never be woken. Before RCU based lookup this was synchronized via the inode_hash_lock. But since unhashing requires the inode lock as well we can check whether the inode is unhashed while holding inode lock even without holding inode_hash_lock. pidfd: - The nsproxy structure contains nearly all of the namespaces associated with a task. When a namespace type isn't supported nsproxy might contain a NULL pointer or always point to the initial namespace type. The logic isn't consistent. So when deriving namespace fds we need to ensure that the namespace type is supported. First, so that we don't risk dereferncing NULL pointers. The correct bigger fix would be to change all namespaces to always set a valid namespace pointer in struct nsproxy independent of whether or not it is compiled in. But that requires quite a few changes. Second, so that we don't allow deriving namespace fds when the namespace type doesn't exist and thus when they couldn't also be derived via /proc/self/ns/. - Add missing selftests for the new pidfd ioctls to derive namespace fds. This simply extends the already existing testsuite. netfs: - Fix debug logging and fix kconfig variable name so it actually works. - Fix writeback that goes both to the server and cache. The streams are only activated once a subreq is added. When a server write happens the subreq doesn't need to have finished by the time the cache write is started. If the server write has already finished by the time the cache write is about to start the cache write will operate on a folio that might already have been reused. Fix this by preactivating the cache write. - Limit cachefiles subreq size for cache writes to MAX_RW_COUNT" * tag 'vfs-6.11-rc1.fixes.2' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs: inode: clarify what's locked vfs: Fix potential circular locking through setxattr() and removexattr() filelock: Fix fcntl/close race recovery compat path fs: use all available ids cachefiles: Set the max subreq size for cache writes to MAX_RW_COUNT netfs: Fix writeback that needs to go to both server and cache pidfs: add selftests for new namespace ioctls pidfs: handle kernels without namespaces cleanly pidfs: when time ns disabled add check for ioctl vfs: correct the comments of vfs_*() helpers vfs: handle __wait_on_freeing_inode() and evict() race netfs: Rename CONFIG_FSCACHE_DEBUG to CONFIG_NETFS_DEBUG netfs: Revert "netfs: Switch debug logging to pr_debug()" commit facdbdfe0e6202d74758387ae9189c39f7b4b16c Author: Benjamin Tissoires Date: Tue Jul 23 18:21:54 2024 +0200 selftests/hid: add test for attaching multiple time the same struct_ops Turns out that we would en up in a bad state if we attempt to attach twice the same HID-BPF struct_ops, so have a test for it. Link: https://patch.msgid.link/20240723-fix-6-11-bpf-v1-4-b9d770346784@kernel.org Signed-off-by: Benjamin Tissoires tools/testing/selftests/hid/hid_bpf.c | 18 ++++++++++++++++++ 1 file changed, 18 insertions(+) commit acd34cfc48b3dd46e5e4c4bdc99cc0c15568bac0 Author: Benjamin Tissoires Date: Tue Jul 23 18:21:53 2024 +0200 HID: bpf: prevent the same struct_ops to be attached more than once If the struct_ops is already attached, we should bail out or we will end up in various locks and pointer issues while unregistering. Link: https://patch.msgid.link/20240723-fix-6-11-bpf-v1-3-b9d770346784@kernel.org Signed-off-by: Benjamin Tissoires drivers/hid/bpf/hid_bpf_struct_ops.c | 5 +++++ 1 file changed, 5 insertions(+) commit f64c1a4593391c57accf32693a14ef45f8162b5c Author: Benjamin Tissoires Date: Tue Jul 23 18:21:52 2024 +0200 selftests/hid: disable struct_ops auto-attach Since commit 08ac454e258e ("libbpf: Auto-attach struct_ops BPF maps in BPF skeleton"), libbpf automatically calls bpf_map__attach_struct_ops() on every struct_ops it sees in the bpf object. The problem is that our test bpf object has many of them but only one should be manually loaded at a time, or we end up locking the syscall. Link: https://patch.msgid.link/20240723-fix-6-11-bpf-v1-2-b9d770346784@kernel.org Signed-off-by: Benjamin Tissoires tools/testing/selftests/hid/hid_bpf.c | 8 ++++++++ 1 file changed, 8 insertions(+) commit ff9fbcafbaf13346c742c0d672a22f5ac20b9d92 Author: Benjamin Tissoires Date: Tue Jul 23 18:21:51 2024 +0200 selftests/hid: fix bpf_wq new API Since commit f56f4d541eab ("bpf: helpers: fix bpf_wq_set_callback_impl signature"), the API for bpf_wq changed a bit. We need to update the selftests/hid code to reflect that or the bpf program will not load. Link: https://patch.msgid.link/20240723-fix-6-11-bpf-v1-1-b9d770346784@kernel.org Signed-off-by: Benjamin Tissoires tools/testing/selftests/hid/progs/hid.c | 2 +- tools/testing/selftests/hid/progs/hid_bpf_helpers.h | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) commit e44be00289ef3ce8195d915cf354714b14fd30a4 Author: Linus Torvalds Date: Tue Jul 23 18:14:54 2024 -0700 hostfs: fix folio conversion Commit e3ec0fe944d2 ("hostfs: Convert hostfs_read_folio() to use a folio") simplified hostfs_read_folio(), but in the process of converting to using folios natively also mis-used the folio_zero_tail() function due to the very confusing API of that function. Very arguably it's folio_zero_tail() API itself that is buggy, since it would make more sense (and the documentation kind of implies) that the third argument would be the pointer to the beginning of the folio buffer. But no, the third argument to folio_zero_tail() is where we should start zeroing the tail (even if we already also pass in the offset separately as the second argument). So fix the hostfs caller, and we can leave any folio_zero_tail() sanity cleanup for later. Reported-and-tested-by: Maciej Żenczykowski Fixes: e3ec0fe944d2 ("hostfs: Convert hostfs_read_folio() to use a folio") Link: https://lore.kernel.org/all/CANP3RGceNzwdb7w=vPf5=7BCid5HVQDmz1K5kC9JG42+HVAh_g@mail.gmail.com/ Cc: Matthew Wilcox Cc: Christian Brauner Signed-off-by: Linus Torvalds fs/hostfs/hostfs_kern.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit e6e18021ddd0dc5af487fb86b6d7c964e062d692 Author: Luke D. Jones Date: Tue Jul 23 13:12:24 2024 +1200 ALSA: hda/realtek: cs35l41: Fixup remaining asus strix models Adjust quirks for 0x3a20, 0x3a30, 0x3a50 to match the 0x3a60. This set has now been confirmed to work with this patch. Signed-off-by: Luke D. Jones Fixes: 811dd426a9b1 ("ALSA: hda/realtek: Add quirks for Asus ROG 2024 laptops using CS35L41") Cc: Link: https://patch.msgid.link/20240723011224.115579-1-luke@ljones.dev Signed-off-by: Takashi Iwai sound/pci/hda/patch_realtek.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) commit 55fbb9a5d64e0e590cad5eacc16c99f2482a008f Author: Ming Lei Date: Wed Jul 24 22:33:11 2024 +0800 ublk: fix UBLK_CMD_DEL_DEV_ASYNC handling In ublk_ctrl_uring_cmd(), ioctl command NR should be used for matching _IOC_NR(cmd_op). Fix it by adding one private macro, and this way is clean. Fixes: 13fe8e6825e4 ("ublk: add UBLK_CMD_DEL_DEV_ASYNC") Signed-off-by: Ming Lei Link: https://lore.kernel.org/r/20240724143311.2646330-1-ming.lei@redhat.com Signed-off-by: Jens Axboe drivers/block/ublk_drv.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) commit 7e04da2dc7013af50ed3a2beb698d5168d1e594b Author: Yang Yang Date: Wed Jul 24 15:04:12 2024 +0800 block: fix deadlock between sd_remove & sd_release Our test report the following hung task: [ 2538.459400] INFO: task "kworker/0:0":7 blocked for more than 188 seconds. [ 2538.459427] Call trace: [ 2538.459430] __switch_to+0x174/0x338 [ 2538.459436] __schedule+0x628/0x9c4 [ 2538.459442] schedule+0x7c/0xe8 [ 2538.459447] schedule_preempt_disabled+0x24/0x40 [ 2538.459453] __mutex_lock+0x3ec/0xf04 [ 2538.459456] __mutex_lock_slowpath+0x14/0x24 [ 2538.459459] mutex_lock+0x30/0xd8 [ 2538.459462] del_gendisk+0xdc/0x350 [ 2538.459466] sd_remove+0x30/0x60 [ 2538.459470] device_release_driver_internal+0x1c4/0x2c4 [ 2538.459474] device_release_driver+0x18/0x28 [ 2538.459478] bus_remove_device+0x15c/0x174 [ 2538.459483] device_del+0x1d0/0x358 [ 2538.459488] __scsi_remove_device+0xa8/0x198 [ 2538.459493] scsi_forget_host+0x50/0x70 [ 2538.459497] scsi_remove_host+0x80/0x180 [ 2538.459502] usb_stor_disconnect+0x68/0xf4 [ 2538.459506] usb_unbind_interface+0xd4/0x280 [ 2538.459510] device_release_driver_internal+0x1c4/0x2c4 [ 2538.459514] device_release_driver+0x18/0x28 [ 2538.459518] bus_remove_device+0x15c/0x174 [ 2538.459523] device_del+0x1d0/0x358 [ 2538.459528] usb_disable_device+0x84/0x194 [ 2538.459532] usb_disconnect+0xec/0x300 [ 2538.459537] hub_event+0xb80/0x1870 [ 2538.459541] process_scheduled_works+0x248/0x4dc [ 2538.459545] worker_thread+0x244/0x334 [ 2538.459549] kthread+0x114/0x1bc [ 2538.461001] INFO: task "fsck.":15415 blocked for more than 188 seconds. [ 2538.461014] Call trace: [ 2538.461016] __switch_to+0x174/0x338 [ 2538.461021] __schedule+0x628/0x9c4 [ 2538.461025] schedule+0x7c/0xe8 [ 2538.461030] blk_queue_enter+0xc4/0x160 [ 2538.461034] blk_mq_alloc_request+0x120/0x1d4 [ 2538.461037] scsi_execute_cmd+0x7c/0x23c [ 2538.461040] ioctl_internal_command+0x5c/0x164 [ 2538.461046] scsi_set_medium_removal+0x5c/0xb0 [ 2538.461051] sd_release+0x50/0x94 [ 2538.461054] blkdev_put+0x190/0x28c [ 2538.461058] blkdev_release+0x28/0x40 [ 2538.461063] __fput+0xf8/0x2a8 [ 2538.461066] __fput_sync+0x28/0x5c [ 2538.461070] __arm64_sys_close+0x84/0xe8 [ 2538.461073] invoke_syscall+0x58/0x114 [ 2538.461078] el0_svc_common+0xac/0xe0 [ 2538.461082] do_el0_svc+0x1c/0x28 [ 2538.461087] el0_svc+0x38/0x68 [ 2538.461090] el0t_64_sync_handler+0x68/0xbc [ 2538.461093] el0t_64_sync+0x1a8/0x1ac T1: T2: sd_remove del_gendisk __blk_mark_disk_dead blk_freeze_queue_start ++q->mq_freeze_depth bdev_release mutex_lock(&disk->open_mutex) sd_release scsi_execute_cmd blk_queue_enter wait_event(!q->mq_freeze_depth) mutex_lock(&disk->open_mutex) SCSI does not set GD_OWNS_QUEUE, so QUEUE_FLAG_DYING is not set in this scenario. This is a classic ABBA deadlock. To fix the deadlock, make sure we don't try to acquire disk->open_mutex after freezing the queue. Cc: stable@vger.kernel.org Fixes: eec1be4c30df ("block: delete partitions later in del_gendisk") Signed-off-by: Yang Yang Reviewed-by: Ming Lei Reviewed-by: Bart Van Assche Reviewed-by: Christoph Hellwig Fixes: and Cc: stable tags are missing. Otherwise this patch looks fine Link: https://lore.kernel.org/r/20240724070412.22521-1-yang.yang@vivo.com Signed-off-by: Jens Axboe block/genhd.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit cc374782b6ca0fd634482391da977542443d3368 Author: Mickaël Salaün Date: Wed Jul 24 16:54:26 2024 +0200 selftests/landlock: Add cred_transfer test Check that keyctl(KEYCTL_SESSION_TO_PARENT) preserves the parent's restrictions. Fixes: e1199815b47b ("selftests/landlock: Add user space tests") Co-developed-by: Jann Horn Signed-off-by: Jann Horn Link: https://lore.kernel.org/r/20240724.Ood5aige9she@digikod.net Signed-off-by: Mickaël Salaün tools/testing/selftests/landlock/base_test.c | 74 ++++++++++++++++++++++++++++ tools/testing/selftests/landlock/config | 1 + 2 files changed, 75 insertions(+) commit 39705a6c29f8a2b93cf5b99528a55366c50014d1 Author: Jann Horn Date: Wed Jul 24 14:49:01 2024 +0200 landlock: Don't lose track of restrictions on cred_transfer When a process' cred struct is replaced, this _almost_ always invokes the cred_prepare LSM hook; but in one special case (when KEYCTL_SESSION_TO_PARENT updates the parent's credentials), the cred_transfer LSM hook is used instead. Landlock only implements the cred_prepare hook, not cred_transfer, so KEYCTL_SESSION_TO_PARENT causes all information on Landlock restrictions to be lost. This basically means that a process with the ability to use the fork() and keyctl() syscalls can get rid of all Landlock restrictions on itself. Fix it by adding a cred_transfer hook that does the same thing as the existing cred_prepare hook. (Implemented by having hook_cred_prepare() call hook_cred_transfer() so that the two functions are less likely to accidentally diverge in the future.) Cc: stable@kernel.org Fixes: 385975dca53e ("landlock: Set up the security framework and manage credentials") Signed-off-by: Jann Horn Link: https://lore.kernel.org/r/20240724-landlock-houdini-fix-v1-1-df89a4560ca3@google.com Signed-off-by: Mickaël Salaün security/landlock/cred.c | 11 +++++++++-- 1 file changed, 9 insertions(+), 2 deletions(-) commit 66381d36771e4ffedbea0dd23da17cf3d38e9aae Author: Yunhui Cui Date: Mon Jun 17 21:14:25 2024 +0800 RISC-V: Select ACPI PPTT drivers After adding ACPI support to populate_cache_leaves(), RISC-V can build cacheinfo through the ACPI PPTT table, thus enabling the ACPI_PPTT configuration. Signed-off-by: Yunhui Cui Reviewed-by: Jeremy Linton Reviewed-by: Sudeep Holla Reviewed-by: Sunil V L Link: https://lore.kernel.org/r/20240617131425.7526-3-cuiyunhui@bytedance.com Signed-off-by: Palmer Dabbelt arch/riscv/Kconfig | 1 + 1 file changed, 1 insertion(+) commit 604f32ea6909b0ebb8ab0bf1ab7dc66ee3dc8955 Author: Yunhui Cui Date: Mon Jun 17 21:14:24 2024 +0800 riscv: cacheinfo: initialize cacheinfo's level and type from ACPI PPTT Before cacheinfo can be built correctly, we need to initialize level and type. Since RISC-V currently does not have a register group that describes cache-related attributes like ARM64, we cannot obtain them directly, so now we obtain cache leaves from the ACPI PPTT table (acpi_get_cache_info()) and set the cache type through split_levels. Suggested-by: Jeremy Linton Suggested-by: Sudeep Holla Reviewed-by: Conor Dooley Reviewed-by: Sunil V L Reviewed-by: Jeremy Linton Reviewed-by: Sudeep Holla Signed-off-by: Yunhui Cui Link: https://lore.kernel.org/r/20240617131425.7526-2-cuiyunhui@bytedance.com Signed-off-by: Palmer Dabbelt arch/riscv/kernel/cacheinfo.c | 22 ++++++++++++++++++++++ 1 file changed, 22 insertions(+) commit ee3fab10cb1566562aa683f319066eaeecccf918 Author: Yunhui Cui Date: Mon Jun 17 21:14:23 2024 +0800 riscv: cacheinfo: remove the useless input parameter (node) of ci_leaf_init() ci_leaf_init() is a declared static function. The implementation of the function body and the caller do not use the parameter (struct device_node *node) input parameter, so remove it. Fixes: 6a24915145c9 ("Revert "riscv: Set more data to cacheinfo"") Signed-off-by: Yunhui Cui Reviewed-by: Jeremy Linton Reviewed-by: Sudeep Holla Link: https://lore.kernel.org/r/20240617131425.7526-1-cuiyunhui@bytedance.com Signed-off-by: Palmer Dabbelt arch/riscv/kernel/cacheinfo.c | 13 ++++++------- 1 file changed, 6 insertions(+), 7 deletions(-) commit 38738947db38520b58b7dae64bd0eec513e83139 Author: Sia Jee Heng Date: Thu May 2 00:37:51 2024 -0700 RISC-V: ACPI: Enable SPCR table for console output on RISC-V The ACPI SPCR code has been used to enable console output for ARM64 and X86. The same code can be reused for RISC-V. Furthermore, SPCR table is mandated for headless system as outlined in the RISC-V BRS Specification, chapter 6. Signed-off-by: Sia Jee Heng Reviewed-by: Sunil V L Link: https://lore.kernel.org/r/20240502073751.102093-2-jeeheng.sia@starfivetech.com Signed-off-by: Palmer Dabbelt arch/riscv/Kconfig | 1 + arch/riscv/kernel/acpi.c | 12 +++++++++++- 2 files changed, 12 insertions(+), 1 deletion(-) commit 7c938e438c56dbbe1aceb128c46cebb340a3c06b Author: Jakub Kicinski Date: Tue Jul 23 15:34:05 2024 -0700 MAINTAINERS: make Breno the netconsole maintainer netconsole has no maintainer, and Breno has been working on improving it consistently for some time. So I think we found the maintainer :) Acked-by: Paolo Abeni Reviewed-by: Eric Dumazet Signed-off-by: Jakub Kicinski Acked-by: Breno Leitao Signed-off-by: David S. Miller MAINTAINERS | 6 ++++++ 1 file changed, 6 insertions(+) commit 0fa9af961102cf3a4cbf591a50f376c8ab1cf443 Author: Jay Vosburgh Date: Tue Jul 23 15:22:36 2024 -0700 MAINTAINERS: Update bonding entry Update my email address, clarify support status, and delete the web site that hasn't been used in a long time. Signed-off-by: Jay Vosburgh Signed-off-by: David S. Miller MAINTAINERS | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-) commit 6d745cd0e9720282cd291d36b9db528aea18add2 Author: Petr Machata Date: Tue Jul 23 18:04:16 2024 +0200 net: nexthop: Initialize all fields in dumped nexthops struct nexthop_grp contains two reserved fields that are not initialized by nla_put_nh_group(), and carry garbage. This can be observed e.g. with strace (edited for clarity): # ip nexthop add id 1 dev lo # ip nexthop add id 101 group 1 # strace -e recvmsg ip nexthop get id 101 ... recvmsg(... [{nla_len=12, nla_type=NHA_GROUP}, [{id=1, weight=0, resvd1=0x69, resvd2=0x67}]] ...) = 52 The fields are reserved and therefore not currently used. But as they are, they leak kernel memory, and the fact they are not just zero complicates repurposing of the fields for new ends. Initialize the full structure. Fixes: 430a049190de ("nexthop: Add support for nexthop groups") Signed-off-by: Petr Machata Reviewed-by: Ido Schimmel Reviewed-by: Eric Dumazet Signed-off-by: David S. Miller net/ipv4/nexthop.c | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) commit e9dbebae2e3c338122716914fe105458f41e3a4a Author: Simon Horman Date: Tue Jul 23 14:29:27 2024 +0100 net: stmmac: Correct byte order of perfect_match The perfect_match parameter of the update_vlan_hash operation is __le16, and is correctly converted from host byte-order in the lone caller, stmmac_vlan_update(). However, the implementations of this caller, dwxgmac2_update_vlan_hash() and dwxgmac2_update_vlan_hash(), both treat this parameter as host byte order, using the following pattern: u32 value = ... ... writel(value | perfect_match, ...); This is not correct because both: 1) value is host byte order; and 2) writel expects a host byte order value as it's first argument I believe that this will break on big endian systems. And I expect it has gone unnoticed by only being exercised on little endian systems. The approach taken by this patch is to update the callback, and it's caller to simply use a host byte order value. Flagged by Sparse. Compile tested only. Fixes: c7ab0b8088d7 ("net: stmmac: Fallback to VLAN Perfect filtering if HASH is not available") Signed-off-by: Simon Horman Reviewed-by: Maxime Chevallier Signed-off-by: David S. Miller drivers/net/ethernet/stmicro/stmmac/dwmac4_core.c | 2 +- drivers/net/ethernet/stmicro/stmmac/dwxgmac2_core.c | 2 +- drivers/net/ethernet/stmicro/stmmac/hwif.h | 2 +- drivers/net/ethernet/stmicro/stmmac/stmmac_main.c | 4 ++-- 4 files changed, 5 insertions(+), 5 deletions(-) commit 29d63b94036e561a016ec8878b44aad6650d23e2 Author: Pavel Begunkov Date: Wed Jul 24 12:16:21 2024 +0100 io_uring: align iowq and task request error handling There is a difference in how io_queue_sqe and io_wq_submit_work treat error codes they get from io_issue_sqe. The first one fails anything unknown but latter only fails when the code is negative. It doesn't make sense to have this discrepancy, align them to the io_queue_sqe behaviour. Signed-off-by: Pavel Begunkov Link: https://lore.kernel.org/r/c550e152bf4a290187f91a4322ddcb5d6d1f2c73.1721819383.git.asml.silence@gmail.com Signed-off-by: Jens Axboe io_uring/io_uring.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit a2b72b81fb3ba18717fc000949ca9d45a3351130 Author: Pavel Begunkov Date: Wed Jul 24 12:16:20 2024 +0100 io_uring: kill REQ_F_CANCEL_SEQ We removed the reliance on the flag by the cancellation path and now it's unused. Signed-off-by: Pavel Begunkov Link: https://lore.kernel.org/r/e57afe566bbe4fefeb44daffb08900f2a4756577.1721819383.git.asml.silence@gmail.com Signed-off-by: Jens Axboe include/linux/io_uring_types.h | 3 --- 1 file changed, 3 deletions(-) commit f1dcdfcadb0c8c13dddd931c1f4dc58e54fdc9c0 Author: Pavel Begunkov Date: Wed Jul 24 12:16:19 2024 +0100 io_uring: simplify io_uring_cmd return We don't have to return error code from an op handler back to core io_uring, so once io_uring_cmd() sets the results and handles errors we can juts return IOU_OK and simplify the code. Note, only valid with e0b23d9953b0c ("io_uring: optimise ltimeout for inline execution"), there was a problem with iopoll before. Signed-off-by: Pavel Begunkov Link: https://lore.kernel.org/r/8eae2be5b2a49236cd5f1dadbd1aa5730e9e2d4f.1721819383.git.asml.silence@gmail.com Signed-off-by: Jens Axboe io_uring/uring_cmd.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit e142e9cd8891b0c6f277ac2c2c254199a6aa56e3 Author: Pavel Begunkov Date: Wed Jul 24 12:16:18 2024 +0100 io_uring: fix io_match_task must_hold The __must_hold annotation in io_match_task() uses a non existing parameter "req", fix it. Fixes: 6af3f48bf6156 ("io_uring: fix link traversal locking") Signed-off-by: Pavel Begunkov Link: https://lore.kernel.org/r/3e65ee7709e96507cef3d93291746f2c489f2307.1721819383.git.asml.silence@gmail.com Signed-off-by: Jens Axboe io_uring/timeout.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit bd44d7e902c2b34c217d3b48874b079760ca7b6e Author: Pavel Begunkov Date: Wed Jul 24 12:16:17 2024 +0100 io_uring: don't allow netpolling with SETUP_IOPOLL IORING_SETUP_IOPOLL rings don't have any netpoll handling, let's fail attempts to register netpolling in this case, there might be people who will mix up IOPOLL and netpoll. Cc: stable@vger.kernel.org Fixes: ef1186c1a875b ("io_uring: add register/unregister napi function") Signed-off-by: Pavel Begunkov Link: https://lore.kernel.org/r/1e7553aee0a8ae4edec6742cd6dd0c1e6914fba8.1721819383.git.asml.silence@gmail.com Signed-off-by: Jens Axboe io_uring/napi.c | 2 ++ 1 file changed, 2 insertions(+) commit f8b632e89a101dae349a7b212c1771d7925f441b Author: Pavel Begunkov Date: Wed Jul 24 12:16:16 2024 +0100 io_uring: tighten task exit cancellations io_uring_cancel_generic() should retry if any state changes like a request is completed, however in case of a task exit it only goes for another loop and avoids schedule() if any tracked (i.e. REQ_F_INFLIGHT) request got completed. Let's assume we have a non-tracked request executing in iowq and a tracked request linked to it. Let's also assume io_uring_cancel_generic() fails to find and cancel the request, i.e. via io_run_local_work(), which may happen as io-wq has gaps. Next, the request logically completes, io-wq still hold a ref but queues it for completion via tw, which happens in io_uring_try_cancel_requests(). After, right before prepare_to_wait() io-wq puts the request, grabs the linked one and tries executes it, e.g. arms polling. Finally the cancellation loop calls prepare_to_wait(), there are no tw to run, no tracked request was completed, so the tctx_inflight() check passes and the task is put to indefinite sleep. Cc: stable@vger.kernel.org Fixes: 3f48cf18f886c ("io_uring: unify files and task cancel") Signed-off-by: Pavel Begunkov Link: https://lore.kernel.org/r/acac7311f4e02ce3c43293f8f1fda9c705d158f1.1721819383.git.asml.silence@gmail.com Signed-off-by: Jens Axboe io_uring/io_uring.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) commit 8d22d0db5bbcec95c70e025dce3d00821da8be7d Author: Jisheng Zhang Date: Thu Jun 13 23:30:53 2024 +0800 riscv: boot: remove duplicated targets line The "targets:" is duplicated in another line, remove the one with less targets. Signed-off-by: Jisheng Zhang Reviewed-by: Emil Renner Berthing Link: https://lore.kernel.org/r/20240613153053.3835-1-jszhang@kernel.org Signed-off-by: Palmer Dabbelt arch/riscv/boot/Makefile | 1 - 1 file changed, 1 deletion(-) commit 3308172276db5d070975d9a321283fcd423ce465 Author: Jinjie Ruan Date: Thu Jun 13 19:13:47 2024 +0800 trace: riscv: Remove deprecated kprobe on ftrace support Since commit 7caa9765465f60 ("ftrace: riscv: move from REGS to ARGS"), kprobe on ftrace is not supported by riscv, because riscv's support for FTRACE_WITH_REGS has been replaced with support for FTRACE_WITH_ARGS, and KPROBES_ON_FTRACE will be supplanted by FPROBES. So remove the deprecated kprobe on ftrace support, which is misunderstood. Signed-off-by: Jinjie Ruan Acked-by: Masami Hiramatsu (Google) Link: https://lore.kernel.org/r/20240613111347.1745379-1-ruanjinjie@huawei.com Signed-off-by: Palmer Dabbelt arch/riscv/Kconfig | 1 - arch/riscv/kernel/probes/Makefile | 1 - arch/riscv/kernel/probes/ftrace.c | 65 --------------------------------------- 3 files changed, 67 deletions(-) commit 863ff546fb62a8fa75757a30794ab6ec6cc4bab7 Author: Hangbin Liu Date: Tue Jul 23 16:22:52 2024 +0800 selftests: forwarding: skip if kernel not support setting bridge fdb learning limit If the testing kernel doesn't support setting fdb_max_learned or show fdb_n_learned, just skip it. Or we will get errors like ./bridge_fdb_learning_limit.sh: line 218: [: null: integer expression expected ./bridge_fdb_learning_limit.sh: line 225: [: null: integer expression expected Fixes: 6f84090333bb ("selftests: forwarding: bridge_fdb_learning_limit: Add a new selftest") Signed-off-by: Hangbin Liu Acked-by: Nikolay Aleksandrov Reviewed-by: Johannes Nixdorf Signed-off-by: David S. Miller .../net/forwarding/bridge_fdb_learning_limit.sh | 18 ++++++++++++++++++ 1 file changed, 18 insertions(+) commit fa96c6baef1b5385e2f0c0677b32b3839e716076 Author: Shigeru Yoshida Date: Tue Jul 16 11:09:05 2024 +0900 tipc: Return non-zero value from tipc_udp_addr2str() on error tipc_udp_addr2str() should return non-zero value if the UDP media address is invalid. Otherwise, a buffer overflow access can occur in tipc_media_addr_printf(). Fix this by returning 1 on an invalid UDP media address. Fixes: d0f91938bede ("tipc: add ip/udp media type") Signed-off-by: Shigeru Yoshida Reviewed-by: Tung Nguyen Signed-off-by: David S. Miller net/tipc/udp_media.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) commit f7c1b0e4ae47e67c6f9af84568a5f4a80638ccd8 Author: Rafael J. Wysocki Date: Thu Jul 18 21:01:14 2024 +0200 thermal: core: Back off when polling thermal zones on errors Commit a8a261774466 ("thermal: core: Call monitor_thermal_zone() if zone temperature is invalid") introduced a polling mechanism by which the thermal core attampts to get a valid temperature value for thermal zones where the .get_temp() callback returns errors to start with (for example, due to initialization ordering woes). However, this polling is carried out periodically ad infinitum and every iteration of it causes a message to be printed to the kernel log which means a lot of log noise on systems where there are thermal zones that never get ready for some reason. It is also not really useful to continuously poll thermal zones that never respond. To address this, modify the thermal core to increase the delay between consecutive thermal zone temperature checks after every check that fails until it reaches a certain maximum value. At that point, the thermal zone in question will be disabled, but user space will be able to reenable it if it believes that the failure is transient. Also change the code to print messages regarding failed temperature checks to the kernel log only twice, once when the thermal zone's .get_temp() callback returns an error for the first time and once when disabling the given thermal zone. In addition, a dev_crit() message will be printed at that point if the given thermal zone contains a critical trip point to notify the system operator about the situation. Fixes: a8a261774466 ("thermal: core: Call monitor_thermal_zone() if zone temperature is invalid") Link: https://lore.kernel.org/linux-acpi/CAGnHSE=RyPK++UG0-wAtVKgeJxe0uzFYgLxm+RUOKKoQquW=Ow@mail.gmail.com/ Reported-by: Tom Yan Signed-off-by: Rafael J. Wysocki Link: https://patch.msgid.link/2962033.e9J7NaK4W3@rjwysocki.net drivers/thermal/thermal_core.c | 58 +++++++++++++++++++++++++++++++++++++++--- drivers/thermal/thermal_core.h | 10 +++++--- 2 files changed, 61 insertions(+), 7 deletions(-) commit e6fc5fcaeffa04a3fa1db8dfccdfd4b6001c0446 Author: Peter Ujfalusi Date: Wed Jul 24 11:19:32 2024 +0300 ASoC: SOF: ipc4-topology: Preserve the DMA Link ID for ChainDMA on unprepare The DMA Link ID is set to the IPC message's primary during dai_config, which is only during hw_params. During xrun handling the hw_params is not called and the DMA Link ID information will be lost. All other fields in the message expected to be 0 for re-configuration, only the DMA Link ID needs to be preserved and the in case of repeated dai_config, it is correctly updated (masked and then set). Cc: stable@vger.kernel.org Fixes: ca5ce0caa67f ("ASoC: SOF: ipc4/intel: Add support for chained DMA") Link: https://github.com/thesofproject/linux/issues/5116 Signed-off-by: Peter Ujfalusi Reviewed-by: Bard Liao Reviewed-by: Ranjani Sridharan Reviewed-by: Pierre-Louis Bossart Link: https://patch.msgid.link/20240724081932.24542-3-peter.ujfalusi@linux.intel.com Signed-off-by: Mark Brown sound/soc/sof/ipc4-topology.c | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-) commit ae67ed9010a7b52933ad1038d13df8a3aae34b83 Author: Peter Ujfalusi Date: Wed Jul 24 11:19:31 2024 +0300 ASoC: SOF: ipc4-topology: Only handle dai_config with HW_PARAMS for ChainDMA The DMA Link ID is only valid in snd_sof_dai_config_data when the dai_config is called with HW_PARAMS. The commit that this patch fixes is actually moved a code section without changing it, the same bug exists in the original code, needing different patch to kernel prior to 6.9 kernels. Cc: stable@vger.kernel.org Fixes: 3858464de57b ("ASoC: SOF: ipc4-topology: change chain_dma handling in dai_config") Link: https://github.com/thesofproject/linux/issues/5116 Signed-off-by: Peter Ujfalusi Reviewed-by: Bard Liao Reviewed-by: Ranjani Sridharan Reviewed-by: Pierre-Louis Bossart Link: https://patch.msgid.link/20240724081932.24542-2-peter.ujfalusi@linux.intel.com Signed-off-by: Mark Brown sound/soc/sof/ipc4-topology.c | 10 ++++++++-- 1 file changed, 8 insertions(+), 2 deletions(-) commit ba6c664081afd18da86ac49cb22ceb266f89a561 Author: Petr Vorel Date: Wed Jul 24 10:46:55 2024 +0200 kbuild: rpm-pkg: Fix C locale setup semicolon separation in LC_ALL is wrong. Either variable needs to be exported before as a separate commit or set as part of the commit in the beginning. Used second variant. This fixes broken build on user's locale setup which makes 'date' binary to produce invalid characters in rpm changelog (e.g. cs_CZ.UTF-8 'čec'): $ make binrpm-pkg GEN rpmbuild/SPECS/kernel.spec rpmbuild -bb rpmbuild/SPECS/kernel.spec --define='_topdirlinux/rpmbuild' \ --target x86_64-linux --build-in-place --noprep --define='_smp_mflags \ %{nil}' $(rpm -q rpm >/dev/null 2>&1 || echo --nodeps) Building target platforms: x86_64-linux Building for target x86_64-linux error: bad date in %changelog: St čec 24 2024 user make[2]: *** [scripts/Makefile.package:71: binrpm-pkg] Error 1 make[1]: *** [linux/Makefile:1546: binrpm-pkg] Error 2 make: *** [Makefile:224: __sub-make] Error 2 Fixes: 301c10908e42 ("kbuild: rpm-pkg: introduce a simple changelog section for kernel.spec") Signed-off-by: Petr Vorel Reviewed-by: Miguel Ojeda Signed-off-by: Masahiro Yamada scripts/package/mkspec | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit f5e5e97c719d289025afce07050effcf1f7373ef Author: Christian Brauner Date: Wed Jul 24 10:50:33 2024 +0200 inode: clarify what's locked In __wait_on_freeing_inode() we warn in case the inode_hash_lock is held but the inode is unhashed. We then release the inode_lock. So using "locked" as parameter name is confusing. Use is_inode_hash_locked as parameter name instead. Signed-off-by: Christian Brauner fs/inode.c | 22 +++++++++++----------- 1 file changed, 11 insertions(+), 11 deletions(-) commit c3a5e3e872f3688ae0dc57bb78ca633921d96a91 Author: David Howells Date: Tue Jul 23 09:59:54 2024 +0100 vfs: Fix potential circular locking through setxattr() and removexattr() When using cachefiles, lockdep may emit something similar to the circular locking dependency notice below. The problem appears to stem from the following: (1) Cachefiles manipulates xattrs on the files in its cache when called from ->writepages(). (2) The setxattr() and removexattr() system call handlers get the name (and value) from userspace after taking the sb_writers lock, putting accesses of the vma->vm_lock and mm->mmap_lock inside of that. (3) The afs filesystem uses a per-inode lock to prevent multiple revalidation RPCs and in writeback vs truncate to prevent parallel operations from deadlocking against the server on one side and local page locks on the other. Fix this by moving the getting of the name and value in {get,remove}xattr() outside of the sb_writers lock. This also has the minor benefits that we don't need to reget these in the event of a retry and we never try to take the sb_writers lock in the event we can't pull the name and value into the kernel. Alternative approaches that might fix this include moving the dispatch of a write to the cache off to a workqueue or trying to do without the validation lock in afs. Note that this might also affect other filesystems that use netfslib and/or cachefiles. ====================================================== WARNING: possible circular locking dependency detected 6.10.0-build2+ #956 Not tainted ------------------------------------------------------ fsstress/6050 is trying to acquire lock: ffff888138fd82f0 (mapping.invalidate_lock#3){++++}-{3:3}, at: filemap_fault+0x26e/0x8b0 but task is already holding lock: ffff888113f26d18 (&vma->vm_lock->lock){++++}-{3:3}, at: lock_vma_under_rcu+0x165/0x250 which lock already depends on the new lock. the existing dependency chain (in reverse order) is: -> #4 (&vma->vm_lock->lock){++++}-{3:3}: __lock_acquire+0xaf0/0xd80 lock_acquire.part.0+0x103/0x280 down_write+0x3b/0x50 vma_start_write+0x6b/0xa0 vma_link+0xcc/0x140 insert_vm_struct+0xb7/0xf0 alloc_bprm+0x2c1/0x390 kernel_execve+0x65/0x1a0 call_usermodehelper_exec_async+0x14d/0x190 ret_from_fork+0x24/0x40 ret_from_fork_asm+0x1a/0x30 -> #3 (&mm->mmap_lock){++++}-{3:3}: __lock_acquire+0xaf0/0xd80 lock_acquire.part.0+0x103/0x280 __might_fault+0x7c/0xb0 strncpy_from_user+0x25/0x160 removexattr+0x7f/0x100 __do_sys_fremovexattr+0x7e/0xb0 do_syscall_64+0x9f/0x100 entry_SYSCALL_64_after_hwframe+0x76/0x7e -> #2 (sb_writers#14){.+.+}-{0:0}: __lock_acquire+0xaf0/0xd80 lock_acquire.part.0+0x103/0x280 percpu_down_read+0x3c/0x90 vfs_iocb_iter_write+0xe9/0x1d0 __cachefiles_write+0x367/0x430 cachefiles_issue_write+0x299/0x2f0 netfs_advance_write+0x117/0x140 netfs_write_folio.isra.0+0x5ca/0x6e0 netfs_writepages+0x230/0x2f0 afs_writepages+0x4d/0x70 do_writepages+0x1e8/0x3e0 filemap_fdatawrite_wbc+0x84/0xa0 __filemap_fdatawrite_range+0xa8/0xf0 file_write_and_wait_range+0x59/0x90 afs_release+0x10f/0x270 __fput+0x25f/0x3d0 __do_sys_close+0x43/0x70 do_syscall_64+0x9f/0x100 entry_SYSCALL_64_after_hwframe+0x76/0x7e -> #1 (&vnode->validate_lock){++++}-{3:3}: __lock_acquire+0xaf0/0xd80 lock_acquire.part.0+0x103/0x280 down_read+0x95/0x200 afs_writepages+0x37/0x70 do_writepages+0x1e8/0x3e0 filemap_fdatawrite_wbc+0x84/0xa0 filemap_invalidate_inode+0x167/0x1e0 netfs_unbuffered_write_iter+0x1bd/0x2d0 vfs_write+0x22e/0x320 ksys_write+0xbc/0x130 do_syscall_64+0x9f/0x100 entry_SYSCALL_64_after_hwframe+0x76/0x7e -> #0 (mapping.invalidate_lock#3){++++}-{3:3}: check_noncircular+0x119/0x160 check_prev_add+0x195/0x430 __lock_acquire+0xaf0/0xd80 lock_acquire.part.0+0x103/0x280 down_read+0x95/0x200 filemap_fault+0x26e/0x8b0 __do_fault+0x57/0xd0 do_pte_missing+0x23b/0x320 __handle_mm_fault+0x2d4/0x320 handle_mm_fault+0x14f/0x260 do_user_addr_fault+0x2a2/0x500 exc_page_fault+0x71/0x90 asm_exc_page_fault+0x22/0x30 other info that might help us debug this: Chain exists of: mapping.invalidate_lock#3 --> &mm->mmap_lock --> &vma->vm_lock->lock Possible unsafe locking scenario: CPU0 CPU1 ---- ---- rlock(&vma->vm_lock->lock); lock(&mm->mmap_lock); lock(&vma->vm_lock->lock); rlock(mapping.invalidate_lock#3); *** DEADLOCK *** 1 lock held by fsstress/6050: #0: ffff888113f26d18 (&vma->vm_lock->lock){++++}-{3:3}, at: lock_vma_under_rcu+0x165/0x250 stack backtrace: CPU: 0 PID: 6050 Comm: fsstress Not tainted 6.10.0-build2+ #956 Hardware name: ASUS All Series/H97-PLUS, BIOS 2306 10/09/2014 Call Trace: dump_stack_lvl+0x57/0x80 check_noncircular+0x119/0x160 ? queued_spin_lock_slowpath+0x4be/0x510 ? __pfx_check_noncircular+0x10/0x10 ? __pfx_queued_spin_lock_slowpath+0x10/0x10 ? mark_lock+0x47/0x160 ? init_chain_block+0x9c/0xc0 ? add_chain_block+0x84/0xf0 check_prev_add+0x195/0x430 __lock_acquire+0xaf0/0xd80 ? __pfx___lock_acquire+0x10/0x10 ? __lock_release.isra.0+0x13b/0x230 lock_acquire.part.0+0x103/0x280 ? filemap_fault+0x26e/0x8b0 ? __pfx_lock_acquire.part.0+0x10/0x10 ? rcu_is_watching+0x34/0x60 ? lock_acquire+0xd7/0x120 down_read+0x95/0x200 ? filemap_fault+0x26e/0x8b0 ? __pfx_down_read+0x10/0x10 ? __filemap_get_folio+0x25/0x1a0 filemap_fault+0x26e/0x8b0 ? __pfx_filemap_fault+0x10/0x10 ? find_held_lock+0x7c/0x90 ? __pfx___lock_release.isra.0+0x10/0x10 ? __pte_offset_map+0x99/0x110 __do_fault+0x57/0xd0 do_pte_missing+0x23b/0x320 __handle_mm_fault+0x2d4/0x320 ? __pfx___handle_mm_fault+0x10/0x10 handle_mm_fault+0x14f/0x260 do_user_addr_fault+0x2a2/0x500 exc_page_fault+0x71/0x90 asm_exc_page_fault+0x22/0x30 Signed-off-by: David Howells Link: https://lore.kernel.org/r/2136178.1721725194@warthog.procyon.org.uk cc: Alexander Viro cc: Christian Brauner cc: Jan Kara cc: Jeff Layton cc: Gao Xiang cc: Matthew Wilcox cc: netfs@lists.linux.dev cc: linux-erofs@lists.ozlabs.org cc: linux-fsdevel@vger.kernel.org [brauner: fix minor issues] Signed-off-by: Christian Brauner fs/xattr.c | 91 +++++++++++++++++++++++++++++++++----------------------------- 1 file changed, 48 insertions(+), 43 deletions(-) commit f8138f2ad2f745b9a1c696a05b749eabe44337ea Author: Jann Horn Date: Tue Jul 23 17:03:56 2024 +0200 filelock: Fix fcntl/close race recovery compat path When I wrote commit 3cad1bc01041 ("filelock: Remove locks reliably when fcntl/close race is detected"), I missed that there are two copies of the code I was patching: The normal version, and the version for 64-bit offsets on 32-bit kernels. Thanks to Greg KH for stumbling over this while doing the stable backport... Apply exactly the same fix to the compat path for 32-bit kernels. Fixes: c293621bbf67 ("[PATCH] stale POSIX lock handling") Cc: stable@kernel.org Link: https://bugs.chromium.org/p/project-zero/issues/detail?id=2563 Signed-off-by: Jann Horn Link: https://lore.kernel.org/r/20240723-fs-lock-recover-compatfix-v1-1-148096719529@google.com Signed-off-by: Christian Brauner fs/locks.c | 9 ++++----- 1 file changed, 4 insertions(+), 5 deletions(-) commit 8eac5358ad3bbc007156a0f9ea5637ee7ae421b5 Author: Christian Brauner Date: Fri Jul 19 13:41:48 2024 +0200 fs: use all available ids The counter is unconditionally incremented for each mount allocation. If we set it to 1ULL << 32 we're losing 4294967296 as the first valid non-32 bit mount id. Link: https://lore.kernel.org/r/20240719-work-mount-namespace-v1-1-834113cab0d2@kernel.org Reviewed-by: Josef Bacik Reviewed-by: Jeff Layton Signed-off-by: Christian Brauner fs/namespace.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 51d37982bbac3ea0ca21b2797a9cb0044272b3aa Author: David Howells Date: Fri Jul 19 15:19:02 2024 +0100 cachefiles: Set the max subreq size for cache writes to MAX_RW_COUNT Set the maximum size of a subrequest that writes to cachefiles to be MAX_RW_COUNT so that we don't overrun the maximum write we can make to the backing filesystem. Signed-off-by: David Howells Link: https://lore.kernel.org/r/1599005.1721398742@warthog.procyon.org.uk cc: Jeff Layton cc: netfs@lists.linux.dev cc: linux-fsdevel@vger.kernel.org Signed-off-by: Christian Brauner fs/cachefiles/io.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 212be98aa19303cbf376d61faf9de3ec9997c1cd Author: David Howells Date: Fri Jul 19 15:20:18 2024 +0100 netfs: Fix writeback that needs to go to both server and cache When netfslib is performing writeback (ie. ->writepages), it maintains two parallel streams of writes, one to the server and one to the cache, but it doesn't mark either stream of writes as active until it gets some data that needs to be written to that stream. This is done because some folios will only be written to the cache (e.g. copying to the cache on read is done by marking the folios and letting writeback do the actual work) and sometimes we'll only be writing to the server (e.g. if there's no cache). Now, since we don't actually dispatch uploads and cache writes in parallel, but rather flip between the streams, depending on which has the lowest so-far-issued offset, and don't wait for the subreqs to finish before flipping, we can end up in a situation where, say, we issue a write to the server and this completes before we start the write to the cache. But because we only activate a stream when we first add a subreq to it, the result collection code may run before we manage to activate the stream - resulting in the folio being cleaned and having the writeback-in-progress mark removed. At this point, the folio no longer belongs to us. This is only really a problem for folios that need to be written to both streams - and in that case, the upload to the server is started first, followed by the write to the cache - and the cache write may see a bad folio. Fix this by activating the cache stream up front if there's a cache available. If there's a cache, then all data is going to be written to it. Fixes: 288ace2f57c9 ("netfs: New writeback implementation") Signed-off-by: David Howells Link: https://lore.kernel.org/r/1599053.1721398818@warthog.procyon.org.uk cc: Jeff Layton cc: netfs@lists.linux.dev cc: linux-fsdevel@vger.kernel.org Signed-off-by: Christian Brauner fs/netfs/write_issue.c | 1 + 1 file changed, 1 insertion(+) commit 1bb8dce5dfa9d11ff83a683fab2cda2916384c12 Author: Christian Brauner Date: Mon Jul 22 15:13:55 2024 +0200 pidfs: add selftests for new namespace ioctls Add selftests to verify that deriving namespace file descriptors from pidfd file descriptors works correctly. Link: https://lore.kernel.org/r/20240722-work-pidfs-69dbea91edab@brauner Signed-off-by: Christian Brauner tools/testing/selftests/pidfd/pidfd_setns_test.c | 258 ++++++++++++++++++++--- 1 file changed, 227 insertions(+), 31 deletions(-) commit 9b3e15046437d0e647e1f29ac955e2a3eb94b675 Author: Christian Brauner Date: Mon Jul 22 15:13:54 2024 +0200 pidfs: handle kernels without namespaces cleanly The nsproxy structure contains nearly all of the namespaces associated with a task. When a given namespace type is not supported by this kernel the rules whether the corresponding pointer in struct nsproxy is NULL or always init__ns differ per namespace. Ideally, that wouldn't be the case and for all namespace types we'd always set it to init__ns when the corresponding namespace type isn't supported. Make sure we handle all namespaces where the pointer in struct nsproxy can be NULL when the namespace type isn't supported. Link: https://lore.kernel.org/r/20240722-work-pidfs-e6a83030f63e@brauner Fixes: 5b08bd408534 ("pidfs: allow retrieval of namespace file descriptors") # mainline only Signed-off-by: Christian Brauner fs/pidfs.c | 65 ++++++++++++++++++++++++++++++++++++++++---------------------- 1 file changed, 42 insertions(+), 23 deletions(-) commit f60d38cb02d03f39576f9c7ad13652babded2410 Author: Edward Adam Davis Date: Sun Jul 21 14:23:12 2024 +0800 pidfs: when time ns disabled add check for ioctl syzbot call pidfd_ioctl() with cmd "PIDFD_GET_TIME_NAMESPACE" and disabled CONFIG_TIME_NS, since time_ns is NULL, it will make NULL ponter deref in open_namespace. Fixes: 5b08bd408534 ("pidfs: allow retrieval of namespace file descriptors") # mainline only Reported-and-tested-by: syzbot+34a0ee986f61f15da35d@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=34a0ee986f61f15da35d Signed-off-by: Edward Adam Davis Link: https://lore.kernel.org/r/tencent_7FAE8DB725EE0DD69236DDABDDDE195E4F07@qq.com Signed-off-by: Christian Brauner fs/pidfs.c | 2 ++ 1 file changed, 2 insertions(+) commit b40c8e7a033ff2cafd33adbe50e2a516f88fa223 Author: Congjie Zhou Date: Fri Jul 19 00:25:45 2024 +0800 vfs: correct the comments of vfs_*() helpers correct the comments of vfs_*() helpers in fs/namei.c, including: 1. vfs_create() 2. vfs_mknod() 3. vfs_mkdir() 4. vfs_rmdir() 5. vfs_symlink() All of them come from the same commit: 6521f8917082 "namei: prepare for idmapped mounts" The @dentry is actually the dentry of child directory rather than base directory(parent directory), and thus the @dir has to be modified due to the change of @dentry. Signed-off-by: Congjie Zhou Link: https://lore.kernel.org/r/tencent_2FCF6CC9E10DC8A27AE58A5A0FE4FCE96D0A@qq.com Signed-off-by: Christian Brauner fs/namei.c | 26 +++++++++++++------------- 1 file changed, 13 insertions(+), 13 deletions(-) commit 5bc9ad78c2f836bd2fe9b5c911f8499364ee5b6e Author: Mateusz Guzik Date: Thu Jul 18 17:18:37 2024 +0200 vfs: handle __wait_on_freeing_inode() and evict() race Lockless hash lookup can find and lock the inode after it gets the I_FREEING flag set, at which point it blocks waiting for teardown in evict() to finish. However, the flag is still set even after evict() wakes up all waiters. This results in a race where if the inode lock is taken late enough, it can happen after both hash removal and wakeups, meaning there is nobody to wake the racing thread up. This worked prior to RCU-based lookup because the entire ordeal was synchronized with the inode hash lock. Since unhashing requires the inode lock, we can safely check whether it happened after acquiring it. Link: https://lore.kernel.org/v9fs/20240717102458.649b60be@kernel.org/ Reported-by: Dominique Martinet Fixes: 7180f8d91fcb ("vfs: add rcu-based find_inode variants for iget ops") Signed-off-by: Mateusz Guzik Link: https://lore.kernel.org/r/20240718151838.611807-1-mjguzik@gmail.com Reviewed-by: Jan Kara Signed-off-by: Christian Brauner fs/inode.c | 20 ++++++++++++++++++++ 1 file changed, 20 insertions(+) commit fcad93360df4d04b172dba85b976c9f38ee0d5e0 Author: David Howells Date: Thu Jul 18 21:10:06 2024 +0100 netfs: Rename CONFIG_FSCACHE_DEBUG to CONFIG_NETFS_DEBUG CONFIG_FSCACHE_DEBUG should have been renamed to CONFIG_NETFS_DEBUG, so do that now. Signed-off-by: David Howells Link: https://lore.kernel.org/r/1410796.1721333406@warthog.procyon.org.uk cc: Uwe Kleine-König cc: Christian Brauner cc: Jeff Layton cc: netfs@lists.linux.dev cc: linux-fsdevel@vger.kernel.org Signed-off-by: Christian Brauner fs/netfs/Kconfig | 18 ++++++++---------- 1 file changed, 8 insertions(+), 10 deletions(-) commit a9d47a50cf257ff1019a4e30d573777882fd785c Author: David Howells Date: Thu Jul 18 21:07:32 2024 +0100 netfs: Revert "netfs: Switch debug logging to pr_debug()" Revert commit 163eae0fb0d4c610c59a8de38040f8e12f89fd43 to get back the original operation of the debugging macros. Signed-off-by: David Howells Link: https://lore.kernel.org/r/20240608151352.22860-2-ukleinek@kernel.org Link: https://lore.kernel.org/r/1410685.1721333252@warthog.procyon.org.uk cc: Uwe Kleine-König cc: Christian Brauner cc: Jeff Layton cc: netfs@lists.linux.dev cc: linux-fsdevel@vger.kernel.org Signed-off-by: Christian Brauner fs/netfs/buffered_read.c | 14 +++++++------- fs/netfs/buffered_write.c | 12 ++++++------ fs/netfs/direct_read.c | 2 +- fs/netfs/direct_write.c | 8 ++++---- fs/netfs/fscache_cache.c | 4 ++-- fs/netfs/fscache_cookie.c | 28 ++++++++++++++-------------- fs/netfs/fscache_io.c | 12 ++++++------ fs/netfs/fscache_main.c | 2 +- fs/netfs/fscache_volume.c | 4 ++-- fs/netfs/internal.h | 33 ++++++++++++++++++++++++++++++++- fs/netfs/io.c | 12 ++++++------ fs/netfs/main.c | 4 ++++ fs/netfs/misc.c | 4 ++-- fs/netfs/write_collect.c | 16 ++++++++-------- fs/netfs/write_issue.c | 36 ++++++++++++++++++------------------ 15 files changed, 113 insertions(+), 78 deletions(-) commit a16909ae9982e931841c456061cb57fbaec9c59e Author: Florian Westphal Date: Fri Jul 19 13:19:26 2024 +0200 netfilter: nft_set_pipapo_avx2: disable softinterrupts We need to disable softinterrupts, else we get following problem: 1. pipapo_avx2 called from process context; fpu usable 2. preempt_disable() called, pcpu scratchmap in use 3. softirq handles rx or tx, we re-enter pipapo_avx2 4. fpu busy, fallback to generic non-avx version 5. fallback reuses scratch map and index, which are in use by the preempted process Handle this same way as generic version by first disabling softinterrupts while the scratchmap is in use. Fixes: f0b3d338064e ("netfilter: nft_set_pipapo_avx2: Add irq_fpu_usable() check, fallback to non-AVX2 version") Cc: Stefano Brivio Signed-off-by: Florian Westphal Reviewed-by: Stefano Brivio Signed-off-by: Pablo Neira Ayuso net/netfilter/nft_set_pipapo_avx2.c | 12 ++++++++++-- 1 file changed, 10 insertions(+), 2 deletions(-) commit da897484557b34a54fabb81f6c223c19a69e546d Author: Jonathan Denose Date: Tue Jul 23 21:33:30 2024 -0700 Input: synaptics - enable SMBus for HP Elitebook 840 G2 The kernel reports that the touchpad for this device can support a different bus. With SMBus enabled the touchpad movement is smoother and three-finger gestures are recognized. Signed-off-by: Jonathan Denose Link: https://lore.kernel.org/r/20240719180612.1.Ib652dd808c274076f32cd7fc6c1160d2cf71753b@changeid Signed-off-by: Dmitry Torokhov drivers/input/mouse/synaptics.c | 1 + 1 file changed, 1 insertion(+) commit ccbfea78adf75d3d9e87aa739dab83254f5333fa Author: Marek Vasut Date: Mon Jul 8 23:18:57 2024 +0200 Input: ads7846 - ratelimit the spi_sync error message In case the touch controller is not connected, this message keeps scrolling on the console indefinitelly. Ratelimit it to avoid filling kernel logs. " ads7846 spi2.1: spi_sync --> -22 " Signed-off-by: Marek Vasut Link: https://lore.kernel.org/r/20240708211913.171243-1-marex@denx.de Signed-off-by: Dmitry Torokhov drivers/input/touchscreen/ads7846.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 786c8248dbd33a5a7a07f7c6e55a7bfc68d2ca48 Merge: e9e969797bae 92717bc07789 Author: Linus Torvalds Date: Tue Jul 23 18:15:51 2024 -0700 Merge tag 'perf-tools-fixes-for-v6.11-2024-07-23' of git://git.kernel.org/pub/scm/linux/kernel/git/perf/perf-tools Pull perf tools fixes from Namhyung Kim: "Two fixes for building perf and other tools: - Fix breakage in tracing tools due to pkg-config for libtrace{event,fs} - Fix build of perf when libunwind is used" * tag 'perf-tools-fixes-for-v6.11-2024-07-23' of git://git.kernel.org/pub/scm/linux/kernel/git/perf/perf-tools: perf dso: Fix build when libunwind is enabled tools/latency: Use pkg-config in lib_setup of Makefile.config tools/rtla: Use pkg-config in lib_setup of Makefile.config tools/verification: Use pkg-config in lib_setup of Makefile.config tools: Make pkg-config dependency checks usable by other tools perf build: Warn if libtracefs is not found commit e9e969797bae359fd463f7617ad875bca2771586 Merge: 5ad7ff8738b8 b6f5ee4d5301 Author: Linus Torvalds Date: Tue Jul 23 17:30:42 2024 -0700 Merge tag 'execve-v6.11-rc1-fix1' of git://git.kernel.org/pub/scm/linux/kernel/git/kees/linux Pull execve fix from Kees Cook: "This moves the exec and binfmt_elf tests out of your way and into the tests/ subdirectory, following the newly ratified KUnit naming conventions. :)" * tag 'execve-v6.11-rc1-fix1' of git://git.kernel.org/pub/scm/linux/kernel/git/kees/linux: execve: Move KUnit tests to tests/ subdirectory commit cbade823342cd013f1fbd46f6e3b74825fecbc16 Author: Helge Deller Date: Sun Jul 21 23:36:36 2024 +0200 parisc: Add support for CONFIG_SYSCTL_ARCH_UNALIGN_NO_WARN Allow users to disable kernel warnings for unaligned memory accesses from kernel via the /proc/sys/kernel/ignore-unaligned-usertrap procfs entry. That way users can disable those warnings in case they happen too often. Signed-off-by: Helge Deller Documentation/admin-guide/sysctl/kernel.rst | 2 +- arch/parisc/Kconfig | 1 + arch/parisc/kernel/unaligned.c | 2 ++ 3 files changed, 4 insertions(+), 1 deletion(-) commit 0e314e452687ce0ec5874e42cdb993a34325d3d2 Author: Steve French Date: Tue Jul 23 00:44:48 2024 -0500 cifs: mount with "unix" mount option for SMB1 incorrectly handled Although by default we negotiate CIFS Unix Extensions for SMB1 mounts to Samba (and they work if the user does not specify "unix" or "posix" or "linux" on mount), and we do properly handle when a user turns them off with "nounix" mount parm. But with the changes to the mount API we broke cases where the user explicitly specifies the "unix" option (or equivalently "linux" or "posix") on mount with vers=1.0 to Samba or other servers which support the CIFS Unix Extensions. "mount error(95): Operation not supported" and logged: "CIFS: VFS: Check vers= mount option. SMB3.11 disabled but required for POSIX extensions" even though CIFS Unix Extensions are supported for vers=1.0 This patch fixes the case where the user specifies both "unix" (or equivalently "posix" or "linux") and "vers=1.0" on mount to a server which supports the CIFS Unix Extensions. Cc: stable@vger.kernel.org Reviewed-by: David Howells Reviewed-by: Paulo Alcantara (Red Hat) Signed-off-by: Steve French fs/smb/client/connect.c | 7 +++++++ 1 file changed, 7 insertions(+) commit a214384ce26b6111ea8c8d58fa82a1ca63996c38 Author: Steve French Date: Mon Jul 22 23:40:08 2024 -0500 cifs: fix reconnect with SMB1 UNIX Extensions When mounting with the SMB1 Unix Extensions (e.g. mounts to Samba with vers=1.0), reconnects no longer reset the Unix Extensions (SetFSInfo SET_FILE_UNIX_BASIC) after tcon so most operations (e.g. stat, ls, open, statfs) will fail continuously with: "Operation not supported" if the connection ever resets (e.g. due to brief network disconnect) Cc: stable@vger.kernel.org Reviewed-by: Paulo Alcantara (Red Hat) Signed-off-by: Steve French fs/smb/client/connect.c | 17 ++++++++++++++++- 1 file changed, 16 insertions(+), 1 deletion(-) commit 19abb9c2b900bad59e0a9818d6c83bb4cc875437 Author: Wojciech Drewek Date: Mon Jul 1 11:05:46 2024 +0200 ice: Fix recipe read procedure When ice driver reads recipes from firmware information about need_pass_l2 and allow_pass_l2 flags is not stored correctly. Those flags are stored as one bit each in ice_sw_recipe structure. Because of that, the result of checking a flag has to be casted to bool. Note that the need_pass_l2 flag currently works correctly, because it's stored in the first bit. Fixes: bccd9bce29e0 ("ice: Add guard rule when creating FDB in switchdev") Reviewed-by: Marcin Szycik Reviewed-by: Przemek Kitszel Signed-off-by: Wojciech Drewek Reviewed-by: Simon Horman Tested-by: Sujai Buvaneswaran Signed-off-by: Tony Nguyen drivers/net/ethernet/intel/ice/ice_switch.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) commit 6ebbe97a488179f5dc85f2f1e0c89b486e99ee97 Author: Ahmed Zaki Date: Fri Jun 14 07:18:42 2024 -0600 ice: Add a per-VF limit on number of FDIR filters While the iavf driver adds a s/w limit (128) on the number of FDIR filters that the VF can request, a malicious VF driver can request more than that and exhaust the resources for other VFs. Add a similar limit in ice. CC: stable@vger.kernel.org Fixes: 1f7ea1cd6a37 ("ice: Enable FDIR Configure for AVF") Reviewed-by: Przemek Kitszel Suggested-by: Sridhar Samudrala Signed-off-by: Ahmed Zaki Reviewed-by: Wojciech Drewek Tested-by: Rafal Romanowski Signed-off-by: Tony Nguyen drivers/net/ethernet/intel/ice/ice_ethtool_fdir.c | 2 +- drivers/net/ethernet/intel/ice/ice_fdir.h | 3 +++ drivers/net/ethernet/intel/ice/ice_virtchnl_fdir.c | 16 ++++++++++++++++ drivers/net/ethernet/intel/ice/ice_virtchnl_fdir.h | 1 + 4 files changed, 21 insertions(+), 1 deletion(-) commit 5ad7ff8738b8bd238ca899df08badb1f61bcc39e Merge: 371c141464b8 bed6b0317441 Author: Linus Torvalds Date: Tue Jul 23 15:21:19 2024 -0700 Merge tag 'f2fs-for-6.11-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/jaegeuk/f2fs Pull f2fs updates from Jaegeuk Kim: "A pretty small update including mostly minor bug fixes in zoned storage along with the large section support. Enhancements: - add support for FS_IOC_GETFSSYSFSPATH - enable atgc dynamically if conditions are met - use new ioprio Macro to get ckpt thread ioprio level - remove unreachable lazytime mount option parsing Bug fixes: - fix null reference error when checking end of zone - fix start segno of large section - fix to cover read extent cache access with lock - don't dirty inode for readonly filesystem - allocate a new section if curseg is not the first seg in its zone - only fragment segment in the same section - truncate preallocated blocks in f2fs_file_open() - fix to avoid use SSR allocate when do defragment - fix to force buffered IO on inline_data inode And some minor code clean-ups and sanity checks" * tag 'f2fs-for-6.11-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/jaegeuk/f2fs: (26 commits) f2fs: clean up addrs_per_{inode,block}() f2fs: clean up F2FS_I() f2fs: use meta inode for GC of COW file f2fs: use meta inode for GC of atomic file f2fs: only fragment segment in the same section f2fs: fix to update user block counts in block_operations() f2fs: remove unreachable lazytime mount option parsing f2fs: fix null reference error when checking end of zone f2fs: fix start segno of large section f2fs: remove redundant sanity check in sanity_check_inode() f2fs: assign CURSEG_ALL_DATA_ATGC if blkaddr is valid f2fs: fix to use mnt_{want,drop}_write_file replace file_{start,end}_wrtie f2fs: clean up set REQ_RAHEAD given rac f2fs: enable atgc dynamically if conditions are met f2fs: fix to truncate preallocated blocks in f2fs_file_open() f2fs: fix to cover read extent cache access with lock f2fs: fix return value of f2fs_convert_inline_inode() f2fs: use new ioprio Macro to get ckpt thread ioprio level f2fs: fix to don't dirty inode for readonly filesystem f2fs: fix to avoid use SSR allocate when do defragment ... commit 371c141464b8312ee4a298fad6d17ee26654b7d6 Merge: ca83c61cb3db d0fa70aca54c Author: Linus Torvalds Date: Tue Jul 23 15:15:16 2024 -0700 Merge tag 'jfs-6.11' of github.com:kleikamp/linux-shaggy Pull jfs updates from David Kleikamp: "Folio conversion from Matthew Wilcox and a few various fixes" * tag 'jfs-6.11' of github.com:kleikamp/linux-shaggy: jfs: don't walk off the end of ealist jfs: Fix shift-out-of-bounds in dbDiscardAG jfs: Fix array-index-out-of-bounds in diFree jfs: fix null ptr deref in dtInsertEntry jfs: Remove use of folio error flag fs: Remove i_blocks_per_page jfs: Change metapage->page to metapage->folio jfs: Convert force_metapage to use a folio jfs: Convert inc_io to take a folio jfs: Convert page_to_mp to folio_to_mp jfs; Convert __invalidate_metapages to use a folio jfs: Convert dec_io to take a folio jfs: Convert drop_metapage and remove_metapage to take a folio jfs; Convert release_metapage to use a folio jfs: Convert insert_metapage() to take a folio jfs: Convert __get_metapage to use a folio jfs: Convert metapage_writepage to metapage_write_folio jfs: Convert metapage_read_folio to use folio APIs commit ca83c61cb3db964061ea186654bf8e1879589de3 Merge: 643af93f15be 13c239a2c088 Author: Linus Torvalds Date: Tue Jul 23 14:32:21 2024 -0700 Merge tag 'kbuild-v6.11' of git://git.kernel.org/pub/scm/linux/kernel/git/masahiroy/linux-kbuild Pull Kbuild updates from Masahiro Yamada: - Remove tristate choice support from Kconfig - Stop using the PROVIDE() directive in the linker script - Reduce the number of links for the combination of CONFIG_KALLSYMS and CONFIG_DEBUG_INFO_BTF - Enable the warning for symbol reference to .exit.* sections by default - Fix warnings in RPM package builds - Improve scripts/make_fit.py to generate a FIT image with separate base DTB and overlays - Improve choice value calculation in Kconfig - Fix conditional prompt behavior in choice in Kconfig - Remove support for the uncommon EMAIL environment variable in Debian package builds - Remove support for the uncommon "name " form for the DEBEMAIL environment variable - Raise the minimum supported GNU Make version to 4.0 - Remove stale code for the absolute kallsyms - Move header files commonly used for host programs to scripts/include/ - Introduce the pacman-pkg target to generate a pacman package used in Arch Linux - Clean up Kconfig * tag 'kbuild-v6.11' of git://git.kernel.org/pub/scm/linux/kernel/git/masahiroy/linux-kbuild: (65 commits) kbuild: doc: gcc to CC change kallsyms: change sym_entry::percpu_absolute to bool type kallsyms: unify seq and start_pos fields of struct sym_entry kallsyms: add more original symbol type/name in comment lines kallsyms: use \t instead of a tab in printf() kallsyms: avoid repeated calculation of array size for markers kbuild: add script and target to generate pacman package modpost: use generic macros for hash table implementation kbuild: move some helper headers from scripts/kconfig/ to scripts/include/ Makefile: add comment to discourage tools/* addition for kernel builds kbuild: clean up scripts/remove-stale-files kconfig: recursive checks drop file/lineno kbuild: rpm-pkg: introduce a simple changelog section for kernel.spec kallsyms: get rid of code for absolute kallsyms kbuild: Create INSTALL_PATH directory if it does not exist kbuild: Abort make on install failures kconfig: remove 'e1' and 'e2' macros from expression deduplication kconfig: remove SYMBOL_CHOICEVAL flag kconfig: add const qualifiers to several function arguments kconfig: call expr_eliminate_yn() at least once in expr_eliminate_dups() ... commit 643af93f15be901982b2b08f241263934201c99f Merge: 60c6119cadba 36862eab884d Author: Linus Torvalds Date: Tue Jul 23 13:41:59 2024 -0700 Merge tag 'rpmsg-v6.11' of git://git.kernel.org/pub/scm/linux/kernel/git/remoteproc/linux Pull rpmsg updates from Bjorn Andersson: - fix interrupt handling in the stm32 remoteproc driver when being attached to an already running remote processor - fix invalid kernel-doc and add missing MODULE_DESCRIPTION() in the rpmsg char driver * tag 'rpmsg-v6.11' of git://git.kernel.org/pub/scm/linux/kernel/git/remoteproc/linux: rpmsg: char: add missing MODULE_DESCRIPTION() macro remoteproc: stm32_rproc: Fix mailbox interrupts queuing rpmsg: char: Fix rpmsg_eptdev structure documentation commit 60c6119cadba52bee86b3e88011495483e26eb43 Merge: 58bffbac533d 19cb60586206 Author: Linus Torvalds Date: Tue Jul 23 13:36:51 2024 -0700 Merge tag 'rproc-v6.11' of git://git.kernel.org/pub/scm/linux/kernel/git/remoteproc/linux Pull remoteproc updates from Bjorn Andersson: - The maximum amount of DDR memory used by the Mediatek MT8188/MT8195 SCP is increased to handle new use cases. Handling of optional L1TCM memory is made actually optional. - An optimization is introduced to only clear the unused portion of IPI shared buffers, rather than the entire buffer before writing the message. - Detection for IPC-only mode in the TI K3 DSP remoteproc driver is corrected. The loglevel of a debug print in the same is lowered from error. - Support for attaching to an running remote processor is added to the Xilinx R5F. - An in-kernel implementation of the Qualcomm "protected domain mapper" (aka service registry) service is introduced, to remove the dependency on a userspace implementation to detect when the battery monitor and USB Type-C port manager becomes available. This is then integrated with the Qualcomm remoteproc driver. - The Qualcomm PAS remoteproc driver gains support for attempting to bust hwspinlocks held by the remote processor when it crashed/stopped. - The TI OMAP remoteproc driver is transitioned to use devres helpers for various forms of allocations. - Parsing of memory-regions in the i.MX remoteproc driver is improved to avoid a NULL pointer dereference if the phandle reference is empty. of_node reference counting is corrected in the same. * tag 'rproc-v6.11' of git://git.kernel.org/pub/scm/linux/kernel/git/remoteproc/linux: remoteproc: mediatek: Increase MT8188/MT8195 SCP core0 DRAM size remoteproc: k3-dsp: Fix log levels where appropriate remoteproc: xlnx: Add attach detach support remoteproc: qcom: select AUXILIARY_BUS remoteproc: k3-r5: Fix IPC-only mode detection remoteproc: mediatek: Don't attempt to remap l1tcm memory if missing remoteproc: qcom: enable in-kernel PD mapper dt-bindings: remoteproc: imx_rproc: Add minItems for power-domain remoteproc: imx_rproc: Fix refcount mistake in imx_rproc_addr_init remoteproc: omap: Use devm_rproc_add() helper remoteproc: omap: Use devm action to release reserved memory remoteproc: omap: Use devm_rproc_alloc() helper remoteproc: imx_rproc: Skip over memory region when node value is NULL dt-bindings: remoteproc: k3-dsp: Correct optional sram properties for AM62A SoCs remoteproc: qcom_q6v5_pas: Add hwspinlock bust on stop soc: qcom: smem: Add qcom_smem_bust_hwspin_lock_by_host() remoteproc: mediatek: Zero out only remaining bytes of IPI buffer commit 58bffbac533d4526cb4922b8563d1963a90729be Merge: e9680017b2dc 718a7ad700b1 Author: Linus Torvalds Date: Tue Jul 23 13:34:56 2024 -0700 Merge tag 'hwlock-v6.11' of git://git.kernel.org/pub/scm/linux/kernel/git/remoteproc/linux Pull hwspinlock updates from Bjorn Andersson: "This introduces a mechanism in the hardware spinlock framework, and the Qualcomm TCSR mutex driver, for allowing clients to bust locks held by a remote processor in the event that this enters a faulty state while holding the shared lock" * tag 'hwlock-v6.11' of git://git.kernel.org/pub/scm/linux/kernel/git/remoteproc/linux: hwspinlock: qcom: implement bust operation hwspinlock: Introduce hwspin_lock_bust() commit e9680017b2dc8686a908ea1b51941a91b6da9f1d Merge: f488790059fe 8fe76a1c2264 Author: Linus Torvalds Date: Tue Jul 23 11:57:52 2024 -0700 Merge tag 'sh-for-v6.11-tag1' of git://git.kernel.org/pub/scm/linux/kernel/git/glaubitz/sh-linux Pull sh updates from John Paul Adrian Glaubitz: "This is rather small this time and contains just three changes. The first change by Oscar Salvador drops support for memory hotplug and hotremove for sh as the kernel stopped supporting it on 32-bit platforms since 7ec58a2b941e ("mm/memory_hotplug: restrict CONFIG_MEMORY_HOTPLUG to 64 bit"). That then results in a follow-up change to update all affected board config files. The third change comes from Jeff Johnson which adds the missing MODULE_DESCRIPTION() macro to the push-switch driver" * tag 'sh-for-v6.11-tag1' of git://git.kernel.org/pub/scm/linux/kernel/git/glaubitz/sh-linux: sh: push-switch: Add missing MODULE_DESCRIPTION() macro sh: config: Drop CONFIG_MEMORY_{HOTPLUG,HOTREMOVE} sh: Drop support for memory hotplug and memory hotremove commit f488790059fe7be6b2b059ddee10835b2500b603 Merge: d2d721e2eb13 61842868de13 Author: Linus Torvalds Date: Tue Jul 23 11:43:40 2024 -0700 Merge tag 'modules-6.11-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/mcgrof/linux Pull module update from Luis Chamberlain: "This is a super boring development cycle this time around for modules, there is only one patch in this pull request. The patch deals with a corner case set of dependencies which is not resolved today to ensure users get the module they need on initramfs. Currently only one module is known to exist which needs this, however this can grow to capture other corner cases likely escaped and not reported before. The kernel change is just a section update, the real work is done and merged already on upstream kmod. This has been on linux-next for 3 weeks now" * tag 'modules-6.11-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/mcgrof/linux: module: create weak dependecies commit f99b3feb3b0e9fca2257c90fc8317be8ee44c19a Author: Krzysztof Kozlowski Date: Mon Jul 22 08:33:09 2024 +0200 clk: samsung: fix getting Exynos4 fin_pll rate from external clocks Commit 0dc83ad8bfc9 ("clk: samsung: Don't register clkdev lookup for the fixed rate clocks") claimed registering clkdev lookup is not necessary anymore, but that was not entirely true: Exynos4210/4212/4412 clock code still relied on it to get the clock rate of xxti or xusbxti external clocks. Drop that requirement by accessing already registered clk_hw when looking up the xxti/xusbxti rate. Reported-by: Artur Weber Closes: https://lore.kernel.org/all/6227c1fb-d769-462a-b79b-abcc15d3db8e@gmail.com/ Fixes: 0dc83ad8bfc9 ("clk: samsung: Don't register clkdev lookup for the fixed rate clocks") Cc: Signed-off-by: Krzysztof Kozlowski Link: https://lore.kernel.org/r/20240722063309.60054-1-krzysztof.kozlowski@linaro.org Tested-by: Artur Weber # Exynos4212 Signed-off-by: Stephen Boyd drivers/clk/samsung/clk-exynos4.c | 13 +++++++------ 1 file changed, 7 insertions(+), 6 deletions(-) commit d2d721e2eb1337c67f0c5bba303f8a013b622bed Merge: 28bbe4ea686a ea5377ec49f2 Author: Linus Torvalds Date: Tue Jul 23 11:11:51 2024 -0700 Merge tag 'livepatching-for-6.11' of git://git.kernel.org/pub/scm/linux/kernel/git/livepatching/livepatching Pull livepatching update from Petr Mladek: - show patch->replace flag in sysfs - add or improve few selftests * tag 'livepatching-for-6.11' of git://git.kernel.org/pub/scm/linux/kernel/git/livepatching/livepatching: livepatch: Replace snprintf() with sysfs_emit() selftests/livepatch: Add selftests for "replace" sysfs attribute livepatch: Add "replace" sysfs attribute selftests: livepatch: Test atomic replace against multiple modules selftests/livepatch: define max test-syscall processes commit 8031b001da700474c11d28629581480b12a0d8d4 Author: Basavaraj Natikar Date: Thu Jul 18 16:46:16 2024 +0530 HID: amd_sfh: Move sensor discovery before HID device initialization Sensors discovery is independent of HID device initialization. If sensor discovery fails after HID initialization, then the HID device needs to be deinitialized. Therefore, sensors discovery should be moved before HID device initialization. Fixes: 7bcfdab3f0c6 ("HID: amd_sfh: if no sensors are enabled, clean up") Tested-by: Aurinko Signed-off-by: Basavaraj Natikar Link: https://patch.msgid.link/20240718111616.3012155-1-Basavaraj.Natikar@amd.com Signed-off-by: Benjamin Tissoires drivers/hid/amd-sfh-hid/amd_sfh_client.c | 18 +++++++++++------- 1 file changed, 11 insertions(+), 7 deletions(-) commit 28bbe4ea686a023929d907cc168430b61094811c Merge: d51f8f63f7cf 385ac870bdd5 Author: Linus Torvalds Date: Tue Jul 23 09:59:20 2024 -0700 Merge tag 'i2c-for-6.11-rc1-second-batch' of git://git.kernel.org/pub/scm/linux/kernel/git/wsa/linux Pull more i2c updates from Wolfram Sang: "The I2C core has two header documentation updates as the dependecies are in now. The I2C host drivers add some patches which nearly fell through the cracks: - Added descriptions in the DTS for the Qualcomm SM8650 and SM8550 Camera Control Interface (CCI). - Added support for the "settle-time-us" property, which allows the gpio-mux device to switch from one bus to another with a configurable delay. The time can be set in the DTS. The latest change also includes file sorting. - Fixed slot numbering in the SMBus framework to prevent failures when more than 8 slots are occupied. It now enforces a a maximum of 8 slots to be used. This ensures that the Intel PIIX4 device can register the SPDs correctly without failure, even if other slots are populated but not used" * tag 'i2c-for-6.11-rc1-second-batch' of git://git.kernel.org/pub/scm/linux/kernel/git/wsa/linux: i2c: header: improve kdoc for i2c_algorithm i2c: header: remove unneeded stuff regarding i2c_algorithm i2c: piix4: Register SPDs i2c: smbus: remove i801 assumptions from SPD probing i2c: mux: gpio: Add support for the 'settle-time-us' property i2c: mux: gpio: Re-order #include to match alphabetic order dt-bindings: i2c: mux-gpio: Add 'settle-time-us' property dt-bindings: i2c: qcom-cci: Document sm8650 compatible dt-bindings: i2c: qcom-cci: Document sm8550 compatible commit d51f8f63f7cf19c7c7d0288650fdee154a89d499 Merge: 71bed1ec0fa7 a8bd68e4329f Author: Linus Torvalds Date: Tue Jul 23 09:55:27 2024 -0700 Merge tag 'mailbox-v6.11' of git://git.kernel.org/pub/scm/linux/kernel/git/jassibrar/mailbox Pull mailbox updates from Jassi Brar: "broadcom: - remove unused pdc_dma_map imx: - fix TXDB_V2 channel race condition mediatek: - cleanup and refactor driver - add bindings for gce-props omap: - fix mailbox interrupt sharing qcom: - add bindings for SA8775p - add CPUCP driver zynqmp: - make polling period configurable" * tag 'mailbox-v6.11' of git://git.kernel.org/pub/scm/linux/kernel/git/jassibrar/mailbox: mailbox: mtk-cmdq: Move devm_mbox_controller_register() after devm_pm_runtime_enable() mailbox: zynqmp-ipi: Make polling period configurable mailbox: qcom-cpucp: fix 64BIT dependency mailbox: Add support for QTI CPUCP mailbox controller dt-bindings: mailbox: qcom: Add CPUCP mailbox controller bindings dt-bindings: remoteproc: qcom,sa8775p-pas: Document the SA8775p ADSP, CDSP and GPDSP mailbox: mtk-cmdq: add missing MODULE_DESCRIPTION() macro mailbox: bcm-pdc: remove unused struct 'pdc_dma_map' mailbox: imx: fix TXDB_V2 channel race condition mailbox: omap: Fix mailbox interrupt sharing mailbox: mtk-cmdq: Dynamically allocate clk_bulk_data structure mailbox: mtk-cmdq: Move and partially refactor clocks probe mailbox: mtk-cmdq: Stop requiring name for GCE clock dt-bindings: mailbox: Add mediatek,gce-props.yaml commit 71bed1ec0fa73da529a23336352b859eab12ae8f Merge: fd71b9a07b63 0630e3bc0e91 Author: Linus Torvalds Date: Tue Jul 23 09:46:17 2024 -0700 Merge tag 'pcmcia-6.11-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/brodo/linux Pull PCMCIA updates from Dominik Brodowski: "A number of tiny cleanups of the PCMCIA subsystem by Jeff Johnson, Jules Irenge, and Krzysztof Kozlowski" * tag 'pcmcia-6.11-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/brodo/linux: pcmcia: add missing MODULE_DESCRIPTION() macros pcmcia: Use resource_size function on resource object pcmcia: bcm63xx: drop driver owner assignment commit fd71b9a07b6327bed6ef9d572b9cede98c868baf Merge: c5d2be66705c be6299c6e55e Author: Linus Torvalds Date: Tue Jul 23 09:38:27 2024 -0700 Merge tag 'for-v6.11' of git://git.kernel.org/pub/scm/linux/kernel/git/sre/linux-power-supply Pull power supply and reset updates from Sebastian Reichel: "Power-supply core: - new charging_orange_full_green RGB LED trigger - simplify and cleanup power-supply LED trigger code - expose power information via hwmon compatibility layer New hardware support: - enable battery support for Qualcomm Snapdragon X Elite - new battery driver for Maxim MAX17201/MAX17205 - new battery driver for Lenovo Yoga C630 laptop (custom EC) Cleanups: - cleanup 'struct i2c_device_id' initializations - misc small battery driver cleanups and fixes" * tag 'for-v6.11' of git://git.kernel.org/pub/scm/linux/kernel/git/sre/linux-power-supply: power: supply: sysfs: use power_supply_property_is_writeable() power: supply: qcom_battmgr: Enable battery support on x1e80100 power: supply: add support for MAX1720x standalone fuel gauge dt-bindings: power: supply: add support for MAX17201/MAX17205 fuel gauge power: reset: piix4: add missing MODULE_DESCRIPTION() macro power: supply: samsung-sdi-battery: Constify struct power_supply_maintenance_charge_table power: supply: samsung-sdi-battery: Constify struct power_supply_vbat_ri_table power: supply: lenovo_yoga_c630_battery: add Lenovo C630 driver power: supply: ingenic: Fix some error handling paths in ingenic_battery_get_property() power: supply: ab8500: Clean some error messages power: supply: ab8500: Use iio_read_channel_processed_scale() power: supply: ab8500: Fix error handling when calling iio_read_channel_processed() power: supply: hwmon: Add support for power sensors power: supply: ab8500: remove unused struct 'inst_curr_result_list' power: supply: bd99954: remove unused struct 'battery_data' power: supply: leds: Add activate() callback to triggers power: supply: leds: Share trig pointer for online and charging_full power: supply: leds: Add power_supply_[un]register_led_trigger() power: supply: Drop explicit initialization of struct i2c_device_id::driver_data to 0 commit c5d2be66705c5ebec8a691707ab427d937c91b7a Merge: 66ebbdfdeb09 f02cfe695047 Author: Linus Torvalds Date: Tue Jul 23 09:37:33 2024 -0700 Merge tag 'hsi-for-6.11' of git://git.kernel.org/pub/scm/linux/kernel/git/sre/linux-hsi Pull HSI update from Sebastian Reichel: - drop unused gpio.h header from SSI McSAAB protocol driver * tag 'hsi-for-6.11' of git://git.kernel.org/pub/scm/linux/kernel/git/sre/linux-hsi: HSI: ssi_protocol: Remove unused linux/gpio.h commit 13c239a2c088e91e453d26517b562c9a116444fa Author: Ivan Davydov Date: Mon Jul 22 08:57:31 2024 +0300 kbuild: doc: gcc to CC change In this part of the documentation, $(CC) is meant, but gcc is written. Signed-off-by: Ivan Davydov Signed-off-by: Masahiro Yamada Documentation/kbuild/makefiles.rst | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) commit 86c5eac3c4c4a2ee124d202af9a141bd0457ee68 Author: Chen Ni Date: Tue Jul 16 15:25:45 2024 +0800 iommu/amd: Convert comma to semicolon Replace a comma between expression statements by a semicolon. Fixes: c9b258c6be09 ("iommu/amd: Prepare for generic IO page table framework") Signed-off-by: Chen Ni Reviewed-by: Suravee Suthikulpanit Link: https://lore.kernel.org/r/20240716072545.968690-1-nichen@iscas.ac.cn Signed-off-by: Will Deacon drivers/iommu/amd/io_pgtable.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) commit 630482ee0653decf9e2482ac6181897eb6cde5b8 Author: Artem Chernyshev Date: Tue Jul 16 15:55:14 2024 +0300 iommu: sprd: Avoid NULL deref in sprd_iommu_hw_en In sprd_iommu_cleanup() before calling function sprd_iommu_hw_en() dom->sdev is equal to NULL, which leads to null dereference. Found by Linux Verification Center (linuxtesting.org) with SVACE. Fixes: 9afea57384d4 ("iommu/sprd: Release dma buffer to avoid memory leak") Signed-off-by: Artem Chernyshev Reviewed-by: Chunyan Zhang Link: https://lore.kernel.org/r/20240716125522.3690358-1-artem.chernyshev@red-soft.ru Signed-off-by: Will Deacon drivers/iommu/sprd-iommu.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 193cc89ea0ca1da311877d2b4bb5e9f03bcc82a2 Author: Steve French Date: Sun Jul 21 15:45:56 2024 -0500 cifs: fix potential null pointer use in destroy_workqueue in init_cifs error path Dan Carpenter reported a Smack static checker warning: fs/smb/client/cifsfs.c:1981 init_cifs() error: we previously assumed 'serverclose_wq' could be null (see line 1895) The patch which introduced the serverclose workqueue used the wrong oredering in error paths in init_cifs() for freeing it on errors. Fixes: 173217bd7336 ("smb3: retrying on failed server close") Cc: stable@vger.kernel.org Cc: Ritvik Budhiraja Reported-by: Dan Carpenter Reviewed-by: Dan Carpenter Reviewed-by: David Howells Signed-off-by: Steve French fs/smb/client/cifsfs.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) commit ea5377ec49f29baaf50cbffa986a8ae667b7eaff Merge: 61894818e304 920526928089 Author: Petr Mladek Date: Tue Jul 23 17:13:10 2024 +0200 Merge branch 'for-6.11/sysfs-patch-replace' into for-linus commit f3dfcd25455b1cbb3c7e2d19b0a06acc6c7472a5 Author: Raghavendra Rao Ananta Date: Thu Jul 18 21:55:32 2024 +0000 arm64/sysreg: Correct the values for GICv4.1 Currently, sysreg has value as 0b0010 for the presence of GICv4.1 in ID_PFR1_EL1 and ID_AA64PFR0_EL1, instead of 0b0011 as per ARM ARM. Hence, correct them to reflect ARM ARM. Signed-off-by: Raghavendra Rao Ananta Reviewed-by: Zenghui Yu Reviewed-by: Anshuman Khandual Reviewed-by: Marc Zyngier Link: https://lore.kernel.org/r/20240718215532.616447-1-rananta@google.com Signed-off-by: Will Deacon arch/arm64/tools/sysreg | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) commit 48f6430505c0b0498ee9020ce3cf9558b1caaaeb Author: Fangrui Song Date: Thu Jul 18 10:34:23 2024 -0700 arm64/vdso: Remove --hash-style=sysv glibc added support for .gnu.hash in 2006 and .hash has been obsoleted for more than one decade in many Linux distributions. Using --hash-style=sysv might imply unaddressed issues and confuse readers. Just drop the option and rely on the linker default, which is likely "both", or "gnu" when the distribution really wants to eliminate sysv hash overhead. Similar to commit 6b7e26547fad ("x86/vdso: Emit a GNU hash"). Signed-off-by: Fangrui Song Link: https://lore.kernel.org/r/20240718173423.1574395-1-maskray@google.com Signed-off-by: Will Deacon arch/arm64/kernel/vdso/Makefile | 2 +- arch/arm64/kernel/vdso32/Makefile | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) commit 0c35e3bd412a6a2676adc35df950cfbb9f464b0c Author: Remington Brasga Date: Fri Jul 12 23:17:30 2024 +0000 kselftest: missing arg in ptrace.c The string passed to ksft_test_result_skip is missing the `type_name` Signed-off-by: Remington Brasga Reviewed-by: Dev Jain Reviewed-by: Anshuman Khandual Link: https://lore.kernel.org/r/20240712231730.2794-1-rbrasga@uci.edu Signed-off-by: Will Deacon tools/testing/selftests/arm64/abi/ptrace.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit add6128fc7f0d24199e977d13ca724f011c03fc2 Author: Anshuman Khandual Date: Tue Jul 16 10:39:15 2024 +0530 arm64/Kconfig: Remove redundant 'if HAVE_FUNCTION_GRAPH_TRACER' Since the commit 819e50e25d0c ("arm64: Add ftrace support"), HAVE_FUNCTION_GRAPH_TRACER has always been enabled. Although a subsequent commit 364697032246 ("arm64: ftrace: Enable HAVE_FUNCTION_GRAPH_RETVAL") redundantly added check on HAVE_FUNCTION_GRAPH_TRACER, while enabling the config HAVE_FUNCTION_GRAPH_RETVAL. Let's just drop this redundant check. Cc: Catalin Marinas Cc: Will Deacon Cc: linux-arm-kernel@lists.infradead.org CC: linux-kernel@vger.kernel.org Signed-off-by: Anshuman Khandual Acked-by: Mark Rutland Link: https://lore.kernel.org/r/20240716050915.2657694-1-anshuman.khandual@arm.com Signed-off-by: Will Deacon arch/arm64/Kconfig | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 62e2397c2203d41c8ebe2cca0c728293ff2af313 Author: Masahiro Yamada Date: Tue Jul 16 04:28:17 2024 +0900 arm64: remove redundant 'if HAVE_ARCH_KASAN' in Kconfig Since commit 0383808e4d99 ("arm64: kasan: Reduce minimum shadow alignment and enable 5 level paging"), HAVE_ARCH_KASAN is always 'y'. The condition 'if HAVE_ARCH_KASAN' is always met. Signed-off-by: Masahiro Yamada Reviewed-by: Randy Dunlap Acked-by: Mark Rutland Reviewed-by: Anshuman Khandual Link: https://lore.kernel.org/r/20240715192843.2201439-1-masahiroy@kernel.org Signed-off-by: Will Deacon arch/arm64/Kconfig | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) commit 6dc2e98d5f1de162d1777aee97e59d75d70d07c5 Author: Janosch Frank Date: Thu Jul 4 11:02:46 2024 +0000 s390: Remove protvirt and kvm config guards for uv code Removing the CONFIG_PROTECTED_VIRTUALIZATION_GUEST ifdefs and config option as well as CONFIG_KVM ifdefs in uv files. Having this configurable has been more of a pain than a help. It's time to remove the ifdefs and the config option. Signed-off-by: Janosch Frank Acked-by: Christian Borntraeger Acked-by: Heiko Carstens Signed-off-by: Vasily Gorbik arch/s390/Kconfig | 11 ----------- arch/s390/boot/Makefile | 3 +-- arch/s390/boot/uv.c | 8 -------- arch/s390/boot/uv.h | 13 ------------- arch/s390/configs/debug_defconfig | 1 - arch/s390/configs/defconfig | 1 - arch/s390/include/asm/page.h | 2 -- arch/s390/include/asm/uv.h | 32 -------------------------------- arch/s390/kernel/Makefile | 3 +-- arch/s390/kernel/uv.c | 35 +++++++++++++++-------------------- drivers/s390/char/Kconfig | 2 +- 11 files changed, 18 insertions(+), 93 deletions(-) commit 8f1e70adb1a3ecb982bb6c475209b080bf985074 Author: Sven Schnelle Date: Mon Jul 22 15:41:28 2024 +0200 s390/boot: Add cmdline option to relocate lowcore Now that everything has been converted, add the option 'relocate_lowcore' to enable relocating the lowcore. Reviewed-by: Heiko Carstens Signed-off-by: Sven Schnelle Signed-off-by: Vasily Gorbik arch/s390/boot/ipl_parm.c | 2 ++ 1 file changed, 2 insertions(+) commit 97cee3dd4a07413a4175e247f550a4931d39cee1 Author: Sven Schnelle Date: Mon Jul 22 15:41:27 2024 +0200 s390/kdump: Make kdump ready for lowcore relocation In preparation of having lowcore at different address than zero, add the base register to all lowcore accesses in store_status() and __do_machine_kdump(). Reviewed-by: Heiko Carstens Signed-off-by: Sven Schnelle Signed-off-by: Vasily Gorbik arch/s390/kernel/machine_kexec.c | 2 +- arch/s390/kernel/reipl.S | 26 +++++++++++--------------- 2 files changed, 12 insertions(+), 16 deletions(-) commit 361f6ec2fe203760353c708480099e0325295b21 Author: Sven Schnelle Date: Mon Jul 22 15:41:26 2024 +0200 s390/entry: Make system_call() ready for lowcore relocation In preparation of having lowcore at different address than zero, add the base register to all lowcore accesses in system_call(). Reviewed-by: Heiko Carstens Signed-off-by: Sven Schnelle Signed-off-by: Vasily Gorbik arch/s390/kernel/entry.S | 21 +++++++++++---------- 1 file changed, 11 insertions(+), 10 deletions(-) commit 9b3dcae128f8803950d646329f2301cae3fe8f4d Author: Sven Schnelle Date: Mon Jul 22 15:41:25 2024 +0200 s390/entry: Make ret_from_fork() ready for lowcore relocation In preparation of having lowcore at different address than zero, add the base register to all lowcore accesses in ret_from_fork(). Reviewed-by: Heiko Carstens Signed-off-by: Sven Schnelle Signed-off-by: Vasily Gorbik arch/s390/kernel/entry.S | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) commit 7cc86dee44a47d961fd6195fd91f75ce176b992d Author: Sven Schnelle Date: Mon Jul 22 15:41:24 2024 +0200 s390/entry: Make __switch_to() ready for lowcore relocation In preparation of having lowcore at different address than zero, add the base register to all lowcore accesses in __switch_to(). Reviewed-by: Heiko Carstens Signed-off-by: Sven Schnelle Signed-off-by: Vasily Gorbik arch/s390/kernel/entry.S | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-) commit 4064b711127e1eb5b5fd42d539fd45e3e33c9b6f Author: Sven Schnelle Date: Mon Jul 22 15:41:23 2024 +0200 s390/entry: Make restart_int_handler() ready for lowcore relocation In preparation of having lowcore at different address than zero, add the base register to all lowcore accesses in restart_int_handler(). Reviewed-by: Heiko Carstens Signed-off-by: Sven Schnelle Signed-off-by: Vasily Gorbik arch/s390/kernel/entry.S | 14 ++++++++------ 1 file changed, 8 insertions(+), 6 deletions(-) commit 0001b7bbc53aeb8d31f650701d2a55e498634a2d Author: Sven Schnelle Date: Mon Jul 22 15:41:22 2024 +0200 s390/entry: Make mchk_int_handler() ready for lowcore relocation In preparation of having lowcore at different address than zero, add the base register to all lowcore accesses in mcck_int_handler(). Reviewed-by: Heiko Carstens Signed-off-by: Sven Schnelle Signed-off-by: Vasily Gorbik arch/s390/kernel/entry.S | 48 +++++++++++++++++++++++++----------------------- 1 file changed, 25 insertions(+), 23 deletions(-) commit bd2c55b307f77fbf19d76250672266ff06f4a324 Author: Sven Schnelle Date: Mon Jul 22 15:41:21 2024 +0200 s390/entry: Make int handlers ready for lowcore relocation In preparation of having lowcore at different address than zero, add the base register to all lowcore accesses in the ext/io interrupt handlers. Reviewed-by: Heiko Carstens Signed-off-by: Sven Schnelle Signed-off-by: Vasily Gorbik arch/s390/kernel/entry.S | 31 ++++++++++++++++--------------- 1 file changed, 16 insertions(+), 15 deletions(-) commit 9e1e275fa28d5896ca7cdf8afa5eb58c0117a303 Author: Sven Schnelle Date: Mon Jul 22 15:41:20 2024 +0200 s390/entry: Make pgm_check_handler() ready for lowcore relocation In preparation of having lowcore at different address than zero, add the base register to all lowcore accesses in pgm_check_handler(). Reviewed-by: Heiko Carstens Signed-off-by: Sven Schnelle Signed-off-by: Vasily Gorbik arch/s390/include/asm/lowcore.h | 6 ++++++ arch/s390/kernel/entry.S | 47 +++++++++++++++++++++++------------------ 2 files changed, 32 insertions(+), 21 deletions(-) commit 86e08d64eec35cbe6a85798add4bfc1218ca9513 Author: Sven Schnelle Date: Mon Jul 22 15:41:19 2024 +0200 s390/entry: Add base register to CHECK_VMAP_STACK/CHECK_STACK macro In preparation of having lowcore at different address than zero, add the base register to CHECK_VMAP_STACK and CHECK_STACK. No functional change, because %r0 is passed to the macro. Signed-off-by: Sven Schnelle Signed-off-by: Vasily Gorbik arch/s390/kernel/entry.S | 24 ++++++++++++------------ 1 file changed, 12 insertions(+), 12 deletions(-) commit 6908f8f916f24636621a5b4c300bdf9a0155f07e Author: Sven Schnelle Date: Mon Jul 22 15:41:18 2024 +0200 s390/entry: Add base register to SIEEXIT macro In preparation of having lowcore at different address than zero, add the base register to SIEEXIT. No functional change, because %r0 is passed to the macro. Reviewed-by: Heiko Carstens Signed-off-by: Sven Schnelle Signed-off-by: Vasily Gorbik arch/s390/kernel/entry.S | 16 ++++++++-------- 1 file changed, 8 insertions(+), 8 deletions(-) commit ca2f0a26c498c42fcccdf09527e8755481801eea Author: Sven Schnelle Date: Mon Jul 22 15:41:17 2024 +0200 s390/entry: Add base register to MBEAR macro In preparation of having lowcore at different address than zero, add the base register to MBEAR. No functional change, because %r0 is passed to the macro. Reviewed-by: Heiko Carstens Signed-off-by: Sven Schnelle Signed-off-by: Vasily Gorbik arch/s390/kernel/entry.S | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-) commit 12184a46767b40c1c9b022cd96a9b4019ebd368f Author: Sven Schnelle Date: Mon Jul 22 15:41:16 2024 +0200 s390/entry: Make __sie64a() ready for lowcore relocation In preparation of having lowcore at different address than zero, add the base register to all lowcore accesses in __sie64a(). Reviewed-by: Heiko Carstens Signed-off-by: Sven Schnelle Signed-off-by: Vasily Gorbik arch/s390/kernel/entry.S | 9 ++++++--- 1 file changed, 6 insertions(+), 3 deletions(-) commit 39e8c5d6a4ce6512af5178f70c0c5d735141fc10 Author: Sven Schnelle Date: Mon Jul 22 15:41:15 2024 +0200 s390/head64: Make startup code ready for lowcore relocation In preparation of having lowcore at different address than zero, add the base register to all lowcore accesses in startup_continue(). Reviewed-by: Heiko Carstens Signed-off-by: Sven Schnelle Signed-off-by: Vasily Gorbik arch/s390/kernel/head64.S | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-) commit 5ade5be4edf855245955108860d2016af3065a37 Author: Sven Schnelle Date: Mon Jul 22 15:41:14 2024 +0200 s390: Add infrastructure to patch lowcore accesses The s390 architecture defines two special per-CPU data pages called the "prefix area". In s390-linux terminology this is usually called "lowcore". This memory area contains system configuration data like old/new PSW's for system call/interrupt/machine check handlers and lots of other data. It is normally mapped to logical address 0. This area can only be accessed when in supervisor mode. This means that kernel code can dereference NULL pointers, because accesses to address 0 are allowed. Parts of lowcore can be write protected, but read accesses and write accesses outside of the write protected areas are not caught. To remove this limitation for debugging and testing, remap lowcore to another address and define a function get_lowcore() which simply returns the address where lowcore is mapped at. This would normally introduce a pointer dereference (=memory read). As lowcore is used for several very often used variables, add code to patch this function during runtime, so we avoid the memory reads. For C code get_lowcore() has to be used, for assembly code it is the GET_LC macro. When using this macro/function a reference is added to alternative patching. All these locations will be patched to the actual lowcore location when the kernel is booted or a module is loaded. To make debugging/bisecting problems easier, this patch adds all the infrastructure but the lowcore address is still hardwired to 0. This way the code can be converted on a per function basis, and the functionality is enabled in a patch after all the functions have been converted. Note that this requires at least z16 because the old lpsw instruction only allowed a 12 bit displacement. z16 introduced lpswey which allows 20 bits (signed), so the lowcore can effectively be mapped from address 0 - 0x7e000. To use 0x7e000 as address, a 6 byte lgfi instruction would have to be used in the alternative. To save two bytes, llilh can be used, but this only allows to set bits 16-31 of the address. In order to use the llilh instruction, use 0x70000 as alternative lowcore address. This is still large enough to catch NULL pointer dereferences into large arrays. Reviewed-by: Heiko Carstens Signed-off-by: Sven Schnelle Signed-off-by: Vasily Gorbik arch/s390/boot/boot.h | 2 ++ arch/s390/boot/ipl_parm.c | 1 + arch/s390/boot/startup.c | 1 + arch/s390/boot/vmem.c | 11 ++++++++++- arch/s390/include/asm/abs_lowcore.h | 8 ++++++++ arch/s390/include/asm/alternative.h | 4 ++++ arch/s390/include/asm/lowcore.h | 23 ++++++++++++++++++++++- arch/s390/kernel/abs_lowcore.c | 1 + arch/s390/kernel/alternative.c | 4 ++++ arch/s390/kernel/alternative.h | 0 arch/s390/kernel/early.c | 1 + arch/s390/kernel/setup.c | 3 +++ 12 files changed, 57 insertions(+), 2 deletions(-) commit 13be21f39ab58184fb91844d2242e33805dda40e Author: Heiko Carstens Date: Mon Jul 22 15:41:13 2024 +0200 s390/atomic_ops: Disable flag outputs constraint for GCC versions below 14.2.0 GCC may die with an ICE if the flag outputs constraint is used in combination with other inline assemblies. This will be fixed with GCC 14.2.0. Therefore disable the use of the constraint for now. Link: https://gcc.gnu.org/git?p=gcc.git;a=commit;h=cd11413ff7c4353a3e336db415304f788d23a393 Signed-off-by: Heiko Carstens Signed-off-by: Sven Schnelle Signed-off-by: Vasily Gorbik arch/s390/include/asm/atomic_ops.h | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) commit fc8eac33ad93420b4e51cdd811e12d3fc9b531a5 Author: Heiko Carstens Date: Mon Jul 22 15:41:12 2024 +0200 s390/entry: Move SIE indicator flag to thread info CIF_SIE indicates if a thread is running in SIE context. This is the state of a thread and not the CPU. Therefore move this indicator to thread info. Signed-off-by: Heiko Carstens Signed-off-by: Sven Schnelle Signed-off-by: Vasily Gorbik arch/s390/include/asm/processor.h | 2 -- arch/s390/include/asm/thread_info.h | 1 + arch/s390/kernel/asm-offsets.c | 1 + arch/s390/kernel/entry.S | 20 ++++++++++++-------- 4 files changed, 14 insertions(+), 10 deletions(-) commit 213400c4afd5c89fd8bd17d06addf145f6c8f0d5 Author: Heiko Carstens Date: Mon Jul 22 15:41:11 2024 +0200 s390/nmi: Simplify ptregs setup The low level machine check handler code fills the ptregs structure partially with the register contents present at machine check handler entry and partially with contents from the machine check save area. In case of a machine check the contents of all general purpose registers are saved by the CPU to the machine check save area. Therefore simplify the code and fill the ptregs structure by only using the machine check save area as source. Signed-off-by: Heiko Carstens Signed-off-by: Sven Schnelle Signed-off-by: Vasily Gorbik arch/s390/kernel/entry.S | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-) commit beb8cee06f9b8726616ba87783116cb8fb889c7a Author: Heiko Carstens Date: Tue Jul 16 13:50:56 2024 +0200 s390/alternatives: Remove alternative facility list The alternative and the normal facility list are always identical. Remove the alternative facility list, which allows to simplify the alternatives code. Acked-by: Alexander Gordeev Tested-by: Sven Schnelle Signed-off-by: Heiko Carstens Signed-off-by: Vasily Gorbik arch/s390/include/asm/alternative.h | 9 ++++----- arch/s390/include/asm/facility.h | 1 - arch/s390/kernel/alternative.c | 7 +------ arch/s390/kernel/early.c | 6 ------ arch/s390/kernel/setup.c | 1 - 5 files changed, 5 insertions(+), 19 deletions(-) commit 47837a5c74f432ad992239cfa5966543f466d4df Author: Heiko Carstens Date: Tue Jul 16 13:50:55 2024 +0200 s390/nospec: Push down alternative handling The nospec implementation is deeply integrated into the alternatives code: only for nospec an alternative facility list is implemented and used by the alternative code, while it is modified by nospec specific needs. Push down the nospec alternative handling into the nospec by introducing a new alternative type and a specific nospec callback to decide if alternatives should be applied. Also introduce a new global nobp variable which together with facility 82 can be used to decide if nobp is enabled or not. Acked-by: Alexander Gordeev Tested-by: Sven Schnelle Signed-off-by: Heiko Carstens Signed-off-by: Vasily Gorbik arch/s390/include/asm/alternative.h | 5 +++++ arch/s390/include/asm/nospec-branch.h | 9 +++++++++ arch/s390/include/asm/processor.h | 2 +- arch/s390/kernel/alternative.c | 4 ++++ arch/s390/kernel/early.c | 2 -- arch/s390/kernel/entry.S | 8 ++++---- arch/s390/kernel/nospec-branch.c | 16 +++++++++------- arch/s390/kernel/nospec-sysfs.c | 2 +- 8 files changed, 33 insertions(+), 15 deletions(-) commit 7f9d85998f6c5b989796470fd1ac066232c60723 Author: Sven Schnelle Date: Tue Jul 16 13:50:54 2024 +0200 s390/alternatives: Allow early alternative patching in decompressor Add the required code to patch alternatives early in the decompressor. This is required for the upcoming lowcore relocation changes, where alternatives for facility 193 need to get patched before lowcore alternatives. Reviewed-by: Alexander Gordeev Co-developed-by: Heiko Carstens Signed-off-by: Heiko Carstens Signed-off-by: Sven Schnelle Signed-off-by: Vasily Gorbik arch/s390/boot/Makefile | 2 +- arch/s390/boot/alternative.c | 3 +++ arch/s390/boot/boot.h | 2 ++ arch/s390/boot/startup.c | 5 +++++ arch/s390/include/asm/alternative.h | 12 +++++++++--- arch/s390/kernel/alternative.c | 5 +++++ arch/s390/kernel/vmlinux.lds.S | 2 ++ 7 files changed, 27 insertions(+), 4 deletions(-) commit b3e0c5f734f934dab1cfdef669e3baa165a0cbfe Author: Heiko Carstens Date: Tue Jul 16 13:50:53 2024 +0200 s390/alternatives: Rework to allow for callbacks Rework alternatives to allow for callbacks. With this every alternative entry has additional data encoded: - When (aka context) an alternative is supposed to be applied - The type of an alternative, which allows for type specific handling and callbacks - Extra type specific payload (patch information), which can be passed to callbacks in order to decide if an alternative should be applied or not With this only the "late" context is implemented, which means there is no change to the previous behaviour. All code is just converted to the more generic new infrastructure. Reviewed-by: Alexander Gordeev Tested-by: Sven Schnelle Signed-off-by: Heiko Carstens Signed-off-by: Vasily Gorbik arch/s390/include/asm/alternative.h | 66 ++++++++++++++++++++++++++++++++++--- arch/s390/include/asm/processor.h | 2 +- arch/s390/include/asm/spinlock.h | 2 +- arch/s390/kernel/alternative.c | 30 +++++++++-------- arch/s390/kernel/entry.S | 22 ++++++------- arch/s390/lib/spinlock.c | 4 +-- 6 files changed, 92 insertions(+), 34 deletions(-) commit 030f7951c5b293739301fb616add0f1d3fb46073 Author: Heiko Carstens Date: Tue Jul 16 13:50:52 2024 +0200 s390/uaccess: Make s390_kernel_write() usable for decompressor To avoid lots of ifdefs in C code make s390_kernel_write() usable for the decompressor: simply use memcpy() for this case since there is no write protection enabled that early. Reviewed-by: Alexander Gordeev Tested-by: Sven Schnelle Signed-off-by: Heiko Carstens Signed-off-by: Vasily Gorbik arch/s390/include/asm/uaccess.h | 9 ++++++++- arch/s390/mm/maccess.c | 4 ++-- 2 files changed, 10 insertions(+), 3 deletions(-) commit ace76fac944b06e46427e0406f315609f278ef91 Author: Heiko Carstens Date: Tue Jul 16 13:50:51 2024 +0200 s390/alternatives: Move text sync functions Move all text sync functions from alternative.c to processor.c. This way there is only minimal code left in alternative.c left, which is a prerequisite to use the C file within boot code as well. Reviewed-by: Alexander Gordeev Tested-by: Sven Schnelle Signed-off-by: Heiko Carstens Signed-off-by: Vasily Gorbik arch/s390/kernel/alternative.c | 20 -------------------- arch/s390/kernel/processor.c | 20 +++++++++++++++++++- 2 files changed, 19 insertions(+), 21 deletions(-) commit c77f7354c4478bf4560b546913e097b3d4ab50c1 Author: Heiko Carstens Date: Tue Jul 16 13:50:50 2024 +0200 s390/alternatives: Merge both alternative header files The two alternative header files must stay in sync. This is easier to achieve within one header file. Therefore merge both of them and have only one file, like most other architectures. Reviewed-by: Alexander Gordeev Tested-by: Sven Schnelle Signed-off-by: Heiko Carstens Signed-off-by: Vasily Gorbik arch/s390/include/asm/alternative-asm.h | 57 --------------------------------- arch/s390/include/asm/alternative.h | 50 +++++++++++++++++++++++++++++ arch/s390/kernel/entry.S | 2 +- 3 files changed, 51 insertions(+), 58 deletions(-) commit 9be999a61232fd6748ebe8654c71bcde1a0fbed3 Author: Heiko Carstens Date: Tue Jul 16 13:50:49 2024 +0200 s390/alternatives: Use consistent naming The alternative code is using the words facility and feature for the same. Rename facility to more generic feature everywhere to have consistent naming. Reviewed-by: Alexander Gordeev Tested-by: Sven Schnelle Signed-off-by: Heiko Carstens Signed-off-by: Vasily Gorbik arch/s390/include/asm/alternative.h | 30 +++++++++++++++--------------- arch/s390/kernel/alternative.c | 2 +- 2 files changed, 16 insertions(+), 16 deletions(-) commit 035248a7843242d51f249444fbad7340b7336f68 Author: Sven Schnelle Date: Tue Jul 16 13:50:48 2024 +0200 s390/alternatives: Remove noaltinstr option The current Kernel doesn't boot without alternative patching on z16 machines. To avoid such bugs in the future, remove the option disable alternative patching. Signed-off-by: Sven Schnelle Reviewed-by: Alexander Gordeev Signed-off-by: Heiko Carstens Signed-off-by: Vasily Gorbik Documentation/admin-guide/kernel-parameters.txt | 3 --- arch/s390/kernel/alternative.c | 21 ++------------------- 2 files changed, 2 insertions(+), 22 deletions(-) commit d3604ffba1521f59f312be3f19999084dddef446 Author: Sven Schnelle Date: Tue Jul 16 09:26:15 2024 +0200 s390: Move CIF flags to struct pcpu To allow testing flags for offline CPUs, move the CIF flags to struct pcpu. To avoid having to calculate the array index for each access, add a pointer to the pcpu member for the current cpu to lowcore. Reviewed-by: Heiko Carstens Signed-off-by: Sven Schnelle Signed-off-by: Vasily Gorbik arch/s390/include/asm/lowcore.h | 3 +-- arch/s390/include/asm/processor.h | 26 ++++++++++++++++++++------ arch/s390/kernel/asm-offsets.c | 4 +++- arch/s390/kernel/entry.S | 3 ++- arch/s390/kernel/setup.c | 1 + arch/s390/kernel/smp.c | 17 +++++++---------- 6 files changed, 34 insertions(+), 20 deletions(-) commit 90fc5ac28235843b1d5070c5dac9b01e7d39b24c Author: Sven Schnelle Date: Tue Jul 16 09:26:14 2024 +0200 s390/smp: Switch pcpu_devices to percpu In preparation of moving the CIF flags from lowcore to pcpu_devices, convert the pcpu_devices array to use the percpu infrastructure. This is required because using the pcpu_devices array as it is would introduce a performance penalty due to the fact that CPU flags for multiple CPUs would end up in the same cacheline. Note that a pointer to the pcpu struct of the IPL CPU is still required. This is because a restart interrupt can be triggered on an offline CPU. s390 stores the percpu offset in lowcore, but offline CPUs have no lowcore area allocated. So percpu data cannot be used from an offline CPU and we need to get the pcpu pointer for the IPL cpu from somewhere else. Reviewed-by: Heiko Carstens Signed-off-by: Sven Schnelle Signed-off-by: Vasily Gorbik arch/s390/kernel/smp.c | 113 +++++++++++++++++++++++++------------------------ 1 file changed, 57 insertions(+), 56 deletions(-) commit a795eeaf851b91c79fc357a245ca72fd1e7df906 Author: Sven Schnelle Date: Tue Jul 16 09:26:13 2024 +0200 s390/smp: Handle restart interrupt on ipl cpu The current smp code allows to trigger a restart interrupt on CPUs offline in linux. To allow using the percpu infrastructure instead of the pcpu_devices array, switch to the ipl cpu which is always online before calling do_restart(). Reviewed-by: Heiko Carstens Reviewed-by: Alexander Gordeev Signed-off-by: Sven Schnelle Signed-off-by: Vasily Gorbik arch/s390/include/asm/smp.h | 1 - arch/s390/kernel/ipl.c | 2 +- arch/s390/kernel/smp.c | 15 --------------- 3 files changed, 1 insertion(+), 17 deletions(-) commit b798b685b42c9dbe508e59a74250d97c41bec35e Author: Alexander Gordeev Date: Wed Jul 17 21:43:22 2024 +0200 s390/boot: Do not assume the decompressor range is reserved When allocating a random memory range for .amode31 sections the minimal randomization address is 0. That does not lead to a possible overlap with the decompressor image (which also starts from 0) since by that time the image range is already reserved. Do not assume the decompressor range is reserved and always provide the minimal randomization address for .amode31 sections beyond the decompressor. That is a prerequisite for moving the lowcore memory address from NULL elsewhere. Signed-off-by: Alexander Gordeev Signed-off-by: Sven Schnelle Signed-off-by: Vasily Gorbik arch/s390/boot/startup.c | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) commit e6ce1f12d777f6ee22b20e10ae6a771e7e6f44f5 Author: Thomas Richter Date: Mon Jul 15 12:07:29 2024 +0200 s390/cpum_cf: Fix endless loop in CF_DIAG event stop Event CF_DIAG reads out complete counter sets using stcctm instruction. This is done at event start time when the process starts execution and at event stop time when the process is removed from the CPU. During removal the difference of each counter in the counter sets is calculated and saved as raw data in the ring buffer. This works fine unless the number of counters in a counter set is zero. This may happen for the extended counter set. This set is machine specific and the size of the counter set can be zero even when extended counter set is authorized for read access. This case is not handled. cfdiag_diffctr() checks authorization of the extended counter set. If true the functions assumes the extended counter set has been saved in a data buffer. However this is not the case, cfdiag_getctrset() does not save a counter set with counter set size of zero. This mismatch causes an endless loop in the counter set readout during event stop handling. The calculation of the difference of the counters in each counter now verifies the size of the counter set is non-zero. A counter set with size zero is skipped. Fixes: a029a4eab39e ("s390/cpumf: Allow concurrent access for CPU Measurement Counter Facility") Signed-off-by: Thomas Richter Acked-by: Sumanth Korikkar Acked-by: Heiko Carstens Cc: Heiko Carstens Cc: Vasily Gorbik Cc: Alexander Gordeev Signed-off-by: Vasily Gorbik arch/s390/kernel/perf_cpum_cf.c | 14 ++++++++++---- 1 file changed, 10 insertions(+), 4 deletions(-) commit 19af288706b25f2213e85b8b2df140c04fd7c63d Author: Ilya Leoshkevich Date: Tue Jul 23 14:44:12 2024 +0200 s390/ptdump: Add KMSAN page markers Add KMSAN vmalloc metadata areas to /sys/kernel/debug/kernel_page_tables. Example output: 0x000003a95fff9000-0x000003a960000000 28K PTE I ---[ vmalloc Area End ]--- ---[ Kmsan vmalloc Shadow Start ]--- 0x000003a960000000-0x000003a960010000 64K PTE RW NX [...] 0x000003d3dfff9000-0x000003d3e0000000 28K PTE I ---[ Kmsan vmalloc Shadow End ]--- ---[ Kmsan vmalloc Origins Start ]--- 0x000003d3e0000000-0x000003d3e0010000 64K PTE RW NX [...] 0x000003fe5fff9000-0x000003fe60000000 28K PTE I ---[ Kmsan vmalloc Origins End ]--- ---[ Kmsan Modules Shadow Start ]--- 0x000003fe60000000-0x000003fe60001000 4K PTE RW NX [...] 0x000003fe60100000-0x000003fee0000000 2047M PMD I ---[ Kmsan Modules Shadow End ]--- ---[ Kmsan Modules Origins Start ]--- 0x000003fee0000000-0x000003fee0001000 4K PTE RW NX [...] 0x000003fee0100000-0x000003ff60000000 2047M PMD I ---[ Kmsan Modules Origins End ]--- ---[ Modules Area Start ]--- 0x000003ff60000000-0x000003ff60001000 4K PTE RO X Signed-off-by: Ilya Leoshkevich Reviewed-by: Heiko Carstens Link: https://lore.kernel.org/r/20240723124441.120044-3-iii@linux.ibm.com Signed-off-by: Vasily Gorbik arch/s390/mm/dump_pagetables.c | 30 ++++++++++++++++++++++++++++++ 1 file changed, 30 insertions(+) commit ec25f99cc834644e6577fa11582f7691589ed8cc Author: Ilya Leoshkevich Date: Tue Jul 23 14:44:11 2024 +0200 s390/kmsan: Fix merge conflict with get_lowcore() introduction Resolve the conflict between commit 2a48c8c9cf87 ("s390/kmsan: implement the architecture-specific functions") and commit 39976f1278a9 ("s390: Remove S390_lowcore"). Fixes: 2a48c8c9cf87 ("s390/kmsan: implement the architecture-specific functions") Signed-off-by: Ilya Leoshkevich Reviewed-by: Heiko Carstens Link: https://lore.kernel.org/r/20240723124441.120044-2-iii@linux.ibm.com Signed-off-by: Vasily Gorbik arch/s390/include/asm/kmsan.h | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) commit e188e5d5ffd01d484b5255b88739fcf67b300223 Author: Vasily Gorbik Date: Thu Jul 11 15:50:26 2024 +0200 s390/setup: Fix __pa/__va for modules under non-GPL licenses The struct vm_layout contains fields used in __pa/__va calculations. Such fundamental things have to be exported with EXPORT_SYMBOL to avoid breakages of out-of-tree modules under non-GPL licenses. Fixes: 7de0446f0b26 ("s390/boot: Make identity mapping base address explicit") Acked-by: Heiko Carstens Acked-by: Alexander Gordeev Signed-off-by: Vasily Gorbik arch/s390/kernel/setup.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit ab42fcb511fd9d241bbab7cc3ca04e34e9fc0666 Author: Gerd Bayer Date: Thu Jul 11 15:45:27 2024 +0200 s390/pci: Allow allocation of more than 1 MSI interrupt On a PCI adapter that provides up to 8 MSI interrupt sources the s390 implementation of PCI interrupts rejected to accommodate them, although the underlying hardware is able to support that. For MSI-X it is sufficient to allocate a single irq_desc per msi_desc, but for MSI multiple irq descriptors are attached to and controlled by a single msi descriptor. Add the appropriate loops to maintain multiple irq descriptors and tie/untie them to/from the appropriate AIBV bit, if a device driver allocates more than 1 MSI interrupt. Common PCI code passes on requests to allocate a number of interrupt vectors based on the device drivers' demand and the PCI functions' capabilities. However, the root-complex of s390 systems support just a limited number of interrupt vectors per PCI function. Produce a kernel log message to inform about any architecture-specific capping that might be done. With this change, we had a PCI adapter successfully raising interrupts to its device driver via all 8 sources. Fixes: a384c8924a8b ("s390/PCI: Fix single MSI only check") Signed-off-by: Gerd Bayer Reviewed-by: Niklas Schnelle Signed-off-by: Vasily Gorbik arch/s390/pci/pci_irq.c | 62 +++++++++++++++++++++++++++++++++---------------- 1 file changed, 42 insertions(+), 20 deletions(-) commit 5fd11b96b43708f2f6e3964412c301c1bd20ec0f Author: Gerd Bayer Date: Thu Jul 11 15:45:26 2024 +0200 s390/pci: Refactor arch_setup_msi_irqs() Factor out adapter interrupt allocation from arch_setup_msi_irqs() in preparation for enabling registration of multiple MSIs. Code movement only, no change of functionality intended. Signed-off-by: Gerd Bayer Reviewed-by: Niklas Schnelle Signed-off-by: Vasily Gorbik arch/s390/pci/pci_irq.c | 54 +++++++++++++++++++++++++++++-------------------- 1 file changed, 32 insertions(+), 22 deletions(-) commit 57e29f4c8919af7276c35c2da0ae5efb4c36c33e Author: Heiko Carstens Date: Mon Jul 15 10:33:06 2024 +0200 s390: Add runtime constant support Implement the runtime constant infrastructure for s390, allowing the dcache d_hash() function to be generated using as a constant for hash table address followed by shift by a constant of the hash index. This is the s390 variant of commit 94a2bc0f611c ("arm64: add 'runtime constant' support") and commit e3c92e81711d ("runtime constants: add x86 architecture support"). Signed-off-by: Heiko Carstens Acked-by: Vasily Gorbik Signed-off-by: Vasily Gorbik arch/s390/include/asm/runtime-const.h | 77 +++++++++++++++++++++++++++++++++++ arch/s390/kernel/vmlinux.lds.S | 3 ++ 2 files changed, 80 insertions(+) commit b8a4518b5c2d1164f9bb2e586733a658c5239adf Author: Simon Horman Date: Tue Jul 23 10:41:52 2024 +0100 drbd: Add peer_device to Kernel doc Add missing documentation of peer_device parameter to Kernel doc. These parameters were added in commit 8164dd6c8ae1 ("drbd: Add peer device parameter to whole-bitmap I/O handlers") Flagged by W=1 builds. Signed-off-by: Simon Horman Link: https://lore.kernel.org/r/20240723-drbd-doc-v1-1-a04d9b7a9688@kernel.org Signed-off-by: Jens Axboe drivers/block/drbd/drbd_main.c | 4 ++++ 1 file changed, 4 insertions(+) commit 3ba359c0cd6eb5ea772125a7aededb4a2d516684 Author: Johannes Berg Date: Fri Jul 19 09:41:18 2024 -0700 net: bonding: correctly annotate RCU in bond_should_notify_peers() RCU use in bond_should_notify_peers() looks wrong, since it does rcu_dereference(), leaves the critical section, and uses the pointer after that. Luckily, it's called either inside a nested RCU critical section or with the RTNL held. Annotate it with rcu_dereference_rtnl() instead, and remove the inner RCU critical section. Fixes: 4cb4f97b7e36 ("bonding: rebuild the lock use for bond_mii_monitor()") Reviewed-by: Jiri Pirko Signed-off-by: Johannes Berg Acked-by: Jay Vosburgh Link: https://patch.msgid.link/20240719094119.35c62455087d.I68eb9c0f02545b364b79a59f2110f2cf5682a8e2@changeid Signed-off-by: Paolo Abeni drivers/net/bonding/bond_main.c | 7 ++----- 1 file changed, 2 insertions(+), 5 deletions(-) commit e5f98896efb3b6350cb6f1c241394966dcbcf240 Author: Rafael J. Wysocki Date: Thu Jul 18 21:00:35 2024 +0200 thermal: trip: Split thermal_zone_device_set_mode() Pull a wrapper around thermal zone .change_mode() callback out of thermal_zone_device_set_mode() because it will be used elsewhere subsequently. No intentional functional impact. Signed-off-by: Rafael J. Wysocki Link: https://patch.msgid.link/2206793.irdbgypaU6@rjwysocki.net drivers/thermal/thermal_core.c | 31 ++++++++++++++++++++++++------- 1 file changed, 24 insertions(+), 7 deletions(-) commit 39a9c25bcdfb5e88995841c47439b74cac74a527 Author: Lorenzo Bianconi Date: Fri Jul 19 22:38:31 2024 +0200 net: airoha: Fix MBI_RX_AGE_SEL_MASK definition Fix copy-paste error in MBI_RX_AGE_SEL_MASK macro definition Fixes: 23020f049327 ("net: airoha: Introduce ethernet support for EN7581 SoC") Signed-off-by: Lorenzo Bianconi Reviewed-by: Simon Horman Link: https://patch.msgid.link/d27d0465be1bff3369e886e5f10c4d37fefc4934.1721419930.git.lorenzo@kernel.org Signed-off-by: Paolo Abeni drivers/net/ethernet/mediatek/airoha_eth.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 368990a7fe30737c990f628a60d26d9854a9e690 Author: Juergen Gross Date: Mon Jul 15 09:47:08 2024 +0200 xen: fix multicall debug data referencing The recent adding of multicall debug mixed up the referencing of the debug data. A __percpu tagged pointer can't be initialized with a plain pointer, so use another percpu variable for the pointer and set it on each new cpu via a function. Fixes: 942d917cb92a ("xen: make multicall debug boot time selectable") Reported-by: kernel test robot Closes: https://lore.kernel.org/oe-kbuild-all/202407151106.5s7Mnfpz-lkp@intel.com/ Signed-off-by: Juergen Gross Reviewed-by: Boris Ostrovsky Signed-off-by: Juergen Gross arch/x86/xen/multicalls.c | 19 ++++++++++++------- arch/x86/xen/smp_pv.c | 1 + arch/x86/xen/xen-ops.h | 3 +++ 3 files changed, 16 insertions(+), 7 deletions(-) commit 26720dd2b5a1d088bff8f7e6355fca021c83718f Author: Jonathan Cavitt Date: Fri Jul 12 14:41:56 2024 -0700 drm/i915: Allow NULL memory region Prevent a NULL pointer access in intel_memory_regions_hw_probe. Fixes: 05da7d9f717b ("drm/i915/gem: Downgrade stolen lmem setup warning") Reported-by: Dan Carpenter Closes: https://gitlab.freedesktop.org/drm/i915/kernel/-/issues/11704 Signed-off-by: Jonathan Cavitt Reviewed-by: Nirmoy Das Reviewed-by: Andi Shyti Signed-off-by: Andi Shyti Link: https://patchwork.freedesktop.org/patch/msgid/20240712214156.3969584-1-jonathan.cavitt@intel.com (cherry picked from commit d75dec1fcbcb05b021c08b62551649567ab8955c) Signed-off-by: Tvrtko Ursulin drivers/gpu/drm/i915/intel_memory_region.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) commit 65564157ae64cec0f527583f96e32f484f730f92 Author: Nitin Gote Date: Thu Jul 11 22:02:08 2024 +0530 drm/i915/gt: Do not consider preemption during execlists_dequeue for gen8 We're seeing a GPU hang issue on a CHV platform, which was caused by commit bac24f59f454 ("drm/i915/execlists: Enable coarse preemption boundaries for Gen8"). The Gen8 platform only supports timeslicing and doesn't have a preemption mechanism, as its engines do not have a preemption timer. Commit 751f82b353a6 ("drm/i915/gt: Only disable preemption on Gen8 render engines") addressed this issue only for render engines. This patch extends that fix by ensuring that preemption is not considered for all engines on Gen8 platforms. v4: - Use the correct Fixes tag (Rodrigo Vivi) - Reworded commit log (Andi Shyti) v3: - Inside need_preempt(), condition of can_preempt() is not required as simplified can_preempt() is enough. (Chris Wilson) v2: Simplify can_preempt() function (Tvrtko Ursulin) Fixes: 751f82b353a6 ("drm/i915/gt: Only disable preemption on gen8 render engines") Closes: https://gitlab.freedesktop.org/drm/i915/kernel/-/issues/11396 Suggested-by: Andi Shyti Signed-off-by: Nitin Gote Cc: Chris Wilson CC: # v5.12+ Reviewed-by: Jonathan Cavitt Reviewed-by: Andi Shyti Signed-off-by: Andi Shyti Link: https://patchwork.freedesktop.org/patch/msgid/20240711163208.1355736-1-nitin.r.gote@intel.com (cherry picked from commit 7df0be6e6280c6fca01d039864bb123e5e36604b) Signed-off-by: Tvrtko Ursulin drivers/gpu/drm/i915/gt/intel_execlists_submission.c | 6 +----- 1 file changed, 1 insertion(+), 5 deletions(-) commit d587d825424b6784ff7d7519efd1b827b09aa501 Author: James Chapman Date: Thu Jul 18 14:43:48 2024 +0100 l2tp: make session IDR and tunnel session list coherent Modify l2tp_session_register and l2tp_session_unhash so that the session IDR and tunnel session lists remain coherent. To do so, hold the session IDR lock and the tunnel's session list lock when making any changes to either list. Without this change, a rare race condition could hit the WARN_ON_ONCE in l2tp_session_unhash if a thread replaced the IDR entry while another thread was registering the same ID. [ 7126.151795][T17511] WARNING: CPU: 3 PID: 17511 at net/l2tp/l2tp_core.c:1282 l2tp_session_delete.part.0+0x87e/0xbc0 [ 7126.163754][T17511] ? show_regs+0x93/0xa0 [ 7126.164157][T17511] ? __warn+0xe5/0x3c0 [ 7126.164536][T17511] ? l2tp_session_delete.part.0+0x87e/0xbc0 [ 7126.165070][T17511] ? report_bug+0x2e1/0x500 [ 7126.165486][T17511] ? l2tp_session_delete.part.0+0x87e/0xbc0 [ 7126.166013][T17511] ? handle_bug+0x99/0x130 [ 7126.166428][T17511] ? exc_invalid_op+0x35/0x80 [ 7126.166890][T17511] ? asm_exc_invalid_op+0x1a/0x20 [ 7126.167372][T17511] ? l2tp_session_delete.part.0+0x87d/0xbc0 [ 7126.167900][T17511] ? l2tp_session_delete.part.0+0x87e/0xbc0 [ 7126.168429][T17511] ? __local_bh_enable_ip+0xa4/0x120 [ 7126.168917][T17511] l2tp_session_delete+0x40/0x50 [ 7126.169369][T17511] pppol2tp_release+0x1a1/0x3f0 [ 7126.169817][T17511] __sock_release+0xb3/0x270 [ 7126.170247][T17511] ? __pfx_sock_close+0x10/0x10 [ 7126.170697][T17511] sock_close+0x1c/0x30 [ 7126.171087][T17511] __fput+0x40b/0xb90 [ 7126.171470][T17511] task_work_run+0x16c/0x260 [ 7126.171897][T17511] ? __pfx_task_work_run+0x10/0x10 [ 7126.172362][T17511] ? srso_alias_return_thunk+0x5/0xfbef5 [ 7126.172863][T17511] ? do_raw_spin_unlock+0x174/0x230 [ 7126.173348][T17511] do_exit+0xaae/0x2b40 [ 7126.173730][T17511] ? srso_alias_return_thunk+0x5/0xfbef5 [ 7126.174235][T17511] ? __pfx_lock_release+0x10/0x10 [ 7126.174690][T17511] ? srso_alias_return_thunk+0x5/0xfbef5 [ 7126.175190][T17511] ? do_raw_spin_lock+0x12c/0x2b0 [ 7126.175650][T17511] ? __pfx_do_exit+0x10/0x10 [ 7126.176072][T17511] ? _raw_spin_unlock_irq+0x23/0x50 [ 7126.176543][T17511] do_group_exit+0xd3/0x2a0 [ 7126.176990][T17511] __x64_sys_exit_group+0x3e/0x50 [ 7126.177456][T17511] x64_sys_call+0x1821/0x1830 [ 7126.177895][T17511] do_syscall_64+0xcb/0x250 [ 7126.178317][T17511] entry_SYSCALL_64_after_hwframe+0x77/0x7f Fixes: aa5e17e1f5ec ("l2tp: store l2tpv3 sessions in per-net IDR") Signed-off-by: James Chapman Signed-off-by: Tom Parkin Reviewed-by: Simon Horman Link: https://patch.msgid.link/20240718134348.289865-1-jchapman@katalix.com Signed-off-by: Paolo Abeni net/l2tp/l2tp_core.c | 32 ++++++++++++++------------------ 1 file changed, 14 insertions(+), 18 deletions(-) commit cc73bbab4b1fb8a4f53a24645871dafa5f81266a Author: Ido Schimmel Date: Thu Jul 18 15:34:07 2024 +0300 ipv4: Fix incorrect source address in Record Route option The Record Route IP option records the addresses of the routers that routed the packet. In the case of forwarded packets, the kernel performs a route lookup via fib_lookup() and fills in the preferred source address of the matched route. The lookup is performed with the DS field of the forwarded packet, but using the RT_TOS() macro which only masks one of the two ECN bits. If the packet is ECT(0) or CE, the matched route might be different than the route via which the packet was forwarded as the input path masks both of the ECN bits, resulting in the wrong address being filled in the Record Route option. Fix by masking both of the ECN bits. Fixes: 8e36360ae876 ("ipv4: Remove route key identity dependencies in ip_rt_get_source().") Signed-off-by: Ido Schimmel Reviewed-by: Guillaume Nault Link: https://patch.msgid.link/20240718123407.434778-1-idosch@nvidia.com Signed-off-by: Paolo Abeni net/ipv4/route.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 03230edb0bd831662a7c08b6fef66b2a9a817774 Author: ethanwu Date: Thu Jul 11 14:47:56 2024 +0800 ceph: fix incorrect kmalloc size of pagevec mempool The kmalloc size of pagevec mempool is incorrectly calculated. It misses the size of page pointer and only accounts the number for the array. Fixes: a0102bda5bc0 ("ceph: move sb->wb_pagevec_pool to be a global mempool") Signed-off-by: ethanwu Reviewed-by: Xiubo Li Signed-off-by: Ilya Dryomov fs/ceph/super.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) commit 578eb54c4a16713d99eed736660e30ae6eb1877f Author: Xiubo Li Date: Wed Jul 10 20:16:54 2024 +0800 ceph: periodically flush the cap releases The MDS could be waiting the caps releases infinitely in some corner case and then reporting the caps revoke stuck warning. To fix this we should periodically flush the cap releases. Link: https://tracker.ceph.com/issues/57244 Signed-off-by: Xiubo Li Reviewed-by: Venky Shankar Signed-off-by: Ilya Dryomov fs/ceph/mds_client.c | 2 ++ 1 file changed, 2 insertions(+) commit 77bb4a501a7756e6f5428b72fb0e420deb7ae562 Author: Chen Ni Date: Tue Jul 9 14:44:00 2024 +0800 ceph: convert comma to semicolon in __ceph_dentry_dir_lease_touch() Replace a comma between expression statements by a semicolon. Signed-off-by: Chen Ni Reviewed-by: Xiubo Li Signed-off-by: Ilya Dryomov fs/ceph/dir.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 65d284a38c0ded391ae04a29640c34221c934cd2 Author: Max Kellermann Date: Thu Jun 6 18:41:57 2024 +0200 ceph: use cap_wait_list only if debugfs is enabled Only debugfs uses this list. By omitting it, we save some memory and reduce lock contention on `caps_list_lock`. Signed-off-by: Max Kellermann Reviewed-by: Xiubo Li Signed-off-by: Ilya Dryomov fs/ceph/caps.c | 6 ++++++ fs/ceph/mds_client.c | 2 ++ fs/ceph/mds_client.h | 6 ++++++ 3 files changed, 14 insertions(+) commit 2c716cf17edee74424336e87fe42b99ee5e91bad Author: Jeff Johnson Date: Thu Jul 18 16:17:52 2024 -0700 mips: sibyte: add missing MODULE_DESCRIPTION() macro Since commit 1fffe7a34c89 ("script: modpost: emit a warning when the description is missing"), a module without a MODULE_DESCRIPTION() will result in a warning with make W=1. The following warning is being observed when ARCH=mips and CONFIG_SIBYTE_TBPROF=m: WARNING: modpost: missing MODULE_DESCRIPTION() in arch/mips/sibyte/common/sb_tbprof.o Add the missing invocation of the MODULE_DESCRIPTION() macro. Signed-off-by: Jeff Johnson Signed-off-by: Thomas Bogendoerfer arch/mips/sibyte/common/sb_tbprof.c | 1 + 1 file changed, 1 insertion(+) commit a263e5f309f32301e1f3ad113293f4e68a82a646 Author: Gregory CLEMENT Date: Mon Jul 22 15:15:39 2024 +0200 MIPS: SMP-CPS: Fix address for GCR_ACCESS register for CM3 and later When the CM block migrated from CM2.5 to CM3.0, the address offset for the Global CSR Access Privilege register was modified. We saw this in the "MIPS64 I6500 Multiprocessing System Programmer's Guide," it is stated that "the Global CSR Access Privilege register is located at offset 0x0120" in section 5.4. It is at least the same for I6400. This fix allows to use the VP cores in SMP mode if the reset values were modified by the bootloader. Based on the work of Vladimir Kondratiev and the feedback from Jiaxun Yang . Fixes: 197e89e0984a ("MIPS: mips-cm: Implement mips_cm_revision") Signed-off-by: Gregory CLEMENT Reviewed-by: Jiaxun Yang Signed-off-by: Thomas Bogendoerfer arch/mips/include/asm/mips-cm.h | 4 ++++ arch/mips/kernel/smp-cps.c | 5 ++++- 2 files changed, 8 insertions(+), 1 deletion(-) commit fa165f919016829e542e37782a3452512dffa5ea Author: Jiaxun Yang Date: Sun Jul 14 10:41:05 2024 +0800 MIPS: Loongson64: Switch to SYNC_R4K Nowadays SYNC_R4K is performing better than Loongson64's custom sync mechanism. Switch to SYNC_R4K to improve performance and reduce code duplication. Signed-off-by: Jiaxun Yang Reviewed-by: Huacai Chen Signed-off-by: Thomas Bogendoerfer arch/mips/Kconfig | 1 + arch/mips/include/asm/smp.h | 1 - arch/mips/loongson64/smp.c | 35 ++--------------------------------- 3 files changed, 3 insertions(+), 34 deletions(-) commit b6f5ee4d53019443fb99dd23bc08680b1244ccfa Author: Kees Cook Date: Sat Jul 20 10:03:14 2024 -0700 execve: Move KUnit tests to tests/ subdirectory Move the exec KUnit tests into a separate directory to avoid polluting the local directory namespace. Additionally update MAINTAINERS for the new files. Reviewed-by: David Gow Reviewed-by: SeongJae Park Acked-by: Christian Brauner Link: https://lore.kernel.org/r/20240720170310.it.942-kees@kernel.org Signed-off-by: Kees Cook MAINTAINERS | 3 ++- fs/binfmt_elf.c | 2 +- fs/exec.c | 2 +- fs/{binfmt_elf_test.c => tests/binfmt_elf_kunit.c} | 0 fs/{exec_test.c => tests/exec_kunit.c} | 0 5 files changed, 4 insertions(+), 3 deletions(-) commit 47398f49dab8326bb652fa2d7a51ae5ec78775b5 Author: Eric Biggers Date: Sun Jul 21 11:38:40 2024 -0700 scsi: ufs: exynos: Don't resume FMP when crypto support is disabled If exynos_ufs_fmp_init() did not enable FMP support, then exynos_ufs_fmp_resume() should not execute the FMP-related SMC calls. Fixes: c96499fcb403 ("scsi: ufs: exynos: Add support for Flash Memory Protector (FMP)") Signed-off-by: Eric Biggers Link: https://lore.kernel.org/r/20240721183840.209284-1-ebiggers@kernel.org Reviewed-by: Bart Van Assche Signed-off-by: Martin K. Petersen drivers/ufs/host/ufs-exynos.c | 3 +++ 1 file changed, 3 insertions(+) commit 82dbb57ac8d06dfe8227ba9ab11a49de2b475ae5 Author: Damien Le Moal Date: Fri Jul 19 16:39:12 2024 +0900 scsi: mpt3sas: Avoid IOMMU page faults on REPORT ZONES Some firmware versions of the 9600 series SAS HBA byte-swap the REPORT ZONES command reply buffer from ATA-ZAC devices by directly accessing the buffer in the host memory. This does not respect the default command DMA direction and causes IOMMU page faults on architectures with an IOMMU enforcing write-only mappings for DMA_FROM_DEVICE DMA driection (e.g. AMD hosts). scsi 18:0:0:0: Direct-Access-ZBC ATA WDC WSH722020AL W870 PQ: 0 ANSI: 6 scsi 18:0:0:0: SATA: handle(0x0027), sas_addr(0x300062b2083e7c40), phy(0), device_name(0x5000cca29dc35e11) scsi 18:0:0:0: enclosure logical id (0x300062b208097c40), slot(0) scsi 18:0:0:0: enclosure level(0x0000), connector name( C0.0) scsi 18:0:0:0: atapi(n), ncq(y), asyn_notify(n), smart(y), fua(y), sw_preserve(y) scsi 18:0:0:0: qdepth(32), tagged(1), scsi_level(7), cmd_que(1) sd 18:0:0:0: Attached scsi generic sg2 type 20 sd 18:0:0:0: [sdc] Host-managed zoned block device mpt3sas 0000:41:00.0: AMD-Vi: Event logged [IO_PAGE_FAULT domain=0x0021 address=0xfff9b200 flags=0x0050] mpt3sas 0000:41:00.0: AMD-Vi: Event logged [IO_PAGE_FAULT domain=0x0021 address=0xfff9b300 flags=0x0050] mpt3sas_cm0: mpt3sas_ctl_pre_reset_handler: Releasing the trace buffer due to adapter reset. mpt3sas_cm0 fault info from func: mpt3sas_base_make_ioc_ready mpt3sas_cm0: fault_state(0x2666)! mpt3sas_cm0: sending diag reset !! mpt3sas_cm0: diag reset: SUCCESS sd 18:0:0:0: [sdc] REPORT ZONES start lba 0 failed sd 18:0:0:0: [sdc] REPORT ZONES: Result: hostbyte=DID_RESET driverbyte=DRIVER_OK sd 18:0:0:0: [sdc] 0 4096-byte logical blocks: (0 B/0 B) Avoid such issue by always mapping the buffer of REPORT ZONES commands using DMA_BIDIRECTIONAL (read+write IOMMU mapping). This is done by introducing the helper function _base_scsi_dma_map() and using this helper in _base_build_sg_scmd() and _base_build_sg_scmd_ieee() instead of calling directly scsi_dma_map(). Fixes: 471ef9d4e498 ("mpt3sas: Build MPI SGL LIST on GEN2 HBAs and IEEE SGL LIST on GEN3 HBAs") Cc: stable@vger.kernel.org Signed-off-by: Damien Le Moal Link: https://lore.kernel.org/r/20240719073913.179559-3-dlemoal@kernel.org Reviewed-by: Christoph Hellwig Reviewed-by: Johannes Thumshirn Signed-off-by: Martin K. Petersen drivers/scsi/mpt3sas/mpt3sas_base.c | 20 ++++++++++++++++++-- 1 file changed, 18 insertions(+), 2 deletions(-) commit 1abc900ddda8ad2ef739fedf498d415655b6c3b8 Author: Damien Le Moal Date: Fri Jul 19 16:39:11 2024 +0900 scsi: mpi3mr: Avoid IOMMU page faults on REPORT ZONES Some firmware versions of the 9600 series SAS HBA byte-swap the REPORT ZONES command reply buffer from ATA-ZAC devices by directly accessing the buffer in the host memory. This does not respect the default command DMA direction and causes IOMMU page faults on architectures with an IOMMU enforcing write-only mappings for DMA_FROM_DEVICE DMA direction (e.g. AMD hosts), leading to the device capacity to be dropped to 0: scsi 18:0:58:0: Direct-Access-ZBC ATA WDC WSH722626AL W930 PQ: 0 ANSI: 7 scsi 18:0:58:0: Power-on or device reset occurred sd 18:0:58:0: Attached scsi generic sg9 type 20 sd 18:0:58:0: [sdj] Host-managed zoned block device mpi3mr 0000:c1:00.0: AMD-Vi: Event logged [IO_PAGE_FAULT domain=0x0001 address=0xfec0c400 flags=0x0050] mpi3mr 0000:c1:00.0: AMD-Vi: Event logged [IO_PAGE_FAULT domain=0x0001 address=0xfec0c500 flags=0x0050] sd 18:0:58:0: [sdj] REPORT ZONES start lba 0 failed sd 18:0:58:0: [sdj] REPORT ZONES: Result: hostbyte=DID_SOFT_ERROR driverbyte=DRIVER_OK sd 18:0:58:0: [sdj] 0 4096-byte logical blocks: (0 B/0 B) sd 18:0:58:0: [sdj] Write Protect is off sd 18:0:58:0: [sdj] Mode Sense: 6b 00 10 08 sd 18:0:58:0: [sdj] Write cache: enabled, read cache: enabled, supports DPO and FUA sd 18:0:58:0: [sdj] Attached SCSI disk Avoid this issue by always mapping the buffer of REPORT ZONES commands using DMA_BIDIRECTIONAL, that is, using a read-write IOMMU mapping. Suggested-by: Christoph Hellwig Fixes: 023ab2a9b4ed ("scsi: mpi3mr: Add support for queue command processing") Cc: stable@vger.kernel.org Signed-off-by: Damien Le Moal Link: https://lore.kernel.org/r/20240719073913.179559-2-dlemoal@kernel.org Reviewed-by: Christoph Hellwig Reviewed-by: Johannes Thumshirn Signed-off-by: Martin K. Petersen drivers/scsi/mpi3mr/mpi3mr_os.c | 11 +++++++++++ 1 file changed, 11 insertions(+) commit ac6efb12ca64156f4a94e964acdb96ee7d59630d Author: Manivannan Sadhasivam Date: Thu Jul 18 22:36:59 2024 +0530 scsi: ufs: core: Do not set link to OFF state while waking up from hibernation UFS link is just put into hibern8 state during the 'freeze' process of the hibernation. Afterwards, the system may get powered down. But that doesn't matter during wakeup. Because during wakeup from hibernation, UFS link is again put into hibern8 state by the restore kernel and then the control is handed over to the to image kernel. So in both the places, UFS link is never turned OFF. But ufshcd_system_restore() just assumes that the link will be in OFF state and sets the link state accordingly. And this breaks hibernation wakeup: [ 2445.371335] phy phy-1d87000.phy.3: phy_power_on was called before phy_init [ 2445.427883] ufshcd-qcom 1d84000.ufshc: Controller enable failed [ 2445.427890] ufshcd-qcom 1d84000.ufshc: ufshcd_host_reset_and_restore: Host init failed -5 [ 2445.427906] ufs_device_wlun 0:0:0:49488: ufshcd_wl_resume failed: -5 [ 2445.427918] ufs_device_wlun 0:0:0:49488: PM: dpm_run_callback(): scsi_bus_restore returns -5 [ 2445.427973] ufs_device_wlun 0:0:0:49488: PM: failed to restore async: error -5 So fix the issue by removing the code that sets the link to OFF state. Cc: Anjana Hari Cc: stable@vger.kernel.org # 6.3 Fixes: 88441a8d355d ("scsi: ufs: core: Add hibernation callbacks") Signed-off-by: Manivannan Sadhasivam Link: https://lore.kernel.org/r/20240718170659.201647-1-manivannan.sadhasivam@linaro.org Reviewed-by: Bart Van Assche Signed-off-by: Martin K. Petersen drivers/ufs/core/ufshcd.c | 3 --- 1 file changed, 3 deletions(-) commit da3e19ef0b3de0aa4b25595bdc214c02a04f19b8 Author: Johan Hovold Date: Tue Jul 16 18:11:01 2024 +0200 scsi: Revert "scsi: sd: Do not repeat the starting disk message" This reverts commit 7a6bbc2829d4ab592c7e440a6f6f5deb3cd95db4. The offending commit tried to suppress a double "Starting disk" message for some drivers, but instead started spamming the log with bogus messages every five seconds: [ 311.798956] sd 0:0:0:0: [sda] Starting disk [ 316.919103] sd 0:0:0:0: [sda] Starting disk [ 322.040775] sd 0:0:0:0: [sda] Starting disk [ 327.161140] sd 0:0:0:0: [sda] Starting disk [ 332.281352] sd 0:0:0:0: [sda] Starting disk [ 337.401878] sd 0:0:0:0: [sda] Starting disk [ 342.521527] sd 0:0:0:0: [sda] Starting disk [ 345.850401] sd 0:0:0:0: [sda] Starting disk [ 350.967132] sd 0:0:0:0: [sda] Starting disk [ 356.090454] sd 0:0:0:0: [sda] Starting disk ... on machines that do not actually stop the disk on runtime suspend (e.g. the Qualcomm sc8280xp CRD with UFS). Let's just revert for now to address the regression. Fixes: 7a6bbc2829d4 ("scsi: sd: Do not repeat the starting disk message") Cc: stable@vger.kernel.org Signed-off-by: Johan Hovold Link: https://lore.kernel.org/r/20240716161101.30692-1-johan+linaro@kernel.org Reviewed-by: Bart Van Assche Reviewed-by: Damien Le Moal Signed-off-by: Martin K. Petersen drivers/scsi/sd.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) commit b9a603da42c816af9eeb8f5084ba815353e9b22b Merge: 82b461680651 d4c8d79f5199 Author: Palmer Dabbelt Date: Mon Jul 22 15:37:01 2024 -0700 Merge patch series "riscv: Separate vendor extensions from standard extensions" Charlie Jenkins says: All extensions, both standard and vendor, live in one struct "riscv_isa_ext". There is currently one vendor extension, xandespmu, but it is likely that more vendor extensions will be added to the kernel in the future. As more vendor extensions (and standard extensions) are added, riscv_isa_ext will become more bloated with a mix of vendor and standard extensions. This also allows each vendor to be conditionally enabled through Kconfig. * b4-shazam-merge: riscv: cpufeature: Extract common elements from extension checking riscv: Introduce vendor variants of extension helpers riscv: Add vendor extensions to /proc/cpuinfo riscv: Extend cpufeature.c to detect vendor extensions Link: https://lore.kernel.org/r/20240719-support_vendor_extensions-v3-0-0af7587bbec0@rivosinc.com Signed-off-by: Palmer Dabbelt commit d4c8d79f5199055da38f880f782a3e62c599ff5d Author: Charlie Jenkins Date: Fri Jul 19 09:15:21 2024 -0700 riscv: cpufeature: Extract common elements from extension checking The __riscv_has_extension_likely() and __riscv_has_extension_unlikely() functions from the vendor_extensions.h can be used to simplify the standard extension checking code as well. Migrate those functions to cpufeature.h and reorganize the code in the file to use the functions. Signed-off-by: Charlie Jenkins Reviewed-by: Conor Dooley Reviewed-by: Andy Chiu Link: https://lore.kernel.org/r/20240719-support_vendor_extensions-v3-4-0af7587bbec0@rivosinc.com Signed-off-by: Palmer Dabbelt arch/riscv/include/asm/cpufeature.h | 78 +++++++++++++++++------------- arch/riscv/include/asm/vendor_extensions.h | 28 ----------- 2 files changed, 44 insertions(+), 62 deletions(-) commit 0f2425411101128a38ad0166268975ca11fbcaeb Author: Charlie Jenkins Date: Fri Jul 19 09:15:20 2024 -0700 riscv: Introduce vendor variants of extension helpers Vendor extensions are maintained in per-vendor structs (separate from standard extensions which live in riscv_isa). Create vendor variants for the existing extension helpers to interface with the riscv_isa_vendor bitmaps. Signed-off-by: Charlie Jenkins Reviewed-by: Conor Dooley Reviewed-by: Andy Chiu Link: https://lore.kernel.org/r/20240719-support_vendor_extensions-v3-3-0af7587bbec0@rivosinc.com Signed-off-by: Palmer Dabbelt arch/riscv/include/asm/vendor_extensions.h | 83 ++++++++++++++++++++++++++++++ drivers/perf/riscv_pmu_sbi.c | 3 +- 2 files changed, 85 insertions(+), 1 deletion(-) commit 9448d9accdd8f1483df6fe6692e3c50cfe507d7a Author: Charlie Jenkins Date: Fri Jul 19 09:15:19 2024 -0700 riscv: Add vendor extensions to /proc/cpuinfo All of the supported vendor extensions that have been listed in riscv_isa_vendor_ext_list can be exported through /proc/cpuinfo. Signed-off-by: Charlie Jenkins Reviewed-by: Evan Green Reviewed-by: Conor Dooley Link: https://lore.kernel.org/r/20240719-support_vendor_extensions-v3-2-0af7587bbec0@rivosinc.com Signed-off-by: Palmer Dabbelt arch/riscv/kernel/cpu.c | 35 ++++++++++++++++++++++++++++++++--- 1 file changed, 32 insertions(+), 3 deletions(-) commit 23c996fc2bc1978a02c64eddb90b4ab5d309c8df Author: Charlie Jenkins Date: Fri Jul 19 09:15:18 2024 -0700 riscv: Extend cpufeature.c to detect vendor extensions Instead of grouping all vendor extensions into the same riscv_isa_ext that standard instructions use, create a struct "riscv_isa_vendor_ext_data_list" that allows each vendor to maintain their vendor extensions independently of the standard extensions. xandespmu is currently the only vendor extension so that is the only extension that is affected by this change. An additional benefit of this is that the extensions of each vendor can be conditionally enabled. A config RISCV_ISA_VENDOR_EXT_ANDES has been added to allow for that. Signed-off-by: Charlie Jenkins Reviewed-by: Conor Dooley Reviewed-by: Andy Chiu Tested-by: Yu Chien Peter Lin Reviewed-by: Yu Chien Peter Lin Link: https://lore.kernel.org/r/20240719-support_vendor_extensions-v3-1-0af7587bbec0@rivosinc.com Signed-off-by: Palmer Dabbelt arch/riscv/Kconfig | 2 + arch/riscv/Kconfig.vendor | 19 +++ arch/riscv/errata/andes/errata.c | 3 + arch/riscv/errata/sifive/errata.c | 3 + arch/riscv/errata/thead/errata.c | 3 + arch/riscv/include/asm/cpufeature.h | 25 ++++ arch/riscv/include/asm/hwcap.h | 25 ++-- arch/riscv/include/asm/vendor_extensions.h | 49 ++++++++ arch/riscv/include/asm/vendor_extensions/andes.h | 19 +++ arch/riscv/kernel/Makefile | 2 + arch/riscv/kernel/cpufeature.c | 143 ++++++++++++++++------- arch/riscv/kernel/vendor_extensions.c | 56 +++++++++ arch/riscv/kernel/vendor_extensions/Makefile | 3 + arch/riscv/kernel/vendor_extensions/andes.c | 18 +++ drivers/perf/riscv_pmu_sbi.c | 10 +- 15 files changed, 324 insertions(+), 56 deletions(-) commit 0e91ac701c69c44840e8d36566604cac1b638880 Author: Palmer Dabbelt Date: Fri Jul 19 08:10:27 2024 -0700 clk: T-Head: Disable on 32-bit Targets This fails to build on 32-bit targets because of a missing __udivdi3. IIRC the right way to fix that is to avoid the division, but I just want a tree that builds and the only real T-Head platforms are 64-bit right now. Signed-off-by: Palmer Dabbelt Link: https://lore.kernel.org/r/20240719151027.16152-1-palmer@rivosinc.com Acked-by: Drew Fustini Signed-off-by: Stephen Boyd drivers/clk/thead/Kconfig | 1 + 1 file changed, 1 insertion(+) commit 66ebbdfdeb093e097399b1883390079cd4c3022b Merge: ac7473a179d6 c9b4f313f6b8 Author: Linus Torvalds Date: Mon Jul 22 14:02:19 2024 -0700 Merge tag 'irq-msi-2024-07-22' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull MSI interrupt updates from Thomas Gleixner: "Switch ARM/ARM64 over to the modern per device MSI domains. This simplifies the handling of platform MSI and wire to MSI controllers and removes about 500 lines of legacy code. Aside of that it paves the way for ARM/ARM64 to utilize the dynamic allocation of PCI/MSI interrupts and to support the upcoming non standard IMS (Interrupt Message Store) mechanism on PCIe devices" * tag 'irq-msi-2024-07-22' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: (25 commits) irqchip/gic-v3-its: Correctly fish out the DID for platform MSI irqchip/gic-v3-its: Correctly honor the RID remapping genirq/msi: Move msi_device_data to core genirq/msi: Remove platform MSI leftovers irqchip/irq-mvebu-icu: Remove platform MSI leftovers irqchip/irq-mvebu-sei: Switch to MSI parent irqchip/mvebu-odmi: Switch to parent MSI irqchip/mvebu-gicp: Switch to MSI parent irqchip/irq-mvebu-icu: Prepare for real per device MSI irqchip/imx-mu-msi: Switch to MSI parent irqchip/gic-v2m: Switch to device MSI irqchip/gic_v3_mbi: Switch over to parent domain genirq/msi: Remove platform_msi_create_device_domain() irqchip/mbigen: Remove platform_msi_create_device_domain() fallback irqchip/gic-v3-its: Switch platform MSI to MSI parent irqchip/irq-msi-lib: Prepare for DOMAIN_BUS_WIRED_TO_MSI irqchip/mbigen: Prepare for real per device MSI irqchip/irq-msi-lib: Prepare for DEVICE MSI to replace platform MSI irqchip/gic-v3-its: Provide MSI parent for PCI/MSI[-X] irqchip/irq-msi-lib: Prepare for PCI MSI/MSIX ... commit a9bf3efc33f1fbf88787a277f7349459283c9b95 Author: Danilo Krummrich Date: Thu Jul 18 18:58:46 2024 +0200 drm/nouveau: prime: fix refcount underflow Calling nouveau_bo_ref() on a nouveau_bo without initializing it (and hence the backing ttm_bo) leads to a refcount underflow. Instead of calling nouveau_bo_ref() in the unwind path of drm_gem_object_init(), clean things up manually. Fixes: ab9ccb96a6e6 ("drm/nouveau: use prime helpers") Reviewed-by: Ben Skeggs Reviewed-by: Christian König Signed-off-by: Danilo Krummrich Link: https://patchwork.freedesktop.org/patch/msgid/20240718165959.3983-2-dakr@kernel.org (cherry picked from commit 1b93f3e89d03cfc576636e195466a0d728ad8de5) Signed-off-by: Danilo Krummrich drivers/gpu/drm/nouveau/nouveau_prime.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) commit ac7473a179d65f6c5de06a4b10d3b3d36df3f172 Merge: a362ade892e3 b7b377332b96 Author: Linus Torvalds Date: Mon Jul 22 13:52:05 2024 -0700 Merge tag 'irq-core-2024-07-15' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull interrupt subsystem updates from Thomas Gleixner: "Core: - Provide a new mechanism to create interrupt domains. The existing interfaces have already too many parameters and it's a pain to expand any of this for new required functionality. The new function takes a pointer to a data structure as argument. The data structure combines all existing parameters and allows for easy extension. The first extension for this is to handle the instantiation of generic interrupt chips at the core level and to allow drivers to provide extra init/exit callbacks. This is necessary to do the full interrupt chip initialization before the new domain is published, so that concurrent usage sites won't see a half initialized interrupt domain. Similar problems exist on teardown. This has turned out to be a real problem due to the deferred and parallel probing which was added in recent years. Handling this at the core level allows to remove quite some accrued boilerplate code in existing drivers and avoids horrible workarounds at the driver level. - The usual small improvements all over the place Drivers: - Add support for LAN966x OIC and RZ/Five SoC - Split the STM ExtI driver into a microcontroller and a SMP version to allow building the latter as a module for multi-platform kernels - Enable MSI support for Armada 370XP on platforms which do not support IPIs - The usual small fixes and enhancements all over the place" * tag 'irq-core-2024-07-15' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: (59 commits) irqdomain: Fix the kernel-doc and plug it into Documentation genirq: Set IRQF_COND_ONESHOT in request_irq() irqchip/imx-irqsteer: Handle runtime power management correctly irqchip/gic-v3: Pass #redistributor-regions to gic_of_setup_kvm_info() irqchip/bcm2835: Enable SKIP_SET_WAKE and MASK_ON_SUSPEND irqchip/gic-v4: Make sure a VPE is locked when VMAPP is issued irqchip/gic-v4: Substitute vmovp_lock for a per-VM lock irqchip/gic-v4: Always configure affinity on VPE activation Revert "irqchip/dw-apb-ictl: Support building as module" Revert "Loongarch: Support loongarch avec" arm64: Kconfig: Allow build irq-stm32mp-exti driver as module ARM: stm32: Allow build irq-stm32mp-exti driver as module irqchip/stm32mp-exti: Allow building as module irqchip/stm32mp-exti: Rename internal symbols irqchip/stm32-exti: Split MCU and MPU code arm64: Kconfig: Select STM32MP_EXTI on STM32 platforms ARM: stm32: Use different EXTI driver on ARMv7m and ARMv7a irqchip/stm32-exti: Add CONFIG_STM32MP_EXTI irqchip/dw-apb-ictl: Support building as module irqchip/riscv-aplic: Simplify the initialization code ... commit a362ade892e3e4de69296cddb1a23a1efe701428 Merge: 539fbb912321 998b17d4440b Author: Linus Torvalds Date: Mon Jul 22 13:44:22 2024 -0700 Merge tag 'loongarch-6.11' of git://git.kernel.org/pub/scm/linux/kernel/git/chenhuacai/linux-loongson Pull LoongArch updates from Huacai Chen: - Define __ARCH_WANT_NEW_STAT in unistd.h - Always enumerate MADT and setup logical-physical CPU mapping - Add irq_work support via self IPIs - Add RANDOMIZE_KSTACK_OFFSET support - Add ARCH_HAS_PTE_DEVMAP support - Add ARCH_HAS_DEBUG_VM_PGTABLE support - Add writecombine support for DMW-based ioremap() - Add architectural preparation for CPUFreq - Add ACPI standard hardware register based S3 support - Add support for relocating the kernel with RELR relocation - Some bug fixes and other small changes * tag 'loongarch-6.11' of git://git.kernel.org/pub/scm/linux/kernel/git/chenhuacai/linux-loongson: LoongArch: Make the users of larch_insn_gen_break() constant LoongArch: Check TIF_LOAD_WATCH to enable user space watchpoint LoongArch: Use rustc option -Zdirect-access-external-data LoongArch: Add support for relocating the kernel with RELR relocation LoongArch: Remove a redundant checking in relocator LoongArch: Use correct API to map cmdline in relocate_kernel() LoongArch: Automatically disable KASLR for hibernation LoongArch: Add ACPI standard hardware register based S3 support LoongArch: Add architectural preparation for CPUFreq LoongArch: Add writecombine support for DMW-based ioremap() LoongArch: Add ARCH_HAS_DEBUG_VM_PGTABLE support LoongArch: Add ARCH_HAS_PTE_DEVMAP support LoongArch: Add RANDOMIZE_KSTACK_OFFSET support LoongArch: Add irq_work support via self IPIs LoongArch: Always enumerate MADT and setup logical-physical CPU mapping LoongArch: Define __ARCH_WANT_NEW_STAT in unistd.h commit 539fbb912321ab6361ccc08b72f5f83e8a25c24b Merge: 9deed1d5f82c e528be3c87be Author: Linus Torvalds Date: Mon Jul 22 12:13:48 2024 -0700 Merge tag 'thermal-6.11-rc1-2' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm Pull thermal control fix from Rafael Wysocki: "Fix a flood of kernel messages coming from the thermal core on systems where iwlwifi is loaded, but the network interfaces controlled by it are down (Rafael Wysocki)" * tag 'thermal-6.11-rc1-2' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm: thermal: core: Allow thermal zones to tell the core to ignore them commit 9deed1d5f82cf30308027f9f604a95ac7ffdbe19 Merge: 7d080fa86709 bcc87d978b83 Author: Linus Torvalds Date: Mon Jul 22 11:45:48 2024 -0700 Merge tag 'io_uring-6.11-20240722' of git://git.kernel.dk/linux Pull io_uring fixes from Jens Axboe: "Two minor fixes in here, both heading to stable. In detail: - Fix error where forced async uring_cmd getsockopt returns the wrong value on execution, leading to it never being completed (Pavel) - Fix io_alloc_pbuf_ring() using a NULL check rather than IS_ERR (Pavel)" * tag 'io_uring-6.11-20240722' of git://git.kernel.dk/linux: io_uring: fix error pbuf checking io_uring: fix lost getsockopt completions commit 7d080fa867092c1db078dd72d70cb256642f7b18 Merge: 0256994887d7 89ed6c9ac69e Author: Linus Torvalds Date: Mon Jul 22 11:32:05 2024 -0700 Merge tag 'for-6.11/block-20240722' of git://git.kernel.dk/linux Pull more block updates from Jens Axboe: - MD fixes via Song: - md-cluster fixes (Heming Zhao) - raid1 fix (Mateusz Jończyk) - s390/dasd module description (Jeff) - Series cleaning up and hardening the blk-mq debugfs flag handling (John, Christoph) - blk-cgroup cleanup (Xiu) - Error polled IO attempts if backend doesn't support it (hexue) - Fix for an sbitmap hang (Yang) * tag 'for-6.11/block-20240722' of git://git.kernel.dk/linux: (23 commits) blk-cgroup: move congestion_count to struct blkcg sbitmap: fix io hung due to race on sbitmap_word::cleared block: avoid polling configuration errors block: Catch possible entries missing from rqf_name[] block: Simplify definition of RQF_NAME() block: Use enum to define RQF_x bit indexes block: Catch possible entries missing from cmd_flag_name[] block: Catch possible entries missing from alloc_policy_name[] block: Catch possible entries missing from hctx_flag_name[] block: Catch possible entries missing from hctx_state_name[] block: Catch possible entries missing from blk_queue_flag_name[] block: Make QUEUE_FLAG_x as an enum block: Relocate BLK_MQ_MAX_DEPTH block: Relocate BLK_MQ_CPU_WORK_BATCH block: remove QUEUE_FLAG_STOPPED block: Add missing entry to hctx_flag_name[] block: Add zone write plugging entry to rqf_name[] block: Add missing entries from cmd_flag_name[] s390/dasd: fix error checks in dasd_copy_pair_store() s390/dasd: add missing MODULE_DESCRIPTION() macros ... commit 0256994887d7c89c2a41d872aac67605bda8f115 Merge: dd018c238b84 74cc150282e4 Author: Linus Torvalds Date: Mon Jul 22 11:04:09 2024 -0700 Merge tag 'for-6.11/block-post-20240722' of git://git.kernel.dk/linux Pull block integrity mapping updates from Jens Axboe: "A set of cleanups and fixes for the block integrity support. Sent separately from the main block changes from last week, as they depended on later fixes in the 6.10-rc cycle" * tag 'for-6.11/block-post-20240722' of git://git.kernel.dk/linux: block: don't free the integrity payload in bio_integrity_unmap_free_user block: don't free submitter owned integrity payload on I/O completion block: call bio_integrity_unmap_free_user from blk_rq_unmap_user block: don't call bio_uninit from bio_endio block: also return bio_integrity_payload * from stubs block: split integrity support out of bio.h commit dd018c238b8489b6dd8c06f6b962ea75d79115ff Merge: 5ea6d72489a4 737759fc098f Author: Linus Torvalds Date: Mon Jul 22 10:59:08 2024 -0700 Merge tag 'bcachefs-2024-07-22' of https://evilpiepirate.org/git/bcachefs Pull bcachefs fixes from Kent Overstreet: - another fix for fsck getting stuck, from marcin - small syzbot fix - another undefined shift fix * tag 'bcachefs-2024-07-22' of https://evilpiepirate.org/git/bcachefs: bcachefs: Fix printbuf usage while atomic bcachefs: More informative error message in reattach_inode() bcachefs: kill btree_trans_too_many_iters() in bch2_bucket_alloc_freelist() bcachefs: mean_and_variance: Avoid too-large shift amounts commit 82b461680651ac452fa773f271000ddbc4e4db14 Author: Conor Dooley Date: Wed Jul 17 14:29:24 2024 +0100 RISC-V: run savedefconfig for defconfig It's been a while since this was run, and there's a few things that have changed. Firstly, almost all of the Renesas stuff vanishes because the config for the RZ/Five is gated behind NONPORTABLE. Several options (like CONFIG_PM) are removed as they are the default values. To retain DEFVFREQ_THERMAL and BLK_DEV_THROTTLING, add PM_DEVFREQ and BLK_CGROUP respectively. Signed-off-by: Conor Dooley Link: https://lore.kernel.org/r/20240717-shrubs-concise-51600886babf@spud Signed-off-by: Palmer Dabbelt arch/riscv/configs/defconfig | 26 ++++++++------------------ 1 file changed, 8 insertions(+), 18 deletions(-) commit 3d8d459c8ba282a67df3b518c5f80bcb217a5b38 Author: Conor Dooley Date: Wed Jul 17 09:54:38 2024 +0100 RISC-V: hwprobe: sort EXT_KEY()s in hwprobe_isa_ext0() alphabetically Currently the entries appear to be in a random order (although according to Palmer he has tried to sort them by key value) which makes it harder to find entries in a growing list, and more likely to have conflicts as all patches are adding to the end of the list. Sort them alphabetically instead. Signed-off-by: Conor Dooley Reviewed-by: Clément Léger Link: https://lore.kernel.org/r/20240717-dedicate-squeamish-7e4ab54df58f@spud Signed-off-by: Palmer Dabbelt arch/riscv/kernel/sys_hwprobe.c | 43 ++++++++++++++++++++--------------------- 1 file changed, 21 insertions(+), 22 deletions(-) commit 5ea6d72489a4a937fb9e9f9e81474cdf3483196e Merge: 933069701c1b 911daf695a74 Author: Linus Torvalds Date: Mon Jul 22 10:50:18 2024 -0700 Merge tag 'ntfs3_for_6.11' of https://github.com/Paragon-Software-Group/linux-ntfs3 Pull ntfs3 updates from Konstantin Komarov: "New code: - simple fileattr support Fixes: - transform resident to nonresident for compressed files - the format of the "nocase" mount option - getting file type - many other internal bugs Refactoring: - remove unused functions and macros - partial transition from page to folio (suggested by Matthew Wilcox) - legacy ntfs support" * tag 'ntfs3_for_6.11' of https://github.com/Paragon-Software-Group/linux-ntfs3: (42 commits) fs/ntfs3: Fix formatting, change comments, renaming fs/ntfs3: Update log->page_{mask,bits} if log->page_size changed fs/ntfs3: Implement simple fileattr fs/ntfs3: Redesign legacy ntfs support fs/ntfs3: Use function file_inode to get inode from file fs/ntfs3: Minor ntfs_list_ea refactoring fs/ntfs3: Check more cases when directory is corrupted fs/ntfs3: Do copy_to_user out of run_lock fs/ntfs3: Keep runs for $MFT::$ATTR_DATA and $MFT::$ATTR_BITMAP fs/ntfs3: Missed error return fs/ntfs3: Fix the format of the "nocase" mount option fs/ntfs3: Fix field-spanning write in INDEX_HDR ntfs3: Convert attr_wof_frame_info() to use a folio ntfs3: Convert ni_readpage_cmpr() to take a folio ntfs3: Convert ntfs_get_frame_pages() to use a folio ntfs3: Remove calls to set/clear the error flag ntfs3: Convert attr_make_nonresident to use a folio ntfs3: Convert attr_data_write_resident to use a folio ntfs3: Convert ntfs_write_end() to work on a folio ntfs3: Convert attr_data_read_resident() to take a folio ... commit 6a4aa4c94ba161bc0ffa73169ef5f33d0ae673d6 Merge: f557af081de6 5f76d4211ee4 Author: Palmer Dabbelt Date: Mon Jul 22 07:13:13 2024 -0700 Merge patch series "Add ACPI NUMA support for RISC-V" Haibo Xu says: This patch series enable RISC-V ACPI NUMA support which was based on the recently approved ACPI ECR[1]. Patch 1/4 add RISC-V specific acpi_numa.c file to parse NUMA information from SRAT and SLIT ACPI tables. Patch 2/4 add the common SRAT RINTC affinity structure handler. Patch 3/4 change the ACPI_NUMA to a hidden option since it would be selected by default on all supported platform. Patch 4/4 replace pr_info with pr_debug in arch_acpi_numa_init() to avoid potential boot noise on ACPI platforms that are not NUMA. Based-on: https://github.com/linux-riscv/linux-riscv/tree/for-next [1] https://drive.google.com/file/d/1YTdDx2IPm5IeZjAW932EYU-tUtgS08tX/view?usp=sharing Testing: Since the ACPI AIA/PLIC support patch set is still under upstream review, hence it is tested using the poll based HVC SBI console and RAM disk. 1) Build latest Qemu with the following patch backported https://github.com/vlsunil/qemu/commit/42bd4eeefd5d4410a68f02d54fee406d8a1269b0 2) Build latest EDK-II https://github.com/tianocore/edk2/blob/master/OvmfPkg/RiscVVirt/README.md 3) Build Linux with the following configs enabled CONFIG_RISCV_SBI_V01=y CONFIG_SERIAL_EARLYCON_RISCV_SBI=y CONFIG_NONPORTABLE=y CONFIG_HVC_RISCV_SBI=y CONFIG_NUMA=y CONFIG_ACPI_NUMA=y 4) Build buildroot rootfs.cpio 5) Launch the Qemu machine qemu-system-riscv64 -nographic \ -machine virt,pflash0=pflash0,pflash1=pflash1 -smp 4 -m 8G \ -blockdev node-name=pflash0,driver=file,read-only=on,filename=RISCV_VIRT_CODE.fd \ -blockdev node-name=pflash1,driver=file,filename=RISCV_VIRT_VARS.fd \ -object memory-backend-ram,size=4G,id=m0 \ -object memory-backend-ram,size=4G,id=m1 \ -numa node,memdev=m0,cpus=0-1,nodeid=0 \ -numa node,memdev=m1,cpus=2-3,nodeid=1 \ -numa dist,src=0,dst=1,val=30 \ -kernel linux/arch/riscv/boot/Image \ -initrd buildroot/output/images/rootfs.cpio \ -append "root=/dev/ram ro console=hvc0 earlycon=sbi" [ 0.000000] ACPI: SRAT: Node 0 PXM 0 [mem 0x80000000-0x17fffffff] [ 0.000000] ACPI: SRAT: Node 1 PXM 1 [mem 0x180000000-0x27fffffff] [ 0.000000] NUMA: NODE_DATA [mem 0x17fe3bc40-0x17fe3cfff] [ 0.000000] NUMA: NODE_DATA [mem 0x27fff4c40-0x27fff5fff] ... [ 0.000000] ACPI: NUMA: SRAT: PXM 0 -> HARTID 0x0 -> Node 0 [ 0.000000] ACPI: NUMA: SRAT: PXM 0 -> HARTID 0x1 -> Node 0 [ 0.000000] ACPI: NUMA: SRAT: PXM 1 -> HARTID 0x2 -> Node 1 [ 0.000000] ACPI: NUMA: SRAT: PXM 1 -> HARTID 0x3 -> Node 1 * b4-shazam-merge: ACPI: NUMA: replace pr_info with pr_debug in arch_acpi_numa_init ACPI: NUMA: change the ACPI_NUMA to a hidden option ACPI: NUMA: Add handler for SRAT RINTC affinity structure ACPI: RISCV: Add NUMA support based on SRAT and SLIT Link: https://lore.kernel.org/r/cover.1718268003.git.haibo1.xu@intel.com Signed-off-by: Palmer Dabbelt commit f004bf9de057004f7ccea4239317aec2fbd8240b Author: Anna-Maria Behnsen Date: Tue Jul 16 16:19:26 2024 +0200 timers/migration: Fix grammar in comment Signed-off-by: Anna-Maria Behnsen Signed-off-by: Thomas Gleixner Reviewed-by: Frederic Weisbecker Link: https://lore.kernel.org/r/20240716-tmigr-fixes-v4-8-757baa7803fe@linutronix.de kernel/time/timer_migration.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 2367e28e231af05243b92325de9a38956ad0b565 Author: Anna-Maria Behnsen Date: Tue Jul 16 16:19:25 2024 +0200 timers/migration: Spare write when nothing changed The wakeup value is written unconditionally in tmigr_cpu_new_timer(). When there was no new next timer expiry that needs to be propagated, then the value that was read before is written. This is not required. Move the write to the place where wakeup value is changed changed. Signed-off-by: Anna-Maria Behnsen Signed-off-by: Thomas Gleixner Reviewed-by: Frederic Weisbecker Link: https://lore.kernel.org/r/20240716-tmigr-fixes-v4-7-757baa7803fe@linutronix.de kernel/time/timer_migration.c | 11 +++++------ 1 file changed, 5 insertions(+), 6 deletions(-) commit 835a9a67f54f01033417a254e53a1391f99db708 Author: Anna-Maria Behnsen Date: Tue Jul 16 16:19:24 2024 +0200 timers/migration: Rename childmask by groupmask to make naming more obvious childmask in the group reflects the mask that is required to 'reference' this group in the parent. When reading childmask, this might be confusing, as this suggests, that this is the mask of the child of the group. Clarify this by renaming childmask in the tmigr_group and tmc_group by groupmask. Signed-off-by: Anna-Maria Behnsen Signed-off-by: Thomas Gleixner Reviewed-by: Frederic Weisbecker Link: https://lore.kernel.org/r/20240716-tmigr-fixes-v4-6-757baa7803fe@linutronix.de include/trace/events/timer_migration.h | 16 ++++++++-------- kernel/time/timer_migration.c | 24 ++++++++++++------------ kernel/time/timer_migration.h | 15 +++++++-------- 3 files changed, 27 insertions(+), 28 deletions(-) commit d47be589844224a3ef13b55ff6f15211ab20f1d1 Author: Anna-Maria Behnsen Date: Tue Jul 16 16:19:23 2024 +0200 timers/migration: Read childmask and parent pointer in a single place Reading the childmask and parent pointer is required when propagating changes through the hierarchy. At the moment this reads are spread all over the place which makes it harder to follow. Move those reads to a single place to keep code clean. Signed-off-by: Anna-Maria Behnsen Signed-off-by: Thomas Gleixner Reviewed-by: Frederic Weisbecker Link: https://lore.kernel.org/r/20240716-tmigr-fixes-v4-5-757baa7803fe@linutronix.de kernel/time/timer_migration.c | 20 +++++--------------- 1 file changed, 5 insertions(+), 15 deletions(-) commit 3ba111032bc1d8a0f04e6d2a5d8fb4ddc96eeae7 Author: Anna-Maria Behnsen Date: Tue Jul 16 16:19:22 2024 +0200 timers/migration: Use a single struct for hierarchy walk data Two different structs are defined for propagating data from one to another level when walking the hierarchy. Several struct members exist in both structs which makes generalization harder. Merge those two structs into a single one and use it directly in walk_groups() and the corresponding function pointers instead of introducing pointer casting all over the place. Signed-off-by: Anna-Maria Behnsen Signed-off-by: Thomas Gleixner Reviewed-by: Frederic Weisbecker Link: https://lore.kernel.org/r/20240716-tmigr-fixes-v4-4-757baa7803fe@linutronix.de kernel/time/timer_migration.c | 126 ++++++++++++++++++------------------------ 1 file changed, 55 insertions(+), 71 deletions(-) commit 92506741521fd09dfaa9d6ef3c3620a9dd6bbafd Author: Anna-Maria Behnsen Date: Tue Jul 16 16:19:21 2024 +0200 timers/migration: Improve tracing Trace points of inactive and active propagation are located at the end of the related functions. The interesting information of those trace points is the updated group state. When trace points are not located directly at the place where group state changed, order of trace points in traces could be confusing. Move inactive and active propagation trace points directly after update of group state values. Signed-off-by: Anna-Maria Behnsen Signed-off-by: Thomas Gleixner Reviewed-by: Frederic Weisbecker Link: https://lore.kernel.org/r/20240716-tmigr-fixes-v4-3-757baa7803fe@linutronix.de kernel/time/timer_migration.c | 11 +++++------ 1 file changed, 5 insertions(+), 6 deletions(-) commit 10a0e6f3d3db7dcfe36e578923e5f038f1d2b72a Author: Anna-Maria Behnsen Date: Wed Jul 17 11:49:40 2024 +0200 timers/migration: Move hierarchy setup into cpuhotplug prepare callback When a CPU comes online the first time, it is possible that a new top level group will be created. In general all propagation is done from the bottom to top. This minimizes complexity and prevents possible races. But when a new top level group is created, the formely top level group needs to be connected to the new level. This is the only time, when the direction to propagate changes is changed: the changes are propagated from top (new top level group) to bottom (formerly top level group). This introduces two races (see (A) and (B)) as reported by Frederic: (A) This race happens, when marking the formely top level group as active, but the last active CPU of the formerly top level group goes idle. Then it's likely that formerly group is no longer active, but marked nevertheless as active in new top level group: [GRP0:0] migrator = 0 active = 0 nextevt = KTIME_MAX / \ 0 1 .. 7 active idle 0) Hierarchy has for now only 8 CPUs and CPU 0 is the only active CPU. [GRP1:0] migrator = TMIGR_NONE active = NONE nextevt = KTIME_MAX \ [GRP0:0] [GRP0:1] migrator = 0 migrator = TMIGR_NONE active = 0 active = NONE nextevt = KTIME_MAX nextevt = KTIME_MAX / \ 0 1 .. 7 8 active idle !online 1) CPU 8 is booting and creates a new group in first level GRP0:1 and therefore also a new top group GRP1:0. For now the setup code proceeded only until the connected between GRP0:1 to the new top group. The connection between CPU8 and GRP0:1 is not yet established and CPU 8 is still !online. [GRP1:0] migrator = TMIGR_NONE active = NONE nextevt = KTIME_MAX / \ [GRP0:0] [GRP0:1] migrator = 0 migrator = TMIGR_NONE active = 0 active = NONE nextevt = KTIME_MAX nextevt = KTIME_MAX / \ 0 1 .. 7 8 active idle !online 2) Setup code now connects GRP0:0 to GRP1:0 and observes while in tmigr_connect_child_parent() that GRP0:0 is not TMIGR_NONE. So it prepares to call tmigr_active_up() on it. It hasn't done it yet. [GRP1:0] migrator = TMIGR_NONE active = NONE nextevt = KTIME_MAX / \ [GRP0:0] [GRP0:1] migrator = TMIGR_NONE migrator = TMIGR_NONE active = NONE active = NONE nextevt = KTIME_MAX nextevt = KTIME_MAX / \ 0 1 .. 7 8 idle idle !online 3) CPU 0 goes idle. Since GRP0:0->parent has been updated by CPU 8 with GRP0:0->lock held, CPU 0 observes GRP1:0 after calling tmigr_update_events() and it propagates the change to the top (no change there and no wakeup programmed since there is no timer). [GRP1:0] migrator = GRP0:0 active = GRP0:0 nextevt = KTIME_MAX / \ [GRP0:0] [GRP0:1] migrator = TMIGR_NONE migrator = TMIGR_NONE active = NONE active = NONE nextevt = KTIME_MAX nextevt = KTIME_MAX / \ 0 1 .. 7 8 idle idle !online 4) Now the setup code finally calls tmigr_active_up() to and sets GRP0:0 active in GRP1:0 [GRP1:0] migrator = GRP0:0 active = GRP0:0, GRP0:1 nextevt = KTIME_MAX / \ [GRP0:0] [GRP0:1] migrator = TMIGR_NONE migrator = 8 active = NONE active = 8 nextevt = KTIME_MAX nextevt = KTIME_MAX / \ | 0 1 .. 7 8 idle idle active 5) Now CPU 8 is connected with GRP0:1 and CPU 8 calls tmigr_active_up() out of tmigr_cpu_online(). [GRP1:0] migrator = GRP0:0 active = GRP0:0 nextevt = T8 / \ [GRP0:0] [GRP0:1] migrator = TMIGR_NONE migrator = TMIGR_NONE active = NONE active = NONE nextevt = KTIME_MAX nextevt = T8 / \ | 0 1 .. 7 8 idle idle idle 5) CPU 8 goes idle with a timer T8 and relies on GRP0:0 as the migrator. But it's not really active, so T8 gets ignored. --> The update which is done in third step is not noticed by setup code. So a wrong migrator is set to top level group and a timer could get ignored. (B) Reading group->parent and group->childmask when an hierarchy update is ongoing and reaches the formerly top level group is racy as those values could be inconsistent. (The notation of migrator and active now slightly changes in contrast to the above example, as now the childmasks are used.) [GRP1:0] migrator = TMIGR_NONE active = 0x00 nextevt = KTIME_MAX \ [GRP0:0] [GRP0:1] migrator = TMIGR_NONE migrator = TMIGR_NONE active = 0x00 active = 0x00 nextevt = KTIME_MAX nextevt = KTIME_MAX childmask= 0 childmask= 1 parent = NULL parent = GRP1:0 / \ 0 1 .. 7 8 idle idle !online childmask=1 1) Hierarchy has 8 CPUs. CPU 8 is at the moment in the process of onlining but did not yet connect GRP0:0 to GRP1:0. [GRP1:0] migrator = TMIGR_NONE active = 0x00 nextevt = KTIME_MAX / \ [GRP0:0] [GRP0:1] migrator = TMIGR_NONE migrator = TMIGR_NONE active = 0x00 active = 0x00 nextevt = KTIME_MAX nextevt = KTIME_MAX childmask= 0 childmask= 1 parent = GRP1:0 parent = GRP1:0 / \ 0 1 .. 7 8 idle idle !online childmask=1 2) Setup code (running on CPU 8) now connects GRP0:0 to GRP1:0, updates parent pointer of GRP0:0 and ... [GRP1:0] migrator = TMIGR_NONE active = 0x00 nextevt = KTIME_MAX / \ [GRP0:0] [GRP0:1] migrator = 0x01 migrator = TMIGR_NONE active = 0x01 active = 0x00 nextevt = KTIME_MAX nextevt = KTIME_MAX childmask= 0 childmask= 1 parent = GRP1:0 parent = GRP1:0 / \ 0 1 .. 7 8 active idle !online childmask=1 tmigr_walk.childmask = 0 3) ... CPU 0 comes active in the same time. As migrator in GRP0:0 was TMIGR_NONE, childmask of GRP0:0 is stored in update propagation data structure tmigr_walk (as update of childmask is not yet visible/updated). And now ... [GRP1:0] migrator = TMIGR_NONE active = 0x00 nextevt = KTIME_MAX / \ [GRP0:0] [GRP0:1] migrator = 0x01 migrator = TMIGR_NONE active = 0x01 active = 0x00 nextevt = KTIME_MAX nextevt = KTIME_MAX childmask= 2 childmask= 1 parent = GRP1:0 parent = GRP1:0 / \ 0 1 .. 7 8 active idle !online childmask=1 tmigr_walk.childmask = 0 4) ... childmask of GRP0:0 is updated by CPU 8 (still part of setup code). [GRP1:0] migrator = 0x00 active = 0x00 nextevt = KTIME_MAX / \ [GRP0:0] [GRP0:1] migrator = 0x01 migrator = TMIGR_NONE active = 0x01 active = 0x00 nextevt = KTIME_MAX nextevt = KTIME_MAX childmask= 2 childmask= 1 parent = GRP1:0 parent = GRP1:0 / \ 0 1 .. 7 8 active idle !online childmask=1 tmigr_walk.childmask = 0 5) CPU 0 sees the connection to GRP1:0 and now propagates active state to GRP1:0 but with childmask = 0 as stored in propagation data structure. --> Now GRP1:0 always has a migrator as 0x00 != TMIGR_NONE and for all CPUs it looks like GRP1:0 is always active. To prevent those races, the setup of the hierarchy is moved into the cpuhotplug prepare callback. The prepare callback is not executed by the CPU which will come online, it is executed by the CPU which prepares onlining of the other CPU. This CPU is active while it is connecting the formerly top level to the new one. This prevents from (A) to happen and it also prevents from any further walk above the formerly top level until that active CPU becomes inactive, releasing the new ->parent and ->childmask updates to be visible by any subsequent walk up above the formerly top level hierarchy. This prevents from (B) to happen. The direction for the updates is now forced to look like "from bottom to top". However if the active CPU prevents from tmigr_cpu_(in)active() to walk up with the update not-or-half visible, nothing prevents walking up to the new top with a 0 childmask in tmigr_handle_remote_up() or tmigr_requires_handle_remote_up() if the active CPU doing the prepare is not the migrator. But then it looks fine because: * tmigr_check_migrator() should just return false * The migrator is active and should eventually observe the new childmask at some point in a future tick. Split setup functionality of online callback into the cpuhotplug prepare callback and setup hotplug state. Change init call into early_initcall() to make sure an already active CPU prepares everything for newly upcoming CPUs. Reorder the code, that all prepare related functions are close to each other and online and offline callbacks are also close together. Fixes: 7ee988770326 ("timers: Implement the hierarchical pull model") Signed-off-by: Anna-Maria Behnsen Signed-off-by: Thomas Gleixner Reviewed-by: Frederic Weisbecker Link: https://lore.kernel.org/r/20240717094940.18687-1-anna-maria@linutronix.de include/linux/cpuhotplug.h | 1 + kernel/time/timer_migration.c | 206 ++++++++++++++++++++++++------------------ 2 files changed, 120 insertions(+), 87 deletions(-) commit facd40aa5c4699f94014012e4e58414c082f2c01 Author: Anna-Maria Behnsen Date: Tue Jul 16 16:19:19 2024 +0200 timers/migration: Do not rely always on group->parent When reading group->parent without holding the group lock it is racy against CPUs coming online the first time and thereby creating another level of the hierarchy. This is not a problem when this value is read once to decide whether to abort a propagation or not. The worst outcome is an unnecessary/early CPU wake up. But it is racy when reading it several times during a single 'action' (like activation, deactivation, checking for remote timer expiry,...) and relying on the consitency of this value without holding the lock. This happens at the moment e.g. in tmigr_inactive_up() which is also calling tmigr_udpate_events(). Code relys on group->parent not to change during this 'action'. Update parent struct member description to explain the above only once. Remove parent pointer checks when they are not mandatory (like update of data->childmask). Remove a warning, which would be nice but the trigger of this warning is not reliable and add expand the data structure member description instead. Expand a comment, why it is safe to rely on parent pointer here (inside hierarchy update). Fixes: 7ee988770326 ("timers: Implement the hierarchical pull model") Reported-by: Borislav Petkov Signed-off-by: Anna-Maria Behnsen Signed-off-by: Thomas Gleixner Reviewed-by: Frederic Weisbecker Link: https://lore.kernel.org/r/20240716-tmigr-fixes-v4-1-757baa7803fe@linutronix.de kernel/time/timer_migration.c | 33 +++++++++++++++------------------ kernel/time/timer_migration.h | 12 +++++++++++- 2 files changed, 26 insertions(+), 19 deletions(-) commit b6f7d984ebf826069d3dc6fa187b4d1cfb90f965 Author: Stephan Gerhold Date: Mon Jul 15 14:15:37 2024 +0200 dt-bindings: display: panel: samsung,atna33xc20: Document ATNA45AF01 The Samsung ATNA45AF01 panel is an AMOLED eDP panel that has backlight control over the DP AUX channel. While it works almost correctly with the generic "edp-panel" compatible, the backlight needs special handling to work correctly. It is similar to the existing ATNA33XC20 panel, just with a larger resolution and size. Add a new "samsung,atna45af01" compatible to describe this panel in the DT. Use the existing "samsung,atna33xc20" as fallback compatible since existing drivers should work as-is, given that resolution and size are discoverable through the eDP link. Signed-off-by: Stephan Gerhold Acked-by: Conor Dooley Reviewed-by: Neil Armstrong Reviewed-by: Douglas Anderson Signed-off-by: Douglas Anderson Link: https://patchwork.freedesktop.org/patch/msgid/20240715-x1e80100-crd-backlight-v2-1-31b7f2f658a3@linaro.org .../devicetree/bindings/display/panel/samsung,atna33xc20.yaml | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-) commit 737759fc098f7bb7fb4cef64fec731803e955e01 Author: Kent Overstreet Date: Mon Jul 22 11:25:03 2024 -0400 bcachefs: Fix printbuf usage while atomic Reported-by: syzbot+f765e51170cf13493f0b@syzkaller.appspotmail.com Fixes: f12410bb7ddd ("bcachefs: Add an error message for insufficient rw journal devs") Signed-off-by: Kent Overstreet fs/bcachefs/journal_reclaim.c | 1 + 1 file changed, 1 insertion(+) commit 7a086baad0d640a45dbc65d6853a58ca6368892b Author: Kent Overstreet Date: Sat Jul 20 14:37:24 2024 -0400 bcachefs: More informative error message in reattach_inode() Signed-off-by: Kent Overstreet fs/bcachefs/fsck.c | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) commit bacc15e010fc5a235fb2020b06a29a9961b5db82 Author: Arnd Bergmann Date: Fri Jul 19 11:51:07 2024 +0200 hid: bpf: add BPF_JIT dependency The module does not do anything when the JIT is disabled, but instead causes a warning: In file included from include/linux/bpf_verifier.h:7, from drivers/hid/bpf/hid_bpf_struct_ops.c:10: drivers/hid/bpf/hid_bpf_struct_ops.c: In function 'hid_bpf_struct_ops_init': include/linux/bpf.h:1853:50: error: statement with no effect [-Werror=unused-value] 1853 | #define register_bpf_struct_ops(st_ops, type) ({ (void *)(st_ops); 0; }) | ^~~~~~~~~~~~~~~~ drivers/hid/bpf/hid_bpf_struct_ops.c:305:16: note: in expansion of macro 'register_bpf_struct_ops' 305 | return register_bpf_struct_ops(&bpf_hid_bpf_ops, hid_bpf_ops); | ^~~~~~~~~~~~~~~~~~~~~~~ Add a Kconfig dependency to only allow building the HID-BPF support when a JIT is enabled. Fixes: ebc0d8093e8c ("HID: bpf: implement HID-BPF through bpf_struct_ops") Signed-off-by: Arnd Bergmann Link: https://patch.msgid.link/96a00b6f-eb81-4c67-8c4b-6b1f3f045034@app.fastmail.com Signed-off-by: Benjamin Tissoires drivers/hid/bpf/Kconfig | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 13c9b702e6cb8e406d5fa6b2dca422fa42d2f13e Author: Liwei Song Date: Mon Jul 22 16:32:59 2024 +0800 tools/resolve_btfids: Fix comparison of distinct pointer types warning in resolve_btfids Add a type cast for set8->pairs to fix below compile warning: main.c: In function 'sets_patch': main.c:699:50: warning: comparison of distinct pointer types lacks a cast 699 | BUILD_BUG_ON(set8->pairs != &set8->pairs[0].id); | ^~ Fixes: 9707ac4fe2f5 ("tools/resolve_btfids: Refactor set sorting with types from btf_ids.h") Signed-off-by: Liwei Song Signed-off-by: Daniel Borkmann Acked-by: Jiri Olsa Link: https://lore.kernel.org/bpf/20240722083305.4009723-1-liwei.song.lsong@gmail.com tools/bpf/resolve_btfids/main.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit ac29d8ae05b770ed3f52d7a60908ab9b126f69d7 Author: Takashi Iwai Date: Mon Jul 22 16:06:06 2024 +0200 ALSA: ump: Force 1 Group for MIDI1 FBs When a Function Block declares it being a legacy MIDI1 device, it has to be only with a single UMP Group. Correct the attribute when a device declares it wrongly. Fixes: 37e0e14128e0 ("ALSA: ump: Support UMP Endpoint and Function Block parsing") Cc: Link: https://patch.msgid.link/20240722140610.10845-1-tiwai@suse.de Signed-off-by: Takashi Iwai sound/core/ump.c | 6 ++++++ 1 file changed, 6 insertions(+) commit 9a4ab167cfb1dea1df0c0c948205a62c7eb3b85b Author: Takashi Iwai Date: Mon Jul 22 15:59:28 2024 +0200 ALSA: ump: Don't update FB name for static blocks When a device tries to update the FB name string even if its Endpoint is declared as static, we should skip it, just already done for the FB info update reply. Fixes: 37e0e14128e0 ("ALSA: ump: Support UMP Endpoint and Function Block parsing") Cc: Link: https://patch.msgid.link/20240722135929.8612-1-tiwai@suse.de Signed-off-by: Takashi Iwai sound/core/ump.c | 7 +++++++ 1 file changed, 7 insertions(+) commit 5f76d4211ee44dcd9b2dc8a9065002bf8ecee81e Author: Haibo Xu Date: Thu Jun 13 16:54:36 2024 +0800 ACPI: NUMA: replace pr_info with pr_debug in arch_acpi_numa_init There are lots of ACPI enabled systems that aren't NUMA and If the firmware didn't provide the SRAT/SLIT, then there will be a message "Failed to initialise from firmware" from arch_acpi_numa_init() which adding noise to the boot on all of those kind of systems. Replace the pr_info with pr_debug in arch_acpi_numa_init() to avoid it. Suggested-by: Sunil V L Signed-off-by: Haibo Xu Reviewed-by: Sunil V L Reviewed-by: Hanjun Guo Link: https://lore.kernel.org/r/109354315a02cd22145d2effa4a8c571b69d3e56.1718268003.git.haibo1.xu@intel.com Signed-off-by: Palmer Dabbelt drivers/base/arch_numa.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit adc3e82d253786a5b63c821108709de23317a90d Author: Haibo Xu Date: Thu Jun 13 16:54:35 2024 +0800 ACPI: NUMA: change the ACPI_NUMA to a hidden option x86/arm64/loongarch would select ACPI_NUMA by default and riscv would do the same thing, so change it to a hidden option and the select statements except for the X86_64_ACPI_NUMA can also go away. Suggested-by: Arnd Bergmann Suggested-by: Sunil V L Signed-off-by: Haibo Xu Reviewed-by: Sunil V L Acked-by: Huacai Chen Acked-by: Will Deacon Reviewed-by: Hanjun Guo Link: https://lore.kernel.org/r/f1f96377b8ecd6e3183f28abf5c9ac21cb9855ea.1718268003.git.haibo1.xu@intel.com Signed-off-by: Palmer Dabbelt arch/arm64/Kconfig | 1 - arch/loongarch/Kconfig | 1 - drivers/acpi/numa/Kconfig | 5 +---- 3 files changed, 1 insertion(+), 6 deletions(-) commit 39494aec8a0454f9e8a68d2422d3bd4e5c5ee0c7 Author: Haibo Xu Date: Thu Jun 13 16:54:34 2024 +0800 ACPI: NUMA: Add handler for SRAT RINTC affinity structure Add RINTC affinity structure handler during parsing SRAT table. Signed-off-by: Haibo Xu Reviewed-by: Sunil V L Reviewed-by: Hanjun Guo Link: https://lore.kernel.org/r/e076514d78d92f104a5f2d8c82b8921f6aa26fdd.1718268003.git.haibo1.xu@intel.com Signed-off-by: Palmer Dabbelt drivers/acpi/numa/srat.c | 32 +++++++++++++++++++++++++++++++- 1 file changed, 31 insertions(+), 1 deletion(-) commit eabd9db64ea8ba64d2a0b1d70da38e1a95dcd08b Author: Haibo Xu Date: Thu Jun 13 16:54:33 2024 +0800 ACPI: RISCV: Add NUMA support based on SRAT and SLIT Add acpi_numa.c file to enable parse NUMA information from ACPI SRAT and SLIT tables. SRAT table provide CPUs(Hart) and memory nodes to proximity domain mapping, while SLIT table provide the distance metrics between proximity domains. Signed-off-by: Haibo Xu Reviewed-by: Sunil V L Reviewed-by: Hanjun Guo Link: https://lore.kernel.org/r/65dbad1fda08a32922c44886e4581e49b4a2fecc.1718268003.git.haibo1.xu@intel.com Signed-off-by: Palmer Dabbelt arch/riscv/include/asm/acpi.h | 15 ++++- arch/riscv/kernel/Makefile | 1 + arch/riscv/kernel/acpi.c | 5 -- arch/riscv/kernel/acpi_numa.c | 131 ++++++++++++++++++++++++++++++++++++++++++ arch/riscv/kernel/setup.c | 4 +- arch/riscv/kernel/smpboot.c | 2 - include/linux/acpi.h | 6 ++ 7 files changed, 154 insertions(+), 10 deletions(-) commit 91da337e5d506f2c065d20529d105ca40090e320 Author: Jeff Layton Date: Fri Jul 19 14:55:53 2024 -0400 nfsd: don't set SVC_SOCK_ANONYMOUS when creating nfsd sockets When creating nfsd sockets via the netlink interface, we do want to register with the portmapper. Don't set SVC_SOCK_ANONYMOUS. Reported-by: Steve Dickson Fixes: 16a471177496 ("NFSD: add listener-{set,get} netlink command") Cc: Lorenzo Bianconi Signed-off-by: Jeff Layton Signed-off-by: Chuck Lever fs/nfsd/nfsctl.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) commit 21451dfd853e7d8e6e3fbd7ef1fbdb2f2ead12f5 Author: wangdicheng Date: Mon Jul 22 16:48:22 2024 +0800 ALSA: usb-audio: Add a quirk for Sonix HD USB Camera Sonix HD USB Camera does not support reading the sample rate which leads to many lines of "cannot get freq at ep 0x84". This patch adds the USB ID to quirks.c and avoids those error messages. (snip) [1.789698] usb 3-3: new high-speed USB device number 2 using xhci_hcd [1.984121] usb 3-3: New USB device found, idVendor=0c45, idProduct=6340, bcdDevice= 0.00 [1.984124] usb 3-3: New USB device strings: Mfr=2, Product=1, SerialNumber=0 [1.984127] usb 3-3: Product: USB 2.0 Camera [1.984128] usb 3-3: Manufacturer: Sonix Technology Co., Ltd. [5.440957] usb 3-3: 3:1: cannot get freq at ep 0x84 [12.130679] usb 3-3: 3:1: cannot get freq at ep 0x84 [12.175065] usb 3-3: 3:1: cannot get freq at ep 0x84 Signed-off-by: wangdicheng Cc: Link: https://patch.msgid.link/20240722084822.31620-1-wangdich9700@163.com Signed-off-by: Takashi Iwai sound/usb/quirks.c | 2 ++ 1 file changed, 2 insertions(+) commit 66558537cb8c7485cf2d43b3880395c81218ec12 Author: Ricardo Ribalda Date: Mon Jul 22 11:52:26 2024 +0000 media: uvcvideo: Fix custom control mapping probing Custom control mapping introduced a bug, where the filter function was applied to every single control. Fix it so it is only applied to the matching controls. The following dmesg errors during probe are now fixed: usb 1-5: Found UVC 1.00 device Integrated_Webcam_HD (0c45:670c) usb 1-5: Failed to query (GET_CUR) UVC control 2 on unit 2: -75 (exp. 1). usb 1-5: Failed to query (GET_CUR) UVC control 3 on unit 2: -75 (exp. 1). usb 1-5: Failed to query (GET_CUR) UVC control 6 on unit 2: -75 (exp. 1). usb 1-5: Failed to query (GET_CUR) UVC control 7 on unit 2: -75 (exp. 1). usb 1-5: Failed to query (GET_CUR) UVC control 8 on unit 2: -75 (exp. 1). usb 1-5: Failed to query (GET_CUR) UVC control 9 on unit 2: -75 (exp. 1). usb 1-5: Failed to query (GET_CUR) UVC control 10 on unit 2: -75 (exp. 1). Reported-by: Paul Menzel Closes: https://lore.kernel.org/linux-media/518cd6b4-68a8-4895-b8fc-97d4dae1ddc4@molgen.mpg.de/T/#t Cc: stable@vger.kernel.org Fixes: 8f4362a8d42b ("media: uvcvideo: Allow custom control mapping") Signed-off-by: Ricardo Ribalda Link: https://lore.kernel.org/r/20240722-fix-filter-mapping-v2-1-7ed5bb6c1185@chromium.org Tested-by: Paul Menzel Reviewed-by: Laurent Pinchart Signed-off-by: Laurent Pinchart drivers/media/usb/uvc/uvc_ctrl.c | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-) commit 92c78222168e9035a9bfb8841c2e56ce23e51f73 Author: Dan Carpenter Date: Fri Jul 19 18:53:48 2024 -0500 ASoC: TAS2781: Fix tasdev_load_calibrated_data() This function has a reversed if statement so it's either a no-op or it leads to a NULL dereference. Fixes: b195acf5266d ("ASoC: tas2781: Fix wrong loading calibrated data sequence") Signed-off-by: Dan Carpenter Link: https://patch.msgid.link/18a29b68-cc85-4139-b7c7-2514e8409a42@stanley.mountain Signed-off-by: Mark Brown sound/soc/codecs/tas2781-fmwlib.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 83340b855d222f257354afd272dc8d315fecc3ee Author: Arnd Bergmann Date: Fri Jul 19 09:48:03 2024 +0200 ASoC: tegra: select CONFIG_SND_SIMPLE_CARD_UTILS This I2S client driver now uses functions exported from a helper module but fails to link when the helper is disabled: ERROR: modpost: "simple_util_parse_convert" [sound/soc/tegra/snd-soc-tegra210-i2s.ko] undefined! ERROR: modpost: "simple_util_get_sample_fmt" [sound/soc/tegra/snd-soc-tegra210-i2s.ko] undefined! Add a Kconfig select line to ensure it's always turned on here. Fixes: 2502f8dd8c30 ("ASoC: tegra: I2S client convert formats handling") Signed-off-by: Arnd Bergmann Reviewed-by: Sameer Pujar Link: https://patch.msgid.link/20240719074831.3253995-1-arnd@kernel.org Signed-off-by: Mark Brown sound/soc/tegra/Kconfig | 1 + 1 file changed, 1 insertion(+) commit 9931f7d5d251882a147cc5811060097df43e79f5 Author: Pierre-Louis Bossart Date: Mon Jul 22 10:30:02 2024 +0200 ASoC: Intel: use soc_intel_is_byt_cr() only when IOSF_MBI is reachable the Intel kbuild bot reports a link failure when IOSF_MBI is built-in but the Merrifield driver is configured as a module. The soc-intel-quirks.h is included for Merrifield platforms, but IOSF_MBI is not selected for that platform. ld.lld: error: undefined symbol: iosf_mbi_read >>> referenced by atom.c >>> sound/soc/sof/intel/atom.o:(atom_machine_select) in archive vmlinux.a This patch forces the use of the fallback static inline when IOSF_MBI is not reachable. Fixes: 536cfd2f375d ("ASoC: Intel: use common helpers to detect CPUs") Reported-by: kernel test robot Closes: https://lore.kernel.org/oe-kbuild-all/202407160704.zpdhJ8da-lkp@intel.com/ Suggested-by: Takashi Iwai Signed-off-by: Pierre-Louis Bossart Reviewed-by: Péter Ujfalusi Reviewed-by: Bard Liao Link: https://patch.msgid.link/20240722083002.10800-1-pierre-louis.bossart@linux.intel.com Signed-off-by: Mark Brown sound/soc/intel/common/soc-intel-quirks.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 542440fd7b30983cae23e32bd22f69a076ec7ef4 Author: Arnd Bergmann Date: Fri Jul 19 12:40:24 2024 +0200 regmap: maple: work around gcc-14.1 false-positive warning With gcc-14.1, there is a false-postive -Wuninitialized warning in regcache_maple_drop: drivers/base/regmap/regcache-maple.c: In function 'regcache_maple_drop': drivers/base/regmap/regcache-maple.c:113:23: error: 'lower_index' is used uninitialized [-Werror=uninitialized] 113 | unsigned long lower_index, lower_last; | ^~~~~~~~~~~ drivers/base/regmap/regcache-maple.c:113:36: error: 'lower_last' is used uninitialized [-Werror=uninitialized] 113 | unsigned long lower_index, lower_last; | ^~~~~~~~~~ I've created a reduced test case to see if this needs to be reported as a gcc, but it appears that the gcc-14.x branch already has a change that turns this into a more sensible -Wmaybe-uninitialized warning, so I ended up not reporting it so far. The reduced test case also produces a warning for gcc-13 and gcc-12 but I don't see that with the version in the kernel. Link: https://godbolt.org/z/oKbohKqd3 Link: https://lore.kernel.org/all/CAMuHMdWj=FLmkazPbYKPevDrcym2_HDb_U7Mb9YE9ovrP0jJfA@mail.gmail.com/ Signed-off-by: Arnd Bergmann Link: https://patch.msgid.link/20240719104030.1382465-1-arnd@kernel.org Signed-off-by: Mark Brown drivers/base/regmap/regcache-maple.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) commit 7010d9464f7ca3ee2d75095ea2e642a9009a41ff Author: Takashi Iwai Date: Mon Jul 22 10:06:04 2024 +0200 ALSA: usb-audio: Move HD Webcam quirk to the right place The quirk_flags_table[] is sorted in the USB ID order, while the last fix was put at a wrong position. Adjust the entry at the right position. Fixes: 74dba2408818 ("ALSA: usb-audio: Fix microphone sound on HD webcam.") Cc: Link: https://patch.msgid.link/20240722080605.23481-1-tiwai@suse.de Signed-off-by: Takashi Iwai sound/usb/quirks.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) commit 933069701c1b507825b514317d4edd5d3fd9d417 Merge: 527eff227d43 d484d621d40f Author: Linus Torvalds Date: Sun Jul 21 20:50:39 2024 -0700 Merge tag '6.11-rc-smb3-server-fixes' of git://git.samba.org/ksmbd Pull smb server fixes from Steve French: - two durable handle improvements - two small cleanup patches * tag '6.11-rc-smb3-server-fixes' of git://git.samba.org/ksmbd: ksmbd: add durable scavenger timer ksmbd: avoid reclaiming expired durable opens by the client ksmbd: Constify struct ksmbd_transport_ops ksmbd: remove duplicate SMB2 Oplock levels definitions commit 627a24f5f25d689682f395f3df1411273be4436b Merge: 412dbc662e65 e3615bd19828 Author: Dave Airlie Date: Mon Jul 22 13:03:42 2024 +1000 Merge tag 'amd-drm-fixes-6.11-2024-07-18' of https://gitlab.freedesktop.org/agd5f/linux into drm-next amd-drm-fixes-6.11-2024-07-18: amdgpu: - Bump driver version for GFX12 DCC - DC documention warning fixes - VCN unified queue power fix - SMU fix - RAS fix - Display corruption fix Signed-off-by: Dave Airlie From: Alex Deucher Link: https://patchwork.freedesktop.org/patch/msgid/20240718215258.79356-1-alexander.deucher@amd.com commit 412dbc662e651960b47285d8b647cd36b31a3e4d Merge: 78e6e468e111 1fe1c66274fb Author: Dave Airlie Date: Mon Jul 22 12:52:55 2024 +1000 Merge tag 'drm-misc-next-fixes-2024-07-19' of https://gitlab.freedesktop.org/drm/misc/kernel into drm-next Two fixes for v3d to fix an array indexing on newer V3D revisions. Signed-off-by: Dave Airlie From: Maxime Ripard Link: https://patchwork.freedesktop.org/patch/msgid/20240719-emerald-newt-of-skill-89b54a@houat commit 78e6e468e111ebf502adea7bb07c6708e497f83d Merge: 7d4ecf3707b5 90936a0a4c54 Author: Dave Airlie Date: Mon Jul 22 11:51:48 2024 +1000 Merge tag 'drm-xe-next-fixes-2024-07-18' of https://gitlab.freedesktop.org/drm/xe/kernel into drm-next - Xe_exec ioctl minor fix on sync entry cleanup upon error (Ashutosh) - SRIOV: limit VF LMEM provisioning (Michal) - Wedge mode fixes (Brost) Signed-off-by: Dave Airlie From: Rodrigo Vivi Link: https://patchwork.freedesktop.org/patch/msgid/Zpk6CI0FDoTJwkSb@intel.com commit 527eff227d4321c6ea453db1083bc4fdd4d3a3e8 Merge: fbc90c042cd1 67856f44da38 Author: Linus Torvalds Date: Sun Jul 21 17:56:22 2024 -0700 Merge tag 'mm-nonmm-stable-2024-07-21-15-07' of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm Pull non-MM updates from Andrew Morton: - In the series "treewide: Refactor heap related implementation", Kuan-Wei Chiu has significantly reworked the min_heap library code and has taught bcachefs to use the new more generic implementation. - Yury Norov's series "Cleanup cpumask.h inclusion in core headers" reworks the cpumask and nodemask headers to make things generally more rational. - Kuan-Wei Chiu has sent along some maintenance work against our sorting library code in the series "lib/sort: Optimizations and cleanups". - More library maintainance work from Christophe Jaillet in the series "Remove usage of the deprecated ida_simple_xx() API". - Ryusuke Konishi continues with the nilfs2 fixes and clanups in the series "nilfs2: eliminate the call to inode_attach_wb()". - Kuan-Ying Lee has some fixes to the gdb scripts in the series "Fix GDB command error". - Plus the usual shower of singleton patches all over the place. Please see the relevant changelogs for details. * tag 'mm-nonmm-stable-2024-07-21-15-07' of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm: (98 commits) ia64: scrub ia64 from poison.h watchdog/perf: properly initialize the turbo mode timestamp and rearm counter tsacct: replace strncpy() with strscpy() lib/bch.c: use swap() to improve code test_bpf: convert comma to semicolon init/modpost: conditionally check section mismatch to __meminit* init: remove unused __MEMINIT* macros nilfs2: Constify struct kobj_type nilfs2: avoid undefined behavior in nilfs_cnt32_ge macro math: rational: add missing MODULE_DESCRIPTION() macro lib/zlib: add missing MODULE_DESCRIPTION() macro fs: ufs: add MODULE_DESCRIPTION() lib/rbtree.c: fix the example typo ocfs2: add bounds checking to ocfs2_check_dir_entry() fs: add kernel-doc comments to ocfs2_prepare_orphan_dir() coredump: simplify zap_process() selftests/fpu: add missing MODULE_DESCRIPTION() macro compiler.h: simplify data_race() macro build-id: require program headers to be right after ELF header resource: add missing MODULE_DESCRIPTION() ... commit 7d4ecf3707b5da27a69ddf3dcfc28599593aad2e Merge: 478a52707b0a 509580fad732 Author: Dave Airlie Date: Mon Jul 22 10:51:47 2024 +1000 Merge tag 'drm-intel-next-fixes-2024-07-18' of https://gitlab.freedesktop.org/drm/i915/kernel into drm-next - Reset intel_dp->link_trained before retraining the link [dp] (Imre Deak) - Don't switch the LTTPR mode on an active link [dp] (Imre Deak) Signed-off-by: Dave Airlie From: Tvrtko Ursulin Link: https://patchwork.freedesktop.org/patch/msgid/ZpjgtowjpUZoHvrl@linux commit fbc90c042cd1dc7258ebfebe6d226017e5b5ac8c Merge: 7846b618e0a4 30d77b7eef01 Author: Linus Torvalds Date: Sun Jul 21 17:15:46 2024 -0700 Merge tag 'mm-stable-2024-07-21-14-50' of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm Pull MM updates from Andrew Morton: - In the series "mm: Avoid possible overflows in dirty throttling" Jan Kara addresses a couple of issues in the writeback throttling code. These fixes are also targetted at -stable kernels. - Ryusuke Konishi's series "nilfs2: fix potential issues related to reserved inodes" does that. This should actually be in the mm-nonmm-stable tree, along with the many other nilfs2 patches. My bad. - More folio conversions from Kefeng Wang in the series "mm: convert to folio_alloc_mpol()" - Kemeng Shi has sent some cleanups to the writeback code in the series "Add helper functions to remove repeated code and improve readability of cgroup writeback" - Kairui Song has made the swap code a little smaller and a little faster in the series "mm/swap: clean up and optimize swap cache index". - In the series "mm/memory: cleanly support zeropage in vm_insert_page*(), vm_map_pages*() and vmf_insert_mixed()" David Hildenbrand has reworked the rather sketchy handling of the use of the zeropage in MAP_SHARED mappings. I don't see any runtime effects here - more a cleanup/understandability/maintainablity thing. - Dev Jain has improved selftests/mm/va_high_addr_switch.c's handling of higher addresses, for aarch64. The (poorly named) series is "Restructure va_high_addr_switch". - The core TLB handling code gets some cleanups and possible slight optimizations in Bang Li's series "Add update_mmu_tlb_range() to simplify code". - Jane Chu has improved the handling of our fake-an-unrecoverable-memory-error testing feature MADV_HWPOISON in the series "Enhance soft hwpoison handling and injection". - Jeff Johnson has sent a billion patches everywhere to add MODULE_DESCRIPTION() to everything. Some landed in this pull. - In the series "mm: cleanup MIGRATE_SYNC_NO_COPY mode", Kefeng Wang has simplified migration's use of hardware-offload memory copying. - Yosry Ahmed performs more folio API conversions in his series "mm: zswap: trivial folio conversions". - In the series "large folios swap-in: handle refault cases first", Chuanhua Han inches us forward in the handling of large pages in the swap code. This is a cleanup and optimization, working toward the end objective of full support of large folio swapin/out. - In the series "mm,swap: cleanup VMA based swap readahead window calculation", Huang Ying has contributed some cleanups and a possible fixlet to his VMA based swap readahead code. - In the series "add mTHP support for anonymous shmem" Baolin Wang has taught anonymous shmem mappings to use multisize THP. By default this is a no-op - users must opt in vis sysfs controls. Dramatic improvements in pagefault latency are realized. - David Hildenbrand has some cleanups to our remaining use of page_mapcount() in the series "fs/proc: move page_mapcount() to fs/proc/internal.h". - David also has some highmem accounting cleanups in the series "mm/highmem: don't track highmem pages manually". - Build-time fixes and cleanups from John Hubbard in the series "cleanups, fixes, and progress towards avoiding "make headers"". - Cleanups and consolidation of the core pagemap handling from Barry Song in the series "mm: introduce pmd|pte_needs_soft_dirty_wp helpers and utilize them". - Lance Yang's series "Reclaim lazyfree THP without splitting" has reduced the latency of the reclaim of pmd-mapped THPs under fairly common circumstances. A 10x speedup is seen in a microbenchmark. It does this by punting to aother CPU but I guess that's a win unless all CPUs are pegged. - hugetlb_cgroup cleanups from Xiu Jianfeng in the series "mm/hugetlb_cgroup: rework on cftypes". - Miaohe Lin's series "Some cleanups for memory-failure" does just that thing. - Someone other than SeongJae has developed a DAMON feature in Honggyu Kim's series "DAMON based tiered memory management for CXL memory". This adds DAMON features which may be used to help determine the efficiency of our placement of CXL/PCIe attached DRAM. - DAMON user API centralization and simplificatio work in SeongJae Park's series "mm/damon: introduce DAMON parameters online commit function". - In the series "mm: page_type, zsmalloc and page_mapcount_reset()" David Hildenbrand does some maintenance work on zsmalloc - partially modernizing its use of pageframe fields. - Kefeng Wang provides more folio conversions in the series "mm: remove page_maybe_dma_pinned() and page_mkclean()". - More cleanup from David Hildenbrand, this time in the series "mm/memory_hotplug: use PageOffline() instead of PageReserved() for !ZONE_DEVICE". It "enlightens memory hotplug more about PageOffline() pages" and permits the removal of some virtio-mem hacks. - Barry Song's series "mm: clarify folio_add_new_anon_rmap() and __folio_add_anon_rmap()" is a cleanup to the anon folio handling in preparation for mTHP (multisize THP) swapin. - Kefeng Wang's series "mm: improve clear and copy user folio" implements more folio conversions, this time in the area of large folio userspace copying. - The series "Docs/mm/damon/maintaier-profile: document a mailing tool and community meetup series" tells people how to get better involved with other DAMON developers. From SeongJae Park. - A large series ("kmsan: Enable on s390") from Ilya Leoshkevich does that. - David Hildenbrand sends along more cleanups, this time against the migration code. The series is "mm/migrate: move NUMA hinting fault folio isolation + checks under PTL". - Jan Kara has found quite a lot of strangenesses and minor errors in the readahead code. He addresses this in the series "mm: Fix various readahead quirks". - SeongJae Park's series "selftests/damon: test DAMOS tried regions and {min,max}_nr_regions" adds features and addresses errors in DAMON's self testing code. - Gavin Shan has found a userspace-triggerable WARN in the pagecache code. The series "mm/filemap: Limit page cache size to that supported by xarray" addresses this. The series is marked cc:stable. - Chengming Zhou's series "mm/ksm: cmp_and_merge_page() optimizations and cleanup" cleans up and slightly optimizes KSM. - Roman Gushchin has separated the memcg-v1 and memcg-v2 code - lots of code motion. The series (which also makes the memcg-v1 code Kconfigurable) are "mm: memcg: separate legacy cgroup v1 code and put under config option" and "mm: memcg: put cgroup v1-specific memcg data under CONFIG_MEMCG_V1" - Dan Schatzberg's series "Add swappiness argument to memory.reclaim" adds an additional feature to this cgroup-v2 control file. - The series "Userspace controls soft-offline pages" from Jiaqi Yan permits userspace to stop the kernel's automatic treatment of excessive correctable memory errors. In order to permit userspace to monitor and handle this situation. - Kefeng Wang's series "mm: migrate: support poison recover from migrate folio" teaches the kernel to appropriately handle migration from poisoned source folios rather than simply panicing. - SeongJae Park's series "Docs/damon: minor fixups and improvements" does those things. - In the series "mm/zsmalloc: change back to per-size_class lock" Chengming Zhou improves zsmalloc's scalability and memory utilization. - Vivek Kasireddy's series "mm/gup: Introduce memfd_pin_folios() for pinning memfd folios" makes the GUP code use FOLL_PIN rather than bare refcount increments. So these paes can first be moved aside if they reside in the movable zone or a CMA block. - Andrii Nakryiko has added a binary ioctl()-based API to /proc/pid/maps for much faster reading of vma information. The series is "query VMAs from /proc//maps". - In the series "mm: introduce per-order mTHP split counters" Lance Yang improves the kernel's presentation of developer information related to multisize THP splitting. - Michael Ellerman has developed the series "Reimplement huge pages without hugepd on powerpc (8xx, e500, book3s/64)". This permits userspace to use all available huge page sizes. - In the series "revert unconditional slab and page allocator fault injection calls" Vlastimil Babka removes a performance-affecting and not very useful feature from slab fault injection. * tag 'mm-stable-2024-07-21-14-50' of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm: (411 commits) mm/mglru: fix ineffective protection calculation mm/zswap: fix a white space issue mm/hugetlb: fix kernel NULL pointer dereference when migrating hugetlb folio mm/hugetlb: fix possible recursive locking detected warning mm/gup: clear the LRU flag of a page before adding to LRU batch mm/numa_balancing: teach mpol_to_str about the balancing mode mm: memcg1: convert charge move flags to unsigned long long alloc_tag: fix page_ext_get/page_ext_put sequence during page splitting lib: reuse page_ext_data() to obtain codetag_ref lib: add missing newline character in the warning message mm/mglru: fix overshooting shrinker memory mm/mglru: fix div-by-zero in vmpressure_calc_level() mm/kmemleak: replace strncpy() with strscpy() mm, page_alloc: put should_fail_alloc_page() back behing CONFIG_FAIL_PAGE_ALLOC mm, slab: put should_failslab() back behind CONFIG_SHOULD_FAILSLAB mm: ignore data-race in __swap_writepage hugetlbfs: ensure generic_hugetlb_get_unmapped_area() returns higher address than mmap_min_addr mm: shmem: rename mTHP shmem counters mm: swap_state: use folio_alloc_mpol() in __read_swap_cache_async() mm/migrate: putback split folios when numa hint migration fails ... commit 7846b618e0a4c3e08888099d1d4512722b39ca99 Merge: 33c9de2960d3 efa9c5be2cae Author: Linus Torvalds Date: Sun Jul 21 15:34:10 2024 -0700 Merge tag 'rtc-6.11' of git://git.kernel.org/pub/scm/linux/kernel/git/abelloni/linux Pull RTC updates from Alexandre Belloni: "Subsystem: - add missing MODULE_DESCRIPTION() macro - fix offset addition for alarms Drivers: - isl1208: alarm clearing fixes - mcp794xx: oscillator failure detection - stm32: stm32mp25 support - tps6594: power management support" * tag 'rtc-6.11' of git://git.kernel.org/pub/scm/linux/kernel/git/abelloni/linux: rtc: stm32: add new st,stm32mp25-rtc compatible and check RIF configuration dt-bindings: rtc: stm32: introduce new st,stm32mp25-rtc compatible rtc: Drop explicit initialization of struct i2c_device_id::driver_data to 0 rtc: interface: Add RTC offset to alarm after fix-up rtc: ds1307: Clamp year to valid BCD (0-99) in `set_time()` rtc: ds1307: Detect oscillator fail on mcp794xx rtc: isl1208: Update correct procedure for clearing alarm rtc: isl1208: Add a delay for clearing alarm dt-bindings: rtc: Convert rtc-fsl-ftm-alarm.txt to yaml format rtc: add missing MODULE_DESCRIPTION() macro rtc: abx80x: Fix return value of nvmem callback on read rtc: cmos: Fix return value of nvmem callbacks rtc: isl1208: Fix return value of nvmem callbacks rtc: tps6594: Add power management support rtc: tps6594: introduce private structure as drvdata rtc: tps6594: Fix memleak in probe commit 33c9de2960d347c06d016c2c07ac4aa855cd75f0 Merge: 8e313211f7d4 a07d38afd152 Author: Linus Torvalds Date: Sun Jul 21 15:23:39 2024 -0700 Merge tag '6.11-rc-part1-smb3-client-fixes' of git://git.samba.org/sfrench/cifs-2.6 Pull smb client fixes from Steve French: "Six smb3 client fixes, most for stable including important netfs fixes: - various netfs related fixes for cifs addressing some regressions in 6.10 (e.g. generic/708 and some multichannel crediting related issues) - fix for a noisy log message on copy_file_range - add trace point for read/write credits" * tag '6.11-rc-part1-smb3-client-fixes' of git://git.samba.org/sfrench/cifs-2.6: cifs: Fix missing fscache invalidation cifs: Add a tracepoint to track credits involved in R/W requests cifs: Fix setting of zero_point after DIO write cifs: Fix missing error code set cifs: Fix server re-repick on subrequest retry cifs: fix noisy message on copy_file_range commit 8e313211f7d46d42b6aa7601b972fe89dcc4a076 Merge: 2c9b3512402e 11eaac6e8e72 Author: Linus Torvalds Date: Sun Jul 21 10:25:59 2024 -0700 Merge tag 'pinctrl-v6.11-1' of git://git.kernel.org/pub/scm/linux/kernel/git/linusw/linux-pinctrl Pull pin control updates from Linus Walleij: "Some new drivers is the main part, the rest is cleanups and nonurgent fixes. Nothing much special about this, no core changes this time. New drivers: - Renesas RZ/V2H(P) SoC - NXP Freescale i.MX91 SoC - Nuvoton MA35D1 SoC - Qualcomm PMC8380, SM4250, SM4250 LPI Enhancements: - A slew of scoped-based simplifications of of_node_put()" * tag 'pinctrl-v6.11-1' of git://git.kernel.org/pub/scm/linux/kernel/git/linusw/linux-pinctrl: (110 commits) pinctrl: renesas: rzg2l: Support output enable on RZ/G2L pinctrl: renesas: rzg2l: Clean up and refactor OEN read/write functions pinctrl: renesas: rzg2l: Clarify OEN read/write support dt-bindings: pinctrl: pinctrl-single: Fix pinctrl-single,gpio-range description dt-bindings: pinctrl: npcm8xx: add missing pin group and mux function dt-bindings: pinctrl: pinctrl-single: fix schmitt related properties pinctrl: freescale: Use scope based of_node_put() cleanups pinctrl: equilibrium: Use scope based of_node_put() cleanups pinctrl: ti: iodelay: Use scope based of_node_put() cleanups pinctrl: qcom: lpass-lpi: increase MAX_NR_GPIO to 32 pinctrl: cy8c95x0: Update cache modification pinctrl: cy8c95x0: Use cleanup.h pinctrl: renesas: r8a779h0: Remove unneeded separators pinctrl: renesas: r8a779g0: Add INTC-EX pins, groups, and function pinctrl: renesas: r8a779g0: Remove unneeded separators pinctrl: renesas: r8a779h0: Add AVB MII pins and groups pinctrl: renesas: r8a779g0: Fix TPU suffixes pinctrl: renesas: r8a779g0: Fix TCLK suffixes pinctrl: renesas: r8a779g0: FIX PWM suffixes pinctrl: renesas: r8a779g0: Fix IRQ suffixes ... commit 1a7c8d2459edb8e082cbce1b7e516495ca913740 Author: Masahiro Yamada Date: Sun Jul 21 01:21:14 2024 +0900 kallsyms: change sym_entry::percpu_absolute to bool type This field is boolean. Signed-off-by: Masahiro Yamada scripts/kallsyms.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) commit 1d48f8feb86ee773e65c6d54856bbfb7702bd35d Author: Masahiro Yamada Date: Sun Jul 21 01:21:13 2024 +0900 kallsyms: unify seq and start_pos fields of struct sym_entry The struct sym_entry uses the 'seq' and 'start_pos' fields to remember the index in the symbol table. They serve the same purpose and are not used simultaneously. Unify them. Signed-off-by: Masahiro Yamada scripts/kallsyms.c | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-) commit f9c3d671dd816ea4d5604dd04ef98d42921656a7 Author: Masahiro Yamada Date: Sat Jul 20 19:30:14 2024 +0900 kallsyms: add more original symbol type/name in comment lines Commit bea5b7450474 ("kallsyms: expand symbol name into comment for debugging") added the uncompressed type/name in the comment lines of kallsyms_offsets. It would be useful to do the same for kallsyms_names and kallsyms_seqs_of_names. Signed-off-by: Masahiro Yamada scripts/kallsyms.c | 19 +++++++++---------- 1 file changed, 9 insertions(+), 10 deletions(-) commit b07e18100940418803d289a91c7d859af006b8e7 Author: Masahiro Yamada Date: Sat Jul 20 19:30:13 2024 +0900 kallsyms: use \t instead of a tab in printf() This string literal uses a mixture of \t escape sequences and a tab. Use \t consistently. Signed-off-by: Masahiro Yamada scripts/kallsyms.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit bde6fb37bbc3a41eb63b1e4d06e2ff217d4a2f18 Author: Masahiro Yamada Date: Sat Jul 20 19:30:12 2024 +0900 kallsyms: avoid repeated calculation of array size for markers Introduce the markers_cnt variable for readability. No functional change intended. Signed-off-by: Masahiro Yamada scripts/kallsyms.c | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) commit c8578539debaedfbb4671e1954be8ebbd1307c6f Author: Thomas Weißschuh Date: Sat Jul 20 11:18:12 2024 +0200 kbuild: add script and target to generate pacman package pacman is the package manager used by Arch Linux and its derivates. Creating native packages from the kernel tree has multiple advantages: * The package triggers the correct hooks for initramfs generation and bootloader configuration * Uninstallation is complete and also invokes the relevant hooks * New UAPI headers can be installed without any manual bookkeeping The PKGBUILD file is a modified version of the one used for the downstream Arch Linux "linux" package. Extra steps that should not be necessary for a development kernel have been removed and an UAPI header package has been added. Signed-off-by: Thomas Weißschuh Reviewed-by: Nathan Chancellor Tested-by: Nathan Chancellor Signed-off-by: Masahiro Yamada .gitignore | 6 +++ MAINTAINERS | 7 +++ Makefile | 2 +- scripts/Makefile.package | 14 ++++++ scripts/package/PKGBUILD | 108 +++++++++++++++++++++++++++++++++++++++++++++++ 5 files changed, 136 insertions(+), 1 deletion(-) commit 3554a45297c0f6c5de5dfdba0d218b0eb9274207 Author: Masahiro Yamada Date: Sat Jul 20 16:27:39 2024 +0900 modpost: use generic macros for hash table implementation Use macros provided by hashtable.h Signed-off-by: Masahiro Yamada scripts/mod/modpost.c | 18 +++++------------- 1 file changed, 5 insertions(+), 13 deletions(-) commit fbaf242c956aff6a07d9e97eaa3a0a48d947de33 Author: Masahiro Yamada Date: Sat Jul 20 16:27:38 2024 +0900 kbuild: move some helper headers from scripts/kconfig/ to scripts/include/ Move array_size.h, hashtable.h, list.h, list_types.h from scripts/kconfig/ to scripts/include/. These headers will be useful for other host programs. Remove scripts/mod/list.h. Signed-off-by: Masahiro Yamada MAINTAINERS | 1 + Makefile | 6 +- scripts/{kconfig => include}/array_size.h | 0 scripts/{kconfig => include}/hashtable.h | 0 scripts/{kconfig => include}/list.h | 0 scripts/{kconfig => include}/list_types.h | 0 scripts/kconfig/expr.h | 3 +- scripts/kconfig/internal.h | 2 +- scripts/kconfig/mconf.c | 2 +- scripts/kconfig/menu.c | 2 +- scripts/kconfig/mnconf-common.c | 2 +- scripts/kconfig/mnconf-common.h | 2 + scripts/kconfig/nconf.c | 2 +- scripts/kconfig/preprocess.c | 4 +- scripts/kconfig/util.c | 2 +- scripts/mod/list.h | 213 ------------------------------ scripts/mod/modpost.c | 2 + scripts/mod/modpost.h | 2 +- 18 files changed, 19 insertions(+), 226 deletions(-) commit 2c9b3512402ed192d1f43f4531fb5da947e72bd0 Merge: c43a20e4a520 332d2c1d713e Author: Linus Torvalds Date: Sat Jul 20 12:41:03 2024 -0700 Merge tag 'for-linus' of git://git.kernel.org/pub/scm/virt/kvm/kvm Pull kvm updates from Paolo Bonzini: "ARM: - Initial infrastructure for shadow stage-2 MMUs, as part of nested virtualization enablement - Support for userspace changes to the guest CTR_EL0 value, enabling (in part) migration of VMs between heterogenous hardware - Fixes + improvements to pKVM's FF-A proxy, adding support for v1.1 of the protocol - FPSIMD/SVE support for nested, including merged trap configuration and exception routing - New command-line parameter to control the WFx trap behavior under KVM - Introduce kCFI hardening in the EL2 hypervisor - Fixes + cleanups for handling presence/absence of FEAT_TCRX - Miscellaneous fixes + documentation updates LoongArch: - Add paravirt steal time support - Add support for KVM_DIRTY_LOG_INITIALLY_SET - Add perf kvm-stat support for loongarch RISC-V: - Redirect AMO load/store access fault traps to guest - perf kvm stat support - Use guest files for IMSIC virtualization, when available s390: - Assortment of tiny fixes which are not time critical x86: - Fixes for Xen emulation - Add a global struct to consolidate tracking of host values, e.g. EFER - Add KVM_CAP_X86_APIC_BUS_CYCLES_NS to allow configuring the effective APIC bus frequency, because TDX - Print the name of the APICv/AVIC inhibits in the relevant tracepoint - Clean up KVM's handling of vendor specific emulation to consistently act on "compatible with Intel/AMD", versus checking for a specific vendor - Drop MTRR virtualization, and instead always honor guest PAT on CPUs that support self-snoop - Update to the newfangled Intel CPU FMS infrastructure - Don't advertise IA32_PERF_GLOBAL_OVF_CTRL as an MSR-to-be-saved, as it reads '0' and writes from userspace are ignored - Misc cleanups x86 - MMU: - Small cleanups, renames and refactoring extracted from the upcoming Intel TDX support - Don't allocate kvm_mmu_page.shadowed_translation for shadow pages that can't hold leafs SPTEs - Unconditionally drop mmu_lock when allocating TDP MMU page tables for eager page splitting, to avoid stalling vCPUs when splitting huge pages - Bug the VM instead of simply warning if KVM tries to split a SPTE that is non-present or not-huge. KVM is guaranteed to end up in a broken state because the callers fully expect a valid SPTE, it's all but dangerous to let more MMU changes happen afterwards x86 - AMD: - Make per-CPU save_area allocations NUMA-aware - Force sev_es_host_save_area() to be inlined to avoid calling into an instrumentable function from noinstr code - Base support for running SEV-SNP guests. API-wise, this includes a new KVM_X86_SNP_VM type, encrypting/measure the initial image into guest memory, and finalizing it before launching it. Internally, there are some gmem/mmu hooks needed to prepare gmem-allocated pages before mapping them into guest private memory ranges This includes basic support for attestation guest requests, enough to say that KVM supports the GHCB 2.0 specification There is no support yet for loading into the firmware those signing keys to be used for attestation requests, and therefore no need yet for the host to provide certificate data for those keys. To support fetching certificate data from userspace, a new KVM exit type will be needed to handle fetching the certificate from userspace. An attempt to define a new KVM_EXIT_COCO / KVM_EXIT_COCO_REQ_CERTS exit type to handle this was introduced in v1 of this patchset, but is still being discussed by community, so for now this patchset only implements a stub version of SNP Extended Guest Requests that does not provide certificate data x86 - Intel: - Remove an unnecessary EPT TLB flush when enabling hardware - Fix a series of bugs that cause KVM to fail to detect nested pending posted interrupts as valid wake eents for a vCPU executing HLT in L2 (with HLT-exiting disable by L1) - KVM: x86: Suppress MMIO that is triggered during task switch emulation Explicitly suppress userspace emulated MMIO exits that are triggered when emulating a task switch as KVM doesn't support userspace MMIO during complex (multi-step) emulation Silently ignoring the exit request can result in the WARN_ON_ONCE(vcpu->mmio_needed) firing if KVM exits to userspace for some other reason prior to purging mmio_needed See commit 0dc902267cb3 ("KVM: x86: Suppress pending MMIO write exits if emulator detects exception") for more details on KVM's limitations with respect to emulated MMIO during complex emulator flows Generic: - Rename the AS_UNMOVABLE flag that was introduced for KVM to AS_INACCESSIBLE, because the special casing needed by these pages is not due to just unmovability (and in fact they are only unmovable because the CPU cannot access them) - New ioctl to populate the KVM page tables in advance, which is useful to mitigate KVM page faults during guest boot or after live migration. The code will also be used by TDX, but (probably) not through the ioctl - Enable halt poll shrinking by default, as Intel found it to be a clear win - Setup empty IRQ routing when creating a VM to avoid having to synchronize SRCU when creating a split IRQCHIP on x86 - Rework the sched_in/out() paths to replace kvm_arch_sched_in() with a flag that arch code can use for hooking both sched_in() and sched_out() - Take the vCPU @id as an "unsigned long" instead of "u32" to avoid truncating a bogus value from userspace, e.g. to help userspace detect bugs - Mark a vCPU as preempted if and only if it's scheduled out while in the KVM_RUN loop, e.g. to avoid marking it preempted and thus writing guest memory when retrieving guest state during live migration blackout Selftests: - Remove dead code in the memslot modification stress test - Treat "branch instructions retired" as supported on all AMD Family 17h+ CPUs - Print the guest pseudo-RNG seed only when it changes, to avoid spamming the log for tests that create lots of VMs - Make the PMU counters test less flaky when counting LLC cache misses by doing CLFLUSH{OPT} in every loop iteration" * tag 'for-linus' of git://git.kernel.org/pub/scm/virt/kvm/kvm: (227 commits) crypto: ccp: Add the SNP_VLEK_LOAD command KVM: x86/pmu: Add kvm_pmu_call() to simplify static calls of kvm_pmu_ops KVM: x86: Introduce kvm_x86_call() to simplify static calls of kvm_x86_ops KVM: x86: Replace static_call_cond() with static_call() KVM: SEV: Provide support for SNP_EXTENDED_GUEST_REQUEST NAE event x86/sev: Move sev_guest.h into common SEV header KVM: SEV: Provide support for SNP_GUEST_REQUEST NAE event KVM: x86: Suppress MMIO that is triggered during task switch emulation KVM: x86/mmu: Clean up make_huge_page_split_spte() definition and intro KVM: x86/mmu: Bug the VM if KVM tries to split a !hugepage SPTE KVM: selftests: x86: Add test for KVM_PRE_FAULT_MEMORY KVM: x86: Implement kvm_arch_vcpu_pre_fault_memory() KVM: x86/mmu: Make kvm_mmu_do_page_fault() return mapped level KVM: x86/mmu: Account pf_{fixed,emulate,spurious} in callers of "do page fault" KVM: x86/mmu: Bump pf_taken stat only in the "real" page fault handler KVM: Add KVM_PRE_FAULT_MEMORY vcpu ioctl to pre-populate guest memory KVM: Document KVM_PRE_FAULT_MEMORY ioctl mm, virt: merge AS_UNMOVABLE and AS_INACCESSIBLE perf kvm: Add kvm-stat for loongarch64 LoongArch: KVM: Add PV steal time support in guest side ... commit a07d38afd15281c42613943a9a715c3ba07c21e6 Author: David Howells Date: Fri Jul 19 16:01:48 2024 +0100 cifs: Fix missing fscache invalidation A network filesystem needs to implement a netfslib hook to invalidate fscache if it's to be able to use the cache. Fix cifs to implement the cache invalidation hook. Signed-off-by: David Howells Reviewed-by: Paulo Alcantara (Red Hat) cc: Jeff Layton cc: linux-cifs@vger.kernel.org cc: netfs@lists.linux.dev cc: linux-fsdevel@vger.kernel.org Cc: stable@vger.kernel.org Fixes: 3ee1a1fc3981 ("cifs: Cut over to using netfslib") Signed-off-by: Steve French fs/smb/client/file.c | 6 ++++++ 1 file changed, 6 insertions(+) commit c43a20e4a520b37c2ef6d4f422de989992c9129f Merge: 9fa23750c6e5 78a0b13f5744 Author: Linus Torvalds Date: Sat Jul 20 11:52:17 2024 -0700 Merge tag 'mtd/for-6.11' of git://git.kernel.org/pub/scm/linux/kernel/git/mtd/linux Pull MTD updates from Miquel Raynal: "Nothing stands out for this merge window, mostly minor fixes, such as module descriptions, the use of debug macros and Makefile improvements. Raw NAND changes; - The Freescale MXC driver has been converted to the newer '->exec_op()' interface - The meson driver now supports handling the boot ROM area with very specific ECC needs - Support for the iMX8QXP has been added to the GPMI driver - The lpx32xx driver now can get the DMA channels using DT entries - The Qcom binding has been improved to be more future proof by Rob - And then there is the usual load of misc and minor changes SPI-NAND changes: - The Macronix vendor driver has been improved to support an extended ID to avoid conflicting with older devices after an ID reuse issue SPI NOR changes: - Drop support for Xilinx S3AN flashes. These flashes are for the very old Xilinx Spartan 3 FPGAs and they need some awkward code in the core to support. Drop support for these flashes, along with the special handling we needed for them in the core like non-power-of-2 page size handling and the .setup() callback. - Fix regression for old w25q128 flashes without SFDP tables. Commit 83e824a4a595 ("mtd: spi-nor: Correct flags for Winbond w25q128") dropped support for such devices under the assumption that they aren't being used anymore. Users have now surfaced [0] so fix the regression by supporting both kind of devices. - Core cleanups including removal of SPI_NOR_NO_FR flag and simplification of spi_nor_get_flash_info()" Link: https://lore.kernel.org/r/CALxbwRo_-9CaJmt7r7ELgu+vOcgk=xZcGHobnKf=oT2=u4d4aA@mail.gmail.com/ [0] * tag 'mtd/for-6.11' of git://git.kernel.org/pub/scm/linux/kernel/git/mtd/linux: (28 commits) mtd: rawnand: lpx32xx: Fix dma_request_chan() error checks mtd: spinand: macronix: Add support for serial NAND flash mtd: spinand: macronix: Add support for reading Device ID 2 mtd: rawnand: lpx32xx: Request DMA channels using DT entries dt-bindings: mtd: qcom,nandc: Define properties at top-level mtd: rawnand: intel: use 'time_left' variable with wait_for_completion_timeout() mtd: rawnand: mxc: use 'time_left' variable with wait_for_completion_timeout() mtd: rawnand: gpmi: add iMX8QXP support. mtd: rawnand: gpmi: add 'support_edo_timing' in gpmi_devdata mtd: cmdlinepart: Replace `dbg()` macro with `pr_debug()` mtd: add missing MODULE_DESCRIPTION() macros mtd: make mtd_test.c a separate module dt-bindings: mtd: gpmi-nand: Add 'fsl,imx8qxp-gpmi-nand' compatible string mtd: rawnand: cadence: remove unused struct 'ecc_info' mtd: rawnand: mxc: support software ECC mtd: rawnand: mxc: implement exec_op mtd: rawnand: mxc: separate page read from ecc calc mtd: spi-nor: winbond: fix w25q128 regression mtd: spi-nor: simplify spi_nor_get_flash_info() mtd: spi-nor: get rid of SPI_NOR_NO_FR ... commit 9fa23750c6e591a6e095057ec07c81dddec0d72c Merge: 8326f5e1a47b f4b89d8ce5a8 Author: Linus Torvalds Date: Sat Jul 20 11:41:52 2024 -0700 Merge tag 'landlock-6.11-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/mic/linux Pull landlock updates from Mickaël Salaün: "This simplifies code and improves documentation" * tag 'landlock-6.11-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/mic/linux: landlock: Various documentation improvements landlock: Clarify documentation for struct landlock_ruleset_attr landlock: Use bit-fields for storing handled layer access masks commit 8326f5e1a47b1a657524678cb62b264a84fbea7e Merge: 13a7871541b7 06dcc4c9baa9 Author: Linus Torvalds Date: Sat Jul 20 11:30:16 2024 -0700 Merge tag 'firewire-updates-6.11' of git://git.kernel.org/pub/scm/linux/kernel/git/ieee1394/linux1394 Pull firewire updates from Takashi Sakamoto: "There are many lines of changes for FireWire subsystem, but there is practically no functional change. Most of the changes are for code refactoring, some KUnit tests to added helper functions, and new tracepoints events for both the core functions and 1394 OHCI driver. The tracepoints events now cover the verbose logging enabled by debug parameter of firewire-ohci kernel module. The parameter would be removed in any future timing, thus it is now deprecated" * tag 'firewire-updates-6.11' of git://git.kernel.org/pub/scm/linux/kernel/git/ieee1394/linux1394: (32 commits) firewire: core: move copy_port_status() helper function to TP_fast_assign() block Revert "firewire: ohci: use common macro to interpret be32 data in le32 buffer" firewire: ohci: add tracepoints event for data of Self-ID DMA firewire: ohci: use inline functions to operate data of self-ID DMA firewire: ohci: add static inline functions to deserialize for Self-ID DMA operation firewire: ohci: use static function to handle endian issue on PowerPC platform firewire: ohci: use common macro to interpret be32 data in le32 buffer firewire: core: Fix spelling mistakes in tracepoint messages firewire: ohci: add tracepoints event for hardIRQ event firewire: ohci: add support for Linux kernel tracepoints firewire: core: add tracepoints events for completions of packets in isochronous context firewire: core: add tracepoints events for queueing packets of isochronous context firewire: core: add tracepoints events for flushing completions of isochronous context firewire: core: add tracepoints events for flushing of isochronous context firewire: core: add tracepoints events for starting/stopping of isochronous context firewire: core: add tracepoints events for setting channels of multichannel context firewire: core: add tracepoints events for allocation/deallocation of isochronous context firewire: core: undefine macros after use in tracepoints events firewire: core: record card index in tracepoints event for self ID sequence firewire: core: use inline helper functions to serialize phy config packet ... commit 13a7871541b7f5fa6d81e76f160644d1e118b6b0 Merge: f557af081de6 b0d478e34dbf Author: Linus Torvalds Date: Sat Jul 20 11:26:02 2024 -0700 Merge tag 'libnvdimm-for-6.11' of git://git.kernel.org/pub/scm/linux/kernel/git/nvdimm/nvdimm Pull libnvdimm updates from Ira Weiny: - One small cleanup to use sizeof(*pointer) - Add MODULE_DESCRIPTIONS() to eliminate make W=1 warnings * tag 'libnvdimm-for-6.11' of git://git.kernel.org/pub/scm/linux/kernel/git/nvdimm/nvdimm: testing: nvdimm: Add MODULE_DESCRIPTION() macros testing: nvdimm: iomap: add MODULE_DESCRIPTION() dax: add missing MODULE_DESCRIPTION() macros nvdimm: add missing MODULE_DESCRIPTION() macros ACPI: NFIT: add missing MODULE_DESCRIPTION() macro nvdimm/btt: use sizeof(*pointer) instead of sizeof(type) commit bcc87d978b834c298bbdd9c52454c5d0a946e97e Author: Pavel Begunkov Date: Thu Jul 18 20:00:53 2024 +0100 io_uring: fix error pbuf checking Syz reports a problem, which boils down to NULL vs IS_ERR inconsistent error handling in io_alloc_pbuf_ring(). KASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007] RIP: 0010:__io_remove_buffers+0xac/0x700 io_uring/kbuf.c:341 Call Trace: io_put_bl io_uring/kbuf.c:378 [inline] io_destroy_buffers+0x14e/0x490 io_uring/kbuf.c:392 io_ring_ctx_free+0xa00/0x1070 io_uring/io_uring.c:2613 io_ring_exit_work+0x80f/0x8a0 io_uring/io_uring.c:2844 process_one_work kernel/workqueue.c:3231 [inline] process_scheduled_works+0xa2c/0x1830 kernel/workqueue.c:3312 worker_thread+0x86d/0xd40 kernel/workqueue.c:3390 kthread+0x2f0/0x390 kernel/kthread.c:389 ret_from_fork+0x4b/0x80 arch/x86/kernel/process.c:147 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244 Cc: stable@vger.kernel.org Reported-by: syzbot+2074b1a3d447915c6f1c@syzkaller.appspotmail.com Fixes: 87585b05757dc ("io_uring/kbuf: use vm_insert_pages() for mmap'ed pbuf ring") Signed-off-by: Pavel Begunkov Link: https://lore.kernel.org/r/c5f9df20560bd9830401e8e48abc029e7cfd9f5e.1721329239.git.asml.silence@gmail.com Signed-off-by: Jens Axboe io_uring/kbuf.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) commit 24dce1c538a7ceac43f2f97aae8dfd4bb93ea9b9 Author: Pavel Begunkov Date: Tue Jul 16 19:05:46 2024 +0100 io_uring: fix lost getsockopt completions There is a report that iowq executed getsockopt never completes. The reason being that io_uring_cmd_sock() can return a positive result, and io_uring_cmd() propagates it back to core io_uring, instead of IOU_OK. In case of io_wq_submit_work(), the request will be dropped without completing it. The offending code was introduced by a hack in a9c3eda7eada9 ("io_uring: fix submission-failure handling for uring-cmd"), however it was fine until getsockopt was introduced and started returning positive results. The right solution is to always return IOU_OK, since e0b23d9953b0c ("io_uring: optimise ltimeout for inline execution"), we should be able to do it without problems, however for the sake of backporting and minimising side effects, let's keep returning negative return codes and otherwise do IOU_OK. Link: https://github.com/axboe/liburing/issues/1181 Cc: stable@vger.kernel.org Fixes: 8e9fad0e70b7b ("io_uring: Add io_uring command support for sockets") Signed-off-by: Pavel Begunkov Reviewed-by: Breno Leitao Link: https://lore.kernel.org/r/ff349cf0654018189b6077e85feed935f0f8839e.1721149870.git.asml.silence@gmail.com Signed-off-by: Jens Axboe io_uring/uring_cmd.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit f557af081de6b45a25e27d633b4d8d2dbc2f428e Merge: d2be38b9a551 93b63f68d00a Author: Linus Torvalds Date: Sat Jul 20 09:11:27 2024 -0700 Merge tag 'riscv-for-linus-6.11-mw1' of git://git.kernel.org/pub/scm/linux/kernel/git/riscv/linux Pull RISC-V updates from Palmer Dabbelt: - Support for various new ISA extensions: * The Zve32[xf] and Zve64[xfd] sub-extensios of the vector extension * Zimop and Zcmop for may-be-operations * The Zca, Zcf, Zcd and Zcb sub-extensions of the C extension * Zawrs - riscv,cpu-intc is now dtschema - A handful of performance improvements and cleanups to text patching - Support for memory hot{,un}plug - The highest user-allocatable virtual address is now visible in hwprobe * tag 'riscv-for-linus-6.11-mw1' of git://git.kernel.org/pub/scm/linux/kernel/git/riscv/linux: (58 commits) riscv: lib: relax assembly constraints in hweight riscv: set trap vector earlier KVM: riscv: selftests: Add Zawrs extension to get-reg-list test KVM: riscv: Support guest wrs.nto riscv: hwprobe: export Zawrs ISA extension riscv: Add Zawrs support for spinlocks dt-bindings: riscv: Add Zawrs ISA extension description riscv: Provide a definition for 'pause' riscv: hwprobe: export highest virtual userspace address riscv: Improve sbi_ecall() code generation by reordering arguments riscv: Add tracepoints for SBI calls and returns riscv: Optimize crc32 with Zbc extension riscv: Enable DAX VMEMMAP optimization riscv: mm: Add support for ZONE_DEVICE virtio-mem: Enable virtio-mem for RISC-V riscv: Enable memory hotplugging for RISC-V riscv: mm: Take memory hotplug read-lock during kernel page table dump riscv: mm: Add memory hotplugging support riscv: mm: Add pfn_to_kaddr() implementation riscv: mm: Refactor create_linear_mapping_range() for memory hot add ... commit d2be38b9a5514dbc7dc0c96a2a7f619fcddce00d Merge: 3c3ff7be9729 bb2d63500b5c Author: Linus Torvalds Date: Sat Jul 20 09:03:36 2024 -0700 Merge tag 'mips_6.11' of git://git.kernel.org/pub/scm/linux/kernel/git/mips/linux Pull MIPS updates from Thomas Bogendoerfer: - add support for Realtek RTL9302C - add support for Mobileye EyeQ6H - add support for Mobileye EyeQ OLB system controller - improve r4k clocksource - add mode for emulating ieee754 NAN2008 - rework for BMIPS CBR address handling - fixes for Loongson 2K1000 - defconfig updates - cleanups and fixes * tag 'mips_6.11' of git://git.kernel.org/pub/scm/linux/kernel/git/mips/linux: (58 commits) MIPS: config: Add ip30_defconfig MIPS: config: lemote2f: Regenerate defconfig MIPS: config: generic: Add board-litex MIPS: config: Enable MSA and virtualization for MIPS64R6 MIPS: Fix fallback march for SB1 mips: dts: realtek: Add RTL9302C board mips: generic: add fdt fixup for Realtek reference board mips: select REALTEK_OTTO_TIMER for Realtek platforms dt-bindings: interrupt-controller: realtek,rtl-intc: Add rtl9300-intc dt-bindings: mips: realtek: Add rtl930x-soc compatible dt-bindings: vendor-prefixes: Add Cameo Communications mips: dts: realtek: add device_type property to cpu node mips: dts: realtek: use "serial" instead of "uart" in node name MIPS: Implement ieee754 NAN2008 emulation mode MIPS: lantiq: improve USB initialization MIPS: GIC: Generate redirect block accessors MIPS: CPS: Add a couple of multi-cluster utility functions MIPS: Octeron: remove source file executable bit MAINTAINERS: Mobileye: add OLB drivers and dt-bindings MIPS: mobileye: eyeq5: add OLB system-controller node ... commit 998b17d4440b8559a8bf4926e86f493101995519 Author: Oleg Nesterov Date: Sat Jul 20 22:41:07 2024 +0800 LoongArch: Make the users of larch_insn_gen_break() constant LoongArch defines UPROBE_SWBP_INSN as a function call and this breaks arch_uprobe_trampoline() which uses it to initialize a static variable. Add the new "__builtin_constant_p" helper, __emit_break(), and redefine the current users of larch_insn_gen_break() to use it. Fixes: ff474a78cef5 ("uprobe: Add uretprobe syscall to speed up return probe") Reported-by: Nathan Chancellor Closes: https://lore.kernel.org/all/20240614174822.GA1185149@thelio-3990X/ Suggested-by: Andrii Nakryiko Tested-by: Tiezhu Yang Signed-off-by: Oleg Nesterov Signed-off-by: Huacai Chen arch/loongarch/include/asm/inst.h | 3 +++ arch/loongarch/include/asm/uprobes.h | 4 ++-- arch/loongarch/kernel/kprobes.c | 4 ++-- 3 files changed, 7 insertions(+), 4 deletions(-) commit 3892b11eac5aaaeefbf717f1953288b77759d9e2 Author: Tiezhu Yang Date: Sat Jul 20 22:41:07 2024 +0800 LoongArch: Check TIF_LOAD_WATCH to enable user space watchpoint Currently, there are some places to set CSR.PRMD.PWE, the first one is in hw_breakpoint_thread_switch() to enable user space singlestep via checking TIF_SINGLESTEP, the second one is in hw_breakpoint_control() to enable user space watchpoint. For the latter case, it should also check TIF_LOAD_WATCH to make the logic correct and clear. Fixes: c8e57ab0995c ("LoongArch: Trigger user-space watchpoints correctly") Signed-off-by: Tiezhu Yang Signed-off-by: Huacai Chen arch/loongarch/kernel/hw_breakpoint.c | 2 +- arch/loongarch/kernel/ptrace.c | 3 +++ 2 files changed, 4 insertions(+), 1 deletion(-) commit 0d3a6322021b8c98527842518eeb685f3a8761c8 Author: WANG Rui Date: Sat Jul 20 22:41:07 2024 +0800 LoongArch: Use rustc option -Zdirect-access-external-data -Zdirect-access-external-data is a new Rust compiler option added in Rust 1.78, which we use to optimize the access of external data in the Linux kernel's Rust code. This patch modifies the Rust code in vmlinux to directly access externa data, using PC-REL instead of GOT. However, Rust code whithin modules is constrained by the PC-REL addressing range and is explicitly set to use an indirect method. Acked-by: Miguel Ojeda Signed-off-by: WANG Rui Signed-off-by: Huacai Chen arch/loongarch/Makefile | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) commit e05d4cd9b895c503dcf19c0ed9ebb8d393b220ec Author: Xi Ruoyao Date: Sat Jul 20 22:41:07 2024 +0800 LoongArch: Add support for relocating the kernel with RELR relocation RELR as a relocation packing format for relative relocations for reducing the size of relative relocation records. In a position independent executable there are often many relative relocation records, and our vmlinux is a PIE. The LLD linker (since 17.0.0) and the BFD linker (since 2.43) supports packing the relocations in the RELR format for LoongArch, with the flag -z pack-relative-relocs. Commits 5cf896fb6be3eff ("arm64: Add support for relocating the kernel with RELR relocations") and ccb2d173b983984bfa ("Makefile: use -z pack-relative-relocs") have already added the framework to use RELR. We just need to wire it up and process the RELR relocation records in relocate_relative() in addition to the RELA relocation records. A ".p2align 3" directive is added to la_abs macro or the BFD linker cannot pack the relocation records against the .la_abs section (the ". = ALIGN(8);" directive in vmlinux.lds.S is too late in the linking process). With defconfig and CONFIG_RELR vmlinux.efi is 2.1 MiB (6%) smaller, and vmlinuz.efi (using gzip compression) is 384 KiB (2.8%) smaller. Link: https://groups.google.com/d/topic/generic-abi/bX460iggiKg Link: https://reviews.llvm.org/D138135#4531389 Link: https://sourceware.org/git/?p=binutils-gdb.git;a=commit;h=d89ecf33ab6d Signed-off-by: Xi Ruoyao Signed-off-by: Huacai Chen arch/loongarch/Kconfig | 1 + arch/loongarch/include/asm/asmmacro.h | 1 + arch/loongarch/include/asm/setup.h | 5 +++++ arch/loongarch/kernel/relocate.c | 18 ++++++++++++++++++ arch/loongarch/kernel/vmlinux.lds.S | 8 ++++++++ 5 files changed, 33 insertions(+) commit 0ad158e4ef769c5f261cbf791e0005d69fc3b785 Author: Xi Ruoyao Date: Sat Jul 20 22:41:07 2024 +0800 LoongArch: Remove a redundant checking in relocator With our linker script "relocated_addr >= VMLINUX_LOAD_ADDRESS" should be always true. Signed-off-by: Xi Ruoyao Signed-off-by: Huacai Chen arch/loongarch/kernel/relocate.c | 4 +--- 1 file changed, 1 insertion(+), 3 deletions(-) commit 0124fbb4c6dba23dbdf80c829be68adbccde2722 Author: Huacai Chen Date: Sat Jul 20 22:41:07 2024 +0800 LoongArch: Use correct API to map cmdline in relocate_kernel() fw_arg1 is in memory space rather than I/O space, so we should use early_memremap_ro() instead of early_ioremap() to map the cmdline. Moreover, we should unmap it after using. Suggested-by: Jiaxun Yang Reviewed-by: Jiaxun Yang Signed-off-by: Huacai Chen arch/loongarch/kernel/relocate.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) commit 67e6b115ddcf8f03108cedcf66261153904ce4fb Author: Huacai Chen Date: Sat Jul 20 22:41:06 2024 +0800 LoongArch: Automatically disable KASLR for hibernation Hibernation assumes the memory layout after resume be the same as that before sleep, so it expects the kernel is loaded at the same position. To achieve this goal we automatically disable KASLR if user explicitly requests hibernation via the "resume=" command line. Since "nohibernate" and "noresume" have higher priorities than "resume=", we only disable KASLR if there is no "nohibernate" and "noresume". Signed-off-by: Huacai Chen arch/loongarch/kernel/relocate.c | 26 ++++++++++++++++++++++++++ 1 file changed, 26 insertions(+) commit e523a5a65f34ca5bd67ccfdfdccf04689b58f0bf Author: Jiaxun Yang Date: Sat Jul 20 22:41:06 2024 +0800 LoongArch: Add ACPI standard hardware register based S3 support Most LoongArch 64 machines are using custom "SADR" ACPI extension to perform ACPI S3 sleep. However the standard ACPI way to perform sleep is to write a value to ACPI PM1/SLEEP_CTL register, and this is never supported properly in kernel. Add standard S3 sleep by providing a default DoSuspend function which calls ACPI's acpi_enter_sleep_state() routine when SADR is not provided by the firmware. Also fix suspend assembly code so that ra is set properly before go into sleep routine. (Previously linked address of jirl was set to a0, some firmware do require return address in a0 but it's already set with la.pcrel before). Signed-off-by: Jiaxun Yang Signed-off-by: Huacai Chen arch/loongarch/power/platform.c | 22 +++++++++++++++++----- arch/loongarch/power/suspend_asm.S | 2 +- 2 files changed, 18 insertions(+), 6 deletions(-) commit f60d251b27f6599b3407950924ac9b2c7a94b714 Author: Huacai Chen Date: Sat Jul 20 22:41:06 2024 +0800 LoongArch: Add architectural preparation for CPUFreq Add architectural preparation for CPUFreq driver, including: Kconfig, register definition and platform device registration. Some of LoongArch processors support DVFS, their IOCSR.FEATURES has IOCSRF_FREQSCALE set. And they has a micro-core in the package called SMC (System Management Controller) to scale frequency, voltage, etc. Signed-off-by: Binbin Zhou Signed-off-by: Huacai Chen arch/loongarch/Kconfig | 1 + arch/loongarch/include/asm/loongarch.h | 3 +++ arch/loongarch/power/platform.c | 15 +++++++++++++++ 3 files changed, 19 insertions(+) commit 8e02c3b782ec64343f3cccc8dc5a8be2b379e80b Author: Huacai Chen Date: Sat Jul 20 22:40:59 2024 +0800 LoongArch: Add writecombine support for DMW-based ioremap() Currently, only TLB-based ioremap() support writecombine, so add the counterpart for DMW-based ioremap() with help of DMW2. The base address (WRITECOMBINE_BASE) is configured as 0xa000000000000000. DMW3 is unused by kernel now, however firmware may leave garbage in them and interfere kernel's address mapping. So clear it as necessary. BTW, centralize the DMW configuration to macro SETUP_DMWINS. Signed-off-by: Jiaxun Yang Signed-off-by: Huacai Chen arch/loongarch/include/asm/addrspace.h | 4 ++++ arch/loongarch/include/asm/io.h | 10 ++++++++-- arch/loongarch/include/asm/loongarch.h | 10 +++++++++- arch/loongarch/include/asm/stackframe.h | 11 +++++++++++ arch/loongarch/kernel/head.S | 11 ++--------- arch/loongarch/power/suspend_asm.S | 6 +----- drivers/firmware/efi/libstub/loongarch.c | 2 ++ 7 files changed, 37 insertions(+), 17 deletions(-) commit 614d7e99752e02ff6f6d447a83d2929b9649b6cb Author: Huacai Chen Date: Sat Jul 20 22:40:59 2024 +0800 LoongArch: Add ARCH_HAS_DEBUG_VM_PGTABLE support Add ARCH_HAS_DEBUG_VM_PGTABLE selection in Kconfig, in order to make corresponding vm debug features usable on LoongArch. Also update the corresponding arch-support.txt document. Signed-off-by: Huacai Chen Documentation/features/debug/debug-vm-pgtable/arch-support.txt | 2 +- arch/loongarch/Kconfig | 1 + 2 files changed, 2 insertions(+), 1 deletion(-) commit b7a2750ef268e2723acb785c4903b0b78c3dcbc6 Author: Huacai Chen Date: Sat Jul 20 22:40:59 2024 +0800 LoongArch: Add ARCH_HAS_PTE_DEVMAP support In order for things like get_user_pages() to work on ZONE_DEVICE memory, we need a software PTE bit to identify device-backed PFNs. Hook this up along with the relevant helpers to join in with ARCH_HAS_PTE_DEVMAP. Signed-off-by: Huacai Chen arch/loongarch/Kconfig | 1 + arch/loongarch/include/asm/pgtable-bits.h | 6 ++++-- arch/loongarch/include/asm/pgtable.h | 19 +++++++++++++++++++ 3 files changed, 24 insertions(+), 2 deletions(-) commit a0f7085f6a63f19f83f2644ce2da49a8d3cf7c0f Author: Jinjie Ruan Date: Sat Jul 20 22:40:58 2024 +0800 LoongArch: Add RANDOMIZE_KSTACK_OFFSET support Add support of kernel stack offset randomization while handling syscall, the offset is defaultly limited by KSTACK_OFFSET_MAX(). In order to avoid triggering stack canaries (due to __builtin_alloca()) and slowing down the entry path, use __no_stack_protector attribute to disable stack protector for do_syscall() at function level. With this patch, the REPORT_STACK test show that: `loongarch64 bits of stack entropy: 7` Reviewed-by: Kees Cook Signed-off-by: Jinjie Ruan Signed-off-by: Huacai Chen arch/loongarch/Kconfig | 1 + arch/loongarch/kernel/syscall.c | 22 +++++++++++++++++++++- 2 files changed, 22 insertions(+), 1 deletion(-) commit 08f417db702c5b05150b3851af7186fee96ddd46 Author: Huacai Chen Date: Sat Jul 20 22:40:58 2024 +0800 LoongArch: Add irq_work support via self IPIs Add irq_work support for LoongArch via self IPIs. This make it possible to run works in hardware interrupt context, which is a prerequisite for NOHZ_FULL. Implement: - arch_irq_work_raise() - arch_irq_work_has_interrupt() Reviewed-by: Guo Ren Signed-off-by: Huacai Chen arch/loongarch/include/asm/hardirq.h | 3 ++- arch/loongarch/include/asm/irq_work.h | 10 ++++++++++ arch/loongarch/include/asm/smp.h | 2 ++ arch/loongarch/kernel/paravirt.c | 6 ++++++ arch/loongarch/kernel/smp.c | 14 ++++++++++++++ 5 files changed, 34 insertions(+), 1 deletion(-) commit 12d3b559b85e75640b79995e1320588d6f0d5630 Author: Huacai Chen Date: Sat Jul 20 22:40:58 2024 +0800 LoongArch: Always enumerate MADT and setup logical-physical CPU mapping Some drivers want to use cpu_logical_map(), early_cpu_to_node() and some other CPU mapping APIs, even if we use "nr_cpus=1" to hard limit the CPU number. This is strongly required for the multi-bridges machines. Currently, we stop parsing the MADT if the nr_cpus limit is reached, but to achieve the above goal we should always enumerate the MADT table and setup logical-physical CPU mapping whether there is a nr_cpus limit. Rework the MADT enumeration: 1. Define a flag "cpu_enumerated" to distinguish the first enumeration (cpu_enumerated=0) and the physical hotplug case (cpu_enumerated=1) for set_processor_mask(). 2. If cpu_enumerated=0, stop parsing only when NR_CPUS limit is reached, so we can setup logical-physical CPU mapping; if cpu_enumerated=1, stop parsing when nr_cpu_ids limit is reached, so we can avoid some runtime bugs. Once logical-physical CPU mapping is setup, we will let cpu_enumerated=1. 3. Use find_first_zero_bit() instead of cpumask_next_zero() to find the next zero bit (free logical CPU id) in the cpu_present_mask, because cpumask_next_zero() will stop at nr_cpu_ids. 4. Only touch cpu_possible_mask if cpu_enumerated=0, this is in order to avoid some potential crashes, because cpu_possible_mask is marked as __ro_after_init. 5. In prefill_possible_map(), clear cpu_present_mask bits greater than nr_cpu_ids, in order to avoid a CPU be "present" but not "possible". Signed-off-by: Huacai Chen arch/loongarch/kernel/acpi.c | 22 ++++++++++++++++------ arch/loongarch/kernel/setup.c | 4 +++- arch/loongarch/kernel/smp.c | 7 +++---- 3 files changed, 22 insertions(+), 11 deletions(-) commit 7697a0fe0154468f5df35c23ebd7aa48994c2cdc Author: Huacai Chen Date: Sat Jul 20 22:40:58 2024 +0800 LoongArch: Define __ARCH_WANT_NEW_STAT in unistd.h Chromium sandbox apparently wants to deny statx [1] so it could properly inspect arguments after the sandboxed process later falls back to fstat. Because there's currently not a "fd-only" version of statx, so that the sandbox has no way to ensure the path argument is empty without being able to peek into the sandboxed process's memory. For architectures able to do newfstatat though, glibc falls back to newfstatat after getting -ENOSYS for statx, then the respective SIGSYS handler [2] takes care of inspecting the path argument, transforming allowed newfstatat's into fstat instead which is allowed and has the same type of return value. But, as LoongArch is the first architecture to not have fstat nor newfstatat, the LoongArch glibc does not attempt falling back at all when it gets -ENOSYS for statx -- and you see the problem there! Actually, back when the LoongArch port was under review, people were aware of the same problem with sandboxing clone3 [3], so clone was eventually kept. Unfortunately it seemed at that time no one had noticed statx, so besides restoring fstat/newfstatat to LoongArch uapi (and postponing the problem further), it seems inevitable that we would need to tackle seccomp deep argument inspection. However, this is obviously a decision that shouldn't be taken lightly, so we just restore fstat/newfstatat by defining __ARCH_WANT_NEW_STAT in unistd.h. This is the simplest solution for now, and so we hope the community will tackle the long-standing problem of seccomp deep argument inspection in the future [4][5]. Also add "newstat" to syscall_abis_64 in Makefile.syscalls due to upstream asm-generic changes. More infomation please reading this thread [6]. [1] https://chromium-review.googlesource.com/c/chromium/src/+/2823150 [2] https://chromium.googlesource.com/chromium/src/sandbox/+/c085b51940bd/linux/seccomp-bpf-helpers/sigsys_handlers.cc#355 [3] https://lore.kernel.org/linux-arch/20220511211231.GG7074@brightrain.aerifal.cx/ [4] https://lwn.net/Articles/799557/ [5] https://lpc.events/event/4/contributions/560/attachments/397/640/deep-arg-inspection.pdf [6] https://lore.kernel.org/loongarch/20240226-granit-seilschaft-eccc2433014d@brauner/T/#t Cc: stable@vger.kernel.org Signed-off-by: Huacai Chen arch/loongarch/include/asm/unistd.h | 1 + arch/loongarch/kernel/Makefile.syscalls | 3 +-- 2 files changed, 2 insertions(+), 2 deletions(-) commit 385ac870bdd531348de123d6790626ccd7827f69 Author: Wolfram Sang Date: Tue Jul 16 10:36:25 2024 +0200 i2c: header: improve kdoc for i2c_algorithm Reword the explanation of @xfer, the old one was confusing and mixing up terminology. Other than that, capitalize some words correctly and use full line length. Signed-off-by: Wolfram Sang include/linux/i2c.h | 15 +++++++-------- 1 file changed, 7 insertions(+), 8 deletions(-) commit d83763e44944d4d6dee38099c5d0a0984ac66385 Author: Wolfram Sang Date: Tue Jul 16 10:36:24 2024 +0200 i2c: header: remove unneeded stuff regarding i2c_algorithm The forward declaration is not needed anymore. The sentence about "following structs" became obsolete when struct i2c_algorithm became a kdoc. The paragraph about return values can go because we have this information in kdoc already. Signed-off-by: Wolfram Sang include/linux/i2c.h | 6 ------ 1 file changed, 6 deletions(-) commit 6318f219cd8971296c04371b2dc4a0bff7f44858 Merge: 8e5c0abfa02d de4f2f52f932 Author: Wolfram Sang Date: Sat Jul 20 15:42:18 2024 +0200 Merge tag 'i2c-host-6.11-part-2' of git://git.kernel.org/pub/scm/linux/kernel/git/andi.shyti/linux into i2c/for-mergewindow Added descriptions in the DTS for the Qualcomm SM8650 and SM8550 Camera Control Interface (CCI). Added support for the "settle-time-us" property, which allows the gpio-mux device to switch from one bus to another with a configurable delay. The time can be set in the DTS. The latest change also includes file sorting. Fixed slot numbering in the SMBus framework to prevent failures when more than 8 slots are occupied. It now enforces a a maximum of 8 slots to be used. This ensures that the Intel PIIX4 device can register the SPDs correctly without failure, even if other slots are populated but not used. commit 78a0b13f5744bd270d0c2391973605d9960a402a Merge: b93f410b8b2a a503f91a3645 Author: Miquel Raynal Date: Sat Jul 20 14:24:38 2024 +0200 Merge tag 'nand/for-6.11' into mtd/next Raw NAND changes; The Freescale MXC driver has been converted to the newer ->exec_op() interface. The meson driver now supports handling the boot ROM area with very specific ECC needs. Support for the iMX8QXP has been added to the GPMI driver. The lpx32xx driver now can get the DMA channels using DT entries. The Qcom binding has been improved to be more future proof by Rob. And then there is the usual load of misc and minor changes. SPI-NAND changes: The Macronix vendor driver has been improved to support an extended ID to avoid conflicting with older devices after an ID reuse issue. Signed-off-by: Miquel Raynal commit b93f410b8b2a9a6344ea27ea9f1038e351b112f3 Merge: 2538af030d6f d35df77707bf Author: Miquel Raynal Date: Sat Jul 20 14:24:26 2024 +0200 Merge tag 'spi-nor/for-6.11' into mtd/next SPI NOR changes for 6.11 Notable changes: - Drop support for Xilinx S3AN flashes. These flashes are for the very old Xilinx Spartan 3 FPGAs and they need some awkward code in the core to support. Drop support for these flashes, along with the special handling we needed for them in the core like non-power-of-2 page size handling and the .setup() callback. - Fix regression for old w25q128 flashes without SFDP tables. Commit 83e824a4a595 ("mtd: spi-nor: Correct flags for Winbond w25q128") dropped support for such devices under the assumption that they aren't being used anymore. Users have now surfaced [0] so fix the regression by supporting both kind of devices. - Core cleanups including removal of SPI_NOR_NO_FR flag and simplification of spi_nor_get_flash_info(). [0] https://lore.kernel.org/r/CALxbwRo_-9CaJmt7r7ELgu+vOcgk=xZcGHobnKf=oT2=u4d4aA@mail.gmail.com/ Signed-off-by: Miquel Raynal commit de4f2f52f93257433c9029ba2b4044cd9f029b21 Author: Thomas Weißschuh Date: Tue Jul 9 19:35:36 2024 +0200 i2c: piix4: Register SPDs The piix4 I2C bus can carry SPDs, register them if present. Only look on bus 0, as this is where the SPDs seem to be located. Only the first 8 slots are supported. If the system has more, then these will not be visible. The AUX bus can not be probed as on some platforms it reports all devices present and all reads return "0". This would allow the ee1004 to be probed incorrectly. Signed-off-by: Thomas Weißschuh Reviewed-by: Guenter Roeck Tested-by: Guenter Roeck Signed-off-by: Andi Shyti drivers/i2c/busses/Kconfig | 1 + drivers/i2c/busses/i2c-piix4.c | 9 +++++++++ 2 files changed, 10 insertions(+) commit 6e6ef2da3a28f3e02fd204b4f8821030b61f8cd4 Author: Masahiro Yamada Date: Thu Jul 18 03:28:19 2024 +0900 Makefile: add comment to discourage tools/* addition for kernel builds Kbuild provides scripts/Makefile.host to build host programs used for building the kernel. Unfortunately, there are two exceptions that opt out of Kbuild. The build system under tools/ is a cheesy replica, and cause issues. I was recently poked about a problem in the tools build system, which I do not maintain (and nobody maintains). [1] Without a comment, people might believe this is the right location because that is where objtool lives, even if a more robust Kbuild syntax satisfies their needs. [2] [1]: https://lore.kernel.org/linux-kbuild/ZnIYWBgrJ-IJtqK8@google.com/T/#m8ece130dd0e23c6f2395ed89070161948dee8457 [2]: https://lore.kernel.org/all/20240618200501.GA1611012@google.com/ Signed-off-by: Masahiro Yamada Acked-by: Nicolas Schier Reviewed-by: Brian Norris Reviewed-by: Sami Tolvanen Makefile | 6 ++++++ 1 file changed, 6 insertions(+) commit 44ad2814ca58fc43ab473d8fbb3b46a2b39a0392 Author: Masahiro Yamada Date: Thu Jul 18 03:13:22 2024 +0900 kbuild: clean up scripts/remove-stale-files These lines have been here for more than a year. Remove them. Signed-off-by: Masahiro Yamada scripts/remove-stale-files | 18 ------------------ 1 file changed, 18 deletions(-) commit 9d0d266046571f4b3e733c7eb9cf7c959f37fbdd Author: HONG Yifan Date: Wed Jul 17 01:50:41 2024 +0000 kconfig: recursive checks drop file/lineno This prevents segfault when getting filename and lineno in recursive checks. If the following snippet is found in Kconfig: [Test code 1] config FOO bool depends on BAR select BAR ... without BAR defined; then there is a segfault. Kconfig:34:error: recursive dependency detected! Kconfig:34: symbol FOO depends on BAR make[4]: *** [scripts/kconfig/Makefile:85: allnoconfig] Segmentation fault This is because of the following. BAR is a fake entry created by sym_lookup() with prop being NULL. In the recursive check, there is a NULL check for prop to fall back to stack->sym->prop if stack->prop is NULL. However, in this case, stack->sym points to the fake BAR entry created by sym_lookup(), so prop is still NULL. prop was then referenced without additional NULL checks, causing segfault. As the previous email thread suggests, the file and lineno for select is also wrong: [Test code 2] config FOO bool config BAR bool config FOO bool "FOO" depends on BAR select BAR $ make defconfig *** Default configuration is based on 'x86_64_defconfig' Kconfig:1:error: recursive dependency detected! Kconfig:1: symbol FOO depends on BAR Kconfig:4: symbol BAR is selected by FOO [...] Kconfig:4 should be Kconfig:10. This patch deletes the wrong and segfault-prone filename/lineno inference completely. With this patch, Test code 1 yields: error: recursive dependency detected! symbol FOO depends on BAR symbol BAR is selected by FOO Signed-off-by: HONG Yifan Signed-off-by: Masahiro Yamada scripts/kconfig/symbol.c | 42 +++++++--------------- .../tests/err_recursive_dep/expected_stderr | 36 +++++++++---------- 2 files changed, 30 insertions(+), 48 deletions(-) commit 301c10908e42657c3e6142055aa772adab6a6ef7 Author: Rafael Aquini Date: Tue Jul 16 08:25:05 2024 -0400 kbuild: rpm-pkg: introduce a simple changelog section for kernel.spec Fix the following rpmbuild warning: $ make srcrpm-pkg ... RPM build warnings: source_date_epoch_from_changelog set but %changelog is missing Signed-off-by: Rafael Aquini Signed-off-by: Masahiro Yamada scripts/package/mkspec | 23 +++++++++++++++++++++++ 1 file changed, 23 insertions(+) commit 64e166099b69bfc09f667253358a15160b86ea43 Author: Jann Horn Date: Wed Feb 21 21:26:53 2024 +0100 kallsyms: get rid of code for absolute kallsyms Commit cf8e8658100d ("arch: Remove Itanium (IA-64) architecture") removed the last use of the absolute kallsyms. Signed-off-by: Jann Horn Acked-by: Arnd Bergmann Link: https://lore.kernel.org/all/20240221202655.2423854-1-jannh@google.com/ [masahiroy@kernel.org: rebase the code and reword the commit description] Signed-off-by: Masahiro Yamada init/Kconfig | 18 --------- kernel/kallsyms.c | 5 +-- kernel/kallsyms_internal.h | 1 - kernel/vmcore_info.c | 4 -- scripts/kallsyms.c | 78 +++++++++++++++---------------------- scripts/link-vmlinux.sh | 4 -- tools/perf/tests/vmlinux-kallsyms.c | 1 - 7 files changed, 33 insertions(+), 78 deletions(-) commit 7efcb39e0da99de8295e81a2f98b7fdeebcdaa73 Author: Zhang Bingwu Date: Sun Jul 14 16:57:51 2024 +0800 kbuild: Create INSTALL_PATH directory if it does not exist If INSTALL_PATH is not a valid directory, create it, like what modules_install and dtbs_install will do in the same situation. Signed-off-by: Zhang Bingwu Reviewed-by: Nicolas Schier Signed-off-by: Masahiro Yamada scripts/install.sh | 4 ++++ 1 file changed, 4 insertions(+) commit af7925d82096d30bf971d41a109bd42f6a027ec2 Author: Zhang Bingwu Date: Sun Jul 14 16:57:50 2024 +0800 kbuild: Abort make on install failures Setting '-e' flag tells shells to exit with error exit code immediately after any of commands fails, and causes make(1) to regard recipes as failed. Before this, make will still continue to succeed even after the installation failed, for example, for insufficient permission or directory does not exist. Signed-off-by: Zhang Bingwu Signed-off-by: Masahiro Yamada arch/arm/boot/install.sh | 2 ++ arch/arm64/boot/install.sh | 2 ++ arch/m68k/install.sh | 2 ++ arch/nios2/boot/install.sh | 2 ++ arch/parisc/install.sh | 2 ++ arch/riscv/boot/install.sh | 2 ++ arch/s390/boot/install.sh | 2 ++ arch/sparc/boot/install.sh | 2 ++ arch/x86/boot/install.sh | 2 ++ 9 files changed, 18 insertions(+) commit 3c2f84cedaeb2fe9575dd3f6edddf0d875b3b97c Author: Masahiro Yamada Date: Mon Jul 8 00:38:07 2024 +0900 kconfig: remove 'e1' and 'e2' macros from expression deduplication I do not think the macros 'e1' and 'e2' are readable. The statement: e1 = expr_alloc_symbol(...); affects the caller's variable, but this is not sufficiently clear from the code. Remove the macros. No functional change intended. Signed-off-by: Masahiro Yamada scripts/kconfig/expr.c | 94 ++++++++++++++++++++++---------------------------- 1 file changed, 42 insertions(+), 52 deletions(-) commit 3c3ff7be9729959699eb6cbc7fd7303566d74069 Merge: 3f386cb8ee9f 9ff0251b2eb5 Author: Linus Torvalds Date: Fri Jul 19 21:00:33 2024 -0700 Merge tag 'powerpc-6.11-1' of git://git.kernel.org/pub/scm/linux/kernel/git/powerpc/linux Pull powerpc updates from Michael Ellerman: - Remove support for 40x CPUs & platforms - Add support to the 64-bit BPF JIT for cpu v4 instructions - Fix PCI hotplug driver crash on powernv - Fix doorbell emulation for KVM on PAPR guests (nestedv2) - Fix KVM nested guest handling of some less used SPRs - Online NUMA nodes with no CPU/memory if they have a PCI device attached - Reduce memory overhead of enabling kfence on 64-bit Radix MMU kernels - Reimplement the iommu table_group_ops for pseries for VFIO SPAPR TCE Thanks to: Anjali K, Artem Savkov, Athira Rajeev, Breno Leitao, Brian King, Celeste Liu, Christophe Leroy, Esben Haabendal, Gaurav Batra, Gautam Menghani, Haren Myneni, Hari Bathini, Jeff Johnson, Krishna Kumar, Krzysztof Kozlowski, Nathan Lynch, Nicholas Piggin, Nick Bowler, Nilay Shroff, Rob Herring (Arm), Shawn Anastasio, Shivaprasad G Bhat, Sourabh Jain, Srikar Dronamraju, Timothy Pearson, Uwe Kleine-König, and Vaibhav Jain. * tag 'powerpc-6.11-1' of git://git.kernel.org/pub/scm/linux/kernel/git/powerpc/linux: (57 commits) Documentation/powerpc: Mention 40x is removed powerpc: Remove 40x leftovers macintosh/therm_windtunnel: fix module unload. powerpc: Check only single values are passed to CPU/MMU feature checks powerpc/xmon: Fix disassembly CPU feature checks powerpc: Drop clang workaround for builtin constant checks powerpc64/bpf: jit support for signed division and modulo powerpc64/bpf: jit support for sign extended mov powerpc64/bpf: jit support for sign extended load powerpc64/bpf: jit support for unconditional byte swap powerpc64/bpf: jit support for 32bit offset jmp instruction powerpc/pci: Hotplug driver bridge support pci/hotplug/pnv_php: Fix hotplug driver crash on Powernv powerpc/configs: Update defconfig with now user-visible CONFIG_FSL_IFC powerpc: add missing MODULE_DESCRIPTION() macros macintosh/mac_hid: add MODULE_DESCRIPTION() KVM: PPC: add missing MODULE_DESCRIPTION() macros powerpc/kexec: Use of_property_read_reg() powerpc/64s/radix/kfence: map __kfence_pool at page granularity powerpc/pseries/iommu: Define spapr_tce_table_group_ops only with CONFIG_IOMMU_API ... commit a8bd68e4329f9a0ad1b878733e0f80be6a971649 Author: Jason-JH.Lin Date: Thu Jul 18 22:17:04 2024 +0800 mailbox: mtk-cmdq: Move devm_mbox_controller_register() after devm_pm_runtime_enable() When mtk-cmdq unbinds, a WARN_ON message with condition pm_runtime_get_sync() < 0 occurs. According to the call tracei below: cmdq_mbox_shutdown mbox_free_channel mbox_controller_unregister __devm_mbox_controller_unregister ... The root cause can be deduced to be calling pm_runtime_get_sync() after calling pm_runtime_disable() as observed below: 1. CMDQ driver uses devm_mbox_controller_register() in cmdq_probe() to bind the cmdq device to the mbox_controller, so devm_mbox_controller_unregister() will automatically unregister the device bound to the mailbox controller when the device-managed resource is removed. That means devm_mbox_controller_unregister() and cmdq_mbox_shoutdown() will be called after cmdq_remove(). 2. CMDQ driver also uses devm_pm_runtime_enable() in cmdq_probe() after devm_mbox_controller_register(), so that devm_pm_runtime_disable() will be called after cmdq_remove(), but before devm_mbox_controller_unregister(). To fix this problem, cmdq_probe() needs to move devm_mbox_controller_register() after devm_pm_runtime_enable() to make devm_pm_runtime_disable() be called after devm_mbox_controller_unregister(). Fixes: 623a6143a845 ("mailbox: mediatek: Add Mediatek CMDQ driver") Signed-off-by: Jason-JH.Lin Reviewed-by: AngeloGioacchino Del Regno Signed-off-by: Jassi Brar drivers/mailbox/mtk-cmdq-mailbox.c | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-) commit 0e3bb6ee88874fc052a6f7a8eb18463faea0a63d Author: Ben Levinsky Date: Thu Jul 18 13:40:57 2024 -0700 mailbox: zynqmp-ipi: Make polling period configurable There are cases where remote that is acking mailbox message can take longer than the default tx_poll_period value. Therefore, enable this to be mutable. Added tx_poll_period field while inserting the module to set the poll period for ack after sending mailbox message. Signed-off-by: Ben Levinsky Acked-by: Michal Simek Signed-off-by: Jassi Brar drivers/mailbox/zynqmp-ipi-mailbox.c | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-) commit cbf5009580c7c86e9822b3e675df1762ea0a5a0a Author: Arnd Bergmann Date: Fri Jul 19 12:02:23 2024 +0200 mailbox: qcom-cpucp: fix 64BIT dependency This newly added driver fails compile testing on 32-bit architectures because it relies on 64-bit MMIO register access: drivers/mailbox/qcom-cpucp-mbox.c: In function 'qcom_cpucp_mbox_irq_fn': drivers/mailbox/qcom-cpucp-mbox.c:54:18: error: implicit declaration of function 'readq'; did you mean 'readb'? [-Wimplicit-function-declaration] 54 | status = readq(cpucp->rx_base + APSS_CPUCP_RX_MBOX_STAT); | ^~~~~ | readb drivers/mailbox/qcom-cpucp-mbox.c:65:17: error: implicit declaration of function 'writeq'; did you mean 'writeb'? [-Wimplicit-function-declaration] 65 | writeq(BIT(i), cpucp->rx_base + APSS_CPUCP_RX_MBOX_CLEAR); | ^~~~~~ | writeb Change the Kconfig dependency to disallow that configuration as well. Fixes: 0e2a9a03106c ("mailbox: Add support for QTI CPUCP mailbox controller") Signed-off-by: Arnd Bergmann Reviewed-by: Konrad Dybcio Signed-off-by: Jassi Brar drivers/mailbox/Kconfig | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 3f386cb8ee9f04ff4be164ca7a1d0ef3f81f7374 Merge: 8e5c0abfa02d 45659274e608 Author: Linus Torvalds Date: Fri Jul 19 19:03:18 2024 -0700 Merge tag 'pci-v6.11-changes' of git://git.kernel.org/pub/scm/linux/kernel/git/pci/pci Pull pci updates from Bjorn Helgaas: "Enumeration: - Define PCIE_RESET_CONFIG_DEVICE_WAIT_MS for the generic 100ms required after reset before config access (Kevin Xie) - Define PCIE_T_RRS_READY_MS for the generic 100ms required after reset before config access (probably should be unified with PCIE_RESET_CONFIG_DEVICE_WAIT_MS) (Damien Le Moal) Resource management: - Rename find_resource() to find_resource_space() to be more descriptive (Ilpo Järvinen) - Export find_resource_space() for use by PCI core, which needs to learn whether there is available space for a bridge window (Ilpo Järvinen) - Prevent double counting of resources so window size doesn't grow on each remove/rescan cycle (Ilpo Järvinen) - Relax bridge window sizing algorithm so a device doesn't break simply because it was removed and rescanned (Ilpo Järvinen) - Evaluate the ACPI PRESERVE_BOOT_CONFIG _DSM in pci_register_host_bridge() (not acpi_pci_root_create()) so we can unify it with similar DT functionality (Vidya Sagar) - Extend use of DT "linux,pci-probe-only" property so it works per-host bridge as well as globally (Vidya Sagar) - Unify support for ACPI PRESERVE_BOOT_CONFIG _DSM and the DT "linux,pci-probe-only" property in pci_preserve_config() (Vidya Sagar) Driver binding: - Add devres infrastructure for managed request and map of partial BAR resources (Philipp Stanner) - Deprecate pcim_iomap_table() because uses like "pcim_iomap_table()[0]" have no good way to return errors (Philipp Stanner) - Add an always-managed pcim_request_region() for use instead of pci_request_region() and similar, which are sometimes managed depending on whether pcim_enable_device() has been called previously (Philipp Stanner) - Reimplement pcim_set_mwi() so it doesn't need to keep store MWI state (Philipp Stanner) - Add pcim_intx() for use instead of pci_intx(), which is sometimes managed depending on whether pcim_enable_device() has been called previously (Philipp Stanner) - Add managed pcim_iomap_range() to allow mapping of a partial BAR (Philipp Stanner) - Fix a devres mapping leak in drm/vboxvideo (Philipp Stanner) Error handling: - Add missing bridge locking in device reset path and add a warning for other possible lock issues (Dan Williams) - Fix use-after-free on concurrent DPC and hot-removal (Lukas Wunner) Power management: - Disable AER and DPC during suspend to avoid spurious wakeups if they share an interrupt with PME (Kai-Heng Feng) PCIe native device hotplug: - Detect if a device was removed or replaced during system sleep so we don't assume a new device is the one that used to be there (Lukas Wunner) Virtualization: - Add an ACS quirk for Broadcom BCM5760X multi-function NIC; it prevents transactions between functions even though it doesn't advertise ACS, so the functions can be attached individually via VFIO (Ajit Khaparde) Peer-to-peer DMA: - Add a "pci=config_acs=" kernel command-line parameter to relax default ACS settings to enable additional peer-to-peer configurations. Requires expert knowledge of topology and ACS operation (Vidya Sagar) Endpoint framework: - Remove unused struct pci_epf_group.type_group (Christophe JAILLET) - Fix error handling in vpci_scan_bus() and epf_ntb_epc_cleanup() (Dan Carpenter) - Make struct pci_epc_class constant (Greg Kroah-Hartman) - Remove unused pci_endpoint_test_bar_{readl,writel} functions (Jiapeng Chong) - Rename "BME" to "Bus Master Enable" (Manivannan Sadhasivam) - Rename struct pci_epc_event_ops.core_init() callback to epc_init() (Manivannan Sadhasivam) - Move DMA init to MHI .epc_init() callback for uniformity (Manivannan Sadhasivam) - Cancel EPF test delayed work when link goes down (Manivannan Sadhasivam) - Add struct pci_epc_event_ops.epc_deinit() callback for cleanup needed on fundamental reset (Manivannan Sadhasivam) - Add 64KB alignment to endpoint test to support Rockchip rk3588 (Niklas Cassel) - Optimize endpoint test by using memcpy() instead of readl() (Niklas Cassel) Device tree bindings: - Add generic "ats-supported" property to advertise that a PCIe Root Complex supports ATS (Jean-Philippe Brucker) Amazon Annapurna Labs PCIe controller driver: - Validate IORESOURCE_BUS presence to avoid NULL pointer dereference (Aleksandr Mishin) Axis ARTPEC-6 PCIe controller driver: - Rename .cpu_addr_fixup() parameter to reflect that it is a PCI address, not a CPU address (Niklas Cassel) Freescale i.MX6 PCIe controller driver: - Convert to agnostic GPIO API (Andy Shevchenko) Freescale Layerscape PCIe controller driver: - Make struct mobiveil_rp_ops constant (Christophe JAILLET) - Use new generic dw_pcie_ep_linkdown() to handle link-down events (Manivannan Sadhasivam) HiSilicon Kirin PCIe controller driver: - Convert to agnostic GPIO API (Andy Shevchenko) - Use _scoped() iterator for OF children to ensure refcounts are decremented at loop exit (Javier Carrasco) Intel VMD host bridge driver: - Create sysfs "domain" symlink before downstream devices are exposed to userspace by pci_bus_add_devices() (Jiwei Sun) Loongson PCIe controller driver: - Enable MSI when LS7A is used with new CPUs that have integrated PCIe Root Complex, e.g., Loongson-3C6000, so downstream devices can use MSI (Huacai Chen) Microchip AXI PolarFlare PCIe controller driver: - Move pcie-microchip-host.c to a new PLDA directory (Minda Chen) - Factor PLDA generic items out to a common plda,xpressrich3-axi-common.yaml binding (Minda Chen) - Factor PLDA generic data structures and code out to shared pcie-plda.h, pcie-plda-host.c (Minda Chen) - Add PLDA generic interrupt handling with a .request_event_irq() callback for vendor-specific events (Minda Chen) - Add PLDA generic host init/deinit and map bus functions for use by vendor-specific drivers (Minda Chen) - Rework to use PLDA core (Minda Chen) Microsoft Hyper-V host bridge driver: - Return zero, not garbage, when reading PCI_INTERRUPT_PIN (Wei Liu) NVIDIA Tegra194 PCIe controller driver: - Remove unused struct tegra_pcie_soc (Dr. David Alan Gilbert) - Set 64KB inbound ATU alignment restriction (Jon Hunter) Qualcomm PCIe controller driver: - Make the MHI reg region mandatory for X1E80100, since all PCIe controllers have it (Abel Vesa) - Prevent use of uninitialized data and possible error pointer dereference (Dan Carpenter) - Return error, not success, if dev_pm_opp_find_freq_floor() fails (Dan Carpenter) - Add Operating Performance Points (OPP) support to scale performance state based on aggregate link bandwidth to improve SoC power efficiency (Krishna chaitanya chundru) - Vote for the CPU-PCIe ICC (interconnect) path to ensure it stays active even if other drivers don't vote for it (Krishna chaitanya chundru) - Use devm_clk_bulk_get_all() to get all the clocks from DT to avoid writing out all the clock names (Manivannan Sadhasivam) - Add DT binding and driver support for the SA8775P SoC (Mrinmay Sarkar) - Add HDMA support for the SA8775P SoC (Mrinmay Sarkar) - Override the SA8775P NO_SNOOP default to avoid possible memory corruption (Mrinmay Sarkar) - Make sure resources are disabled during PERST# assertion, even if the link is already disabled (Manivannan Sadhasivam) - Use new generic dw_pcie_ep_linkdown() to handle link-down events (Manivannan Sadhasivam) - Add DT and endpoint driver support for the SA8775P SoC (Mrinmay Sarkar) - Add Hyper DMA (HDMA) support for the SA8775P SoC and enable it in the EPF MHI driver (Mrinmay Sarkar) - Set PCIE_PARF_NO_SNOOP_OVERIDE to override the default NO_SNOOP attribute on the SA8775P SoC (both Root Complex and Endpoint mode) to avoid possible memory corruption (Mrinmay Sarkar) Renesas R-Car PCIe controller driver: - Demote WARN() to dev_warn_ratelimited() in rcar_pcie_wakeup() to avoid unnecessary backtrace (Marek Vasut) - Add DT and driver support for R-Car V4H (R8A779G0) host and endpoint. This requires separate proprietary firmware (Yoshihiro Shimoda) Rockchip PCIe controller driver: - Assert PERST# for 100ms after power is stable (Damien Le Moal) - Wait PCIE_T_RRS_READY_MS (100ms) after reset before starting configuration (Damien Le Moal) - Use GPIOD_OUT_LOW flag while requesting ep_gpio to fix a firmware crash on Qcom-based modems with Rockpro64 board (Manivannan Sadhasivam) Rockchip DesignWare PCIe controller driver: - Factor common parts of rockchip-dw-pcie DT binding to be shared by Root Complex and Endpoint mode (Niklas Cassel) - Add missing INTx signals to common DT binding (Niklas Cassel) - Add eDMA items to DT binding for Endpoint controller (Niklas Cassel) - Fix initial dw-rockchip PERST# GPIO value to prevent unnecessary short assert/deassert that causes issues with some WLAN controllers (Niklas Cassel) - Refactor dw-rockchip and add support for Endpoint mode (Niklas Cassel) - Call pci_epc_init_notify() and drop dw_pcie_ep_init_notify() wrapper (Niklas Cassel) - Add error messages in .probe() error paths to improve user experience (Uwe Kleine-König) Samsung Exynos PCIe controller driver: - Use bulk clock APIs to simplify clock setup (Shradha Todi) StarFive PCIe controller driver: - Add DT binding and driver support for the StarFive JH7110 PLDA-based PCIe controller (Minda Chen) Synopsys DesignWare PCIe controller driver: - Add generic support for sending PME_Turn_Off when system suspends (Frank Li) - Fix incorrect interpretation of iATU slot 0 after PERST# assert/deassert (Frank Li) - Use msleep() instead of usleep_range() while waiting for link (Konrad Dybcio) - Refactor dw_pcie_edma_find_chip() to enable adding support for Hyper DMA (HDMA) (Manivannan Sadhasivam) - Enable drivers to supply the eDMA channel count since some can't auto detect this (Manivannan Sadhasivam) - Call pci_epc_init_notify() and drop dw_pcie_ep_init_notify() wrapper (Manivannan Sadhasivam) - Pass the eDMA mapping format directly from drivers instead of maintaining a capability for it (Manivannan Sadhasivam) - Add generic dw_pcie_ep_linkdown() to notify EPF drivers about link-down events and restore non-sticky DWC registers lost on link down (Manivannan Sadhasivam) - Add vendor-specific "apb" reg name, interrupt names, INTx names to generic binding (Niklas Cassel) - Enforce DWC restriction that 64-bit BARs must start with an even-numbered BAR (Niklas Cassel) - Consolidate args of dw_pcie_prog_outbound_atu() into a structure (Yoshihiro Shimoda) - Add support for endpoints to send Message TLPs, e.g., for INTx emulation (Yoshihiro Shimoda) TI DRA7xx PCIe controller driver: - Rename .cpu_addr_fixup() parameter to reflect that it is a PCI address, not a CPU address (Niklas Cassel) TI Keystone PCIe controller driver: - Validate IORESOURCE_BUS presence to avoid NULL pointer dereference (Aleksandr Mishin) - Work around AM65x/DRA80xM Errata #i2037 that corrupts TLPs and causes processor hangs by limiting Max_Read_Request_Size (MRRS) and Max_Payload_Size (MPS) (Kishon Vijay Abraham I) - Leave BAR 0 disabled for AM654x to fix a regression caused by 6ab15b5e7057 ("PCI: dwc: keystone: Convert .scan_bus() callback to use add_bus"), which caused a 45-second boot delay (Siddharth Vadapalli) Xilinx Versal CPM PCIe controller driver: - Fix overlapping bridge registers and 32-bit BAR addresses in DT binding (Thippeswamy Havalige) MicroSemi Switchtec management driver: - Make struct switchtec_class constant (Greg Kroah-Hartman) Miscellaneous: - Remove unused struct acpi_handle_node (Dr. David Alan Gilbert) - Add missing MODULE_DESCRIPTION() macros (Jeff Johnson)" * tag 'pci-v6.11-changes' of git://git.kernel.org/pub/scm/linux/kernel/git/pci/pci: (154 commits) PCI: loongson: Enable MSI in LS7A Root Complex PCI: Extend ACS configurability PCI: Add missing bridge lock to pci_bus_lock() drm/vboxvideo: fix mapping leaks PCI: Add managed pcim_iomap_range() PCI: Remove legacy pcim_release() PCI: Add managed pcim_intx() PCI: vmd: Create domain symlink before pci_bus_add_devices() PCI: qcom: Prevent use of uninitialized data in qcom_pcie_suspend_noirq() PCI: qcom: Prevent potential error pointer dereference PCI: qcom: Fix missing error code in qcom_pcie_probe() PCI: Give pcim_set_mwi() its own devres cleanup callback PCI: Move struct pci_devres.pinned bit to struct pci_dev PCI: Remove struct pci_devres.enabled status bit PCI: Document hybrid devres hazards PCI: Add managed pcim_request_region() PCI: Deprecate pcim_iomap_table(), pcim_iomap_regions_request_all() PCI: Add managed partial-BAR request and map infrastructure PCI: Add devres helpers for iomap table PCI: Add and use devres helper for bit masks ... commit 8f3075cc680c232590ca4e2ef39ebaf1e887a52e Author: Thomas Weißschuh Date: Tue Jul 9 19:35:35 2024 +0200 i2c: smbus: remove i801 assumptions from SPD probing The check and warning are very specific to the SPD usage of the i801 driver. That was fine as long as i801 was the only caller of i2c_register_spd(). Now that piix4 will be added as another user of that function, the check and warning are not accurate anymore. Instead of introducing a more complicated calling protocol only to print a warning, drop the warning. Even in cases where not all slots can be probed, then at least probe the 8 slots that can be. Signed-off-by: Thomas Weißschuh Reviewed-by: Heiner Kallweit Signed-off-by: Andi Shyti drivers/i2c/i2c-smbus.c | 15 ++++----------- 1 file changed, 4 insertions(+), 11 deletions(-) commit 45b8ee7182d5ef8df6959297046f86dc128d6a06 Author: Bastien Curutchet Date: Mon Jun 17 14:08:18 2024 +0200 i2c: mux: gpio: Add support for the 'settle-time-us' property Some hardware need some time to switch from a bus to another. This can cause the first transfers following the selection of a bus to fail. There is no way to configure this kind of waiting time in the driver. Add support for the 'settle-time-us' device-tree property. When set, the i2c_mux_gpio_select() applies a delay before returning, leaving enough time to the hardware to switch to the new bus. Signed-off-by: Bastien Curutchet Reviewed-by: Andi Shyti Acked-by: Peter Rosin Signed-off-by: Andi Shyti drivers/i2c/muxes/i2c-mux-gpio.c | 6 ++++++ include/linux/platform_data/i2c-mux-gpio.h | 2 ++ 2 files changed, 8 insertions(+) commit a618d86d5a1cf1ac6edbbe0e2b29649afb3decf0 Author: Bastien Curutchet Date: Mon Jun 17 14:08:17 2024 +0200 i2c: mux: gpio: Re-order #include to match alphabetic order The #includes don't match alphabetic order. Re-order #includes to match the alphabetic order before adding a new one. Signed-off-by: Bastien Curutchet Reviewed-by: Andi Shyti Acked-by: Peter Rosin Signed-off-by: Andi Shyti drivers/i2c/muxes/i2c-mux-gpio.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) commit dc53dbe3e79008ca7c1bc5e5ae2c71b52161f96d Author: Bastien Curutchet Date: Mon Jun 17 14:08:16 2024 +0200 dt-bindings: i2c: mux-gpio: Add 'settle-time-us' property I2C MUXes described by the i2c-gpio-mux sometimes need a significant amount of time to switch from a bus to another. When a new bus is selected, the first I2C transfer can fail if it occurs too early. There is no way to describe this transition delay that has to be waited before starting the first I2C transfer. Add a 'settle-time-us' property that indicates the delay to be respected before doing the first i2c transfer. Signed-off-by: Bastien Curutchet Reviewed-by: Krzysztof Kozlowski Reviewed-by: Andi Shyti Acked-by: Peter Rosin Signed-off-by: Andi Shyti Documentation/devicetree/bindings/i2c/i2c-mux-gpio.yaml | 3 +++ 1 file changed, 3 insertions(+) commit 064e911392177e8c39e395f748fb4ae8ffb18e92 Author: Vladimir Zapolskiy Date: Thu Jun 13 00:58:33 2024 +0300 dt-bindings: i2c: qcom-cci: Document sm8650 compatible Add sm8650 compatible consistent with CAMSS CCI interfaces. Signed-off-by: Vladimir Zapolskiy Reviewed-by: Krzysztof Kozlowski Signed-off-by: Andi Shyti Documentation/devicetree/bindings/i2c/qcom,i2c-cci.yaml | 2 ++ 1 file changed, 2 insertions(+) commit 8c4ff24d7cc84432a9f1055ef57e4c86706b38c7 Author: Vladimir Zapolskiy Date: Thu Jun 13 00:58:32 2024 +0300 dt-bindings: i2c: qcom-cci: Document sm8550 compatible Add sm8550 compatible consistent with CAMSS CCI interfaces, the list of clocks is reduced by removing "slow_ahb_src" clock, which is derived from "cpas_ahb" clock. Signed-off-by: Vladimir Zapolskiy Reviewed-by: Krzysztof Kozlowski Signed-off-by: Andi Shyti .../devicetree/bindings/i2c/qcom,i2c-cci.yaml | 18 ++++++++++++++++++ 1 file changed, 18 insertions(+) commit 8e5c0abfa02d85b9cd2419567ad2d73ed8fe4b74 Merge: ef035628c326 a23e19669324 Author: Linus Torvalds Date: Fri Jul 19 16:51:39 2024 -0700 Merge tag 'input-for-v6.11-rc0' of git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input Pull input updates from Dmitry Torokhov: - streamlined logic in input core for handling normal input handlers vs input filters - updates to input drivers to allocate memory with sizeof(*pointer) instead of sizeof(type) - change to ads7846 touchscreen driver to use hsync GPIO instead of requiring platform data with special method (which is not compatible with boards using device tree) - update to adc-joystick driver to handle inverted axes - cleanups in various drivers switching them to use the new "guard" and "__free()" facilities - changes to several drivers (adxl34x, atmel_mxt_ts, ati-remote2, omap-keypad, yealink) to stop creating driver-specific device attributes manually and use driver core facilities for this - update to Cypress PS/2 protocol driver to properly handle errors from the PS/2 transport as well as other cleanups - update to edt-ft5x06 driver to support ft5426 variant - update to ektf2127 driver to support ektf2232 variant - update to exc3000 driver to support EXC81W32 variant - update to imagis driver to support IST3038 variant - other assorted driver cleanups. * tag 'input-for-v6.11-rc0' of git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input: (71 commits) Input: yealink - simplify locking in sysfs attribute handling Input: yealink - use driver core to instantiate device attributes Input: ati-remote2 - use driver core to instantiate device attributes Input: omap-keypad - use driver core to instantiate device attributes Input: atmel_mxt_ts - use driver core to instantiate device attributes Input: exc3000 - add EXC81W32 support dt-bindings: input: touchscreen: exc3000: add EXC81W32 Input: twl4030-pwrbutton - fix kernel-doc warning Input: himax_hx83112b - add support for HX83100A Input: himax_hx83112b - add himax_chip struct for multi-chip support Input: himax_hx83112b - implement MCU register reading Input: himax_hx83112b - use more descriptive register defines dt-bindings: input: touchscreen: himax,hx83112b: add HX83100A Input: do not check number of events in input_pass_values() Input: preallocate memory to hold event values Input: rearrange input_alloc_device() to prepare for preallocating of vals Input: simplify event handling logic Input: make events() method return number of events processed Input: make sure input handlers define only one processing method Input: evdev - remove ->event() method ... commit ef035628c326af9aa645af1b91fbb72fdfec874e Merge: acc5965b9ff8 5d89b5bdbce3 Author: Linus Torvalds Date: Fri Jul 19 16:46:26 2024 -0700 Merge tag 'i2c-for-6.11-rc1-try2' of git://git.kernel.org/pub/scm/linux/kernel/git/wsa/linux Pull i2c fixes from Wolfram Sang: "The I2C core gains documentation updates for the testunit, a cleanup regarding unneeded 'driver_data' and more sanity checks in the char device. For the host drivers, this release includes significant updates, with the primary change being the renaming from "master/slave" to "controller/target" to adhere to I2C v7 and SMBus 3.2 standards. New Support: - Added support for Intel Arrow Lake-H - Added I2C support in the Arioha SoC by linking the Mediatek I2C controller Cleanups: - Added the MODULE_DESCRIPTION() macro, resolving a modpost warning in the ALi 1563 Southbridge driver. - Constified the regmap_config declaration in the i2c-designware driver. - Improved the coding style in the Renesas R-Car driver by removing unnecessary semicolons after brackets. General improvements: - In the OMAP device, replaced NOIRQ_SYSTEM_SLEEP_PM_OPS with RUNTIME_PM_OPS to enable waking up the controller during suspend() before suspend_noirq() kicks in. - Improved logging in the Xilinx driver. - Added a warning (WARN()) in the Renesas R-Car driver for spurious interrupts. DTS Changes: - Removed address-cell and size-cell from the Atmel at91sam, nVidia Tegra 20, and Samsung S3c2410 devices. - Fixed Texas Instruments OMAP4 I2C controller to comply with the i2c-controller.yaml schema. - Improved indentation in DTS examples for several I2C devices. - Converted the NXP LPC1788 binding to the dt-schema. - Added documentation for the compatible string thead,th1520-i2c. - Added the "power-domains" property for the Meson I2C driver. AT24 EEPROM driver changes: - add support for two new Microchip models - document even more new models in DT bindings (those use fallback compatibles so no code changes)" * tag 'i2c-for-6.11-rc1-try2' of git://git.kernel.org/pub/scm/linux/kernel/git/wsa/linux: (87 commits) i2c: document new callbacks in i2c_algorithm dt-bindings: i2c: amlogic,meson6-i2c: add optional power-domains dt-bindings: i2c: at91: Add sama7d65 compatible string i2c: st: reword according to newest specification i2c: cpm: reword according to newest specification i2c: virtio: reword according to newest specification i2c: nvidia-gpu: reword according to newest specification i2c: viai2c: reword according to newest specification i2c: viperboard: reword according to newest specification i2c: uniphier: reword according to newest specification i2c: uniphier-f: reword according to newest specification i2c: tiny-usb: reword according to newest specification i2c: thunderx-pcidrv: reword according to newest specification i2c: tegra-bpmp: reword according to newest specification i2c: taos-evm: reword according to newest specification i2c: sun6i-p2wi: reword according to newest specification i2c: stm32f4: reword according to newest specification i2c: sprd: reword according to newest specification i2c: sis5595: reword according to newest specification i2c: rzv2m: reword according to newest specification ... commit acc5965b9ff8a1889f5b51466562896d59c6e1b9 Merge: 09ea8089abb5 5418e6dfc905 Author: Linus Torvalds Date: Fri Jul 19 15:55:08 2024 -0700 Merge tag 'char-misc-6.11-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc Pull char / misc and other driver updates from Greg KH: "Here is the "big" set of char/misc and other driver subsystem changes for 6.11-rc1. Nothing major in here, just loads of new drivers and updates. Included in here are: - IIO api updates and new drivers added - wait_interruptable_timeout() api cleanups for some drivers - MODULE_DESCRIPTION() additions for loads of drivers - parport out-of-bounds fix - interconnect driver updates and additions - mhi driver updates and additions - w1 driver fixes - binder speedups and fixes - eeprom driver updates - coresight driver updates - counter driver update - new misc driver additions - other minor api updates All of these, EXCEPT for the final Kconfig build fix for 32bit systems, have been in linux-next for a while with no reported issues. The Kconfig fixup went in 29 hours ago, so might have missed the latest linux-next, but was acked by everyone involved" * tag 'char-misc-6.11-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc: (330 commits) misc: Kconfig: exclude mrvl-cn10k-dpi compilation for 32-bit systems misc: delete Makefile.rej binder: fix hang of unregistered readers misc: Kconfig: add a new dependency for MARVELL_CN10K_DPI virtio: add missing MODULE_DESCRIPTION() macro agp: uninorth: add missing MODULE_DESCRIPTION() macro spmi: add missing MODULE_DESCRIPTION() macros dev/parport: fix the array out-of-bounds risk samples: configfs: add missing MODULE_DESCRIPTION() macro misc: mrvl-cn10k-dpi: add Octeon CN10K DPI administrative driver misc: keba: Fix missing AUXILIARY_BUS dependency slimbus: Fix struct and documentation alignment in stream.c MAINTAINERS: CC dri-devel list on Qualcomm FastRPC patches misc: fastrpc: use coherent pool for untranslated Compute Banks misc: fastrpc: support complete DMA pool access to the DSP misc: fastrpc: add missing MODULE_DESCRIPTION() macro misc: fastrpc: Add missing dev_err newlines misc: fastrpc: Use memdup_user() nvmem: core: Implement force_ro sysfs attribute nvmem: Use sysfs_emit() for type attribute ... commit 09ea8089abb5d851ce08a9b1a43706e42ef39db2 Merge: 04d17331ca33 104e004739ef Author: Linus Torvalds Date: Fri Jul 19 15:46:29 2024 -0700 Merge tag 'staging-6.11-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/staging Pull staging driver updates from Greg KH: "This is the "big" staging driver update for 6.11-rc1. Not really all that much happened this release cycle, just lots of tiny cleanups, overall about 3000 lines removed, so the cleanups were worth it. Included in here are: - loads of rtl8723bs driver cleanups - lots of rtl8192e driver cleanups - vc04_services reworks and cleanups as that codebase gets slowly evolved into something that will make it into the "real" part of the kernel hopefully soon. - other tiny staging driver cleanups All of these have been in linux-next for a while with no reported issues" * tag 'staging-6.11-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/staging: (124 commits) staging: rtl8723bs: Remove constant result function CheckNegative() staging: rtl8723bs: Remove unused macros in rtw_mlme_ext.h staging: rtl8723bs: Remove unused macros in hal_pwr_seq.h staging: rtl8723bs: Remove unused macros in rtw_efuse.h staging: rtl8723bs: Remove unused macros in rtw_mlme.h staging: rtl8723bs: Remove unused macros in HalPwrSeqCmd.h staging: rtl8723bs: Remove unused macros in Hal8723BReg.h staging: rtl8723bs: Remove unused macros in Hal8192CPhyReg.h staging: rtl8723bs: Delete file hal_phy_reg_8723b.h staging: rtl8723bs: Move last macro from hal_phy_reg_8723b.h staging: rtl8723bs: Remove unused macros in hal_phy_reg_8723b.h staging: rtl8723bs: Remove unused macros in hal_com_reg.h staging: rtl8723bs: Remove unused macros in rtw_ht.h staging: rtl8723bs: Remove unused macros in hal_com_h2c.h staging: vc04_services: vchiq_core: Stop kthreads on vchiq module unload staging: vchiq_core: Bubble up wait_event_interruptible() return value staging: nvec: Use x instead of x != NULL to improve readability. staging: rtl8192e: Fix conflicting types error with net_device. staging: rtl8723bs: Remove unused variable pwdev_priv staging: vc04_services: Update testing instructions ... commit 04d17331ca33744e1426fdeee7ba5e975c4b2239 Merge: aba9753c0677 b72749301112 Author: Linus Torvalds Date: Fri Jul 19 15:37:48 2024 -0700 Merge tag 'usb-6.11-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb Pull USB / Thunderbolt updates from Greg KH: "Here is the big set of USB and Thunderbolt changes for 6.11-rc1. Nothing earth-shattering in here, just constant forward progress in adding support for new hardware and better debugging functionalities for thunderbolt devices and the subsystem. Included in here are: - thunderbolt debugging update and driver additions - xhci driver updates - typec driver updates - kselftest device driver changes (acked by the relevant maintainers, depended on other changes in this tree.) - cdns3 driver updates - gadget driver updates - MODULE_DESCRIPTION() additions - dwc3 driver updates and fixes All of these have been in linux-next for a while with no reported issues" * tag 'usb-6.11-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb: (112 commits) kselftest: devices: Add test to detect device error logs kselftest: Move ksft helper module to common directory kselftest: devices: Move discoverable devices test to subdirectory usb: gadget: f_uac2: fix non-newline-terminated function name USB: uas: Implement the new shutdown callback USB: core: add 'shutdown' callback to usb_driver usb: typec: Drop explicit initialization of struct i2c_device_id::driver_data to 0 usb: dwc3: enable CCI support for AMD-xilinx DWC3 controller usb: dwc2: add support for other Lantiq SoCs usb: gadget: Use u16 types for 16-bit fields usb: gadget: midi2: Fix incorrect default MIDI2 protocol setup usb: dwc3: core: Check all ports when set phy suspend usb: typec: tcpci: add support to set connector orientation dt-bindings: usb: Convert fsl-usb to yaml usb: typec: ucsi: reorder operations in ucsi_run_command() usb: typec: ucsi: extract common code for command handling usb: typec: ucsi: inline ucsi_read_message_in usb: typec: ucsi: rework command execution functions usb: typec: ucsi: split read operation usb: typec: ucsi: simplify command sending API ... commit aba9753c0677e860f982edff98c7fe5a2b97758c Merge: d7e78951a8b8 17199dfccd4b Author: Linus Torvalds Date: Fri Jul 19 15:22:14 2024 -0700 Merge tag 'tty-6.11-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/tty Pull tty / serial updates from Greg KH: "Here is a small set of tty and serial driver updates for 6.11-rc1. Not much happened this cycle, unlike the previous kernel release which had lots of "excitement" in this part of the kernel. Included in here are the following changes: - dt binding updates for new platforms - 8250 driver updates - various small serial driver fixes and updates - printk/console naming and matching attempt #2 (was reverted for 6.10-final, should be good to go this time around, acked by the relevant maintainers). All of these have been in linux-next for a while with no reported issues" * tag 'tty-6.11-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/tty: (22 commits) Documentation: kernel-parameters: Add DEVNAME:0.0 format for serial ports serial: core: Add serial_base_match_and_update_preferred_console() printk: Add match_devname_and_update_preferred_console() serial: sc16is7xx: hardware reset chip if reset-gpios is defined in DT dt-bindings: serial: sc16is7xx: add reset-gpios dt-bindings: serial: vt8500-uart: convert to json-schema serial: 8250_platform: Explicitly show we initialise ISA ports only once tty: add missing MODULE_DESCRIPTION() macros dt-bindings: serial: mediatek,uart: add MT7988 serial: sh-sci: Add support for RZ/V2H(P) SoC dt-bindings: serial: Add documentation for Renesas RZ/V2H(P) (R9A09G057) SCIF support dt-bindings: serial: renesas,scif: Make 'interrupt-names' property as required dt-bindings: serial: renesas,scif: Validate 'interrupts' and 'interrupt-names' dt-bindings: serial: renesas,scif: Move ref for serial.yaml at the end riscv: dts: starfive: jh7110: Add the core reset and jh7110 compatible for uarts serial: 8250_dw: Use reset array API to get resets dt-bindings: serial: snps-dw-apb-uart: Add one more reset signal for StarFive JH7110 SoC serial: 8250: Extract platform driver serial: 8250: Extract RSA bits serial: imx: stop casting struct uart_port to struct imx_port ... commit d7e78951a8b8b53e4d52c689d927a6887e6cfadf Merge: 53a5182c8a68 4359836129d9 Author: Linus Torvalds Date: Fri Jul 19 14:58:12 2024 -0700 Merge tag 'net-6.11-rc0' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net Pull networking fixes from Paolo Abeni: "Including fixes from netfilter. Notably this includes fixes for a s390 build breakage. Current release - new code bugs: - eth: fbnic: fix s390 build - eth: airoha: fix NULL pointer dereference in airoha_qdma_cleanup_rx_queue() Previous releases - regressions: - flow_dissector: use DEBUG_NET_WARN_ON_ONCE - ipv4: fix incorrect TOS in route get reply - dsa: fix chip-wide frame size config in some drivers Previous releases - always broken: - netfilter: nf_set_pipapo: fix initial map fill - eth: gve: fix XDP TX completion handling when counters overflow" * tag 'net-6.11-rc0' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net: eth: fbnic: don't build the driver when skb has more than 21 frags net: dsa: b53: Limit chip-wide jumbo frame config to CPU ports net: dsa: mv88e6xxx: Limit chip-wide frame size config to CPU ports net: airoha: Fix NULL pointer dereference in airoha_qdma_cleanup_rx_queue() net: wwan: t7xx: add support for Dell DW5933e ipv4: Fix incorrect TOS in fibmatch route get reply ipv4: Fix incorrect TOS in route get reply net: flow_dissector: use DEBUG_NET_WARN_ON_ONCE driver core: auxiliary bus: Fix documentation of auxiliary_device net: airoha: fix error branch in airoha_dev_xmit and airoha_set_gdm_ports gve: Fix XDP TX completion handling when counters overflow ipvs: properly dereference pe in ip_vs_add_service selftests: netfilter: add test case for recent mismatch bug netfilter: nf_set_pipapo: fix initial map fill netfilter: ctnetlink: use helper function to calculate expect ID eth: fbnic: fix s390 build. commit 53a5182c8a6805d3096336709ba5790d16f8c369 Merge: 33cf09877093 c3ece6b7ffb4 Author: Linus Torvalds Date: Fri Jul 19 14:34:52 2024 -0700 Merge tag 'for-6.11-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/kdave/linux Pull btrfs fix from David Sterba: "A fix for build breakage on 32bit platforms" * tag 'for-6.11-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/kdave/linux: btrfs: change BTRFS_MOUNT_* flags to 64bit type commit 33cf098770930a9b782d3983e1b0127bdc203216 Merge: 9c67f9084af3 5c28424e9a34 Author: Linus Torvalds Date: Fri Jul 19 14:33:30 2024 -0700 Merge tag 'probes-fixes-v6.11-pre-rc' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace Pull uprobe fix from Masami Hiramatsu: - Add sys_uretprobe entry to scripts/syscall.tbl. * tag 'probes-fixes-v6.11-pre-rc' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace: syscalls: Fix to add sys_uretprobe to syscall.tbl commit 9c67f9084af3f84e63abb44b82316fe0dbccd5d5 Merge: 12cc3d5389f3 1a8c67a8b21e Author: Linus Torvalds Date: Fri Jul 19 14:31:18 2024 -0700 Merge tag 'pwrseq-fixes-for-v6.11-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/brgl/linux Pull power sequencing fixes from Bartosz Golaszewski: "There's one fix for an invalid pointer dereference in error path reported by smatch and two patches that address the noisy config choices you reported earlier this week. Summary: - fix an invalid pointer dereference in error path in pwrseq core - reduce the Kconfig noise from PCI pwrctl choices" * tag 'pwrseq-fixes-for-v6.11-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/brgl/linux: arm64: qcom: don't select HAVE_PWRCTL when PCI=n Kconfig: reduce the amount of power sequencing noise power: sequencing: fix an invalid pointer dereference in error path commit 12cc3d5389f313f07222b000fefa2cd8fc98c4f8 Merge: a4f928552058 4594d26fca91 Author: Linus Torvalds Date: Fri Jul 19 12:39:34 2024 -0700 Merge tag 'sound-6.11-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound Pull sound updates from Takashi Iwai: "Lots of changes in this cycle, but mostly for cleanups and refactoring. Significant amount of changes are about DT schema conversions for ASoC at this time while we see other usual suspects, too. Some highlights below: Core: - Re-introduction of PCM sync ID support API - MIDI2 time-base extension in ALSA sequencer API ASoC: - Syncing of features between simple-audio-card and the two audio-graph cards - Support for specifying the order of operations for components within cards to allow quirking for unusual systems - Lots of DT schema conversions - Continued SOF/Intel updates for topology, SoundWire, IPC3/4 - New support for Asahi Kasei AK4619, Cirrus Logic CS530x, Everest Semiconductors ES8311, NXP i.MX95 and LPC32xx, Qualcomm LPASS v2.5 and WCD937x, Realtek RT1318 and RT1320 and Texas Instruments PCM5242 HD-audio: - More quirks, Intel PantherLake support, senarytech codec support - Refactoring of Cirrus codec component-binding Others: - ALSA control kselftest improvements, and fixes for input value checks in various drivers" * tag 'sound-6.11-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound: (349 commits) kselftest/alsa: Log the PCM ID in pcm-test kselftest/alsa: Use card name rather than number in test names ALSA: hda/realtek: Fix the speaker output on Samsung Galaxy Book Pro 360 ALSA: hda/tas2781: Add new quirk for Lenovo Hera2 Laptop ALSA: seq: ump: Skip useless ports for static blocks ALSA: pcm_dmaengine: Don't synchronize DMA channel when DMA is paused ALSA: usb: Use BIT() for bit values ALSA: usb: Fix UBSAN warning in parse_audio_unit() ALSA: hda/realtek: Enable headset mic on Positivo SU C1400 ASoC: tas2781: Add new Kontrol to set tas2563 digital Volume ASoC: codecs: wcd937x: Remove separate handling for vdd-buck supply ASoC: codecs: wcd937x: Remove the string compare in MIC BIAS widget settings ASoC: codecs: wcd937x-sdw: Fix Unbalanced pm_runtime_enable ASoC: dt-bindings: cirrus,cs42xx8: Convert to dtschema ASoC: cs530x: Remove bclk from private structure ASoC: cs530x: Calculate proper bclk rate using TDM ASoC: dt-bindings: cirrus,cs4270: Convert to dtschema firmware: cs_dsp: Rename fw_ver to wmfw_ver firmware: cs_dsp: Clarify wmfw format version log message firmware: cs_dsp: Make wmfw and bin filename arguments const char * ... commit a4f9285520584977127946a22eab2adfbc87d1bf Merge: f4f92db43912 589eb11498fb Author: Linus Torvalds Date: Fri Jul 19 12:16:28 2024 -0700 Merge tag 'clk-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/clk/linux Pull clk updates from Stephen Boyd: "This a large collection of clk driver updates and a handful of new SoC clk driver support. We have the usual Qualcomm clk drivers, along with clk drivers for the Sophgo and T-Head vendors, all to support some new SoCs. Nothing in particular stands out to me in the updates. There's the interconnect clk driver which exposes clks as interconnects, crossing subsystems. There's a bunch of janitorial things that are improving drivers in general like kmemdup_array() or fixing error paths. But overall the updates look normal to fix the description data which is usually the stuff that's wrong and/or untested. Core: - Skip gate basic type KUnit tests on s390 due to lack of MMIO emulation New Drivers: - AP sub-system clock controller in the T-Head TH1520 - Sophgo Sophon sg2042 clk driver - Qualcomm SM7150 camera, display and video clk drivers - Qualcomm QCM2290 GPU clk driver - Qualcomm QCS8386/QCS8084 NSS clk driver - Qualcomm SM8650 camera and video drivers Updates: - Add reset support to Airoha EN7581 clk driver - Add MODULE_DESCRIPTIONs to various clk drivers - Introduce helper logic to expose clock controllers as simple interconnect providers - Use the interconnect helper above on Qualcomm ipq9574 - Add CLK_SET_RATE_PARENT to the remaining USB pipe clocks on Qualcomm X1Elite - Improve error handling in Qualcomm kpss-xcc driver - Mark Qualcomm SC8280XP LPASS clock controller regmap_config const - Export more clocks for Rockchip rk3128 peripherals - Convert Rockchip clk drivers to use kmemdup_array() - Drop CLK_NR_CLKS from Rockchip rk3128 and rk3188 binding headers - Make qcom_cc_really_probe() take a struct device to allow reuse in non-platform-drivers - Introduce prepare-only branch clock ops in the qcom clk driver to support clocks on buses that take locks - Describe parent/child relationship for Qualcomm SC7280 camera GDSCs - Support Qualcomm Huayra 2290 alpha PLL - Adjust the highest SDCC clock frequency on Qualcomm IPQ6018 to match HS200 support - Add missing PCIe PIPE clocks on Qualcomm IPQ9574 - Fix various configurations and properties in the Qualcomm SA8775P, X1E80100 and SM7280 drivers - Park Qualcomm SM8350 GPU RCGs on XO while disabled - Remove unused CONFIG_QCOM_RPMCC Kconfig symbol - exynos-clkout: Remove usage of of_device_id table as .of_match_table, because the driver is instantiated as MFD cell, not as standalone platform driver. Populated .of_match_table confused people few times to convert the code to device_get_match_data(), which broke the driver - Mark one Samsung UFS clock as critical, because having it off stops the system from shutdown - Use kmemdup_array() when applicable - Remove unused 'struct gates_data' from old sunxi driver library - Add GPADC clock and reset for Allwinner H616 - Minor Amlogic S4 clock fixes - DT bindings Yaml conversion of the Amlogic AXG audio controller - Amlogic C3 clock controllers support - Amlogic clk flag added to skip init of already enabled PLLs and avoid relocking - Amlogic A1 DT bindings updates for system pll support - Add missing MODULE_DESCRIPTION where necessary - Remove obsolete clock DT binding header files - Add Battery Backup (VBATTB) and I2C clocks, resets, and power domains on Renesas RZ/G3S - Add audio clocks on Renesas R-Car V4M - Add video capture (ISPCS, CSI-2, VIN) clocks on Renesas R-Car V4M" * tag 'clk-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/clk/linux: (135 commits) clk: thead: Add support for T-Head TH1520 AP_SUBSYS clocks dt-bindings: clock: Document T-Head TH1520 AP_SUBSYS controller clk: sophgo: Avoid -Wsometimes-uninitialized in sg2042_clk_pll_set_rate() clk/sophgo: Using BUG() instead of unreachable() in mmux_get_parent_id() clk: mxs: Use clamp() in clk_ref_round_rate() and clk_ref_set_rate() clk: sunxi-ng r40: Constify struct regmap_config clk: en7523: fix rate divider for slic and spi clocks clk: lpc32xx: Constify struct regmap_config clk: xilinx: Constify struct regmap_config clk: en7523: Remove PCIe reset open drain configuration for EN7581 clk: en7523: Remove pcie prepare/unpreare callbacks for EN7581 SoC clk: en7523: Add reset-controller support for EN7581 SoC dt-bindings: clock: airoha: Add reset support to EN7581 clock binding dt-bindings: clock: mediatek: Document reset cells for MT8188 sys clk: mediatek: mt8173-infracfg: Handle unallocated infracfg when module dt-bindings: clock: mediatek: add syscon compatible for mt7622 pciesys dt-bindings: clock: sprd,sc9860-clk: convert to YAML dt-bindings: clock: qoriq-clock: convert to yaml format clk: qcom: Park shared RCGs upon registration clk: qcom: ipq9574: Use icc-clk for enabling NoC related clocks ... commit f4f92db4391285ef3a688cdad25d5c76db200a30 Merge: f66b07c56119 6c85d6b653ca Author: Linus Torvalds Date: Fri Jul 19 11:57:55 2024 -0700 Merge tag 'for_linus' of git://git.kernel.org/pub/scm/linux/kernel/git/mst/vhost Pull virtio updates from Michael Tsirkin: "Several new features here: - Virtio find vqs API has been reworked (required to fix the scalability issue we have with adminq, which I hope to merge later in the cycle) - vDPA driver for Marvell OCTEON - virtio fs performance improvement - mlx5 migration speedups Fixes, cleanups all over the place" * tag 'for_linus' of git://git.kernel.org/pub/scm/linux/kernel/git/mst/vhost: (56 commits) virtio: rename virtio_find_vqs_info() to virtio_find_vqs() virtio: remove unused virtio_find_vqs() and virtio_find_vqs_ctx() helpers virtio: convert the rest virtio_find_vqs() users to virtio_find_vqs_info() virtio_balloon: convert to use virtio_find_vqs_info() virtiofs: convert to use virtio_find_vqs_info() scsi: virtio_scsi: convert to use virtio_find_vqs_info() virtio_net: convert to use virtio_find_vqs_info() virtio_crypto: convert to use virtio_find_vqs_info() virtio_console: convert to use virtio_find_vqs_info() virtio_blk: convert to use virtio_find_vqs_info() virtio: rename find_vqs_info() op to find_vqs() virtio: remove the original find_vqs() op virtio: call virtio_find_vqs_info() from virtio_find_single_vq() directly virtio: convert find_vqs() op implementations to find_vqs_info() virtio_pci: convert vp_*find_vqs() ops to find_vqs_info() virtio: introduce virtio_queue_info struct and find_vqs_info() config op virtio: make virtio_find_single_vq() call virtio_find_vqs() virtio: make virtio_find_vqs() call virtio_find_vqs_ctx() caif_virtio: use virtio_find_single_vq() for single virtqueue finding vdpa/mlx5: Don't enable non-active VQs in .set_vq_ready() ... commit f66b07c56119833b88bffa4ecaf9f983834675de Merge: 4305ca0087dd 0756bec2e45b Author: Linus Torvalds Date: Fri Jul 19 11:53:09 2024 -0700 Merge tag 'vfio-v6.11-rc1' of https://github.com/awilliam/linux-vfio Pull VFIO updates from Alex Williamson: - Add support for 8-byte accesses when using read/write through the device regions. This fills a gap for userspace drivers that might not be able to use access through mmap to perform native register width accesses (Gerd Bayer) - Add missing MODULE_DESCRIPTION to vfio-mdev sample drivers and replace a non-standard MODULE_INFO usage (Jeff Johnson) * tag 'vfio-v6.11-rc1' of https://github.com/awilliam/linux-vfio: vfio-mdev: add missing MODULE_DESCRIPTION() macros vfio/pci: Fix typo in macro to declare accessors vfio/pci: Support 8-byte PCI loads and stores vfio/pci: Extract duplicated code into macro commit ad8070cb1b4bd40aa19a5e3f7c24d7f62c71b382 Author: Jason A. Donenfeld Date: Mon Jul 15 04:37:18 2024 +0200 MAINTAINERS: add random.h headers to RNG subsection Before, patches to two RNG header files wouldn't be sent to the right recipients automatically. So add the two header files -- one for userspace and one for the kernel -- to the right part of the MAINTAINERS file. Signed-off-by: Jason A. Donenfeld MAINTAINERS | 2 ++ 1 file changed, 2 insertions(+) commit 13f75d9ecf3d8efcf597dfcd8f7be7460cdaa11a Author: Jason A. Donenfeld Date: Mon Jul 15 04:50:07 2024 +0200 random: note that RNDGETPOOL was removed in 2.6.9-rc2 RNDGETPOOL was thankfully removed twenty years ago, but it's stuck around in headers. Probably removing it from uapi headers isn't great in case there are some weird users out there, but we should at least mark this as having been removed, to save future readers the same goose chase I just went on. Link: https://lore.kernel.org/all/E1By1St-0001TS-Qj@thunk.org/ Link: https://lore.kernel.org/all/Pine.LNX.4.58.0409130937050.4094@ppc970.osdl.org/ Signed-off-by: Jason A. Donenfeld include/uapi/linux/random.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 4920a2590e91bc15068e789aaf4ddc522f772fc5 Author: Jason A. Donenfeld Date: Sun Jul 7 01:40:16 2024 +0200 selftests/vDSO: add tests for vgetrandom This adds two tests for vgetrandom. The first one, vdso_test_chacha, simply checks that the assembly implementation of chacha20 matches that of libsodium, a basic sanity check that should catch most errors. The second, vdso_test_getrandom, is a full "libc-like" implementation of the userspace side of vgetrandom() support. It's meant to be used also as example code for libcs that might be integrating this. Cc: linux-kselftest@vger.kernel.org Signed-off-by: Jason A. Donenfeld tools/include/asm/rwonce.h | 0 tools/testing/selftests/vDSO/.gitignore | 2 + tools/testing/selftests/vDSO/Makefile | 18 ++ tools/testing/selftests/vDSO/vdso_test_chacha.c | 43 +++ tools/testing/selftests/vDSO/vdso_test_getrandom.c | 288 +++++++++++++++++++++ 5 files changed, 351 insertions(+) commit 33385150ac456f6f95a58647583d0a3887620729 Author: Jason A. Donenfeld Date: Fri Nov 18 17:38:23 2022 +0100 x86: vdso: Wire up getrandom() vDSO implementation Hook up the generic vDSO implementation to the x86 vDSO data page. Since the existing vDSO infrastructure is heavily based on the timekeeping functionality, which works over arrays of bases, a new macro is introduced for vvars that are not arrays. The vDSO function requires a ChaCha20 implementation that does not write to the stack, yet can still do an entire ChaCha20 permutation, so provide this using SSE2, since this is userland code that must work on all x86-64 processors. Reviewed-by: Thomas Gleixner Reviewed-by: Samuel Neves # for vgetrandom-chacha.S Signed-off-by: Jason A. Donenfeld MAINTAINERS | 2 + arch/x86/Kconfig | 1 + arch/x86/entry/vdso/Makefile | 3 +- arch/x86/entry/vdso/vdso.lds.S | 2 + arch/x86/entry/vdso/vgetrandom-chacha.S | 178 ++++++++++++++++++++++++++++++++ arch/x86/entry/vdso/vgetrandom.c | 17 +++ arch/x86/include/asm/vdso/getrandom.h | 55 ++++++++++ arch/x86/include/asm/vdso/vsyscall.h | 2 + arch/x86/include/asm/vvar.h | 16 +++ 9 files changed, 275 insertions(+), 1 deletion(-) commit 4ad10a5f5f78a5b3e525a63bd075a4eb1139dde1 Author: Jason A. Donenfeld Date: Fri Nov 18 17:23:34 2022 +0100 random: introduce generic vDSO getrandom() implementation Provide a generic C vDSO getrandom() implementation, which operates on an opaque state returned by vgetrandom_alloc() and produces random bytes the same way as getrandom(). This has the following API signature: ssize_t vgetrandom(void *buffer, size_t len, unsigned int flags, void *opaque_state, size_t opaque_len); The return value and the first three arguments are the same as ordinary getrandom(), while the last two arguments are a pointer to the opaque allocated state and its size. Were all five arguments passed to the getrandom() syscall, nothing different would happen, and the functions would have the exact same behavior. The actual vDSO RNG algorithm implemented is the same one implemented by drivers/char/random.c, using the same fast-erasure techniques as that. Should the in-kernel implementation change, so too will the vDSO one. It requires an implementation of ChaCha20 that does not use any stack, in order to maintain forward secrecy if a multi-threaded program forks (though this does not account for a similar issue with SA_SIGINFO copying registers to the stack), so this is left as an architecture-specific fill-in. Stack-less ChaCha20 is an easy algorithm to implement on a variety of architectures, so this shouldn't be too onerous. Initially, the state is keyless, and so the first call makes a getrandom() syscall to generate that key, and then uses it for subsequent calls. By keeping track of a generation counter, it knows when its key is invalidated and it should fetch a new one using the syscall. Later, more than just a generation counter might be used. Since MADV_WIPEONFORK is set on the opaque state, the key and related state is wiped during a fork(), so secrets don't roll over into new processes, and the same state doesn't accidentally generate the same random stream. The generation counter, as well, is always >0, so that the 0 counter is a useful indication of a fork() or otherwise uninitialized state. If the kernel RNG is not yet initialized, then the vDSO always calls the syscall, because that behavior cannot be emulated in userspace, but fortunately that state is short lived and only during early boot. If it has been initialized, then there is no need to inspect the `flags` argument, because the behavior does not change post-initialization regardless of the `flags` value. Since the opaque state passed to it is mutated, vDSO getrandom() is not reentrant, when used with the same opaque state, which libc should be mindful of. The function works over an opaque per-thread state of a particular size, which must be marked VM_WIPEONFORK, VM_DONTDUMP, VM_NORESERVE, and VM_DROPPABLE for proper operation. Over time, the nuances of these allocations may change or grow or even differ based on architectural features. The opaque state passed to vDSO getrandom() must be allocated using the mmap_flags and mmap_prot parameters provided by the vgetrandom_opaque_params struct, which also contains the size of each state. That struct can be obtained with a call to vgetrandom(NULL, 0, 0, ¶ms, ~0UL). Then, libc can call mmap(2) and slice up the returned array into a state per each thread, while ensuring that no single state straddles a page boundary. Libc is expected to allocate a chunk of these on first use, and then dole them out to threads as they're created, allocating more when needed. vDSO getrandom() provides the ability for userspace to generate random bytes quickly and safely, and is intended to be integrated into libc's thread management. As an illustrative example, the introduced code in the vdso_test_getrandom self test later in this series might be used to do the same outside of libc. In a libc the various pthread-isms are expected to be elided into libc internals. Reviewed-by: Thomas Gleixner Signed-off-by: Jason A. Donenfeld MAINTAINERS | 2 + drivers/char/random.c | 18 +++- include/uapi/linux/random.h | 15 +++ include/vdso/datapage.h | 11 ++ include/vdso/getrandom.h | 46 ++++++++ lib/vdso/Kconfig | 5 + lib/vdso/getrandom.c | 251 ++++++++++++++++++++++++++++++++++++++++++++ 7 files changed, 347 insertions(+), 1 deletion(-) commit 9651fcedf7b92d3f7f1ab179e8ab55b85ee10fc1 Author: Jason A. Donenfeld Date: Thu Dec 8 17:55:04 2022 +0100 mm: add MAP_DROPPABLE for designating always lazily freeable mappings The vDSO getrandom() implementation works with a buffer allocated with a new system call that has certain requirements: - It shouldn't be written to core dumps. * Easy: VM_DONTDUMP. - It should be zeroed on fork. * Easy: VM_WIPEONFORK. - It shouldn't be written to swap. * Uh-oh: mlock is rlimited. * Uh-oh: mlock isn't inherited by forks. - It shouldn't reserve actual memory, but it also shouldn't crash when page faulting in memory if none is available * Uh-oh: VM_NORESERVE means segfaults. It turns out that the vDSO getrandom() function has three really nice characteristics that we can exploit to solve this problem: 1) Due to being wiped during fork(), the vDSO code is already robust to having the contents of the pages it reads zeroed out midway through the function's execution. 2) In the absolute worst case of whatever contingency we're coding for, we have the option to fallback to the getrandom() syscall, and everything is fine. 3) The buffers the function uses are only ever useful for a maximum of 60 seconds -- a sort of cache, rather than a long term allocation. These characteristics mean that we can introduce VM_DROPPABLE, which has the following semantics: a) It never is written out to swap. b) Under memory pressure, mm can just drop the pages (so that they're zero when read back again). c) It is inherited by fork. d) It doesn't count against the mlock budget, since nothing is locked. e) If there's not enough memory to service a page fault, it's not fatal, and no signal is sent. This way, allocations used by vDSO getrandom() can use: VM_DROPPABLE | VM_DONTDUMP | VM_WIPEONFORK | VM_NORESERVE And there will be no problem with OOMing, crashing on overcommitment, using memory when not in use, not wiping on fork(), coredumps, or writing out to swap. In order to let vDSO getrandom() use this, expose these via mmap(2) as MAP_DROPPABLE. Note that this involves removing the MADV_FREE special case from sort_folio(), which according to Yu Zhao is unnecessary and will simply result in an extra call to shrink_folio_list() in the worst case. The chunk removed reenables the swapbacked flag, which we don't want for VM_DROPPABLE, and we can't conditionalize it here because there isn't a vma reference available. Finally, the provided self test ensures that this is working as desired. Cc: linux-mm@kvack.org Acked-by: David Hildenbrand Signed-off-by: Jason A. Donenfeld fs/proc/task_mmu.c | 1 + include/linux/mm.h | 7 +++++ include/linux/userfaultfd_k.h | 3 ++ include/trace/events/mmflags.h | 7 +++++ include/uapi/linux/mman.h | 1 + mm/ksm.c | 2 +- mm/madvise.c | 5 +++- mm/memory.c | 13 +++++++++ mm/mempolicy.c | 3 ++ mm/mlock.c | 2 +- mm/mmap.c | 30 +++++++++++++++++++ mm/rmap.c | 22 ++++++++++++-- mm/vmscan.c | 9 ------ tools/include/uapi/linux/mman.h | 1 + tools/testing/selftests/mm/.gitignore | 1 + tools/testing/selftests/mm/Makefile | 1 + tools/testing/selftests/mm/droppable.c | 53 ++++++++++++++++++++++++++++++++++ 17 files changed, 146 insertions(+), 15 deletions(-) commit 4305ca0087dd99c3c3e0e2ac8a228b7e53a21c78 Merge: 661fb4e68cf6 23cef42d1741 Author: Linus Torvalds Date: Fri Jul 19 10:56:58 2024 -0700 Merge tag 'scsi-misc' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi Pull SCSI updates from James Bottomley: "Updates to the usual drivers (ufs, lpfc, qla2xxx, mpi3mr) plus some misc small fixes. The only core changes are to both bsg and scsi to pass in the device instead of setting it afterwards as q->queuedata, so no functional change" * tag 'scsi-misc' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi: (69 commits) scsi: aha152x: Use DECLARE_COMPLETION_ONSTACK for non-constant completion scsi: qla2xxx: Convert comma to semicolon scsi: qla2xxx: Update version to 10.02.09.300-k scsi: qla2xxx: Use QP lock to search for bsg scsi: qla2xxx: Reduce fabric scan duplicate code scsi: qla2xxx: Fix optrom version displayed in FDMI scsi: qla2xxx: During vport delete send async logout explicitly scsi: qla2xxx: Complete command early within lock scsi: qla2xxx: Fix flash read failure scsi: qla2xxx: Return ENOBUFS if sg_cnt is more than one for ELS cmds scsi: qla2xxx: Fix for possible memory corruption scsi: qla2xxx: validate nvme_local_port correctly scsi: qla2xxx: Unable to act on RSCN for port online scsi: ufs: exynos: Add support for Flash Memory Protector (FMP) scsi: ufs: core: Add UFSHCD_QUIRK_KEYS_IN_PRDT scsi: ufs: core: Add fill_crypto_prdt variant op scsi: ufs: core: Add UFSHCD_QUIRK_BROKEN_CRYPTO_ENABLE scsi: ufs: core: fold ufshcd_clear_keyslot() into its caller scsi: ufs: core: Add UFSHCD_QUIRK_CUSTOM_CRYPTO_PROFILE scsi: ufs: mcq: Make .get_hba_mac() optional ... commit 661fb4e68cf62bf52eacfcd9b3b0d93fe4260c5b Merge: afd81d914f6f 7f1c4909a821 Author: Linus Torvalds Date: Fri Jul 19 10:48:44 2024 -0700 Merge tag 'for-6.11/dm-changes' of git://git.kernel.org/pub/scm/linux/kernel/git/device-mapper/linux-dm Pull device mapper updates from Mikulas Patocka: - Optimize processing of flush bios in the dm-linear and dm-stripe targets - Dm-io cleansups and refactoring - Remove unused 'struct thunk' in dm-cache - Handle minor device numbers > 255 in dm-init - Dm-verity refactoring & enabling platform keyring - Fix warning in dm-raid - Improve dm-crypt performance - split bios to smaller pieces, so that They could be processed concurrently - Stop using blk_limits_io_{min,opt} - Dm-vdo cleanup and refactoring - Remove max_write_zeroes_granularity and max_secure_erase_granularity - Dm-multipath cleanup & refactoring - Add dm-crypt and dm-integrity support for non-power-of-2 sector size - Fix reshape in dm-raid - Make dm_block_validator const * tag 'for-6.11/dm-changes' of git://git.kernel.org/pub/scm/linux/kernel/git/device-mapper/linux-dm: (33 commits) dm vdo: fix a minor formatting issue in vdo.rst dm vdo int-map: fix kerneldoc formatting dm vdo repair: add missing kerneldoc fields dm: Constify struct dm_block_validator dm-integrity: introduce the Inline mode dm: introduce the target flag mempool_needs_integrity dm raid: fix stripes adding reshape size issues dm raid: move _get_reshape_sectors() as prerequisite to fixing reshape size issues dm-crypt: support for per-sector NVMe metadata dm mpath: don't call dm_get_device in multipath_message dm: factor out helper function from dm_get_device dm-verity: fix dm_is_verity_target() when dm-verity is builtin dm: Remove max_secure_erase_granularity dm: Remove max_write_zeroes_granularity dm vdo indexer: use swap() instead of open coding it dm vdo: remove unused struct 'uds_attribute' dm: stop using blk_limits_io_{min,opt} dm-crypt: limit the size of encryption requests dm verity: add support for signature verification with platform keyring dm-raid: Fix WARN_ON_ONCE check for sync_thread in raid_resume ... commit afd81d914f6fb3e74a46bf5d0dd0b028591ea22e Merge: ebcfbf02abfb b69bdba5a37e Author: Linus Torvalds Date: Fri Jul 19 10:20:26 2024 -0700 Merge tag 'dma-mapping-6.11-2024-07-19' of git://git.infradead.org/users/hch/dma-mapping Pull dma-mapping updates from Christoph Hellwig: - reduce duplicate swiotlb pool lookups (Michael Kelley) - minor small fixes (Yicong Yang, Yang Li) * tag 'dma-mapping-6.11-2024-07-19' of git://git.infradead.org/users/hch/dma-mapping: swiotlb: fix kernel-doc description for swiotlb_del_transient swiotlb: reduce swiotlb pool lookups dma-mapping: benchmark: Don't starve others when doing the test commit ebcfbf02abfbecc144440ff797419cc95cb047fe Merge: 3d5152095415 8b6c32e831ef Author: Linus Torvalds Date: Fri Jul 19 09:59:58 2024 -0700 Merge tag 'iommu-updates-v6.11' of git://git.kernel.org/pub/scm/linux/kernel/git/iommu/linux Pull iommu updates from Will Deacon: "Core: - Support for the "ats-supported" device-tree property - Removal of the 'ops' field from 'struct iommu_fwspec' - Introduction of iommu_paging_domain_alloc() and partial conversion of existing users - Introduce 'struct iommu_attach_handle' and provide corresponding IOMMU interfaces which will be used by the IOMMUFD subsystem - Remove stale documentation - Add missing MODULE_DESCRIPTION() macro - Misc cleanups Allwinner Sun50i: - Ensure bypass mode is disabled on H616 SoCs - Ensure page-tables are allocated below 4GiB for the 32-bit page-table walker - Add new device-tree compatible strings AMD Vi: - Use try_cmpxchg64() instead of cmpxchg64() when updating pte Arm SMMUv2: - Print much more useful information on context faults - Fix Qualcomm TBU probing when CONFIG_ARM_SMMU_QCOM_DEBUG=n - Add new Qualcomm device-tree bindings Arm SMMUv3: - Support for hardware update of access/dirty bits and reporting via IOMMUFD - More driver rework from Jason, this time updating the PASID/SVA support to prepare for full IOMMUFD support - Add missing MODULE_DESCRIPTION() macro - Minor fixes and cleanups NVIDIA Tegra: - Fix for benign fwspec initialisation issue exposed by rework on the core branch Intel VT-d: - Use try_cmpxchg64() instead of cmpxchg64() when updating pte - Use READ_ONCE() to read volatile descriptor status - Remove support for handling Execute-Requested requests - Avoid calling iommu_domain_alloc() - Minor fixes and refactoring Qualcomm MSM: - Updates to the device-tree bindings" * tag 'iommu-updates-v6.11' of git://git.kernel.org/pub/scm/linux/kernel/git/iommu/linux: (72 commits) iommu/tegra-smmu: Pass correct fwnode to iommu_fwspec_init() iommu/vt-d: Fix identity map bounds in si_domain_init() iommu: Move IOMMU_DIRTY_NO_CLEAR define dt-bindings: iommu: Convert msm,iommu-v0 to yaml iommu/vt-d: Fix aligned pages in calculate_psi_aligned_address() iommu/vt-d: Limit max address mask to MAX_AGAW_PFN_WIDTH docs: iommu: Remove outdated Documentation/userspace-api/iommu.rst arm64: dts: fvp: Enable PCIe ATS for Base RevC FVP iommu/of: Support ats-supported device-tree property dt-bindings: PCI: generic: Add ats-supported property iommu: Remove iommu_fwspec ops OF: Simplify of_iommu_configure() ACPI: Retire acpi_iommu_fwspec_ops() iommu: Resolve fwspec ops automatically iommu/mediatek-v1: Clean up redundant fwspec checks RDMA/usnic: Use iommu_paging_domain_alloc() wifi: ath11k: Use iommu_paging_domain_alloc() wifi: ath10k: Use iommu_paging_domain_alloc() drm/msm: Use iommu_paging_domain_alloc() vhost-vdpa: Use iommu_paging_domain_alloc() ... commit 3d51520954154a476bfdacf9427acd1d9538734c Merge: ef7c8f2b1fb4 887cd308fd46 Author: Linus Torvalds Date: Fri Jul 19 09:51:33 2024 -0700 Merge tag 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/rdma/rdma Pull rdma updates from Jason Gunthorpe: "Usual collection of small improvements and fixes: - Bug fixes and minor improvments in efa, irdma, mlx4, mlx5, rxe, hf1, qib, ocrdma - bnxt_re support for MSN, which is a new retransmit logic - Initial mana support for RC qps - Use after free bug and cleanups in iwcm - Reduce resource usage in mlx5 when RDMA verbs features are not used - New verb to drain shared recieve queues, similar to normal recieve queues. This is necessary to allow ULPs a clean shutdown. Used in the iscsi rdma target - mlx5 support for more than 16 bits of doorbell indexes - Doorbell moderation support for bnxt_re - IB multi-plane support for mlx5 - New EFA adaptor PCI IDs - RDMA_NAME_ASSIGN_TYPE_USER to hint to userspace that it shouldn't rename the device - A collection of hns bugs - Fix long standing bug in bnxt_re with incorrect endian handling of immediate data" * tag 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/rdma/rdma: (65 commits) IB/hfi1: Constify struct flag_table RDMA/mana_ib: Set correct device into ib bnxt_re: Fix imm_data endianness RDMA: Fix netdev tracker in ib_device_set_netdev RDMA/hns: Fix mbx timing out before CMD execution is completed RDMA/hns: Fix insufficient extend DB for VFs. RDMA/hns: Fix undifined behavior caused by invalid max_sge RDMA/hns: Fix shift-out-bounds when max_inline_data is 0 RDMA/hns: Fix missing pagesize and alignment check in FRMR RDMA/hns: Fix unmatch exception handling when init eq table fails RDMA/hns: Fix soft lockup under heavy CEQE load RDMA/hns: Check atomic wr length RDMA/ocrdma: Don't inline statistics functions RDMA/core: Introduce "name_assign_type" for an IB device RDMA/qib: Fix truncation compilation warnings in qib_verbs.c RDMA/qib: Fix truncation compilation warnings in qib_init.c RDMA/efa: Add EFA 0xefa3 PCI ID RDMA/mlx5: Support per-plane port IB counters by querying PPCNT register net/mlx5: mlx5_ifc update for accessing ppcnt register of plane ports RDMA/mlx5: Add plane index support when querying PTYS registers ... commit ef7c8f2b1fb46d3fc7a46d64bb73919e288ba547 Merge: 07e773db19f1 136a8066676e Author: Linus Torvalds Date: Fri Jul 19 09:42:29 2024 -0700 Merge tag 'for-linus-iommufd' of git://git.kernel.org/pub/scm/linux/kernel/git/jgg/iommufd Pull iommufd updates from Jason Gunthorpe: - The iova_bitmap logic for efficiently reporting dirty pages back to userspace has a few more tricky corner case bugs that have been resolved and backed with new tests. The revised version has simpler logic. - Shared branch with iommu for handle support when doing domain attach. Handles allow the domain owner to include additional private data on a per-device basis. - IO Page Fault Reporting to userspace via iommufd. Page faults can be generated on fault capable HWPTs when a translation is not present. Routing them to userspace would allow a VMM to be able to virtualize them into an emulated vIOMMU. This is the next step to fully enabling vSVA support. * tag 'for-linus-iommufd' of git://git.kernel.org/pub/scm/linux/kernel/git/jgg/iommufd: (26 commits) iommufd: Put constants for all the uAPI enums iommufd: Fix error pointer checking iommufd: Add check on user response code iommufd: Remove IOMMUFD_PAGE_RESP_FAILURE iommufd: Require drivers to supply the cache_invalidate_user ops iommufd/selftest: Add coverage for IOPF test iommufd/selftest: Add IOPF support for mock device iommufd: Associate fault object with iommufd_hw_pgtable iommufd: Fault-capable hwpt attach/detach/replace iommufd: Add iommufd fault object iommufd: Add fault and response message definitions iommu: Extend domain attach group with handle support iommu: Add attach handle to struct iopf_group iommu: Remove sva handle list iommu: Introduce domain attachment handle iommufd/iova_bitmap: Remove iterator logic iommufd/iova_bitmap: Dynamic pinning on iova_bitmap_set() iommufd/iova_bitmap: Consolidate iova_bitmap_set exit conditionals iommufd/iova_bitmap: Move initial pinning to iova_bitmap_for_each() iommufd/iova_bitmap: Cache mapped length in iova_bitmap_map struct ... commit 07e773db19f16f4111795b658c4748da22c927bb Merge: c434e25b62f8 7dc357d343f1 Author: Linus Torvalds Date: Fri Jul 19 09:35:53 2024 -0700 Merge tag 'tpmdd-next-6.11-rc1-roundtwo' of git://git.kernel.org/pub/scm/linux/kernel/git/jarkko/linux-tpmdd Pull tpm fix from Jarkko Sakkinen: "An additional fix that supplements my earlier fixes for handling auth, which I unfortunately missed last time" * tag 'tpmdd-next-6.11-rc1-roundtwo' of git://git.kernel.org/pub/scm/linux/kernel/git/jarkko/linux-tpmdd: tpm: Use auth only after NULL check in tpm_buf_check_hmac_response() commit 519be989717c5bffaed1dc14a439e3872cb4bb8d Author: David Howells Date: Thu May 23 10:01:08 2024 +0100 cifs: Add a tracepoint to track credits involved in R/W requests Add a tracepoint to track the credit changes and server in_flight value involved in the lifetime of a R/W request, logging it against the request/subreq debugging ID. This requires the debugging IDs to be recorded in the cifs_credits struct. The tracepoint can be enabled with: echo 1 >/sys/kernel/debug/tracing/events/cifs/smb3_rw_credits/enable Also add a three-state flag to struct cifs_credits to note if we're interested in determining when the in_flight contribution ends and, if so, to track whether we've decremented the contribution yet. Signed-off-by: David Howells Reviewed-by: Paulo Alcantara (Red Hat) cc: Jeff Layton cc: linux-cifs@vger.kernel.org cc: netfs@lists.linux.dev cc: linux-fsdevel@vger.kernel.org Signed-off-by: Steve French fs/smb/client/cifsglob.h | 17 +++++++++------ fs/smb/client/file.c | 32 ++++++++++++++++++++++++++- fs/smb/client/smb1ops.c | 2 +- fs/smb/client/smb2ops.c | 42 +++++++++++++++++++++++++++++++----- fs/smb/client/smb2pdu.c | 40 ++++++++++++++++++++++++++++++---- fs/smb/client/trace.h | 55 ++++++++++++++++++++++++++++++++++++++++++++++- fs/smb/client/transport.c | 8 +++---- 7 files changed, 173 insertions(+), 23 deletions(-) commit 61ea6b3a3104fcd66364282391dd2152bc4c129a Author: David Howells Date: Fri Jul 19 14:07:07 2024 +0100 cifs: Fix setting of zero_point after DIO write At the moment, at the end of a DIO write, cifs calls netfs_resize_file() to adjust the size of the file if it needs it. This will reduce the zero_point (the point above which we assume a read will just return zeros) if it's more than the new i_size, but won't increase it. With DIO writes, however, we definitely want to increase it as we have clobbered the local pagecache and then written some data that's not available locally. Fix cifs to make the zero_point above the end of a DIO or unbuffered write. This fixes corruption seen occasionally with the generic/708 xfs-test. In that case, the read-back of some of the written data is being short-circuited and replaced with zeroes. Fixes: 3ee1a1fc3981 ("cifs: Cut over to using netfslib") Cc: stable@vger.kernel.org Reported-by: Steve French Signed-off-by: David Howells Reviewed-by: Paulo Alcantara (Red Hat) cc: Jeff Layton cc: linux-cifs@vger.kernel.org cc: netfs@lists.linux.dev cc: linux-fsdevel@vger.kernel.org Signed-off-by: Steve French fs/smb/client/file.c | 15 ++++++++++----- 1 file changed, 10 insertions(+), 5 deletions(-) commit d2c5eb57b6da10f335c30356f9696bd667601e6a Author: David Howells Date: Thu Jul 18 20:55:20 2024 +0100 cifs: Fix missing error code set In cifs_strict_readv(), the default rc (-EACCES) is accidentally cleared by a successful return from netfs_start_io_direct(), such that if cifs_find_lock_conflict() fails, we don't return an error. Fix this by resetting the default error code. Fixes: 14b1cd25346b ("cifs: Fix locking in cifs_strict_readv()") Cc: stable@vger.kernel.org Signed-off-by: David Howells Reviewed-by: Paulo Alcantara (Red Hat) cc: Jeff Layton cc: linux-cifs@vger.kernel.org cc: netfs@lists.linux.dev cc: linux-fsdevel@vger.kernel.org Signed-off-by: Steve French fs/smb/client/file.c | 2 ++ 1 file changed, 2 insertions(+) commit de40579b903883274fe203865f29d66b168b7236 Author: David Howells Date: Thu Jul 18 20:19:32 2024 +0100 cifs: Fix server re-repick on subrequest retry When a subrequest is marked for needing retry, netfs will call cifs_prepare_write() which will make cifs repick the server for the op before renegotiating credits; it then calls cifs_issue_write() which invokes smb2_async_writev() - which re-repicks the server. If a different server is then selected, this causes the increment of server->in_flight to happen against one record and the decrement to happen against another, leading to misaccounting. Fix this by just removing the repick code in smb2_async_writev(). As this is only called from netfslib-driven code, cifs_prepare_write() should always have been called first, and so server should never be NULL and the preparatory step is repeated in the event that we do a retry. The problem manifests as a warning looking something like: WARNING: CPU: 4 PID: 72896 at fs/smb/client/smb2ops.c:97 smb2_add_credits+0x3f0/0x9e0 [cifs] ... RIP: 0010:smb2_add_credits+0x3f0/0x9e0 [cifs] ... smb2_writev_callback+0x334/0x560 [cifs] cifs_demultiplex_thread+0x77a/0x11b0 [cifs] kthread+0x187/0x1d0 ret_from_fork+0x34/0x60 ret_from_fork_asm+0x1a/0x30 Which may be triggered by a number of different xfstests running against an Azure server in multichannel mode. generic/249 seems the most repeatable, but generic/215, generic/249 and generic/308 may also show it. Fixes: 3ee1a1fc3981 ("cifs: Cut over to using netfslib") Cc: stable@vger.kernel.org Reported-by: Steve French Reviewed-by: Paulo Alcantara (Red Hat) Acked-by: Tom Talpey Signed-off-by: David Howells cc: Jeff Layton cc: Aurelien Aptel cc: linux-cifs@vger.kernel.org cc: netfs@lists.linux.dev cc: linux-fsdevel@vger.kernel.org Signed-off-by: Steve French fs/smb/client/smb2pdu.c | 3 --- 1 file changed, 3 deletions(-) commit ae4ccca47195332c69176b8615c5ee17efd30c46 Author: Steve French Date: Wed Jul 17 00:42:22 2024 -0500 cifs: fix noisy message on copy_file_range There are common cases where copy_file_range can noisily log "source and target of copy not on same server" e.g. the mv command across mounts to two different server's shares. Change this to informational rather than logging as an error. A followon patch will add dynamic trace points e.g. for cifs_file_copychunk_range Cc: stable@vger.kernel.org Reviewed-by: Shyam Prasad N Signed-off-by: Steve French fs/smb/client/cifsfs.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit c434e25b62f8efcfbb6bf1f7ce55960206c1137e Merge: 720261cfc732 df1e9791998a Author: Linus Torvalds Date: Fri Jul 19 08:52:58 2024 -0700 Merge tag 'v6.11-p1' of git://git.kernel.org/pub/scm/linux/kernel/git/herbert/crypto-2.6 Pull crypto update from Herbert Xu: "API: - Test setkey in no-SIMD context - Add skcipher speed test for user-specified algorithm Algorithms: - Add x25519 support on ppc64le - Add VAES and AVX512 / AVX10 optimized AES-GCM on x86 - Remove sm2 algorithm Drivers: - Add Allwinner H616 support to sun8i-ce - Use DMA in stm32 - Add Exynos850 hwrng support to exynos" * tag 'v6.11-p1' of git://git.kernel.org/pub/scm/linux/kernel/git/herbert/crypto-2.6: (81 commits) hwrng: core - remove (un)register_miscdev() crypto: lib/mpi - delete unnecessary condition crypto: testmgr - generate power-of-2 lengths more often crypto: mxs-dcp - Ensure payload is zero when using key slot hwrng: Kconfig - Do not enable by default CN10K driver crypto: starfive - Fix nent assignment in rsa dec crypto: starfive - Align rsa input data to 32-bit crypto: qat - fix unintentional re-enabling of error interrupts crypto: qat - extend scope of lock in adf_cfg_add_key_value_param() Documentation: qat: fix auto_reset attribute details crypto: sun8i-ce - add Allwinner H616 support crypto: sun8i-ce - wrap accesses to descriptor address fields dt-bindings: crypto: sun8i-ce: Add compatible for H616 hwrng: core - Fix wrong quality calculation at hw rng registration hwrng: exynos - Enable Exynos850 support hwrng: exynos - Add SMC based TRNG operation hwrng: exynos - Implement bus clock control hwrng: exynos - Use devm_clk_get_enabled() to get the clock hwrng: exynos - Improve coding style dt-bindings: rng: Add Exynos850 support to exynos-trng ... commit 89ed6c9ac69ec398ccb648f5f675b43e8ca679ca Author: Xiu Jianfeng Date: Tue Jul 16 13:30:58 2024 +0000 blk-cgroup: move congestion_count to struct blkcg The congestion_count was introduced into the struct cgroup by commit d09d8df3a294 ("blkcg: add generic throttling mechanism"), but since it is closely related to the blkio subsys, it is not appropriate to put it in the struct cgroup, so let's move it to struct blkcg. There should be no functional changes because blkcg is per cgroup. Signed-off-by: Xiu Jianfeng Acked-by: Tejun Heo Link: https://lore.kernel.org/r/20240716133058.3491350-1-xiujianfeng@huawei.com Signed-off-by: Jens Axboe block/blk-cgroup.c | 7 ++++--- block/blk-cgroup.h | 10 ++++++---- include/linux/cgroup-defs.h | 3 --- 3 files changed, 10 insertions(+), 10 deletions(-) commit 72d04bdcf3f7d7e07d82f9757946f68802a7270a Author: Yang Yang Date: Tue Jul 16 16:26:27 2024 +0800 sbitmap: fix io hung due to race on sbitmap_word::cleared Configuration for sbq: depth=64, wake_batch=6, shift=6, map_nr=1 1. There are 64 requests in progress: map->word = 0xFFFFFFFFFFFFFFFF 2. After all the 64 requests complete, and no more requests come: map->word = 0xFFFFFFFFFFFFFFFF, map->cleared = 0xFFFFFFFFFFFFFFFF 3. Now two tasks try to allocate requests: T1: T2: __blk_mq_get_tag . __sbitmap_queue_get . sbitmap_get . sbitmap_find_bit . sbitmap_find_bit_in_word . __sbitmap_get_word -> nr=-1 __blk_mq_get_tag sbitmap_deferred_clear __sbitmap_queue_get /* map->cleared=0xFFFFFFFFFFFFFFFF */ sbitmap_find_bit if (!READ_ONCE(map->cleared)) sbitmap_find_bit_in_word return false; __sbitmap_get_word -> nr=-1 mask = xchg(&map->cleared, 0) sbitmap_deferred_clear atomic_long_andnot() /* map->cleared=0 */ if (!(map->cleared)) return false; /* * map->cleared is cleared by T1 * T2 fail to acquire the tag */ 4. T2 is the sole tag waiter. When T1 puts the tag, T2 cannot be woken up due to the wake_batch being set at 6. If no more requests come, T1 will wait here indefinitely. This patch achieves two purposes: 1. Check on ->cleared and update on both ->cleared and ->word need to be done atomically, and using spinlock could be the simplest solution. 2. Add extra check in sbitmap_deferred_clear(), to identify whether ->word has free bits. Fixes: ea86ea2cdced ("sbitmap: ammortize cost of clearing bits") Signed-off-by: Yang Yang Reviewed-by: Ming Lei Reviewed-by: Bart Van Assche Link: https://lore.kernel.org/r/20240716082644.659566-1-yang.yang@vivo.com Signed-off-by: Jens Axboe include/linux/sbitmap.h | 5 +++++ lib/sbitmap.c | 36 +++++++++++++++++++++++++++++------- 2 files changed, 34 insertions(+), 7 deletions(-) commit 73e59d3eeca4feaf0814a077df8ec5edc53ccf77 Author: hexue Date: Thu Jul 18 15:08:17 2024 +0800 block: avoid polling configuration errors This patch adds a poll queue check, aiming to help users use polled IO accurately. If users do polled IO but the device doesn't have poll queues, they will get suboptimal performance data and waste CPU resources. Add a poll queue check batching this. If users don't have the device properly configured, or if it simply doesn't support polled IO, it will error the IO with -EOPNOTSUPP. This is similar to what we used to do for sync polled IO, which is no longer supported. Signed-off-by: hexue Link: https://lore.kernel.org/r/20240718070817.1031494-1-xue01.he@samsung.com Signed-off-by: Jens Axboe block/blk-core.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) commit 8a47e33f50dd779f94bc277c6d3de81672463c5e Author: John Garry Date: Fri Jul 19 11:29:12 2024 +0000 block: Catch possible entries missing from rqf_name[] Add a BUILD_BUG_ON() call to ensure that we are not missing entries in rqf_name[]. Reviewed-by: Bart Van Assche Signed-off-by: John Garry Link: https://lore.kernel.org/r/20240719112912.3830443-16-john.g.garry@oracle.com Signed-off-by: Jens Axboe block/blk-mq-debugfs.c | 1 + include/linux/blk-mq.h | 1 + 2 files changed, 2 insertions(+) commit 2d61a6c2ca7aadce3771f81a3624848f97dcc39e Author: John Garry Date: Fri Jul 19 11:29:11 2024 +0000 block: Simplify definition of RQF_NAME() Now that we have a bit index for RQF_x in __RQF_x, use __RQF_x to simplify the definition of RQF_NAME() by not using ilog2((__force u32()). Reviewed-by: Bart Van Assche Signed-off-by: John Garry Link: https://lore.kernel.org/r/20240719112912.3830443-15-john.g.garry@oracle.com Signed-off-by: Jens Axboe block/blk-mq-debugfs.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 5f89154e8e9e3445f9b592e58a7045e06153b822 Author: John Garry Date: Fri Jul 19 11:29:10 2024 +0000 block: Use enum to define RQF_x bit indexes Similar to what we do for enum req_flag_bits, divide the definition of RQF_x flags into an enum to declare the bits and an actual flag. Tweak some comments to not spill onto new lines. Signed-off-by: John Garry Link: https://lore.kernel.org/r/20240719112912.3830443-14-john.g.garry@oracle.com Signed-off-by: Jens Axboe include/linux/blk-mq.h | 86 +++++++++++++++++++++++++++++++------------------- 1 file changed, 54 insertions(+), 32 deletions(-) commit 6fa99325ec86bcd442363d77561a1babd8d9a427 Author: John Garry Date: Fri Jul 19 11:29:09 2024 +0000 block: Catch possible entries missing from cmd_flag_name[] Add a BUILD_BUG_ON() call to ensure that we are not missing entries in cmd_flag_name[]. Reviewed-by: Bart Van Assche Signed-off-by: John Garry Link: https://lore.kernel.org/r/20240719112912.3830443-13-john.g.garry@oracle.com Signed-off-by: Jens Axboe block/blk-mq-debugfs.c | 2 ++ include/linux/blk_types.h | 1 + 2 files changed, 3 insertions(+) commit 26d3bdb57ec3fa56eaf8d2e74b5d488e55f43013 Author: John Garry Date: Fri Jul 19 11:29:08 2024 +0000 block: Catch possible entries missing from alloc_policy_name[] Make BLK_TAG_ALLOC_x an enum and add a "max" entry. Add a BUILD_BUG_ON() call to ensure that we are not missing entries in hctx_flag_name[]. Reviewed-by: Bart Van Assche Signed-off-by: John Garry Link: https://lore.kernel.org/r/20240719112912.3830443-12-john.g.garry@oracle.com Signed-off-by: Jens Axboe block/blk-mq-debugfs.c | 1 + include/linux/blk-mq.h | 8 ++++++-- 2 files changed, 7 insertions(+), 2 deletions(-) commit 226f0f6afc3e5c8903c6e57e1f6073ad8ad189b5 Author: John Garry Date: Fri Jul 19 11:29:07 2024 +0000 block: Catch possible entries missing from hctx_flag_name[] Refresh values in BLK_MQ_F_x enum, and then re-arrange members in hctx_flag_name[] to match that enum. Renumber BLK_MQ_F_ALLOC_POLICY_START_BIT to match the value refresh. Add a BUILD_BUG_ON() call to ensure that we are not missing entries in hctx_flag_name[]. Signed-off-by: John Garry Link: https://lore.kernel.org/r/20240719112912.3830443-11-john.g.garry@oracle.com Signed-off-by: Jens Axboe block/blk-mq-debugfs.c | 3 +++ include/linux/blk-mq.h | 10 ++++++---- 2 files changed, 9 insertions(+), 4 deletions(-) commit 23827310cce7eff3477aeaeb59ea3718f5c9c633 Author: John Garry Date: Fri Jul 19 11:29:06 2024 +0000 block: Catch possible entries missing from hctx_state_name[] Add a build-time assert that we are not missing entries from hctx_state_name[]. For this, create a separate enum for state flags and add a "max" entry for BLK_MQ_S_x flags. The numbering for those enum values is as default, so don't explicitly number. Signed-off-by: John Garry Link: https://lore.kernel.org/r/20240719112912.3830443-10-john.g.garry@oracle.com Signed-off-by: Jens Axboe block/blk-mq-debugfs.c | 1 + include/linux/blk-mq.h | 17 ++++++++++------- 2 files changed, 11 insertions(+), 7 deletions(-) commit cce496de061d09794825b7c7c7d57faca4772d82 Author: John Garry Date: Fri Jul 19 11:29:05 2024 +0000 block: Catch possible entries missing from blk_queue_flag_name[] Assert that we are not missing flag entries in blk_queue_flag_name[]. Signed-off-by: John Garry Reviewed-by: Bart Van Assche Link: https://lore.kernel.org/r/20240719112912.3830443-9-john.g.garry@oracle.com Signed-off-by: Jens Axboe block/blk-mq-debugfs.c | 2 ++ 1 file changed, 2 insertions(+) commit 55177adf1837bc56f878f7f6f7123947a2088148 Author: John Garry Date: Fri Jul 19 11:29:04 2024 +0000 block: Make QUEUE_FLAG_x as an enum This will allow us better keep in sync with blk_queue_flag_name[]. Signed-off-by: John Garry Link: https://lore.kernel.org/r/20240719112912.3830443-8-john.g.garry@oracle.com Signed-off-by: Jens Axboe include/linux/blkdev.h | 29 ++++++++++++++++------------- 1 file changed, 16 insertions(+), 13 deletions(-) commit 793356d23f8a817e164a917c792741a6d6d651ed Author: John Garry Date: Fri Jul 19 11:29:03 2024 +0000 block: Relocate BLK_MQ_MAX_DEPTH BLK_MQ_MAX_DEPTH is defined as an enumerated value, but has no real relation to the other members in its enum, so just use #define to provide the definition. Signed-off-by: John Garry Link: https://lore.kernel.org/r/20240719112912.3830443-7-john.g.garry@oracle.com Signed-off-by: Jens Axboe include/linux/blk-mq.h | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) commit 3dff6155733f25872530ad358c6f5559800f4ccb Author: John Garry Date: Fri Jul 19 11:29:02 2024 +0000 block: Relocate BLK_MQ_CPU_WORK_BATCH BLK_MQ_CPU_WORK_BATCH is defined in include/linux/blk-mq.h, but only used in blk-mq.c, so relocate to block/blk-mq.h Signed-off-by: John Garry Link: https://lore.kernel.org/r/20240719112912.3830443-6-john.g.garry@oracle.com Signed-off-by: Jens Axboe block/blk-mq.h | 2 ++ include/linux/blk-mq.h | 2 -- 2 files changed, 2 insertions(+), 2 deletions(-) commit c8f51feee135f37f0d77b4616083c25524daa7b0 Author: Christoph Hellwig Date: Fri Jul 19 11:29:01 2024 +0000 block: remove QUEUE_FLAG_STOPPED QUEUE_FLAG_STOPPED is entirely unused. Signed-off-by: Christoph Hellwig Reviewed-by: Chaitanya Kulkarni Reviewed-by: Bart Van Assche Reviewed-by: Johannes Thumshirn Signed-off-by: John Garry Link: https://lore.kernel.org/r/20240719112912.3830443-5-john.g.garry@oracle.com Signed-off-by: Jens Axboe block/blk-mq-debugfs.c | 1 - include/linux/blkdev.h | 2 -- 2 files changed, 3 deletions(-) commit 1c83c5375e2f1bc7b59fa3ec5aa1e5909ec8710c Author: John Garry Date: Fri Jul 19 11:29:00 2024 +0000 block: Add missing entry to hctx_flag_name[] Add missing entry for NO_SCHED_BY_DEFAULT and reorder to match the enum. Signed-off-by: John Garry Link: https://lore.kernel.org/r/20240719112912.3830443-4-john.g.garry@oracle.com Signed-off-by: Jens Axboe block/blk-mq-debugfs.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) commit af54963f193533dd7c1fe8f3d4e7af18de2406d8 Author: John Garry Date: Fri Jul 19 11:28:59 2024 +0000 block: Add zone write plugging entry to rqf_name[] Add missing entry. Reviewed-by: Bart Van Assche Signed-off-by: John Garry Link: https://lore.kernel.org/r/20240719112912.3830443-3-john.g.garry@oracle.com Signed-off-by: Jens Axboe block/blk-mq-debugfs.c | 1 + 1 file changed, 1 insertion(+) commit 6b3789e6c5310a8f517796b0f4a11039f9e5cf8f Author: John Garry Date: Fri Jul 19 11:28:58 2024 +0000 block: Add missing entries from cmd_flag_name[] Add missing entries for req_flag_bits. Reviewed-by: Bart Van Assche Signed-off-by: John Garry Link: https://lore.kernel.org/r/20240719112912.3830443-2-john.g.garry@oracle.com Signed-off-by: Jens Axboe block/blk-mq-debugfs.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) commit 0be9ae5486cd9e767138c13638820d240713f5f1 Author: Hou Tao Date: Sun Jul 14 14:55:33 2024 +0800 bpf, events: Use prog to emit ksymbol event for main program Since commit 0108a4e9f358 ("bpf: ensure main program has an extable"), prog->aux->func[0]->kallsyms is left as uninitialized. For BPF programs with subprogs, the symbol for the main program is missing just as shown in the output of perf script below: ffffffff81284b69 qp_trie_lookup_elem+0xb9 ([kernel.kallsyms]) ffffffffc0011125 bpf_prog_a4a0eb0651e6af8b_lookup_qp_trie+0x5d (bpf...) ffffffff8127bc2b bpf_for_each_array_elem+0x7b ([kernel.kallsyms]) ffffffffc00110a1 +0x25 () ffffffff8121a89a trace_call_bpf+0xca ([kernel.kallsyms]) Fix it by always using prog instead prog->aux->func[0] to emit ksymbol event for the main program. After the fix, the output of perf script will be correct: ffffffff81284b96 qp_trie_lookup_elem+0xe6 ([kernel.kallsyms]) ffffffffc001382d bpf_prog_a4a0eb0651e6af8b_lookup_qp_trie+0x5d (bpf...) ffffffff8127bc2b bpf_for_each_array_elem+0x7b ([kernel.kallsyms]) ffffffffc0013779 bpf_prog_245c55ab25cfcf40_qp_trie_lookup+0x25 (bpf...) ffffffff8121a89a trace_call_bpf+0xca ([kernel.kallsyms]) Fixes: 0108a4e9f358 ("bpf: ensure main program has an extable") Signed-off-by: Hou Tao Signed-off-by: Daniel Borkmann Tested-by: Yonghong Song Reviewed-by: Krister Johansen Reviewed-by: Jiri Olsa Link: https://lore.kernel.org/bpf/20240714065533.1112616-1-houtao@huaweicloud.com kernel/events/core.c | 28 +++++++++++++--------------- 1 file changed, 13 insertions(+), 15 deletions(-) commit c3ece6b7ffb4a7c00e8d53cbf4026a32b6127914 Author: Qu Wenruo Date: Sat Jul 13 18:33:44 2024 +0930 btrfs: change BTRFS_MOUNT_* flags to 64bit type Currently the BTRFS_MOUNT_* flags are already beyond 32 bits, this is going to cause compilation errors for some 32 bit systems, as their unsigned long is only 32 bits long, thus flag BTRFS_MOUNT_IGNORESUPERFLAGS overflows and can lead to errors. Fix the problem by: - Migrate all existing BTRFS_MOUNT_* flags to unsigned long long - Migrate all mount option related variables to unsigned long long * btrfs_fs_info::mount_opt * btrfs_fs_context::mount_opt * mount_opt parameter of btrfs_check_options() * old_opts parameter of btrfs_remount_begin() * old_opts parameter of btrfs_remount_cleanup() * mount_opt parameter of btrfs_check_mountopts_zoned() * mount_opt and opt parameters of check_ro_option() Fixes: 32e6216512b4 ("btrfs: introduce new "rescue=ignoresuperflags" mount option") Signed-off-by: Qu Wenruo Reviewed-by: David Sterba Signed-off-by: David Sterba fs/btrfs/fs.h | 66 ++++++++++++++++++++++++++++---------------------------- fs/btrfs/super.c | 11 +++++----- fs/btrfs/super.h | 3 ++- fs/btrfs/zoned.c | 3 ++- fs/btrfs/zoned.h | 5 +++-- 5 files changed, 46 insertions(+), 42 deletions(-) commit 45659274e60864f9acabba844468e405362bdc8c Merge: 19a3eec1e7cc 142a41da39d1 Author: Bjorn Helgaas Date: Fri Jul 19 10:10:33 2024 -0500 Merge branch 'pci/misc' - Remove unused struct 'acpi_handle_node' (Dr. David Alan Gilbert) - Use array notation for portdrv .id_table consistently (Masahiro Yamada) - Switch to new Intel CPU model defines (Tony Luck) - Add missing MODULE_DESCRIPTION() macros (Jeff Johnson) * pci/misc: PCI: controller: Add missing MODULE_DESCRIPTION() macros PCI: Add missing MODULE_DESCRIPTION() macros PCI/PM: Switch to new Intel CPU model defines PCI: Use array for .id_table consistently ACPI: PCI: Remove unused struct 'acpi_handle_node' commit 19a3eec1e7cc04901f8b14f6244345cd83a8507f Merge: d098215aec2c 8a74e4eaa72c Author: Bjorn Helgaas Date: Fri Jul 19 10:10:33 2024 -0500 Merge branch 'pci/switchtec' - Make switchtec_class constant (Greg Kroah-Hartman) * pci/switchtec: PCI: switchtec: Make switchtec_class constant commit d098215aec2c1a0ef785542c1b1bcf65d617dd80 Merge: 99329ded0909 f24c9bfcd423 Author: Bjorn Helgaas Date: Fri Jul 19 10:10:32 2024 -0500 Merge branch 'pci/controller/vmd' - Create "domain" symlink for vmd before adding devices below the VMD bridge so it's available when mdadm assembles RAID devices from them (Jiwei Sun) * pci/controller/vmd: PCI: vmd: Create domain symlink before pci_bus_add_devices() commit 99329ded09099b40f755893b466571395d09ce46 Merge: 8240a9b4a5a2 6a6118336270 Author: Bjorn Helgaas Date: Fri Jul 19 10:10:32 2024 -0500 Merge branch 'pci/controller/tegra194' - Ensure Tegra194 and Tegra234 inbound ATU entries are 64KB-aligned to match the hardware restriction (Jon Hunter) - Remove unused struct 'tegra_pcie_soc' (Dr. David Alan Gilbert) * pci/controller/tegra194: PCI: tegra: Remove unused struct 'tegra_pcie_soc' PCI: tegra194: Set EP alignment restriction for inbound ATU commit 8240a9b4a5a27ce20a0ae2dea2b2e830be34f3b9 Merge: 59dd7046b4fb 84e30b878aed Author: Bjorn Helgaas Date: Fri Jul 19 10:10:32 2024 -0500 Merge branch 'pci/controller/rockchip' - Use dev_err_probe() in dw-rockchip probe error path so the failures aren't silent (Uwe Kleine-König) - Sleep PCIE_T_PVPERL_MS (100ms) before deasserting PERST# (Damien Le Moal) - Sleep PCIE_T_RRS_READY_MS (100ms) after conventional reset, before a config access (Damien Le Moal) - Request the PERST# GPIO with GPIOD_OUT_LOW so it matches the POR value, which avoids a spurious PERST# assertion and fixes a Qcom modem firmware crash and issues with WLAN controllers, e.g., RTL8822CE (Manivannan Sadhasivam for rockchip, Niklas Cassel for dw-rockchip) - Refactor dw-rockchip and add support for Endpoint mode for rk3568 and rk3588 (Niklas Cassel) * pci/controller/rockchip: PCI: dw-rockchip: Use pci_epc_init_notify() directly PCI: dw-rockchip: Add endpoint mode support PCI: dw-rockchip: Refactor the driver to prepare for EP mode PCI: dw-rockchip: Add rockchip_pcie_get_ltssm() helper PCI: dw-rockchip: Fix weird indentation PCI: dw-rockchip: Fix initial PERST# GPIO value PCI: dw-rockchip: Add error messages in .probe() error paths PCI: rockchip: Use GPIOD_OUT_LOW flag while requesting ep_gpio PCI: rockchip-host: Wait 100ms after reset before starting configuration PCI: rockchip-host: Fix rockchip_pcie_host_init_port() PERST# handling commit 59dd7046b4fbe60d74544f8a77c63899ce8b3618 Merge: 55b3ebfedc19 faf5a975ee3b Author: Bjorn Helgaas Date: Fri Jul 19 10:10:31 2024 -0500 Merge branch 'pci/controller/rcar-gen4' - Add Synopsys DWC macros for lane skew configuration (Yoshihiro Shimoda) - Add struct rcar_gen4_pcie_drvdata to provide for future SoCs with different initialization requirements (Yoshihiro Shimoda) - Add .ltssm_control() method for SoC dependencies (Yoshihiro Shimoda) - Add r8a779g0 (R-Car V4H) support (Yoshihiro Shimoda) * pci/controller/rcar-gen4: PCI: rcar-gen4: Add support for R-Car V4H PCI: rcar-gen4: Add .ltssm_control() for other SoC support PCI: rcar-gen4: Add struct rcar_gen4_pcie_drvdata PCI: dwc: Add PCIE_PORT_{FORCE,LANE_SKEW} macros commit 55b3ebfedc199c1492c30d0ef0ad5dd7d4ee611c Merge: df5dd337283a c93637e6a4c4 Author: Bjorn Helgaas Date: Fri Jul 19 10:10:31 2024 -0500 Merge branch 'pci/controller/rcar' - Demote WARN() to dev_warn_ratelimited() in rcar_pcie_wakeup() to avoid excessive warnings when the driver is confused about link state when resuming (Marek Vasut) * pci/controller/rcar: PCI: rcar: Demote WARN() to dev_warn_ratelimited() in rcar_pcie_wakeup() commit df5dd337283ad104ef329124d683b63d6b4dcd48 Merge: 325b9a3e4e6b 044b45be04cb Author: Bjorn Helgaas Date: Fri Jul 19 10:10:31 2024 -0500 Merge branch 'pci/controller/qcom' - Use devm_clk_bulk_get_all() to get all the clocks from DT to avoid writing out all the clock names (Manivannan Sadhasivam) - Add DT binding and driver support for the SA8775P SoC (Mrinmay Sarkar) - Refactor dw_pcie_edma_find_chip() to enable adding support for Hyper DMA (HDMA) (Manivannan Sadhasivam) - Enable drivers to supply the eDMA channel count since some can't auto detect this (Manivannan Sadhasivam) - Add HDMA support for the SA8775P SoC (Mrinmay Sarkar) - Override the SA8775P NO_SNOOP default to avoid possible memory corruption (Mrinmay Sarkar) - Make sure resources are disabled during PERST# assertion, even if the link is already disabled (Manivannan Sadhasivam) - Vote for the CPU-PCIe ICC (interconnect) path to ensure it stays active even if other drivers don't vote for it (Krishna chaitanya chundru) - Add Operating Performance Points (OPP) to scale performance state based on aggregate link bandwidth to improve SoC power efficiency (Krishna chaitanya chundru) - Return failure instead of success if dev_pm_opp_find_freq_floor() fails (Dan Carpenter) - Avoid an error pointer dereference if dev_pm_opp_find_freq_exact() fails (Dan Carpenter) - Prevent use of uninitialized data in qcom_pcie_suspend_noirq() (Dan Carpenter) * pci/controller/qcom: PCI: qcom: Prevent use of uninitialized data in qcom_pcie_suspend_noirq() PCI: qcom: Prevent potential error pointer dereference PCI: qcom: Fix missing error code in qcom_pcie_probe() PCI: qcom: Add OPP support to scale performance PCI: Bring the PCIe speed to MBps logic to new pcie_dev_speed_mbps() PCI: qcom: Add ICC bandwidth vote for CPU to PCIe path PCI: qcom-ep: Disable resources unconditionally during PERST# assert PCI: qcom-ep: Override NO_SNOOP attribute for SA8775P EP PCI: qcom: Override NO_SNOOP attribute for SA8775P RC PCI: epf-mhi: Enable HDMA for SA8775P SoC PCI: qcom-ep: Add HDMA support for SA8775P SoC PCI: dwc: Pass the eDMA mapping format flag directly from glue drivers PCI: dwc: Skip finding eDMA channels count for HDMA platforms PCI: dwc: Refactor dw_pcie_edma_find_chip() API PCI: qcom-ep: Add support for SA8775P SOC dt-bindings: PCI: qcom-ep: Add support for SA8775P SoC PCI: qcom: Use devm_clk_bulk_get_all() API commit 325b9a3e4e6bcaa04495ebc54e24203e00151bc0 Merge: 145eec91b38a 39b91eb40c6a Author: Bjorn Helgaas Date: Fri Jul 19 10:10:30 2024 -0500 Merge branch 'pci/controller/microchip' - Move PLDA XpressRICH generic DT binding properties to plda,xpressrich3-axi-common.yaml where they can be shared across PLDA-based drivers (Minda Chen) - Create a drivers/pci/controller/plda/ directory for PLDA-based drivers and move pcie-microchip-host.c there (Minda Chen) - Move PLDA generic macros to pcie-plda.h where they can be shared across drivers (Minda Chen) - Extract PLDA generic structures from pcie-microchip-host.c, rename them to be generic, and move them to pcie-plda-host.c where they can be shared across drivers (Minda Chen) - Add a .request_event_irq() callback for requesting device-specific interrupts in addition to PLDA-generic interrupts (Minda Chen) - Add DT binding and driver for the StarFive JH7110 SoC, based on PLDA IP (Minda Chen) * pci/controller/microchip: PCI: starfive: Add JH7110 PCIe controller dt-bindings: PCI: Add StarFive JH7110 PCIe controller PCI: Add PCIE_RESET_CONFIG_DEVICE_WAIT_MS waiting time value PCI: plda: Pass pci_host_bridge to plda_pcie_setup_iomems() PCI: plda: Add host init/deinit and map bus functions PCI: plda: Add event bitmap field to struct plda_pcie_rp PCI: microchip: Move IRQ functions to pcie-plda-host.c PCI: microchip: Add event irqchip field to host port and add PLDA irqchip PCI: microchip: Add get_events() callback and PLDA get_event() PCI: microchip: Add INTx and MSI event num to struct plda_event PCI: microchip: Add request_event_irq() callback function PCI: microchip: Add num_events field to struct plda_pcie_rp PCI: microchip: Rename interrupt related functions PCI: microchip: Move PLDA functions to pcie-plda-host.c PCI: microchip: Rename PLDA functions to be generic PCI: microchip: Move PLDA structures to plda-pcie.h PCI: microchip: Rename PLDA structures to be generic PCI: microchip: Add bridge_addr field to struct mc_pcie PCI: microchip: Move PLDA IP register macros to pcie-plda.h PCI: microchip: Move pcie-microchip-host.c to PLDA directory dt-bindings: PCI: Add PLDA XpressRICH PCIe host common properties # Conflicts: # drivers/pci/pci.h commit 145eec91b38a56a619fb1edc867f09fecc8dc44f Merge: 9965133729ed a4bbcac11d3c Author: Bjorn Helgaas Date: Fri Jul 19 10:10:28 2024 -0500 Merge branch 'pci/controller/loongson' * pci/controller/loongson: PCI: loongson: Enable MSI in LS7A Root Complex commit 9965133729ed70293f565d35bf67f6a87fe88c6a Merge: db2cc94fae13 cd09a6ac85b9 Author: Bjorn Helgaas Date: Fri Jul 19 10:10:28 2024 -0500 Merge branch 'pci/controller/layerscape' - Make the ls-gen4 struct mobiveil_rp_ops constant (Christophe JAILLET) * pci/controller/layerscape: PCI: ls-gen4: Make struct mobiveil_rp_ops constant commit db2cc94fae135e2ea9d2de68c7a2b30a2fc75e74 Merge: 477ddcd8ef8b 86f271f22bbb Author: Bjorn Helgaas Date: Fri Jul 19 10:10:28 2024 -0500 Merge branch 'pci/controller/keystone' - Enable BAR 0 only for v3.65a to avoid Completion Timeouts that cause a 45 second boot delay on the v4.90a-based AM654x SoC (Siddharth Vadapalli) - Avoid a NULL pointer dereference if DT failed to provide a host bridge memory window (Aleksandr Mishin) * pci/controller/keystone: PCI: keystone: Add workaround for Errata #i2037 (AM65x SR 1.0) PCI: keystone: Fix NULL pointer dereference in case of DT error in ks_pcie_setup_rc_app_regs() PCI: keystone: Don't enable BAR 0 for AM654x PCI: keystone: Relocate ks_pcie_set/clear_dbi_mode() commit 477ddcd8ef8bc555e021eb1a9d13bf182538a363 Merge: da3552d2256c fea93a3e5d5e Author: Bjorn Helgaas Date: Fri Jul 19 10:10:27 2024 -0500 Merge branch 'pci/controller/hyperv' - Return zero, not garbage, when reading PCI_INTERRUPT_PIN from a Hyper-V device (Wei Liu) * pci/controller/hyperv: PCI: hv: Return zero, not garbage, when reading PCI_INTERRUPT_PIN commit da3552d2256c8bb8953a65d94b26994e29998f89 Merge: 1d97f4b21539 6b11143f9344 Author: Bjorn Helgaas Date: Fri Jul 19 10:10:27 2024 -0500 Merge branch 'pci/controller/exynos' - Use devm_clk_bulk_get_all_enable() to simplify clock setup (Shradha Todi) * pci/controller/exynos: PCI: exynos: Adapt to use bulk clock APIs commit 1d97f4b215396f3501732ff09f311494db3fbdec Merge: 43f25adf9f27 045fda253511 Author: Bjorn Helgaas Date: Fri Jul 19 10:10:27 2024 -0500 Merge branch 'pci/controller/dra7xx' - Correct the dra7xx_pcie_cpu_addr_fixup() parameter name, which takes a CPU address but called it "pci_addr" (Niklas Cassel) * pci/controller/dra7xx: PCI: dra7xx: Fix dra7xx_pcie_cpu_addr_fixup() parameter name commit 43f25adf9f27a88247ab7500f0d8190bf970a4f6 Merge: e38de94eddce 7903ffa44056 Author: Bjorn Helgaas Date: Fri Jul 19 10:10:26 2024 -0500 Merge branch 'pci/controller/artpec6' - Correct the artpec6_pcie_cpu_addr_fixup() parameter name, which takes a CPU address but called it "pci_addr" (Niklas Cassel) * pci/controller/artpec6: PCI: artpec6: Fix artpec6_pcie_cpu_addr_fixup() parameter name commit e38de94eddcef3763b12e60528fe8a716af9f77c Merge: 378539328511 a9927c2cac6e Author: Bjorn Helgaas Date: Fri Jul 19 10:10:26 2024 -0500 Merge branch 'pci/controller/al' - Check IORESOURCE_BUS existence to avoid NULL pointer dereference (Aleksandr Mishin) * pci/controller/al: PCI: al: Check IORESOURCE_BUS existence during probe commit 37853932851153fe49bdb2cfd9b2f0694812504f Merge: 35f0c94a1207 9b10e877fc84 Author: Bjorn Helgaas Date: Fri Jul 19 10:10:25 2024 -0500 Merge branch 'pci/controller/dwc' - Use msleep() in DWC core instead of usleep_range() for ~100 ms sleep (Konrad Dybcio) - Fix iATU slot management to avoid using the wrong slot after PERST# assert/deassert, which could potentially cause DMA to go the wrong place (Frank Li) - Consolidate dw_pcie_prog_outbound_atu() arguments into a struct to ease adding new functionality like initiating Message TLPs (Yoshihiro Shimoda) - Add support for endpoints to initiate PCIe messages (Yoshihiro Shimoda) - Add #defines for PCIe INTx messages (Yoshihiro Shimoda) - Add support for endpoints to initiate PCIe PME_Turn_Off messages for system suspend (Frank Li) - Add dw_pcie_ep_linkdown() to reinitialize registers that are lost when the link goes down (Manivannan Sadhasivam) - Use dw_pcie_ep_linkdown() to reinitialize qcom non-sticky registers that are lost when the link goes down (Manivannan Sadhasivam) - Enforce DWC limitation that 64-bit BARs must start with the even numbered BAR (Niklas Cassel) * pci/controller/dwc: PCI: dwc: ep: Enforce DWC specific 64-bit BAR limitation PCI: layerscape-ep: Use the generic dw_pcie_ep_linkdown() API to handle Link Down event PCI: qcom-ep: Use the generic dw_pcie_ep_linkdown() API to handle Link Down event PCI: dwc: ep: Remove dw_pcie_ep_init_notify() wrapper PCI: dwc: ep: Add a generic dw_pcie_ep_linkdown() API to handle Link Down event PCI: dwc: Add generic MSG TLP support for sending PME_Turn_Off when system suspend PCI: Add PCIE_MSG_CODE_PME_TURN_OFF message macro PCI: Add PCIE_MSG_CODE_ASSERT_INTx message macros PCI: dwc: Add outbound MSG TLPs support PCI: dwc: Consolidate args of dw_pcie_prog_outbound_atu() into a structure PCI: dwc: Fix index 0 incorrectly being interpreted as a free ATU slot PCI: dwc: Use msleep() in dw_pcie_wait_for_link() commit 35f0c94a1207cd250ed705860bd223f01761b209 Merge: 0f74d8984301 d03b2dd78532 Author: Bjorn Helgaas Date: Fri Jul 19 10:10:25 2024 -0500 Merge branch 'pci/controller/gpio' - Include in dra7xx to avoid implicitly including it elsewhere (Andy Shevchenko) - Remove unused from aardvark and dwc drivers (dra7xx, meson, qcom, tegra194) (Andy Shevchenko) - Convert kirin to use scoped for_each_available_child_of_node() to ease future error exits (Javier Carrasco) - Convert imx6 and kirin to use the agnostic GPIO API to simplify GPIO setup and remove usage of the deprecated of_gpio.h API (Andy Shevchenko) * pci/controller/gpio: PCI: kirin: Convert to use agnostic GPIO API PCI: kirin: Convert kirin_pcie_parse_port() to scoped iterator PCI: imx6: Convert to use agnostic GPIO API PCI: dwc: Remove unused of_gpio.h inclusion PCI: aardvark: Remove unused of_gpio.h inclusion PCI: dra7xx: Add missing chained IRQ header inclusion commit 0f74d8984301b65879ef34ffc69de33f2c32beb2 Merge: 7095d21ef553 96447ede32d8 Author: Bjorn Helgaas Date: Fri Jul 19 10:10:25 2024 -0500 Merge branch 'pci/endpoint' - Remove unused struct pci_epf_group.type_group (Christophe JAILLET) - Use cached epc_features instead of pci_epc_get_features() to avoid having to check for failure (potential NULL pointer dereference) (Manivannan Sadhasivam) - Drop pointless local msix_capable variable in pci_epf_test_alloc_space() (Manivannan Sadhasivam) - Rename struct pci_epc_event_ops.core_init to .epc_init, since "core" is no longer meaningful here (Manivannan Sadhasivam) - Rename pci_epc_bme_notify(), pci_epf_mhi_bme(), pci_epc_bme_notify() to spell out "bus_master_enable" instead of "bme" (Manivannan Sadhasivam) - Factor pci_epf_test_clear_bar() and pci_epf_test_free_space() out of pci_epf_test_unbind() so they can be reused elsewhere (Manivannan Sadhasivam) - Move DMA initialization to the pci_epf_mhi_epc_init() callback so endpoint drivers do this uniformly (Manivannan Sadhasivam) - Add endpoint testing for Link Down events (Manivannan Sadhasivam) - Add 'epc_deinit' event so endpoints that can be reset via PERST# (qcom, tegra194) can notify EPF drivers when this happens (Manivannan Sadhasivam) - Make pci_epc_class constant (Greg Kroah-Hartman) - Fix vpci_scan_bus() error checking to print error for failure (not success) and clean up after failure (Dan Carpenter) - Fix epf_ntb_epc_cleanup() error handling to clean up scratchpad BARs and clean up in mirror order of allocation (Dan Carpenter) - Add rk3588, which requires 64KB BAR alignment, to pci_endpoint_test (Niklas Cassel) - Use memcpy_toio()/memcpy_fromio() for endpoint BAR tests to improve performance (Niklas Cassel) - Set DMA mask to 48 bits always to simplify endpoint test, since there's there's no need to check for error or to fallback to 32 bits (Frank Li) - Suggest using programmable Vendor/Device ID (when supported) to use pci_endpoint_test without having to add new entries (Yoshihiro Shimoda) - Remove unused pci_endpoint_test_bar_{readl,writel}() (Jiapeng Chong) - Remove 'linkup' and add 'add_cfs' to the endpoint function driver 'ops' documentation to match the code (Alexander Stein) - * pci/endpoint: Documentation: PCI: pci-endpoint: Fix EPF ops list misc: pci_endpoint_test: Remove unused pci_endpoint_test_bar_{readl,writel} functions misc: pci_endpoint_test: Document policy about adding pci_device_id misc: pci_endpoint_test: Refactor dma_set_mask_and_coherent() logic misc: pci_endpoint_test: Use memcpy_toio()/memcpy_fromio() for BAR tests misc: pci_endpoint_test: Add support for Rockchip rk3588 PCI: endpoint: Fix error handling in epf_ntb_epc_cleanup() PCI: endpoint: Clean up error handling in vpci_scan_bus() PCI: endpoint: Make pci_epc_class struct constant PCI: endpoint: Introduce 'epc_deinit' event and notify the EPF drivers PCI: endpoint: pci-epf-test: Handle Link Down event PCI: endpoint: pci-epf-{mhi/test}: Move DMA initialization to EPC init callback PCI: endpoint: pci-epf-test: Refactor pci_epf_test_unbind() function PCI: endpoint: Rename BME to Bus Master Enable PCI: endpoint: Rename core_init() callback in 'struct pci_epc_event_ops' to epc_init() PCI: endpoint: pci-epf-test: Use 'msix_capable' flag directly in pci_epf_test_alloc_space() PCI: endpoint: pci-epf-test: Make use of cached 'epc_features' in pci_epf_test_core_init() PCI: endpoint: Remove unused field in struct pci_epf_group commit 7095d21ef5534d753895f5f1e695a1371a2d5b44 Merge: 65d8f684a5cb 30e7c6cc88b0 Author: Bjorn Helgaas Date: Fri Jul 19 10:10:24 2024 -0500 Merge branch 'pci/dt-bindings' - Add "apb", "sys", "pmc", "msg", "err" for Endpoint descriptions as well as for Root Complexes (Niklas Cassel) - Add "tx_inta", "tx_intb", "tx_intc", "tx_intd" for interrupt signals triggered in response to PCIe Assert_INTx messages (Niklas Cassel) - Refactor rockchip-dw-pcie binding to move generic properties to a new rockchip-dw-pcie-common binding that can be shared by both RC and EP mode (Niklas Cassel) - Fix rockchip-dw-pcie description of INTx signals (Niklas Cassel) - Add rockchip-dw-pcie description of Endpoint controller (Niklas Cassel) - Avoid xilinx-versal-cpm overlapping of bridge registers and 32-bit BAR addresses (Thippeswamy Havalige) - Add qcom Operating Performance Points (OPP) table (Krishna chaitanya chundru) - Add a picture of mediatek,mt7621-pcie topology (Sergio Paracuellos) - Add a generic "ats-supported" property so the OS can discover whether a Root Complex supports ATS (Jean-Philippe Brucker) - Make the qcom,pcie-x1e80100 MHI register region mandatory (Abel Vesa) * pci/dt-bindings: dt-bindings: PCI: qcom: x1e80100: Make the MHI reg region mandatory dt-bindings: PCI: generic: Add ats-supported property dt-bindings: PCI: mediatek,mt7621-pcie: Add PCIe host topology ASCII graph dt-bindings: PCI: qcom: Add OPP table dt-bindings: PCI: xilinx-cpm: Fix overlapping of bridge register and 32-bit BAR addresses dt-bindings: PCI: rockchip: Add DesignWare based PCIe Endpoint controller dt-bindings: PCI: rockchip-dw-pcie: Fix description of legacy IRQ dt-bindings: PCI: rockchip-dw-pcie: Prepare for Endpoint mode support dt-bindings: PCI: snps,dw-pcie-ep: Add tx_int{a,b,c,d} legacy IRQs dt-bindings: PCI: snps,dw-pcie-ep: Add vendor specific interrupt-names dt-bindings: PCI: snps,dw-pcie-ep: Add vendor specific reg-name commit 65d8f684a5cb7ededa4fe7e264dbef750fa5b489 Merge: 62281339e34b 566f1dd52816 Author: Bjorn Helgaas Date: Fri Jul 19 10:10:24 2024 -0500 Merge branch 'pci/resource' - Rename find_resource() to find_resource_space() to make it more descriptive for exporting outside resource.c (Ilpo Järvinen) - Document find_resource_space() and the resource_constraint struct it uses (Ilpo Järvinen) - Add typedef resource_alignf to make it simpler to declare allocation constraint alignf callbacks (Ilpo Järvinen) - Open-code the no-constraint simple alignment case to make the simple_align_resource() default callback unnecessary (Ilpo Järvinen) - Export find_resource_space() because PCI bridge window allocation needs to learn whether there's space for a window (Ilpo Järvinen) - Fix a double-counting problem in PCI calculate_memsize() that led to allocating larger windows each time a bus was removed and rescanned (Ilpo Järvinen) - When we don't have space to allocate larger bridge windows, allocate windows only large enough for the downstream devices to prevent cases where a device worked originally, but not after being removed and re-added (Ilpo Järvinen) * pci/resource: PCI: Relax bridge window tail sizing rules PCI: Make minimum bridge window alignment reference more obvious PCI: Fix resource double counting on remove & rescan resource: Export find_resource_space() resource: Handle simple alignment inside __find_resource_space() resource: Use typedef for alignf callback resource: Document find_resource_space() and resource_constraint resource: Rename find_resource() to find_resource_space() commit 62281339e34ba39c062d7ee13a02e9f2f3c739f8 Merge: 675ba773c6b3 a4e772898f8b Author: Bjorn Helgaas Date: Fri Jul 19 10:10:23 2024 -0500 Merge branch 'pci/reset' - Warn about doing a Secondary Bus Reset without holding the device lock (Dan Williams) - Lock bridge in addition to downstream hierarchy before doing a Secondary Bus Reset (Dan Williams) * pci/reset: PCI: Add missing bridge lock to pci_bus_lock() PCI: Warn on missing cfg_access_lock during secondary bus reset commit 675ba773c6b3175b331db0933eea88346ec78d83 Merge: 5249048080f4 618b29a34697 Author: Bjorn Helgaas Date: Fri Jul 19 10:10:23 2024 -0500 Merge branch 'pci/hotplug' - Detect if a device was removed or replaced during system sleep so we don't assume a new device is the one that used to be there. This uses Vendor/Device/Subsystem/Class/Revision and Device Serial Number (if implemented), so it's not fool-proof and drivers may know how to detect more cases (Lukas Wunner) - Add missing MODULE_DESCRIPTION() macro (Jeff Johnson) * pci/hotplug: PCI: acpiphp: Add missing MODULE_DESCRIPTION() macro PCI: pciehp: Detect device replacement during system sleep commit 5249048080f4144a32cdfa4be878482a5216bee6 Merge: 903a3b1eed54 75c47c790f43 Author: Bjorn Helgaas Date: Fri Jul 19 10:10:22 2024 -0500 Merge branch 'pci/err' - Disable AER and DPC during suspend so that if they share an interrupt with PME and errors occur during suspend, the AER or DPC interrupt doesn't cause spurious wakeups (Kai-Heng Feng) * pci/err: PCI/DPC: Disable DPC service on suspend PCI/AER: Disable AER service on suspend commit 903a3b1eed540d0e02ca8489638dcf92126c8946 Merge: 147ea50e1e05 7246a4520b4b Author: Bjorn Helgaas Date: Fri Jul 19 10:10:22 2024 -0500 Merge branch 'pci/enumeration' - Move the PRESERVE_BOOT_CONFIG ACPI _DSM evaluation from drivers/acpi to drivers/pci so we can unify with similar DT functionality (Vidya Sagar) - Add of_pci_preserve_config() to check for a DT "linux,pci-probe-only" property on a per-host bridge basis in addition to a global basis (Vidya Sagar) - Unify ACPI PRESERVE_BOOT_CONFIG _DSM and DT "linux,pci-probe-only" in a generic pci_preserve_config() path (Vidya Sagar) * pci/enumeration: PCI: Use preserve_config in place of pci_flags PCI: Unify ACPI and DT 'preserve config' support PCI: of: Add of_pci_preserve_config() for per-host bridge support PCI: Move PRESERVE_BOOT_CONFIG _DSM evaluation to pci_register_host_bridge() commit 147ea50e1e0508544156b0465dc07fd8739281f4 Merge: 06bbe25c21a0 11a1f4bc4736 Author: Bjorn Helgaas Date: Fri Jul 19 10:10:22 2024 -0500 Merge branch 'pci/dpc' - If there's a device below a bridge, prevent a use-after-free by holding a reference to the device while waiting for the secondary bus to be ready in case the device is concurrently removed, e.g., by DPC (Lukas Wunner) * pci/dpc: PCI/DPC: Fix use-after-free on concurrent DPC and hot-removal commit 06bbe25c21a02ec09682be5077f22198870040e2 Merge: cb43487e5dc3 f00059b4c1b0 Author: Bjorn Helgaas Date: Fri Jul 19 10:10:21 2024 -0500 Merge branch 'pci/devres' - Add pcim_add_mapping_to_legacy_table() and pcim_remove_mapping_from_legacy_table() helper functions to simplify devres iomap table (Philipp Stanner) - Reimplement devres that take a bit mask of BARs in a way that can be used to map partial BARs as well as entire BARs (Philipp Stanner) - Deprecate pcim_iomap_table() and pcim_iomap_regions_request_all() in favor of pcim_* request plus pcim_* mapping (Philipp Stanner) - Add pcim_request_region(), a managed interface to request a single BAR (Philipp Stanner) - Use the existing pci_is_enabled() interface to replace the struct devres.enabled bit (Philipp Stanner) - Move the struct pci_devres.pinned bit to struct pci_dev (Philipp Stanner) - Reimplement pcim_set_mwi() so it uses its own devres cleanup callback instead of a special-purpose bit in struct pci_devres (Philipp Stanner) - Add pcim_intx(), which is unambiguously managed, unlike pci_intx(), which is managed if pcim_enable_device() has been called but unmanaged otherwise (Philipp Stanner) - Remove pcim_release(), which is no longer needed after previous cleanups of pcim_set_mwi() and pci_intx() (Philipp Stanner) - Add pcim_iomap_range(), a managed interface to map part of a BAR (Philipp Stanner) - Fix vboxvideo leak by using the new pcim_iomap_range() instead of the unmanaged pci_iomap_range() (Philipp Stanner) * pci/devres: drm/vboxvideo: fix mapping leaks PCI: Add managed pcim_iomap_range() PCI: Remove legacy pcim_release() PCI: Add managed pcim_intx() PCI: Give pcim_set_mwi() its own devres cleanup callback PCI: Move struct pci_devres.pinned bit to struct pci_dev PCI: Remove struct pci_devres.enabled status bit PCI: Document hybrid devres hazards PCI: Add managed pcim_request_region() PCI: Deprecate pcim_iomap_table(), pcim_iomap_regions_request_all() PCI: Add managed partial-BAR request and map infrastructure PCI: Add devres helpers for iomap table PCI: Add and use devres helper for bit masks commit cb43487e5dc3efddc14c66938138b5908789be59 Merge: 1613e604df0c 47c8846a49ba Author: Bjorn Helgaas Date: Fri Jul 19 10:10:21 2024 -0500 Merge branch 'pci/acs' - Add ACS quirk for Broadcom BCM5760X NIC, which doesn't allow peer-to-peer transactions between functions, but doesn't advertise ACS support (Ajit Khaparde) - Add "pci=config_acs=" kernel command-line parameter to relax default ACS settings to enable peer-to-peer configurations. Requires expert knowledge of topology and ACS operation (Vidya Sagar) * pci/acs: PCI: Extend ACS configurability PCI: Add ACS quirk for Broadcom BCM5760X NIC commit a4bbcac11d3cea85822af8b40daed7e96bca5068 Author: Huacai Chen Date: Wed Jun 12 14:53:15 2024 +0800 PCI: loongson: Enable MSI in LS7A Root Complex The LS7A chipset can be used as part of a PCIe Root Complex with Loongson-3C6000 and similar CPUs. In this case, DEV_LS7A_PCIE_PORT5 has a PCI_CLASS_BRIDGE_HOST class code, and it is a Type 0 Function whose config space provides access to Root Complex registers. The DEV_LS7A_PCIE_PORT5 has an MSI Capability, and its MSI Enable bit must be set before other devices below the Root Complex can use MSI. This is not the standard PCI behavior of MSI Enable, so the normal PCI MSI code does not set it. Set the DEV_LS7A_PCIE_PORT5 MSI Enable bit via a quirk so other devices below the Root Complex can use MSI. [kwilczynski: exit early to reduce indentation; commit log] Link: https://lore.kernel.org/linux-pci/20240612065315.2048110-1-chenhuacai@loongson.cn Signed-off-by: Sheng Wu Signed-off-by: Huacai Chen Signed-off-by: Krzysztof Wilczyński [bhelgaas: commit log] Signed-off-by: Bjorn Helgaas Cc: stable@vger.kernel.org drivers/pci/controller/pci-loongson.c | 13 +++++++++++++ 1 file changed, 13 insertions(+) commit a2d6d8aee4a4f694920bfaf6f6be3690e0f8d302 Author: Arnd Bergmann Date: Fri Jul 19 11:56:34 2024 +0200 ALSA: hda: tas2781: mark const variables as __maybe_unused An earlier patch changed the DECLARE_TLV_DB_SCALE declaration, but now there are additional static const variables that cause the same build warnings: In file included from sound/pci/hda/tas2781_hda_i2c.c:23: include/sound/tas2781-tlv.h:23:28: error: 'tas2563_dvc_table' defined but not used [-Werror=unused-const-variable=] 23 | static const unsigned char tas2563_dvc_table[][4] = { | ^~~~~~~~~~~~~~~~~ In file included from include/sound/tlv.h:10, from sound/pci/hda/tas2781_hda_i2c.c:22: include/sound/tas2781-tlv.h:20:35: error: 'tas2563_dvc_tlv' defined but not used [-Werror=unused-const-variable=] 20 | static const DECLARE_TLV_DB_SCALE(tas2563_dvc_tlv, -12150, 50, 1); | ^~~~~~~~~~~~~~~ Mark them all as unused as well. Signed-off-by: Arnd Bergmann Link: https://patch.msgid.link/20240719095640.3741247-1-arnd@kernel.org Signed-off-by: Takashi Iwai include/sound/tas2781-tlv.h | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) commit 3ae08e47742eeebf2190900d31ddac53fdd13a5b Author: Arnd Bergmann Date: Fri Jul 19 16:44:10 2024 +0200 gpio: virtuser: avoid non-constant format string Using a string variable as an sprintf format is potentially dangerous, and gcc can warn about this: drivers/gpio/gpio-virtuser.c: In function 'gpio_virtuser_dbgfs_init_line_attrs': drivers/gpio/gpio-virtuser.c:808:9: error: format not a string literal and no format arguments [-Werror=format-security] 808 | sprintf(data->consumer, id); | ^~~~~~~ Change it to a simpler strscpy() instead to just copy it and check the destination buffer size. Fixes: 91581c4b3f29 ("gpio: virtuser: new virtual testing driver for the GPIO API") Signed-off-by: Arnd Bergmann Link: https://lore.kernel.org/r/20240719144422.2082394-1-arnd@kernel.org Signed-off-by: Bartosz Golaszewski drivers/gpio/gpio-virtuser.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 74dba240881820b46b9b1c62ef4de3bfff47fbd4 Author: wangdicheng Date: Fri Jul 19 10:09:06 2024 +0800 ALSA: usb-audio: Fix microphone sound on HD webcam. I own an external usb Webcam, HD webcam, which had low mic volume and inconsistent sound quality. Video works as expected. (snip) [ 95.473820][ 1] [ T73] usb 5-2.2: new high-speed USB device number 7 using xhci_hcd [ 95.773974][ 1] [ T73] usb 5-2.2: New USB device found, idVendor=1bcf, idProduct=2281, bcdDevice= 0.05 [ 95.783445][ 1] [ T73] usb 5-2.2: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 95.791872][ 1] [ T73] usb 5-2.2: Product: HD webcam [ 95.797001][ 1] [ T73] usb 5-2.2: Manufacturer: Sunplus IT Co [ 95.802996][ 1] [ T73] usb 5-2.2: SerialNumber: 20200513 [ 96.092610][ 2] [ T3680] usb 5-2.2: Warning! Unlikely big volume range (=4096), cval->res is probably wrong. [ 96.102436][ 2] [ T3680] usb 5-2.2: [5] FU [Mic Capture Volume] ch = 1, val = 0/4096/1 Set up quirk cval->res to 16 for 256 levels, Set GET_SAMPLE_RATE quirk flag to stop trying to get the sample rate. Confirmed that happened anyway later due to the backoff mechanism, After 3 failures. All audio stream on device interfaces share the same values, apart from wMaxPacketSize and tSamFreq : bLength 9 bDescriptorType 4 bInterfaceNumber 3 bAlternateSetting 4 bNumEndpoints 1 bInterfaceClass 1 Audio Interface Descriptor: bLength 9 bDescriptorType 4 bInterfaceNumber 3 bAlternateSetting 4 bNumEndpoints 1 bInterfaceClass 1 Audio bInterfaceSubClass 2 Streaming bInterfaceProtocol 0 iInterface 0 AudioStreaming Interface Descriptor: bLength 7 bDescriptorType 36 bDescriptorSubtype 1 (AS_GENERAL) bTerminalLink 3 bDelay 1 frames wFormatTag 0x0001 PCM AudioStreaming Interface Descriptor: bLength 11 bDescriptorType 36 bDescriptorSubtype 2 (FORMAT_TYPE) bFormatType 1 (FORMAT_TYPE_I) bNrChannels 1 bSubframeSize 2 bBitResolution 16 bSamFreqType 1 Discrete tSamFreq[ 0] 48000 Endpoint Descriptor: bLength 9 bDescriptorType 5 bEndpointAddress 0x86 EP 6 IN bmAttributes 5 Transfer Type Isochronous Synch Type Asynchronous Usage Type Data wMaxPacketSize 0x0064 1x 100 bytes bInterval 4 bRefresh 0 bSynchAddress 0 AudioStreaming Endpoint Descriptor: bLength 7 bDescriptorType 37 bDescriptorSubtype 1 (EP_GENERAL) bmAttributes 0x01 Sampling Frequency bLockDelayUnits 0 Undefined wLockDelay 0x0000 (snip) Testing patch provides consistent good sound recording quality and volume range. (snip) [ 95.473820][ 1] [ T73] usb 5-2.2: new high-speed USB device number 7 using xhci_hcd [ 95.773974][ 1] [ T73] usb 5-2.2: New USB device found, idVendor=1bcf, idProduct=2281, bcdDevice= 0.05 [ 95.783445][ 1] [ T73] usb 5-2.2: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 95.791872][ 1] [ T73] usb 5-2.2: Product: HD webcam [ 95.797001][ 1] [ T73] usb 5-2.2: Manufacturer: Sunplus IT Co [ 95.802996][ 1] [ T73] usb 5-2.2: SerialNumber: 20200513 [ 96.110630][ 3] [ T3680] usbcore: registered new interface driver snd-usb-audio [ 96.114329][ 7] [ T3677] usb 5-2.2: Found UVC 1.00 device HD webcam (1bcf:2281) [ 96.167555][ 7] [ T3677] usbcore: registered new interface driver uvcvideo Signed-off-by: wangdicheng Cc: Link: https://patch.msgid.link/20240719020906.8078-1-wangdich9700@163.com Signed-off-by: Takashi Iwai sound/usb/mixer.c | 7 +++++++ sound/usb/quirks.c | 2 ++ 2 files changed, 9 insertions(+) commit 4359836129d931fc424370249a1fcdec139fe407 Author: Jakub Kicinski Date: Wed Jul 17 09:15:59 2024 -0700 eth: fbnic: don't build the driver when skb has more than 21 frags Similarly to commit 0e03c643dc93 ("eth: fbnic: fix s390 build."), the driver won't build if skb_shared_info has more than 25 frags assuming a 64B cache line and 21 frags assuming a 128B cache line. (512 - 48 - 64) / 16 = 25 (512 - 48 - 128) / 16 = 21 Fixes: 0cb4c0a13723 ("eth: fbnic: Implement Rx queue alloc/start/stop/free") Signed-off-by: Jakub Kicinski Link: https://patch.msgid.link/20240717161600.1291544-1-kuba@kernel.org Signed-off-by: Paolo Abeni drivers/net/ethernet/meta/Kconfig | 1 + 1 file changed, 1 insertion(+) commit 785280973472dbdee2c31cb740633c4b6460a8ee Author: Arnd Bergmann Date: Fri Jul 19 12:54:22 2024 +0200 sunrpc: avoid -Wformat-security warning Using a non-constant string as an sprintf-style is potentially dangerous: net/sunrpc/svc.c: In function 'param_get_pool_mode': net/sunrpc/svc.c:164:32: error: format not a string literal and no format arguments [-Werror=format-security] Use a literal "%s" format instead. Fixes: 5f71f3c32553 ("sunrpc: refactor pool_mode setting code") Signed-off-by: Arnd Bergmann Reviewed-by: Jeff Layton Signed-off-by: Chuck Lever net/sunrpc/svc.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit b57d5ffc3ab507d0e19fc8b90b19c76af43fb790 Author: Greg Kroah-Hartman Date: Fri Jul 12 11:39:17 2024 +0200 ARM: sa1100: make match function take a const pointer In commit d69d80484598 ("driver core: have match() callback in struct bus_type take a const *"), the match callback for busses was changed to take a const pointer to struct device_driver. Unfortunately I missed fixing up the sa1111 code, and was only noticed after-the-fact by the kernel test robot. Resolve this issue by properly changing the sa111_match() function. Cc: Russell King Fixes: d69d80484598 ("driver core: have match() callback in struct bus_type take a const *") Reported-by: kernel test robot Link: https://lore.kernel.org/r/20240712093916.2121096-2-gregkh@linuxfoundation.org Signed-off-by: Greg Kroah-Hartman arch/arm/common/sa1111.c | 4 ++-- arch/arm/include/asm/hardware/sa1111.h | 2 +- 2 files changed, 3 insertions(+), 3 deletions(-) commit 7f1c4909a821dbfd258177db9ec96dda3ae91346 Author: Masatake YAMATO Date: Wed Jul 17 04:05:59 2024 +0900 dm vdo: fix a minor formatting issue in vdo.rst Signed-off-by: Masatake YAMATO Signed-off-by: Matthew Sakai Signed-off-by: Mikulas Patocka Documentation/admin-guide/device-mapper/vdo.rst | 1 + 1 file changed, 1 insertion(+) commit 513789b7fb5366a7c26c9d347d83eaba6c33a537 Author: Matthew Sakai Date: Mon Jul 15 10:43:39 2024 -0400 dm vdo int-map: fix kerneldoc formatting Reported-by: kernel test robot Closes: https://lore.kernel.org/oe-kbuild-all/202407141607.M3E2XQ0Z-lkp@intel.com/ Signed-off-by: Matthew Sakai Signed-off-by: Mikulas Patocka drivers/md/dm-vdo/int-map.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit fa398e603ff79523ac5f40632f061396baa58593 Author: Matthew Sakai Date: Mon Jul 15 12:45:15 2024 -0400 dm vdo repair: add missing kerneldoc fields Also remove trivial comment for increment_recovery_point. Reported-by: Abaci Robot Closes: https://bugzilla.openanolis.cn/show_bug.cgi?id=9518 Signed-off-by: Matthew Sakai Signed-off-by: Mikulas Patocka drivers/md/dm-vdo/repair.c | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-) commit 0b60be1628e3448fc96e28bde3d0b27e6d8743fc Author: Christophe JAILLET Date: Sun Jul 14 09:13:56 2024 +0200 dm: Constify struct dm_block_validator 'struct dm_block_validator' are not modified in these drivers. Constifying this structure moves some data to a read-only section, so increase overall security. On a x86_64, with allmodconfig, as an example: Before: ====== text data bss dec hex filename 32047 920 16 32983 80d7 drivers/md/dm-cache-metadata.o After: ===== text data bss dec hex filename 32075 896 16 32987 80db drivers/md/dm-cache-metadata.o Signed-off-by: Christophe JAILLET Signed-off-by: Mikulas Patocka drivers/md/dm-cache-metadata.c | 6 +++--- drivers/md/dm-clone-metadata.c | 6 +++--- drivers/md/dm-era-target.c | 6 +++--- drivers/md/dm-thin-metadata.c | 6 +++--- drivers/md/persistent-data/dm-array.c | 6 +++--- drivers/md/persistent-data/dm-block-manager.c | 12 ++++++------ drivers/md/persistent-data/dm-block-manager.h | 14 ++++++++------ drivers/md/persistent-data/dm-btree-internal.h | 2 +- drivers/md/persistent-data/dm-btree-spine.c | 6 +++--- drivers/md/persistent-data/dm-space-map-common.c | 12 ++++++------ drivers/md/persistent-data/dm-transaction-manager.c | 8 ++++---- drivers/md/persistent-data/dm-transaction-manager.h | 6 +++--- 12 files changed, 46 insertions(+), 44 deletions(-) commit fb0987682c629c1d2c476f35f6fde405a5e304a4 Author: Mikulas Patocka Date: Wed Jul 10 21:00:18 2024 +0200 dm-integrity: introduce the Inline mode This commit introduces a new 'I' mode for dm-integrity. The 'I' mode may be selected if the underlying device has non-power-of-2 sector size. In this mode, dm-integrity will store integrity data directly in device's sectors and it will not use journal. This mode improves performance and reduces flash wear because there would be no journal writes. Signed-off-by: Mikulas Patocka Signed-off-by: Mike Snitzer drivers/md/dm-integrity.c | 406 ++++++++++++++++++++++++++++++++++++++++------ 1 file changed, 360 insertions(+), 46 deletions(-) commit 1a8c67a8b21e26843d5641c55f48130b3e323ce8 Author: Arnd Bergmann Date: Fri Jul 19 09:27:47 2024 +0200 arm64: qcom: don't select HAVE_PWRCTL when PCI=n The new HAVE_PWRCTL option is defined in the PCI subsystem, so selecting it unconditionally when PCI is disabled causes a harmless warning: WARNING: unmet direct dependencies detected for HAVE_PWRCTL Depends on [n]: PCI [=n] Selected by [y]: - ARCH_QCOM [=y] Add 'if PCI' in the qualcomm platform to hide the warning. Fixes: ed70aaac7c35 ("Kconfig: reduce the amount of power sequencing noise") Signed-off-by: Arnd Bergmann Signed-off-by: Bartosz Golaszewski arch/arm64/Kconfig.platforms | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 12c35c5582acb0fd8f7713ffa75f450766022ff1 Author: Jammy Huang Date: Thu Jul 18 11:03:52 2024 +0800 drm/ast: Fix black screen after resume Suspend will disable pcie device. Thus, resume should do full hw initialization again. Add some APIs to ast_drm_thaw() before ast_post_gpu() to fix the issue. v2: - fix function-call arguments Fixes: 5b71707dd13c ("drm/ast: Enable and unlock device access early during init") Reported-by: Cary Garrett Closes: https://lore.kernel.org/dri-devel/8ce1e1cc351153a890b65e62fed93b54ccd43f6a.camel@gmail.com/ Cc: Thomas Zimmermann Cc: Jocelyn Falempe Cc: Dave Airlie Cc: dri-devel@lists.freedesktop.org Cc: # v6.6+ Signed-off-by: Jammy Huang Reviewed-by: Thomas Zimmermann Signed-off-by: Thomas Zimmermann Link: https://patchwork.freedesktop.org/patch/msgid/20240718030352.654155-1-jammy_huang@aspeedtech.com drivers/gpu/drm/ast/ast_drv.c | 5 +++++ 1 file changed, 5 insertions(+) commit 5c28424e9a348f95e3c634fe2ed6da8af29cc870 Author: Masami Hiramatsu (Google) Date: Fri Jul 19 14:35:51 2024 +0900 syscalls: Fix to add sys_uretprobe to syscall.tbl Add sys_uretprobe entry to scripts/syscall.tbl as same as arch/x86/entry/syscalls/syscall_64.tbl. Reported-by: Stephen Rothwell Closes: https://lore.kernel.org/all/20240719102824.1e086a40@canb.auug.org.au/ Fixes: 63ded110979b ("uprobe: Change uretprobe syscall scope and number") Signed-off-by: Masami Hiramatsu (Google) scripts/syscall.tbl | 1 + 1 file changed, 1 insertion(+) commit 28e8b7406d3a1f5329a03aa25a43aa28e087cb20 Author: Lance Richardson Date: Thu Jul 18 14:38:24 2024 +0000 dma: fix call order in dmam_free_coherent dmam_free_coherent() frees a DMA allocation, which makes the freed vaddr available for reuse, then calls devres_destroy() to remove and free the data structure used to track the DMA allocation. Between the two calls, it is possible for a concurrent task to make an allocation with the same vaddr and add it to the devres list. If this happens, there will be two entries in the devres list with the same vaddr and devres_destroy() can free the wrong entry, triggering the WARN_ON() in dmam_match. Fix by destroying the devres entry before freeing the DMA allocation. Tested: kokonut //net/encryption http://sponge2/b9145fe6-0f72-4325-ac2f-a84d81075b03 Fixes: 9ac7849e35f7 ("devres: device resource management") Signed-off-by: Lance Richardson Signed-off-by: Christoph Hellwig kernel/dma/mapping.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 2fa88b191929d3115ccda098071b34922957bb08 Author: Kent Overstreet Date: Wed Jul 17 11:56:05 2024 -0400 bcachefs: kill btree_trans_too_many_iters() in bch2_bucket_alloc_freelist() When we're called via trans commit -> btree split -> allocator We may have already arbitrarily many btree_paths, for the transaction commit we're trying to do; when this happens, the btree_trans_too_many_iters() call causes us to livelock. Since the allocator calls btree_iter_dontneed to release paths as it iterates, this shouldn't cause any problems. Signed-off-by: Kent Overstreet fs/bcachefs/alloc_foreground.c | 6 ------ 1 file changed, 6 deletions(-) commit 720261cfc7329406a50c2a8536e0039b9dd9a4e5 Merge: 4f40c636b291 a97b43fac5b9 Author: Linus Torvalds Date: Thu Jul 18 17:27:43 2024 -0700 Merge tag 'bcachefs-2024-07-18.2' of https://evilpiepirate.org/git/bcachefs Pull bcachefs updates from Kent Overstreet: - Metadata version 1.8: Stripe sectors accounting, BCH_DATA_unstriped This splits out the accounting of dirty sectors and stripe sectors in alloc keys; this lets us see stripe buckets that still have unstriped data in them. This is needed for ensuring that erasure coding is working correctly, as well as completing stripe creation after a crash. - Metadata version 1.9: Disk accounting rewrite The previous disk accounting scheme relied heavily on percpu counters that were also sharded by outstanding journal buffer; it was fast but not extensible or scalable, and meant that all accounting counters were recorded in every journal entry. The new disk accounting scheme stores accounting as normal btree keys; updates are deltas until they are flushed by the btree write buffer. This means we have no practical limit on the number of counters, and a new tagged union format that's easy to extend. We now have counters for compression type/ratio, per-snapshot-id usage, per-btree-id usage, and pending rebalance work. - Self healing on read IO/checksum error Data is now automatically rewritten if we get a read error and then a successful retry - Mount API conversion (thanks to Thomas Bertschinger) - Better lockdep coverage Previously, btree node locks were tracked individually by lockdep, like any other lock. But we may take _many_ btree node locks simultaneously, we easily blow through the limit of 48 locks that lockdep can track, leading to lockdep turning itself off. Tracking each btree node lock individually isn't really necessary since we have our own cycle detector for deadlock avoidance and centralized tracking of btree node locks, so we now have a single lockdep_map in btree_trans for "any btree nodes are locked". - Some more small incremental work towards online check_allocations - Lots more debugging improvements - Fixes, including: - undefined behaviour fixes, originally noted as breaking userspace LTO builds - fix a spurious warning in fsck_err, reported by Marcin - fix an integer overflow on trans->nr_updates, also reported by Marcin; this broke during deletion of highly fragmented indirect extents * tag 'bcachefs-2024-07-18.2' of https://evilpiepirate.org/git/bcachefs: (120 commits) lockdep: Add comments for lockdep_set_no{validate,track}_class() bcachefs: Fix integer overflow on trans->nr_updates bcachefs: silence silly kdoc warning bcachefs: Fix fsck warning about btree_trans not passed to fsck error bcachefs: Add an error message for insufficient rw journal devs bcachefs: varint: Avoid left-shift of a negative value bcachefs: darray: Don't pass NULL to memcpy() bcachefs: Kill bch2_assert_btree_nodes_not_locked() bcachefs: Rename BCH_WRITE_DONE -> BCH_WRITE_SUBMITTED bcachefs: __bch2_read(): call trans_begin() on every loop iter bcachefs: show none if label is not set bcachefs: drop packed, aligned from bkey_inode_buf bcachefs: btree node scan: fall back to comparing by journal seq bcachefs: Add lockdep support for btree node locks lockdep: lockdep_set_notrack_class() bcachefs: Improve copygc_wait_to_text() bcachefs: Convert clock code to u64s bcachefs: Improve startup message bcachefs: Self healing on read IO error bcachefs: Make read_only a mount option again, but hidden ... commit 4f40c636b291deeae7d1f4c9fb5db5f0aac54267 Merge: 51ed42a8a135 b9fae9f06d84 Author: Linus Torvalds Date: Thu Jul 18 17:17:30 2024 -0700 Merge tag 'nfs-for-6.11-1' of git://git.linux-nfs.org/projects/anna/linux-nfs Pull NFS client updates from Anna Schumaker: "New Features: - Add support for large folios - Implement rpcrdma generic device removal notification - Add client support for attribute delegations - Use a LAYOUTRETURN during reboot recovery to report layoutstats and errors - Improve throughput for random buffered writes - Add NVMe support to pnfs/blocklayout Bugfixes: - Fix rpcrdma_reqs_reset() - Avoid soft lockups when using UDP - Fix an nfs/blocklayout premature PR key unregestration - Another fix for EXCHGID4_FLAG_USE_PNFS_DS for DS server - Do not extend writes to the entire folio - Pass explicit offset and count values to tracepoints - Fix a race to wake up sleeping SUNRPC sync tasks - Fix gss_status tracepoint output Cleanups: - Add missing MODULE_DESCRIPTION() macros - Add blocklayout / SCSI layout tracepoints - Remove asm-generic headers from xprtrdma verbs.c - Remove unused 'struct mnt_fhstatus' - Other delegation related cleanups - Other folio related cleanups - Other pNFS related cleanups - Other xprtrdma cleanups" * tag 'nfs-for-6.11-1' of git://git.linux-nfs.org/projects/anna/linux-nfs: (63 commits) SUNRPC: Fixup gss_status tracepoint error output SUNRPC: Fix a race to wake a sync task nfs: split nfs_read_folio nfs: pass explicit offset/count to trace events nfs: do not extend writes to the entire folio nfs/blocklayout: add support for NVMe nfs: remove nfs_page_length nfs: remove the unused max_deviceinfo_size field from struct pnfs_layoutdriver_type nfs: don't reuse partially completed requests in nfs_lock_and_join_requests nfs: move nfs_wait_on_request to write.c nfs: fold nfs_page_group_lock_subrequests into nfs_lock_and_join_requests nfs: fold nfs_folio_find_and_lock_request into nfs_lock_and_join_requests nfs: simplify nfs_folio_find_and_lock_request nfs: remove nfs_folio_private_request nfs: remove dead code for the old swap over NFS implementation NFSv4.1 another fix for EXCHGID4_FLAG_USE_PNFS_DS for DS server nfs: Block on write congestion nfs: Properly initialize server->writeback nfs: Drop pointless check from nfs_commit_release_pages() nfs/blocklayout: SCSI layout trace points for reservation key reg/unreg ... commit 51ed42a8a135511f6d6f75b56e85e6586a06a93c Merge: dddebdece62e f9ca51596bbf Author: Linus Torvalds Date: Thu Jul 18 17:03:42 2024 -0700 Merge tag 'ext4_for_linus-6.11-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/tytso/ext4 Pull ext4 updates from Ted Ts'o: "Many cleanups and bug fixes in ext4, especially for the fast commit feature. Also some performance improvements; in particular, improving IOPS and throughput on fast devices running Async Direct I/O by up to 20% by optimizing jbd2_transaction_committed()" * tag 'ext4_for_linus-6.11-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/tytso/ext4: (40 commits) ext4: make sure the first directory block is not a hole ext4: check dot and dotdot of dx_root before making dir indexed ext4: sanity check for NULL pointer after ext4_force_shutdown jbd2: increase maximum transaction size jbd2: drop pointless shrinker batch initialization jbd2: avoid infinite transaction commit loop jbd2: precompute number of transaction descriptor blocks jbd2: make jbd2_journal_get_max_txn_bufs() internal jbd2: avoid mount failed when commit block is partial submitted ext4: avoid writing unitialized memory to disk in EA inodes ext4: don't track ranges in fast_commit if inode has inlined data ext4: fix possible tid_t sequence overflows ext4: use ext4_update_inode_fsync_trans() helper in inode creation ext4: add missing MODULE_DESCRIPTION() jbd2: add missing MODULE_DESCRIPTION() ext4: use memtostr_pad() for s_volume_name jbd2: speed up jbd2_transaction_committed() ext4: make ext4_da_map_blocks() buffer_head unaware ext4: make ext4_insert_delayed_block() insert multi-blocks ext4: factor out a helper to check the cluster allocation state ... commit dddebdece62ead1ac1112e6df375f56a1cb45f84 Merge: cf05e93af423 280e36f0d5b9 Author: Linus Torvalds Date: Thu Jul 18 16:59:02 2024 -0700 Merge tag 'vfs-6.11-rc1.fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs Pull vfs fixes from Christian Brauner: - Fix a missing rcu_read_unlock() in nsfs by switching to a cleanup guard - Add missing module descriptor for adfs * tag 'vfs-6.11-rc1.fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs: nsfs: use cleanup guard fs/adfs: add MODULE_DESCRIPTION commit cf05e93af423b225fb3e3237e7d46493c7909f2b Merge: 7dd894c1bf65 702418f7559f Author: Linus Torvalds Date: Thu Jul 18 15:54:16 2024 -0700 Merge tag 'docs-6.11' of git://git.lwn.net/linux Pull documentation updates from Jonathan Corbet: "Nothing hugely exciting happening in the documentation tree this time around, mostly more of the usual: - More Spanish, Italian, and Chinese translations - A new script, scripts/checktransupdate.py, can be used to see which commits have touched an (English) document since a given translation was last updated. - A couple of "best practices" suggestions (on Link: tags and off-list discussions) that were not entirely at consensus level, but I concluded they were close enough to accept. - Some nice cleanups removing documentation for kernel parameters that have not been recognized for ... a long time. ...along with the usual updates, typo fixes, and such" * tag 'docs-6.11' of git://git.lwn.net/linux: (57 commits) Documentation: Document user_events ioctl code docs/pinctrl: fix typo in mapping example docs: maintainer: discourage taking conversations off-list docs: driver-model: platform: update the definition of platform_driver docs/sp_SP: Add translation for scheduler/sched-design-CFS.rst writing_musb_glue_layer.rst: Fix broken URL zh_CN/admin-guide: one typo fix docs/zh_CN/virt: Update the translation of guest-halt-polling.rst Documentation: add reference from dynamic debug to loglevel kernel params Documentation: best practices for using Link trailers Documentation: fix links to mailing list services Documentation: exception-tables.rst: Fix the wrong steps referenced docs/zh_CN: add process/researcher-guidelines Chinese translation Documentation/tools/rv: fix document header docs/sp_SP: Add translation of process/maintainer-kvm-x86.rst docs/admin-guide/mm: correct typo 'quired' to 'queried' Add libps2 to the input section of driver-api Docs/mm/index: move allocation profiling document to unsorted documents chapter Docs/mm/index: rename 'Legacy Documentation' to 'Unsorted Documentation' Docs/mm/index: Remove 'Memory Management Guide' chapter marker ... commit 7dd894c1bf65a9591ba27f6175cf3238748deb47 Merge: 1c7d0c3af5cc a3da15389112 Author: Linus Torvalds Date: Thu Jul 18 15:48:41 2024 -0700 Merge tag 'sparc-for-6.11-tag1' of git://git.kernel.org/pub/scm/linux/kernel/git/alarsson/linux-sparc Pull sparc updates from Andreas Larsson: - Add MODULE_DESCRIPTION for a number of sbus drivers - Fix linking error for large sparc32 kernels - Fix incorrect functions signature and prototype warnings for sparc64 * tag 'sparc-for-6.11-tag1' of git://git.kernel.org/pub/scm/linux/kernel/git/alarsson/linux-sparc: sparc64: Fix prototype warnings in hibernate.c sparc64: Fix prototype warning for prom_get_mmu_ihandle sparc64: Fix incorrect function signature and add prototype for prom_cif_init sparc64: Fix prototype warnings for floppy_64.h sparc32: Fix truncated relocation errors when linking large kernels sbus: add missing MODULE_DESCRIPTION() macros commit 1c7d0c3af5cc8adafef6477f9416820fc894ca40 Merge: dde1a0e1625c df39038cd895 Author: Linus Torvalds Date: Thu Jul 18 15:41:45 2024 -0700 Merge tag 's390-6.11-1' of git://git.kernel.org/pub/scm/linux/kernel/git/s390/linux Pull s390 updates from Vasily Gorbik: - Remove restrictions on PAI NNPA and crypto counters, enabling concurrent per-task and system-wide sampling and counting events - Switch to GENERIC_CPU_DEVICES by setting up the CPU present mask in the architecture code and letting the generic code handle CPU bring-up - Add support for the diag204 busy indication facility to prevent undesirable blocking during hypervisor logical CPU utilization queries. Implement results caching - Improve the handling of Store Data SCLP events by suppressing unnecessary warning, preventing buffer release in I/O during failures, and adding timeout handling for Store Data requests to address potential firmware issues - Provide optimized __arch_hweight*() implementations - Remove the unnecessary CPU KOBJ_CHANGE uevents generated during topology updates, as they are unused and also not present on other architectures - Cleanup atomic_ops, optimize __atomic_set() for small values and __atomic_cmpxchg_bool() for compilers supporting flag output constraint - Couple of cleanups for KVM: - Move and improve KVM struct definitions for DAT tables from gaccess.c to a new header - Pass the asce as parameter to sie64a() - Make the crdte() and cspg() page table handling wrappers return a boolean to indicate success, like the other existing "compare and swap" wrappers - Add documentation for HWCAP flags - Switch to obtaining total RAM pages from memblock instead of totalram_pages() during mm init, to ensure correct calculation of zero page size, when defer_init is enabled - Refactor lowcore access and switch to using the get_lowcore() function instead of the S390_lowcore macro - Cleanups for PG_arch_1 and folio handling in UV and hugetlb code - Add missing MODULE_DESCRIPTION() macros - Fix VM_FAULT_HWPOISON handling in do_exception() * tag 's390-6.11-1' of git://git.kernel.org/pub/scm/linux/kernel/git/s390/linux: (54 commits) s390/mm: Fix VM_FAULT_HWPOISON handling in do_exception() s390/kvm: Move bitfields for dat tables s390/entry: Pass the asce as parameter to sie64a() s390/sthyi: Use cached data when diag is busy s390/sthyi: Move diag operations s390/hypfs_diag: Diag204 busy loop s390/diag: Add busy-indication-facility requirements s390/diag: Diag204 add busy return errno s390/diag: Return errno's from diag204 s390/sclp: Diag204 busy indication facility detection s390/atomic_ops: Make use of flag output constraint s390/atomic_ops: Improve __atomic_set() for small values s390/atomic_ops: Use symbolic names s390/smp: Switch to GENERIC_CPU_DEVICES s390/hwcaps: Add documentation for HWCAP flags s390/pgtable: Make crdte() and cspg() return a value s390/topology: Remove CPU KOBJ_CHANGE uevents s390/sclp: Add timeout to Store Data requests s390/sclp: Prevent release of buffer in I/O s390/sclp: Suppress unnecessary Store Data warning ... commit 73f88592dd1bef38542024ef8223599afc2c41bb Author: Tavian Barnes Date: Fri Jun 21 16:38:44 2024 -0400 bcachefs: mean_and_variance: Avoid too-large shift amounts Shifting a value by the width of its type or more is undefined. Signed-off-by: Tavian Barnes Signed-off-by: Kent Overstreet fs/bcachefs/mean_and_variance.h | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) commit a97b43fac5b9b3ffca71b8a917a249789902fce9 Author: Kent Overstreet Date: Thu Jul 18 17:17:10 2024 -0400 lockdep: Add comments for lockdep_set_no{validate,track}_class() Cc: Waiman Long Signed-off-by: Kent Overstreet include/linux/lockdep.h | 15 +++++++++++++++ 1 file changed, 15 insertions(+) commit 6f719cbe0c8b3b8a14b403b9e60fdb565fd829fe Author: Kent Overstreet Date: Tue Jul 16 20:20:21 2024 -0400 bcachefs: Fix integer overflow on trans->nr_updates We can't have more updates than paths, so btree_path_idx_t is the correct type to use. Signed-off-by: Kent Overstreet fs/bcachefs/btree_types.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit f05a0b9c73bc1728b130ac8d1d76b7bbf3f0241d Author: Kent Overstreet Date: Tue Jul 16 16:43:59 2024 -0400 bcachefs: silence silly kdoc warning Signed-off-by: Kent Overstreet fs/bcachefs/btree_write_buffer.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 2c4c17fefc49e895e322b3ab0f49d946f384f71b Author: Kent Overstreet Date: Mon Jul 15 19:03:17 2024 -0400 bcachefs: Fix fsck warning about btree_trans not passed to fsck error If a btree_trans is in use it's supposed to be passed to fsck_err so that it can be unlocked if we're waiting on userspace input; but the btree IO paths do call fsck errors where a btree_trans exists on the stack but it's not passed through. But it's ok, because it's unlocked while doing IO. Fixes: a850bde6498b ("bcachefs: fsck_err() may now take a btree_trans") Signed-off-by: Kent Overstreet fs/bcachefs/btree_iter.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) commit f12410bb7dddc64b58cbd6fca224b82ff40c5807 Author: Kent Overstreet Date: Mon Jul 15 16:30:44 2024 -0400 bcachefs: Add an error message for insufficient rw journal devs This causes us to go read-only - need an error message saying why. Signed-off-by: Kent Overstreet fs/bcachefs/journal_reclaim.c | 11 +++++++++++ 1 file changed, 11 insertions(+) commit ee1b8dc17ac367f3fbea18fee4f7825eb11eb757 Author: Tavian Barnes Date: Fri Jun 21 16:39:58 2024 -0400 bcachefs: varint: Avoid left-shift of a negative value Shifting a negative value left is undefined. Signed-off-by: Tavian Barnes Signed-off-by: Kent Overstreet fs/bcachefs/varint.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit dde1a0e1625c08cf4f958348a83434b2ddecf449 Merge: 76d9b92e68f2 47ff30cc1be7 Author: Linus Torvalds Date: Thu Jul 18 15:24:59 2024 -0700 Merge tag 'x86-percpu-2024-07-17' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull x86 percpu updates from Ingo Molnar: - Enable the named address spaces based percpu accessors optimization on all GCC versions that contain this feature, detected through a build-time testcase. This effectively enables the feature on GCC 6, GCC 7 and GCC 8 versions. - Fix operand constraint modifier in __raw_cpu_write() - Reorganize the per-CPU headers for better readability - Misc cleanups and fixes * tag 'x86-percpu-2024-07-17' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: x86/percpu: Enable named address spaces for all capable GCC versions x86/percpu: Clean up vertical alignment details x86/percpu: Clean up a bit x86/percpu: Move some percpu accessors around to reduce ifdeffery x86/percpu: Rename percpu_stable_op() to __raw_cpu_read_stable() x86/percpu: Fix operand constraint modifier in __raw_cpu_write() x86/percpu: Introduce the __raw_cpu_read_const() macro x86/percpu: Unify percpu read-write accessors x86/percpu: Move some percpu macros around for readability x86/percpu: Introduce the pcpu_binary_op() macro commit 76d9b92e68f2bb55890f935c5143f4fef97a935d Merge: b2fc97c18614 436381eaf2a4 Author: Linus Torvalds Date: Thu Jul 18 15:08:12 2024 -0700 Merge tag 'slab-for-6.11' of git://git.kernel.org/pub/scm/linux/kernel/git/vbabka/slab Pull slab updates from Vlastimil Babka: "The most prominent change this time is the kmem_buckets based hardening of kmalloc() allocations from Kees Cook. We have also extended the kmalloc() alignment guarantees for non-power-of-two sizes in a way that benefits rust. The rest are various cleanups and non-critical fixups. - Dedicated bucket allocator (Kees Cook) This series [1] enhances the probabilistic defense against heap spraying/grooming of CONFIG_RANDOM_KMALLOC_CACHES from last year. kmalloc() users that are known to be useful for exploits can get completely separate set of kmalloc caches that can't be shared with other users. The first converted users are alloc_msg() and memdup_user(). The hardening is enabled by CONFIG_SLAB_BUCKETS. - Extended kmalloc() alignment guarantees (Vlastimil Babka) For years now we have guaranteed natural alignment for power-of-two allocations, but nothing was defined for other sizes (in practice, we have two such buckets, kmalloc-96 and kmalloc-192). To avoid unnecessary padding in the rust layer due to its alignment rules, extend the guarantee so that the alignment is at least the largest power-of-two divisor of the requested size. This fits what rust needs, is a superset of the existing power-of-two guarantee, and does not in practice change the layout (and thus does not add overhead due to padding) of the kmalloc-96 and kmalloc-192 caches, unless slab debugging is enabled for them. - Cleanups and non-critical fixups (Chengming Zhou, Suren Baghdasaryan, Matthew Willcox, Alex Shi, and Vlastimil Babka) Various tweaks related to the new alloc profiling code, folio conversion, debugging and more leftovers after SLAB" Link: https://lore.kernel.org/all/20240701190152.it.631-kees@kernel.org/ [1] * tag 'slab-for-6.11' of git://git.kernel.org/pub/scm/linux/kernel/git/vbabka/slab: mm/memcg: alignment memcg_data define condition mm, slab: move prepare_slab_obj_exts_hook under CONFIG_MEM_ALLOC_PROFILING mm, slab: move allocation tagging code in the alloc path into a hook mm/util: Use dedicated slab buckets for memdup_user() ipc, msg: Use dedicated slab buckets for alloc_msg() mm/slab: Introduce kmem_buckets_create() and family mm/slab: Introduce kvmalloc_buckets_node() that can take kmem_buckets argument mm/slab: Plumb kmem_buckets into __do_kmalloc_node() mm/slab: Introduce kmem_buckets typedef slab, rust: extend kmalloc() alignment guarantees to remove Rust padding slab: delete useless RED_INACTIVE and RED_ACTIVE slab: don't put freepointer outside of object if only orig_size slab: make check_object() more consistent mm: Reduce the number of slab->folio casts mm, slab: don't wrap internal functions with alloc_hooks() commit b2fc97c18614f99179700be263ecbc667c91a4e8 Merge: 68b59730459e 9364a7e40d54 Author: Linus Torvalds Date: Thu Jul 18 14:48:11 2024 -0700 Merge tag 'memblock-v6.11-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/rppt/memblock Pull memblock updates from Mike Rapoport: - 'reserve_mem' command line parameter to allow creation of named memory reservation at boot time. The driving use-case is to improve the ability of pstore to retain ramoops data across reboots. - cleanups and small improvements in memblock and mm_init - new tests cases in memblock test suite * tag 'memblock-v6.11-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/rppt/memblock: memblock tests: fix implicit declaration of function 'numa_valid_node' memblock: Move late alloc warning down to phys alloc pstore/ramoops: Add ramoops.mem_name= command line option mm/memblock: Add "reserve_mem" to reserved named memory at boot up mm/mm_init.c: don't initialize page->lru again mm/mm_init.c: not always search next deferred_init_pfn from very beginning mm/mm_init.c: use deferred_init_mem_pfn_range_in_zone() to decide loop condition mm/mm_init.c: get the highest zone directly mm/mm_init.c: move nr_initialised reset down a bit mm/memblock: fix a typo in description of for_each_mem_region() mm/mm_init.c: use memblock_region_memory_base_pfn() to get startpfn mm/memblock: use PAGE_ALIGN_DOWN to get pgend in free_memmap mm/memblock: return true directly on finding overlap region memblock tests: add memblock_overlaps_region_checks mm/memblock: fix comment for memblock_isolate_range() memblock tests: add memblock_reserve_many_may_conflict_check() memblock tests: add memblock_reserve_all_locations_check() mm/memblock: remove empty dummy entry commit 68b59730459e5d1fe4e0bbeb04ceb9df0f002270 Merge: f669aac34c5f 7a2fb5619cc1 Author: Linus Torvalds Date: Thu Jul 18 14:16:35 2024 -0700 Merge tag 'perf-tools-for-v6.11-2024-07-16' of git://git.kernel.org/pub/scm/linux/kernel/git/perf/perf-tools Pull perf tools updates from Namhyung Kim: "Build: - Build each directory as a library so that depedency check for the python extension module can be automatic - Use pkg-config to check libtraceevent and libtracefs perf sched: - Add --task-name and --fuzzy-name options for `perf sched map` It focuses on selected tasks only by removing unrelated tasks in the output. It matches the task comm with the given string and the --fuzzy-name option allows the partial matching: $ sudo perf sched record -a sleep 1 $ sudo perf sched map --task-name kworker --fuzzy-name . . . . - *A0 . . 481065.315131 secs A0 => kworker/5:2-i91:438521 . . . . - *- . . 481065.315160 secs *B0 . . . - . . . 481065.316435 secs B0 => kworker/0:0-i91:437860 *- . . . . . . . 481065.316441 secs . . . . . *A0 . . 481065.318703 secs . . . . . *- . . 481065.318717 secs . . *C0 . . . . . 481065.320544 secs C0 => kworker/u16:30-:430186 . . *- . . . . . 481065.320555 secs . . *D0 . . . . . 481065.328524 secs D0 => kworker/2:0-kdm:429654 *B0 . D0 . - . . . 481065.328527 secs *- . D0 . - . . . 481065.328535 secs . . *- . . . . . 481065.328535 secs - Fix -r/--repeat option of perf sched replay The documentation said -1 will work as infinity but it didn't accept the value. Update the code and document to use 0 instead - Fix perf sched timehist to account the delay time for preempted tasks Perf event filtering: - perf top gained filtering support on regular events using BPF like perf record. Previously it was able to use it for tracepoints only - The BPF filter now supports filtering by UID/GID. This should be preferred than -u option as it's racy to scan /proc to check tasks for the user and fails to open an event for the task if it's already gone $ sudo perf top -e cycles --filter "uid == $(id -u)" perf report: - Skip dummy events in the group output by default. The --skip-empty option controls display of empty events without samples. But perf report can force display all events in a group In this case, auto-added a dummy event (for a system-wide record) ends up in the output. Now it can skip those empty events even in the group display mode To preserve the old behavior, run this: $ perf report --group --no-skip-empty perf stat: - Choose the most disaggregate option when multiple aggregation options are given. It used to pick the last option in the command line but it can be confusing and not consistent. Now it'll choose the smallest unit For example, it'd aggregate the result per-core when the user gave both --per-socket and --per-core options at the same time Internals: - Fix `perf bench` when some CPUs are offline - Fix handling of JIT symbol mappings to accept "/tmp/perf-${PID}.map patterns only so that it can not be confused by other /tmp/perf-* files - Many improvements and fixes for `perf test` Others: - Support some new instructions for Intel-PT - Fix syscall ID mapping in perf trace - Document AMD IBS PMU usages - Change `perf lock info` to show map and thread info by default Vendor JSON events: - Update Intel events and metrics - Add i.MX9[35] DDR metrics" * tag 'perf-tools-for-v6.11-2024-07-16' of git://git.kernel.org/pub/scm/linux/kernel/git/perf/perf-tools: (125 commits) perf trace: Fix iteration of syscall ids in syscalltbl->entries perf dso: Fix address sanitizer build perf mem: Warn if memory events are not supported on all CPUs perf arm-spe: Support multiple Arm SPE PMUs perf build x86: Fix SC2034 error in syscalltbl.sh perf record: Fix memset out-of-range error perf sched map: Add --fuzzy-name option for fuzzy matching in task names perf sched map: Add support for multiple task names using CSV perf sched map: Add task-name option to filter the output map perf build: Conditionally add feature check flags for libtrace{event,fs} perf install: Don't propagate subdir to Documentation submake perf vendor events arm64:: Add i.MX95 DDR Performance Monitor metrics perf vendor events arm64:: Add i.MX93 DDR Performance Monitor metrics perf dsos: When adding a dso into sorted dsos maintain the sort order perf comm str: Avoid sort during insert perf report: Calling available function for stats printing perf intel-pt: Fix exclude_guest setting perf intel-pt: Fix aux_watermark calculation for 64-bit size perf sched replay: Fix -r/--repeat command line option for infinity perf: pmus: Remove unneeded semicolon ... commit f669aac34c5f76b58e6cad1fef0643e5ae16d413 Merge: 1777e471e11d 5f7c72df1ba6 Author: Linus Torvalds Date: Thu Jul 18 14:08:42 2024 -0700 Merge tag 'trace-v6.11-2' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace Pull tracing CREDITS file update from Steven Rostedt: "Update of MAINTAINERS and CREDITS file - Update Daniel Bristot de Oliveira's entry in MAINTAINERS with respect to his tracing code. - Add more credits to him in CREDITS file and move his entry to be alphabetical" * tag 'trace-v6.11-2' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace: tracing: Update MAINTAINERS file commit ae835a96d72cd025421910edb0e8faf706998727 Author: Ard Biesheuvel Date: Fri Mar 22 18:11:32 2024 +0100 x86/efistub: Revert to heap allocated boot_params for PE entrypoint This is a partial revert of commit 8117961d98f ("x86/efi: Disregard setup header of loaded image") which triggers boot issues on older Dell laptops. As it turns out, switching back to a heap allocation for the struct boot_params constructed by the EFI stub works around this, even though it is unclear why. Cc: Christian Heusel Reported-by: Signed-off-by: Ard Biesheuvel drivers/firmware/efi/libstub/x86-stub.c | 20 +++++++++++++++----- 1 file changed, 15 insertions(+), 5 deletions(-) commit 1777e471e11da7cba3db8dfa82822dcef6fd7794 Merge: 70045bfc4cd5 28beb730ee16 Author: Linus Torvalds Date: Thu Jul 18 14:01:37 2024 -0700 Merge tag 'trace-tools-v6.11' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace Pull tracing tools updates from Steven Rostedt: "Trivial updates for 6.11: - Use pretty formatting only on interactive tty in rtla/osnoise - Better reporting when histogram is empty in rtla/osnoise - Use the correct library name for "libtracefs" in feature detection" * tag 'trace-tools-v6.11' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace: tools: build: use correct lib name for libtracefs feature detection rtla/osnoise: Better report when histogram is empty rtla/osnoise: Use pretty formatting only on interactive tty commit 70045bfc4cd5fef44ada25fa3367329eba98731a Merge: 2fd4130e53db b576d375b536 Author: Linus Torvalds Date: Thu Jul 18 13:36:33 2024 -0700 Merge tag 'ftrace-v6.11' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace Pull ftrace updates from Steven Rostedt: "Rewrite of function graph tracer to allow multiple users Up until now, the function graph tracer could only have a single user attached to it. If another user tried to attach to the function graph tracer while one was already attached, it would fail. Allowing function graph tracer to have more than one user has been asked for since 2009, but it required a rewrite to the logic to pull it off so it never happened. Until now! There's three systems that trace the return of a function. That is kretprobes, function graph tracer, and BPF. kretprobes and function graph tracing both do it similarly. The difference is that kretprobes uses a shadow stack per callback and function graph tracer creates a shadow stack for all tasks. The function graph tracer method makes it possible to trace the return of all functions. As kretprobes now needs that feature too, allowing it to use function graph tracer was needed. BPF also wants to trace the return of many probes and its method doesn't scale either. Having it use function graph tracer would improve that. By allowing function graph tracer to have multiple users allows both kretprobes and BPF to use function graph tracer in these cases. This will allow kretprobes code to be removed in the future as it's version will no longer be needed. Note, function graph tracer is only limited to 16 simultaneous users, due to shadow stack size and allocated slots" * tag 'ftrace-v6.11' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace: (49 commits) fgraph: Use str_plural() in test_graph_storage_single() function_graph: Add READ_ONCE() when accessing fgraph_array[] ftrace: Add missing kerneldoc parameters to unregister_ftrace_direct() function_graph: Everyone uses HAVE_FUNCTION_GRAPH_RET_ADDR_PTR, remove it function_graph: Fix up ftrace_graph_ret_addr() function_graph: Make fgraph_update_pid_func() a stub for !DYNAMIC_FTRACE function_graph: Rename BYTE_NUMBER to CHAR_NUMBER in selftests fgraph: Remove some unused functions ftrace: Hide one more entry in stack trace when ftrace_pid is enabled function_graph: Do not update pid func if CONFIG_DYNAMIC_FTRACE not enabled function_graph: Make fgraph_do_direct static key static ftrace: Fix prototypes for ftrace_startup/shutdown_subops() ftrace: Assign RCU list variable with rcu_assign_ptr() ftrace: Assign ftrace_list_end to ftrace_ops_list type cast to RCU ftrace: Declare function_trace_op in header to quiet sparse warning ftrace: Add comments to ftrace_hash_move() and friends ftrace: Convert "inc" parameter to bool in ftrace_hash_rec_update_modify() ftrace: Add comments to ftrace_hash_rec_disable/enable() ftrace: Remove "filter_hash" parameter from __ftrace_hash_rec_update() ftrace: Rename dup_hash() and comment it ... commit 5a6a25ea5bcd5bdf80fb13acd65a03fc6b8794b1 Author: Dan Carpenter Date: Wed Jul 17 21:25:53 2024 -0500 clk: sophgo: clk-sg2042-pll: Fix uninitialized variable in debug output If sg2042_get_pll_ctl_setting() fails then "value" isn't initialized and it is printed in the debug output. Initialize it to zero. Fixes: 48cf7e01386e ("clk: sophgo: Add SG2042 clock driver") Signed-off-by: Dan Carpenter Link: https://lore.kernel.org/r/baf0a490-d5ba-4528-90ba-80399684692d@stanley.mountain Reviewed-by: Chen Wang Signed-off-by: Stephen Boyd drivers/clk/sophgo/clk-sg2042-pll.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit a83b22754e351f13fb46596c85f667dc33da71ec Author: Bastien Curutchet Date: Thu Jul 18 13:55:34 2024 +0200 clk: davinci: da8xx-cfgchip: Initialize clk_init_data before use The flag attribute of the struct clk_init_data isn't initialized before the devm_clk_hw_register() call. This can lead to unexpected behavior during registration. Initialize the entire clk_init_data to zero at declaration. Cc: stable@vger.kernel.org Fixes: 58e1e2d2cd89 ("clk: davinci: cfgchip: Add TI DA8XX USB PHY clocks") Signed-off-by: Bastien Curutchet Reviewed-by: David Lechner Link: https://lore.kernel.org/r/20240718115534.41513-1-bastien.curutchet@bootlin.com Signed-off-by: Stephen Boyd drivers/clk/davinci/da8xx-cfgchip.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) commit 2fd4130e53db0958167510eddbca0f09dc858109 Merge: db2451e78d5d 7dc836187f7c Author: Linus Torvalds Date: Thu Jul 18 13:29:25 2024 -0700 Merge tag 'trace-v6.11' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace Pull tracing updates from Steven Rostedt: "Trivial updates for 6.11: - Set rtla/osnoise default threshold to 1us from 5us The 5us default was missing noise that people cared about. Changing it to 1us makes it work as expected. - Restructure how sched_switch prev_comm and next_comm was being saved The prev_comm was being saved along with the other next fields, and the next_comm was being saved along with the other prev fields. This is just a cosmetic change. - Have the allocation of pid_list use GFP_NOWAIT instead of GFP_KERNEL The allocation can happen in irq_work context, but luckily, the size was by default so large, it was never triggered. But in case it ever is, use the NOWAIT allocation in the interrupt context. - Fix some kernel doc errors" * tag 'trace-v6.11' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace: trace/pid_list: Change gfp flags in pid_list_fill_irq() tracing/sched: sched_switch: place prev_comm and next_comm in right order rtla/osnoise: set the default threshold to 1us tracing: Fix trace_pid_list_free() kernel-doc commit db2451e78d5df51b8f926e31e343e74e6aafba9d Merge: 91bd008d4e2b 0d9c0a67b144 Author: Linus Torvalds Date: Thu Jul 18 12:39:40 2024 -0700 Merge tag 'bootconfig-v6.11' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace Pull bootconfig update from Masami Hiramatsu: - Remove duplicate included header file linux/bootconfig.h from lib/bootconfig.c. This is a cleanup, no behavior change. * tag 'bootconfig-v6.11' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace: bootconfig: Remove duplicate included header file linux/bootconfig.h commit 91bd008d4e2b4962ecb9a10e40c2fb666b0aeb92 Merge: cb273eb7c839 c26b1b89b8a9 Author: Linus Torvalds Date: Thu Jul 18 12:19:20 2024 -0700 Merge tag 'probes-v6.11' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace Pull probes updates from Masami Hiramatsu: "Uprobes: - x86/shstk: Make return uprobe work with shadow stack - Add uretprobe syscall which speeds up the uretprobe 10-30% faster. This syscall is automatically used from user-space trampolines which are generated by the uretprobe. If this syscall is used by normal user program, it will cause SIGILL. Note that this is currently only implemented on x86_64. (This also has two fixes for adjusting the syscall number to avoid conflict with new *attrat syscalls.) - uprobes/perf: fix user stack traces in the presence of pending uretprobe. This corrects the uretprobe's trampoline address in the stacktrace with correct return address - selftests/x86: Add a return uprobe with shadow stack test - selftests/bpf: Add uretprobe syscall related tests. - test case for register integrity check - test case with register changing case - test case for uretprobe syscall without uprobes (expected to fail) - test case for uretprobe with shadow stack - selftests/bpf: add test validating uprobe/uretprobe stack traces - MAINTAINERS: Add uprobes entry. This does not specify the tree but to clarify who maintains and reviews the uprobes Kprobes: - tracing/kprobes: Test case cleanups. Replace redundant WARN_ON_ONCE() + pr_warn() with WARN_ONCE() and remove unnecessary code from selftest - tracing/kprobes: Add symbol counting check when module loads. This checks the uniqueness of the probed symbol on modules. The same check has already done for kernel symbols (This also has a fix for build error with CONFIG_MODULES=n) Cleanup: - Add MODULE_DESCRIPTION() macros for fprobe and kprobe examples" * tag 'probes-v6.11' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace: MAINTAINERS: Add uprobes entry selftests/bpf: Change uretprobe syscall number in uprobe_syscall test uprobe: Change uretprobe syscall scope and number tracing/kprobes: Fix build error when find_module() is not available tracing/kprobes: Add symbol counting check when module loads selftests/bpf: add test validating uprobe/uretprobe stack traces perf,uprobes: fix user stack traces in the presence of pending uretprobes tracing/kprobe: Remove cleanup code unrelated to selftest tracing/kprobe: Integrate test warnings into WARN_ONCE selftests/bpf: Add uretprobe shadow stack test selftests/bpf: Add uretprobe syscall call from user space test selftests/bpf: Add uretprobe syscall test for regs changes selftests/bpf: Add uretprobe syscall test for regs integrity selftests/x86: Add return uprobe shadow stack test uprobe: Add uretprobe syscall to speed up return probe uprobe: Wire up uretprobe system call x86/shstk: Make return uprobe work with shadow stack samples: kprobes: add missing MODULE_DESCRIPTION() macros fprobe: add missing MODULE_DESCRIPTION() macro commit cb273eb7c8390c70a484db6c79a797e377db09b5 Merge: 24777bac4af5 8b5ea9029b03 Author: Linus Torvalds Date: Thu Jul 18 11:47:14 2024 -0700 Merge tag 'fbdev-for-6.11-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/deller/linux-fbdev Pull fbdev updates from Helge Deller: - Detect VGA compatibility from VESA attributes (Thomas Zimmermann) - Make I2C terminology more inclusive in smscufx and viafb (Easwar Hariharan) - Add lots of missing MODULE_DESCRIPTION() macros (Jeff Johnson) - Logo code cleanups (Geert Uytterhoeven) - Minor fixes by Chen Ni, Kuninori Morimoto, Uwe Kleine-König and Christophe Jaillett * tag 'fbdev-for-6.11-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/deller/linux-fbdev: (21 commits) fbdev: viafb: Make I2C terminology more inclusive fbdev: smscufx: Make I2C terminology more inclusive fbdev: omap2: Return clk_prepare_enable to transfer the error fbdev: mmp: Constify struct mmp_overlay_ops fbdev: Drop explicit initialization of struct i2c_device_id::driver_data to 0 video: agp: add remaining missing MODULE_DESCRIPTION() macros video: console: add missing MODULE_DESCRIPTION() macros fbdev: amifb: add missing MODULE_DESCRIPTION() macro fbdev: c2p_planar: add missing MODULE_DESCRIPTION() macro fbdev: vesafb: Detect VGA compatibility from screen info's VESA attributes fbdev: omapfb: use of_graph_get_remote_port() fbdev: omapdss: use for_each_endpoint_of_node() fbdev: offb: add missing MODULE_DESCRIPTION() macro fbdev: vfb: add missing MODULE_DESCRIPTION() macro fbdev: macmodes: add missing MODULE_DESCRIPTION() macro fbdev: goldfishfb: add missing MODULE_DESCRIPTION() macro fbdev: kyro: add missing MODULE_DESCRIPTION() macro fbdev: viafb: add missing MODULE_DESCRIPTION() macro fbdev: matroxfb: add missing MODULE_DESCRIPTION() macros video/logo: Remove linux_serial_image comments ... commit 63d097d46799dc6ab4d1430482cd5ab6a409c4ec Author: Biju Das Date: Wed Jul 17 12:56:47 2024 +0100 dt-bindings: watchdog: dlg,da9062-watchdog: Drop blank space Drop unnecessary blank space from binding documentation. Reported-by: Pavel Machek Closes: https://lore.kernel.org/all/ZpemkYsK6zQgGCF2@duo.ucw.cz/ Signed-off-by: Biju Das Acked-by: Conor Dooley Reviewed-by: Guenter Roeck Link: https://lore.kernel.org/r/20240717115649.131914-1-biju.das.jz@bp.renesas.com Signed-off-by: Guenter Roeck Signed-off-by: Wim Van Sebroeck Documentation/devicetree/bindings/watchdog/dlg,da9062-watchdog.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 1bb3b542cb1b68e40d4323592fdc9bd222c4f84a Author: Chen Ni Date: Tue Jul 16 11:11:37 2024 +0800 watchdog: rzn1: Convert comma to semicolon Replace a comma between expression statements by a semicolon. Fixes: d65112f58464 ("watchdog: Add Renesas RZ/N1 Watchdog driver") Signed-off-by: Chen Ni Reviewed-by: Guenter Roeck Link: https://lore.kernel.org/r/20240716031137.400502-1-nichen@iscas.ac.cn Signed-off-by: Guenter Roeck Signed-off-by: Wim Van Sebroeck drivers/watchdog/rzn1_wdt.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) commit 2c58070fde0fffe494d9e38b0ccedbda01c512ff Author: Chen Ni Date: Tue Jul 16 11:07:25 2024 +0800 watchdog: lenovo_se10_wdt: Convert comma to semicolon Replace a comma between expression statements by a semicolon. Fixes: 1f6602c8ed1e ("watchdog: lenovo_se10_wdt: Watchdog driver for Lenovo SE10 platform") Signed-off-by: Chen Ni Reviewed-by: Guenter Roeck Reviewed-by: Mark Pearson Link: https://lore.kernel.org/r/20240716030725.400400-1-nichen@iscas.ac.cn Signed-off-by: Guenter Roeck Signed-off-by: Wim Van Sebroeck drivers/watchdog/lenovo_se10_wdt.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) commit c9b4f313f6b83ac80e9d51845d092c32513efdb4 Author: Marc Zyngier Date: Thu Jul 18 08:58:04 2024 +0100 irqchip/gic-v3-its: Correctly fish out the DID for platform MSI Similarly to PCI where msi-map/msi-mask are used to compute the full RID (aka DID in ITS speak), use the msi-parent as the discovery mechanism, since there is no way a device can generally express its ID. However, since switching to a per-device MSI domain model, the domain passed to its_pmsi_prepare() is the wrong one, and points to the device's instead of the ITS'. Bad. Use the parent domain instead, which is the ITS domain. Fixes: 80b63cc1cc146 ("irqchip/gic-v3-its: Switch platform MSI to MSI parent") Signed-off-by: Marc Zyngier Signed-off-by: Thomas Gleixner Link: https://lore.kernel.org/r/20240718075804.2245733-1-maz@kernel.org drivers/irqchip/irq-gic-v3-its-msi-parent.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 99d7fbf8f813eb77dd4ec148c4596455910b2fa1 Author: Marc Zyngier Date: Wed Jul 17 20:59:37 2024 +0100 irqchip/gic-v3-its: Correctly honor the RID remapping Since 6adb35ff43a16 ("irqchip/gic-v3-its: Provide MSI parent for PCI/MSI[-X]"), the primary domain a PCI device allocates its interrupts from is the one that is directly attached to the device itself. By virtue of being a PCI device, it has no OF node. This domain is (through more layer than it is worth describing) passed to its_pci_msi_prepare(), which tries to compute the full RID that is presented to the ITS by the device. This is ultimately done by calling pci_msi_domain_get_msi_rid(), passing both the domain and the PCI device as arguments. The baked-in assumption is that either the domain that is passed to pci_msi_domain_get_msi_rid() describes an interrupt controller with either an OF node or an entry in an ACPI IORT table. In this case, it is *neither*. This domain is does not represent anything firmware-based, but just an allocation unit for the device. As a result, it fails to provide the full RID (which requires inspecting the msi-map/msi-mask properties in the DT), and stick to the BDF, which isn't very useful. Tragedy follows with a litany of devices that randomly die as they fail to see any MSI (because the RID is wrong) or fail to get an allocation (because they try to steal LPIs from their neighbour's pool). This will happen on any system where a single ITS is shared by multiple root ports and end-points with overlapping BDF numbers, and has the topology described in the device-tree. Simpler DT topologies will luckily work, and so will ACPI-based systems. Solve it by pointing pci_msi_domain_get_msi_rid() at the *parent* domain, which is the ITS, resulting in a correct mapping and a restored happiness in my personal zoo. Fixes: 6adb35ff43a16 ("irqchip/gic-v3-its: Provide MSI parent for PCI/MSI[-X]") Reported-by: Johan Hovold Signed-off-by: Marc Zyngier Signed-off-by: Thomas Gleixner Tested-by: Johan Hovold Link: https://lore.kernel.org/r/20240717195937.2240400-1-maz@kernel.org drivers/irqchip/irq-gic-v3-its-msi-parent.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 2fdda02a8749fdaff5621c96aaf24a61d2f8c5a2 Author: Thomas Gleixner Date: Sun Jun 23 17:19:07 2024 +0200 genirq/msi: Move msi_device_data to core Now that the platform MSI hack is gone, nothing needs to know about struct msi_device_data outside of the core code. Signed-off-by: Thomas Gleixner Signed-off-by: Anna-Maria Behnsen Signed-off-by: Shivamurthy Shastri Signed-off-by: Thomas Gleixner Link: https://lore.kernel.org/r/20240623142236.003295177@linutronix.de include/linux/msi.h | 18 ------------------ kernel/irq/msi.c | 20 ++++++++++++++++++-- 2 files changed, 18 insertions(+), 20 deletions(-) commit e9894248994ca8291838baf063f045eab28e5a0e Author: Thomas Gleixner Date: Sun Jun 23 17:19:05 2024 +0200 genirq/msi: Remove platform MSI leftovers No more users! Signed-off-by: Thomas Gleixner Signed-off-by: Anna-Maria Behnsen Signed-off-by: Shivamurthy Shastri Signed-off-by: Thomas Gleixner Reviewed-by: Greg Kroah-Hartman Link: https://lore.kernel.org/r/20240623142235.943295676@linutronix.de drivers/base/platform-msi.c | 350 +------------------------------------------- include/linux/msi.h | 30 ---- kernel/irq/msi.c | 75 +--------- 3 files changed, 5 insertions(+), 450 deletions(-) commit ce44d1ff463dcf812b43c71a0e16859e3451bc1e Author: Thomas Gleixner Date: Sun Jun 23 17:19:04 2024 +0200 irqchip/irq-mvebu-icu: Remove platform MSI leftovers All related domains provide MSI parent functionality, so the fallback code to the original platform MSI implementation is not longer required. Signed-off-by: Thomas Gleixner Signed-off-by: Anna-Maria Behnsen Signed-off-by: Shivamurthy Shastri Signed-off-by: Thomas Gleixner Link: https://lore.kernel.org/r/20240623142235.881677325@linutronix.de drivers/irqchip/irq-mvebu-icu.c | 212 ++-------------------------------------- 1 file changed, 6 insertions(+), 206 deletions(-) commit fbdf14e90ce445fedfb387413c3d8dc9d90db2a7 Author: Thomas Gleixner Date: Sun Jun 23 17:19:02 2024 +0200 irqchip/irq-mvebu-sei: Switch to MSI parent All platform MSI users and the PCI/MSI code handle per device MSI domains when the irqdomain associated to the device provides MSI parent functionality. Remove the "global" platform domain related code and provide the MSI parent functionality by filling in msi_parent_ops. Signed-off-by: Thomas Gleixner Signed-off-by: Anna-Maria Behnsen Signed-off-by: Shivamurthy Shastri Signed-off-by: Thomas Gleixner Link: https://lore.kernel.org/r/20240623142235.820275215@linutronix.de drivers/irqchip/irq-mvebu-sei.c | 52 ++++++++++++++++------------------------- 1 file changed, 20 insertions(+), 32 deletions(-) commit e0b99c4c5917759c257a5c41d2c3e4d7c014578b Author: Thomas Gleixner Date: Sun Jun 23 17:19:00 2024 +0200 irqchip/mvebu-odmi: Switch to parent MSI All platform MSI users and the PCI/MSI code handle per device MSI domains when the irqdomain associated to the device provides MSI parent functionality. Remove the "global" platform domain related code and provide the MSI parent functionality by filling in msi_parent_ops. Signed-off-by: Thomas Gleixner Signed-off-by: Anna-Maria Behnsen Signed-off-by: Shivamurthy Shastri Signed-off-by: Thomas Gleixner Link: https://lore.kernel.org/r/20240623142235.759892514@linutronix.de drivers/irqchip/Kconfig | 1 + drivers/irqchip/irq-mvebu-odmi.c | 37 ++++++++++++++++++------------------- 2 files changed, 19 insertions(+), 19 deletions(-) commit cdb238723018eb766040d7be5d879b4c81ad3d50 Author: Thomas Gleixner Date: Sun Jun 23 17:18:58 2024 +0200 irqchip/mvebu-gicp: Switch to MSI parent All platform MSI users and the PCI/MSI code handle per device MSI domains when the irqdomain associated to the device provides MSI parent functionality. Remove the "global" platform domain related code and provide the MSI parent functionality by filling in msi_parent_ops. Signed-off-by: Thomas Gleixner Signed-off-by: Anna-Maria Behnsen Signed-off-by: Shivamurthy Shastri Signed-off-by: Thomas Gleixner Link: https://lore.kernel.org/r/20240623142235.699780279@linutronix.de drivers/irqchip/Kconfig | 1 + drivers/irqchip/irq-mvebu-gicp.c | 44 +++++++++++++++++----------------------- 2 files changed, 20 insertions(+), 25 deletions(-) commit d929e4db22b61555a6b091450c26d1f7281ca576 Author: Thomas Gleixner Date: Sun Jun 23 17:18:56 2024 +0200 irqchip/irq-mvebu-icu: Prepare for real per device MSI The core infrastructure has everything in place to switch ICU to per device MSI domains and avoid the convoluted construct of the existing platform-MSI layering violation. The new infrastructure provides a wired interrupt specific interface in the MSI core which converts the 'hardware interrupt number + trigger type' allocation which is required for wired interrupts in the regular irqdomain code to a normal MSI allocation. The hardware interrupt number and the trigger type are stored in the MSI descriptor device cookie by the core code so the ICU specific code can retrieve them. The new per device domain is only instantiated when the irqdomain which is associated to the ICU device provides MSI parent functionality. Up to that point it invokes the existing code. Once the parent is converted the code for the current platform-MSI mechanism is removed. The new domain shares the interrupt chip callbacks and the translation function. The only new functionality aside of filling out the msi_domain_templates is a domain specific set_desc() callback, which will go away once all platform-MSI code has been converted. Signed-off-by: Thomas Gleixner Signed-off-by: Anna-Maria Behnsen Signed-off-by: Shivamurthy Shastri Signed-off-by: Thomas Gleixner Link: https://lore.kernel.org/r/20240623142235.635015886@linutronix.de drivers/irqchip/irq-mvebu-icu.c | 181 +++++++++++++++++++++++++++++++++++++--- 1 file changed, 170 insertions(+), 11 deletions(-) commit 7b2f8aa005bc141ac9144f2fcf2cfb63abd7a0b1 Author: Thomas Gleixner Date: Sun Jun 23 17:18:55 2024 +0200 irqchip/imx-mu-msi: Switch to MSI parent All platform MSI users and the PCI/MSI code handle per device MSI domains when the irqdomain associated to the device provides MSI parent functionality. Remove the "global" platform domain related code and provide the MSI parent functionality by filling in msi_parent_ops. Signed-off-by: Thomas Gleixner Signed-off-by: Anna-Maria Behnsen Signed-off-by: Shivamurthy Shastri Signed-off-by: Thomas Gleixner Link: https://lore.kernel.org/r/20240623142235.574932935@linutronix.de drivers/irqchip/Kconfig | 1 + drivers/irqchip/irq-imx-mu-msi.c | 48 ++++++++++++++++++---------------------- drivers/irqchip/irq-msi-lib.c | 2 ++ 3 files changed, 24 insertions(+), 27 deletions(-) commit 74e44454aafefd682706248eb3846e25a1a05c6d Author: Thomas Gleixner Date: Sun Jun 23 17:18:53 2024 +0200 irqchip/gic-v2m: Switch to device MSI All platform MSI users and the PCI/MSI code handle per device MSI domains when the irqdomain associated to the device provides MSI parent functionality. Remove the "global" PCI/MSI and platform domain related code and provide the MSI parent functionality by filling in msi_parent_ops. Signed-off-by: Thomas Gleixner Signed-off-by: Anna-Maria Behnsen Signed-off-by: Shivamurthy Shastri Signed-off-by: Thomas Gleixner Link: https://lore.kernel.org/r/20240623142235.514419280@linutronix.de drivers/irqchip/Kconfig | 1 + drivers/irqchip/irq-gic-v2m.c | 81 +++++++++++++------------------------------ 2 files changed, 26 insertions(+), 56 deletions(-) commit da8ec7956efb5dc2be87f5f3beb3c9ed74316baf Author: Thomas Gleixner Date: Sun Jun 23 17:18:51 2024 +0200 irqchip/gic_v3_mbi: Switch over to parent domain The MBI chip creates two MSI domains: - PCI/MSI - Platform device domain Both have the MBI domain as parent and differ slightly in the interrupt chip callbacks and the platform device domain supports level type signaling. Convert it over to the MSI parent domain mechanism by: - Providing the required templates - Implementing a custom init_dev_msi_info() callback which sets the chip callbacks and the level support flags depending on the domain bus token type of the per device domain. Signed-off-by: Thomas Gleixner Link: https://lore.kernel.org/r/20240623142235.455849114@linutronix.de drivers/irqchip/irq-gic-v3-mbi.c | 130 ++++++++++++++------------------------- 1 file changed, 47 insertions(+), 83 deletions(-) commit f6a9886a9e55a1e6bd78c7e505205d05ef50a71e Author: Thomas Gleixner Date: Sun Jun 23 17:18:50 2024 +0200 genirq/msi: Remove platform_msi_create_device_domain() No more users. Signed-off-by: Thomas Gleixner Signed-off-by: Anna-Maria Behnsen Signed-off-by: Shivamurthy Shastri Signed-off-by: Thomas Gleixner Link: https://lore.kernel.org/r/20240623142235.395577449@linutronix.de include/linux/msi.h | 2 -- 1 file changed, 2 deletions(-) commit 752e021f5b9be0ad42752deaa241ae631f293f9f Author: Thomas Gleixner Date: Sun Jun 23 17:18:48 2024 +0200 irqchip/mbigen: Remove platform_msi_create_device_domain() fallback Now that ITS provides the MSI parent domain, remove the unused fallback code. Signed-off-by: Thomas Gleixner Signed-off-by: Anna-Maria Behnsen Signed-off-by: Shivamurthy Shastri Signed-off-by: Thomas Gleixner Link: https://lore.kernel.org/r/20240623142235.333333826@linutronix.de drivers/irqchip/irq-mbigen.c | 74 +++----------------------------------------- 1 file changed, 4 insertions(+), 70 deletions(-) commit 7f2baef05d6aaae7bd6d0c863eeec50ae5b2997f Author: Thomas Gleixner Date: Sun Jun 23 17:18:46 2024 +0200 irqchip/gic-v3-its: Switch platform MSI to MSI parent Similar to the previous conversion of the PCI/MSI support lift the prepare() callback from the existing platform MSI code and enable platform MSI and the related device domain bus tokens in select and the child domain initialization code. All platform MSI users are automatically using the new per device MSI model now. Signed-off-by: Thomas Gleixner Signed-off-by: Anna-Maria Behnsen Signed-off-by: Shivamurthy Shastri Signed-off-by: Thomas Gleixner Link: https://lore.kernel.org/r/20240623142235.271734124@linutronix.de drivers/irqchip/Makefile | 2 +- drivers/irqchip/irq-gic-v3-its-msi-parent.c | 73 +++++++++++- drivers/irqchip/irq-gic-v3-its-platform-msi.c | 163 -------------------------- 3 files changed, 73 insertions(+), 165 deletions(-) commit 64a855324311ddad7a85fc0b25ce1f3914ed3425 Author: Thomas Gleixner Date: Sun Jun 23 17:18:44 2024 +0200 irqchip/irq-msi-lib: Prepare for DOMAIN_BUS_WIRED_TO_MSI Add the new bus token to the accepted list of child domain tokens. Signed-off-by: Thomas Gleixner Signed-off-by: Anna-Maria Behnsen Signed-off-by: Shivamurthy Shastri Signed-off-by: Thomas Gleixner Link: https://lore.kernel.org/r/20240623142235.207343466@linutronix.de drivers/irqchip/irq-msi-lib.c | 2 ++ 1 file changed, 2 insertions(+) commit fbfe7e13641efe811a273e1fd237929245376fe0 Author: Thomas Gleixner Date: Sun Jun 23 17:18:43 2024 +0200 irqchip/mbigen: Prepare for real per device MSI The core infrastructure has everything in place to switch MBIGEN to per device MSI domains and avoid the convoluted construct of the existing platform-MSI layering violation. The new infrastructure provides a wired interrupt specific interface in the MSI core which converts the 'hardware interrupt number + trigger type' allocation which is required for wired interrupts in the regular irqdomain code to a normal MSI allocation. The hardware interrupt number and the trigger type are stored in the MSI descriptor device cookie by the core code so the MBIGEN specific code can retrieve them. The new per device domain is only instantiated when the irqdomain which is associated to the MBIGEN device provides MSI parent functionality. Up to that point it invokes the existing code. Once the parent is converted the code for the current platform-MSI mechanism is removed. The new domain shares the interrupt chip callbacks and the translation function. The only new functionality aside of filling out the msi_domain_template is a domain specific set_desc() callback, which will go away once all platform-MSI code has been converted. Signed-off-by: Thomas Gleixner Signed-off-by: Anna-Maria Behnsen Signed-off-by: Shivamurthy Shastri Signed-off-by: Thomas Gleixner Link: https://lore.kernel.org/r/20240623142235.146579575@linutronix.de drivers/irqchip/irq-mbigen.c | 98 +++++++++++++++++++++++++++++++------------- 1 file changed, 70 insertions(+), 28 deletions(-) commit 496436f4a514a3fb4bc7aecd41f0dd4b38e39b1f Author: Thomas Gleixner Date: Sun Jun 23 17:18:41 2024 +0200 irqchip/irq-msi-lib: Prepare for DEVICE MSI to replace platform MSI Add the prerequisites for DEVICE MSI into the shared select() and child domain init function. These domains are really trivial and just provide a custom irq chip callback to write the MSI message. Signed-off-by: Thomas Gleixner Signed-off-by: Anna-Maria Behnsen Signed-off-by: Shivamurthy Shastri Signed-off-by: Thomas Gleixner Link: https://lore.kernel.org/r/20240623142235.085171290@linutronix.de drivers/irqchip/irq-msi-lib.c | 15 +++++++++++++++ drivers/irqchip/irq-msi-lib.h | 2 ++ 2 files changed, 17 insertions(+) commit b5712bf89b4bbc5bcc9ebde8753ad222f1f68296 Author: Thomas Gleixner Date: Sun Jun 23 17:18:39 2024 +0200 irqchip/gic-v3-its: Provide MSI parent for PCI/MSI[-X] The its_pci_msi_prepare() function from the ITS-PCI/MSI code provides the 'global' PCI/MSI domains. Move this function to the ITS-MSI parent code and amend the function to use the domain hardware size, which is the MSI[X] vector count, for allocating the ITS slots for the PCI device. Enable PCI matching in msi_parent_ops and provide the necessary update to the ITS specific child domain initialization function so that the prepare callback gets invoked on allocations. The latter might be optimized to do the allocation right at the point where the child domain is initialized, but keep it simple for now. Signed-off-by: Thomas Gleixner Signed-off-by: Anna-Maria Behnsen Signed-off-by: Shivamurthy Shastri Signed-off-by: Thomas Gleixner Link: https://lore.kernel.org/r/20240623142235.024567623@linutronix.de drivers/irqchip/Makefile | 1 - drivers/irqchip/irq-gic-v3-its-msi-parent.c | 114 +++++++++++++++- drivers/irqchip/irq-gic-v3-its-pci-msi.c | 202 ---------------------------- 3 files changed, 111 insertions(+), 206 deletions(-) commit 8c41ccec839c622b2d1be769a95405e4e9a4cb20 Author: Thomas Gleixner Date: Sun Jun 23 17:18:38 2024 +0200 irqchip/irq-msi-lib: Prepare for PCI MSI/MSIX Add the bus tokens for DOMAIN_BUS_PCI_DEVICE_MSI and DOMAIN_BUS_PCI_DEVICE_MSIX to the common child init function. Provide the match mask which can be used by parent domain implementation so the bitmask based child bus token match works. Signed-off-by: Thomas Gleixner Signed-off-by: Anna-Maria Behnsen Signed-off-by: Shivamurthy Shastri Signed-off-by: Thomas Gleixner Link: https://lore.kernel.org/r/20240623142234.964056815@linutronix.de drivers/irqchip/irq-msi-lib.c | 11 ++++++++++- drivers/irqchip/irq-msi-lib.h | 6 ++++++ 2 files changed, 16 insertions(+), 1 deletion(-) commit 48f71d56e2b87839052d2a2ec32fc97a79c3e264 Author: Thomas Gleixner Date: Sun Jun 23 17:18:36 2024 +0200 irqchip/gic-v3-its: Provide MSI parent infrastructure To support per device MSI domains the ITS must provide MSI parent domain functionality. Provide the basic skeleton for this: - msi_parent_ops - child domain init callback - the MSI parent flag set in irqdomain::flags This does not make ITS a functional parent domain as there is no bit set in the bus_select_mask yet, but it provides the base to implement PCI and platform MSI support gradually on top. Signed-off-by: Thomas Gleixner Signed-off-by: Anna-Maria Behnsen Signed-off-by: Shivamurthy Shastri Signed-off-by: Thomas Gleixner Link: https://lore.kernel.org/r/20240623142234.903076277@linutronix.de drivers/irqchip/Kconfig | 1 + drivers/irqchip/Makefile | 2 +- drivers/irqchip/irq-gic-common.h | 3 +++ drivers/irqchip/irq-gic-v3-its-msi-parent.c | 31 +++++++++++++++++++++++++++++ drivers/irqchip/irq-gic-v3-its.c | 5 +++++ 5 files changed, 41 insertions(+), 1 deletion(-) commit 72e257c6f058032daba1c4fe0c81003d545d0f81 Author: Thomas Gleixner Date: Sun Jun 23 17:18:34 2024 +0200 irqchip: Provide irq-msi-lib All irqdomains which provide MSI parent domain functionality for per device MSI domains need to provide a select() callback for the irqdomain and a function to initialize the child domain. Most of these functions would just be copy&paste with minimal modifications, so provide a library function which implements the required functionality and is customizable via parent_domain::msi_parent_ops. The check for the supported bus tokens in msi_lib_init_dev_msi_info() is expanded step by step within the next patches. Signed-off-by: Thomas Gleixner Signed-off-by: Anna-Maria Behnsen Signed-off-by: Shivamurthy Shastri Signed-off-by: Thomas Gleixner Link: https://lore.kernel.org/r/20240623142234.840975799@linutronix.de drivers/irqchip/Kconfig | 3 ++ drivers/irqchip/Makefile | 1 + drivers/irqchip/irq-msi-lib.c | 112 ++++++++++++++++++++++++++++++++++++++++++ drivers/irqchip/irq-msi-lib.h | 19 +++++++ 4 files changed, 135 insertions(+) commit 7d189c77106ed6df09829f7a419e35ada67b2bd0 Author: Shivamurthy Shastri Date: Wed Jun 26 21:05:12 2024 +0200 PCI/MSI: Provide MSI_FLAG_PCI_MSI_MASK_PARENT Most ARM(64) PCI/MSI domains mask and unmask in the parent domain after or before the PCI mask/unmask operation takes place. So there are more than a dozen of the same wrapper implementation all over the place. Don't make the same mistake with the new per device PCI/MSI domains and provide a new MSI feature flag, which lets the domain implementation enable this sequence in the PCI/MSI code. Signed-off-by: Shivamurthy Shastri Signed-off-by: Thomas Gleixner Acked-by: Bjorn Helgaas Link: https://lore.kernel.org/r/87ed8j34pj.ffs@tglx drivers/pci/msi/irqdomain.c | 20 ++++++++++++++++++++ include/linux/msi.h | 2 ++ 2 files changed, 22 insertions(+) commit 24777bac4af5fcddb0cf4a7d8a2b6ee2a98fe6fd Author: Manivannan Sadhasivam Date: Wed Jul 17 09:57:46 2024 +0530 PCI: Check for the existence of 'dev.of_node' before calling of_platform_populate() Commit 50b040ef3732 ("PCI/pwrctl: only call of_platform_populate() if CONFIG_OF is enabled") added the CONFIG_OF guard for the of_platform_populate() API. But it missed the fact that the CONFIG_OF platforms can also run on ACPI without devicetree (so dev.of_node will be NULL). In those cases, of_platform_populate() will fail with below error messages as seen on the Ampere Altra box: pci 000c:00:01.0: failed to populate child OF nodes (-22) pci 000c:00:02.0: failed to populate child OF nodes (-22) Fix this by checking for the existence of 'dev.of_node' before calling the of_platform_populate() API. This also warrants the removal of CONFIG_OF check, since dev_of_node() helper will return NULL if CONFIG_OF is not enabled. While at it, let's also use dev_of_node() to pass device OF node pointer to of_platform_populate(). Fixes: 50b040ef3732 ("PCI/pwrctl: only call of_platform_populate() if CONFIG_OF is enabled") Reported-by: Linus Torvalds Closes: https://lore.kernel.org/linux-arm-msm/CAHk-=wjcO_9dkNf-bNda6bzykb5ZXWtAYA97p7oDsXPHmMRi6g@mail.gmail.com Reviewed-by: Bartosz Golaszewski Signed-off-by: Manivannan Sadhasivam Signed-off-by: Linus Torvalds drivers/pci/bus.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) commit f2f6a8e8871725035959b90bac048cde555aa0e9 Author: Mark Rutland Date: Thu Jul 18 13:06:47 2024 +0100 init/Kconfig: remove CONFIG_GCC_ASM_GOTO_OUTPUT_WORKAROUND Several versions of GCC mis-compile asm goto with outputs. We try to workaround this, but our workaround is demonstrably incomplete and liable to result in subtle bugs, especially on arm64 where get_user() has recently been moved over to using asm goto with outputs. From discussion(s) with Linus at: https://lore.kernel.org/linux-arm-kernel/Zpfv2tnlQ-gOLGac@J2N7QTR9R3.cambridge.arm.com/ https://lore.kernel.org/linux-arm-kernel/ZpfxLrJAOF2YNqCk@J2N7QTR9R3.cambridge.arm.com/ ... it sounds like the best thing to do for now is to remove the workaround and make CC_HAS_ASM_GOTO_OUTPUT depend on working compiler versions. The issue was originally reported to GCC by Sean Christopherson: https://gcc.gnu.org/bugzilla/show_bug.cgi?id=113921 ... and Jakub Jelinek fixed this for GCC 14, with the fix backported to 13.3.0, 12.4.0, and 11.5.0. In the kernel, we tried to workaround broken compilers in commits: 4356e9f841f7 ("work around gcc bugs with 'asm goto' with outputs") 68fb3ca0e408 ("update workarounds for gcc "asm goto" issue") ... but the workaround of adding an empty asm("") after the asm volatile goto(...) demonstrably does not always avoid the problem, as can be seen in the following test case: | #define asm_goto_output(x...) \ | do { asm volatile goto(x); asm (""); } while (0) | | #define __good_or_bad(__val, __key) \ | do { \ | __label__ __failed; \ | unsigned long __tmp; \ | asm_goto_output( \ | " cbnz %[key], %l[__failed]\n" \ | " mov %[val], #0x900d\n" \ | : [val] "=r" (__tmp) \ | : [key] "r" (__key) \ | : \ | : __failed); \ | (__val) = __tmp; \ | break; \ | __failed: \ | (__val) = 0xbad; \ | } while (0) | | unsigned long get_val(unsigned long key); | unsigned long get_val(unsigned long key) | { | unsigned long val = 0xbad; | | __good_or_bad(val, key); | | return val; | } GCC 13.2.0 (at -O2) compiles this to: | cbnz x0, .Lfailed | mov x0, #0x900d | .Lfailed: | ret GCC 14.1.0 (at -O2) compiles this to: | cbnz x0, .Lfailed | mov x0, #0x900d | ret | .Lfailed: | mov x0, #0xbad | ret Note that GCC 13.2.0 erroneously omits the assignment to 'val' in the error path (even though this does not depend on an output of the asm goto). GCC 14.1.0 correctly retains the assignment. This problem can be seen within the kernel with the following test case: | #include | #include | | noinline unsigned long test_unsafe_get_user(unsigned long __user *ptr); | noinline unsigned long test_unsafe_get_user(unsigned long __user *ptr) | { | unsigned long val; | | unsafe_get_user(val, ptr, Efault); | return val; | | Efault: | val = 0x900d; | return val; | } GCC 13.2.0 (arm64 defconfig) compiles this to: | and x0, x0, #0xff7fffffffffffff | ldtr x0, [x0] | .Lextable_fixup: | ret GCC 13.2.0 (x86_64 defconfig + MITIGATION_RETPOLINE=n) compiles this to: | endbr64 | mov (%rdi),%rax | .Lextable_fixup: | ret ... omitting the assignment to 'val' in the error path, and leaving garbage in the result register returned by the function (which happens to contain the faulting address in the generated code). GCC 14.1.0 (arm64 defconfig) compiles this to: | and x0, x0, #0xff7fffffffffffff | ldtr x0, [x0] | ret | .Lextable_fixup: | mov x0, #0x900d // #36877 | ret GCC 14.1.0 (x86_64 defconfig + MITIGATION_RETPOLINE=n) compiles this to: | endbr64 | mov (%rdi),%rax | ret | .Lextable_fixup: | mov $0x900d,%eax | ret ... retaining the expected assignment to 'val' in the error path. We don't have a complete and reasonable workaround. While placing empty asm("") blocks after each goto label *might* be sufficient, we don't know for certain, this is tedious and error-prone, and there doesn't seem to be a neat way to wrap this up (which is especially painful for cases with multiple goto labels). Avoid this issue by disabling CONFIG_CC_HAS_ASM_GOTO_OUTPUT for known-broken compiler versions and removing the workaround (along with the CONFIG_GCC_ASM_GOTO_OUTPUT_WORKAROUND config option). For the moment I've left the default implementation of asm_goto_output() unchanged. This should now be redundant since any compiler with the fix for the clobbering issue whould also have a fix for the (earlier) volatile issue, but it's far less churny to leave it around, which makes it easier to backport this patch if necessary. Signed-off-by: Mark Rutland Cc: Alex Coplan Cc: Catalin Marinas Cc: Jakub Jelinek Cc: Peter Zijlstra Cc: Sean Christopherson Cc: Szabolcs Nagy Cc: Will Deacon Cc: linux-arm-kernel@lists.infradead.org Cc: linux-kernel@vger.kernel.org Signed-off-by: Linus Torvalds include/linux/compiler-gcc.h | 20 -------------------- init/Kconfig | 22 ++++++++++++---------- 2 files changed, 12 insertions(+), 30 deletions(-) commit 49208b67585d18521225bf72bf842593cea711f8 Author: Masahiro Yamada Date: Thu Jul 18 01:24:20 2024 +0900 kbuild: fix rebuild of generic syscall headers Commit fbb5c0606fa4 ("kbuild: add syscall table generation to scripts/Makefile.asm-headers") started to generate syscall headers for architectures using generic syscalls. However, these headers are always rebuilt using GNU Make 4.4.1 or newer. When using GNU Make 4.4 or older, these headers are not rebuilt when the command to generate them is changed, despite the use of the if_changed macro. scripts/Makefile.asm-headers now uses FORCE, but it is not marked as .PHONY. To handle the command line change correctly, .*.cmd files must be included. Fixes: fbb5c0606fa4 ("kbuild: add syscall table generation to scripts/Makefile.asm-headers") Reported-by: Linus Torvalds Closes: https://lore.kernel.org/lkml/CAHk-=wibB7SvXnUftBgAt+4-3vEKRpvEgBeDEH=i=j2GvDitoA@mail.gmail.com/ Signed-off-by: Masahiro Yamada Tested-by: Arnd Bergmann Signed-off-by: Linus Torvalds scripts/Makefile.asm-headers | 8 ++++++++ 1 file changed, 8 insertions(+) commit b3ce7a30847a54a7f96a35e609303d8afecd460b Merge: b1bc554e009e 478a52707b0a Author: Linus Torvalds Date: Thu Jul 18 09:34:02 2024 -0700 Merge tag 'drm-next-2024-07-18' of https://gitlab.freedesktop.org/drm/kernel Pull drm updates from Dave Airlie: "There's a lot of stuff in here, amd, i915 and xe have new platform work, lots of core rework around EDID handling, some new COMPILE_TEST options, maintainer changes and a lots of other stuff. Summary: core: - deprecate DRM data and return 0 date - connector: Create a set of helpers to help with HDMI support - Remove driver owner assignments - Allow more drivers to compile with COMPILE_TEST - Conversions to drm_edid - Sprinkle MODULE_DESCRIPTIONS everywhere they are missing - Remove drm_mm_replace_node - print: Add a drm prefix to warn level messages too, remove ___drm_dbg, consolidate prefix handling - New monochrome TV mode variant ttm: - improve number of page faults on some platforms - fix test builds under PREEMPT_RT - more test coverage ci: - Require a more recent version of mesa - improve farm setup and test generation dma-buf: - warn if reserving 0 fence slots - internal API heap enhancements fbdev: - Create memory manager optimized fbdev emulation panic: - Allow to select fonts - improve drm_fb_dma_get_scanout_buffer - Allow to dump kmsg to the screen bridge: - Remove redundant checks on bridge->encoder - Remove drm_bridge_chain_mode_fixup - bridge-connector: Plumb in the new HDMI helper - analogix_dp: Various improvements, handle AUX transfers timeout - samsung-dsim: Fix timings calculation - tc358767: Plenty of small fixes, fix no connector attach, fix clocks - sii902x: state validation improvements panels: - Switch panels from register table initialization to proper code - Now that the panel code tracks the panel state, remove every ad-hoc implementation in the panel drivers - More cleanup of prepare / enable state tracking in drivers - edp: Drop legacy panel compatibles - simple-bridge: Switch to devm_drm_bridge_add - New panels: Lincoln Tech Sol LCD185-101CT, Microtips Technology 13-101HIEBCAF0-C, Microtips Technology MF-103HIEB0GA0, BOE nv110wum-l60, IVO t109nw41, WL-355608-A8, PrimeView PM070WL4, Lincoln Technologies LCD197, Ortustech COM35H3P70ULC, AUO G104STN01, K&d kd101ne3-40ti amdgpu: - DCN 4.0.x support - GC 12.0 support - GMC 12.0 support - SDMA 7.0 support - MES12 support - MMHUB 4.1 support - GFX12 modifier and DCC support - lots of IP fixes/updates amdkfd: - Contiguous VRAM allocations - GC 12.0 support - SDMA 7.0 support - SR-IOV fixes - KFD GFX ALU exceptions i915: - Battlemage Xe2 HPD display enablement - Panel Replay enabling - DP AUX-less ALPM/LOBF - Enable link training failure fallback for DP MST links - CMRR (Content Match Refresh Rate) enabling - Increase ADL-S/ADL-P/DG2+ max TMDS bitrate to 6 Gbps - Enable eDP AUX based HDR backlight - Support replaying GPU hangs with captured context image - Automate CCS Mode setting during engine resets - lots of refactoring - Support replaying GPU hangs with captured context image - Increase FLR timeout from 3s to 9s - Enable w/a 16021333562 for DG2, MTL and ARL [guc] xe: - update MAINATINERS - New uapi adding OA functionality to Xe - expose l3 bank mask - fix display detect on ADL-N - runtime PM Fixes - Fix silent backmerge issues - More prep for SR-IOV - HWmon additions - per client usage info - Rework GPU page fault handling - Drop EXEC_QUEUE_FLAG_BANNED - Add BMG PCI IDs - Scheduler fixes and improvements - Rename xe_exec_queue::compute to xe_exec_queue::lr - Use ttm_uncached for BO with NEEDS_UC flag - Rename xe perf layer as xe observation layer - lots of refactoring radeon: - Backlight workaround for iMac - Silence UBSAN flex array warnings msm: - Validate registers XML description against schema in CI - core/dpu: SM7150 support - mdp5: Add support for MSM8937 - gpu: Add param for userspace to know if raytracing is supported - gpu: X185 support (aka gpu in X1 laptop chips) - gpu: a505 support ivpu: - hardware scheduler support - profiling support - improvements to the platform support layer - firmware handling improvements - clocks/power mgmt improvements - scheduler/logging improvements habanalabs: - Gradual sleep in polling memory macro - Reduce Gaudi2 MSI-X interrupt count to 128 - Add Gaudi2-D revision support - Add timestamp to CPLD info - Gaudi2: Assume hard-reset by firmware upon MC SEI severe error - Align Gaudi2 interrupt names - Check for errors after preboot is ready - Change habanalabs maintainer and git repo path mgag200: - refactoring and improvements - Add BMC output - enable polling nouveau: - add registry command line v3d: - perf counters improvements zynqmp: - irq and debugfs improvements atmel-hlcdc: - Support XLCDC in sam9x7 mipi-dbi: - Remove mipi_dbi_machine_little_endian - make SPI bits per word configurable - support RGB888 - allow pixel formats to be specified in the DT sun4i: - Rework the blender setup for DE2 panfrost: - Enable MT8188 support vc4: - Monochrome TV support exynos: - fix fallback mode regression - fix memory leak - Use drm_edid_duplicate() instead of kmemdup() etnaviv: - fix i.MX8MP NPU clock gating - workaround FE register cdc issues on some cores - fix DMA sync handling for cached buffers - fix job timeout handling - keep TS enabled on MMUv2 cores for improved performance mediatek: - Convert to platform remove callback returning void- - Drop chain_mode_fixup call in mode_valid() - Fixes the errors of MediaTek display driver found by IGT - Add display support for the MT8365-EVK board - Fix bit depth overwritten for mtk_ovl_set bit_depth() - Fix possible_crtcs calculation - Fix spurious kfree() ast: - refactor mode setting code stm: - Add LVDS support - DSI PHY updates" * tag 'drm-next-2024-07-18' of https://gitlab.freedesktop.org/drm/kernel: (2501 commits) drm/amdgpu/mes12: add missing opcode string drm/amdgpu/mes11: update opcode strings Revert "drm/amd/display: Reset freesync config before update new state" drm/omap: Restrict compile testing to PAGE_SIZE less than 64KB drm/xe: Drop trace_xe_hw_fence_free drm/xe/uapi: Rename xe perf layer as xe observation layer drm/amdgpu: remove exp hw support check for gfx12 drm/amdgpu: timely save bad pages to eeprom after gpu ras reset is completed drm/amdgpu: flush all cached ras bad pages to eeprom drm/amdgpu: select compute ME engines dynamically drm/amd/display: Allow display DCC for DCN401 drm/amdgpu: select compute ME engines dynamically drm/amdgpu/job: Replace DRM_INFO/ERROR logging drm/amdgpu: select compute ME engines dynamically drm/amd/pm: Ignore initial value in smu response register drm/amdgpu: Initialize VF partition mode drm/amd/amdgpu: fix SDMA IRQ client ID <-> req mapping MAINTAINERS: fix Xinhui's name MAINTAINERS: update powerplay and swsmu drm/qxl: Pin buffer objects for internal mappings ... commit b9fae9f06d84ffab0f3f9118f3a96bbcdc528bf6 Author: Benjamin Coddington Date: Thu Jul 11 13:21:00 2024 -0400 SUNRPC: Fixup gss_status tracepoint error output The GSS routine errors are values, not flags. Fixes: 0c77668ddb4e ("SUNRPC: Introduce trace points in rpc_auth_gss.ko") Signed-off-by: Benjamin Coddington Reviewed-by: Chuck Lever Signed-off-by: Anna Schumaker include/trace/events/rpcgss.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit ed0172af5d6fc07d1b40ca82f5ca3979300369f7 Author: Benjamin Coddington Date: Wed Jul 17 10:49:33 2024 -0400 SUNRPC: Fix a race to wake a sync task We've observed NFS clients with sync tasks sleeping in __rpc_execute waiting on RPC_TASK_QUEUED that have not responded to a wake-up from rpc_make_runnable(). I suspect this problem usually goes unnoticed, because on a busy client the task will eventually be re-awoken by another task completion or xprt event. However, if the state manager is draining the slot table, a sync task missing a wake-up can result in a hung client. We've been able to prove that the waker in rpc_make_runnable() successfully calls wake_up_bit() (ie- there's no race to tk_runstate), but the wake_up_bit() call fails to wake the waiter. I suspect the waker is missing the load of the bit's wait_queue_head, so waitqueue_active() is false. There are some very helpful comments about this problem above wake_up_bit(), prepare_to_wait(), and waitqueue_active(). Fix this by inserting smp_mb__after_atomic() before the wake_up_bit(), which pairs with prepare_to_wait() calling set_current_state(). Signed-off-by: Benjamin Coddington Reviewed-by: Jeff Layton Signed-off-by: Anna Schumaker net/sunrpc/sched.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) commit 4594d26fca91fab0e1621d2ab196f3f9bab96bc8 Author: Mark Brown Date: Tue Jul 16 15:48:00 2024 +0100 kselftest/alsa: Log the PCM ID in pcm-test Drivers report a string with a name for each PCM, log it during startup of pcm-test as a diagnostic aid. Signed-off-by: Mark Brown Link: https://patch.msgid.link/20240716-alsa-kselftest-board-name-v2-2-60f1acdde096@kernel.org Signed-off-by: Takashi Iwai tools/testing/selftests/alsa/pcm-test.c | 4 ++++ 1 file changed, 4 insertions(+) commit b1a7b97aa534b031f929ba4bf70d2e869b117c9d Author: Mark Brown Date: Tue Jul 16 15:47:59 2024 +0100 kselftest/alsa: Use card name rather than number in test names Currently for the PCM and mixer tests we report test names which identify the card being tested with the card number. This ensures we have unique names but since card numbers are dynamically assigned at runtime the names we end up with will often not be stable on systems with multiple cards especially where those cards are provided by separate modules loeaded at runtime. This makes it difficult for automated systems and UIs to relate test results between runs on affected platforms. Address this by replacing our use of card numbers with card names which are more likely to be stable across runs. We use the card ID since it is guaranteed to be unique by default, unlike the long name. There is still some vulnerability to ordering issues if multiple cards with the same base ID are present in the system but have separate dependencies but not all drivers put distinguishing information in their long names. Signed-off-by: Mark Brown Link: https://patch.msgid.link/20240716-alsa-kselftest-board-name-v2-1-60f1acdde096@kernel.org Signed-off-by: Takashi Iwai tools/testing/selftests/alsa/mixer-test.c | 98 +++++++++++++++++++------------ tools/testing/selftests/alsa/pcm-test.c | 64 ++++++++++++++------ 2 files changed, 104 insertions(+), 58 deletions(-) commit d7063c08738573fc2f3296da6d31a22fa8aa843a Author: Seunghun Han Date: Thu Jul 18 17:09:08 2024 +0900 ALSA: hda/realtek: Fix the speaker output on Samsung Galaxy Book Pro 360 Samsung Galaxy Book Pro 360 (13" 2022 NT935QDB-KC71S) with codec SSID 144d:c1a4 requires the same workaround to enable the speaker amp as other Samsung models with the ALC298 codec. Signed-off-by: Seunghun Han Cc: Link: https://patch.msgid.link/20240718080908.8677-1-kkamagui@gmail.com Signed-off-by: Takashi Iwai sound/pci/hda/patch_realtek.c | 1 + 1 file changed, 1 insertion(+) commit 90936a0a4c54f0a1cdf4538f9128821ad70c36ab Author: Matthew Brost Date: Mon Jul 15 23:39:02 2024 -0700 drm/xe: Don't suspend device upon wedge When wedging a device we shouldn't be suspending device as state for debug will be lost. Also this appears to not work as the below stack trace pops upon trying to resume a wedged device: [ 304.245044] INFO: task cat:12115 blocked for more than 151 seconds. [ 304.251333] Tainted: G W 6.10.0-rc7-xe+ #3518 [ 304.257617] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. [ 304.265459] task:cat state:D stack:13384 pid:12115 tgid:12115 ppid:3986 flags:0x00000006 [ 304.265465] Call Trace: [ 304.265467] [ 304.265469] __schedule+0x3c4/0xdf0 [ 304.265478] schedule+0x3c/0x140 [ 304.265481] rpm_resume+0x1cc/0x740 [ 304.265484] ? __pfx_autoremove_wake_function+0x10/0x10 [ 304.265489] __pm_runtime_resume+0x49/0x80 [ 304.265494] guc_info+0x6b/0xb0 [xe] [ 304.265538] ? __pfx___drm_printfn_seq_file+0x10/0x10 [ 304.265541] ? __pfx___drm_puts_seq_file+0x10/0x10 [ 304.265545] seq_read_iter+0x111/0x4c0 [ 304.265551] seq_read+0xfc/0x140 [ 304.265556] full_proxy_read+0x58/0x80 [ 304.265560] vfs_read+0xa7/0x360 [ 304.265563] ? find_held_lock+0x2b/0x80 [ 304.265568] ksys_read+0x64/0xe0 [ 304.265571] do_syscall_64+0x68/0x140 [ 304.265575] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 304.265578] RIP: 0033:0x7f4254d14992 [ 304.265580] RSP: 002b:00007ffc558666f8 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 304.265583] RAX: ffffffffffffffda RBX: 0000000000020000 RCX: 00007f4254d14992 [ 304.265584] RDX: 0000000000020000 RSI: 00007f4254ebb000 RDI: 0000000000000003 [ 304.265586] RBP: 00007f4254ebb000 R08: 00007f4254eba010 R09: 00007f4254eba010 [ 304.265587] R10: 0000000000000022 R11: 0000000000000246 R12: 0000000000022000 [ 304.265588] R13: 0000000000000003 R14: 0000000000020000 R15: 0000000000020000 [ 304.265593] [ 304.265594] Showing all locks held in the system: [ 304.265598] 1 lock held by khungtaskd/57: [ 304.265599] #0: ffffffff8273b860 (rcu_read_lock){....}-{1:2}, at: debug_show_all_locks+0x36/0x1c0 [ 304.265607] 3 locks held by kworker/6:1/90: [ 304.265610] 1 lock held by in:imklog/547: [ 304.265611] #0: ffff88810498cd88 (&f->f_pos_lock){+.+.}-{3:3}, at: __fdget_pos+0x76/0xc0 [ 304.265620] 1 lock held by dmesg/1310: v2: Drop local 'err' variable (Jonathan) Fixes: 8ed9aaae39f3 ("drm/xe: Force wedged state and block GT reset upon any GPU hang") Cc: Rodrigo Vivi Signed-off-by: Matthew Brost Reviewed-by: Jonathan Cavitt Link: https://patchwork.freedesktop.org/patch/msgid/20240716063902.1390130-2-matthew.brost@intel.com (cherry picked from commit 452bca0edbd0764ca0284239d5438b3edd305ab3) Signed-off-by: Rodrigo Vivi drivers/gpu/drm/xe/xe_device.c | 14 ++++++++++++++ 1 file changed, 14 insertions(+) commit c9474b726b932b5d555effd9ed0ae19f4da2367c Author: Matthew Brost Date: Mon Jul 15 23:39:01 2024 -0700 drm/xe: Wedge the entire device Wedge the entire device, not just GT which may have triggered the wedge. To implement this, cleanup the layering so xe_device_declare_wedged() calls into the lower layers (GT) to ensure entire device is wedged. While we are here, also signal any pending GT TLB invalidations upon wedging device. Lastly, short circuit reset wait if device is wedged. v2: - Short circuit reset wait if device is wedged (Local testing) Fixes: 8ed9aaae39f3 ("drm/xe: Force wedged state and block GT reset upon any GPU hang") Cc: Rodrigo Vivi Signed-off-by: Matthew Brost Reviewed-by: Jonathan Cavitt Link: https://patchwork.freedesktop.org/patch/msgid/20240716063902.1390130-1-matthew.brost@intel.com (cherry picked from commit 7dbe8af13c189f5937e87e9fb924d5bbc49e6f71) Signed-off-by: Rodrigo Vivi drivers/gpu/drm/xe/xe_device.c | 6 ++++++ drivers/gpu/drm/xe/xe_gt.c | 15 +++++++++++++++ drivers/gpu/drm/xe/xe_gt.h | 1 + drivers/gpu/drm/xe/xe_guc.c | 16 ++++++++++++++++ drivers/gpu/drm/xe/xe_guc.h | 1 + drivers/gpu/drm/xe/xe_guc_submit.c | 38 +++++++++++++++++++++++++------------- drivers/gpu/drm/xe/xe_guc_submit.h | 1 + drivers/gpu/drm/xe/xe_uc.c | 14 ++++++++++++++ drivers/gpu/drm/xe/xe_uc.h | 1 + 9 files changed, 80 insertions(+), 13 deletions(-) commit bf07ca963d4fd11c88a9d4b058f2bd62e8d46a98 Author: Michal Wajdeczko Date: Thu Jul 11 21:23:19 2024 +0200 drm/xe/pf: Limit fair VF LMEM provisioning Due to the current design of the BO and VRAM manager, any object with XE_BO_FLAG_PINNED flag, which the PF driver uses during VF LMEM provisionining, is created with the TTM_PL_FLAG_CONTIGUOUS flag, which may cause VRAM fragmentation that prevents subsequent allocations of larger objects, like fair VF LMEM provisioning. To avoid such failures, round down fair VF LMEM provisioning size to next power of two size, to compensate what xe_ttm_vram_mgr is doing to achieve contiguous allocations. Fixes: ac6598aed1b3 ("drm/xe/pf: Add support to configure SR-IOV VFs") Signed-off-by: Michal Wajdeczko Reviewed-by: Piotr Piórkowski Reviewed-by: Jonathan Cavitt Link: https://patchwork.freedesktop.org/patch/msgid/20240711192320.1198-2-michal.wajdeczko@intel.com Signed-off-by: Lucas De Marchi (cherry picked from commit 4c3fe5eae46b92e2fd961b19f7779608352e5368) Signed-off-by: Rodrigo Vivi drivers/gpu/drm/xe/xe_gt_sriov_pf_config.c | 1 + 1 file changed, 1 insertion(+) commit 408c2f14a5d3d7ac4824b96e52693ab271efb738 Author: Ashutosh Dixit Date: Thu Jul 11 14:12:03 2024 -0700 drm/xe/exec: Fix minor bug related to xe_sync_entry_cleanup Increment num_syncs after xe_sync_entry_parse() is successful to ensure the xe_sync_entry_cleanup() logic under "err_syncs" label works correctly. v2: Use the same pattern as that in xe_vm.c (Matt Brost) Fixes: dd08ebf6c352 ("drm/xe: Introduce a new DRM driver for Intel GPUs") Signed-off-by: Ashutosh Dixit Reviewed-by: Matthew Brost Link: https://patchwork.freedesktop.org/patch/msgid/20240711211203.3728180-1-ashutosh.dixit@intel.com (cherry picked from commit 43a6faa6d9b5e9139758200a79fe9c8f4aaa0c8d) Signed-off-by: Rodrigo Vivi drivers/gpu/drm/xe/xe_exec.c | 14 +++++++------- 1 file changed, 7 insertions(+), 7 deletions(-) commit 4ecc24a84d7e0254efd150ec23e0b89638386516 Author: Tvrtko Ursulin Date: Thu Jul 11 14:53:34 2024 +0100 drm/v3d: Validate passed in drm syncobj handles in the performance extension If userspace provides an unknown or invalid handle anywhere in the handle array the rest of the driver will not handle that well. Fix it by checking handle was looked up successfully or otherwise fail the extension by jumping into the existing unwind. Signed-off-by: Tvrtko Ursulin Fixes: bae7cb5d6800 ("drm/v3d: Create a CPU job extension for the reset performance query job") Cc: Maíra Canal Cc: Iago Toral Quiroga Cc: stable@vger.kernel.org # v6.8+ Reviewed-by: Maíra Canal Signed-off-by: Maíra Canal Link: https://patchwork.freedesktop.org/patch/msgid/20240711135340.84617-6-tursulin@igalia.com (cherry picked from commit a546b7e4d73c23838d7e4d2c92882b3ca902d213) Signed-off-by: Thomas Zimmermann drivers/gpu/drm/v3d/v3d_submit.c | 8 ++++++++ 1 file changed, 8 insertions(+) commit 023d22e8bb0cdd6900382ad1ed06df3b6c2ea791 Author: Tvrtko Ursulin Date: Thu Jul 11 14:53:33 2024 +0100 drm/v3d: Validate passed in drm syncobj handles in the timestamp extension If userspace provides an unknown or invalid handle anywhere in the handle array the rest of the driver will not handle that well. Fix it by checking handle was looked up successfully or otherwise fail the extension by jumping into the existing unwind. Signed-off-by: Tvrtko Ursulin Fixes: 9ba0ff3e083f ("drm/v3d: Create a CPU job extension for the timestamp query job") Cc: Maíra Canal Cc: Iago Toral Quiroga Cc: stable@vger.kernel.org # v6.8+ Reviewed-by: Maíra Canal Signed-off-by: Maíra Canal Link: https://patchwork.freedesktop.org/patch/msgid/20240711135340.84617-5-tursulin@igalia.com (cherry picked from commit 8d1276d1b8f738c3afe1457d4dff5cc66fc848a3) Signed-off-by: Thomas Zimmermann drivers/gpu/drm/v3d/v3d_submit.c | 12 ++++++++++++ 1 file changed, 12 insertions(+) commit 32df4abc44f24dbec239d43e2b26d5768c5d1a78 Author: Tvrtko Ursulin Date: Thu Jul 11 14:53:32 2024 +0100 drm/v3d: Fix potential memory leak in the performance extension If fetching of userspace memory fails during the main loop, all drm sync objs looked up until that point will be leaked because of the missing drm_syncobj_put. Fix it by exporting and using a common cleanup helper. Signed-off-by: Tvrtko Ursulin Fixes: bae7cb5d6800 ("drm/v3d: Create a CPU job extension for the reset performance query job") Cc: Maíra Canal Cc: Iago Toral Quiroga Cc: stable@vger.kernel.org # v6.8+ Signed-off-by: Maíra Canal Link: https://patchwork.freedesktop.org/patch/msgid/20240711135340.84617-4-tursulin@igalia.com (cherry picked from commit 484de39fa5f5b7bd0c5f2e2c5265167250ef7501) Signed-off-by: Thomas Zimmermann drivers/gpu/drm/v3d/v3d_drv.h | 2 ++ drivers/gpu/drm/v3d/v3d_sched.c | 22 ++++++++++++----- drivers/gpu/drm/v3d/v3d_submit.c | 52 ++++++++++++++++++++++++---------------- 3 files changed, 50 insertions(+), 26 deletions(-) commit 0e50fcc20bd87584840266e8004f9064a8985b4f Author: Tvrtko Ursulin Date: Thu Jul 11 14:53:31 2024 +0100 drm/v3d: Fix potential memory leak in the timestamp extension If fetching of userspace memory fails during the main loop, all drm sync objs looked up until that point will be leaked because of the missing drm_syncobj_put. Fix it by exporting and using a common cleanup helper. Signed-off-by: Tvrtko Ursulin Fixes: 9ba0ff3e083f ("drm/v3d: Create a CPU job extension for the timestamp query job") Cc: Maíra Canal Cc: Iago Toral Quiroga Cc: stable@vger.kernel.org # v6.8+ Reviewed-by: Maíra Canal Signed-off-by: Maíra Canal Link: https://patchwork.freedesktop.org/patch/msgid/20240711135340.84617-3-tursulin@igalia.com (cherry picked from commit 753ce4fea62182c77e1691ab4f9022008f25b62e) Signed-off-by: Thomas Zimmermann drivers/gpu/drm/v3d/v3d_drv.h | 2 ++ drivers/gpu/drm/v3d/v3d_sched.c | 22 ++++++++++++++------ drivers/gpu/drm/v3d/v3d_submit.c | 43 ++++++++++++++++++++++++++++------------ 3 files changed, 48 insertions(+), 19 deletions(-) commit 6ce9efd12ae81cf46bf44eb0348594558dfbb9d2 Author: Tvrtko Ursulin Date: Thu Jul 11 14:53:30 2024 +0100 drm/v3d: Prevent out of bounds access in performance query extensions Check that the number of perfmons userspace is passing in the copy and reset extensions is not greater than the internal kernel storage where the ids will be copied into. Signed-off-by: Tvrtko Ursulin Fixes: bae7cb5d6800 ("drm/v3d: Create a CPU job extension for the reset performance query job") Cc: Maíra Canal Cc: Iago Toral Quiroga Cc: stable@vger.kernel.org # v6.8+ Reviewed-by: Iago Toral Quiroga Reviewed-by: Maíra Canal Signed-off-by: Maíra Canal Link: https://patchwork.freedesktop.org/patch/msgid/20240711135340.84617-2-tursulin@igalia.com (cherry picked from commit f32b5128d2c440368b5bf3a7a356823e235caabb) Signed-off-by: Thomas Zimmermann drivers/gpu/drm/v3d/v3d_submit.c | 6 ++++++ 1 file changed, 6 insertions(+) commit ed70aaac7c359540d3d8332827fa60b6a45e15f2 Author: Bartosz Golaszewski Date: Wed Jul 17 16:28:03 2024 +0200 Kconfig: reduce the amount of power sequencing noise Kconfig will ask the user twice about power sequencing: once for the QCom WCN power sequencing driver and then again for the PCI power control driver using it. Let's automate the selection of PCI_PWRCTL by introducing a new hidden symbol: HAVE_PWRCTL which should be selected by all platforms that have the need to include PCI power control code (right now: only ARCH_QCOM). The pwrseq-based PCI pwrctl driver itself will then be selected by the drivers binding to devices that may require external handling of the power-up sequence (currently: ath11k and ath12k) based on the value of HAVE_PWRCTL. Make all PCI pwrctl Kconfig symbols hidden so that no questions are asked during configuration. Fixes: 4565d2652a37 ("PCI/pwrctl: Add PCI power control core code") Reported-by: Linus Torvalds Closes: https://lore.kernel.org/lkml/CAHk-=wjWc5dzcj2O1tEgNHY1rnQW63JwtuZi_vAZPqy6wqpoUQ@mail.gmail.com/ Acked-by: Jeff Johnson # drivers/net/wireless/ath Link: https://lore.kernel.org/r/20240717142803.53248-1-brgl@bgdev.pl Signed-off-by: Bartosz Golaszewski arch/arm64/Kconfig.platforms | 1 + drivers/net/wireless/ath/ath11k/Kconfig | 1 + drivers/net/wireless/ath/ath12k/Kconfig | 1 + drivers/pci/pwrctl/Kconfig | 11 +++-------- 4 files changed, 6 insertions(+), 8 deletions(-) commit e528be3c87be953b73e7826a2d7e4b837cbad39d Author: Rafael J. Wysocki Date: Wed Jul 17 21:45:02 2024 +0200 thermal: core: Allow thermal zones to tell the core to ignore them The iwlwifi wireless driver registers a thermal zone that is only needed when the network interface handled by it is up and it wants that thermal zone to be effectively ignored by the core otherwise. Before commit a8a261774466 ("thermal: core: Call monitor_thermal_zone() if zone temperature is invalid") that could be achieved by returning an error code from the thermal zone's .get_temp() callback because the core did not really handle errors returned by it almost at all. However, commit a8a261774466 made the core attempt to recover from the situation in which the temperature of a thermal zone cannot be determined due to errors returned by its .get_temp() and is always invalid from the core's perspective. That was done because there are thermal zones in which .get_temp() returns errors to start with due to some difficulties related to the initialization ordering, but then it will start to produce valid temperature values at one point. Unfortunately, the simple approach taken by commit a8a261774466, which is to poll the thermal zone periodically until its .get_temp() callback starts to return valid temperature values, is at odds with the special thermal zone in iwlwifi in which .get_temp() may always return an error because its network interface may always be down. If that happens, every attempt to invoke the thermal zone's .get_temp() callback resulting in an error causes the thermal core to print a dev_warn() message to the kernel log which is super-noisy. To address this problem, make the core handle the case in which .get_temp() returns 0, but the temperature value returned by it is not actually valid, in a special way. Namely, make the core completely ignore the invalid temperature value coming from .get_temp() in that case, which requires folding in update_temperature() into its caller and a few related changes. On the iwlwifi side, modify iwl_mvm_tzone_get_temp() to return 0 and put THERMAL_TEMP_INVALID into the temperature return memory location instead of returning an error when the firmware is not running or it is not of the right type. Also, to clearly separate the handling of invalid temperature values from the thermal zone initialization, introduce a special THERMAL_TEMP_INIT value specifically for the latter purpose. Fixes: a8a261774466 ("thermal: core: Call monitor_thermal_zone() if zone temperature is invalid") Closes: https://lore.kernel.org/linux-pm/20240715044527.GA1544@sol.localdomain/ Reported-by: Eric Biggers Reported-by: Stefan Lippers-Hollmann Link: https://bugzilla.kernel.org/show_bug.cgi?id=201761 Tested-by: Oleksandr Natalenko Tested-by: Stefan Lippers-Hollmann Cc: 6.10+ # 6.10+ Signed-off-by: Rafael J. Wysocki Link: https://patch.msgid.link/4950004.31r3eYUQgx@rjwysocki.net [ rjw: Rebased on top of the current mainline ] Signed-off-by: Rafael J. Wysocki drivers/net/wireless/intel/iwlwifi/mvm/tt.c | 10 ++++-- drivers/thermal/thermal_core.c | 51 ++++++++++++++--------------- drivers/thermal/thermal_core.h | 3 ++ drivers/thermal/thermal_helpers.c | 2 ++ 4 files changed, 37 insertions(+), 29 deletions(-) commit a1b7dbca149053e4f79a451bebdf0c40c9092896 Merge: 269521e25069 cbd070a4ae62 Author: Paolo Abeni Date: Thu Jul 18 13:28:34 2024 +0200 Merge tag 'nf-24-07-17' of git://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf Pablo Neira Ayuso says: ==================== Netfilter/IPVS fixes for net The following patchset contains Netfilter/IPVS fixes for net: 1) Call nf_expect_get_id() to delete expectation by ID. By trial and error it is possible to leak the LSB of the expectation address on x86_64. This bug is a leftover when converting the existing code to use nf_expect_get_id(). 2) Incorrect initialization in pipapo set backend leads to packet mismatches. From Florian Westphal. 3) Extend netfilter's selftests to cover for the pipapo set backend, also from Florian. 4) Fix sparse warning in IPVS when adding service, from Chen Hanxiao. netfilter pull request 24-07-17 * tag 'nf-24-07-17' of git://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf: ipvs: properly dereference pe in ip_vs_add_service selftests: netfilter: add test case for recent mismatch bug netfilter: nf_set_pipapo: fix initial map fill netfilter: ctnetlink: use helper function to calculate expect ID ==================== Link: https://patch.msgid.link/20240717215214.225394-1-pablo@netfilter.org Signed-off-by: Paolo Abeni commit 269521e250699b312876d85e6ab2279c6d16e91d Merge: 4e076ff6ad53 c5118072e228 Author: Paolo Abeni Date: Thu Jul 18 13:09:13 2024 +0200 Merge branch 'net-dsa-fix-chip-wide-frame-size-config-in-some-drivers' Martin Willi says: ==================== net: dsa: Fix chip-wide frame size config in some drivers Some DSA chips support a chip-wide frame size configurations, only. Some drivers adjust that chip-wide setting for user port changes, overriding the frame size requirements on the CPU port that includes tagger overhead. Fix the mv88e6xxx and b53 drivers and align them to the behavior of other drivers. v2: - Skip chip-wide config for non-CPU ports instead of finding the maximim MTU over all ports - Add a patch fixing the b53 driver as well v1: https://lore.kernel.org/netdev/20240716120808.396514-1-martin@strongswan.org/ ==================== Link: https://patch.msgid.link/20240717090820.894234-1-martin@strongswan.org Signed-off-by: Paolo Abeni commit c5118072e228e7e4385fc5ac46b2e31cf6c4f2d3 Author: Martin Willi Date: Wed Jul 17 11:08:20 2024 +0200 net: dsa: b53: Limit chip-wide jumbo frame config to CPU ports Broadcom switches supported by the b53 driver use a chip-wide jumbo frame configuration. In the commit referenced with the Fixes tag, the setting is applied just for the last port changing its MTU. While configuring CPU ports accounts for tagger overhead, user ports do not. When setting the MTU for a user port, the chip-wide setting is reduced to not include the tagger overhead, resulting in an potentially insufficient chip-wide maximum frame size for the CPU port. As, by design, the CPU port MTU is adjusted for any user port change, apply the chip-wide setting only for CPU ports. This aligns the driver to the behavior of other switch drivers. Fixes: 6ae5834b983a ("net: dsa: b53: add MTU configuration support") Suggested-by: Vladimir Oltean Signed-off-by: Martin Willi Reviewed-by: Vladimir Oltean Signed-off-by: Paolo Abeni drivers/net/dsa/b53/b53_common.c | 3 +++ 1 file changed, 3 insertions(+) commit 66b6095c264e1b4e0a441c6329861806504e06c6 Author: Martin Willi Date: Wed Jul 17 11:08:19 2024 +0200 net: dsa: mv88e6xxx: Limit chip-wide frame size config to CPU ports Marvell chips not supporting per-port jumbo frame size configurations use a chip-wide frame size configuration. In the commit referenced with the Fixes tag, the setting is applied just for the last port changing its MTU. While configuring CPU ports accounts for tagger overhead, user ports do not. When setting the MTU for a user port, the chip-wide setting is reduced to not include the tagger overhead, resulting in an potentially insufficient maximum frame size for the CPU port. Specifically, sending full-size frames from the CPU port on a MV88E6097 having a user port MTU of 1500 bytes results in dropped frames. As, by design, the CPU port MTU is adjusted for any user port change, apply the chip-wide setting only for CPU ports. Fixes: 1baf0fac10fb ("net: dsa: mv88e6xxx: Use chip-wide max frame size for MTU") Suggested-by: Vladimir Oltean Signed-off-by: Martin Willi Reviewed-by: Vladimir Oltean Signed-off-by: Paolo Abeni drivers/net/dsa/mv88e6xxx/chip.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) commit 4e076ff6ad5302c015617da30d877b4cdcbdf613 Author: Lorenzo Bianconi Date: Wed Jul 17 10:47:19 2024 +0200 net: airoha: Fix NULL pointer dereference in airoha_qdma_cleanup_rx_queue() Move page_pool_get_dma_dir() inside the while loop of airoha_qdma_cleanup_rx_queue routine in order to avoid possible NULL pointer dereference if airoha_qdma_init_rx_queue() fails before properly allocating the page_pool pointer. Fixes: 23020f049327 ("net: airoha: Introduce ethernet support for EN7581 SoC") Signed-off-by: Lorenzo Bianconi Reviewed-by: Simon Horman Link: https://patch.msgid.link/7330a41bba720c33abc039955f6172457a3a34f0.1721205981.git.lorenzo@kernel.org Signed-off-by: Paolo Abeni drivers/net/ethernet/mediatek/airoha_eth.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) commit fc28d1c1fe3b3e2fbc50834c8f73dda72f6af9fc Author: Conor Dooley Date: Wed Jul 17 10:59:49 2024 +0100 spi: spidev: add correct compatible for Rohm BH2228FV When Maxime originally added the BH2228FV to the spidev driver, he spelt it incorrectly - the d should have been a b. Add the correctly spelt compatible to the driver. Although the majority of users of this compatible are abusers, there is at least one board that validly uses the incorrect spelt compatible, so keep it in the driver to avoid breaking the few real users it has. Fixes: 8fad805bdc52 ("spi: spidev: Add Rohm DH2228FV DAC compatible string") Signed-off-by: Conor Dooley Acked-by: Maxime Ripard Link: https://patch.msgid.link/20240717-ventricle-strewn-a7678c509e85@spud Signed-off-by: Mark Brown drivers/spi/spidev.c | 1 + 1 file changed, 1 insertion(+) commit 5170dae5591036dba7daa519ea3126169300e275 Author: Conor Dooley Date: Wed Jul 17 10:59:48 2024 +0100 dt-bindings: trivial-devices: fix Rohm BH2228FV compatible string When Maxime originally added the BH2228FV to the spidev driver, he spelt it incorrectly - the d should have been a b. That spelling was then propagated to the binding when written by Krzysztof. Add a new, correctly spelt compatible and advise against using the incorrectly spelling. Fixes: 025aea27732d ("dt-bindings: trivial-devices: document SPI dev compatibles") Signed-off-by: Conor Dooley Acked-by: Maxime Ripard Link: https://patch.msgid.link/20240717-exuberant-enlighten-f890fabcd247@spud Signed-off-by: Mark Brown Documentation/devicetree/bindings/trivial-devices.yaml | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) commit f2038c12e8133bf4c6bd4d1127a23310d55d9e21 Author: Venkata Prasad Potturu Date: Thu Jul 18 11:50:02 2024 +0530 ASoC: sof: amd: fix for firmware reload failure in Vangogh platform Setting ACP ACLK as clock source when ACP enters D0 state causing firmware load failure, as per design clock source should be internal clock. Remove acp_clkmux_sel field so that ACP will use internal clock source when ACP enters into D0 state. Fixes: d0dab6b76a9f ("ASoC: SOF: amd: Add sof support for vangogh platform") Signed-off-by: Venkata Prasad Potturu Link: https://patch.msgid.link/20240718062004.581685-1-venkataprasad.potturu@amd.com Signed-off-by: Mark Brown sound/soc/sof/amd/pci-vangogh.c | 1 - 1 file changed, 1 deletion(-) commit a1a305375dc356865b22a43cbe09869bf8fae9ca Author: Jack Wu Date: Tue Jul 16 10:49:02 2024 +0800 net: wwan: t7xx: add support for Dell DW5933e add support for Dell DW5933e (0x14c0, 0x4d75) Signed-off-by: Jack Wu Link: https://patch.msgid.link/20240716024902.16054-1-wojackbb@gmail.com Signed-off-by: Paolo Abeni drivers/net/wwan/t7xx/t7xx_pci.c | 1 + 1 file changed, 1 insertion(+) commit ab1a2a52885a922687822f6615078d2de25dfe38 Merge: 120f1c857a73 f036e68212c1 Author: Paolo Abeni Date: Thu Jul 18 11:11:05 2024 +0200 Merge branch 'ipv4-fix-incorrect-tos-in-route-get-reply' Ido Schimmel says: ==================== ipv4: Fix incorrect TOS in route get reply Two small fixes for incorrect TOS in route get reply. See more details in the commit messages. No regressions in FIB tests: # ./fib_tests.sh [...] Tests passed: 218 Tests failed: 0 ==================== Link: https://patch.msgid.link/20240715142354.3697987-1-idosch@nvidia.com Signed-off-by: Paolo Abeni commit f036e68212c11e5a7edbb59b5e25299341829485 Author: Ido Schimmel Date: Mon Jul 15 17:23:54 2024 +0300 ipv4: Fix incorrect TOS in fibmatch route get reply The TOS value that is returned to user space in the route get reply is the one with which the lookup was performed ('fl4->flowi4_tos'). This is fine when the matched route is configured with a TOS as it would not match if its TOS value did not match the one with which the lookup was performed. However, matching on TOS is only performed when the route's TOS is not zero. It is therefore possible to have the kernel incorrectly return a non-zero TOS: # ip link add name dummy1 up type dummy # ip address add 192.0.2.1/24 dev dummy1 # ip route get fibmatch 192.0.2.2 tos 0xfc 192.0.2.0/24 tos 0x1c dev dummy1 proto kernel scope link src 192.0.2.1 Fix by instead returning the DSCP field from the FIB result structure which was populated during the route lookup. Output after the patch: # ip link add name dummy1 up type dummy # ip address add 192.0.2.1/24 dev dummy1 # ip route get fibmatch 192.0.2.2 tos 0xfc 192.0.2.0/24 dev dummy1 proto kernel scope link src 192.0.2.1 Extend the existing selftests to not only verify that the correct route is returned, but that it is also returned with correct "tos" value (or without it). Fixes: b61798130f1b ("net: ipv4: RTM_GETROUTE: return matched fib result when requested") Signed-off-by: Ido Schimmel Reviewed-by: David Ahern Reviewed-by: Guillaume Nault Signed-off-by: Paolo Abeni net/ipv4/route.c | 2 +- tools/testing/selftests/net/fib_tests.sh | 24 ++++++++++++------------ 2 files changed, 13 insertions(+), 13 deletions(-) commit 338bb57e4c2a1c2c6fc92f9c0bd35be7587adca7 Author: Ido Schimmel Date: Mon Jul 15 17:23:53 2024 +0300 ipv4: Fix incorrect TOS in route get reply The TOS value that is returned to user space in the route get reply is the one with which the lookup was performed ('fl4->flowi4_tos'). This is fine when the matched route is configured with a TOS as it would not match if its TOS value did not match the one with which the lookup was performed. However, matching on TOS is only performed when the route's TOS is not zero. It is therefore possible to have the kernel incorrectly return a non-zero TOS: # ip link add name dummy1 up type dummy # ip address add 192.0.2.1/24 dev dummy1 # ip route get 192.0.2.2 tos 0xfc 192.0.2.2 tos 0x1c dev dummy1 src 192.0.2.1 uid 0 cache Fix by adding a DSCP field to the FIB result structure (inside an existing 4 bytes hole), populating it in the route lookup and using it when filling the route get reply. Output after the patch: # ip link add name dummy1 up type dummy # ip address add 192.0.2.1/24 dev dummy1 # ip route get 192.0.2.2 tos 0xfc 192.0.2.2 dev dummy1 src 192.0.2.1 uid 0 cache Fixes: 1a00fee4ffb2 ("ipv4: Remove rt_key_{src,dst,tos} from struct rtable.") Signed-off-by: Ido Schimmel Reviewed-by: David Ahern Reviewed-by: Guillaume Nault Signed-off-by: Paolo Abeni include/net/ip_fib.h | 1 + net/ipv4/fib_trie.c | 1 + net/ipv4/route.c | 14 +++++++------- 3 files changed, 9 insertions(+), 7 deletions(-) commit 120f1c857a73e52132e473dee89b340440cb692b Author: Pablo Neira Ayuso Date: Mon Jul 15 16:14:42 2024 +0200 net: flow_dissector: use DEBUG_NET_WARN_ON_ONCE The following splat is easy to reproduce upstream as well as in -stable kernels. Florian Westphal provided the following commit: d1dab4f71d37 ("net: add and use __skb_get_hash_symmetric_net") but this complementary fix has been also suggested by Willem de Bruijn and it can be easily backported to -stable kernel which consists in using DEBUG_NET_WARN_ON_ONCE instead to silence the following splat given __skb_get_hash() is used by the nftables tracing infrastructure to to identify packets in traces. [69133.561393] ------------[ cut here ]------------ [69133.561404] WARNING: CPU: 0 PID: 43576 at net/core/flow_dissector.c:1104 __skb_flow_dissect+0x134f/ [...] [69133.561944] CPU: 0 PID: 43576 Comm: socat Not tainted 6.10.0-rc7+ #379 [69133.561959] RIP: 0010:__skb_flow_dissect+0x134f/0x2ad0 [69133.561970] Code: 83 f9 04 0f 84 b3 00 00 00 45 85 c9 0f 84 aa 00 00 00 41 83 f9 02 0f 84 81 fc ff ff 44 0f b7 b4 24 80 00 00 00 e9 8b f9 ff ff <0f> 0b e9 20 f3 ff ff 41 f6 c6 20 0f 84 e4 ef ff ff 48 8d 7b 12 e8 [69133.561979] RSP: 0018:ffffc90000006fc0 EFLAGS: 00010246 [69133.561988] RAX: 0000000000000000 RBX: ffffffff82f33e20 RCX: ffffffff81ab7e19 [69133.561994] RDX: dffffc0000000000 RSI: ffffc90000007388 RDI: ffff888103a1b418 [69133.562001] RBP: ffffc90000007310 R08: 0000000000000000 R09: 0000000000000000 [69133.562007] R10: ffffc90000007388 R11: ffffffff810cface R12: ffff888103a1b400 [69133.562013] R13: 0000000000000000 R14: ffffffff82f33e2a R15: ffffffff82f33e28 [69133.562020] FS: 00007f40f7131740(0000) GS:ffff888390800000(0000) knlGS:0000000000000000 [69133.562027] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [69133.562033] CR2: 00007f40f7346ee0 CR3: 000000015d200001 CR4: 00000000001706f0 [69133.562040] Call Trace: [69133.562044] [69133.562049] ? __warn+0x9f/0x1a0 [ 1211.841384] ? __skb_flow_dissect+0x107e/0x2860 [...] [ 1211.841496] ? bpf_flow_dissect+0x160/0x160 [ 1211.841753] __skb_get_hash+0x97/0x280 [ 1211.841765] ? __skb_get_hash_symmetric+0x230/0x230 [ 1211.841776] ? mod_find+0xbf/0xe0 [ 1211.841786] ? get_stack_info_noinstr+0x12/0xe0 [ 1211.841798] ? bpf_ksym_find+0x56/0xe0 [ 1211.841807] ? __rcu_read_unlock+0x2a/0x70 [ 1211.841819] nft_trace_init+0x1b9/0x1c0 [nf_tables] [ 1211.841895] ? nft_trace_notify+0x830/0x830 [nf_tables] [ 1211.841964] ? get_stack_info+0x2b/0x80 [ 1211.841975] ? nft_do_chain_arp+0x80/0x80 [nf_tables] [ 1211.842044] nft_do_chain+0x79c/0x850 [nf_tables] Fixes: 9b52e3f267a6 ("flow_dissector: handle no-skb use case") Suggested-by: Willem de Bruijn Signed-off-by: Pablo Neira Ayuso Reviewed-by: Willem de Bruijn Link: https://patch.msgid.link/20240715141442.43775-1-pablo@netfilter.org Signed-off-by: Paolo Abeni net/core/flow_dissector.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 280e36f0d5b997173d014c07484c03a7f7750668 Author: Christian Brauner Date: Tue Jul 16 09:19:11 2024 +0200 nsfs: use cleanup guard Ensure that rcu read lock is given up before returning. Link: https://lore.kernel.org/r/20240716-elixier-fliesen-1ab342151a61@brauner Fixes: ca567df74a28 ("nsfs: add pid translation ioctls") Reported-by: syzbot+a3e82ae343b26b4d2335@syzkaller.appspotmail.com Signed-off-by: Christian Brauner fs/nsfs.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) commit 400e4064b63a4c302dff11136828f54de91eda2a Author: Jeff Johnson Date: Thu May 23 06:58:01 2024 -0700 fs/adfs: add MODULE_DESCRIPTION Fix the 'make W=1' issue: WARNING: modpost: missing MODULE_DESCRIPTION() in fs/adfs/adfs.o Signed-off-by: Jeff Johnson Link: https://lore.kernel.org/r/20240523-md-adfs-v1-1-364268e38370@quicinc.com Signed-off-by: Christian Brauner fs/adfs/super.c | 1 + 1 file changed, 1 insertion(+) commit 5418e6dfc905b3ccc1e01bdad97d948697b20100 Author: Vamsi Attunuru Date: Wed Jul 17 09:37:39 2024 -0700 misc: Kconfig: exclude mrvl-cn10k-dpi compilation for 32-bit systems Upon adding CONFIG_ARCH_THUNDER & CONFIG_COMPILE_TEST dependency, compilation errors arise on 32-bit ARM with writeq() & readq() calls which are used for accessing 64-bit values. Since DPI hardware only works with 64-bit register accesses, using CONFIG_64BIT dependency to skip compilation on 32-bit systems. Fixes: a5e43e2d202d ("misc: Kconfig: add a new dependency for MARVELL_CN10K_DPI") Signed-off-by: Vamsi Attunuru Tested-by: Nathan Chancellor Tested-by: Jeff Johnson Acked-by: Arnd Bergmann Link: https://lore.kernel.org/r/20240717163739.181236-1-vattunuru@marvell.com Signed-off-by: Greg Kroah-Hartman drivers/misc/Kconfig | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit f4b89d8ce5a835afa51404977ee7e3889c2b9722 Author: Günther Noack Date: Mon Jul 15 16:03:29 2024 +0000 landlock: Various documentation improvements * Fix some typos, incomplete or confusing phrases. * Split paragraphs where appropriate. * List the same error code multiple times, if it has multiple possible causes. * Bring wording closer to the man page wording, which has undergone more thorough review (esp. for LANDLOCK_ACCESS_FS_WRITE_FILE). * Small semantic clarifications * Call the ephemeral port range "ephemeral" * Clarify reasons for EFAULT in landlock_add_rule() * Clarify @rule_type doc for landlock_add_rule() This is a collection of small fixes which I collected when preparing the corresponding man pages [1]. Cc: Alejandro Colomar Cc: Konstantin Meskhidze Link: https://lore.kernel.org/r/20240715155554.2791018-1-gnoack@google.com [1] Signed-off-by: Günther Noack Link: https://lore.kernel.org/r/20240715160328.2792835-2-gnoack@google.com [mic: Add label to link, fix formatting spotted by make htmldocs, synchronize userspace-api documentation's date] Signed-off-by: Mickaël Salaün Documentation/userspace-api/landlock.rst | 2 +- include/uapi/linux/landlock.h | 27 ++++++++++++++------------- security/landlock/syscalls.c | 17 +++++++++-------- 3 files changed, 24 insertions(+), 22 deletions(-) commit 9c2913b962daf3e5a947babf93f2125765eeca09 Author: Tatsunosuke Tobita Date: Tue Jul 9 14:57:29 2024 +0900 HID: wacom: more appropriate tool type categorization Recent eraser and pen tools are able to be distinguished by looking at its least significant nibble. This modification applies it to wacom_intuos_get_tool_type function and reduces its code lines. Signed-off-by: Tatsunosuke Tobita Signed-off-by: Tatsunosuke Tobita Reviewed-by: Ping Cheng Link: https://patch.msgid.link/20240709055729.17158-2-tatsunosuke.wacom@gmail.com Signed-off-by: Benjamin Tissoires drivers/hid/wacom_wac.c | 66 ++++++++----------------------------------------- 1 file changed, 10 insertions(+), 56 deletions(-) commit f0d17d696dfce77c9abc830e4ac2d677890a2dad Author: Tatsunosuke Tobita Date: Tue Jul 9 14:57:28 2024 +0900 HID: wacom: Modify pen IDs The pen ID, 0x80842, was not the correct ID for wacom driver to treat. The ID was corrected to 0x8842. Also, 0x4200 was not the expected ID used on any Wacom device. Therefore, 0x4200 was removed. Signed-off-by: Tatsunosuke Tobita Signed-off-by: Tatsunosuke Tobita Fixes: bfdc750c4cb2 ("HID: wacom: add three styli to wacom_intuos_get_tool_type") Cc: stable@kernel.org #6.2 Reviewed-by: Ping Cheng Link: https://patch.msgid.link/20240709055729.17158-1-tatsunosuke.wacom@gmail.com Signed-off-by: Benjamin Tissoires drivers/hid/wacom_wac.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) commit c14112a5574ff5cf3de198ab6eeff53ac1234068 Author: Shay Drory Date: Wed Jul 17 10:29:16 2024 -0700 driver core: auxiliary bus: Fix documentation of auxiliary_device Fix the documentation of the below field of struct auxiliary_device include/linux/auxiliary_bus.h:150: warning: Function parameter or struct member 'sysfs' not described in 'auxiliary_device' include/linux/auxiliary_bus.h:150: warning: Excess struct member 'irqs' description in 'auxiliary_device' include/linux/auxiliary_bus.h:150: warning: Excess struct member 'lock' description in 'auxiliary_device' include/linux/auxiliary_bus.h:150: warning: Excess struct member 'irq_dir_exists' description in 'auxiliary_device' Fixes: a808878308a8 ("driver core: auxiliary bus: show auxiliary device IRQs") Reported-by: Stephen Rothwell Signed-off-by: Shay Drory Signed-off-by: Saeed Mahameed Link: https://patch.msgid.link/20240717172916.595808-1-saeed@kernel.org Signed-off-by: Jakub Kicinski include/linux/auxiliary_bus.h | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) commit 1f038d5897fe6b439039fc28420842abcc0d126b Author: Lorenzo Bianconi Date: Wed Jul 17 10:15:46 2024 +0200 net: airoha: fix error branch in airoha_dev_xmit and airoha_set_gdm_ports Fix error case management in airoha_dev_xmit routine since we need to DMA unmap pending buffers starting from q->head. Moreover fix a typo in error case branch in airoha_set_gdm_ports routine. Fixes: 23020f049327 ("net: airoha: Introduce ethernet support for EN7581 SoC") Signed-off-by: Lorenzo Bianconi Reviewed-by: Simon Horman Link: https://patch.msgid.link/b628871bc8ae4861b5e2ab4db90aaf373cbb7cee.1721203880.git.lorenzo@kernel.org Signed-off-by: Jakub Kicinski drivers/net/ethernet/mediatek/airoha_eth.c | 10 ++++++---- 1 file changed, 6 insertions(+), 4 deletions(-) commit 03b54bad26f3c78bb1f90410ec3e4e7fe197adc9 Author: Joshua Washington Date: Tue Jul 16 10:10:41 2024 -0700 gve: Fix XDP TX completion handling when counters overflow In gve_clean_xdp_done, the driver processes the TX completions based on a 32-bit NIC counter and a 32-bit completion counter stored in the tx queue. Fix the for loop so that the counter wraparound is handled correctly. Fixes: 75eaae158b1b ("gve: Add XDP DROP and TX support for GQI-QPL format") Signed-off-by: Joshua Washington Signed-off-by: Praveen Kaligineedi Reviewed-by: Simon Horman Link: https://patch.msgid.link/20240716171041.1561142-1-pkaligineedi@google.com Signed-off-by: Jakub Kicinski drivers/net/ethernet/google/gve/gve_tx.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) commit 9ff0251b2eb54d17fbe4f6aff50f6edfd837adb6 Merge: 90e812ac40c4 ca8dad041516 Author: Michael Ellerman Date: Thu Jul 18 14:32:46 2024 +1000 Merge branch 'topic/ppc-kvm' into next Merge the powerpc KVM topic branch. commit 67856f44da381973caf4eb692ad2cca1de7b2d37 Author: Alexey Dobriyan Date: Mon Jul 15 08:25:33 2024 +0300 ia64: scrub ia64 from poison.h Link: https://lkml.kernel.org/r/c72e5467-06a8-4739-ae6a-7c84c96cad77@p183 Signed-off-by: Alexey Dobriyan Signed-off-by: Andrew Morton include/linux/poison.h | 6 ------ 1 file changed, 6 deletions(-) commit f944ffcbc2e1c759764850261670586ddf3bdabb Author: Thomas Gleixner Date: Thu Jul 11 22:25:21 2024 +0200 watchdog/perf: properly initialize the turbo mode timestamp and rearm counter For systems on which the performance counter can expire early due to turbo modes the watchdog handler has a safety net in place which validates that since the last watchdog event there has at least 4/5th of the watchdog period elapsed. This works reliably only after the first watchdog event because the per CPU variable which holds the timestamp of the last event is never initialized. So a first spurious event will validate against a timestamp of 0 which results in a delta which is likely to be way over the 4/5 threshold of the period. As this might happen before the first watchdog hrtimer event increments the watchdog counter, this can lead to false positives. Fix this by initializing the timestamp before enabling the hardware event. Reset the rearm counter as well, as that might be non zero after the watchdog was disabled and reenabled. Link: https://lkml.kernel.org/r/87frsfu15a.ffs@tglx Fixes: 7edaeb6841df ("kernel/watchdog: Prevent false positives with turbo modes") Signed-off-by: Thomas Gleixner Cc: Arjan van de Ven Cc: Peter Zijlstra Cc: Signed-off-by: Andrew Morton kernel/watchdog_perf.c | 11 ++++++++--- 1 file changed, 8 insertions(+), 3 deletions(-) commit 30d77b7eef019fa4422980806e8b7cdc8674493e Author: Yu Zhao Date: Fri Jul 12 17:29:56 2024 -0600 mm/mglru: fix ineffective protection calculation mem_cgroup_calculate_protection() is not stateless and should only be used as part of a top-down tree traversal. shrink_one() traverses the per-node memcg LRU instead of the root_mem_cgroup tree, and therefore it should not call mem_cgroup_calculate_protection(). The existing misuse in shrink_one() can cause ineffective protection of sub-trees that are grandchildren of root_mem_cgroup. Fix it by reusing lru_gen_age_node(), which already traverses the root_mem_cgroup tree, to calculate the protection. Previously lru_gen_age_node() opportunistically skips the first pass, i.e., when scan_control->priority is DEF_PRIORITY. On the second pass, lruvec_is_sizable() uses appropriate scan_control->priority, set by set_initial_priority() from lru_gen_shrink_node(), to decide whether a memcg is too small to reclaim from. Now lru_gen_age_node() unconditionally traverses the root_mem_cgroup tree. So it should call set_initial_priority() upfront, to make sure lruvec_is_sizable() uses appropriate scan_control->priority on the first pass. Otherwise, lruvec_is_reclaimable() can return false negatives and result in premature OOM kills when min_ttl_ms is used. Link: https://lkml.kernel.org/r/20240712232956.1427127-1-yuzhao@google.com Fixes: e4dde56cd208 ("mm: multi-gen LRU: per-node lru_gen_folio lists") Signed-off-by: Yu Zhao Reported-by: T.J. Mercier Cc: Signed-off-by: Andrew Morton mm/vmscan.c | 82 ++++++++++++++++++++++++++++--------------------------------- 1 file changed, 38 insertions(+), 44 deletions(-) commit b749cb0d61ca1ed120a555badf3a7b025b8a7fc2 Author: Dan Carpenter Date: Mon Jul 15 15:23:05 2024 -0500 mm/zswap: fix a white space issue We accidentally deleted a tab in commit f84152e9efc5 ("mm/zswap: use only one pool in zswap"). Add it back. Link: https://lkml.kernel.org/r/c15066a0-f061-42c9-b0f5-d60281d3d5d8@stanley.mountain Signed-off-by: Dan Carpenter Reviewed-by: Chengming Zhou Signed-off-by: Andrew Morton mm/zswap.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 1390a3334a48ecac5175865fd433d55eec255db8 Author: Miaohe Lin Date: Tue Jul 9 20:04:33 2024 +0800 mm/hugetlb: fix kernel NULL pointer dereference when migrating hugetlb folio A kernel crash was observed when migrating hugetlb folio: BUG: kernel NULL pointer dereference, address: 0000000000000008 PGD 0 P4D 0 Oops: Oops: 0002 [#1] PREEMPT SMP NOPTI CPU: 0 PID: 3435 Comm: bash Not tainted 6.10.0-rc6-00450-g8578ca01f21f #66 RIP: 0010:__folio_undo_large_rmappable+0x70/0xb0 RSP: 0018:ffffb165c98a7b38 EFLAGS: 00000097 RAX: fffffbbc44528090 RBX: 0000000000000000 RCX: 0000000000000000 RDX: ffffa30e000a2800 RSI: 0000000000000246 RDI: ffffa3153ffffcc0 RBP: fffffbbc44528000 R08: 0000000000002371 R09: ffffffffbe4e5868 R10: 0000000000000001 R11: 0000000000000001 R12: ffffa3153ffffcc0 R13: fffffbbc44468000 R14: 0000000000000001 R15: 0000000000000001 FS: 00007f5b3a716740(0000) GS:ffffa3151fc00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000000000000008 CR3: 000000010959a000 CR4: 00000000000006f0 Call Trace: __folio_migrate_mapping+0x59e/0x950 __migrate_folio.constprop.0+0x5f/0x120 move_to_new_folio+0xfd/0x250 migrate_pages+0x383/0xd70 soft_offline_page+0x2ab/0x7f0 soft_offline_page_store+0x52/0x90 kernfs_fop_write_iter+0x12c/0x1d0 vfs_write+0x380/0x540 ksys_write+0x64/0xe0 do_syscall_64+0xb9/0x1d0 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7f5b3a514887 RSP: 002b:00007ffe138fce68 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 RAX: ffffffffffffffda RBX: 000000000000000c RCX: 00007f5b3a514887 RDX: 000000000000000c RSI: 0000556ab809ee10 RDI: 0000000000000001 RBP: 0000556ab809ee10 R08: 00007f5b3a5d1460 R09: 000000007fffffff R10: 0000000000000000 R11: 0000000000000246 R12: 000000000000000c R13: 00007f5b3a61b780 R14: 00007f5b3a617600 R15: 00007f5b3a616a00 It's because hugetlb folio is passed to __folio_undo_large_rmappable() unexpectedly. large_rmappable flag is imperceptibly set to hugetlb folio since commit f6a8dd98a2ce ("hugetlb: convert alloc_buddy_hugetlb_folio to use a folio"). Then commit be9581ea8c05 ("mm: fix crashes from deferred split racing folio migration") makes folio_migrate_mapping() call folio_undo_large_rmappable() triggering the bug. Fix this issue by clearing large_rmappable flag for hugetlb folios. They don't need that flag set anyway. Link: https://lkml.kernel.org/r/20240709120433.4136700-1-linmiaohe@huawei.com Fixes: f6a8dd98a2ce ("hugetlb: convert alloc_buddy_hugetlb_folio to use a folio") Fixes: be9581ea8c05 ("mm: fix crashes from deferred split racing folio migration") Signed-off-by: Miaohe Lin Cc: Hugh Dickins Cc: Matthew Wilcox (Oracle) Cc: Muchun Song Cc: Signed-off-by: Andrew Morton mm/hugetlb.c | 3 +++ 1 file changed, 3 insertions(+) commit 667574e873b5f77a220b2a93329689f36fb56d5d Author: Miaohe Lin Date: Fri Jul 12 11:13:14 2024 +0800 mm/hugetlb: fix possible recursive locking detected warning When tries to demote 1G hugetlb folios, a lockdep warning is observed: ============================================ WARNING: possible recursive locking detected 6.10.0-rc6-00452-ga4d0275fa660-dirty #79 Not tainted -------------------------------------------- bash/710 is trying to acquire lock: ffffffff8f0a7850 (&h->resize_lock){+.+.}-{3:3}, at: demote_store+0x244/0x460 but task is already holding lock: ffffffff8f0a6f48 (&h->resize_lock){+.+.}-{3:3}, at: demote_store+0xae/0x460 other info that might help us debug this: Possible unsafe locking scenario: CPU0 ---- lock(&h->resize_lock); lock(&h->resize_lock); *** DEADLOCK *** May be due to missing lock nesting notation 4 locks held by bash/710: #0: ffff8f118439c3f0 (sb_writers#5){.+.+}-{0:0}, at: ksys_write+0x64/0xe0 #1: ffff8f11893b9e88 (&of->mutex#2){+.+.}-{3:3}, at: kernfs_fop_write_iter+0xf8/0x1d0 #2: ffff8f1183dc4428 (kn->active#98){.+.+}-{0:0}, at: kernfs_fop_write_iter+0x100/0x1d0 #3: ffffffff8f0a6f48 (&h->resize_lock){+.+.}-{3:3}, at: demote_store+0xae/0x460 stack backtrace: CPU: 3 PID: 710 Comm: bash Not tainted 6.10.0-rc6-00452-ga4d0275fa660-dirty #79 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.14.0-0-g155821a1990b-prebuilt.qemu.org 04/01/2014 Call Trace: dump_stack_lvl+0x68/0xa0 __lock_acquire+0x10f2/0x1ca0 lock_acquire+0xbe/0x2d0 __mutex_lock+0x6d/0x400 demote_store+0x244/0x460 kernfs_fop_write_iter+0x12c/0x1d0 vfs_write+0x380/0x540 ksys_write+0x64/0xe0 do_syscall_64+0xb9/0x1d0 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7fa61db14887 RSP: 002b:00007ffc56c48358 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 RAX: ffffffffffffffda RBX: 0000000000000002 RCX: 00007fa61db14887 RDX: 0000000000000002 RSI: 000055a030050220 RDI: 0000000000000001 RBP: 000055a030050220 R08: 00007fa61dbd1460 R09: 000000007fffffff R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 R13: 00007fa61dc1b780 R14: 00007fa61dc17600 R15: 00007fa61dc16a00 Lockdep considers this an AA deadlock because the different resize_lock mutexes reside in the same lockdep class, but this is a false positive. Place them in distinct classes to avoid these warnings. Link: https://lkml.kernel.org/r/20240712031314.2570452-1-linmiaohe@huawei.com Fixes: 8531fc6f52f5 ("hugetlb: add hugetlb demote page support") Signed-off-by: Miaohe Lin Acked-by: Muchun Song Cc: Signed-off-by: Andrew Morton include/linux/hugetlb.h | 1 + mm/hugetlb.c | 2 +- 2 files changed, 2 insertions(+), 1 deletion(-) commit 33dfe9204f29b415bbc0abb1a50642d1ba94f5e9 Author: yangge Date: Wed Jul 3 20:02:33 2024 +0800 mm/gup: clear the LRU flag of a page before adding to LRU batch If a large number of CMA memory are configured in system (for example, the CMA memory accounts for 50% of the system memory), starting a virtual virtual machine with device passthrough, it will call pin_user_pages_remote(..., FOLL_LONGTERM, ...) to pin memory. Normally if a page is present and in CMA area, pin_user_pages_remote() will migrate the page from CMA area to non-CMA area because of FOLL_LONGTERM flag. But the current code will cause the migration failure due to unexpected page refcounts, and eventually cause the virtual machine fail to start. If a page is added in LRU batch, its refcount increases one, remove the page from LRU batch decreases one. Page migration requires the page is not referenced by others except page mapping. Before migrating a page, we should try to drain the page from LRU batch in case the page is in it, however, folio_test_lru() is not sufficient to tell whether the page is in LRU batch or not, if the page is in LRU batch, the migration will fail. To solve the problem above, we modify the logic of adding to LRU batch. Before adding a page to LRU batch, we clear the LRU flag of the page so that we can check whether the page is in LRU batch by folio_test_lru(page). It's quite valuable, because likely we don't want to blindly drain the LRU batch simply because there is some unexpected reference on a page, as described above. This change makes the LRU flag of a page invisible for longer, which may impact some programs. For example, as long as a page is on a LRU batch, we cannot isolate it, and we cannot check if it's an LRU page. Further, a page can now only be on exactly one LRU batch. This doesn't seem to matter much, because a new page is allocated from buddy and added to the lru batch, or be isolated, it's LRU flag may also be invisible for a long time. Link: https://lkml.kernel.org/r/1720075944-27201-1-git-send-email-yangge1116@126.com Link: https://lkml.kernel.org/r/1720008153-16035-1-git-send-email-yangge1116@126.com Fixes: 9a4e9f3b2d73 ("mm: update get_user_pages_longterm to migrate pages allocated from CMA region") Signed-off-by: yangge Cc: Aneesh Kumar K.V Cc: Baolin Wang Cc: David Hildenbrand Cc: Barry Song <21cnbao@gmail.com> Cc: Hugh Dickins Signed-off-by: Andrew Morton mm/swap.c | 43 +++++++++++++++++++++++++++++++------------ 1 file changed, 31 insertions(+), 12 deletions(-) commit af649773fb25250cd22625af021fb6275c56a3ee Author: Tvrtko Ursulin Date: Mon Jul 8 08:56:32 2024 +0100 mm/numa_balancing: teach mpol_to_str about the balancing mode Since balancing mode was added in bda420b98505 ("numa balancing: migrate on fault among multiple bound nodes"), it was possible to set this mode but it wouldn't be shown in /proc//numa_maps since there was no support for it in the mpol_to_str() helper. Furthermore, because the balancing mode sets the MPOL_F_MORON flag, it would be displayed as 'default' due a workaround introduced a few years earlier in 8790c71a18e5 ("mm/mempolicy.c: fix mempolicy printing in numa_maps"). To tidy this up we implement two changes: Replace the MPOL_F_MORON check by pointer comparison against the preferred_node_policy array. By doing this we generalise the current special casing and replace the incorrect 'default' with the correct 'bind' for the mode. Secondly, we add a string representation and corresponding handling for the MPOL_F_NUMA_BALANCING flag. With the two changes together we start showing the balancing flag when it is set and therefore complete the fix. Representation format chosen is to separate multiple flags with vertical bars, following what existed long time ago in kernel 2.6.25. But as between then and now there wasn't a way to display multiple flags, this patch does not change the format in practice. Some /proc//numa_maps output examples: 555559580000 bind=balancing:0-1,3 file=... 555585800000 bind=balancing|static:0,2 file=... 555635240000 prefer=relative:0 file= Link: https://lkml.kernel.org/r/20240708075632.95857-1-tursulin@igalia.com Signed-off-by: Tvrtko Ursulin Fixes: bda420b98505 ("numa balancing: migrate on fault among multiple bound nodes") References: 8790c71a18e5 ("mm/mempolicy.c: fix mempolicy printing in numa_maps") Reviewed-by: "Huang, Ying" Cc: Mel Gorman Cc: Peter Zijlstra Cc: Ingo Molnar Cc: Rik van Riel Cc: Johannes Weiner Cc: "Matthew Wilcox (Oracle)" Cc: Dave Hansen Cc: Andi Kleen Cc: Michal Hocko Cc: David Rientjes Cc: [5.12+] Signed-off-by: Andrew Morton mm/mempolicy.c | 18 ++++++++++++++---- 1 file changed, 14 insertions(+), 4 deletions(-) commit 5316b497c51fee98b399c055a76f10088dcdce2b Author: Roman Gushchin Date: Fri Jul 12 18:35:14 2024 +0000 mm: memcg1: convert charge move flags to unsigned long long Currently MOVE_ANON and MOVE_FILE flags are defined as integers and it leads to the following Smatch static checker warning: mm/memcontrol-v1.c:609 mem_cgroup_move_charge_write() warn: was expecting a 64 bit value instead of '~(1 | 2)' Fix this be redefining them as unsigned long long. Even though the issue allows to set high 32 bits of mc.flags to an arbitrary number, these bits are never used, so it doesn't have any significant consequences. Link: https://lkml.kernel.org/r/ZpF8Q9zBsIY7d2P9@google.com Signed-off-by: Roman Gushchin Reported-by: Dan Carpenter Signed-off-by: Andrew Morton mm/memcontrol-v1.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) commit 6ab42fe21c84d72da752923b4bd7075344f4a362 Author: Suren Baghdasaryan Date: Thu Jul 11 15:04:57 2024 -0700 alloc_tag: fix page_ext_get/page_ext_put sequence during page splitting pgalloc_tag_sub() might call page_ext_put() using a page different from the one used in page_ext_get() call. This does not pose an issue since page_ext_put() ignores this parameter as long as it's non-NULL but technically this is wrong. Fix it by storing the original page used in page_ext_get() and passing it to page_ext_put(). Link: https://lkml.kernel.org/r/20240711220457.1751071-3-surenb@google.com Fixes: be25d1d4e822 ("mm: create new codetag references during page splitting") Signed-off-by: Suren Baghdasaryan Cc: Kees Cook Cc: Kent Overstreet Cc: Pasha Tatashin Cc: Sourav Panda Cc: Vlastimil Babka Signed-off-by: Andrew Morton include/linux/pgalloc_tag.h | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) commit fd8acc0097b91fab3104fa8a66ce2fd9cf8b0c11 Author: Suren Baghdasaryan Date: Thu Jul 11 15:04:56 2024 -0700 lib: reuse page_ext_data() to obtain codetag_ref codetag_ref_from_page_ext() reimplements the same calculation as page_ext_data(). Reuse existing function instead. Link: https://lkml.kernel.org/r/20240711220457.1751071-2-surenb@google.com Fixes: dcfe378c81f7 ("lib: introduce support for page allocation tagging") Signed-off-by: Suren Baghdasaryan Cc: Kees Cook Cc: Kent Overstreet Cc: Pasha Tatashin Cc: Sourav Panda Cc: Vlastimil Babka Signed-off-by: Andrew Morton include/linux/pgalloc_tag.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 4810a82c8a8ae06fe6496a23fcb89a4952603e60 Author: Suren Baghdasaryan Date: Thu Jul 11 15:04:55 2024 -0700 lib: add missing newline character in the warning message Link: https://lkml.kernel.org/r/20240711220457.1751071-1-surenb@google.com Fixes: 22d407b164ff ("lib: add allocation tagging support for memory allocation profiling") Signed-off-by: Suren Baghdasaryan Cc: Kees Cook Cc: Kent Overstreet Cc: Pasha Tatashin Cc: Sourav Panda Cc: Vlastimil Babka Signed-off-by: Andrew Morton include/linux/alloc_tag.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 3f74e6bd3b84a8b6bb3cc51609c89e5b9d58eed7 Author: Yu Zhao Date: Thu Jul 11 13:19:57 2024 -0600 mm/mglru: fix overshooting shrinker memory set_initial_priority() tries to jump-start global reclaim by estimating the priority based on cold/hot LRU pages. The estimation does not account for shrinker objects, and it cannot do so because their sizes can be in different units other than page. If shrinker objects are the majority, e.g., on TrueNAS SCALE 24.04.0 where ZFS ARC can use almost all system memory, set_initial_priority() can vastly underestimate how much memory ARC shrinker can evict and assign extreme low values to scan_control->priority, resulting in overshoots of shrinker objects. To reproduce the problem, using TrueNAS SCALE 24.04.0 with 32GB DRAM, a test ZFS pool and the following commands: fio --name=mglru.file --numjobs=36 --ioengine=io_uring \ --directory=/root/test-zfs-pool/ --size=1024m --buffered=1 \ --rw=randread --random_distribution=random \ --time_based --runtime=1h & for ((i = 0; i < 20; i++)) do sleep 120 fio --name=mglru.anon --numjobs=16 --ioengine=mmap \ --filename=/dev/zero --size=1024m --fadvise_hint=0 \ --rw=randrw --random_distribution=random \ --time_based --runtime=1m done To fix the problem: 1. Cap scan_control->priority at or above DEF_PRIORITY/2, to prevent the jump-start from being overly aggressive. 2. Account for the progress from mm_account_reclaimed_pages(), to prevent kswapd_shrink_node() from raising the priority unnecessarily. Link: https://lkml.kernel.org/r/20240711191957.939105-2-yuzhao@google.com Fixes: e4dde56cd208 ("mm: multi-gen LRU: per-node lru_gen_folio lists") Signed-off-by: Yu Zhao Reported-by: Alexander Motin Cc: Wei Xu Cc: Signed-off-by: Andrew Morton mm/vmscan.c | 10 ++++++++-- 1 file changed, 8 insertions(+), 2 deletions(-) commit 8b671fe1a879923ecfb72dda6caf01460dd885ef Author: Yu Zhao Date: Thu Jul 11 13:19:56 2024 -0600 mm/mglru: fix div-by-zero in vmpressure_calc_level() evict_folios() uses a second pass to reclaim folios that have gone through page writeback and become clean before it finishes the first pass, since folio_rotate_reclaimable() cannot handle those folios due to the isolation. The second pass tries to avoid potential double counting by deducting scan_control->nr_scanned. However, this can result in underflow of nr_scanned, under a condition where shrink_folio_list() does not increment nr_scanned, i.e., when folio_trylock() fails. The underflow can cause the divisor, i.e., scale=scanned+reclaimed in vmpressure_calc_level(), to become zero, resulting in the following crash: [exception RIP: vmpressure_work_fn+101] process_one_work at ffffffffa3313f2b Since scan_control->nr_scanned has no established semantics, the potential double counting has minimal risks. Therefore, fix the problem by not deducting scan_control->nr_scanned in evict_folios(). Link: https://lkml.kernel.org/r/20240711191957.939105-1-yuzhao@google.com Fixes: 359a5e1416ca ("mm: multi-gen LRU: retry folios written back while isolated") Reported-by: Wei Xu Signed-off-by: Yu Zhao Cc: Alexander Motin Cc: Signed-off-by: Andrew Morton mm/vmscan.c | 1 - 1 file changed, 1 deletion(-) commit 0b84780134fb02525ef29ddcb88c3d560ba88a9c Author: Kees Cook Date: Tue Jul 9 17:13:08 2024 -0700 mm/kmemleak: replace strncpy() with strscpy() Replace the depreciated[1] strncpy() calls with strscpy(). Uses of object->comm do not depend on the padding side-effect. Link: https://github.com/KSPP/linux/issues/90 [1] Link: https://lkml.kernel.org/r/20240710001300.work.004-kees@kernel.org Signed-off-by: Kees Cook Acked-by: Catalin Marinas Signed-off-by: Andrew Morton mm/kmemleak.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) commit 53dabce2652fb854eae84609ce9c37429d5d87ba Author: Vlastimil Babka Date: Thu Jul 11 18:35:31 2024 +0200 mm, page_alloc: put should_fail_alloc_page() back behing CONFIG_FAIL_PAGE_ALLOC This mostly reverts commit af3b854492f3 ("mm/page_alloc.c: allow error injection"). The commit made should_fail_alloc_page() a noinline function that's always called from the page allocation hotpath, even if it's empty because CONFIG_FAIL_PAGE_ALLOC is not enabled, and there is no option to disable it and prevent the associated function call overhead. As with the preceding patch "mm, slab: put should_failslab back behind CONFIG_SHOULD_FAILSLAB" and for the same reasons, put the should_fail_alloc_page() back behind the config option. When enabled, the ALLOW_ERROR_INJECTION and BTF_ID records are preserved so it's not a complete revert. Link: https://lkml.kernel.org/r/20240711-b4-fault-injection-reverts-v1-2-9e2651945d68@suse.cz Signed-off-by: Vlastimil Babka Cc: Akinobu Mita Cc: Alexei Starovoitov Cc: Andrii Nakryiko Cc: Christoph Lameter Cc: Daniel Borkmann Cc: David Rientjes Cc: Eduard Zingerman Cc: Hao Luo Cc: Hyeonggon Yoo <42.hyeyoo@gmail.com> Cc: Jiri Olsa Cc: John Fastabend Cc: KP Singh Cc: Martin KaFai Lau Cc: Mateusz Guzik Cc: Roman Gushchin Cc: Song Liu Cc: Stanislav Fomichev Cc: Yonghong Song Signed-off-by: Andrew Morton include/linux/fault-inject.h | 6 ++---- kernel/bpf/verifier.c | 2 ++ mm/fail_page_alloc.c | 4 +++- mm/page_alloc.c | 6 ------ 4 files changed, 7 insertions(+), 11 deletions(-) commit a7526fe8b94eced7d82aa00b2bcca44e39ae0769 Author: Vlastimil Babka Date: Thu Jul 11 18:35:30 2024 +0200 mm, slab: put should_failslab() back behind CONFIG_SHOULD_FAILSLAB Patch series "revert unconditional slab and page allocator fault injection calls". These two patches largely revert commits that added function call overhead into slab and page allocation hotpaths and that cannot be currently disabled even though related CONFIG_ options do exist. A much more involved solution that can keep the callsites always existing but hidden behind a static key if unused, is possible [1] and can be pursued by anyone who believes it's necessary. Meanwhile the fact the should_failslab() error injection is already not functional on kernels built with current gcc without anyone noticing [2], and lukewarm response to [1] suggests the need is not there. I believe it will be more fair to have the state after this series as a baseline for possible further optimisation, instead of the unconditional overhead. For example a possible compromise for anyone who's fine with an empty function call overhead but not the full CONFIG_FAILSLAB / CONFIG_FAIL_PAGE_ALLOC overhead is to reuse patch 1 from [1] but insert a static key check only inside should_failslab() and should_fail_alloc_page() before performing the more expensive checks. [1] https://lore.kernel.org/all/20240620-fault-injection-statickeys-v2-0-e23947d3d84b@suse.cz/#t [2] https://github.com/bpftrace/bpftrace/issues/3258 This patch (of 2): This mostly reverts commit 4f6923fbb352 ("mm: make should_failslab always available for fault injection"). The commit made should_failslab() a noinline function that's always called from the slab allocation hotpath, even if it's empty because CONFIG_SHOULD_FAILSLAB is not enabled, and there is no option to disable that call. This is visible in profiles and the function call overhead can be noticeable especially with cpu mitigations. Meanwhile the bpftrace program example in the commit silently does not work without CONFIG_SHOULD_FAILSLAB anyway with a recent gcc, because the empty function gets a .constprop clone that is actually being called (uselessly) from the slab hotpath, while the error injection is hooked to the original function that's not being called at all [1]. Thus put the whole should_failslab() function back behind CONFIG_SHOULD_FAILSLAB. It's not a complete revert of 4f6923fbb352 - the int return type that returns -ENOMEM on failure is preserved, as well ALLOW_ERROR_INJECTION annotation. The BTF_ID() record that was meanwhile added is also guarded by CONFIG_SHOULD_FAILSLAB. [1] https://github.com/bpftrace/bpftrace/issues/3258 Link: https://lkml.kernel.org/r/20240711-b4-fault-injection-reverts-v1-0-9e2651945d68@suse.cz Link: https://lkml.kernel.org/r/20240711-b4-fault-injection-reverts-v1-1-9e2651945d68@suse.cz Signed-off-by: Vlastimil Babka Cc: Akinobu Mita Cc: Alexei Starovoitov Cc: Andrii Nakryiko Cc: Christoph Lameter Cc: Daniel Borkmann Cc: David Rientjes Cc: Eduard Zingerman Cc: Hao Luo Cc: Hyeonggon Yoo <42.hyeyoo@gmail.com> Cc: Jiri Olsa Cc: John Fastabend Cc: KP Singh Cc: Martin KaFai Lau Cc: Mateusz Guzik Cc: Roman Gushchin Cc: Song Liu Cc: Stanislav Fomichev Cc: Yonghong Song Signed-off-by: Andrew Morton include/linux/fault-inject.h | 5 ++--- kernel/bpf/verifier.c | 2 ++ mm/failslab.c | 14 ++++++++------ mm/slub.c | 8 -------- 4 files changed, 12 insertions(+), 17 deletions(-) commit 7b7aca6d7c0f9b2d9400bfc57cb2b23cfbd5134d Author: Pei Li Date: Thu Jul 11 09:32:30 2024 -0700 mm: ignore data-race in __swap_writepage Syzbot reported a possible data race: BUG: KCSAN: data-race in __swap_writepage / scan_swap_map_slots read-write to 0xffff888102fca610 of 8 bytes by task 7106 on cpu 1. read to 0xffff888102fca610 of 8 bytes by task 7080 on cpu 0. While we are in __swap_writepage to read sis->flags, scan_swap_map_slots is trying to update it with SWP_SCANNING. value changed: 0x0000000000008083 -> 0x0000000000004083. While this can be updated non-atomicially, this won't affect SWP_SYNCHRONOUS_IO, so we consider this data-race safe. This is possibly introduced by commit 3222d8c2a7f8 ("block: remove ->rw_page"), where this if branch is introduced. Link: https://lkml.kernel.org/r/20240711-bug13-v1-1-cea2b8ae8d76@gmail.com Fixes: 3222d8c2a7f8 ("block: remove ->rw_page") Signed-off-by: Pei Li Reported-by: syzbot+da25887cc13da6bf3b8c@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=da25887cc13da6bf3b8c Cc: Dan Williams Cc: Shuah Khan Signed-off-by: Andrew Morton mm/page_io.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) commit dffe24e9587607c377d87d6c372653ae44b99ce7 Author: Donet Tom Date: Wed Jul 10 00:19:12 2024 -0500 hugetlbfs: ensure generic_hugetlb_get_unmapped_area() returns higher address than mmap_min_addr generic_hugetlb_get_unmapped_area() was returning an address less than mmap_min_addr if the mmap argument addr, after alignment, was less than mmap_min_addr, causing mmap to fail. This is because current generic_hugetlb_get_unmapped_area() code does not take into account mmap_min_addr. This patch ensures that generic_hugetlb_get_unmapped_area() always returns an address that is greater than mmap_min_addr. Additionally, similar to generic_get_unmapped_area(), vm_end_gap() checks are included to maintain stack gap. How to reproduce ================ #include #include #include #include #define HUGEPAGE_SIZE (16 * 1024 * 1024) int main() { void *addr = mmap((void *)-1, HUGEPAGE_SIZE, PROT_READ | PROT_WRITE, MAP_SHARED | MAP_ANONYMOUS | MAP_HUGETLB, -1, 0); if (addr == MAP_FAILED) { perror("mmap"); exit(EXIT_FAILURE); } snprintf((char *)addr, HUGEPAGE_SIZE, "Hello, Huge Pages!"); printf("%s\n", (char *)addr); if (munmap(addr, HUGEPAGE_SIZE) == -1) { perror("munmap"); exit(EXIT_FAILURE); } return 0; } Result without fix ================== # cat /proc/meminfo |grep -i HugePages_Free HugePages_Free: 20 # ./test mmap: Permission denied # Result with fix =============== # cat /proc/meminfo |grep -i HugePages_Free HugePages_Free: 20 # ./test Hello, Huge Pages! # Link: https://lkml.kernel.org/r/20240710051912.4681-1-donettom@linux.ibm.com Signed-off-by: Donet Tom Reported-by Pavithra Prakash Acked-by: Kirill A. Shutemov Cc: Alexei Starovoitov Cc: Andy Lutomirski Cc: Aneesh Kumar K.V Cc: David Hildenbrand Cc: Matthew Wilcox (Oracle) Cc: Mike Rapoport (IBM) Cc: Muchun Song Cc: Nicholas Piggin Cc: Ritesh Harjani (IBM) Cc: Tony Battersby Signed-off-by: Andrew Morton fs/hugetlbfs/inode.c | 11 ++++++----- 1 file changed, 6 insertions(+), 5 deletions(-) commit b1bc554e009e3aeed7e4cfd2e717c7a34a98c683 Merge: 0ffb8a4c96e5 68a72104cbcf Author: Linus Torvalds Date: Wed Jul 17 18:30:10 2024 -0700 Merge tag 'media/v6.11-1' of git://git.kernel.org/pub/scm/linux/kernel/git/mchehab/linux-media Pull media updates from Mauro Carvalho Chehab: - New sensor drivers: gc05a2, gc08a3 and imx283 - New serializer/deserializer drivers: max96714 and max96717 - New JPEG encoder driver: e5010 - Support for Raspberry Pi PiSP Backend (BE) ISP driver - Old documentation for av7110 driver removed, as a new version was added as Documentation/userspace-api/media/dvb/legacy*.rst - atompisp: Linux firmwares are now available, so drop firmware-related task from TODO and update firmware logic - The imx258 driver has gained several improvements - wave5 driver has gained support for HEVC decoding - em28xx gained support for MyGica UTV3 - av7110 budget-patch driver removed - Lots of other cleanups, improvements and fixes * tag 'media/v6.11-1' of git://git.kernel.org/pub/scm/linux/kernel/git/mchehab/linux-media: (301 commits) media: raspberrypi: Switch to remove_new media: uapi: pisp_be_config: Add extra config fields media: uapi: pisp_be_config: Re-sort pisp_be_tiles_config media: uapi: pisp_common: Capitalize all macros media: uapi: pisp_common: Add 32 bpp format test media: uapi: pisp_be_config: Drop BIT() from uAPI media: stm32: dcmipp: correct error handling in dcmipp_create_subdevs media: atomisp: Fix spelling mistakes in sh_css_sp.c media: atomisp: Fix spelling mistake in ia_css_debug.c media: atomisp: Fix spelling mistake in hmm_bo.c media: atomisp: Fix spelling mistake in ia_css_eed1_8.host.c media: atomisp: Fix spelling mistake in sh_css_internal.h media: atomisp: Fix spelling mistake "pipline" -> "pipeline" media: atomisp: Remove unused GPIO related defines and APIs media: atomisp: Replace COMPILATION_ERROR_IF() by static_assert() media: atomisp: Clean up unused macros from math_support.h media: atomisp: csi2-bridge: Add DMI quirk for OV5693 on Xiaomi Mipad2 media: atomisp: Update TODO media: atomisp: Prefix firmware paths with "intel/ipu/" media: atomisp: Remove firmware_name module parameter ... commit 0ffb8a4c96e55ecf0e572aec1a0220af3da84e22 Merge: 5b9ac6c2a735 76be2f9823b1 Author: Linus Torvalds Date: Wed Jul 17 18:07:31 2024 -0700 Merge tag 'devicetree-for-6.11' of git://git.kernel.org/pub/scm/linux/kernel/git/robh/linux Pull devicetree updates from Rob Herring: "DT Bindings: - Convert and add a bunch of IBM FSI related bindings - Add a new schema listing legacy compatibles which will (probably) never be documented. This will silence various checks warning about them. - Add bindings for Sierra Wireless mangOH Green SPI IoT interface, new Arm 2024 Cortex and Neoverse CPUs, QCom sc8180x PDC, QCom SDX75 GPI DMA, imx8mp/imx8qxp fsl,irqsteer, and Renesas RZ/G2UL CRU and CSI-2 blocks - Convert Spreadtrum sprd-timer, FSL cpm_qe, FSL fsl,ls-scfg-msi, FSL q(b)man-*, FSL qoriq-mc, and img,pdc-wdt bindings to DT schema - Drop obsolete stericsson,abx500.txt DT core: - Update dtc to upstream version v1.7.0-93-g1df7b047fe43 - Add support to run DT validation on DTs with applied overlays - Add helper for creating boolean properties in dynamic nodes and use that for dynamic PCI nodes - Clean-up early parsing of '#{address,size}-cells'" * tag 'devicetree-for-6.11' of git://git.kernel.org/pub/scm/linux/kernel/git/robh/linux: (39 commits) dt-bindings: timer: sprd-timer: convert to YAML dt-bindings: incomplete-devices: document devices without bindings dt-bindings: trivial-devices: document the Sierra Wireless mangOH Green SPI IoT interface scripts/dtc: Update to upstream version v1.7.0-93-g1df7b047fe43 dt-bindings: soc: fsl: Add fsl,ls1028a-reset for reset syscon node dt-bindings: soc: fsl: cpm_qe: convert to yaml format dt-bindings: i2c: i2c-fsi: Convert to json-schema dt-bindings: fsi: Document the FSI Hub Controller dt-bindings: fsi: Document the AST2700 FSI controller dt-bindings: fsi: ast2600-fsi-master: Convert to json-schema dt-bindings: fsi: ibm,i2cr-fsi-master: Reference common FSI controller dt-bindings: fsi: Document the FSI controller common properties dt-bindings: fsi: Document the IBM SBEFIFO engine dt-bindings: fsi: p9-occ: Convert to json-schema dt-bindings: fsi: Document the IBM SCOM engine dt-bindings: fsi: fsi2spi: Document SPI controller child nodes dt-bindings: interrupt-controller: convert fsl,ls-scfg-msi to yaml dt-bindings: soc: fsl: Convert q(b)man-* to yaml format dt-bindings: misc: fsl,qoriq-mc: convert to yaml format dt-bindings: drop stale Anson Huang from maintainers ... commit 5b9ac6c2a735f5b1721e0bc7331f8707190f9ef6 Merge: fea17683c4fb 9e4259716f60 Author: Linus Torvalds Date: Wed Jul 17 18:03:41 2024 -0700 Merge tag 'for-6.11-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/pateldipen1984/linux Pull hardware timestamp update from Dipen Patel: - Add module description in hte test to silence modpost warnings * tag 'for-6.11-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/pateldipen1984/linux: hte: tegra-194: add missing MODULE_DESCRIPTION() macro commit fea17683c4fbb06a727cd94abf4c9588a580ab12 Merge: e0d97b04eceb b0eed397623f Author: Linus Torvalds Date: Wed Jul 17 17:51:30 2024 -0700 Merge tag 'leds-next-6.11' of git://git.kernel.org/pub/scm/linux/kernel/git/lee/leds Pull LED updates from Lee Jones: "Core Frameworks: - New trigger for Input Events - New led_mc_set_brightness() call to adapt colour/brightness for mutli-colour LEDs - New lled_mc_trigger_event() call to call the above based on given trigger conditions - New led_get_color_name() call, a wrapper around the existing led_colors[] array - A new flag to avoid automatic renaming of LED devices New Drivers: - Silergy SY7802 Flash LED Controller - Texas Instruments LP5569 LED Controller - ChromeOS EC LED Controller New Device Support: - KTD202{6,7} support for Kinetic KTD2026/7 LEDs Fix-ups: - Replace ACPI/DT firmware helpers with agnostic variants - Make use of resource managed devm_* API calls - Device Tree binding adaptions/conversions/creation - Constify/staticise applicable data structures - Trivial; spelling, whitespace, coding-style adaptions - Drop i2c_device_id::driver_data where the value is unused - Utilise centrally provided helpers and macros to aid simplicity and avoid duplication - Use generic platform device properties instead of OF/ACPI specific ones - Consolidate/de-duplicate various functionality - Remove superfluous/duplicated/unused sections - Make use of the new *_scoped() guard APIs - Improve/simplify error handling Bug Fixes: - Flush pending brightness changes before activating the trigger - Repair incorrect device naming preventing matches - Prevent memory leaks by correctly free resources during error handling routines - Repair locking issue causing circular dependency splats and lock-ups - Unregister sysfs entries before deactivating triggers to prevent use-after issues - Supply a bunch of MODULE_DESCRIPTIONs to silence modpost warnings - Use correct return codes expected by the callers - Omit set_brightness() error message for a LEDs that support only HW triggers" * tag 'leds-next-6.11' of git://git.kernel.org/pub/scm/linux/kernel/git/lee/leds: (65 commits) leds: leds-lp5569: Enable chip after chip configuration leds: leds-lp5569: Better handle enabling clock internal setting leds: leds-lp5569: Fix typo in driver name leds: flash: leds-qcom-flash: Test the correct variable in init leds: leds-lp55xx: Convert mutex lock/unlock to guard API leds: leds-lp5523: Convert to sysfs_emit API leds: leds-lp5569: Convert to sysfs_emit API Revert "leds: led-core: Fix refcount leak in of_led_get()" leds: leds-lp5569: Add support for Texas Instruments LP5569 leds: leds-lp55xx: Drop deprecated defines leds: leds-lp55xx: Support ENGINE program up to 128 bytes leds: leds-lp55xx: Generalize sysfs master_fader leds: leds-lp55xx: Generalize sysfs engine_leds leds: leds-lp55xx: Generalize sysfs engine_load and engine_mode leds: leds-lp55xx: Generalize stop_engine function leds: leds-lp55xx: Generalize turn_off_channels function leds: leds-lp55xx: Generalize set_led_current function leds: leds-lp55xx: Generalize multicolor_brightness function leds: leds-lp55xx: Generalize led_brightness function leds: leds-lp55xx: Generalize firmware_loaded function ... commit e0d97b04eceb637a476a2d0233bc7721611a9cb2 Merge: 1200af3ac164 1df5aa3754ca Author: Linus Torvalds Date: Wed Jul 17 17:48:40 2024 -0700 Merge tag 'backlight-next-6.11' of git://git.kernel.org/pub/scm/linux/kernel/git/lee/backlight Pull backlight updates from Lee Jones: "New Drivers: - Texas Instruments LM3509 Backlight Driver Fix-ups: - Device Tree binding adaptions/conversions/creation - Drop i2c_device_id::driver_data where the value is unused - Make use of the new *_scoped() guard APIs - Decouple from fbdev by providing Backlight with its own BACKLIGHT_POWER_* constrains Bug Fixes: - Correctly assess return values (NULL vs IS_ERR()) - Supply a bunch of MODULE_DESCRIPTIONs to silence modpost warnings" * tag 'backlight-next-6.11' of git://git.kernel.org/pub/scm/linux/kernel/git/lee/backlight: (23 commits) backlight: sky81452-backlight: Use backlight power constants backlight: rave-sp-backlight: Use backlight power constants backlight: pwm-backlight: Use backlight power constants backlight: pcf50633-backlight: Use backlight power constants backlight: pandora-backlight: Use backlight power constants backlight: mp3309c: Use backlight power constants backlight: lm3533-backlight: Use backlight power constants backlight: led-backlight: Use backlight power constants backlight: ktd253-backlight: Use backlight power constants backlight: kb3886-bl: Use backlight power constants backlight: journada_bl: Use backlight power constants backlight: ipaq-micro-backlight: Use backlight power constants backlight: gpio-backlight: Use backlight power constants backlight: corgi-lcd: Use backlight power constants backlight: ams369fb06: Use backlight power constants backlight: aat2870-backlight: Use blacklight power constants backlight: Add BACKLIGHT_POWER_ constants for power states backlight: lm3509_bl: Fix early returns in for_each_child_of_node() backlight: Drop explicit initialization of struct i2c_device_id::driver_data to 0 backlight: Add missing MODULE_DESCRIPTION() macros ... commit 1200af3ac16489d9f0b86000362a044ed7521cf6 Merge: 6e504d2c6124 c298391abf65 Author: Linus Torvalds Date: Wed Jul 17 17:42:20 2024 -0700 Merge tag 'mfd-next-6.11' of git://git.kernel.org/pub/scm/linux/kernel/git/lee/mfd Pull MFD updates from Lee Jones: "New Drivers: - ROHM BD96801 Power Management IC - Cirrus Logic CS40L50 Haptic Driver with Waveform Memory - Marvell 88PM886 Power Management IC New Device Support: - Keyboard Backlight to ChromeOS Embedded Controller - LEDs to ChromeOS Embedded Controller - Charge Control to ChromeOS Embedded Controller - HW Monitoring Service to ChromeOS Embedded Controller - AUXADCs to MediaTek MT635{7,8,9} Power Management ICs New Functionality: - Allow Syscon consumers to supply their own Regmaps on registration Fix-ups: - Constify/staticise applicable data structures - Remove superfluous/duplicated/unused sections - Device Tree binding adaptions/conversions/creation - Trivial; spelling, whitespace, coding-style adaptions - Utilise centrally provided helpers and macros to aid simplicity/duplication - Drop i2c_device_id::driver_data where the value is unused - Replace ACPI/DT firmware helpers with agnostic variants - Move over to GPIOD (descriptor-based) APIs - Annotate a bunch of __counted_by() cases - Straighten out some includes Bug Fixes: - Ensure potentially asserted recent lines are deasserted during initialisation - Avoid ".ko is added to multiple modules" warnings - Supply a bunch of MODULE_DESCRIPTIONs to silence modpost warnings - Fix Wvoid-pointer-to-enum-cast warnings" * tag 'mfd-next-6.11' of git://git.kernel.org/pub/scm/linux/kernel/git/lee/mfd: (87 commits) mfd: timberdale: Attach device properties to TSC2007 board info mfd: tmio: Move header to platform_data mfd: tmio: Sanitize comments mfd: tmio: Update include files mmc: tmio/sdhi: Fix includes mfd: tmio: Remove obsolete io accessors mfd: tmio: Remove obsolete platform_data watchdog: bd96801_wdt: Add missing include for FIELD_*() dt-bindings: mfd: syscon: Add APM poweroff mailbox dt-bindings: mfd: syscon: Split and enforce documenting MFD children dt-bindings: mfd: rk817: Merge support for RK809 dt-bindings: mfd: rk817: Fixup clocks and reference dai-common dt-bindings: mfd: syscon: Add TI's opp table compatible mfd: omap-usb-tll: Use struct_size to allocate tll dt-bindings: mfd: Explain lack of child dependency in simple-mfd dt-bindings: mfd: Dual licensing for st,stpmic1 bindings mfd: omap-usb-tll: Annotate struct usbtll_omap with __counted_by mfd: tps6594-core: Remove unneeded semicolon in tps6594_check_crc_mode() mfd: lm3533: Move to new GPIO descriptor-based APIs mfd: tps65912: Use devm helper functions to simplify probe ... commit 6e504d2c61244a01226c5100c835e44fb9b85ca8 Merge: 221fd1e154ee 30b866413e7b Author: Linus Torvalds Date: Wed Jul 17 17:28:31 2024 -0700 Merge tag 'for-linus-2024071601' of git://git.kernel.org/pub/scm/linux/kernel/git/hid/hid Pull HID updates from Benjamin Tissoires: - rewrite of the HID-BPF internal implementation to use bpf struct_ops instead of a tracing endpoint (Benjamin Tissoires) - add two new HID-BPF hooks to be able to intercept userspace calls targeting a HID device and filtering them (Benjamin Tissoires) - add support for various new devices through HID-BPF filters (Benjamin Tissoires) - add support for the magic keyboard backlight (Orlando Chamberlain) - add the missing MODULE_DESCRIPTION() macros in HID drivers (Jeff Johnson) - use of kvzalloc in case memory gets too fragmented (Hailong Liu) - retrieve the device firmware node in the child HID device (Danny Kaehn) - some hid-uclogic improvements (José Expósito) - some more typos, trivial fixes, kernel doctext and unused functions cleanups * tag 'for-linus-2024071601' of git://git.kernel.org/pub/scm/linux/kernel/git/hid/hid: (60 commits) HID: hid-steam: Fix typo in goto label HID: mcp2221: Remove unnecessary semicolon HID: Fix spelling mistakes "Kensigton" -> "Kensington" HID: add more missing MODULE_DESCRIPTION() macros HID: samples: fix the 2 struct_ops definitions HID: fix for amples in for-6.11/bpf HID: apple: Add support for magic keyboard backlight on T2 Macs HID: bpf: Thrustmaster TCA Yoke Boeing joystick fix HID: bpf: Add Huion Dial 2 bpf fixup HID: bpf: Add support for the XP-PEN Deco Mini 4 HID: bpf: move the BIT() macro to hid_bpf_helpers.h HID: bpf: add a driver for the Huion Inspiroy 2S (H641P) HID: bpf: Add a HID report composition helper macros HID: bpf: doc fixes for hid_hw_request() hooks HID: bpf: doc fixes for hid_hw_request() hooks HID: bpf: fix gcc warning and unify __u64 into u64 selftests/hid: ensure CKI can compile our new tests on old kernels selftests/hid: add an infinite loop test for hid_bpf_try_input_report selftests/hid: add another test for injecting an event from an event hook HID: bpf: allow hid_device_event hooks to inject input reports on self ... commit 221fd1e154ee533c529280bd3866570c086ec792 Merge: a5cb6b2bbff9 19a01155ddfe Author: Linus Torvalds Date: Wed Jul 17 17:09:15 2024 -0700 Merge tag 'for-linus-6.11-1' of https://github.com/cminyard/linux-ipmi Pull IPMI updates from Corey Minyard: "Some cleanups for device changes coming, and some range checks on data coming from a host to a BMC" * tag 'for-linus-6.11-1' of https://github.com/cminyard/linux-ipmi: ipmi: Drop explicit initialization of struct i2c_device_id::driver_data to 0 ipmi: ssif_bmc: prevent integer overflow on 32bit systems commit a5cb6b2bbff9cdd32aab635ad464a1ee299a63bd Merge: e2f710f97f35 d8b17a364ec4 Author: Linus Torvalds Date: Wed Jul 17 17:05:21 2024 -0700 Merge tag 'platform-drivers-x86-v6.11-1' of git://git.kernel.org/pub/scm/linux/kernel/git/pdx86/platform-drivers-x86 Pull x86 platform driver updates from Ilpo Järvinen: - amd/pmf: Report system state changes using existing input events - asus-wmi: Zenbook 2023 camera LED disable support and fix TUF laptop keyboard RGB LED sysfs interface - dell-pc: Fan modes / platform profile support - hp-wmi: Fix platform profile switching on Omen/Victus laptops - intel/ISST: Use only TPMI interface when TPMI and legacy interfaces are available - intel/pmc: LTR restore support to pair with LTR ignore - intel/tpmi: Performance Limit Reasons (PLR) and APIC <-> Punit CPU numbering mapping support - WMI: driver override support and docs improvements - lenovo-yoga-c630: Support for EC (platform/arm64) - platform/arm64: Fix build with COMPILE_TEST (broke after addition of C630) - tools: Intel Speed Select Turbo Ratio Limit fix - Miscellaneous cleanups / refactoring / improvements * tag 'platform-drivers-x86-v6.11-1' of git://git.kernel.org/pub/scm/linux/kernel/git/pdx86/platform-drivers-x86: (65 commits) platform/x86: asus-wmi: fix TUF laptop RGB variant platform/x86/intel/tpmi/plr: Fix output in plr_print_bits() Docs/admin-guide: Remove pmf leftover reference from the index platform/x86: ideapad-laptop: use cleanup.h platform/x86: hp-wmi: Fix implementation of the platform_profile_omen_get function platform: arm64: EC_LENOVO_YOGA_C630 should depend on ARCH_QCOM platform: arm64: EC_ACER_ASPIRE1 should depend on ARCH_QCOM platform/x86/amd/pmf: Remove update system state document platform/x86/amd/pmf: Use existing input event codes to update system states platform/x86: hp-wmi: Fix platform profile option switch bug on Omen and Victus laptops platform/x86:intel/pmc: Add support to undo ltr_ignore platform/x86:intel/pmc: Use the Elvis operator platform/x86:intel/pmc: Use DEFINE_SHOW_STORE_ATTRIBUTE macro platform/x86:intel/pmc: Remove unneeded min_t check platform/x86:intel/pmc: Add support to show ltr_ignore value platform/x86:intel/pmc: Move pmc assignment closer to first usage platform/x86:intel/pmc: Convert index variables to be unsigned platform/x86:intel/pmc: Simplify mutex usage with cleanup helpers platform/x86:intel/pmc: Use the return value of pmc_core_send_msg tools/power/x86/intel-speed-select: v1.20 release ... commit 478a52707b0abe98aac7f8c53ccddb759be66b06 Merge: c58c39163a7e 1cff1010bef6 Author: Dave Airlie Date: Thu Jul 18 09:19:46 2024 +1000 Merge tag 'amd-drm-next-6.11-2024-07-12' of https://gitlab.freedesktop.org/agd5f/linux into drm-next amd-drm-next-6.11-2024-07-12: amdgpu: - RAS fixes - SMU fixes - GC 12 updates - SR-IOV fixes - IH 7 updates - DCC fixes - GC 11.5 fixes - DP MST fixes - GFX 9.4.4 fixes - SMU 14 updates - Documentation updates - MAINTAINERS updates - PSR SU fix - Misc small fixes Signed-off-by: Dave Airlie From: Alex Deucher Link: https://patchwork.freedesktop.org/patch/msgid/20240712171637.2581787-1-alexander.deucher@amd.com commit e3615bd198289f319172c428f20857accb46b830 Author: Alex Deucher Date: Tue Jul 16 12:49:25 2024 -0400 drm/amd/display: fix corruption with high refresh rates on DCN 3.0 This reverts commit bc87d666c05a13e6d4ae1ddce41fc43d2567b9a2 and the register changes from commit 6d4279cb99ac4f51d10409501d29969f687ac8dc. Closes: https://gitlab.freedesktop.org/drm/amd/-/issues/3412 Cc: mikhail.v.gavrilov@gmail.com Cc: Rodrigo Siqueira Tested-by: Mikhail Gavrilov Reviewed-by: Rodrigo Siqueira Signed-off-by: Alex Deucher Cc: stable@vger.kernel.org # 6.10.x drivers/gpu/drm/amd/display/dc/optc/dcn10/dcn10_optc.c | 15 +++------------ drivers/gpu/drm/amd/display/dc/optc/dcn20/dcn20_optc.c | 10 ++++++++++ 2 files changed, 13 insertions(+), 12 deletions(-) commit cbd070a4ae62f119058973f6d2c984e325bce6e7 Author: Chen Hanxiao Date: Thu Jun 27 14:15:15 2024 +0800 ipvs: properly dereference pe in ip_vs_add_service Use pe directly to resolve sparse warning: net/netfilter/ipvs/ip_vs_ctl.c:1471:27: warning: dereference of noderef expression Fixes: 39b972231536 ("ipvs: handle connections started by real-servers") Signed-off-by: Chen Hanxiao Acked-by: Julian Anastasov Acked-by: Simon Horman Signed-off-by: Pablo Neira Ayuso net/netfilter/ipvs/ip_vs_ctl.c | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) commit 6caf9efaa169faea10a369dd6b36806ae6842584 Author: Michal Luczaj Date: Sat Jul 13 21:41:41 2024 +0200 selftests/bpf: Test sockmap redirect for AF_UNIX MSG_OOB Verify that out-of-band packets are silently dropped before they reach the redirection logic. The idea is to test with a 2 byte long send(). Should a MSG_OOB flag be in use, only the last byte will be treated as out-of-band. Test fails if verd_mapfd indicates a wrong number of packets processed (e.g. if OOB wasn't dropped at the source) or if it was possible to recv() MSG_OOB from the mapped socket, or if any stale OOB data have been left reachable from the unmapped socket. Signed-off-by: Michal Luczaj Signed-off-by: Daniel Borkmann Tested-by: Jakub Sitnicki Reviewed-by: Jakub Sitnicki Link: https://lore.kernel.org/bpf/20240713200218.2140950-5-mhal@rbox.co .../selftests/bpf/prog_tests/sockmap_listen.c | 36 ++++++++++++++++++++-- 1 file changed, 33 insertions(+), 3 deletions(-) commit 0befb349c4cdcc4e3c2f4aff81259a3a58c3b33e Author: Michal Luczaj Date: Sat Jul 13 21:41:40 2024 +0200 selftests/bpf: Parametrize AF_UNIX redir functions to accept send() flags Extend pairs_redir_to_connected() and unix_inet_redir_to_connected() with a send_flags parameter. Replace write() with send() allowing packets to be sent as MSG_OOB. Signed-off-by: Michal Luczaj Signed-off-by: Daniel Borkmann Tested-by: Jakub Sitnicki Reviewed-by: Jakub Sitnicki Link: https://lore.kernel.org/bpf/20240713200218.2140950-4-mhal@rbox.co .../selftests/bpf/prog_tests/sockmap_listen.c | 48 ++++++++++++---------- 1 file changed, 26 insertions(+), 22 deletions(-) commit 1b0ad43177c097d38b967b99c2b71d8be28b0223 Author: Michal Luczaj Date: Sat Jul 13 21:41:39 2024 +0200 selftests/bpf: Support SOCK_STREAM in unix_inet_redir_to_connected() Function ignores the AF_UNIX socket type argument, SOCK_DGRAM is hardcoded. Fix to respect the argument provided. Fixes: 75e0e27db6cf ("selftest/bpf: Change udp to inet in some function names") Suggested-by: Jakub Sitnicki Signed-off-by: Michal Luczaj Signed-off-by: Daniel Borkmann Tested-by: Jakub Sitnicki Reviewed-by: Jakub Sitnicki Link: https://lore.kernel.org/bpf/20240713200218.2140950-3-mhal@rbox.co tools/testing/selftests/bpf/prog_tests/sockmap_listen.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) commit ee8b8f5d83eb2c9caaebcf633310905ee76856e9 Author: Qiang Ma Date: Wed Jul 17 15:00:43 2024 +0800 efi/libstub: Zero initialize heap allocated struct screen_info After calling uefi interface allocate_pool to apply for memory, we should clear 0 to prevent the possibility of using random values. Signed-off-by: Qiang Ma Cc: # v6.6+ Fixes: 732ea9db9d8a ("efi: libstub: Move screen_info handling to common code") Signed-off-by: Ard Biesheuvel drivers/firmware/efi/libstub/screen_info.c | 2 ++ 1 file changed, 2 insertions(+) commit 638f32604385fd23059985da8de918e9c18f0b98 Author: Michal Luczaj Date: Sat Jul 13 21:41:38 2024 +0200 af_unix: Disable MSG_OOB handling for sockets in sockmap/sockhash AF_UNIX socket tracks the most recent OOB packet (in its receive queue) with an `oob_skb` pointer. BPF redirecting does not account for that: when an OOB packet is moved between sockets, `oob_skb` is left outdated. This results in a single skb that may be accessed from two different sockets. Take the easy way out: silently drop MSG_OOB data targeting any socket that is in a sockmap or a sockhash. Note that such silent drop is akin to the fate of redirected skb's scm_fp_list (SCM_RIGHTS, SCM_CREDENTIALS). For symmetry, forbid MSG_OOB in unix_bpf_recvmsg(). Fixes: 314001f0bf92 ("af_unix: Add OOB support") Suggested-by: Kuniyuki Iwashima Signed-off-by: Michal Luczaj Signed-off-by: Daniel Borkmann Tested-by: Jakub Sitnicki Reviewed-by: Kuniyuki Iwashima Reviewed-by: Jakub Sitnicki Link: https://lore.kernel.org/bpf/20240713200218.2140950-2-mhal@rbox.co net/unix/af_unix.c | 41 ++++++++++++++++++++++++++++++++++++++++- net/unix/unix_bpf.c | 3 +++ 2 files changed, 43 insertions(+), 1 deletion(-) commit 3c870059e9f8897c032f4256f90c41ee822218a8 Author: Donald Hunter Date: Wed Jul 17 14:45:08 2024 +0100 bpftool: Fix typo in usage help The usage help for "bpftool prog help" contains a ° instead of the _ symbol for cgroup/sendmsg_unix. Fix the typo. Fixes: 8b3cba987e6d ("bpftool: Add support for cgroup unix socket address hooks") Signed-off-by: Donald Hunter Signed-off-by: Daniel Borkmann Acked-by: Quentin Monnet Link: https://lore.kernel.org/bpf/20240717134508.77488-1-donald.hunter@gmail.com tools/bpf/bpftool/prog.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 189f1a976e426011e6a5588f1d3ceedf71fe2965 Author: Andrii Nakryiko Date: Fri Jul 12 15:44:42 2024 -0700 libbpf: Fix no-args func prototype BTF dumping syntax For all these years libbpf's BTF dumper has been emitting not strictly valid syntax for function prototypes that have no input arguments. Instead of `int (*blah)()` we should emit `int (*blah)(void)`. This is not normally a problem, but it manifests when we get kfuncs in vmlinux.h that have no input arguments. Due to compiler internal specifics, we get no BTF information for such kfuncs, if they are not declared with proper `(void)`. The fix is trivial. We also need to adjust a few ancient tests that happily assumed `()` is correct. Fixes: 351131b51c7a ("libbpf: add btf_dump API for BTF-to-C conversion") Reported-by: Tejun Heo Signed-off-by: Andrii Nakryiko Signed-off-by: Daniel Borkmann Acked-by: Stanislav Fomichev Link: https://lore.kernel.org/bpf/20240712224442.282823-1-andrii@kernel.org tools/lib/bpf/btf_dump.c | 8 +++++--- tools/testing/selftests/bpf/progs/btf_dump_test_case_multidim.c | 4 ++-- tools/testing/selftests/bpf/progs/btf_dump_test_case_syntax.c | 4 ++-- 3 files changed, 9 insertions(+), 7 deletions(-) commit e2f710f97f3544df08ebe608c8157536e0ffb494 Merge: 01f851a0e87e 6739fad42af2 Author: Linus Torvalds Date: Wed Jul 17 13:26:01 2024 -0700 Merge tag 'ata-6.11-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/libata/linux Pull ata updates from Niklas Cassel: - ATA PASS-THROUGH sense data cleanups and fixes (Igor Pylypiv) Store the sense data for ATA PASS-THROUGH commands at the correct offset in the sense buffer when using fixed format sense data. Cleanup the logic related to generating sense data for PASS-THROUGH commands. Generating sense data for PASS-THROUGH commands would overwrite any eventual (real) sense data received from the device. Honor the D_SENSE bit when generating sense data for PASS-THROUGH commands. (The D_SENSE bit can be set by the user, and determines if the returned sense data should be in fixed format or descriptor format) - ata port allocation cleanups (me) Assign the ata port print_id at port allocation time, such that the ata_port_* print functions can be used earlier in the init call chain. Change the ata port port print_id to use ida_alloc(), such that print_ids will get reused on rmmod + modprobe, instead of being incremented indefinitely. Remove wrappers that only existed in order to export the internal libata functions which they wrapped, and instead export the libata functions directly. - Update SATA_MOBILE_LPM_POLICY Kconfig default to med_power_with_dipm (Mario Limonciello) Using this default was not always a good idea before, because it would break hot plug support. However, with LPM changes in recent kernels, a port marked as external will not enable LPM (in order to not break hot plug), so it is now safe to change the default value of this Kconfig. All major Linux distros have had SATA_MOBILE_LPM_POLICY set to med_power_with_dipm for quite a long time - Convert ahci-fsl-qoriq device tree binding to yaml format (Frank Li) * tag 'ata-6.11-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/libata/linux: dt-bindings: ata: ahci-fsl-qoriq: add fsl,ls1046a-ahci and fsl,ls1012a-ahci ata: ahci: Add debug print for external port ata,scsi: Remove wrapper ata_sas_port_alloc() ata: libata-core: Reuse available ata_port print_ids ata: libata: Assign print_id at port allocation time ata: libata-core: Remove local_port_no struct member ata: libata-sata: Remove superfluous assignment in ata_sas_port_alloc() ata: libata-core: Remove support for decreasing the number of ports ata: libata: Remove unused function declaration for ata_scsi_detect() ata,scsi: Remove wrappers ata_sas_tport_{add,delete}() ata: libata-scsi: Check ATA_QCFLAG_RTF_FILLED before using result_tf ata: libata-core: Set ATA_QCFLAG_RTF_FILLED in fill_result_tf() ata: libata-scsi: Do not pass ATA device id to ata_to_sense_error() ata: libata-scsi: Remove redundant sense_buffer memsets ata: libata-scsi: Honor the D_SENSE bit for CK_COND=1 and no error ata: libata-scsi: Do not overwrite valid sense data when CK_COND=1 ata: libata-scsi: Fix offsets for the fixed format sense data dt-bindings: ata: ahci-fsl-qoriq: convert to yaml format ata: Kconfig: Update SATA_MOBILE_LPM_POLICY default to med_power_with_dipm commit 01f851a0e87ed64db7081a472061650e96dfb798 Merge: 8b0f0bb27c32 df2f9708ff1f Author: Linus Torvalds Date: Wed Jul 17 13:24:24 2024 -0700 Merge tag 'zonefs-6.11-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/dlemoal/zonefs Pull zonefs update from Damien Le Moal: "A single change to enable support for large folios (from Johannes)" * tag 'zonefs-6.11-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/dlemoal/zonefs: zonefs: enable support for large folios commit 92717bc077892d1ce60fee07aee3a33f33909b85 Author: James Clark Date: Mon Jul 15 10:47:13 2024 +0100 perf dso: Fix build when libunwind is enabled Now that symsrc_filename is always accessed through an accessor, we also need a free() function for it to avoid the following compilation error: util/unwind-libunwind-local.c:416:12: error: lvalue required as unary ‘&’ operand 416 | zfree(&dso__symsrc_filename(dso)); Fixes: 1553419c3c10 ("perf dso: Fix address sanitizer build") Signed-off-by: James Clark Reviewed-by: Ian Rogers Tested-by: Leo Yan Tested-by: Florian Fainelli Cc: Yunseong Kim Cc: Athira Rajeev Link: https://lore.kernel.org/r/20240715094715.3914813-1-james.clark@linaro.org Signed-off-by: Namhyung Kim tools/perf/util/dso.c | 2 +- tools/perf/util/dso.h | 5 +++++ tools/perf/util/unwind-libunwind-local.c | 2 +- 3 files changed, 7 insertions(+), 2 deletions(-) commit 2085948e5f8b31c1ec1bc92413794d11ff749bb2 Author: Guilherme Amadio Date: Wed Jul 17 19:47:39 2024 +0200 tools/latency: Use pkg-config in lib_setup of Makefile.config This allows to build against libtraceevent and libtracefs installed in non-standard locations. Signed-off-by: Guilherme Amadio Tested-by: Thorsten Leemhuis Tested-by: Leo Yan Acked-by: Steven Rostedt (Google) Cc: linux-trace-devel@vger.kernel.org Link: https://lore.kernel.org/r/20240717174739.186988-6-amadio@gentoo.org Signed-off-by: Namhyung Kim tools/tracing/latency/Makefile.config | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) commit eb545a42d0f1da8dd1a09072cff18f5605add05b Author: Guilherme Amadio Date: Fri Jul 12 21:40:49 2024 +0200 tools/rtla: Use pkg-config in lib_setup of Makefile.config This allows to build against libtraceevent and libtracefs installed in non-standard locations. Signed-off-by: Guilherme Amadio Tested-by: Thorsten Leemhuis Tested-by: Leo Yan Acked-by: Steven Rostedt (Google) Link: https://lore.kernel.org/r/20240712194511.3973899-5-amadio@gentoo.org Signed-off-by: Namhyung Kim tools/tracing/rtla/Makefile.config | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) commit e525eff7cc334e1c7450c6bc952bfc35b9d74500 Author: Guilherme Amadio Date: Fri Jul 12 21:40:48 2024 +0200 tools/verification: Use pkg-config in lib_setup of Makefile.config This allows to build against libtraceevent and libtracefs installed in non-standard locations. Signed-off-by: Guilherme Amadio Tested-by: Thorsten Leemhuis Tested-by: Leo Yan Acked-by: Steven Rostedt (Google) Link: https://lore.kernel.org/r/20240712194511.3973899-4-amadio@gentoo.org Signed-off-by: Namhyung Kim tools/verification/rv/Makefile.config | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) commit 8f61e98ad51f167de148488b1881de72fec0d563 Author: Guilherme Amadio Date: Wed Jul 17 19:47:36 2024 +0200 tools: Make pkg-config dependency checks usable by other tools Other tools, in tools/verification and tools/tracing, make use of libtraceevent and libtracefs as dependencies. This allows setting up the feature check flags for them as well. Signed-off-by: Guilherme Amadio Tested-by: Thorsten Leemhuis Tested-by: Leo Yan Acked-by: Steven Rostedt (Google) Cc: linux-trace-devel@vger.kernel.org Link: https://lore.kernel.org/r/20240717174739.186988-3-amadio@gentoo.org Signed-off-by: Namhyung Kim tools/build/Makefile.feature | 18 ++++++++++++++++++ tools/perf/Makefile.config | 11 +++-------- 2 files changed, 21 insertions(+), 8 deletions(-) commit 37ac347f87b616525e0fd397cfc9a163328173aa Author: Guilherme Amadio Date: Wed Jul 17 19:47:35 2024 +0200 perf build: Warn if libtracefs is not found Signed-off-by: Guilherme Amadio Tested-by: Thorsten Leemhuis Tested-by: Leo Yan Acked-by: Steven Rostedt (Google) Cc: linux-trace-devel@vger.kernel.org Link: https://lore.kernel.org/r/20240717174739.186988-2-amadio@gentoo.org Signed-off-by: Namhyung Kim tools/perf/Makefile.config | 2 ++ 1 file changed, 2 insertions(+) commit 8b0f0bb27c32ed46da0d67d056a6aacccd7c48bf Merge: d60183211494 322a6aff0393 Author: Linus Torvalds Date: Wed Jul 17 13:11:42 2024 -0700 Merge tag 'fs_for_v6.11-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/jack/linux-fs Pull udf, ext2, isofs fixes and cleanups from Jan Kara: - A few UDF cleanups and fixes for handling corrupted filesystems - ext2 fix for handling of corrupted filesystem - isofs module description - jbd2 module description * tag 'fs_for_v6.11-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/jack/linux-fs: ext2: Verify bitmap and itable block numbers before using them udf: prevent integer overflow in udf_bitmap_free_blocks() udf: Avoid excessive partition lengths udf: Drop load_block_bitmap() wrapper udf: Avoid using corrupted block bitmap buffer udf: Fix bogus checksum computation in udf_rename() udf: Fix lock ordering in udf_evict_inode() udf: Drop pointless IS_IMMUTABLE and IS_APPEND check isofs: add missing MODULE_DESCRIPTION() jbd2: add missing MODULE_DESCRIPTION() commit d60183211494de0d6af04f82dd3fc301e5562724 Merge: bf3aa9de7ba5 172e422ffea2 Author: Linus Torvalds Date: Wed Jul 17 13:07:53 2024 -0700 Merge tag 'fsnotify_for_v6.11-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/jack/linux-fs Pull fsnotify fix from Jan Kara: "Fix possible softlockups on directories with many dentries in fsnotify code" * tag 'fsnotify_for_v6.11-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/jack/linux-fs: fsnotify: clear PARENT_WATCHED flags lazily commit bf3aa9de7ba57c2c7b5ea70c1ad3a6670cd6fcb0 Merge: 0260b0a7445c 2bf6e353542d Author: Linus Torvalds Date: Wed Jul 17 12:57:48 2024 -0700 Merge tag 'xfs-6.11-merge-3' of git://git.kernel.org/pub/scm/fs/xfs/xfs-linux Pull xfs updates from Chandan Babu: "Major changes in this release are limited to enabling FITRIM on realtime devices and Byte-based grant head log reservation tracking. The remaining changes are limited to fixes and cleanups included in this pull request. Core: - Enable FITRIM on the realtime device - Introduce byte-based grant head log reservation tracking instead of physical log location tracking. This allows grant head to track a full 64 bit bytes space and hence overcome the limit of 4GB indexing that has been present until now Fixes: - xfs_flush_unmap_range() and xfs_prepare_shift() should consider RT extents in the flush unmap range - Implement bounds check when traversing log operations during log replay - Prevent out of bounds access when traversing a directory data block - Prevent incorrect ENOSPC when concurrently performing file creation and file writes - Fix rtalloc rotoring when delalloc is in use Cleanups: - Clean up I/O path inode locking helpers and the page fault handler - xfs: hoist inode operations to libxfs in anticipation of the metadata inode directory feature, which maintains a directory tree of metadata inodes. This will be necessary for further enhancements to the realtime feature, subvolume support - Clean up some warts in the extent freeing log intent code - Clean up the refcount and rmap intent code before adding support for realtime devices - Provide the correct email address for sysfs ABI documentation" * tag 'xfs-6.11-merge-3' of git://git.kernel.org/pub/scm/fs/xfs/xfs-linux: (80 commits) xfs: fix rtalloc rotoring when delalloc is in use xfs: get rid of xfs_ag_resv_rmapbt_alloc xfs: skip flushing log items during push xfs: grant heads track byte counts, not LSNs xfs: pass the full grant head to accounting functions xfs: track log space pinned by the AIL xfs: collapse xlog_state_set_callback in caller xfs: l_last_sync_lsn is really AIL state xfs: ensure log tail is always up to date xfs: background AIL push should target physical space xfs: AIL doesn't need manual pushing xfs: move and rename xfs_trans_committed_bulk xfs: fix the contact address for the sysfs ABI documentation xfs: Avoid races with cnt_btree lastrec updates xfs: move xfs_refcount_update_defer_add to xfs_refcount_item.c xfs: simplify usage of the rcur local variable in xfs_refcount_finish_one xfs: don't bother calling xfs_refcount_finish_one_cleanup in xfs_refcount_finish_one xfs: reuse xfs_refcount_update_cancel_item xfs: add a ci_entry helper xfs: remove xfs_trans_set_refcount_flags ... commit 0260b0a7445c62a08938fa66fad256e5d0779817 Merge: a1b547f0f217 89fc548767a2 Author: Linus Torvalds Date: Wed Jul 17 12:53:47 2024 -0700 Merge tag 'exfat-for-6.11-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/linkinjeon/exfat Pull exfat updates from Namjae Jeon: - Fix deadlock issue reported by syzbot - Handle idmapped mounts * tag 'exfat-for-6.11-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/linkinjeon/exfat: exfat: fix potential deadlock on __exfat_get_dentry_set exfat: handle idmapped mounts commit a1b547f0f217cfb06af7eb4ce8488b02d83a0370 Merge: 6706415bf9f3 8e7860543a94 Author: Linus Torvalds Date: Wed Jul 17 12:38:04 2024 -0700 Merge tag 'for-6.11-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/kdave/linux Pull btrfs updates from David Sterba: "The highlights are new logic behind background block group reclaim, automatic removal of qgroup after removing a subvolume and new 'rescue=' mount options. The rest is optimizations, cleanups and refactoring. User visible features: - dynamic block group reclaim: - tunable framework to avoid situations where eager data allocations prevent creating new metadata chunks due to lack of unallocated space - reuse sysfs knob bg_reclaim_threshold (otherwise used only in zoned mode) for a fixed value threshold - new on/off sysfs knob "dynamic_reclaim" calculating the value based on heuristics, aiming to keep spare working space for relocating chunks but not to needlessly relocate partially utilized block groups or reclaim newly allocated ones - stats are exported in sysfs per block group type, files "reclaim_*" - this may increase IO load at unexpected times but the corner case of no allocatable block groups is known to be worse - automatically remove qgroup of deleted subvolumes: - adjust qgroup removal conditions, make sure all related subvolume data are already removed, or return EBUSY, also take into account setting of sysfs drop_subtree_threshold - also works in squota mode - mount option updates: new modes of 'rescue=' that allow to mount images (read-only) that could have been partially converted by user space tools - ignoremetacsums - invalid metadata checksums are ignored - ignoresuperflags - super block flags that track conversion in progress (like UUID or checksums) Core: - size of struct btrfs_inode is now below 1024 (on a release config), improved memory packing and other secondary effects - switch tracking of open inodes from rb-tree to xarray, minor performance improvement - reduce number of empty transaction commits when there are no dirty data/metadata - memory allocation optimizations (reduced numbers, reordering out of critical sections) - extent map structure optimizations and refactoring, more sanity checks - more subpage in zoned mode preparations or fixes - general snapshot code cleanups, improvements and documentation - tree-checker updates: more file extent ram_bytes fixes, continued - raid-stripe-tree update (not backward compatible): - remove extent encoding field from the structure, can be inferred from other information - requires btrfs-progs 6.9.1 or newer - cleanups and refactoring - error message updates - error handling improvements - return type and parameter cleanups and improvements" * tag 'for-6.11-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/kdave/linux: (152 commits) btrfs: fix extent map use-after-free when adding pages to compressed bio btrfs: fix bitmap leak when loading free space cache on duplicate entry btrfs: remove the BUG_ON() inside extent_range_clear_dirty_for_io() btrfs: move extent_range_clear_dirty_for_io() into inode.c btrfs: enhance compression error messages btrfs: fix data race when accessing the last_trans field of a root btrfs: rename the extra_gfp parameter of btrfs_alloc_page_array() btrfs: remove the extra_gfp parameter from btrfs_alloc_folio_array() btrfs: introduce new "rescue=ignoresuperflags" mount option btrfs: introduce new "rescue=ignoremetacsums" mount option btrfs: output the unrecognized super block flags as hex btrfs: remove unused Opt enums btrfs: tree-checker: add extra ram_bytes and disk_num_bytes check btrfs: fix the ram_bytes assignment for truncated ordered extents btrfs: make validate_extent_map() catch ram_bytes mismatch btrfs: ignore incorrect btrfs_file_extent_item::ram_bytes btrfs: cleanup the bytenr usage inside btrfs_extent_item_to_extent_map() btrfs: fix typo in error message in btrfs_validate_super() btrfs: move the direct IO code into its own file btrfs: pass a btrfs_inode to btrfs_set_prop() ... commit 6706415bf9f3dcb425f4b60a08a3a6f1d94ec0e0 Merge: f097ef0e7625 f75efefb6db3 Author: Linus Torvalds Date: Wed Jul 17 12:23:33 2024 -0700 Merge tag 'gfs2-v6.10-rc1-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/gfs2/linux-gfs2 Pull gfs2 updates from Andreas Gruenbacher: "Fixes and cleanups: - Revise the glock reference counting model and LRU list handling to be more sensible - Several quota related fixes: clean up the quota code, add some missing locking, and work around the on-disk corruption that the reverted patch "gfs2: ignore negated quota changes" causes - Clean up the glock demote logic in glock_work_func()" * tag 'gfs2-v6.10-rc1-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/gfs2/linux-gfs2: (29 commits) gfs2: Clean up glock demote logic gfs2: Revert "check for no eligible quota changes" gfs2: Be more careful with the quota sync generation gfs2: Get rid of some unnecessary quota locking gfs2: Add some missing quota locking gfs2: Fold qd_fish into gfs2_quota_sync gfs2: quota need_sync cleanup gfs2: Fix and clean up function do_qc gfs2: Revert "Add quota_change type" gfs2: Revert "ignore negated quota changes" gfs2: qd_check_sync cleanups gfs2: Revert "introduce qd_bh_get_or_undo" gfs2: Check quota consistency on mount gfs2: Minor gfs2_quota_init error path cleanup gfs2: Get rid of demote_ok checks Revert "GFS2: Don't add all glocks to the lru" gfs2: Revise glock reference counting model gfs2: Switch to a per-filesystem glock workqueue gfs2: Report when glocks cannot be freed for a long time gfs2: gfs2_glock_get cleanup ... commit f097ef0e7625f70844ddaba60ca43d421db5b1b0 Merge: 586f14a6a182 89b01913dc73 Author: Linus Torvalds Date: Wed Jul 17 12:16:22 2024 -0700 Merge tag 'dlm-6.11' of git://git.kernel.org/pub/scm/linux/kernel/git/teigland/linux-dlm Pull dlm updates from David Teigland: - New flag DLM_LSFL_SOFTIRQ_SAFE can be set by code using dlm to indicate callbacks can be run from softirq - Change md-cluster to set DLM_LSFL_SOFTIRQ_SAFE - Clean up for previous changes, e.g. unused code and parameters - Remove custom pre-allocation of rsb structs which is unnecessary with kmem caches - Change idr to xarray for lkb structs in use - Change idr to xarray for rsb structs being recovered - Change outdated naming related to internal rsb states - Fix some incorrect add/remove of rsb on scan list - Use rcu to free rsb structs * tag 'dlm-6.11' of git://git.kernel.org/pub/scm/linux/kernel/git/teigland/linux-dlm: dlm: add rcu_barrier before destroy kmem cache dlm: remove DLM_LSFL_SOFTIRQ from exflags fs: dlm: remove unused struct 'dlm_processed_nodes' md-cluster: use DLM_LSFL_SOFTIRQ for dlm_new_lockspace() dlm: implement LSFL_SOFTIRQ_SAFE dlm: introduce DLM_LSFL_SOFTIRQ_SAFE dlm: use LSFL_FS to check for kernel lockspace dlm: use rcu to avoid an extra rsb struct lookup dlm: fix add_scan and del_scan usage dlm: change list and timer names dlm: move recover idr to xarray datastructure dlm: move lkb idr to xarray datastructure dlm: drop own rsb pre allocation mechanism dlm: remove ls_local_handle from struct dlm_ls dlm: remove unused parameter in dlm_midcomms_addr dlm: don't kref_init rsbs created for toss list dlm: remove scand leftovers commit 586f14a6a182bbdb9404dc66464dcd8d0ac175a3 Merge: 586a7a854234 a3c10bed330b Author: Linus Torvalds Date: Wed Jul 17 12:10:37 2024 -0700 Merge tag 'erofs-for-6.11-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/xiang/erofs Pull erofs updates from Gao Xiang: "Updates for folio conversions for compressed inodes: While large folio support for compressed data could work now, it remains disabled since the stress test could hang due to page migration in a few hours after enabling it. I need more time to investigate further before enabling this feature. Additionally, clean up stream decompressors and tracepoints for simplicity. Summary: - More folio conversions for compressed inodes - Stream decompressor (LZMA/DEFLATE/ZSTD) cleanups - Minor tracepoint cleanup" * tag 'erofs-for-6.11-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/xiang/erofs: erofs: silence uninitialized variable warning in z_erofs_scan_folio() erofs: avoid refcounting short-lived pages erofs: get rid of z_erofs_map_blocks_iter_* tracepoints erofs: tidy up stream decompressors erofs: refine z_erofs_{init,exit}_subsystem() erofs: move each decompressor to its own source file erofs: tidy up `struct z_erofs_bvec` erofs: teach z_erofs_scan_folios() to handle multi-page folios erofs: convert z_erofs_read_fragment() to folios erofs: convert z_erofs_pcluster_readmore() to folios commit 586a7a854234b0a48b0e188ad11896fd2764174f Merge: 48f8bfd4810e 769d20028f45 Author: Linus Torvalds Date: Wed Jul 17 12:00:49 2024 -0700 Merge tag 'nfsd-6.11' of git://git.kernel.org/pub/scm/linux/kernel/git/cel/linux Pull nfsd updates from Chuck Lever: "This is a light release containing optimizations, code clean-ups, and minor bug fixes. This development cycle focused on work outside of upstream kernel development: - Continuing to build upstream CI for NFSD based on kdevops - Continuing to focus on the quality of NFSD in LTS kernels - Participation in IETF nfsv4 WG discussions about NFSv4 ACLs, directory delegation, and NFSv4.2 COPY offload Notable features for v6.11 that do not come through the NFSD tree include NFS server-side support for the new pNFS NVMe layout type [RFC9561]. Functional testing for pNFS block layouts like this one has been introduced to our kdevops CI harness. Work on improving the resolution of file attribute time stamps in local filesystems is also ongoing tree-wide. As always I am grateful to NFSD contributors, reviewers, testers, and bug reporters who participated during this cycle" * tag 'nfsd-6.11' of git://git.kernel.org/pub/scm/linux/kernel/git/cel/linux: nfsd: nfsd_file_lease_notifier_call gets a file_lease as an argument gss_krb5: Fix the error handling path for crypto_sync_skcipher_setkey MAINTAINERS: Add a bugzilla link for NFSD nfsd: new netlink ops to get/set server pool_mode sunrpc: refactor pool_mode setting code nfsd: allow passing in array of thread counts via netlink nfsd: make nfsd_svc take an array of thread counts sunrpc: fix up the special handling of sv_nrpools == 1 SUNRPC: Add a trace point in svc_xprt_deferred_close NFSD: Support write delegations in LAYOUTGET lockd: Use *-y instead of *-objs in Makefile NFSD: Fix nfsdcld warning svcrdma: Handle ADDR_CHANGE CM event properly svcrdma: Refactor the creation of listener CMA ID NFSD: remove unused structs 'nfsd3_voidargs' NFSD: harden svcxdr_dupstr() and svcxdr_tmpalloc() against integer overflows commit 48f8bfd4810e5e2b5de40328aa007733ce3372e3 Merge: 51835949dda3 0aef1d41c61b Author: Linus Torvalds Date: Wed Jul 17 11:53:23 2024 -0700 Merge tag 'affs-6.11-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/kdave/linux Pull affs updates from David Sterba: - conversions of one-element arrays to flexible arrays * tag 'affs-6.11-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/kdave/linux: affs: struct slink_front: Replace 1-element array with flexible array affs: struct affs_data_head: Replace 1-element array with flexible array affs: struct affs_head: Replace 1-element array with flexible array commit 0756bec2e45b206ccb5fc3e8791c08d696dd06f7 Author: Jeff Johnson Date: Mon Jul 15 12:27:09 2024 -0700 vfio-mdev: add missing MODULE_DESCRIPTION() macros Since commit 1fffe7a34c89 ("script: modpost: emit a warning when the description is missing"), a module without a MODULE_DESCRIPTION() will result in a warning with make W=1. The following warnings are being observed in samples/vfio-mdev: WARNING: modpost: missing MODULE_DESCRIPTION() in samples/vfio-mdev/mtty.o WARNING: modpost: missing MODULE_DESCRIPTION() in samples/vfio-mdev/mdpy.o WARNING: modpost: missing MODULE_DESCRIPTION() in samples/vfio-mdev/mdpy-fb.o WARNING: modpost: missing MODULE_DESCRIPTION() in samples/vfio-mdev/mbochs.o Add the missing invocations of the MODULE_DESCRIPTION() macro to these modules. And in the case of mtty.c, remove the now redundant instance of the MODULE_INFO() macro. Signed-off-by: Jeff Johnson Link: https://lore.kernel.org/r/20240715-md-vfio-mdev-v2-1-59a4c5e924bc@quicinc.com Signed-off-by: Alex Williamson samples/vfio-mdev/mbochs.c | 1 + samples/vfio-mdev/mdpy-fb.c | 1 + samples/vfio-mdev/mdpy.c | 1 + samples/vfio-mdev/mtty.c | 2 +- 4 files changed, 4 insertions(+), 1 deletion(-) commit a0328b397f3339d8d17a6ec356e94b3c110b010c Author: Foryun Ma Date: Tue Jun 4 11:21:51 2024 +0800 cxl/core/pci: Move reading of control register to immediately before usage Relocate the reading of the DVSEC control register to immediately before usage and avoid unnecessary PCI config access from the read if DVSEC capability check, hdm_count check, or device validity check results in failure. Signed-off-by: Foryun Ma Reviewed-by: Jonathan Cameron Reviewed-by: Alison Schofield Link: https://patch.msgid.link/20240604032151.655-1-foryun.ma@jaguarmicro.com Signed-off-by: Dave Jiang drivers/cxl/core/pci.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) commit c638b130e83e4aa47031c0e51455ecc961dfdc3d Author: Naveen N Rao Date: Sun Jul 14 14:04:24 2024 +0530 MAINTAINERS: Update powerpc BPF JIT maintainers Hari Bathini has been updating and maintaining the powerpc BPF JIT since a while now. Christophe Leroy has been doing the same for 32-bit powerpc. Add them as maintainers for the powerpc BPF JIT. I am no longer actively looking into the powerpc BPF JIT. Change my role to that of a reviewer so that I can help with the odd query. Signed-off-by: Naveen N Rao Signed-off-by: Daniel Borkmann Reviewed-by: Masami Hiramatsu (Google) Acked-by: Christophe Leroy Acked-by: Hari Bathini Link: https://lore.kernel.org/bpf/24fea21d9d4458973aadd6a02bb1bf558b8bd0b2.1720944897.git.naveen@kernel.org MAINTAINERS | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) commit afcc8e1ef7bb5c14100ba3e6ccfd4baebc80242e Author: Naveen N Rao Date: Sun Jul 14 14:04:23 2024 +0530 MAINTAINERS: Update email address of Naveen I have switched to using my @kernel.org id for my contributions. Update MAINTAINERS and mailmap to reflect the same. Signed-off-by: Naveen N Rao Signed-off-by: Daniel Borkmann Reviewed-by: Masami Hiramatsu (Google) Link: https://lore.kernel.org/bpf/fb6ef126771c70538067709af69d960da3560ce7.1720944897.git.naveen@kernel.org .mailmap | 2 ++ MAINTAINERS | 6 +++--- 2 files changed, 5 insertions(+), 3 deletions(-) commit e1ef78dce9b7b0fa7f9d88bb3554441d74d33b34 Author: Puranjay Mohan Date: Mon Jul 15 17:33:27 2024 +0000 selftests/bpf: fexit_sleep: Fix stack allocation for arm64 On ARM64 the stack pointer should be aligned at a 16 byte boundary or the SPAlignmentFault can occur. The fexit_sleep selftest allocates the stack for the child process as a character array, this is not guaranteed to be aligned at 16 bytes. Because of the SPAlignmentFault, the child process is killed before it can do the nanosleep call and hence fentry_cnt remains as 0. This causes the main thread to hang on the following line: while (READ_ONCE(fexit_skel->bss->fentry_cnt) != 2); Fix this by allocating the stack using mmap() as described in the example in the man page of clone(). Remove the fexit_sleep test from the DENYLIST of arm64. Fixes: eddbe8e65214 ("selftest/bpf: Add a test to check trampoline freeing logic.") Signed-off-by: Puranjay Mohan Signed-off-by: Daniel Borkmann Link: https://lore.kernel.org/bpf/20240715173327.8657-1-puranjay@kernel.org tools/testing/selftests/bpf/DENYLIST.aarch64 | 1 - tools/testing/selftests/bpf/prog_tests/fexit_sleep.c | 8 +++++++- 2 files changed, 7 insertions(+), 2 deletions(-) commit a308996ed7c02d1cd6504ce73436ef3f1c1c75c0 Author: Christoph Hellwig Date: Thu Jul 11 09:17:03 2024 +0200 nfs: split nfs_read_folio nfs_read_folio is a bit hard to follow because it mixes highlevel logic with the actual data read. Split the latter into a helper and update the comments to be more accurate. Signed-off-by: Christoph Hellwig Signed-off-by: Anna Schumaker fs/nfs/read.c | 69 +++++++++++++++++++++++++++++++++++------------------------ 1 file changed, 41 insertions(+), 28 deletions(-) commit fada32ed6dbc748f447c8d050a961b75d946055a Author: Christoph Hellwig Date: Thu Jul 11 09:17:02 2024 +0200 nfs: pass explicit offset/count to trace events nfs_folio_length is unsafe to use without having the folio locked and a check for a NULL ->f_mapping that protects against truncations and can lead to kernel crashes. E.g. when running xfstests generic/065 with all nfs trace points enabled. Follow the model of the XFS trace points and pass in an explіcit offset and length. This has the additional benefit that these values can be more accurate as some of the users touch partial folio ranges. Fixes: eb5654b3b89d ("NFS: Enable tracing of nfs_invalidate_folio() and nfs_launder_folio()") Reported-by: Chuck Lever Signed-off-by: Christoph Hellwig Signed-off-by: Anna Schumaker fs/nfs/file.c | 5 +++-- fs/nfs/nfstrace.h | 36 ++++++++++++++++++++---------------- fs/nfs/read.c | 8 +++++--- fs/nfs/write.c | 10 +++++----- 4 files changed, 33 insertions(+), 26 deletions(-) commit 0935ee6032dfe68bd1f8ddf4c43b618d7beafc69 Author: Florian Westphal Date: Mon Jul 15 13:55:29 2024 +0200 selftests: netfilter: add test case for recent mismatch bug Without 'netfilter: nf_set_pipapo: fix initial map fill' this fails: TEST: reported issues Add two elements, flush, re-add 1s [ OK ] net,mac with reload 1s [ OK ] net,port,proto 1s [FAIL] post-add: should have returned 10.5.8.0/24 . 51-60 . 6-17 but got table inet filter { set test { type ipv4_addr . inet_service . inet_proto flags interval,timeout elements = { 10.5.7.0/24 . 51-60 . 6-17 } } } The other sets defined in the selftest do not trigger this bug, it only occurs if the first field group bitsize is smaller than the largest group bitsize. For each added element, check 'get' works and actually returns the requested range. After map has been filled, check all added ranges can still be retrieved. For each deleted element, check that 'get' fails. Based on a reproducer script from Yi Chen. Signed-off-by: Florian Westphal Reviewed-by: Stefano Brivio Signed-off-by: Pablo Neira Ayuso .../selftests/net/netfilter/nft_concat_range.sh | 76 +++++++++++++++++++++- 1 file changed, 75 insertions(+), 1 deletion(-) commit 791a615b7ad2258c560f91852be54b0480837c93 Author: Florian Westphal Date: Mon Jul 15 13:54:03 2024 +0200 netfilter: nf_set_pipapo: fix initial map fill The initial buffer has to be inited to all-ones, but it must restrict it to the size of the first field, not the total field size. After each round in the map search step, the result and the fill map are swapped, so if we have a set where f->bsize of the first element is smaller than m->bsize_max, those one-bits are leaked into future rounds result map. This makes pipapo find an incorrect matching results for sets where first field size is not the largest. Followup patch adds a test case to nft_concat_range.sh selftest script. Thanks to Stefano Brivio for pointing out that we need to zero out the remainder explicitly, only correcting memset() argument isn't enough. Fixes: 3c4287f62044 ("nf_tables: Add set type for arbitrary concatenation of ranges") Reported-by: Yi Chen Cc: Stefano Brivio Signed-off-by: Florian Westphal Reviewed-by: Stefano Brivio Signed-off-by: Pablo Neira Ayuso net/netfilter/nft_set_pipapo.c | 4 ++-- net/netfilter/nft_set_pipapo.h | 21 +++++++++++++++++++++ net/netfilter/nft_set_pipapo_avx2.c | 10 ++++++---- 3 files changed, 29 insertions(+), 6 deletions(-) commit 782161895eb4ac45cf7cfa8db375bd4766cb8299 Author: Pablo Neira Ayuso Date: Sat Jul 13 16:47:38 2024 +0200 netfilter: ctnetlink: use helper function to calculate expect ID Delete expectation path is missing a call to the nf_expect_get_id() helper function to calculate the expectation ID, otherwise LSB of the expectation object address is leaked to userspace. Fixes: 3c79107631db ("netfilter: ctnetlink: don't use conntrack/expect object addresses as id") Reported-by: zdi-disclosures@trendmicro.com Signed-off-by: Pablo Neira Ayuso net/netfilter/nf_conntrack_netlink.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) commit 332d2c1d713e232e163386c35a3ba0c1b90df83f Author: Michael Roth Date: Wed May 1 03:52:10 2024 -0500 crypto: ccp: Add the SNP_VLEK_LOAD command When requesting an attestation report a guest is able to specify whether it wants SNP firmware to sign the report using either a Versioned Chip Endorsement Key (VCEK), which is derived from chip-unique secrets, or a Versioned Loaded Endorsement Key (VLEK) which is obtained from an AMD Key Derivation Service (KDS) and derived from seeds allocated to enrolled cloud service providers (CSPs). For VLEK keys, an SNP_VLEK_LOAD SNP firmware command is used to load them into the system after obtaining them from the KDS. Add a corresponding userspace interface so to allow the loading of VLEK keys into the system. See SEV-SNP Firmware ABI 1.54, SNP_VLEK_LOAD for more details. Reviewed-by: Tom Lendacky Signed-off-by: Michael Roth Message-ID: <20240501085210.2213060-21-michael.roth@amd.com> Signed-off-by: Paolo Bonzini Documentation/virt/coco/sev-guest.rst | 19 ++++++++++++++++++ drivers/crypto/ccp/sev-dev.c | 36 +++++++++++++++++++++++++++++++++++ include/uapi/linux/psp-sev.h | 27 ++++++++++++++++++++++++++ 3 files changed, 82 insertions(+) commit 5f7c72df1ba6ba00ee163ba4049c785ac5930759 Author: Steven Rostedt (Google) Date: Mon Jul 15 14:47:45 2024 -0400 tracing: Update MAINTAINERS file Gone but never forgotten. [ Also moved Daniel's name to be consistent with the alphabetical order ] Cc: Mark Rutland Cc: Ingo Molnar Cc: Peter Zijlstra Cc: Thomas Gleixner Cc: Juri Lelli Cc: Kate Stewart Cc: Clark Williams Cc: "Luis Claudio R. Goncalves" Cc: John Kacur Signed-off-by: Steven Rostedt (Google) Link: https://lore.kernel.org/20240715144745.51d887a9@rorschach.local.home Reviewed-by: Mathieu Desnoyers Reviewed-by: Masami Hiramatsu (Google) CREDITS | 10 +++++++--- MAINTAINERS | 3 --- 2 files changed, 7 insertions(+), 6 deletions(-) commit a19ce320c379e0519b68178c596e43d1d5dda03b Author: Bartosz Golaszewski Date: Fri Jul 12 21:40:04 2024 +0200 power: sequencing: fix an invalid pointer dereference in error path We may end up calling pwrseq_target_free() on a partially initialized target object whose unit is either NULL or an ERR_PTR(). Avoid dereferencing invalid memory by adding an appropriate check to pwrseq_target_free(). Fixes: 249ebf3f65f8 ("power: sequencing: implement the pwrseq core") Reported-by: Dan Carpenter Closes: https://lore.kernel.org/linux-pm/62a3531e-9927-40f8-b587-254a2dfa47ef@stanley.mountain/ Reviewed-by: Dan Carpenter Link: https://lore.kernel.org/r/20240712194004.241939-1-brgl@bgdev.pl Signed-off-by: Bartosz Golaszewski drivers/power/sequencing/core.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) commit 0e03c643dc9389e61fa484562dae58c8d6e96d63 Author: Paolo Abeni Date: Wed Jul 17 13:25:06 2024 +0200 eth: fbnic: fix s390 build. Building the fbnic nn s390, yield a build bug: In function ‘fbnic_config_drop_mode_rcq’, inlined from ‘fbnic_enable’ at drivers/net/ethernet/meta/fbnic/fbnic_txrx.c:1836:4: ././include/linux/compiler_types.h:510:45: error: call to ‘__compiletime_assert_919’ declared with attribute error: FIELD_PREP: value too large for the field The relevant mask is 9 bits wide, and the related value is the cacheline aligned size of struct skb_shared_info. On s390 the cacheline size is 256 bytes, and skb_shared_info minimum size on 64 bits system is 320 bytes. Avoid building the driver for such arch. Reported-by: kernel test robot Link: https://lore.kernel.org/202407170432.dYJQOWVz-lkp@intel.com/ Reported-by: Nathan Chancellor Fixes: 0cb4c0a13723 ("eth: fbnic: Implement Rx queue alloc/start/stop/free") Signed-off-by: Paolo Abeni Link: https://patch.msgid.link/5dfefd3e90e77828f38e68854b171a5b8b8c6ede.1721215379.git.pabeni@redhat.com Signed-off-by: Jakub Kicinski drivers/net/ethernet/meta/Kconfig | 1 + 1 file changed, 1 insertion(+) commit df39038cd89525d465c2c8827eb64116873f141a Author: Gerald Schaefer Date: Mon Jul 15 20:04:16 2024 +0200 s390/mm: Fix VM_FAULT_HWPOISON handling in do_exception() There is no support for HWPOISON, MEMORY_FAILURE, or ARCH_HAS_COPY_MC on s390. Therefore we do not expect to see VM_FAULT_HWPOISON in do_exception(). However, since commit af19487f00f3 ("mm: make PTE_MARKER_SWAPIN_ERROR more general"), it is possible to see VM_FAULT_HWPOISON in combination with PTE_MARKER_POISONED, even on architectures that do not support HWPOISON otherwise. In this case, we will end up on the BUG() in do_exception(). Fix this by treating VM_FAULT_HWPOISON the same as VM_FAULT_SIGBUS, similar to x86 when MEMORY_FAILURE is not configured. Also print unexpected fault flags, for easier debugging. Note that VM_FAULT_HWPOISON_LARGE is not expected, because s390 cannot support swap entries on other levels than PTE level. Cc: stable@vger.kernel.org # 6.6+ Fixes: af19487f00f3 ("mm: make PTE_MARKER_SWAPIN_ERROR more general") Reported-by: Yunseong Kim Tested-by: Yunseong Kim Acked-by: Alexander Gordeev Signed-off-by: Gerald Schaefer Message-ID: <20240715180416.3632453-1-gerald.schaefer@linux.ibm.com> Signed-off-by: Vasily Gorbik arch/s390/mm/fault.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) commit 1e5597e5ff18d452cf9afa847e904f301d1ac690 Author: Shenghao Ding Date: Wed Jul 17 19:53:04 2024 +0800 ALSA: hda/tas2781: Add new quirk for Lenovo Hera2 Laptop Add new vendor_id and subsystem_id in quirk for Lenovo Hera2 Laptop. Signed-off-by: Shenghao Ding Cc: Link: https://patch.msgid.link/20240717115305.723-1-shenghao-ding@ti.com Signed-off-by: Takashi Iwai sound/pci/hda/patch_realtek.c | 1 + 1 file changed, 1 insertion(+) commit 6d834691da474ed1c648753d3d3a3ef8379fa1c1 Author: Jiri Pirko Date: Tue Jul 16 13:35:52 2024 +0200 virtio_pci_modern: remove admin queue serialization lock The admin queue operations are protected by newly introduced spin lock. To make it possible to issue parallel commands, remove the admin queue serialization lock. Signed-off-by: Jiri Pirko Message-Id: <20240716113552.80599-14-jiri@resnulli.us> Signed-off-by: Michael S. Tsirkin drivers/virtio/virtio_pci_common.h | 2 -- drivers/virtio/virtio_pci_modern.c | 5 ----- 2 files changed, 7 deletions(-) commit 4c3b54af907e709609d3d8beca92d65e2f0cfd83 Author: Jiri Pirko Date: Tue Jul 16 13:35:51 2024 +0200 virtio_pci_modern: use completion instead of busy loop to wait on admin cmd result Currently, the code waits in a busy loop on every admin virtqueue issued command to get a reply. That prevents callers from issuing multiple commands in parallel. To overcome this limitation, introduce a virtqueue event callback for admin virtqueue. For every issued command, use completion mechanism to wait on a reply. In the event callback, trigger the completion is done for every incoming reply. Alongside with that, introduce a spin lock to protect the admin virtqueue operations. Signed-off-by: Jiri Pirko Message-Id: <20240716113552.80599-13-jiri@resnulli.us> Signed-off-by: Michael S. Tsirkin drivers/virtio/virtio_pci_common.c | 13 ++++--- drivers/virtio/virtio_pci_common.h | 3 ++ drivers/virtio/virtio_pci_modern.c | 74 ++++++++++++++++++++++++++++++++------ include/linux/virtio.h | 3 ++ 4 files changed, 77 insertions(+), 16 deletions(-) commit 7090f2b5ad33e9b6ba68eb927b02e8a286d21fb4 Author: Jiri Pirko Date: Tue Jul 16 13:35:50 2024 +0200 virtio_pci_modern: pass cmd as an identification token In preparation to asynchronous admin queue processing, pass cmd pointer as a data arg to virtqueue_add_sgs(). Signed-off-by: Jiri Pirko Message-Id: <20240716113552.80599-12-jiri@resnulli.us> Signed-off-by: Michael S. Tsirkin drivers/virtio/virtio_pci_modern.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) commit b00c4150c435eed6e80ab302ae3a02a3d41460c3 Author: Jiri Pirko Date: Tue Jul 16 13:35:49 2024 +0200 virtio_pci_modern: create admin queue of queried size Don't limit the admin queue size to VIRTIO_AVQ_SGS_MAX and rather rely on the queried queue size. Signed-off-by: Jiri Pirko Message-Id: <20240716113552.80599-11-jiri@resnulli.us> Signed-off-by: Michael S. Tsirkin drivers/virtio/virtio_pci_modern.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) commit af22bbe1f4a514c80b89a27252beef033168f4e9 Author: Jiri Pirko Date: Tue Jul 16 13:35:48 2024 +0200 virtio: create admin queues alongside other virtqueues Admin virtqueue is just another virtqueue nothing that special about it. The current implementation treats it somehow separate though in terms of creation and deletion. Unify the admin virtqueue creation and deletion flows to be aligned with the rest of virtqueues, creating it from vp_find_vqs_*() helpers. Let the admin virtqueue to be deleted by vp_del_vqs() as the rest. Call vp_find_one_vq_msix() with slow_path argument being "true" to make sure that in case of limited interrupt vectors the config vector is used for admin queue. Signed-off-by: Jiri Pirko Message-Id: <20240716113552.80599-10-jiri@resnulli.us> Signed-off-by: Michael S. Tsirkin drivers/virtio/virtio.c | 28 ++--------------- drivers/virtio/virtio_pci_common.c | 43 ++++++++++++++++++++++++-- drivers/virtio/virtio_pci_common.h | 4 +-- drivers/virtio/virtio_pci_modern.c | 63 ++------------------------------------ include/linux/virtio_config.h | 4 --- 5 files changed, 46 insertions(+), 96 deletions(-) commit 89a1c435aec269d109ed46ca7bbb10fa8edf7ace Author: Jiri Pirko Date: Tue Jul 16 13:35:47 2024 +0200 virtio_pci: pass vq info as an argument to vp_setup_vq() Instead vp_setup_vq() storing vq info directly to vp_dev->vqs, let the caller provide a pointer to store the info to. This prepares vp_setup_vq() to be able to store admin queue info as well. Signed-off-by: Jiri Pirko Message-Id: <20240716113552.80599-9-jiri@resnulli.us> Signed-off-by: Michael S. Tsirkin drivers/virtio/virtio_pci_common.c | 16 ++++++++++------ 1 file changed, 10 insertions(+), 6 deletions(-) commit 7e5d9f556edca687acb04f171af1061042a35927 Author: Jiri Pirko Date: Tue Jul 16 13:35:46 2024 +0200 virtio: push out code to vp_avq_index() To prepare for the follow-up patch to use the code as an op, push out the code that gets admin virtqueue base index and count to a separate helper. Signed-off-by: Jiri Pirko Message-Id: <20240716113552.80599-8-jiri@resnulli.us> Signed-off-by: Michael S. Tsirkin drivers/virtio/virtio_pci_modern.c | 31 +++++++++++++++++++++---------- 1 file changed, 21 insertions(+), 10 deletions(-) commit 4199107e39122e49bbddafb50932943127b63aee Author: Jiri Pirko Date: Tue Jul 16 13:35:45 2024 +0200 virtio_pci_modern: treat vp_dev->admin_vq.info.vq pointer as static It is guaranteed by the virtio_pci and PCI layers that none of the VFs is probed before setup_vq() is called for admin queue and after del_vq() is called for admin queue. Therefore treat vp_dev->admin_vq.info.vq as static, don't null it and don't take cmd lock during assign. Signed-off-by: Jiri Pirko Message-Id: <20240716113552.80599-7-jiri@resnulli.us> Signed-off-by: Michael S. Tsirkin drivers/virtio/virtio_pci_common.h | 2 +- drivers/virtio/virtio_pci_modern.c | 11 +---------- 2 files changed, 2 insertions(+), 11 deletions(-) commit 06909a4427d6d57757c0a97a4a4be0aea363caab Author: Jiri Pirko Date: Tue Jul 16 13:35:44 2024 +0200 virtio_pci: introduce vector allocation fallback for slow path virtqueues If there is not enough vectors to satisfy all virtqueues, currently the fallback is to use one vector for all virtqueues. That may be unnecessary in some cases, when there is enough vectors per data queues. Introduce another fallback policy that tries to allocate vector for all data queues, however for slow path queues (control/admin) it shares config vector. Signed-off-by: Jiri Pirko Message-Id: <20240716113552.80599-6-jiri@resnulli.us> Signed-off-by: Michael S. Tsirkin drivers/virtio/virtio_pci_common.c | 53 +++++++++++++++++++++++++++++++++----- drivers/virtio/virtio_pci_common.h | 7 +++-- 2 files changed, 51 insertions(+), 9 deletions(-) commit b8b4e1a05d41c282e63a1772f00e376f6fb84410 Author: Jiri Pirko Date: Tue Jul 16 13:35:43 2024 +0200 virtio_pci: pass vector policy enum to vp_find_one_vq_msix() Instead of accessing vp_dev->per_vq_vectors, pass vector policy enum as an argument of vp_find_one_vq_msix() in preparation for another irq allocation policy. Signed-off-by: Jiri Pirko Message-Id: <20240716113552.80599-5-jiri@resnulli.us> Signed-off-by: Michael S. Tsirkin drivers/virtio/virtio_pci_common.c | 17 +++++++++-------- 1 file changed, 9 insertions(+), 8 deletions(-) commit ef775b2627c83f7c521c38fdcf972567c55e4550 Author: Jiri Pirko Date: Tue Jul 16 13:35:42 2024 +0200 virtio_pci: pass vector policy enum to vp_find_vqs_msix() In preparation for another irq allocation fallback, introduce vector policy enum and pass the values to vp_find_vqs_msix() instead of bool arg. Signed-off-by: Jiri Pirko Message-Id: <20240716113552.80599-4-jiri@resnulli.us> Signed-off-by: Michael S. Tsirkin drivers/virtio/virtio_pci_common.c | 16 +++++++++++++--- 1 file changed, 13 insertions(+), 3 deletions(-) commit 572864d45d61c69aa99461e944f43d3b95c5e159 Author: Jiri Pirko Date: Tue Jul 16 13:35:41 2024 +0200 virtio_pci: simplify vp_request_msix_vectors() call a bit Pass desc arg as it is always to vp_request_msix_vectors(). There rely on per_vq_vectors arg and null desc in case it is false. Signed-off-by: Jiri Pirko Message-Id: <20240716113552.80599-3-jiri@resnulli.us> Signed-off-by: Michael S. Tsirkin drivers/virtio/virtio_pci_common.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) commit de128f3f6317b8568311d9f9eb5e0425ebc23a03 Author: Jiri Pirko Date: Tue Jul 16 13:35:40 2024 +0200 virtio_pci: push out single vq find code to vp_find_one_vq_msix() In order to be reused for admin queue setup, push out common code to setup and configure irq for one vq into a separate helper. Signed-off-by: Jiri Pirko Message-Id: <20240716113552.80599-2-jiri@resnulli.us> Signed-off-by: Michael S. Tsirkin drivers/virtio/virtio_pci_common.c | 68 +++++++++++++++++++++++--------------- 1 file changed, 41 insertions(+), 27 deletions(-) commit e14f480df7fbcb0c84ce9142c861701495d9b6e2 Author: Dan Carpenter Date: Fri Jul 12 09:06:12 2024 -0500 vdpa/octeon_ep: Fix error code in octep_process_mbox() Return -EINVAL for invalid signatures. Don't return success. Fixes: 8b6c724cdab8 ("virtio: vdpa: vDPA driver for Marvell OCTEON DPU devices") Signed-off-by: Dan Carpenter Message-Id: <623e885b-1a05-479e-ab97-01bcf10bf5b8@stanley.mountain> Signed-off-by: Michael S. Tsirkin drivers/vdpa/octeon_ep/octep_vdpa_hw.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 69eced9eb49aa6a55c9ef5745b0826fe0b74ff0f Author: Jeff Johnson Date: Sun Jun 2 13:25:28 2024 -0700 virtio: add missing MODULE_DESCRIPTION() macro make allmodconfig && make W=1 C=1 reports: WARNING: modpost: missing MODULE_DESCRIPTION() in drivers/virtio/virtio_dma_buf.o Add the missing invocation of the MODULE_DESCRIPTION() macro. Signed-off-by: Jeff Johnson Message-Id: <20240602-md-virtio_dma_buf-v1-1-ce602d47e257@quicinc.com> Signed-off-by: Michael S. Tsirkin drivers/virtio/virtio_dma_buf.c | 1 + 1 file changed, 1 insertion(+) commit 6c85d6b653caeba2ef982925703cbb4f2b3b3163 Author: Jiri Pirko Date: Mon Jul 8 09:48:14 2024 +0200 virtio: rename virtio_find_vqs_info() to virtio_find_vqs() Since the original virtio_find_vqs() is no longer present, rename virtio_find_vqs_info() back to virtio_find_vqs(). Signed-off-by: Jiri Pirko Message-Id: <20240708074814.1739223-20-jiri@resnulli.us> Signed-off-by: Michael S. Tsirkin arch/um/drivers/virt-pci.c | 2 +- drivers/block/virtio_blk.c | 2 +- drivers/bluetooth/virtio_bt.c | 3 +-- drivers/char/virtio_console.c | 3 +-- drivers/crypto/virtio/virtio_crypto_core.c | 2 +- drivers/firmware/arm_scmi/virtio.c | 2 +- drivers/gpio/gpio-virtio.c | 4 ++-- drivers/gpu/drm/virtio/virtgpu_kms.c | 2 +- drivers/iommu/virtio-iommu.c | 4 ++-- drivers/net/virtio_net.c | 2 +- drivers/net/wireless/virtual/mac80211_hwsim.c | 4 ++-- drivers/rpmsg/virtio_rpmsg_bus.c | 2 +- drivers/scsi/virtio_scsi.c | 2 +- drivers/virtio/virtio_balloon.c | 4 ++-- drivers/virtio/virtio_input.c | 2 +- fs/fuse/virtio_fs.c | 2 +- include/linux/virtio_config.h | 10 +++++----- net/vmw_vsock/virtio_transport.c | 3 +-- sound/virtio/virtio_card.c | 2 +- 19 files changed, 27 insertions(+), 30 deletions(-) commit 3e8d51c7765dac2a70fe2ad222a8ad244c9f29a4 Author: Jiri Pirko Date: Mon Jul 8 09:48:13 2024 +0200 virtio: remove unused virtio_find_vqs() and virtio_find_vqs_ctx() helpers All callers of virtio_find_vqs() and virtio_find_vqs_ctx() were converted to use virtio_find_vqs_info(). Remove no longer used helpers. Signed-off-by: Jiri Pirko Message-Id: <20240708074814.1739223-19-jiri@resnulli.us> Signed-off-by: Michael S. Tsirkin include/linux/virtio_config.h | 32 -------------------------------- 1 file changed, 32 deletions(-) commit c95e67bac42d7e671e6a2c14548b6a7f76e71235 Author: Jiri Pirko Date: Mon Jul 8 09:48:12 2024 +0200 virtio: convert the rest virtio_find_vqs() users to virtio_find_vqs_info() Instead of passing separate names and callbacks arrays to virtio_find_vqs(), have one of virtual_queue_info structs and pass it to virtio_find_vqs_info(). Suggested-by: Xuan Zhuo Signed-off-by: Jiri Pirko Message-Id: <20240708074814.1739223-18-jiri@resnulli.us> Signed-off-by: Michael S. Tsirkin arch/um/drivers/virt-pci.c | 8 +++++--- drivers/bluetooth/virtio_bt.c | 14 +++++--------- drivers/firmware/arm_scmi/virtio.c | 11 ++++------- drivers/gpio/gpio-virtio.c | 10 +++++----- drivers/gpu/drm/virtio/virtgpu_kms.c | 9 ++++----- drivers/iommu/virtio-iommu.c | 11 +++++------ drivers/net/wireless/virtual/mac80211_hwsim.c | 14 +++++--------- drivers/rpmsg/virtio_rpmsg_bus.c | 8 +++++--- drivers/virtio/virtio_input.c | 9 +++++---- net/vmw_vsock/virtio_transport.c | 17 ++++++----------- sound/virtio/virtio_card.c | 23 ++++++++++------------- 11 files changed, 59 insertions(+), 75 deletions(-) commit 7221922da2a1eb8bbc8d6570cec1197c8f484517 Author: Jiri Pirko Date: Mon Jul 8 09:48:11 2024 +0200 virtio_balloon: convert to use virtio_find_vqs_info() Instead of passing separate names and callbacks arrays to virtio_find_vqs(), have one of virtual_queue_info structs and pass it to virtio_find_vqs_info(). Suggested-by: Xuan Zhuo Signed-off-by: Jiri Pirko Message-Id: <20240708074814.1739223-17-jiri@resnulli.us> Signed-off-by: Michael S. Tsirkin drivers/virtio/virtio_balloon.c | 34 +++++++++++++--------------------- 1 file changed, 13 insertions(+), 21 deletions(-) commit fc496dcd935c23a0b4425e34f82c2ec33c2893f6 Author: Jiri Pirko Date: Mon Jul 8 09:48:10 2024 +0200 virtiofs: convert to use virtio_find_vqs_info() Instead of passing separate names and callbacks arrays to virtio_find_vqs(), allocate one of virtual_queue_info structs and pass it to virtio_find_vqs_info(). Suggested-by: Xuan Zhuo Signed-off-by: Jiri Pirko Message-Id: <20240708074814.1739223-16-jiri@resnulli.us> Signed-off-by: Michael S. Tsirkin fs/fuse/virtio_fs.c | 22 +++++++++------------- 1 file changed, 9 insertions(+), 13 deletions(-) commit a6da214b7c9d8f1c32e1d1844c78f764db63cd48 Author: Jiri Pirko Date: Mon Jul 8 09:48:09 2024 +0200 scsi: virtio_scsi: convert to use virtio_find_vqs_info() Instead of passing separate names and callbacks arrays to virtio_find_vqs(), allocate one of virtual_queue_info structs and pass it to virtio_find_vqs_info(). Suggested-by: Xuan Zhuo Signed-off-by: Jiri Pirko Message-Id: <20240708074814.1739223-15-jiri@resnulli.us> Signed-off-by: Michael S. Tsirkin drivers/scsi/virtio_scsi.c | 32 +++++++++++++------------------- 1 file changed, 13 insertions(+), 19 deletions(-) commit c2c6325e1645b56cc5784c288686e11d649c453e Author: Jiri Pirko Date: Mon Jul 8 09:48:08 2024 +0200 virtio_net: convert to use virtio_find_vqs_info() Instead of passing separate names and callbacks arrays to virtio_find_vqs_ctx(), allocate one of virtual_queue_info structs and pass it to virtio_find_vqs_info(). Suggested-by: Xuan Zhuo Signed-off-by: Jiri Pirko Message-Id: <20240708074814.1739223-14-jiri@resnulli.us> Signed-off-by: Michael S. Tsirkin drivers/net/virtio_net.c | 34 +++++++++++++--------------------- 1 file changed, 13 insertions(+), 21 deletions(-) commit 210a70f22dd09559c2fdc0135aecdd6fe01d724e Author: Jiri Pirko Date: Mon Jul 8 09:48:07 2024 +0200 virtio_crypto: convert to use virtio_find_vqs_info() Instead of passing separate names and callbacks arrays to virtio_find_vqs(), allocate one of virtual_queue_info structs and pass it to virtio_find_vqs_info(). Suggested-by: Xuan Zhuo Signed-off-by: Jiri Pirko Message-Id: <20240708074814.1739223-13-jiri@resnulli.us> Signed-off-by: Michael S. Tsirkin drivers/crypto/virtio/virtio_crypto_core.c | 31 ++++++++++++------------------ 1 file changed, 12 insertions(+), 19 deletions(-) commit cd54c623a80bf818c72eb09051e462157d04cad4 Author: Jiri Pirko Date: Mon Jul 8 09:48:06 2024 +0200 virtio_console: convert to use virtio_find_vqs_info() Instead of passing separate names and callbacks arrays to virtio_find_vqs(), allocate one of virtual_queue_info structs and pass it to virtio_find_vqs_info(). Suggested-by: Xuan Zhuo Signed-off-by: Jiri Pirko Message-Id: <20240708074814.1739223-12-jiri@resnulli.us> Signed-off-by: Michael S. Tsirkin drivers/char/virtio_console.c | 44 ++++++++++++++++++------------------------- 1 file changed, 18 insertions(+), 26 deletions(-) commit 0c60458b1827adbd1ddf7c7dcd2c5b82a449f6df Author: Jiri Pirko Date: Mon Jul 8 09:48:05 2024 +0200 virtio_blk: convert to use virtio_find_vqs_info() Instead of passing separate names and callbacks arrays to virtio_find_vqs(), allocate one of virtual_queue_info structs and pass it to virtio_find_vqs_info(). Suggested-by: Xuan Zhuo Signed-off-by: Jiri Pirko Message-Id: <20240708074814.1739223-11-jiri@resnulli.us> Signed-off-by: Michael S. Tsirkin drivers/block/virtio_blk.c | 20 ++++++++------------ 1 file changed, 8 insertions(+), 12 deletions(-) commit b49503eaf9c74c3d0efd1e8331aba37ce3c1fd68 Author: Jiri Pirko Date: Mon Jul 8 09:48:04 2024 +0200 virtio: rename find_vqs_info() op to find_vqs() Since the original find_vqs() is no longer present, rename find_vqs_info() back to find_vqs(). Signed-off-by: Jiri Pirko Message-Id: <20240708074814.1739223-10-jiri@resnulli.us> Signed-off-by: Michael S. Tsirkin arch/um/drivers/virtio_uml.c | 2 +- drivers/platform/mellanox/mlxbf-tmfifo.c | 2 +- drivers/remoteproc/remoteproc_virtio.c | 2 +- drivers/s390/virtio/virtio_ccw.c | 2 +- drivers/virtio/virtio_mmio.c | 2 +- drivers/virtio/virtio_pci_legacy.c | 2 +- drivers/virtio/virtio_pci_modern.c | 4 ++-- drivers/virtio/virtio_vdpa.c | 2 +- include/linux/virtio_config.h | 12 ++++++------ 9 files changed, 15 insertions(+), 15 deletions(-) commit 18cd029fd7f7a85d522973f34c413a2b009255ac Author: Jiri Pirko Date: Mon Jul 8 09:48:03 2024 +0200 virtio: remove the original find_vqs() op As it is no longer used, remove it. Signed-off-by: Jiri Pirko Message-Id: <20240708074814.1739223-9-jiri@resnulli.us> Signed-off-by: Michael S. Tsirkin include/linux/virtio_config.h | 17 ----------------- 1 file changed, 17 deletions(-) commit 992648f5a61f1c9fab800fbc42dea31727cd8a55 Author: Jiri Pirko Date: Mon Jul 8 09:48:02 2024 +0200 virtio: call virtio_find_vqs_info() from virtio_find_single_vq() directly Since there are no more implementations of find_vqs() op, call virtio_find_vqs_info() from virtio_find_single_vq() directly. Signed-off-by: Jiri Pirko Message-Id: <20240708074814.1739223-8-jiri@resnulli.us> Signed-off-by: Michael S. Tsirkin include/linux/virtio_config.h | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) commit 3c93b576e038577490e8b906025e38b6fd7241b3 Author: Jiri Pirko Date: Mon Jul 8 09:48:01 2024 +0200 virtio: convert find_vqs() op implementations to find_vqs_info() Convert existing find_vqs() transport implementations to use find_vqs_info() config op. Signed-off-by: Jiri Pirko Message-Id: <20240708074814.1739223-7-jiri@resnulli.us> Signed-off-by: Michael S. Tsirkin arch/um/drivers/virtio_uml.c | 14 ++++++++------ drivers/platform/mellanox/mlxbf-tmfifo.c | 12 ++++++------ drivers/remoteproc/remoteproc_virtio.c | 14 +++++++------- drivers/s390/virtio/virtio_ccw.c | 15 +++++++-------- drivers/virtio/virtio_mmio.c | 14 +++++++------- drivers/virtio/virtio_vdpa.c | 15 +++++++-------- 6 files changed, 42 insertions(+), 42 deletions(-) commit ad9a12576bccd4cf1bbef7f8574421804cdff403 Author: Jiri Pirko Date: Mon Jul 8 09:48:00 2024 +0200 virtio_pci: convert vp_*find_vqs() ops to find_vqs_info() Convert existing vp_find_vqs() and vp_modern_find_vqs() implementations to find_vqs_info() config op. Signed-off-by: Jiri Pirko Message-Id: <20240708074814.1739223-6-jiri@resnulli.us> Signed-off-by: Michael S. Tsirkin drivers/virtio/virtio_pci_common.c | 48 +++++++++++++++++++++----------------- drivers/virtio/virtio_pci_common.h | 3 +-- drivers/virtio/virtio_pci_legacy.c | 2 +- drivers/virtio/virtio_pci_modern.c | 9 ++++--- 4 files changed, 32 insertions(+), 30 deletions(-) commit c502eb85c34e29bb185e3d15dd9b8fce8a74f303 Author: Jiri Pirko Date: Mon Jul 8 09:47:59 2024 +0200 virtio: introduce virtio_queue_info struct and find_vqs_info() config op Introduce a structure virtio_queue_info to carry name, callback and ctx together. In order to allow config implementations to accept config op with array of virtio_queue_info structures, introduce a new find_vqs_info() op. Do the needed conversion in virtio_find_vqs_ctx(). Note that whole virtio_find_vqs_ctx() is going to be eventually removed at the and of this patchset. Suggested-by: Xuan Zhuo Signed-off-by: Jiri Pirko Message-Id: <20240708074814.1739223-5-jiri@resnulli.us> Signed-off-by: Michael S. Tsirkin include/linux/virtio_config.h | 55 ++++++++++++++++++++++++++++++++++++++++--- 1 file changed, 52 insertions(+), 3 deletions(-) commit 959538c11a88298672195a0eb3289c0f2f88b02d Author: Jiri Pirko Date: Mon Jul 8 09:47:58 2024 +0200 virtio: make virtio_find_single_vq() call virtio_find_vqs() In order to prepare for conversion of virtio_find_vqs*() arguments, make virtio_find_single_vq() to call virtio_find_vqs() instead of op directly. Signed-off-by: Jiri Pirko Message-Id: <20240708074814.1739223-4-jiri@resnulli.us> Signed-off-by: Michael S. Tsirkin include/linux/virtio_config.h | 28 ++++++++++++++-------------- 1 file changed, 14 insertions(+), 14 deletions(-) commit de1177e56005dccd9729d4ca331de64f5d463b90 Author: Jiri Pirko Date: Mon Jul 8 09:47:57 2024 +0200 virtio: make virtio_find_vqs() call virtio_find_vqs_ctx() In order to prepare for conversion of virtio_find_vqs*() arguments, make virtio_find_vqs() to call virtio_find_vqs_ctx() instead of op directly. Signed-off-by: Jiri Pirko Message-Id: <20240708074814.1739223-3-jiri@resnulli.us> Signed-off-by: Michael S. Tsirkin include/linux/virtio_config.h | 15 ++++++++------- 1 file changed, 8 insertions(+), 7 deletions(-) commit 87bb477c39b172071a1cb44aef41e701d5fee90d Author: Jiri Pirko Date: Mon Jul 8 09:47:56 2024 +0200 caif_virtio: use virtio_find_single_vq() for single virtqueue finding Since caif uses only one queue, convert to virtio_find_single_vq() helper which is made for this purpose. Signed-off-by: Jiri Pirko Message-Id: <20240708074814.1739223-2-jiri@resnulli.us> Signed-off-by: Michael S. Tsirkin drivers/net/caif/caif_virtio.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) commit 256a6f430562c163f1fa07576c4cd4e996e953dd Merge: 0c3836482481 1a7b7326d587 Author: Huacai Chen Date: Wed Jul 17 17:07:11 2024 +0800 Merge tag 'asm-generic-6.11' into loongarch-next LoongArch architecture changes for 6.11 depend on the asm-generic changes to avoid confliction, so merge them to create a base. commit 3bfd7c0ba184de99e9f5083b29e5308f30767265 Author: Takashi Iwai Date: Wed Jul 17 10:33:01 2024 +0200 ALSA: seq: ump: Skip useless ports for static blocks When the UMP Endpoint is configured with static blocks, the block configuration will never change, hence the unused ports will be unchanged as well. Creating sequencer ports for those unused ports is simply useless, and it might be rather confusing for users. The idea behind the inactive ports was for allowing connections from/to ports that can become usable later, but this will never happen for inactive groups in static blocks. Let's change the sequencer UMP binding to skip those unused ports when the UMP EP is with static blocks. Fixes: 81fd444aa371 ("ALSA: seq: Bind UMP device") Cc: Link: https://patch.msgid.link/20240717083322.25892-1-tiwai@suse.de Signed-off-by: Takashi Iwai sound/core/seq/seq_ump_client.c | 16 ++++++++++++++++ 1 file changed, 16 insertions(+) commit 88e98af9f4b5b0d60c1fe7f7f2701b5467691e75 Author: Shengjiu Wang Date: Wed Jul 17 14:44:53 2024 +0800 ALSA: pcm_dmaengine: Don't synchronize DMA channel when DMA is paused When suspended, the DMA channel may enter PAUSE state if dmaengine_pause() is supported by DMA. At this state, dmaengine_synchronize() should not be called, otherwise the DMA channel can't be resumed successfully. Fixes: e8343410ddf0 ("ALSA: dmaengine: Synchronize dma channel after drop()") Signed-off-by: Shengjiu Wang Cc: Link: https://patch.msgid.link/1721198693-27636-1-git-send-email-shengjiu.wang@nxp.com Signed-off-by: Takashi Iwai sound/core/pcm_dmaengine.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) commit a503f91a3645651a39baf97f1aed90d5d9f9bda9 Author: Piotr Wojtaszczyk Date: Fri Jul 5 13:51:35 2024 +0200 mtd: rawnand: lpx32xx: Fix dma_request_chan() error checks The dma_request_chan() returns error pointer in case of error, while dma_request_channel() returns NULL in case of error therefore different error checks are needed for the two. Fixes: 7326d3fb1ee3 ("mtd: rawnand: lpx32xx: Request DMA channels using DT entries") Signed-off-by: Piotr Wojtaszczyk Cc: stable@vger.kernel.org Signed-off-by: Miquel Raynal Link: https://lore.kernel.org/linux-mtd/20240705115139.126522-1-piotr.wojtaszczyk@timesys.com drivers/mtd/nand/raw/lpc32xx_mlc.c | 2 +- drivers/mtd/nand/raw/lpc32xx_slc.c | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) commit d29e8e28d6d53b3406c214059b8e048fa950a136 Author: Cheng Ming Lin Date: Thu Jul 4 10:48:39 2024 +0800 mtd: spinand: macronix: Add support for serial NAND flash MX35{U,L}F{2,4}G24AD-Z4I8 are Macronix serial NAND flashes. Their main difference from MX35{U,L}F{2,4}G24AD lies in the plane number. The plane number for those with the postfix Z4I8 is 1. These flashes have been validated on Xilinx zynq-picozed board which include Macronix SPI Host. Signed-off-by: Cheng Ming Lin Signed-off-by: Miquel Raynal Link: https://lore.kernel.org/linux-mtd/20240704024839.241101-3-linchengming884@gmail.com drivers/mtd/nand/spi/macronix.c | 38 ++++++++++++++++++++++++++++++++++++++ 1 file changed, 38 insertions(+) commit aacbb6c837dfc0f5bba29318c590fc83a0e83f70 Author: Cheng Ming Lin Date: Thu Jul 4 10:48:38 2024 +0800 mtd: spinand: macronix: Add support for reading Device ID 2 Adding the Device ID 2 on Macronix serial NAND flash. When the number of flashes increases, we need to utilize Device ID 2 to distinguish between different flashes. These flashes have been validated on Xilinx zynq-picozed board which included Macronix SPI Host. Signed-off-by: Cheng Ming Lin Signed-off-by: Miquel Raynal Link: https://lore.kernel.org/linux-mtd/20240704024839.241101-2-linchengming884@gmail.com drivers/mtd/nand/spi/macronix.c | 26 +++++++++++++------------- 1 file changed, 13 insertions(+), 13 deletions(-) commit 4782118674600ce1b1622ea66501ff9e484360b1 Author: Piotr Wojtaszczyk Date: Thu Jun 27 17:00:28 2024 +0200 mtd: rawnand: lpx32xx: Request DMA channels using DT entries Move away from pl08x platform data towards device tree. Signed-off-by: Piotr Wojtaszczyk Signed-off-by: Miquel Raynal Link: https://lore.kernel.org/linux-mtd/20240627150046.258795-11-piotr.wojtaszczyk@timesys.com drivers/mtd/nand/raw/lpc32xx_mlc.c | 26 +++++++++++++++----------- drivers/mtd/nand/raw/lpc32xx_slc.c | 26 +++++++++++++++----------- 2 files changed, 30 insertions(+), 22 deletions(-) commit 14427d4b883159d179847f1090112221c1abc7bd Author: Rob Herring (Arm) Date: Tue Jun 25 15:56:05 2024 -0600 dt-bindings: mtd: qcom,nandc: Define properties at top-level Convention is DT schemas should define all properties at the top-level and not inside of if/then schemas. That minimizes the if/then schemas and is more future proof. There were 2 "if" schemas for "qcom,ipq806x-nand" and the "qcom,boot-partitions: true" unnecessary, so the conditional schemas can be simplified a bit. Signed-off-by: Rob Herring (Arm) Reviewed-by: Krzysztof Kozlowski Signed-off-by: Miquel Raynal Link: https://lore.kernel.org/linux-mtd/20240625215605.192260-1-robh@kernel.org .../devicetree/bindings/mtd/qcom,nandc.yaml | 38 ++++++++-------------- 1 file changed, 14 insertions(+), 24 deletions(-) commit e33df1c488d6e2b58064355651adb51901137036 Author: Wolfram Sang Date: Tue Jun 4 23:29:21 2024 +0200 mtd: rawnand: intel: use 'time_left' variable with wait_for_completion_timeout() There is a confusing pattern in the kernel to use a variable named 'timeout' to store the result of wait_for_completion_timeout() causing patterns like: timeout = wait_for_completion_timeout(...) if (!timeout) return -ETIMEDOUT; with all kinds of permutations. Use 'time_left' as a variable to make the code self explaining. Fix to the proper variable type 'unsigned long' while here. Signed-off-by: Wolfram Sang Signed-off-by: Miquel Raynal Link: https://lore.kernel.org/linux-mtd/20240604212919.5038-6-wsa+renesas@sang-engineering.com drivers/mtd/nand/raw/intel-nand-controller.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) commit bf66d81975d4240b46659ea2392fe65d83527140 Author: Wolfram Sang Date: Tue Jun 4 23:29:20 2024 +0200 mtd: rawnand: mxc: use 'time_left' variable with wait_for_completion_timeout() There is a confusing pattern in the kernel to use a variable named 'timeout' to store the result of wait_for_completion_timeout() causing patterns like: timeout = wait_for_completion_timeout(...) if (!timeout) return -ETIMEDOUT; with all kinds of permutations. Use 'time_left' as a variable to make the code self explaining. Signed-off-by: Wolfram Sang Signed-off-by: Miquel Raynal Link: https://lore.kernel.org/linux-mtd/20240604212919.5038-5-wsa+renesas@sang-engineering.com drivers/mtd/nand/raw/mxc_nand.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) commit cbbfb0b4f89733f0152c8a784a24417cd1083f52 Author: Han Xu Date: Mon May 20 12:09:15 2024 -0400 mtd: rawnand: gpmi: add iMX8QXP support. Add "fsl,imx8qxp-gpmi-nand" compatible string. iMX8QXP gpmi nand is similar to iMX7D. But it is using 4 clocks: "gpmi_io", "gpmi_apb", "gpmi_bch" and "gpmi_bch_apb". Signed-off-by: Han Xu Signed-off-by: Frank Li Signed-off-by: Miquel Raynal Link: https://lore.kernel.org/linux-mtd/20240520-gpmi_nand-v2-4-e3017e4c9da5@nxp.com drivers/mtd/nand/raw/gpmi-nand/gpmi-nand.c | 14 ++++++++++++++ drivers/mtd/nand/raw/gpmi-nand/gpmi-nand.h | 5 ++++- 2 files changed, 18 insertions(+), 1 deletion(-) commit 355235842d0a59dc329fa925218ad12a5774e4df Author: Frank Li Date: Mon May 20 12:09:14 2024 -0400 mtd: rawnand: gpmi: add 'support_edo_timing' in gpmi_devdata Introduce a boolean flag, 'support_edo_timing', within gpmi_devdata to simplify the logic check in gpmi_setup_interface(). This is made in preparation for adding support for imx8qxp gpmi. Signed-off-by: Frank Li Signed-off-by: Miquel Raynal Link: https://lore.kernel.org/linux-mtd/20240520-gpmi_nand-v2-3-e3017e4c9da5@nxp.com drivers/mtd/nand/raw/gpmi-nand/gpmi-nand.c | 6 +++++- drivers/mtd/nand/raw/gpmi-nand/gpmi-nand.h | 1 + 2 files changed, 6 insertions(+), 1 deletion(-) commit 51835949dda3783d4639cfa74ce13a3c9829de00 Merge: 0434dbe32053 77ae5e5b0072 Author: Linus Torvalds Date: Tue Jul 16 19:28:34 2024 -0700 Merge tag 'net-next-6.11' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net-next Pull networking updates from Jakub Kicinski: "Not much excitement - a handful of large patchsets (devmem among them) did not make it in time. Core & protocols: - Use local_lock in addition to local_bh_disable() to protect per-CPU resources in networking, a step closer for local_bh_disable() not to act as a big lock on PREEMPT_RT - Use flex array for netdevice priv area, ensure its cache alignment - Add a sysctl knob to allow user to specify a default rto_min at socket init time. Bit of a big hammer but multiple companies were independently carrying such patch downstream so clearly it's useful - Support scheduling transmission of packets based on CLOCK_TAI - Un-pin TCP TIMEWAIT timer to avoid it firing on CPUs later cordoned off using cpusets - Support multiple L2TPv3 UDP tunnels using the same 5-tuple address - Allow configuration of multipath hash seed, to both allow synchronizing hashing of two routers, and preventing partial accidental sync - Improve TCP compliance with RFC 9293 for simultaneous connect() - Support sending NAT keepalives in IPsec ESP in UDP states. Userspace IKE daemon had to do this before, but the kernel can better keep track of it - Support sending supervision HSR frames with MAC addresses stored in ProxyNodeTable when RedBox (i.e. HSR-SAN) is enabled - Introduce IPPROTO_SMC for selecting SMC when socket is created - Allow UDP GSO transmit from devices with no checksum offload - openvswitch: add packet sampling via psample, separating the sampled traffic from "upcall" packets sent to user space for forwarding - nf_tables: shrink memory consumption for transaction objects Things we sprinkled into general kernel code: - Power Sequencing subsystem (used by Qualcomm Bluetooth driver for QCA6390) [ Already merged separately - Linus ] - Add IRQ information in sysfs for auxiliary bus - Introduce guard definition for local_lock - Add aligned flavor of __cacheline_group_{begin, end}() markings for grouping fields in structures BPF: - Notify user space (via epoll) when a struct_ops object is getting detached/unregistered - Add new kfuncs for a generic, open-coded bits iterator - Enable BPF programs to declare arrays of kptr, bpf_rb_root, and bpf_list_head - Support resilient split BTF which cuts down on duplication and makes BTF as compact as possible WRT BTF from modules - Add support for dumping kfunc prototypes from BTF which enables both detecting as well as dumping compilable prototypes for kfuncs - riscv64 BPF JIT improvements in particular to add 12-argument support for BPF trampolines and to utilize bpf_prog_pack for the latter - Add the capability to offload the netfilter flowtable in XDP layer through kfuncs Driver API: - Allow users to configure IRQ tresholds between which automatic IRQ moderation can choose - Expand Power Sourcing (PoE) status with power, class and failure reason. Support setting power limits - Track additional RSS contexts in the core, make sure configuration changes don't break them - Support IPsec crypto offload for IPv6 ESP and IPv4 UDP-encapsulated ESP data paths - Support updating firmware on SFP modules Tests and tooling: - mptcp: use net/lib.sh to manage netns - TCP-AO and TCP-MD5: replace debug prints used by tests with tracepoints - openvswitch: make test self-contained (don't depend on OvS CLI tools) Drivers: - Ethernet high-speed NICs: - Broadcom (bnxt): - increase the max total outstanding PTP TX packets to 4 - add timestamping statistics support - implement netdev_queue_mgmt_ops - support new RSS context API - Intel (100G, ice, idpf): - implement FEC statistics and dumping signal quality indicators - support E825C products (with 56Gbps PHYs) - nVidia/Mellanox: - support HW-GRO - mlx4/mlx5: support per-queue statistics via netlink - obey the max number of EQs setting in sub-functions - AMD/Solarflare: - support new RSS context API - AMD/Pensando: - ionic: rework fix for doorbell miss to lower overhead and skip it on new HW - Wangxun: - txgbe: support Flow Director perfect filters - Ethernet NICs consumer, embedded and virtual: - Add driver for Tehuti Networks TN40xx chips - Add driver for Meta's internal NIC chips - Add driver for Ethernet MAC on Airoha EN7581 SoCs - Add driver for Renesas Ethernet-TSN devices - Google cloud vNIC: - flow steering support - Microsoft vNIC: - support page sizes other than 4KB on ARM64 - vmware vNIC: - support latency measurement (update to version 9) - VirtIO net: - support for Byte Queue Limits - support configuring thresholds for automatic IRQ moderation - support for AF_XDP Rx zero-copy - Synopsys (stmmac): - support for STM32MP13 SoC - let platforms select the right PCS implementation - TI: - icssg-prueth: add multicast filtering support - icssg-prueth: enable PTP timestamping and PPS - Renesas: - ravb: improve Rx performance 30-400% by using page pool, theaded NAPI and timer-based IRQ coalescing - ravb: add MII support for R-Car V4M - Cadence (macb): - macb: add ARP support to Wake-On-LAN - Cortina: - use phylib for RX and TX pause configuration - Ethernet switches: - nVidia/Mellanox: - support configuration of multipath hash seed - report more accurate max MTU - use page_pool to improve Rx performance - MediaTek: - mt7530: add support for bridge port isolation - Qualcomm: - qca8k: add support for bridge port isolation - Microchip: - lan9371/2: add 100BaseTX PHY support - NXP: - vsc73xx: implement VLAN operations - Ethernet PHYs: - aquantia: enable support for aqr115c - aquantia: add support for PHY LEDs - realtek: add support for rtl8224 2.5Gbps PHY - xpcs: add memory-mapped device support - add BroadR-Reach link mode and support in Broadcom's PHY driver - CAN: - add document for ISO 15765-2 protocol support - mcp251xfd: workaround for erratum DS80000789E, use timestamps to catch when device returns incorrect FIFO status - WiFi: - mac80211/cfg80211: - parse Transmit Power Envelope (TPE) data in mac80211 instead of in drivers - improvements for 6 GHz regulatory flexibility - multi-link improvements - support multiple radios per wiphy - remove DEAUTH_NEED_MGD_TX_PREP flag - Intel (iwlwifi): - bump FW API to 91 for BZ/SC devices - report 64-bit radiotap timestamp - enable P2P low latency by default - handle Transmit Power Envelope (TPE) advertised by AP - remove support for older FW for new devices - fast resume (keeping the device configured) - mvm: re-enable Multi-Link Operation (MLO) - aggregation (A-MSDU) optimizations - MediaTek (mt76): - mt7925 Multi-Link Operation (MLO) support - Qualcomm (ath10k): - LED support for various chipsets - Qualcomm (ath12k): - remove unsupported Tx monitor handling - support channel 2 in 6 GHz band - support Spatial Multiplexing Power Save (SMPS) in 6 GHz band - supprt multiple BSSID (MBSSID) and Enhanced Multi-BSSID Advertisements (EMA) - support dynamic VLAN - add panic handler for resetting the firmware state - DebugFS support for datapath statistics - WCN7850: support for Wake on WLAN - Microchip (wilc1000): - read MAC address during probe to make it visible to user space - suspend/resume improvements - TI (wl18xx): - support newer firmware versions - RealTek (rtw89): - preparation for RTL8852BE-VT support - Wake on WLAN support for WiFi 6 chips - 36-bit PCI DMA support - RealTek (rtlwifi): - RTL8192DU support - Broadcom (brcmfmac): - Management Frame Protection support (to enable WPA3) - Bluetooth: - qualcomm: use the power sequencer for QCA6390 - btusb: mediatek: add ISO data transmission functions - hci_bcm4377: add BCM4388 support - btintel: add support for BlazarU core - btintel: add support for Whale Peak2 - btnxpuart: add support for AW693 A1 chipset - btnxpuart: add support for IW615 chipset - btusb: add Realtek RTL8852BE support ID 0x13d3:0x3591" * tag 'net-next-6.11' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net-next: (1589 commits) eth: fbnic: Fix spelling mistake "tiggerring" -> "triggering" tcp: Replace strncpy() with strscpy() wifi: ath12k: fix build vs old compiler tcp: Don't access uninit tcp_rsk(req)->ao_keyid in tcp_create_openreq_child(). eth: fbnic: Write the TCAM tables used for RSS control and Rx to host eth: fbnic: Add L2 address programming eth: fbnic: Add basic Rx handling eth: fbnic: Add basic Tx handling eth: fbnic: Add link detection eth: fbnic: Add initial messaging to notify FW of our presence eth: fbnic: Implement Rx queue alloc/start/stop/free eth: fbnic: Implement Tx queue alloc/start/stop/free eth: fbnic: Allocate a netdevice and napi vectors with queues eth: fbnic: Add FW communication mechanism eth: fbnic: Add message parsing for FW messages eth: fbnic: Add register init to set PCIe/Ethernet device config eth: fbnic: Allocate core device specific structures and devlink interface eth: fbnic: Add scaffolding for Meta's NIC driver PCI: Add Meta Platforms vendor ID net/sched: cls_flower: propagate tca[TCA_OPTIONS] to NL_REQ_ATTR_CHECK ... commit 0434dbe32053d07d658165be681505120c6b1abc Merge: f8d22a3195b8 bb408dae9e73 Author: Linus Torvalds Date: Tue Jul 16 17:45:33 2024 -0700 Merge tag 'linux_kselftest-next-6.11-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/shuah/linux-kselftest Pull kselftest updates from Shuah Khan: - change resctrl test to cleanup resctrl_val() and generalize it by removing test name specific handling from the function. - several clang build failure fixes to framework and tests - add tests to verify IFS (In Field Scan) driver functionality - cleanups to remove unused variables and document changes * tag 'linux_kselftest-next-6.11-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/shuah/linux-kselftest: (33 commits) selftests: ifs: verify IFS ARRAY BIST functionality selftests: ifs: verify IFS scan test functionality selftests: ifs: verify test image loading functionality selftests: ifs: verify test interfaces are created by the driver selftests/dma:remove unused variable selftests/breakpoints:Remove unused variable selftests/x86: fix printk warnings reported by clang selftests/x86: remove (or use) unused variables and functions selftests/x86: avoid -no-pie warnings from clang during compilation selftests/x86: build sysret_rip.c with clang selftests/x86: build fsgsbase_restore.c with clang selftests: x86: test_FISTTP: use fisttps instead of ambiguous fisttp selftests/x86: fix Makefile dependencies to work with clang selftests/timers: remove unused irqcount variable selftests: Add information about TAP conformance in tests selftests/resctrl: Remove test name comparing from write_bm_pid_to_resctrl() selftests/resctrl: Remove mongrp from CMT test selftests/resctrl: Remove mongrp from MBA test selftests/resctrl: Convert ctrlgrp & mongrp to pointers selftests/resctrl: Make some strings passed to resctrlfs functions const ... commit f8d22a3195b8e2eaacbc5073ae1d5d5bb7386de9 Merge: 9de4ad3bde14 ebf51e460e48 Author: Linus Torvalds Date: Tue Jul 16 17:42:14 2024 -0700 Merge tag 'linux_kselftest-kunit-6.11-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/shuah/linux-kselftest Pull KUnit updates from Shuah Khan: - add vm_mmap() allocation resource manager - convert usercopy kselftest to KUnit - disable usercopy testing on !CONFIG_MMU - add MODULE_DESCRIPTION() to core, list, and usercopy tests - add tests for assertion formatting functions - assert.c - introduce KUNIT_ASSERT_MEMEQ and KUNIT_ASSERT_MEMNEQ macros - fix KUNIT_ASSERT_STRNEQ comments to make it clear that it is an assertion - rename KUNIT_ASSERT_FAILURE to KUNIT_FAIL_AND_ABORT * tag 'linux_kselftest-kunit-6.11-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/shuah/linux-kselftest: kunit: Introduce KUNIT_ASSERT_MEMEQ and KUNIT_ASSERT_MEMNEQ macros kunit: Rename KUNIT_ASSERT_FAILURE to KUNIT_FAIL_AND_ABORT for readability kunit: Fix the comment of KUNIT_ASSERT_STRNEQ as assertion kunit: executor: Simplify string allocation handling kunit/usercopy: Add missing MODULE_DESCRIPTION() kunit/usercopy: Disable testing on !CONFIG_MMU usercopy: Convert test_user_copy to KUnit test kunit: test: Add vm_mmap() allocation resource manager list: test: add the missing MODULE_DESCRIPTION() macro kunit: add missing MODULE_DESCRIPTION() macros to core modules list: test: remove unused struct 'klist_test_struct' kunit: Cover 'assert.c' with tests commit 9de4ad3bde144b55b8451fc280c18107c139481c Author: Linus Torvalds Date: Tue Jul 16 17:35:45 2024 -0700 firmware: qcom: tzmem: don't ask about allocator mode when not enabled The Qualcomm firmware code shouldn't ask about what memory allocator mode should be used when the code isn't even enabled. Get rid of pointless config-time question. Link: https://lore.kernel.org/all/CAHk-=wg+38EHPKGou1MqXwAAXC30cM8sMgZAGnZ7TcFO4L9J2w@mail.gmail.com/ Signed-off-by: Linus Torvalds drivers/firmware/qcom/Kconfig | 1 + 1 file changed, 1 insertion(+) commit 17e6a1213058d8759bcf043151c04612df55ebc4 Author: Linus Torvalds Date: Tue Jul 16 17:25:59 2024 -0700 um: Use generic runtime constant implementation UML should not be using the architecture native runtime constants, since that requires also having the appropriate instruction fixups (and all the linker script details). Not that using that code would be impossible, but it's not worth it. Just point UML at the generic version. Reported-by: Nathan Chancellor Fixes: e3c92e81711d ("runtime constants: add x86 architecture support") Link: https://lore.kernel.org/all/20240716143644.GA1827132@thelio-3990X/ Signed-off-by: Linus Torvalds arch/um/include/asm/Kbuild | 1 + 1 file changed, 1 insertion(+) commit 576a997c6315ee482519e7cc080f341b07638808 Merge: 4a996d90b9e0 fa0c1c9d283b Author: Linus Torvalds Date: Tue Jul 16 17:13:31 2024 -0700 Merge tag 'perf-core-2024-07-16' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull performance events updates from Ingo Molnar: - Intel PT support enhancements & fixes - Fix leaked SIGTRAP events - Improve and fix the Intel uncore driver - Add support for Intel HBM and CXL uncore counters - Add Intel Lake and Arrow Lake support - AMD uncore driver fixes - Make SIGTRAP and __perf_pending_irq() work on RT - Micro-optimizations - Misc cleanups and fixes * tag 'perf-core-2024-07-16' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: (44 commits) perf/x86/intel: Add a distinct name for Granite Rapids perf/x86/intel/ds: Fix non 0 retire latency on Raptorlake perf/x86/intel: Hide Topdown metrics events if the feature is not enumerated perf/x86/intel/uncore: Fix the bits of the CHA extended umask for SPR perf: Split __perf_pending_irq() out of perf_pending_irq() perf: Don't disable preemption in perf_pending_task(). perf: Move swevent_htable::recursion into task_struct. perf: Shrink the size of the recursion counter. perf: Enqueue SIGTRAP always via task_work. task_work: Add TWA_NMI_CURRENT as an additional notify mode. perf: Move irq_work_queue() where the event is prepared. perf: Fix event leak upon exec and file release perf: Fix event leak upon exit task_work: Introduce task_work_cancel() again task_work: s/task_work_cancel()/task_work_cancel_func()/ perf/x86/amd/uncore: Fix DF and UMC domain identification perf/x86/amd/uncore: Avoid PMU registration if counters are unavailable perf/x86/intel: Support Perfmon MSRs aliasing perf/x86/intel: Support PERFEVTSEL extension perf/x86: Add config_mask to represent EVENTSEL bitmask ... commit 4a996d90b9e046c6d59845acf00a54d464c34ff3 Merge: 0c182ac2ebc5 db43a609d01e Author: Linus Torvalds Date: Tue Jul 16 17:00:50 2024 -0700 Merge tag 'sched-core-2024-07-16' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull scheduler updates from Ingo Molnar: - Update Daniel Bristot de Oliveira's entry in MAINTAINERS, and credit him in CREDITS - Harmonize the lock-yielding behavior on dynamically selected preemption models with static ones - Reorganize the code a bit: split out sched/syscalls.c to reduce the size of sched/core.c - Micro-optimize psi_group_change() - Fix set_load_weight() for SCHED_IDLE tasks - Misc cleanups & fixes * tag 'sched-core-2024-07-16' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: sched: Update MAINTAINERS and CREDITS sched/fair: set_load_weight() must also call reweight_task() for SCHED_IDLE tasks sched/psi: Optimise psi_group_change a bit sched/core: Drop spinlocks on contention iff kernel is preemptible sched/core: Move preempt_model_*() helpers from sched.h to preempt.h sched/balance: Skip unnecessary updates to idle load balancer's flags idle: Remove stale RCU comment sched/headers: Move struct pre-declarations to the beginning of the header sched/core: Clean up kernel/sched/sched.h a bit sched/core: Simplify prefetch_curr_exec_start() sched: Fix spelling in comments sched/syscalls: Split out kernel/sched/syscalls.c from kernel/sched/core.c commit 0c182ac2ebc5470a725632b08cee9a52065bbe71 Merge: 151647ab5810 8e366d83edce Author: Linus Torvalds Date: Tue Jul 16 16:55:33 2024 -0700 Merge tag 'objtool-core-2024-07-16' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull objtool updates from Ingo Molnar: - Fix bug that caused objtool to confuse certain memory ops added by KASAN instrumentation as stack accesses - Various faddr2line optimizations - Improve error messages * tag 'objtool-core-2024-07-16' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: objtool/x86: objtool can confuse memory and stack access objtool: Use "action" in error message to be consistent with help scripts/faddr2line: Check only two symbols when calculating symbol size scripts/faddr2line: Remove call to addr2line from find_dir_prefix() scripts/faddr2line: Invoke addr2line as a single long-running process scripts/faddr2line: Pass --addresses argument to addr2line scripts/faddr2line: Check vmlinux only once scripts/faddr2line: Combine three readelf calls into one scripts/faddr2line: Reduce number of readelf calls to three commit 151647ab581013b482893d4e2218cd29b005cd6b Merge: 923a327e8f22 e81859fe64ad Author: Linus Torvalds Date: Tue Jul 16 16:42:37 2024 -0700 Merge tag 'locking-core-2024-07-15' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull locking updates from Ingo Molnar: - Jump label fixes, including a perf events fix that originally manifested as jump label failures, but was a serialization bug at the usage site - Mark down_write*() helpers as __always_inline, to improve WCHAN debuggability - Misc cleanups and fixes * tag 'locking-core-2024-07-15' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: locking/rwsem: Add __always_inline annotation to __down_write_common() and inlined callers jump_label: Simplify and clarify static_key_fast_inc_cpus_locked() jump_label: Clarify condition in static_key_fast_inc_not_disabled() jump_label: Fix concurrency issues in static_key_slow_dec() perf/x86: Serialize set_attr_rdpmc() cleanup: Standardize the header guard define's name commit 923a327e8f2257ab7cd5485cb5d8db92c965dfca Merge: 41906248d0d7 b77b0bc85b11 Author: Linus Torvalds Date: Tue Jul 16 16:19:36 2024 -0700 Merge tag 'acpi-6.11-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm Pull ACPI updates from Rafael Wysocki: "The only kind of new feature added by these is the hwmon interface support in the ACPI fan driver. Apart from that, they mostly address issues and clean up code. Specifics: - Switch the ACPI x86 utility code and the ACPI LPSS driver to new Intel CPU model defines (Tony Luck) - Add hwmon interface support to the ACPI fan driver (Armin Wolf) - Add sysfs entry for guaranteed performance to the ACPI CPPC library and replace a ternary operator with umax() in it (Petr Tesařík, Prabhakar Pujeri) - Clean up the ACPI PMIC driver in multiple ways (Andy Shevchenko, Christophe JAILLET) - Add support for charge limiting state to the ACPI battery driver and update _OSC to indicate support for it (Armin Wolf) - Clean up the sysfs interface in the ACPI battery, SBS (smart battery subsystem) and AC drivers (Thomas Weißschuh) - Coordinate header includes in the ACPI NUMA code and make it use ACCESS_COORDINATE_CPU when appropriate (Huang Ying, Thorsten Blum) - Downgrade Intel _OSC and _PDC messages in the ACPI processor driver to debug to reduce log noise (Mario Limonciello) - Still evaluate _OST when _PUR evaluation fails in the ACPI PAD (processor aggregator) driver as per the spec (Armin Wolf) - Skip ACPI IRQ override on Asus Vivobook Pro N6506MJ and N6506MU platforms (Tamim Khan) - Force native mode on some T2 macbooks in the ACPI backlight driver and replace strcpy() with strscpy() in it (Orlando Chamberlain, Muhammad Qasim Abdul Majeed) - Add missing MODULE_DESCRIPTION() macros in two places (Jeff Johnson)" * tag 'acpi-6.11-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm: (26 commits) ACPI: resource: Skip IRQ override on Asus Vivobook Pro N6506MJ ACPI: video: force native for some T2 macbooks ACPI: video: Use strscpy() instead of strcpy() ACPI: CPPC: Replace ternary operator with umax() ACPI: resource: Skip IRQ override on Asus Vivobook Pro N6506MU ACPI: PMIC: Constify struct pmic_table ACPI: bus: Indicate support for battery charge limiting thru _OSC ACPI: battery: Add support for charge limiting state ACPI: processor: Downgrade Intel _OSC and _PDC messages to debug ACPI: SBS: manage alarm sysfs attribute through psy core ACPI: battery: create alarm sysfs attribute atomically ACPI: battery: use sysfs_emit over sprintf ACPI: battery: constify powersupply properties ACPI: SBS: constify powersupply properties ACPI: AC: constify powersupply properties ACPI: PMIC: Replace open coded be16_to_cpu() ACPI: PMIC: Convert pr_*() to dev_*() printing macros ACPI: PMIC: Use sizeof() instead of hard coded value ACPI: NUMA: Consolidate header includes ACPI: CPPC: add sysfs entry for guaranteed performance ... commit 41906248d0d78e3a620a86cf715f6f630912a4eb Merge: 15114e8fb58f a02bed4183c4 Author: Linus Torvalds Date: Tue Jul 16 15:54:03 2024 -0700 Merge tag 'pm-6.11-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm Pull power management updates from Rafael Wysocki: "These add a new cpufreq driver for Loongson-3, add support for new features in the intel_pstate (Lunar Lake and Arrow Lake platforms, OOB mode for Emerald Rapids, highest performance change interrupt), amd-pstate (fast CPPC) and sun50i (Allwinner H700 speed bin) cpufreq drivers, simplify the cpufreq driver interface, simplify the teo cpuidle governor, adjust the pm-graph utility for a new version of Python, address issues and clean up code. Specifics: - Add Loongson-3 CPUFreq driver support (Huacai Chen) - Add support for the Arrow Lake and Lunar Lake platforms and the out-of-band (OOB) mode on Emerald Rapids to the intel_pstate cpufreq driver, make it support the highest performance change interrupt and clean it up (Srinivas Pandruvada) - Switch cpufreq to new Intel CPU model defines (Tony Luck) - Simplify the cpufreq driver interface by switching the .exit() driver callback to the void return data type (Lizhe, Viresh Kumar) - Make cpufreq_boost_enabled() return bool (Dhruva Gole) - Add fast CPPC support to the amd-pstate cpufreq driver, address multiple assorted issues in it and clean it up (Perry Yuan, Mario Limonciello, Dhananjay Ugwekar, Meng Li, Xiaojian Du) - Add Allwinner H700 speed bin to the sun50i cpufreq driver (Ryan Walklin) - Fix memory leaks and of_node_put() usage in the sun50i and qcom-nvmem cpufreq drivers (Javier Carrasco) - Clean up the sti and dt-platdev cpufreq drivers (Jeff Johnson, Raphael Gallais-Pou) - Fix deferred probe handling in the TI cpufreq driver and wrong return values of ti_opp_supply_probe(), and add OPP tables for the AM62Ax and AM62Px SoCs to it (Bryan Brattlof, Primoz Fiser) - Avoid overflow of target_freq in .fast_switch() in the SCMI cpufreq driver (Jagadeesh Kona) - Use dev_err_probe() in every error path in probe in the Mediatek cpufreq driver (Nícolas Prado) - Fix kernel-doc param for longhaul_setstate in the longhaul cpufreq driver (Yang Li) - Fix system resume handling in the CPPC cpufreq driver (Riwen Lu) - Improve the teo cpuidle governor and clean up leftover comments from the menu cpuidle governor (Christian Loehle) - Clean up a comment typo in the teo cpuidle governor (Atul Kumar Pant) - Add missing MODULE_DESCRIPTION() macro to cpuidle haltpoll (Jeff Johnson) - Switch the intel_idle driver to new Intel CPU model defines (Tony Luck) - Switch the Intel RAPL driver new Intel CPU model defines (Tony Luck) - Simplify if condition in the idle_inject driver (Thorsten Blum) - Fix missing cleanup on error in _opp_attach_genpd() (Viresh Kumar) - Introduce an OF helper function to inform if required-opps is used and drop a redundant in-parameter to _set_opp_level() (Ulf Hansson) - Update pm-graph to v5.12 which includes fixes and major code revamp for python3.12 (Todd Brandt) - Address several assorted issues in the cpupower utility (Roman Storozhenko)" * tag 'pm-6.11-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm: (77 commits) cpufreq: sti: fix build warning cpufreq: mediatek: Use dev_err_probe in every error path in probe cpufreq: Add Loongson-3 CPUFreq driver support cpufreq: Make cpufreq_driver->exit() return void cpufreq/amd-pstate: Fix the scaling_max_freq setting on shared memory CPPC systems cpufreq/amd-pstate-ut: Convert nominal_freq to khz during comparisons cpufreq: pcc: Remove empty exit() callback cpufreq: loongson2: Remove empty exit() callback cpufreq: nforce2: Remove empty exit() callback cpupower: fix lib default installation path cpufreq: docs: Add missing scaling_available_frequencies description cpuidle: teo: Don't count non-existent intercepts cpupower: Disable direct build of the 'bench' subproject cpuidle: teo: Remove recent intercepts metric Revert: "cpuidle: teo: Introduce util-awareness" cpufreq: make cpufreq_boost_enabled() return bool cpufreq: intel_pstate: Support highest performance change interrupt x86/cpufeatures: Add HWP highest perf change feature flag Documentation: cpufreq: amd-pstate: update doc for Per CPU boost control method cpufreq: amd-pstate: Cap the CPPC.max_perf to nominal_perf if CPB is off ... commit 15114e8fb58ffd574da83951e89cb5ab0055cc1e Merge: 42b5a01596f1 281cfec53b44 Author: Linus Torvalds Date: Tue Jul 16 15:47:19 2024 -0700 Merge tag 'thermal-6.11-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm Pull thermal control updates from Rafael Wysocki: "These add some new hardware support (notably, the Lunar Lake platform support in int340x and X1E80100 temperature sensor), continue to rework the thermal driver interface to eliminate trip point IDs from it, update DT bindings for a number of platforms and simplify probe in a number of thermal drivers, address issues and clean up code. Specifics: - Add DLVR and MSI interrupt support for the Lunar Lake platform to the int340x thermal driver (Srinivas Pandruvada) - Enable workload type hints (WLT) support and power floor interrupt support for the Lunar Lake platform in int340x ((Srinivas Pandruvada) - Switch Intel thermal drivers to new Intel CPU model defines (Tony Luck) - Clean up the int3400 and int3403 drivers (Erick Archer and David Alan Gilbert) - Improve intel_pch_thermal kernel log messages printed during suspend to idle (Zhang Rui) - Make the intel_tcc_cooling driver use a model-specific bitmask for TCC offset (Ricardo Neri) - Redesign the .set_trip_temp() thermal zone callback to take a trip pointer instead of a trip ID and update its users (Rafael Wysocki) - Avoid using invalid combinations of polling_delay and passive_delay thermal zone parameters (Rafael Wysocki) - Update a cooling device registration function to take a const argument (Krzysztof Kozlowski) - Make the uniphier thermal driver use thermal_zone_for_each_trip() for walking trip points (Rafael Wysocki) - Fix and clean up several minor shortcomings in thermal debug (Rafael Wysocki) - Rename __thermal_zone_set_trips() to thermal_zone_set_trips() and make it use trip thresholds (Rafael Wysocki) - Use READ_ONCE() for lockless access to trip temperature and hysteresis (Rafael Wysocki) - Drop unnecessary cooling device target state checks from the Bang-Bang thermal governor (Rafael Wysocki) - Avoid invoking thermal governor .trip_crossed() callback for critical and hot trip points (Rafael Wysocki) - Group all Renesas drivers inside a dedicated sub directory and add the missing dependency to OF (Niklas Söderlund) - Add suspend/resume support on k3_j72xx_bandgap and take the opportunity to remove an unneeded delay in the init time code path (Théo Lebrun) - Fix thermal zone definition for MT8186 and MT8188 (Julien Panis) - Convert hisilicon-thermal.txt to dt-schema (Abdulrasaq Lawani) - Add DT bindings for the X1E80100 temperature sensor (Abel Vesa) - Fix the thermal zone node name regular expression in the DT schema (Krzysztof Kozlowski) - Avoid failing thermal control initialization by using default values on some platforms where calibration data is missing (Chen-Yu Tsai) - Fix the sensor cell size in DT for the Exynos platform (Krzysztof Kozlowski) - Bring the common definition of '#thermal-sensor-cells' property in order to simplify the bindings on all the platforms where this change makes sense and do some minor cleanups (Krzysztof Kozlowski) - Fix a race between removal and clock disable in the broadcom thermal driver (Krzysztof Kozlowski) - Drop 'trips' DT node as required from the thermal zone bindings in order to fix the remaining warnings appearing for thermal zones without trip points (Rob Herring) - Simplify all the drivers where dev_err_probe() can apply (Krzysztof Kozlowski) - Clean up code related to stih416 as this platform is not described anywhere (Raphael Gallais-Pou)" * tag 'thermal-6.11-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm: (81 commits) thermal/drivers/sti: Cleanup code related to stih416 thermal/drivers/generic-adc: Simplify with dev_err_probe() thermal/drivers/generic-adc: Simplify probe() with local dev variable thermal/drivers/qcom-tsens: Simplify with dev_err_probe() thermal/drivers/qcom-spmi-adc-tm5: Simplify with dev_err_probe() thermal/drivers/imx: Simplify with dev_err_probe() thermal/drivers/imx: Simplify probe() with local dev variable thermal/drivers/hisi: Simplify with dev_err_probe() thermal/drivers/exynos: Simplify with dev_err_probe() thermal/drivers/exynos: Simplify probe() with local dev variable thermal/drivers/broadcom: Simplify with dev_err_probe() thermal/drivers/broadcom: Simplify probe() with local dev variable thermal/drivers/broadcom: Fix race between removal and clock disable dt-bindings: thermal: Drop 'trips' node as required dt-bindings: thermal: qoriq: reference thermal-sensor schema dt-bindings: thermal: cleanup examples indentation dt-bindings: thermal: simplify few bindings dt-bindings: thermal: ti,j72xx: reference thermal-sensor schema dt-bindings: thermal: ti,am654: reference thermal-sensor schema dt-bindings: thermal: st,stm32: reference thermal-sensor schema ... commit 42b5a01596f1f9471b58a2f59e1fceeb8db79ffc Merge: 11ab4cd5ec3f e86cac0acdb1 Author: Linus Torvalds Date: Tue Jul 16 14:56:13 2024 -0700 Merge tag 'Smack-for-6.10' of https://github.com/cschaufler/smack-next Pull smack updates from Casey Schaufler: "Two fixes for Smack networking labeling by Konstantin Andreev" * tag 'Smack-for-6.10' of https://github.com/cschaufler/smack-next: smack: unix sockets: fix accept()ed socket label smack: tcp: ipv4, fix incorrect labeling commit 11ab4cd5ec3f5f531ca0cb3014b7c6869c4aea5d Merge: dad8d1a383a8 dd44477e7fa1 Author: Linus Torvalds Date: Tue Jul 16 14:50:44 2024 -0700 Merge tag 'lsm-pr-20240715' of git://git.kernel.org/pub/scm/linux/kernel/git/pcmoore/lsm Pull lsm updates from Paul Moore: "Two LSM patches focused on cleaning up the inode xattr capability handling" * tag 'lsm-pr-20240715' of git://git.kernel.org/pub/scm/linux/kernel/git/pcmoore/lsm: selinux,smack: remove the capability checks in the removexattr hooks lsm: fixup the inode xattr capability handling commit dad8d1a383a8a2123be2a067098fa25afa2ddad7 Merge: f8a8b94d0698 e123134b39dc Author: Linus Torvalds Date: Tue Jul 16 14:43:28 2024 -0700 Merge tag 'selinux-pr-20240715' of git://git.kernel.org/pub/scm/linux/kernel/git/pcmoore/selinux Pull selinux update from Paul Moore: "A single SELinux patch to change the type of a pre-processor constant to better match its use" * tag 'selinux-pr-20240715' of git://git.kernel.org/pub/scm/linux/kernel/git/pcmoore/selinux: selinux: Use 1UL for EBITMAP_BIT to match maps type commit f8a8b94d0698ccc56c44478169c91ca774540d9f Merge: ce5a51bfacf7 acc154691fc7 Author: Linus Torvalds Date: Tue Jul 16 14:24:29 2024 -0700 Merge tag 'sysctl-6.11-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/sysctl/sysctl Pull sysctl updates from Joel Granados: - Remove "->procname == NULL" check when iterating through sysctl table arrays Removing sentinels in ctl_table arrays reduces the build time size and runtime memory consumed by ~64 bytes per array. With all ctl_table sentinels gone, the additional check for ->procname == NULL that worked in tandem with the ARRAY_SIZE to calculate the size of the ctl_table arrays is no longer needed and has been removed. The sysctl register functions now returns an error if a sentinel is used. - Preparation patches for sysctl constification Constifying ctl_table structs prevents the modification of proc_handler function pointers as they would reside in .rodata. The ctl_table arguments in sysctl utility functions are const qualified in preparation for a future treewide proc_handler argument constification commit. - Misc fixes Increase robustness of set_ownership by providing sane default ownership values in case the callee doesn't set them. Bound check proc_dou8vec_minmax to avoid loading buggy modules and give sysctl testing module a name to avoid compiler complaints. * tag 'sysctl-6.11-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/sysctl/sysctl: sysctl: Warn on an empty procname element sysctl: Remove ctl_table sentinel code comments sysctl: Remove "child" sysctl code comments sysctl: Remove superfluous empty allocations from sysctl internals sysctl: Replace nr_entries with ctl_table_size in new_links sysctl: Remove check for sentinel element in ctl_table arrays mm profiling: Remove superfluous sentinel element from ctl_table locking: Remove superfluous sentinel element from kern_lockdep_table sysctl: Add module description to sysctl-testing sysctl: constify ctl_table arguments of utility function utsname: constify ctl_table arguments of utility function sysctl: move the extra1/2 boundary check of u8 to sysctl_check_table_array sysctl: always initialize i_uid/i_gid commit ce5a51bfacf7a2953f8fa309a8fc8540c2e288da Merge: 8050258bd1ee 872bb37f6829 Author: Linus Torvalds Date: Tue Jul 16 13:45:43 2024 -0700 Merge tag 'hardening-v6.11-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/kees/linux Pull hardening updates from Kees Cook: - lkdtm/bugs: add test for hung smp_call_function_single() (Mark Rutland) - gcc-plugins: Remove duplicate included header file stringpool.h (Thorsten Blum) - ARM: Remove address checking for MMUless devices (Yanjun Yang) - randomize_kstack: Clean up per-arch entropy and codegen - KCFI: Make FineIBT mode Kconfig selectable - fortify: Do not special-case 0-sized destinations * tag 'hardening-v6.11-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/kees/linux: randomize_kstack: Improve stack alignment codegen ARM: Remove address checking for MMUless devices gcc-plugins: Remove duplicate included header file stringpool.h randomize_kstack: Remove non-functional per-arch entropy filtering fortify: Do not special-case 0-sized destinations x86/alternatives: Make FineIBT mode Kconfig selectable lkdtm/bugs: add test for hung smp_call_function_single() commit 8050258bd1eed0f77dd7e3fa15feb23bbcc38e63 Merge: 1ca995edf838 9b3c13c9ea4e Author: Linus Torvalds Date: Tue Jul 16 13:35:07 2024 -0700 Merge tag 'pstore-v6.11-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/kees/linux Pull pstore updates from Kees Cook: - Add missing MODULE_DESCRIPTION() macro (Jeff Johnson) - Replace deprecated strncpy() with strscpy() (Justin Stitt) * tag 'pstore-v6.11-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/kees/linux: pstore: platform: add missing MODULE_DESCRIPTION() macro pstore/blk: replace deprecated strncpy with strscpy commit 1ca995edf838a70c7c0aba2de7fc6da57e22cbf3 Merge: 72fda6c8e553 f0c508faea64 Author: Linus Torvalds Date: Tue Jul 16 13:12:16 2024 -0700 Merge tag 'seccomp-v6.11-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/kees/linux Pull seccomp updates from Kees Cook: - interrupt SECCOMP_IOCTL_NOTIF_RECV when all users exit (Andrei Vagin) - Update selftests to check for expected NOTIF_RECV exits (Andrei Vagin) * tag 'seccomp-v6.11-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/kees/linux: selftests/seccomp: check that a zombie leader doesn't affect others selftests/seccomp: add test for NOTIF_RECV and unused filters seccomp: release task filters when the task exits seccomp: interrupt SECCOMP_IOCTL_NOTIF_RECV when all users have exited commit 72fda6c8e553699f6ba8d3ddc34f0bbe7a5898df Merge: f83e38fc9f10 21f931083060 Author: Linus Torvalds Date: Tue Jul 16 12:59:20 2024 -0700 Merge tag 'execve-v6.11-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/kees/linux Pull execve updates from Kees Cook: - Use value of kernel.randomize_va_space once per exec (Alexey Dobriyan) - Honor PT_LOAD alignment for static PIE - Make bprm->argmin only visible under CONFIG_MMU - Add KUnit testing of bprm_stack_limits() * tag 'execve-v6.11-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/kees/linux: exec: Avoid pathological argc, envc, and bprm->p values execve: Keep bprm->argmin behind CONFIG_MMU ELF: fix kernel.randomize_va_space double read exec: Add KUnit test for bprm_stack_limits() binfmt_elf: Honor PT_LOAD alignment for static PIE binfmt_elf: Calculate total_size earlier selftests/exec: Build both static and non-static load_address tests commit f83e38fc9f1092f8a7a65ff2ea6a1ea6502efaf0 Merge: e55037c879a0 9fe6a8c5b247 Author: Linus Torvalds Date: Tue Jul 16 12:30:57 2024 -0700 Merge tag 'for-linus-6.11-rc1-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/xen/tip Pull xen updates from Juergen Gross: - some trivial cleanups - a fix for the Xen timer - add boot time selectable debug capability to the Xen multicall handling - two fixes for the recently added Xen irqfd handling * tag 'for-linus-6.11-rc1-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/xen/tip: x86/xen: remove deprecated xen_nopvspin boot parameter x86/xen: eliminate some private header files x86/xen: make some functions static xen: make multicall debug boot time selectable xen/arm: Convert comma to semicolon xen: privcmd: Fix possible access to a freed kirqfd instance xen: privcmd: Switch from mutex to spinlock for irqfds xen: add missing MODULE_DESCRIPTION() macros x86/xen: Convert comma to semicolon x86/xen/time: Reduce Xen timer tick xen/manage: Constify struct shutdown_handler commit e55037c879a087a57d775e848a58430ab3380fc1 Merge: d80f2996b850 4a2ebb082297 Author: Linus Torvalds Date: Tue Jul 16 12:22:07 2024 -0700 Merge tag 'efi-next-for-v6.11' of git://git.kernel.org/pub/scm/linux/kernel/git/efi/efi Pull EFI updates from Ard Biesheuvel: "Note the removal of the EFI fake memory map support - this is believed to be unused and no longer worth supporting. However, we could easily bring it back if needed. With recent developments regarding confidential VMs and unaccepted memory, combined with kexec, creating a known inaccurate view of the firmware's memory map and handing it to the OS is a feature we can live without, hence the removal. Alternatively, I could imagine making this feature mutually exclusive with those confidential VM related features, but let's try simply removing it first. Summary: - Drop support for the 'fake' EFI memory map on x86 - Add an SMBIOS based tweak to the EFI stub instructing the firmware on x86 Macbook Pros to keep both GPUs enabled - Replace 0-sized array with flexible array in EFI memory attributes table handling - Drop redundant BSS clearing when booting via the native PE entrypoint on x86 - Avoid returning EFI_SUCCESS when aborting on an out-of-memory condition - Cosmetic tweak for arm64 KASLR loading logic" * tag 'efi-next-for-v6.11' of git://git.kernel.org/pub/scm/linux/kernel/git/efi/efi: efi: Replace efi_memory_attributes_table_t 0-sized array with flexible array efi: Rename efi_early_memdesc_ptr() to efi_memdesc_ptr() arm64/efistub: Clean up KASLR logic x86/efistub: Drop redundant clearing of BSS x86/efistub: Avoid returning EFI_SUCCESS on error x86/efistub: Call Apple set_os protocol on dual GPU Intel Macs x86/efistub: Enable SMBIOS protocol handling for x86 efistub/smbios: Simplify SMBIOS enumeration API x86/efi: Drop support for fake EFI memory maps commit d80f2996b8502779c39221a9e7c9ea7e361c0ae4 Merge: a5db8e4544a4 1a7b7326d587 Author: Linus Torvalds Date: Tue Jul 16 12:09:03 2024 -0700 Merge tag 'asm-generic-6.11' of git://git.kernel.org/pub/scm/linux/kernel/git/arnd/asm-generic Pull asm-generic updates from Arnd Bergmann: "Most of this is part of my ongoing work to clean up the system call tables. In this bit, all of the newer architectures are converted to use the machine readable syscall.tbl format instead in place of complex macros in include/uapi/asm-generic/unistd.h. This follows an earlier series that fixed various API mismatches and in turn is used as the base for planned simplifications. The other two patches are dead code removal and a warning fix" * tag 'asm-generic-6.11' of git://git.kernel.org/pub/scm/linux/kernel/git/arnd/asm-generic: vmlinux.lds.h: catch .bss..L* sections into BSS") fixmap: Remove unused set_fixmap_offset_io() riscv: convert to generic syscall table openrisc: convert to generic syscall table nios2: convert to generic syscall table loongarch: convert to generic syscall table hexagon: use new system call table csky: convert to generic syscall table arm64: rework compat syscall macros arm64: generate 64-bit syscall.tbl arm64: convert unistd_32.h to syscall.tbl format arc: convert to generic syscall table clone3: drop __ARCH_WANT_SYS_CLONE3 macro kbuild: add syscall table generation to scripts/Makefile.asm-headers kbuild: verify asm-generic header list loongarch: avoid generating extra header files um: don't generate asm/bpf_perf_event.h csky: drop asm/gpio.h wrapper syscalls: add generic scripts/syscall.tbl commit a5db8e4544a4dc7143f30a1438686a4d5fa6d775 Merge: a9a4cd9c3397 dead06c5e110 Author: Linus Torvalds Date: Tue Jul 16 12:03:39 2024 -0700 Merge tag 'soc-arm-6.11' of git://git.kernel.org/pub/scm/linux/kernel/git/soc/soc Pull arm SoC platform updates from Arnd Bergmann: "The majority of the updates here are Dmitry Torokhov's cleanups for platform code in the pxa and tegra platforms, changing custom platform_data structures into DT-compatible software node declarations. The other updates are for the MAINTAINERS file, correcting some stale or missing entries" * tag 'soc-arm-6.11' of git://git.kernel.org/pub/scm/linux/kernel/git/soc/soc: ARM: pxa: fix build breakage on PXA3xx ti: omap: MAINTAINERS: move Benoît Cousson to CREDITS amazon: MAINTAINERS: change to odd fixes and Tsahee Zidenberg to CREDITS MAINTAINERS: thead: add git tree ARM: spitz: Use software nodes for the ADS7846 touchscreen ARM: spitz: Use software nodes to describe LED GPIOs ARM: spitz: Use software nodes to describe MMC GPIOs ARM: spitz: Use software nodes to describe LCD GPIOs ARM: spitz: Use software nodes to describe audio GPIOs ARM: spitz: Use software nodes to describe SPI CS lines ARM: spitz: Simplify instantiating SPI controller ARM: pxa/gumstix: convert vbus gpio to use software nodes ARM: pxa: consolidate GPIO chip platform data ARM: spitz: fix GPIO assignment for backlight ARM: tegra: paz00: Use software nodes to describe GPIOs for WiFi rfkill MAINTAINERS: ARM: airoha: add entry to cover Airoha SoC bus: vexpress-config: Add missing MODULE_DESCRIPTION() macro arm64: layerscape: remove redundant EDAC_SUPPORT selection dt-bindings: arm: Remove obsolete RTSM DCSCB binding arm: vexpress: Remove obsolete RTSM DCSCB support commit a9a4cd9c3397109c2799cb765ab0d3959831a248 Merge: e3950967f6e6 05a01ce77349 Author: Linus Torvalds Date: Tue Jul 16 11:56:15 2024 -0700 Merge tag 'soc-defconfig-6.11' of git://git.kernel.org/pub/scm/linux/kernel/git/soc/soc Pull SoC defconfig updates from Arnd Bergmann: "These are the usual updates to enable newly added drivers, mostly for arm64 and riscv this time" * tag 'soc-defconfig-6.11' of git://git.kernel.org/pub/scm/linux/kernel/git/soc/soc: arm64: defconfig: Enable the IWLWIFI driver ARM: multi_v7_defconfig: Add MCP23S08 pinctrl support arm64: defconfig: Enable NVIDIA CoreSight PMU driver arm64: defconfig: enable SHM Bridge support for the TZ memory allocator arm64: defconfig: Enable secure QFPROM driver ARM: imx_v6_v7_defconfig: enable DRM_SII902X and DRM_DISPLAY_CONNECTOR ARM: imx_v6_v7_defconfig: Enable drivers for TQMa7x/MBa7x riscv: defconfig: Enable StarFive JH7110 drivers arm64: defconfig: Enable TI LP873X PMIC arm64: defconfig: Enable USB2 PHY Driver arm64: defconfig: Enable MTD support for Hyperbus ARM: configs: at91: Enable LVDS serializer support arm64: defconfig: enable several Qualcomm interconnects arm64: defconfig: Enable Marvell 88Q2XXX PHY support arm64: defconfig: make CONFIG_INTERCONNECT_QCOM_SM8350 built-in arm64: defconfig: enable CONFIG_SM_GPUCC_8350 arm64: defconfig: Enable Renesas R-Car Gen4 PCIe controller commit e3950967f6e6b74a3606739ec50ed19f3398c7d8 Merge: cc0f7c3f97bc 48d224558645 Author: Linus Torvalds Date: Tue Jul 16 11:43:51 2024 -0700 Merge tag 'soc-dt-6.11' of git://git.kernel.org/pub/scm/linux/kernel/git/soc/soc Pull SoC dt updates from Arnd Bergmann: "The devicetree updates are fairly well spread out across platforms, with Qualcomm making up about a third of the total. There are three new SoCs in existing product families this: - NXP i.MX95 is a variant of i.MX93, now with six Cortex-A55 cores instead of just two as well as a GPU and more high-speed I/O devices. - Qualcomm QCS8550 is a variant of SM8550 for IOT devices - Airoha EN7581 is a 10G-PON network chip and related to the MT7981 Wireless router chip from its parent Mediatek. In total there are 58 new machines, including four riscv boards and eight for 32-bit arm. The most exciting new addition is probably a pair of laptops based on the Qualcomm x1e80100 (Snapdragon X1 Elite) chip, the Asus Vivobook S15 and the Lenovo Yoga Slim7x. Other noteworthy new additions are: - A total of 20 Qualcomm based machines, mostly Android devices from Samsung, Motorola and LG, as well as a wireless router and some reference designs - Six NXP i.MX based machines, mostly industrial boards along with some reference designs - Mediatek sees some interesting Filogic based routers including the "OpenWRT One", a few new Chromebooks as well as single-board computers. - Four machines from Solidrun based on Marvell cn913x, replacing the older Armada 8000 based counterparts - The four Amlogic machines are all set top boxes or reference designs for them - The nine new Rockchips machines are mostly single-board computers including some interesting ones based on the rk3588 chip like the ROCK 5 ITX board and the CM3588 with its four NVMe slots - The RISC-V boards are all single-board computers based on Starfive JH7110, Microchip MPFS and Allwinner D1, which all had similar boards already There are also a lot of updates to already supported machines, notably for the TI K3, Rockchips, Freescale and of course Qualcomm platforms" * tag 'soc-dt-6.11' of git://git.kernel.org/pub/scm/linux/kernel/git/soc/soc: (846 commits) arm64: dts: allwinner: h616: add crypto engine node riscv: dts: add clock generator for Sophgo SG2042 SoC arm64: dts: rockchip: Add Xunlong Orange Pi 3B dt-bindings: arm: rockchip: Add Xunlong Orange Pi 3B arm64: dts: rockchip: Add Radxa ROCK 3B dt-bindings: arm: rockchip: Add Radxa ROCK 3B mailmap: Update Luca Weiss's email address ARM: dts: ixp4xx: nslu2: beeper uses PWM arm64: dts: rockchip: add ROCK 5 ITX board dt-bindings: arm: rockchip: Add ROCK 5 ITX board arm64: dts: rockchip: Add dma-names to uart1 on Pine64 rk3566 devices arm64: dts: rockchip: Add avdd supplies to hdmi on rock64 arm64: dts: qcom: msm8916-lg-c50: add initial dts for LG Leon LTE arm64: dts: qcom: msm8916-lg-m216: Add initial device tree dt-bindings: arm: qcom: Add msm8916 based LG devices ARM: dts: qcom: msm8960: correct memory base arm64: dts: qcom: ipq9574: Add icc provider ability to gcc dt-bindings: interconnect: Add Qualcomm IPQ9574 support arm64: dts: qcom: sm8150: Add video clock controller node arm64: dts: qcom: pm6150: Add vibrator ... commit cc0f7c3f97bc6e888bf4be28a9da9dbd3735d2b4 Merge: 99298eb615de 49e24c80d3c8 Author: Linus Torvalds Date: Tue Jul 16 11:35:27 2024 -0700 Merge tag 'soc-drivers-6.11' of git://git.kernel.org/pub/scm/linux/kernel/git/soc/soc Pull SoC driver updates from Arnd Bergmann: "The updates to the mediatek, allwinner, ti, tegra, microchip, stm32, samsung, imx, zynq and amlogic platoforms are fairly small maintenance changes, either addressing minor mistakes or enabling additional hardware. The qualcomm platform changes add a number of features and are larger than the other ones combined, introducing the use of linux/cleanup.h across several drivers, adding support for Snapdragon X1E and other SoCs in platform drivers, a new "protection domain mapper" driver, and a "shared memory bridge" driver. The cznic "turris omnia" router based on Marvell Armada gets a platform driver that talks to the board specific microcontroller. The reset and cache subsystems get a few minor updates to SoC specific drivers, while the ff-a, scmi and optee firmware drivers get some code refactoring and new features" * tag 'soc-drivers-6.11' of git://git.kernel.org/pub/scm/linux/kernel/git/soc/soc: (122 commits) firmware: turris-mox-rwtm: Initialize completion before mailbox firmware: turris-mox-rwtm: Fix checking return value of wait_for_completion_timeout() firmware: turris-mox-rwtm: Do not complete if there are no waiters MAINTAINERS: drop riscv list from cache controllers platform: cznic: turris-omnia-mcu: fix Kconfig dependencies bus: sunxi-rsb: Constify struct regmap_bus soc: sunxi: sram: Constify struct regmap_config platform: cznic: turris-omnia-mcu: Depend on WATCHDOG platform: cznic: turris-omnia-mcu: Depend on OF soc: samsung: exynos-pmu: add support for PMU_ALIVE non atomic registers arm64: stm32: enable scmi regulator for stm32 firmware: qcom: tzmem: blacklist more platforms for SHM Bridge soc: qcom: wcnss: simplify with cleanup.h soc: qcom: pdr: simplify with cleanup.h soc: qcom: ocmem: simplify with cleanup.h soc: qcom: mdt_loader: simplify with cleanup.h soc: qcom: llcc: simplify with cleanup.h firmware: qcom: tzmem: simplify returning pointer without cleanup soc: qcom: socinfo: Add PM6350 PMIC arm64: dts: renesas: rz-smarc: Replace fixed regulator for USB VBUS ... commit 99298eb615debd41c1fccff05b163d0a29091904 Merge: 408323581b72 21b9e722ad28 Author: Linus Torvalds Date: Tue Jul 16 11:30:32 2024 -0700 Merge tag 'm68k-for-v6.11-tag1' of git://git.kernel.org/pub/scm/linux/kernel/git/geert/linux-m68k Pull m68k updates from Geert Uytterhoeven: - Fix bootup lock-ups on Warp1260, Atari TT, and MegaSTe - Miscellaneous fixes and improvements - defconfig updates * tag 'm68k-for-v6.11-tag1' of git://git.kernel.org/pub/scm/linux/kernel/git/geert/linux-m68k: m68k: cmpxchg: Fix return value for default case in __arch_xchg() m68k: defconfig: Update defconfigs for v6.10-rc1 m68k: atari: Fix TT bootup freeze / unexpected (SCU) interrupt messages zorro: Use str_plural() in amiga_zorro_probe() m68k: emu: Add missing MODULE_DESCRIPTION() macros m68k: amiga: Turn off Warp1260 interrupts during boot commit 589eb11498fbf7de7a1bc8ff1f4b7592687dfd46 Merge: bc060e6bb702 691a01804086 04718d1e4dbf 00c7ded68012 ae81b69fd2b1 Author: Stephen Boyd Date: Tue Jul 16 11:24:25 2024 -0700 Merge branches 'clk-qcom', 'clk-rockchip', 'clk-sophgo' and 'clk-thead' into clk-next - Add support for the AP sub-system clock controller in the T-Head TH1520 * clk-qcom: (71 commits) clk: qcom: Park shared RCGs upon registration clk: qcom: ipq9574: Use icc-clk for enabling NoC related clocks clk: qcom: common: Add interconnect clocks support interconnect: icc-clk: Add devm_icc_clk_register interconnect: icc-clk: Specify master/slave ids dt-bindings: clock: qcom: Add AHB clock for SM8150 clk: qcom: gcc-x1e80100: Set parent rate for USB3 sec and tert PHY pipe clks dt-bindings: interconnect: Add Qualcomm IPQ9574 support clk: qcom: kpss-xcc: Return of_clk_add_hw_provider to transfer the error clk: qcom: lpasscc-sc8280xp: Constify struct regmap_config clk: qcom: gcc-x1e80100: Fix halt_check for all pipe clocks clk: qcom: gcc-ipq6018: update sdcc max clock frequency clk: qcom: camcc-sm8650: Add SM8650 camera clock controller driver dt-bindings: clock: qcom: Add SM8650 camera clock controller dt-bindings: clock: qcom: Update the order of SC8280XP camcc header clk: qcom: videocc-sm8550: Add SM8650 video clock controller clk: qcom: videocc-sm8550: Add support for videocc XO clk ares dt-bindings: clock: qcom: Add SM8650 video clock controller dt-bindings: clock: qcom: Update SM8450 videocc header file name clk: qcom: gpucc-sa8775p: Update wait_val fields for GPU GDSC's ... * clk-rockchip: dt-bindings: clock: rk3188-cru-common: remove CLK_NR_CLKS clk: rockchip: rk3188: Drop CLK_NR_CLKS usage clk: rockchip: Switch to use kmemdup_array() clk: rockchip: rk3128: Add HCLK_SFC dt-bindings: clock: rk3128: Add HCLK_SFC dt-bindings: clock: rk3128: Drop CLK_NR_CLKS clk: rockchip: rk3128: Drop CLK_NR_CLKS usage clk: rockchip: rk3128: Add hclk_vio_h2p to critical clocks clk: rockchip: rk3128: Export PCLK_MIPIPHY dt-bindings: clock: rk3128: Add PCLK_MIPIPHY * clk-sophgo: clk: sophgo: Avoid -Wsometimes-uninitialized in sg2042_clk_pll_set_rate() clk/sophgo: Using BUG() instead of unreachable() in mmux_get_parent_id() clk: sophgo: Add SG2042 clock driver dt-bindings: clock: sophgo: add clkgen for SG2042 dt-bindings: clock: sophgo: add RP gate clocks for SG2042 dt-bindings: clock: sophgo: add pll clocks for SG2042 * clk-thead: clk: thead: Add support for T-Head TH1520 AP_SUBSYS clocks dt-bindings: clock: Document T-Head TH1520 AP_SUBSYS controller commit bc060e6bb7028a1780f1fe652d2546ee7058e065 Merge: 160d7b9fb920 e96b0420988a d424c029af5e 38bded815463 b1da66d28a8b Author: Stephen Boyd Date: Tue Jul 16 11:24:16 2024 -0700 Merge branches 'clk-renesas', 'clk-amlogic', 'clk-allwinner' and 'clk-samsung' into clk-next * clk-renesas: clk: renesas: r9a08g045: Add clock, reset and power domain support for I2C clk: renesas: r8a779h0: Add Audio clocks clk: renesas: r9a08g045: Add clock, reset and power domain support for the VBATTB IP dt-bindings: clock: rcar-gen2: Remove obsolete header files dt-bindings: clock: r8a7779: Remove duplicate newline clk: renesas: Drop "Renesas" from individual driver descriptions clk: renesas: r8a779h0: Fix PLL2/PLL4 multipliers in comments clk: renesas: r8a779h0: Add VIN clocks dt-bindings: clock: renesas,rzg2l-cpg: Update description for #reset-cells clk: renesas: rcar-gen2: Use DEFINE_SPINLOCK() for static spinlock clk: renesas: cpg-lib: Use DEFINE_SPINLOCK() for global spinlock clk: renesas: r8a77970: Use common cpg_lock clk: renesas: r8a779h0: Add CSI-2 clocks clk: renesas: r8a779h0: Add ISPCS clocks * clk-amlogic: clk: meson: add missing MODULE_DESCRIPTION() macros dt-bindings: clock: meson: a1: peripherals: support sys_pll input dt-bindings: clock: meson: a1: pll: introduce new syspll bindings clk: meson: add 'NOINIT_ENABLED' flag to eliminate init for enabled PLL clk: meson: c3: add c3 clock peripherals controller driver clk: meson: c3: add support for the C3 SoC PLL clock dt-bindings: clock: add Amlogic C3 peripherals clock controller dt-bindings: clock: add Amlogic C3 SCMI clock controller support dt-bindings: clock: add Amlogic C3 PLL clock controller dt-bindings: clock: meson: Convert axg-audio-clkc to YAML format clk: meson: s4: fix pwm_j_div parent clock clk: meson: s4: fix fixed_pll_dco clock * clk-allwinner: clk: sunxi-ng r40: Constify struct regmap_config clk: sunxi-ng: h616: Add clock/reset for GPADC dt-bindings: clock: sun50i-h616-ccu: Add GPADC clocks clk: sunxi: Remove unused struct 'gates_data' clk: sunxi-ng: add missing MODULE_DESCRIPTION() macros * clk-samsung: clk: samsung: gs101: mark gout_hsi2_ufs_embd_i_clk_unipro as critical clk: samsung: Switch to use kmemdup_array() clk: samsung: exynos-clkout: Remove misleading of_match_table/MODULE_DEVICE_TABLE commit 160d7b9fb920535c5df12df10e85efabe675d6d1 Merge: a542e9d70cb1 12b02b635959 a6c3da03ead1 58c53d43142f Author: Stephen Boyd Date: Tue Jul 16 11:24:01 2024 -0700 Merge branches 'clk-stm', 'clk-cleanup', 'clk-kunit' and 'clk-mediatek' into clk-next - Add reset support to Airoha EN7581 clk driver - Add module description to mediatek clk drivers * clk-stm: clk: stm32mp25: add security clocks clk: stm32mp2: use of STM32 access controller * clk-cleanup: clk: mxs: Use clamp() in clk_ref_round_rate() and clk_ref_set_rate() clk: lpc32xx: Constify struct regmap_config clk: xilinx: Constify struct regmap_config dt-bindings: clock: sprd,sc9860-clk: convert to YAML dt-bindings: clock: qoriq-clock: convert to yaml format clk: vexpress-osc: add missing MODULE_DESCRIPTION() macro clk: sifive: prci: fix module autoloading dt-bindings: clock: milbeaut: Drop providers and consumers from example clk: sprd: add missing MODULE_DESCRIPTION() macro clk: sophgo: add missing MODULE_DESCRIPTION() macro * clk-kunit: clk: disable clk gate tests for s390 clk: test: add missing MODULE_DESCRIPTION() macros * clk-mediatek: clk: en7523: fix rate divider for slic and spi clocks clk: en7523: Remove PCIe reset open drain configuration for EN7581 clk: en7523: Remove pcie prepare/unpreare callbacks for EN7581 SoC clk: en7523: Add reset-controller support for EN7581 SoC dt-bindings: clock: airoha: Add reset support to EN7581 clock binding dt-bindings: clock: mediatek: Document reset cells for MT8188 sys clk: mediatek: mt8173-infracfg: Handle unallocated infracfg when module dt-bindings: clock: mediatek: add syscon compatible for mt7622 pciesys clk: mediatek: Add a module description where missing commit 408323581b722c9bd504dd296920f392049a7f52 Merge: b84b3381907a 5fa96c7ab3dc Author: Linus Torvalds Date: Tue Jul 16 11:12:25 2024 -0700 Merge tag 'x86_sev_for_v6.11_rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull x86 SEV updates from Borislav Petkov: - Add support for running the kernel in a SEV-SNP guest, over a Secure VM Service Module (SVSM). When running over a SVSM, different services can run at different protection levels, apart from the guest OS but still within the secure SNP environment. They can provide services to the guest, like a vTPM, for example. This series adds the required facilities to interface with such a SVSM module. - The usual fixlets, refactoring and cleanups [ And as always: "SEV" is AMD's "Secure Encrypted Virtualization". I can't be the only one who gets all the newer x86 TLA's confused, can I? - Linus ] * tag 'x86_sev_for_v6.11_rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: Documentation/ABI/configfs-tsm: Fix an unexpected indentation silly x86/sev: Do RMP memory coverage check after max_pfn has been set x86/sev: Move SEV compilation units virt: sev-guest: Mark driver struct with __refdata to prevent section mismatch x86/sev: Allow non-VMPL0 execution when an SVSM is present x86/sev: Extend the config-fs attestation support for an SVSM x86/sev: Take advantage of configfs visibility support in TSM fs/configfs: Add a callback to determine attribute visibility sev-guest: configfs-tsm: Allow the privlevel_floor attribute to be updated virt: sev-guest: Choose the VMPCK key based on executing VMPL x86/sev: Provide guest VMPL level to userspace x86/sev: Provide SVSM discovery support x86/sev: Use the SVSM to create a vCPU when not in VMPL0 x86/sev: Perform PVALIDATE using the SVSM when not at VMPL0 x86/sev: Use kernel provided SVSM Calling Areas x86/sev: Check for the presence of an SVSM in the SNP secrets page x86/irqflags: Provide native versions of the local_irq_save()/restore() commit b84b3381907a3c5c6f1d524185eddc55547068b7 Merge: d67978318827 ea34999f4187 Author: Linus Torvalds Date: Tue Jul 16 10:53:54 2024 -0700 Merge tag 'x86_cache_for_v6.11_rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull x86 resource control updates from Borislav Petkov: - Enable Sub-NUMA clustering to work with resource control on Intel by teaching resctrl to handle scopes due to the clustering which partitions the L3 cache into sets. Modify and extend the subsystem to handle such scopes properly * tag 'x86_cache_for_v6.11_rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: x86/resctrl: Update documentation with Sub-NUMA cluster changes x86/resctrl: Detect Sub-NUMA Cluster (SNC) mode x86/resctrl: Enable shared RMID mode on Sub-NUMA Cluster (SNC) systems x86/resctrl: Make __mon_event_count() handle sum domains x86/resctrl: Fill out rmid_read structure for smp_call*() to read a counter x86/resctrl: Handle removing directories in Sub-NUMA Cluster (SNC) mode x86/resctrl: Create Sub-NUMA Cluster (SNC) monitor files x86/resctrl: Allocate a new field in union mon_data_bits x86/resctrl: Refactor mkdir_mondata_subdir() with a helper function x86/resctrl: Initialize on-stack struct rmid_read instances x86/resctrl: Add a new field to struct rmid_read for summation of domains x86/resctrl: Prepare for new Sub-NUMA Cluster (SNC) monitor files x86/resctrl: Block use of mba_MBps mount option on Sub-NUMA Cluster (SNC) systems x86/resctrl: Introduce snc_nodes_per_l3_cache x86/resctrl: Add node-scope to the options for feature scope x86/resctrl: Split the rdt_domain and rdt_hw_domain structures x86/resctrl: Prepare for different scope for control/monitor operations x86/resctrl: Prepare to split rdt_domain structure x86/resctrl: Prepare for new domain scope commit 702418f7559fb1828646f0b51d9ca7c8b9ee7bff Author: Beau Belgrave Date: Mon Jul 15 18:14:13 2024 +0000 Documentation: Document user_events ioctl code The user events trace subsystem uses the 0x2A/'*' code for ioctls. These are published via the uapi/linux/user_events.h header file. Add a line indicating user events as the owner of the 0x2A/'*' code and reserve the first 32 sequence numbers. Signed-off-by: Beau Belgrave Signed-off-by: Jonathan Corbet Link: https://lore.kernel.org/r/20240715181413.1157-1-beaub@linux.microsoft.com Documentation/userspace-api/ioctl/ioctl-number.rst | 2 ++ 1 file changed, 2 insertions(+) commit f8e52fb8c2b61baf0e376db4dc3347c326feb781 Author: Marc Ferland Date: Tue Jul 9 14:39:19 2024 -0400 docs/pinctrl: fix typo in mapping example Small typo. The device name in the example should be "foo-i2c.0" and not "foo-i2c.o". Signed-off-by: Marc Ferland Signed-off-by: Jonathan Corbet Link: https://lore.kernel.org/r/20240709183919.3337131-1-marc.ferland@sonatest.com Documentation/driver-api/pin-control.rst | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit e35fa1f236b3e8bec56aed0ae180eaaeb3c853eb Author: Jakub Kicinski Date: Sat Jul 13 16:50:20 2024 -0700 docs: maintainer: discourage taking conversations off-list Multiple vendors seem to prefer taking discussions off list, and ask contributors to work with them privately rather than just send patches to the list. I'd imagine this is because it's hard to fit in time for random developers popping up with features to review into packed schedule. From what I've seen "work in private" usually means someone on the company side will be assigned to handle the interaction, possibly months later. In worst case, the person scheduled to help the contributor takes over and writes the code themselves. This is not how the community is supposed to work. Reviewed-by: Greg Kroah-Hartman Reviewed-by: Mark Brown Reviewed-by: Shuah Khan Signed-off-by: Jakub Kicinski Signed-off-by: Jonathan Corbet Link: https://lore.kernel.org/r/20240713235020.820910-1-kuba@kernel.org Link: https://lore.kernel.org/r/20240712144903.392284-1-kuba@kernel.org Documentation/maintainer/feature-and-driver-maintainers.rst | 11 +++++++++++ 1 file changed, 11 insertions(+) commit 5d766508fd15d7e8c90574ef270f0c163b750b45 Author: Wei Wang Date: Tue May 7 21:31:03 2024 +0800 KVM: x86/pmu: Add kvm_pmu_call() to simplify static calls of kvm_pmu_ops Similar to kvm_x86_call(), kvm_pmu_call() is added to streamline the usage of static calls of kvm_pmu_ops, which improves code readability. Suggested-by: Sean Christopherson Signed-off-by: Wei Wang Link: https://lore.kernel.org/r/20240507133103.15052-4-wei.w.wang@intel.com Signed-off-by: Sean Christopherson Signed-off-by: Paolo Bonzini arch/x86/include/asm/kvm_host.h | 1 + arch/x86/kvm/pmu.c | 24 ++++++++++++------------ 2 files changed, 13 insertions(+), 12 deletions(-) commit 896046474f8d2ea711f63576b3ff89f88e273aef Author: Wei Wang Date: Tue May 7 21:31:02 2024 +0800 KVM: x86: Introduce kvm_x86_call() to simplify static calls of kvm_x86_ops Introduces kvm_x86_call(), to streamline the usage of static calls of kvm_x86_ops. The current implementation of these calls is verbose and could lead to alignment challenges. This makes the code susceptible to exceeding the "80 columns per single line of code" limit as defined in the coding-style document. Another issue with the existing implementation is that the addition of kvm_x86_ prefix to hooks at the static_call sites hinders code readability and navigation. kvm_x86_call() is added to improve code readability and maintainability, while adhering to the coding style guidelines. Signed-off-by: Wei Wang Link: https://lore.kernel.org/r/20240507133103.15052-3-wei.w.wang@intel.com Signed-off-by: Sean Christopherson Signed-off-by: Paolo Bonzini arch/x86/include/asm/kvm_host.h | 10 +- arch/x86/kvm/cpuid.c | 2 +- arch/x86/kvm/hyperv.c | 6 +- arch/x86/kvm/irq.c | 2 +- arch/x86/kvm/kvm_cache_regs.h | 10 +- arch/x86/kvm/lapic.c | 42 +++--- arch/x86/kvm/lapic.h | 2 +- arch/x86/kvm/mmu.h | 6 +- arch/x86/kvm/mmu/mmu.c | 6 +- arch/x86/kvm/mmu/spte.c | 4 +- arch/x86/kvm/pmu.c | 5 +- arch/x86/kvm/smm.c | 44 +++--- arch/x86/kvm/trace.h | 15 +- arch/x86/kvm/x86.c | 324 ++++++++++++++++++++-------------------- arch/x86/kvm/x86.h | 2 +- arch/x86/kvm/xen.c | 4 +- 16 files changed, 248 insertions(+), 236 deletions(-) commit f4854bf741c4cdb8f8cdefbf533f9b8dfd43f041 Author: Wei Wang Date: Tue May 7 21:31:01 2024 +0800 KVM: x86: Replace static_call_cond() with static_call() The use of static_call_cond() is essentially the same as static_call() on x86 (e.g. static_call() now handles a NULL pointer as a NOP), so replace it with static_call() to simplify the code. Link: https://lore.kernel.org/all/3916caa1dcd114301a49beafa5030eca396745c1.1679456900.git.jpoimboe@kernel.org/ Suggested-by: Sean Christopherson Signed-off-by: Wei Wang Link: https://lore.kernel.org/r/20240507133103.15052-2-wei.w.wang@intel.com Signed-off-by: Sean Christopherson Signed-off-by: Paolo Bonzini arch/x86/include/asm/kvm-x86-ops.h | 3 +-- arch/x86/include/asm/kvm-x86-pmu-ops.h | 3 +-- arch/x86/include/asm/kvm_host.h | 4 ++-- arch/x86/kvm/irq.c | 2 +- arch/x86/kvm/lapic.c | 24 ++++++++++++------------ arch/x86/kvm/pmu.c | 6 +++--- arch/x86/kvm/x86.c | 26 +++++++++++++------------- 7 files changed, 33 insertions(+), 35 deletions(-) commit 8fe76a1c2264a02155895cda9f97a6a5a9b97d91 Author: Jeff Johnson Date: Tue Jul 2 12:29:38 2024 -0700 sh: push-switch: Add missing MODULE_DESCRIPTION() macro Fixes the following warning when building allmodconfig with W=1 C=1: WARNING: modpost: missing MODULE_DESCRIPTION() in arch/sh/drivers/push-switch.o Signed-off-by: Jeff Johnson Reviewed-by: John Paul Adrian Glaubitz Link: https://lore.kernel.org/r/20240702-md-sh-arch-sh-drivers-v1-1-2c5d439a5479@quicinc.com Signed-off-by: John Paul Adrian Glaubitz arch/sh/drivers/push-switch.c | 1 + 1 file changed, 1 insertion(+) commit 4b0eb9ce15912ec303cc515888691b6ec6c32196 Author: Rodrigo Siqueira Date: Mon Jul 15 16:57:47 2024 -0600 Documentation/amdgpu: Fix duplicate declaration Address the below kernel doc warning: Documentation/gpu/amdgpu/display/display-manager:134: drivers/gpu/drm/amd/display/dc/inc/hw/mpc.h:3: WARNING: Duplicate C declaration, also defined at gpu/amdgpu/display/dcn-blocks:101. Declaration is '.. c:struct:: mpcc_blnd_cfg'. Documentation/gpu/amdgpu/display/display-manager:146: drivers/gpu/drm/amd/display/dc/inc/hw/mpc.h:3: WARNING: Duplicate C declaration, also defined at gpu/amdgpu/display/dcn-blocks:3. Declaration is '.. c:enum:: mpcc_alpha_blend_mode'. To address the above warnings, this commit uses the 'no-identifiers' option in the dcn-blocks to avoid duplication with the previous use of this function doc in the display-manager file. Finally, replaces the deprecated ':function:' in favor of ':identifiers:'. Cc: Alex Deucher Acked-by: Alex Deucher Reported-by: Stephen Rothwell Signed-off-by: Rodrigo Siqueira Signed-off-by: Alex Deucher Documentation/gpu/amdgpu/display/dcn-blocks.rst | 1 + Documentation/gpu/amdgpu/display/display-manager.rst | 4 ++-- 2 files changed, 3 insertions(+), 2 deletions(-) commit 91ca34cba3b6a13df6304f80bbcfdf6cad328c2b Author: Rodrigo Siqueira Date: Mon Jul 15 16:29:41 2024 -0600 Documentation/gpu: Remove undocumented files from dcn-blockshubbub.h The dchubbub.h and hubp.h do not have any meaningful documentation; for this reason, this commit removes those files from the dcn-blocks documentation. Cc: Alex Deucher Acked-by: Alex Deucher Reported-by: Stephen Rothwell Signed-off-by: Rodrigo Siqueira Signed-off-by: Alex Deucher Documentation/gpu/amdgpu/display/dcn-blocks.rst | 6 ------ 1 file changed, 6 deletions(-) commit d938ec1a12a22a4eedff319aa41cba48e9c5e544 Author: Rodrigo Siqueira Date: Mon Jul 15 16:16:12 2024 -0600 drm/amd/display: Add simple struct doc to remove doc build warning This commit is a part of a series that addresses the following build warning for opp: ./drivers/gpu/drm/amd/display/dc/inc/hw/opp.h:1: warning: no structured comments found ./drivers/gpu/drm/amd/display/dc/inc/hw/dpp.h:1: warning: no structured comments found This commit fixes this issue by adding a simple kernel-doc to a struct in the opp.h and the dpp.h files. Cc: Alex Deucher Acked-by: Alex Deucher Reported-by: Stephen Rothwell Signed-off-by: Rodrigo Siqueira Signed-off-by: Alex Deucher drivers/gpu/drm/amd/display/dc/inc/hw/dpp.h | 22 +++++++++++++++++----- drivers/gpu/drm/amd/display/dc/inc/hw/opp.h | 15 +++++++++++++++ 2 files changed, 32 insertions(+), 5 deletions(-) commit 1200bce4de8798ff73d1a0011e84b5ff68ffc25c Author: Rodrigo Siqueira Date: Mon Jul 15 15:58:40 2024 -0600 Documentation/gpu: Adjust DCN documentation paths When building the kernel-doc, it has the following complaints: Documentation/gpu/amdgpu/display/dcn-blocks:23: drivers/gpu/drm/amd/display/dc/inc/hw/hubp.h:3: WARNING: Duplicate C declaration, also defined at gpu/amdgpu/display/dcn-blocks:3. Declaration is '.. c:struct:: surface_flip_registers'. Documentation/gpu/amdgpu/display/dcn-blocks:35: drivers/gpu/drm/amd/display/dc/inc/hw/hubp.h:3: WARNING: Duplicate C declaration, also defined at gpu/amdgpu/display/dcn-blocks:3. Declaration is '.. c:struct:: surface_flip_registers'. This error happened due to a copy-and-paste where the same file path was duplicated multiple times to a different set of blocks. This commit addresses this issue by using the correct file path. Cc: Alex Deucher Acked-by: Alex Deucher Reported-by: Stephen Rothwell Signed-off-by: Rodrigo Siqueira Signed-off-by: Alex Deucher Documentation/gpu/amdgpu/display/dcn-blocks.rst | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) commit 9947dbf984dd79d644a5468a47a76d9fef9f0884 Author: Rodrigo Siqueira Date: Mon Jul 15 15:10:32 2024 -0600 Documentation/gpu: Remove ':export:' option from DCN documentation This commit reduces, but does not fix, all the occurrences and some of the documentation warnings related to the 'no structured comments.' This was caused by the wrong use of the ':export:' option in the DCN kernel-doc, so this commit drops the usage of those options. Acked-by: Alex Deucher Reported-by: Stephen Rothwell Signed-off-by: Rodrigo Siqueira Signed-off-by: Alex Deucher Documentation/gpu/amdgpu/display/dcn-blocks.rst | 15 --------------- 1 file changed, 15 deletions(-) commit 4cf300f604fe894e4bd734f87fa4502faf1b8af3 Author: Rodrigo Siqueira Date: Mon Jul 15 14:57:49 2024 -0600 drm/amd/display: Move DIO documentation to the right place When building the kernel-doc, it complains with the below warning: ./drivers/gpu/drm/amd/display/dc/link/hwss/link_hwss_dio.h:1: warning: no structured comments found ./drivers/gpu/drm/amd/display/dc/link/hwss/link_hwss_dio.h:1: warning: no structured comments found This warning was caused by the wrong use of the ':export:' and the lack of function documentation in the file pointed under the ':internal:'. This commit addresses those issues by relocating the overview documentation to the correct C file, removing the ':export:' options, and adding two simple kernel-doc to ensure that ':internal:' does not have any warning. Cc: Alex Deucher Acked-by: Alex Deucher Reported-by: Stephen Rothwell Link: https://lore.kernel.org/dri-devel/20240715085918.68f5ecc9@canb.auug.org.au/ Signed-off-by: Rodrigo Siqueira Signed-off-by: Alex Deucher Documentation/gpu/amdgpu/display/dcn-blocks.rst | 7 ++---- .../drm/amd/display/dc/link/hwss/link_hwss_dio.c | 29 ++++++++++++++++++++++ .../drm/amd/display/dc/link/hwss/link_hwss_dio.h | 9 ------- 3 files changed, 31 insertions(+), 14 deletions(-) commit 5ae8fb971201d281cc594dba58787406e46c696a Author: Li Ma Date: Wed Jul 10 17:29:59 2024 +0800 drm/amd/swsmu: enable Pstates profile levels for SMU v14.0.4 Enables following UMD stable Pstates profile levels of power_dpm_force_performance_level for SMU v14.0.4. - profile_peak - profile_min_mclk - profile_min_sclk - profile_standard Signed-off-by: Li Ma Reviewed-by: Tim Huang Acked-by: Alex Deucher Signed-off-by: Alex Deucher drivers/gpu/drm/amd/pm/swsmu/smu14/smu_v14_0_0_ppt.c | 18 +++++++++++++++--- 1 file changed, 15 insertions(+), 3 deletions(-) commit 2fdc99b96ea86c178eb14bc948dac93feffc8936 Author: Tim Huang Date: Fri Jul 12 11:05:07 2024 +0800 drm/amd/pm: early return if disabling DPMS for GFX IP v11.5.2 This was intended to add support for GFX IP v11.5.2, but it needs to be applied to all GFX11 and subsequent APUs. Therefore the code should be revised to accommodate this. Signed-off-by: Tim Huang Acked-by: Alex Deucher Signed-off-by: Alex Deucher drivers/gpu/drm/amd/pm/swsmu/amdgpu_smu.c | 16 ++++------------ 1 file changed, 4 insertions(+), 12 deletions(-) commit b3fb79cda5688a44a423c27b791f5456d801e49c Author: YiPeng Chai Date: Fri Apr 12 13:46:03 2024 +0800 drm/amdgpu: add mutex to protect ras shared memory Add mutex to protect ras shared memory. v2: Add TA_RAS_COMMAND__TRIGGER_ERROR command call status check. Signed-off-by: YiPeng Chai Reviewed-by: Hawking Zhang Signed-off-by: Alex Deucher drivers/gpu/drm/amd/amdgpu/amdgpu_psp.c | 123 +++++++++++++++++++---------- drivers/gpu/drm/amd/amdgpu/amdgpu_psp.h | 1 + drivers/gpu/drm/amd/amdgpu/amdgpu_psp_ta.c | 2 + 3 files changed, 86 insertions(+), 40 deletions(-) commit bc9cd5a219aa6c00515aa8f0904c8d49706f0760 Merge: 2a1fc7dc3626 74458e4859d8 Author: Paolo Bonzini Date: Tue Jul 16 11:44:23 2024 -0400 Merge branch 'kvm-6.11-sev-attestation' into HEAD The GHCB 2.0 specification defines 2 GHCB request types to allow SNP guests to send encrypted messages/requests to firmware: SNP Guest Requests and SNP Extended Guest Requests. These encrypted messages are used for things like servicing attestation requests issued by the guest. Implementing support for these is required to be fully GHCB-compliant. For the most part, KVM only needs to handle forwarding these requests to firmware (to be issued via the SNP_GUEST_REQUEST firmware command defined in the SEV-SNP Firmware ABI), and then forwarding the encrypted response to the guest. However, in the case of SNP Extended Guest Requests, the host is also able to provide the certificate data corresponding to the endorsement key used by firmware to sign attestation report requests. This certificate data is provided by userspace because: 1) It allows for different keys/key types to be used for each particular guest with requiring any sort of KVM API to configure the certificate table in advance on a per-guest basis. 2) It provides additional flexibility with how attestation requests might be handled during live migration where the certificate data for source/dest might be different. 3) It allows all synchronization between certificates and firmware/signing key updates to be handled purely by userspace rather than requiring some in-kernel mechanism to facilitate it. [1] To support fetching certificate data from userspace, a new KVM exit type will be needed to handle fetching the certificate from userspace. An attempt to define a new KVM_EXIT_COCO/KVM_EXIT_COCO_REQ_CERTS exit type to handle this was introduced in v1 of this patchset, but is still being discussed by community, so for now this patchset only implements a stub version of SNP Extended Guest Requests that does not provide certificate data, but is still enough to provide compliance with the GHCB 2.0 spec. commit 0e2c796b49735ee141fbff355b9d02e0189c3c65 Author: Roman Li Date: Mon Jul 15 16:45:46 2024 -0400 drm/amd/display: Add function banner for idle_workqueue [Why] htmldocs warning: drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.h: warning: Function parameter or struct member 'idle_workqueue' not described in 'amdgpu_display_manager'. [How] Add comment section for idle_workqueue with param description. Reported-by: Stephen Rothwell Link: https://lore.kernel.org/dri-devel/20240715090211.736a9b4d@canb.auug.org.au/ Signed-off-by: Roman Li Reviewed-by: Aurabindo Pillai Signed-off-by: Alex Deucher drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.h | 13 +++++++++++++ 1 file changed, 13 insertions(+) commit 6e169c7e0f842c48c7bf683fb789dbf5a8b1dfd8 Author: Alex Hung Date: Mon Jul 15 13:53:17 2024 -0600 drm/amd/display: Add doc entry for program_3dlut_size Fixes the warning: Function parameter or struct member 'program_3dlut_size' not described in 'mpc_funcs' Reported-by: Stephen Rothwell Closes: https://lore.kernel.org/dri-devel/20240715090445.7e9387ec@canb.auug.org.au/ Reviewed-by: Aurabindo Pillai Signed-off-by: Alex Hung Signed-off-by: Alex Deucher drivers/gpu/drm/amd/display/dc/inc/hw/mpc.h | 14 ++++++++++++++ 1 file changed, 14 insertions(+) commit 7d75ef3736a025db441be652c8cc8e84044a215f Author: Boyuan Zhang Date: Wed Jul 10 16:17:12 2024 -0400 drm/amdgpu/vcn: not pause dpg for unified queue For unified queue, DPG pause for encoding is done inside VCN firmware, so there is no need to pause dpg based on ring type in kernel. For VCN3 and below, pausing DPG for encoding in kernel is still needed. v2: add more comments v3: update commit message Signed-off-by: Boyuan Zhang Acked-by: Alex Deucher Reviewed-by: Ruijing Dong Signed-off-by: Alex Deucher drivers/gpu/drm/amd/amdgpu/amdgpu_vcn.c | 14 +++++++++++--- 1 file changed, 11 insertions(+), 3 deletions(-) commit 74458e4859d85ea5963ac1c2bd7fa112f92a1d6d Author: Michael Roth Date: Mon Jul 1 17:31:48 2024 -0500 KVM: SEV: Provide support for SNP_EXTENDED_GUEST_REQUEST NAE event Version 2 of GHCB specification added support for the SNP Extended Guest Request Message NAE event. This event serves a nearly identical purpose to the previously-added SNP_GUEST_REQUEST event, but for certain message types it allows the guest to supply a buffer to be used for additional information in some cases. Currently the GHCB spec only defines extended handling of this sort in the case of attestation requests, where the additional buffer is used to supply a table of certificate data corresponding to the attestion report's signing key. Support for this extended handling will require additional KVM APIs to handle coordinating with userspace. Whether or not the hypervisor opts to provide this certificate data is optional. However, support for processing SNP_EXTENDED_GUEST_REQUEST GHCB requests is required by the GHCB 2.0 specification for SNP guests, so for now implement a stub implementation that provides an empty certificate table to the guest if it supplies an additional buffer, but otherwise behaves identically to SNP_GUEST_REQUEST. Reviewed-by: Carlos Bilbao Reviewed-by: Tom Lendacky Reviewed-by: Liam Merwick Signed-off-by: Michael Roth Message-ID: <20240701223148.3798365-4-michael.roth@amd.com> Signed-off-by: Paolo Bonzini arch/x86/kvm/svm/sev.c | 56 ++++++++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 56 insertions(+) commit f55f3c3ac69f22ce092506244a31c08a1ca497ba Author: Michael Roth Date: Mon Jul 1 17:31:47 2024 -0500 x86/sev: Move sev_guest.h into common SEV header sev_guest.h currently contains various definitions relating to the format of SNP_GUEST_REQUEST commands to SNP firmware. Currently only the sev-guest driver makes use of them, but when the KVM side of this is implemented there's a need to parse the SNP_GUEST_REQUEST header to determine whether additional information needs to be provided to the guest. Prepare for this by moving those definitions to a common header that's shared by host/guest code so that KVM can also make use of them. Reviewed-by: Tom Lendacky Reviewed-by: Liam Merwick Signed-off-by: Michael Roth Message-ID: <20240701223148.3798365-3-michael.roth@amd.com> Signed-off-by: Paolo Bonzini arch/x86/include/asm/sev.h | 48 +++++++++++++++++++++++++ drivers/virt/coco/sev-guest/sev-guest.c | 2 -- drivers/virt/coco/sev-guest/sev-guest.h | 63 --------------------------------- 3 files changed, 48 insertions(+), 65 deletions(-) commit 88caf544c9305313e1c48ac1a437faa5df8fff06 Author: Brijesh Singh Date: Mon Jul 1 17:31:46 2024 -0500 KVM: SEV: Provide support for SNP_GUEST_REQUEST NAE event Version 2 of GHCB specification added support for the SNP Guest Request Message NAE event. The event allows for an SEV-SNP guest to make requests to the SEV-SNP firmware through the hypervisor using the SNP_GUEST_REQUEST API defined in the SEV-SNP firmware specification. This is used by guests primarily to request attestation reports from firmware. There are other request types are available as well, but the specifics of what guest requests are being made generally does not affect how they are handled by the hypervisor, which only serves as a proxy for the guest requests and firmware responses. Implement handling for these events. When an SNP Guest Request is issued, the guest will provide its own request/response pages, which could in theory be passed along directly to firmware. However, these pages would need special care: - Both pages are from shared guest memory, so they need to be protected from migration/etc. occurring while firmware reads/writes to them. At a minimum, this requires elevating the ref counts and potentially needing an explicit pinning of the memory. This places additional restrictions on what type of memory backends userspace can use for shared guest memory since there would be some reliance on using refcounted pages. - The response page needs to be switched to Firmware-owned state before the firmware can write to it, which can lead to potential host RMP #PFs if the guest is misbehaved and hands the host a guest page that KVM is writing to for other reasons (e.g. virtio buffers). Both of these issues can be avoided completely by using separately-allocated bounce pages for both the request/response pages and passing those to firmware instead. So that's the approach taken here. Signed-off-by: Brijesh Singh Co-developed-by: Alexey Kardashevskiy Signed-off-by: Alexey Kardashevskiy Co-developed-by: Ashish Kalra Signed-off-by: Ashish Kalra Reviewed-by: Tom Lendacky Reviewed-by: Liam Merwick [mdr: ensure FW command failures are indicated to guest, drop extended request handling to be re-written as separate patch, massage commit] Signed-off-by: Michael Roth Message-ID: <20240701223148.3798365-2-michael.roth@amd.com> Signed-off-by: Paolo Bonzini arch/x86/kvm/svm/sev.c | 134 +++++++++++++++++++++++++++++++++++++++++ arch/x86/kvm/svm/svm.h | 3 + include/uapi/linux/sev-guest.h | 3 + 3 files changed, 140 insertions(+) commit ecfa23c8df7ef3ea2a429dfe039341bf792e95b4 Author: Boyuan Zhang Date: Thu Jul 11 16:19:54 2024 -0400 drm/amdgpu/vcn: identify unified queue in sw init Determine whether VCN using unified queue in sw_init, instead of calling functions later on. v2: fix coding style Signed-off-by: Boyuan Zhang Acked-by: Alex Deucher Reviewed-by: Ruijing Dong Signed-off-by: Alex Deucher drivers/gpu/drm/amd/amdgpu/amdgpu_vcn.c | 39 +++++++++++++-------------------- drivers/gpu/drm/amd/amdgpu/amdgpu_vcn.h | 1 + 2 files changed, 16 insertions(+), 24 deletions(-) commit 77ae5e5b00720372af2860efdc4bc652ac682696 Author: Colin Ian King Date: Tue Jul 16 10:38:51 2024 +0100 eth: fbnic: Fix spelling mistake "tiggerring" -> "triggering" There is a spelling mistake in a netdev_warn message. Fix it. Signed-off-by: Colin Ian King Link: https://patch.msgid.link/20240716093851.1003131-1-colin.i.king@gmail.com Signed-off-by: Jakub Kicinski drivers/net/ethernet/meta/fbnic/fbnic_txrx.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 415fb383ec2bbe4d4bb1a1b5593cd67eb058f1de Author: Francis Pravin Date: Mon Jul 15 06:31:57 2024 +0530 nvme-core: choose PIF from QPIF if QPIFS supports and PIF is QTYPE As per TP4141a: "If the Qualified Protection Information Format Support(QPIFS) bit is set to 1 and the Protection Information Format(PIF) field is set to 11b (i.e., Qualified Type), then the pif is as defined in the Qualified Protection Information Format (QPIF) field." So, choose PIF from QPIF if QPIFS supports and PIF is QTYPE. Signed-off-by: Francis Pravin Reviewed-by: Sagi Grimberg Reviewed-by: Christoph Hellwig Signed-off-by: Keith Busch drivers/nvme/host/core.c | 8 +++++++- include/linux/nvme.h | 9 +++++++++ 2 files changed, 16 insertions(+), 1 deletion(-) commit a3bfc095060b51f0198755020daf80d1e14413b1 Author: Kees Cook Date: Sat Jul 13 21:11:15 2024 -0700 tcp: Replace strncpy() with strscpy() Replace the deprecated[1] uses of strncpy() in tcp_ca_get_name_by_key() and tcp_get_default_congestion_control(). The callers use the results as standard C strings (via nla_put_string() and proc handlers respectively), so trailing padding is not needed. Since passing the destination buffer arguments decays it to a pointer, the size can't be trivially determined by the compiler. ca->name is the same length in both cases, so strscpy() won't fail (when ca->name is NUL-terminated). Include the length explicitly instead of using the 2-argument strscpy(). Link: https://github.com/KSPP/linux/issues/90 [1] Signed-off-by: Kees Cook Reviewed-by: Simon Horman Reviewed-by: Eric Dumazet Link: https://patch.msgid.link/20240714041111.it.918-kees@kernel.org Signed-off-by: Jakub Kicinski net/ipv4/tcp_cong.c | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-) commit b49991d83bba4ae77a560c5f021932e8290bd022 Author: Paolo Abeni Date: Tue Jul 16 13:06:39 2024 +0200 wifi: ath12k: fix build vs old compiler gcc 11.4.1-3 warns about memcpy() with overlapping pointers: drivers/net/wireless/ath/ath12k/wow.c: In function ‘ath12k_wow_convert_8023_to_80211.constprop’: ./include/linux/fortify-string.h:114:33: error: ‘__builtin_memcpy’ accessing 18446744073709551611 or more bytes at offsets 0 and 0 overlaps 9223372036854775799 bytes at offset -9223372036854775804 [-Werror=restrict] 114 | #define __underlying_memcpy __builtin_memcpy | ^ ./include/linux/fortify-string.h:637:9: note: in expansion of macro ‘__underlying_memcpy’ 637 | __underlying_##op(p, q, __fortify_size); \ | ^~~~~~~~~~~~~ ./include/linux/fortify-string.h:682:26: note: in expansion of macro ‘__fortify_memcpy_chk’ 682 | #define memcpy(p, q, s) __fortify_memcpy_chk(p, q, s, \ | ^~~~~~~~~~~~~~~~~~~~ drivers/net/wireless/ath/ath12k/wow.c:190:25: note: in expansion of macro ‘memcpy’ 190 | memcpy(pat, eth_pat, eth_pat_len); | ^~~~~~ ./include/linux/fortify-string.h:114:33: error: ‘__builtin_memcpy’ accessing 18446744073709551605 or more bytes at offsets 0 and 0 overlaps 9223372036854775787 bytes at offset -9223372036854775798 [-Werror=restrict] 114 | #define __underlying_memcpy __builtin_memcpy | ^ ./include/linux/fortify-string.h:637:9: note: in expansion of macro ‘__underlying_memcpy’ 637 | __underlying_##op(p, q, __fortify_size); \ | ^~~~~~~~~~~~~ ./include/linux/fortify-string.h:682:26: note: in expansion of macro ‘__fortify_memcpy_chk’ 682 | #define memcpy(p, q, s) __fortify_memcpy_chk(p, q, s, \ | ^~~~~~~~~~~~~~~~~~~~ drivers/net/wireless/ath/ath12k/wow.c:232:25: note: in expansion of macro ‘memcpy’ 232 | memcpy(pat, eth_pat, eth_pat_len); | ^~~~~~ The sum of size_t operands can overflow SIZE_MAX, triggering the warning. Address the issue using the suitable helper. Fixes: 4a3c212eee0e ("wifi: ath12k: add basic WoW functionalities") Signed-off-by: Paolo Abeni Reviewed-by: Kees Cook Acked-by: Jeff Johnson Link: https://patch.msgid.link/3175f87d7227e395b330fd88fb840c1645084ea7.1721127979.git.pabeni@redhat.com Signed-off-by: Jakub Kicinski drivers/net/wireless/ath/ath12k/wow.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) commit 33c97e7c0338d921c2ae0c2e54bf17121007fb94 Author: Günther Noack Date: Thu Jul 11 16:54:57 2024 +0000 landlock: Clarify documentation for struct landlock_ruleset_attr The explanation for @handled_access_fs and @handled_access_net has significant overlap and is better explained together. * Explain the commonalities in structure-level documentation. * Clarify some wording and break up longer sentences. * Put emphasis on the word "handled" to make it clearer that "handled" is a term with special meaning in the context of Landlock. I'd like to transfer this wording into the man pages as well. Signed-off-by: Günther Noack Cc: Alejandro Colomar Cc: Konstantin Meskhidze Cc: linux-security-module@vger.kernel.org Link: https://lore.kernel.org/r/20240711165456.2148590-2-gnoack@google.com [mic: Format commit message] Signed-off-by: Mickaël Salaün include/uapi/linux/landlock.h | 39 +++++++++++++++++++++++---------------- 1 file changed, 23 insertions(+), 16 deletions(-) commit eeb1f825b5dc68047a0556e5ae86d1467920db41 Author: Danilo Krummrich Date: Mon Jul 15 15:51:33 2024 +0200 drm/gpuvm: fix missing dependency to DRM_EXEC In commit 50c1a36f594b ("drm/gpuvm: track/lock/validate external/evicted objects") we started using drm_exec, but did not select DRM_EXEC in the Kconfig for DRM_GPUVM, fix this. Cc: Christian König Cc: Boris Brezillon Cc: Thomas Hellström Fixes: 50c1a36f594b ("drm/gpuvm: track/lock/validate external/evicted objects") Signed-off-by: Danilo Krummrich Reviewed-by: Christian König Link: https://patchwork.freedesktop.org/patch/msgid/20240715135158.133287-1-dakr@redhat.com drivers/gpu/drm/Kconfig | 1 + 1 file changed, 1 insertion(+) commit 2a1fc7dc36260fbe74b6ca29dc6d9088194a2115 Author: Sean Christopherson Date: Fri Jul 12 07:48:41 2024 -0700 KVM: x86: Suppress MMIO that is triggered during task switch emulation Explicitly suppress userspace emulated MMIO exits that are triggered when emulating a task switch as KVM doesn't support userspace MMIO during complex (multi-step) emulation. Silently ignoring the exit request can result in the WARN_ON_ONCE(vcpu->mmio_needed) firing if KVM exits to userspace for some other reason prior to purging mmio_needed. See commit 0dc902267cb3 ("KVM: x86: Suppress pending MMIO write exits if emulator detects exception") for more details on KVM's limitations with respect to emulated MMIO during complex emulator flows. Reported-by: syzbot+2fb9f8ed752c01bc9a3f@syzkaller.appspotmail.com Signed-off-by: Sean Christopherson Message-ID: <20240712144841.1230591-1-seanjc@google.com> Signed-off-by: Paolo Bonzini arch/x86/kvm/x86.c | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-) commit 9fe17d2ada6e4ec05502a8725e87def023e1d74e Author: Sean Christopherson Date: Fri Jul 12 08:13:35 2024 -0700 KVM: x86/mmu: Clean up make_huge_page_split_spte() definition and intro Tweak the definition of make_huge_page_split_spte() to eliminate an unnecessarily long line, and opportunistically initialize child_spte to make it more obvious that the child is directly derived from the huge parent. No functional change intended. Signed-off-by: Sean Christopherson Message-ID: <20240712151335.1242633-3-seanjc@google.com> Signed-off-by: Paolo Bonzini arch/x86/kvm/mmu/spte.c | 8 +++----- 1 file changed, 3 insertions(+), 5 deletions(-) commit 3d4415ed75a57fc96ea203a9832e3c5ac5982719 Author: Sean Christopherson Date: Fri Jul 12 08:13:34 2024 -0700 KVM: x86/mmu: Bug the VM if KVM tries to split a !hugepage SPTE Bug the VM instead of simply warning if KVM tries to split a SPTE that is non-present or not-huge. KVM is guaranteed to end up in a broken state as the callers fully expect a valid SPTE, e.g. the shadow MMU will add an rmap entry, and all MMUs will account the expected small page. Returning '0' is also technically wrong now that SHADOW_NONPRESENT_VALUE exists, i.e. would cause KVM to create a potential #VE SPTE. While it would be possible to have the callers gracefully handle failure, doing so would provide no practical value as the scenario really should be impossible, while the error handling would add a non-trivial amount of noise. Fixes: a3fe5dbda0a4 ("KVM: x86/mmu: Split huge pages mapped by the TDP MMU when dirty logging is enabled") Cc: David Matlack Signed-off-by: Sean Christopherson Message-ID: <20240712151335.1242633-2-seanjc@google.com> Signed-off-by: Paolo Bonzini arch/x86/kvm/mmu/spte.c | 6 +----- 1 file changed, 1 insertion(+), 5 deletions(-) commit 208a352a5490f2fa4b78d702035036af1a53a287 Merge: 1229cbefa679 45405155d876 Author: Paolo Bonzini Date: Tue Jul 16 09:56:41 2024 -0400 Merge tag 'kvm-x86-vmx-6.11' of https://github.com/kvm-x86/linux into HEAD KVM VMX changes for 6.11 - Remove an unnecessary EPT TLB flush when enabling hardware. - Fix a series of bugs that cause KVM to fail to detect nested pending posted interrupts as valid wake eents for a vCPU executing HLT in L2 (with HLT-exiting disable by L1). - Misc cleanups commit 1229cbefa67969044fddd329ec498b4bbd0d32a1 Merge: dbfd50cb4512 704ec48fc2fb Author: Paolo Bonzini Date: Tue Jul 16 09:55:39 2024 -0400 Merge tag 'kvm-x86-svm-6.11' of https://github.com/kvm-x86/linux into HEAD KVM SVM changes for 6.11 - Make per-CPU save_area allocations NUMA-aware. - Force sev_es_host_save_area() to be inlined to avoid calling into an instrumentable function from noinstr code. commit dbfd50cb4512990c3619e72d9d4c9a31352aba8f Merge: cda231cd42f5 4669de42aa6c Author: Paolo Bonzini Date: Tue Jul 16 09:55:27 2024 -0400 Merge tag 'kvm-x86-selftests-6.11' of https://github.com/kvm-x86/linux into HEAD KVM selftests for 6.11 - Remove dead code in the memslot modification stress test. - Treat "branch instructions retired" as supported on all AMD Family 17h+ CPUs. - Print the guest pseudo-RNG seed only when it changes, to avoid spamming the log for tests that create lots of VMs. - Make the PMU counters test less flaky when counting LLC cache misses by doing CLFLUSH{OPT} in every loop iteration. commit cda231cd42f5d6c4f054071f7fce4f1fe0423e13 Merge: 5c5ddf71071f f287bef6ddc2 Author: Paolo Bonzini Date: Tue Jul 16 09:55:15 2024 -0400 Merge tag 'kvm-x86-pmu-6.11' of https://github.com/kvm-x86/linux into HEAD KVM x86/pmu changes for 6.11 - Don't advertise IA32_PERF_GLOBAL_OVF_CTRL as an MSR-to-be-saved, as it reads '0' and writes from userspace are ignored. - Update to the newfangled Intel CPU FMS infrastructure. - Use macros instead of open-coded literals to clean up KVM's manipulation of FIXED_CTR_CTRL MSRs. commit 5c5ddf71071f01fabe9380e16c36c9263d40d528 Merge: 34b69edecb47 377b2f359d1f Author: Paolo Bonzini Date: Tue Jul 16 09:54:57 2024 -0400 Merge tag 'kvm-x86-mtrrs-6.11' of https://github.com/kvm-x86/linux into HEAD KVM x86 MTRR virtualization removal Remove support for virtualizing MTRRs on Intel CPUs, along with a nasty CR0.CD hack, and instead always honor guest PAT on CPUs that support self-snoop. commit 34b69edecb47284e81f0204a50db5e55fe93cb52 Merge: 5dcc1e76144f 0089c055b560 Author: Paolo Bonzini Date: Tue Jul 16 09:53:28 2024 -0400 Merge tag 'kvm-x86-mmu-6.11' of https://github.com/kvm-x86/linux into HEAD KVM x86 MMU changes for 6.11 - Don't allocate kvm_mmu_page.shadowed_translation for shadow pages that can't hold leafs SPTEs. - Unconditionally drop mmu_lock when allocating TDP MMU page tables for eager page splitting to avoid stalling vCPUs when splitting huge pages. - Misc cleanups commit 5dcc1e76144fcf7bfe182bd98572d1957a380bac Merge: 86014c1e20fa 82222ee7e84c Author: Paolo Bonzini Date: Tue Jul 16 09:53:05 2024 -0400 Merge tag 'kvm-x86-misc-6.11' of https://github.com/kvm-x86/linux into HEAD KVM x86 misc changes for 6.11 - Add a global struct to consolidate tracking of host values, e.g. EFER, and move "shadow_phys_bits" into the structure as "maxphyaddr". - Add KVM_CAP_X86_APIC_BUS_CYCLES_NS to allow configuring the effective APIC bus frequency, because TDX. - Print the name of the APICv/AVIC inhibits in the relevant tracepoint. - Clean up KVM's handling of vendor specific emulation to consistently act on "compatible with Intel/AMD", versus checking for a specific vendor. - Misc cleanups commit 86014c1e20fa1b5d5c6968f37fdd2f1b6c94d519 Merge: f4501e8bc88d 25bc6af60f61 Author: Paolo Bonzini Date: Tue Jul 16 09:51:36 2024 -0400 Merge tag 'kvm-x86-generic-6.11' of https://github.com/kvm-x86/linux into HEAD KVM generic changes for 6.11 - Enable halt poll shrinking by default, as Intel found it to be a clear win. - Setup empty IRQ routing when creating a VM to avoid having to synchronize SRCU when creating a split IRQCHIP on x86. - Rework the sched_in/out() paths to replace kvm_arch_sched_in() with a flag that arch code can use for hooking both sched_in() and sched_out(). - Take the vCPU @id as an "unsigned long" instead of "u32" to avoid truncating a bogus value from userspace, e.g. to help userspace detect bugs. - Mark a vCPU as preempted if and only if it's scheduled out while in the KVM_RUN loop, e.g. to avoid marking it preempted and thus writing guest memory when retrieving guest state during live migration blackout. - A few minor cleanups commit f4501e8bc88db2548b37afe100506358f1bf7504 Merge: 1c5a0b55abeb ebbdf37ce9ab Author: Paolo Bonzini Date: Tue Jul 16 09:51:14 2024 -0400 Merge tag 'kvm-x86-fixes-6.10-11' of https://github.com/kvm-x86/linux into HEAD KVM Xen: Fix a bug where KVM fails to check the validity of an incoming userspace virtual address and tries to activate a gfn_to_pfn_cache with a kernel address. commit 1c5a0b55abeb6d99ed0962c6a6fa611821949523 Merge: c8b8b8190a80 bb032b2352c3 Author: Paolo Bonzini Date: Tue Jul 16 09:50:44 2024 -0400 Merge tag 'kvmarm-6.11' of git://git.kernel.org/pub/scm/linux/kernel/git/kvmarm/kvmarm into HEAD KVM/arm64 changes for 6.11 - Initial infrastructure for shadow stage-2 MMUs, as part of nested virtualization enablement - Support for userspace changes to the guest CTR_EL0 value, enabling (in part) migration of VMs between heterogenous hardware - Fixes + improvements to pKVM's FF-A proxy, adding support for v1.1 of the protocol - FPSIMD/SVE support for nested, including merged trap configuration and exception routing - New command-line parameter to control the WFx trap behavior under KVM - Introduce kCFI hardening in the EL2 hypervisor - Fixes + cleanups for handling presence/absence of FEAT_TCRX - Miscellaneous fixes + documentation updates commit 6f6a23d42bdfbbfe1b41a23e2c78319a0cc65db3 Author: Curtis Malainey Date: Tue Jul 16 10:40:12 2024 +0200 ASoC: Intel: Fix RT5650 SSP lookup Commit 8efcd4864652 ("ASoC: Intel: sof_rt5682: use common module for sof_card_private initialization") migrated the pin assignment in the context struct up to soc-acpi-intel-ssp-common.c. This uses a lookup table to see if a device has a amp/codec before assigning the pin. The issue here arises when combination parts that serve both (with 2 ports) are used. sysfs: cannot create duplicate filename '/devices/pci0000:00/0000:00:1f.3/adl_rt5682_def/SSP0-Codec' CPU: 1 PID: 2079 Comm: udevd Tainted: G U 6.6.36-03391-g744739e00023 #1 3be1a2880a0970f65545a957db7d08ef4b3e2c0d Hardware name: Google Anraggar/Anraggar, BIOS Google_Anraggar.15217.552.0 05/07/2024 Call Trace: dump_stack_lvl+0x69/0xa0 sysfs_warn_dup+0x5b/0x70 sysfs_create_dir_ns+0xb0/0x100 kobject_add_internal+0x133/0x3c0 kobject_add+0x66/0xb0 ? device_add+0x65/0x780 device_add+0x164/0x780 snd_soc_add_pcm_runtimes+0x2fa/0x800 snd_soc_bind_card+0x35e/0xc20 devm_snd_soc_register_card+0x48/0x90 platform_probe+0x7b/0xb0 really_probe+0xf7/0x2a0 ... kobject: kobject_add_internal failed for SSP0-Codec with -EEXIST, don't try to register things with the same name in the same directory. The issue is that the ALC5650 was only defined in the codec table and not the amp table which left the pin unassigned but the dai link was still created by the machine driver. Also patch the suffix filename code for the topology to prevent double suffix names as a result of this change. Fixes: 8efcd4864652 ("ASoC: Intel: sof_rt5682: use common module for sof_card_private initialization") Reviewed-by: Bard Liao Signed-off-by: Curtis Malainey Signed-off-by: Pierre-Louis Bossart Link: https://patch.msgid.link/20240716084012.299257-1-pierre-louis.bossart@linux.intel.com Signed-off-by: Mark Brown sound/soc/intel/common/soc-acpi-intel-ssp-common.c | 9 +++++++++ sound/soc/sof/intel/hda.c | 17 +++++++++-------- 2 files changed, 18 insertions(+), 8 deletions(-) commit 9ee3f0d8c9999eb1ef2866e86f8d57d996fc0348 Author: Pierre-Louis Bossart Date: Tue Jul 16 10:45:30 2024 +0200 ASOC: SOF: Intel: hda-loader: only wait for HDaudio IOC for IPC4 devices Multiple users report a regression bisected to commit d5263dbbd8af ("ASoC: SOF: Intel: don't ignore IOC interrupts for non-audio transfers"). The firmware version is the likely suspect, as these users relied on SOF 2.0 while Intel only tested with the 2.2 release. Rather than completely disable the wait_for_completion(), which can help us gather timing information on the different stages of the boot process, the simplest course of action is to just disable it for older IPC versions which are no longer under active development. Closes: https://github.com/thesofproject/linux/issues/5072 Closes: https://bugzilla.kernel.org/show_bug.cgi?id=218961 Fixes: d5263dbbd8af ("ASoC: SOF: Intel: don't ignore IOC interrupts for non-audio transfers") Tested-by: Mike Krinkin Tested-by: Todd Brandt Signed-off-by: Pierre-Louis Bossart Reviewed-by: Bard Liao Link: https://patch.msgid.link/20240716084530.300829-1-pierre-louis.bossart@linux.intel.com Signed-off-by: Mark Brown sound/soc/sof/intel/hda-loader.c | 20 ++++++++++++-------- 1 file changed, 12 insertions(+), 8 deletions(-) commit 7dc357d343f134bf59815ff6098b93503ec8a23b Author: Hao Ge Date: Tue Jul 9 10:33:37 2024 +0800 tpm: Use auth only after NULL check in tpm_buf_check_hmac_response() Dereference auth after NULL check in tpm_buf_check_hmac_response(). Otherwise, unless tpm2_sessions_init() was called, a call can cause NULL dereference, when TCG_TPM2_HMAC is enabled. [jarkko: adjusted the commit message.] Cc: stable@vger.kernel.org # v6.10+ Fixes: 7ca110f2679b ("tpm: Address !chip->auth in tpm_buf_append_hmac_session*()") Signed-off-by: Hao Ge Signed-off-by: Jarkko Sakkinen drivers/char/tpm/tpm2-sessions.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) commit 30b866413e7bdd507a79854b5931528d3f6f438f Merge: e518f368303d a67a1deb11d9 Author: Benjamin Tissoires Date: Tue Jul 16 12:27:26 2024 +0200 Merge branch 'for-6.11/bpf' into for-linus - Rewrite of HID-BPF internal implementation to use bpf struct_ops instead of tracing (Benjamin Tissoires) - Add new HID-BPF hooks to be able to intercept userspace calls targetting a HID device and filtering them (Benjamin Tissoires) - Add support for various new devices through HID-BPF filters (Benjamin Tissoires) commit e518f368303d35017fe79f21f0fec7860ef71d0b Merge: 2fe90223ebd4 06483d251df6 Author: Benjamin Tissoires Date: Tue Jul 16 12:24:46 2024 +0200 Merge branch 'for-6.11/uclogic' into for-linus Couple of hid-uclogic fixes by José Expósito: - Support HUION devices with up to 20 buttons - Use Rx and Ry for touch strips commit 2fe90223ebd44c2fa33b788926b415f885906cc4 Merge: d0dcd1952e54 09bae5876dde Author: Benjamin Tissoires Date: Tue Jul 16 12:24:04 2024 +0200 Merge branch 'for-6.11/nintendo' into for-linus Cleanup unused functions in hid-nintendo by Jiapeng Chong commit d0dcd1952e54a1668058b789f3933a9319ff3372 Merge: a07ead311700 8bb9f9fa59ef Author: Benjamin Tissoires Date: Tue Jul 16 12:22:09 2024 +0200 Merge branch 'for-6.11/intel-ish-hid' into for-linus Couple of minor fixes on intel-ish-hid by Jeff Johnson: - add missing MODULE_DESCRIPTION - add missing doctext entry commit a07ead311700a74cb013aa3df7e7dba527e99547 Merge: 3c69140734a2 394ba612f941 Author: Benjamin Tissoires Date: Tue Jul 16 12:21:09 2024 +0200 Merge branch 'for-6.11/apple' into for-linus Add support for the magic keyboard backlight (Orlando Chamberlain) commit 3c69140734a27f8b145f12fa0ae80c1fe36a02ca Merge: 5ba28be6be8a 8a25418ba65a Author: Benjamin Tissoires Date: Tue Jul 16 12:19:28 2024 +0200 Merge branch 'for-6.11/trivial' into for-linus Couple of trivial fixes: - extra semicolon (Chen Ni) - typo (Thorsten Blum) commit 5ba28be6be8ac6cd4fa1ac67cd4da237d39917d2 Merge: b5c4881bda64 523e6f4f50fc Author: Benjamin Tissoires Date: Tue Jul 16 12:18:28 2024 +0200 Merge branch 'for-6.11/module-description' into for-linus - add a bunch of missing MODULE_DESCRIPTION (Jeff Johnson) commit b5c4881bda64ddf8d83ea6c116365294028b7ce4 Merge: 22c0a46a0d97 b81881b9c10e Author: Benjamin Tissoires Date: Tue Jul 16 12:16:04 2024 +0200 Merge branch 'for-6.11/core' into for-linus Couple of fixes for HID-core: - use of kvzalloc in case memory gets too fragmented (Hailong Liu) - retrieve the device firmware node in the child HID device (Danny Kaehn) commit c26b1b89b8a9fd8665e79cd798bd970e233772b6 Author: Masami Hiramatsu (Google) Date: Fri Jul 12 09:26:17 2024 +0900 MAINTAINERS: Add uprobes entry Add uprobes entry to MAINTAINERS to clarify the maintainers. Link: https://lore.kernel.org/all/172074397710.247544.17045299807723238107.stgit@devnote2/ Suggested-by: Peter Zijlstra Signed-off-by: Masami Hiramatsu (Google) Acked-by: Peter Zijlstra (Intel) Acked-by: Oleg Nesterov MAINTAINERS | 13 +++++++++++++ 1 file changed, 13 insertions(+) commit 3f45181358e4df50a40ea1bb51b00a1f295f915e Author: Kuniyuki Iwashima Date: Sun Jul 14 09:17:19 2024 -0700 tcp: Don't access uninit tcp_rsk(req)->ao_keyid in tcp_create_openreq_child(). syzkaller reported KMSAN splat in tcp_create_openreq_child(). [0] The uninit variable is tcp_rsk(req)->ao_keyid. tcp_rsk(req)->ao_keyid is initialised only when tcp_conn_request() finds a valid TCP AO option in SYN. Then, tcp_rsk(req)->used_tcp_ao is set accordingly. Let's not read tcp_rsk(req)->ao_keyid when tcp_rsk(req)->used_tcp_ao is false. [0]: BUG: KMSAN: uninit-value in tcp_create_openreq_child+0x198b/0x1ff0 net/ipv4/tcp_minisocks.c:610 tcp_create_openreq_child+0x198b/0x1ff0 net/ipv4/tcp_minisocks.c:610 tcp_v4_syn_recv_sock+0x18e/0x2170 net/ipv4/tcp_ipv4.c:1754 tcp_check_req+0x1a3e/0x20c0 net/ipv4/tcp_minisocks.c:852 tcp_v4_rcv+0x26a4/0x53a0 net/ipv4/tcp_ipv4.c:2265 ip_protocol_deliver_rcu+0x884/0x1270 net/ipv4/ip_input.c:205 ip_local_deliver_finish+0x30f/0x530 net/ipv4/ip_input.c:233 NF_HOOK include/linux/netfilter.h:314 [inline] ip_local_deliver+0x230/0x4c0 net/ipv4/ip_input.c:254 dst_input include/net/dst.h:460 [inline] ip_sublist_rcv_finish net/ipv4/ip_input.c:580 [inline] ip_list_rcv_finish net/ipv4/ip_input.c:631 [inline] ip_sublist_rcv+0x10f7/0x13e0 net/ipv4/ip_input.c:639 ip_list_rcv+0x952/0x9c0 net/ipv4/ip_input.c:674 __netif_receive_skb_list_ptype net/core/dev.c:5703 [inline] __netif_receive_skb_list_core+0xd92/0x11d0 net/core/dev.c:5751 __netif_receive_skb_list net/core/dev.c:5803 [inline] netif_receive_skb_list_internal+0xd8f/0x1350 net/core/dev.c:5895 gro_normal_list include/net/gro.h:515 [inline] napi_complete_done+0x3f2/0x990 net/core/dev.c:6246 e1000_clean+0x1fa4/0x5e50 drivers/net/ethernet/intel/e1000/e1000_main.c:3808 __napi_poll+0xd9/0x990 net/core/dev.c:6771 napi_poll net/core/dev.c:6840 [inline] net_rx_action+0x90f/0x17e0 net/core/dev.c:6962 handle_softirqs+0x152/0x6b0 kernel/softirq.c:554 __do_softirq kernel/softirq.c:588 [inline] invoke_softirq kernel/softirq.c:428 [inline] __irq_exit_rcu kernel/softirq.c:637 [inline] irq_exit_rcu+0x5d/0x120 kernel/softirq.c:649 common_interrupt+0x83/0x90 arch/x86/kernel/irq.c:278 asm_common_interrupt+0x26/0x40 arch/x86/include/asm/idtentry.h:693 __msan_instrument_asm_store+0xd6/0xe0 arch_atomic_inc arch/x86/include/asm/atomic.h:53 [inline] raw_atomic_inc include/linux/atomic/atomic-arch-fallback.h:992 [inline] atomic_inc include/linux/atomic/atomic-instrumented.h:436 [inline] page_ref_inc include/linux/page_ref.h:153 [inline] folio_ref_inc include/linux/page_ref.h:160 [inline] filemap_map_order0_folio mm/filemap.c:3596 [inline] filemap_map_pages+0x11c7/0x2270 mm/filemap.c:3644 do_fault_around mm/memory.c:4879 [inline] do_read_fault mm/memory.c:4912 [inline] do_fault mm/memory.c:5051 [inline] do_pte_missing mm/memory.c:3897 [inline] handle_pte_fault mm/memory.c:5381 [inline] __handle_mm_fault mm/memory.c:5524 [inline] handle_mm_fault+0x3677/0x6f00 mm/memory.c:5689 do_user_addr_fault+0x1373/0x2b20 arch/x86/mm/fault.c:1338 handle_page_fault arch/x86/mm/fault.c:1481 [inline] exc_page_fault+0x54/0xc0 arch/x86/mm/fault.c:1539 asm_exc_page_fault+0x26/0x30 arch/x86/include/asm/idtentry.h:623 Uninit was stored to memory at: tcp_create_openreq_child+0x1984/0x1ff0 net/ipv4/tcp_minisocks.c:611 tcp_v4_syn_recv_sock+0x18e/0x2170 net/ipv4/tcp_ipv4.c:1754 tcp_check_req+0x1a3e/0x20c0 net/ipv4/tcp_minisocks.c:852 tcp_v4_rcv+0x26a4/0x53a0 net/ipv4/tcp_ipv4.c:2265 ip_protocol_deliver_rcu+0x884/0x1270 net/ipv4/ip_input.c:205 ip_local_deliver_finish+0x30f/0x530 net/ipv4/ip_input.c:233 NF_HOOK include/linux/netfilter.h:314 [inline] ip_local_deliver+0x230/0x4c0 net/ipv4/ip_input.c:254 dst_input include/net/dst.h:460 [inline] ip_sublist_rcv_finish net/ipv4/ip_input.c:580 [inline] ip_list_rcv_finish net/ipv4/ip_input.c:631 [inline] ip_sublist_rcv+0x10f7/0x13e0 net/ipv4/ip_input.c:639 ip_list_rcv+0x952/0x9c0 net/ipv4/ip_input.c:674 __netif_receive_skb_list_ptype net/core/dev.c:5703 [inline] __netif_receive_skb_list_core+0xd92/0x11d0 net/core/dev.c:5751 __netif_receive_skb_list net/core/dev.c:5803 [inline] netif_receive_skb_list_internal+0xd8f/0x1350 net/core/dev.c:5895 gro_normal_list include/net/gro.h:515 [inline] napi_complete_done+0x3f2/0x990 net/core/dev.c:6246 e1000_clean+0x1fa4/0x5e50 drivers/net/ethernet/intel/e1000/e1000_main.c:3808 __napi_poll+0xd9/0x990 net/core/dev.c:6771 napi_poll net/core/dev.c:6840 [inline] net_rx_action+0x90f/0x17e0 net/core/dev.c:6962 handle_softirqs+0x152/0x6b0 kernel/softirq.c:554 __do_softirq kernel/softirq.c:588 [inline] invoke_softirq kernel/softirq.c:428 [inline] __irq_exit_rcu kernel/softirq.c:637 [inline] irq_exit_rcu+0x5d/0x120 kernel/softirq.c:649 common_interrupt+0x83/0x90 arch/x86/kernel/irq.c:278 asm_common_interrupt+0x26/0x40 arch/x86/include/asm/idtentry.h:693 Uninit was created at: __alloc_pages_noprof+0x82d/0xcb0 mm/page_alloc.c:4706 __alloc_pages_node_noprof include/linux/gfp.h:269 [inline] alloc_pages_node_noprof include/linux/gfp.h:296 [inline] alloc_slab_page mm/slub.c:2265 [inline] allocate_slab mm/slub.c:2428 [inline] new_slab+0x2af/0x14e0 mm/slub.c:2481 ___slab_alloc+0xf73/0x3150 mm/slub.c:3667 __slab_alloc mm/slub.c:3757 [inline] __slab_alloc_node mm/slub.c:3810 [inline] slab_alloc_node mm/slub.c:3990 [inline] kmem_cache_alloc_noprof+0x53a/0x9f0 mm/slub.c:4009 reqsk_alloc_noprof net/ipv4/inet_connection_sock.c:920 [inline] inet_reqsk_alloc+0x63/0x700 net/ipv4/inet_connection_sock.c:951 tcp_conn_request+0x339/0x4860 net/ipv4/tcp_input.c:7177 tcp_v4_conn_request+0x13b/0x190 net/ipv4/tcp_ipv4.c:1719 tcp_rcv_state_process+0x2dd/0x4a10 net/ipv4/tcp_input.c:6711 tcp_v4_do_rcv+0xbee/0x10d0 net/ipv4/tcp_ipv4.c:1932 tcp_v4_rcv+0x3fad/0x53a0 net/ipv4/tcp_ipv4.c:2334 ip_protocol_deliver_rcu+0x884/0x1270 net/ipv4/ip_input.c:205 ip_local_deliver_finish+0x30f/0x530 net/ipv4/ip_input.c:233 NF_HOOK include/linux/netfilter.h:314 [inline] ip_local_deliver+0x230/0x4c0 net/ipv4/ip_input.c:254 dst_input include/net/dst.h:460 [inline] ip_sublist_rcv_finish net/ipv4/ip_input.c:580 [inline] ip_list_rcv_finish net/ipv4/ip_input.c:631 [inline] ip_sublist_rcv+0x10f7/0x13e0 net/ipv4/ip_input.c:639 ip_list_rcv+0x952/0x9c0 net/ipv4/ip_input.c:674 __netif_receive_skb_list_ptype net/core/dev.c:5703 [inline] __netif_receive_skb_list_core+0xd92/0x11d0 net/core/dev.c:5751 __netif_receive_skb_list net/core/dev.c:5803 [inline] netif_receive_skb_list_internal+0xd8f/0x1350 net/core/dev.c:5895 gro_normal_list include/net/gro.h:515 [inline] napi_complete_done+0x3f2/0x990 net/core/dev.c:6246 e1000_clean+0x1fa4/0x5e50 drivers/net/ethernet/intel/e1000/e1000_main.c:3808 __napi_poll+0xd9/0x990 net/core/dev.c:6771 napi_poll net/core/dev.c:6840 [inline] net_rx_action+0x90f/0x17e0 net/core/dev.c:6962 handle_softirqs+0x152/0x6b0 kernel/softirq.c:554 __do_softirq kernel/softirq.c:588 [inline] invoke_softirq kernel/softirq.c:428 [inline] __irq_exit_rcu kernel/softirq.c:637 [inline] irq_exit_rcu+0x5d/0x120 kernel/softirq.c:649 common_interrupt+0x83/0x90 arch/x86/kernel/irq.c:278 asm_common_interrupt+0x26/0x40 arch/x86/include/asm/idtentry.h:693 CPU: 0 PID: 239 Comm: modprobe Tainted: G B 6.10.0-rc7-01816-g852e42cc2dd4 #3 1107521f0c7b55c9309062382d0bda9f604dbb6d Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.3-0-ga6ed6b701f0a-prebuilt.qemu.org 04/01/2014 Fixes: 06b22ef29591 ("net/tcp: Wire TCP-AO to request sockets") Reported-by: syzkaller Signed-off-by: Kuniyuki Iwashima Reviewed-by: Eric Dumazet Acked-by: Dmitry Safonov <0x7f454c46@gmail.com> Link: https://patch.msgid.link/20240714161719.6528-1-kuniyu@amazon.com Signed-off-by: Paolo Abeni net/ipv4/tcp_minisocks.c | 15 ++++++++------- 1 file changed, 8 insertions(+), 7 deletions(-) commit d8b17a364ec48239fccb65efe74bb485e79e6743 Author: Luke D. Jones Date: Tue Jul 16 13:11:30 2024 +1200 platform/x86: asus-wmi: fix TUF laptop RGB variant In kbd_rgb_mode_store the dev_get_drvdata() call was assuming the device data was asus_wmi when it was actually led_classdev. This patch corrects this by making the correct chain of calls to get the asus_wmi driver data. Fixes: ae834a549ec1 ("platform/x86: asus-wmi: add support variant of TUF RGB") Tested-by: Denis Benato Signed-off-by: Luke D. Jones Reviewed-by: Hans de Goede Link: https://lore.kernel.org/r/20240716011130.17464-2-luke@ljones.dev Reviewed-by: Ilpo Järvinen Signed-off-by: Ilpo Järvinen drivers/platform/x86/asus-wmi.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) commit 182c6941c55347c735e70ffca77741cd000cbec7 Author: Dan Carpenter Date: Mon Jul 15 15:22:55 2024 -0500 platform/x86/intel/tpmi/plr: Fix output in plr_print_bits() Smatch complains that 'str' can be used without being initialized: drivers/platform/x86/intel/intel_plr_tpmi.c:178 plr_print_bits() error: uninitialized symbol 'str'. In this loop, we iterate over all the set bits and print the name of the bit. The intention is that if there is a bit which is between 0-31 we look for the name in the first array plr_coarse_reasons[] which has 10 elements. If the bit is in the 32-63 range we look for it in the plr_fine_reasons[] array which has 30 elements. If the bit is in the invalid ranges, 10-31 or 62-63, then we should print "UNKNOWN(%d)". The problem is that 'str' needs to be initialized at the start of each iteration, otherwise if we can't find the string then instead of printing "UNKNOWN(%d)", we will re-print whatever the previous bit was. Fixes: 9e9397a41b7b ("platform/x86/intel/tpmi/plr: Add support for the plr mailbox") Signed-off-by: Dan Carpenter Link: https://lore.kernel.org/r/b0084e70-4144-445a-9b89-fb19f6b8336a@stanley.mountain Reviewed-by: Ilpo Järvinen Signed-off-by: Ilpo Järvinen drivers/platform/x86/intel/intel_plr_tpmi.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) commit 9d20c0535ea822e7306049bfc735bd0fb83400c1 Author: Ilpo Järvinen Date: Mon Jul 15 13:41:02 2024 +0300 Docs/admin-guide: Remove pmf leftover reference from the index pmf.rst was removed by the commit 2fd66f7d3b0d ("platform/x86/amd/pmf: Remove update system state document") but the reference in the admin-guide index remained in place which triggers this warning: Documentation/admin-guide/index.rst:75: WARNING: toctree contains reference to nonexisting document 'admin-guide/pmf' Remove pmf also from the index to avoid the warning. Reported-by: Stephen Rothwell Acked-by: Randy Dunlap Link: https://lore.kernel.org/r/20240715104102.4615-1-ilpo.jarvinen@linux.intel.com Signed-off-by: Ilpo Järvinen Documentation/admin-guide/index.rst | 1 - 1 file changed, 1 deletion(-) commit 509580fad7323b6a5da27e8365cd488f3b57210e Author: Imre Deak Date: Mon Jul 8 22:00:25 2024 +0300 drm/i915/dp: Don't switch the LTTPR mode on an active link Switching to transparent mode leads to a loss of link synchronization, so prevent doing this on an active link. This happened at least on an Intel N100 system / DELL UD22 dock, the LTTPR residing either on the host or the dock. To fix the issue, keep the current mode on an active link, adjusting the LTTPR count accordingly (resetting it to 0 in transparent mode). v2: Adjust code comment during link training about reiniting the LTTPRs. (Ville) Fixes: 7b2a4ab8b0ef ("drm/i915: Switch to LTTPR transparent mode link training") Reported-and-tested-by: Gareth Yu Closes: https://gitlab.freedesktop.org/drm/i915/kernel/-/issues/10902 Cc: # v5.15+ Cc: Ville Syrjälä Reviewed-by: Ville Syrjälä Reviewed-by: Ankit Nautiyal Signed-off-by: Imre Deak Link: https://patchwork.freedesktop.org/patch/msgid/20240708190029.271247-3-imre.deak@intel.com (cherry picked from commit 211ad49cf8ccfdc798a719b4d1e000d0a8a9e588) Signed-off-by: Tvrtko Ursulin .../gpu/drm/i915/display/intel_dp_link_training.c | 55 +++++++++++++++++++--- 1 file changed, 48 insertions(+), 7 deletions(-) commit d13e2a6e95e6b87f571c837c71a3d05691def9bb Author: Imre Deak Date: Mon Jul 8 22:00:24 2024 +0300 drm/i915/dp: Reset intel_dp->link_trained before retraining the link Regularly retraining a link during an atomic commit happens with the given pipe/link already disabled and hence intel_dp->link_trained being false. Ensure this also for retraining a DP SST link via direct calls to the link training functions (vs. an actual commit as for DP MST). So far nothing depended on this, however the next patch will depend on link_trained==false for changing the LTTPR mode to non-transparent. Cc: # v5.15+ Cc: Ville Syrjälä Reviewed-by: Ankit Nautiyal Signed-off-by: Imre Deak Link: https://patchwork.freedesktop.org/patch/msgid/20240708190029.271247-2-imre.deak@intel.com (cherry picked from commit a4d5ce61765c08ab364aa4b327f6739b646e6cfa) Signed-off-by: Tvrtko Ursulin drivers/gpu/drm/i915/display/intel_dp.c | 2 ++ 1 file changed, 2 insertions(+) commit 94a4b0a4cb4340273a2d67be893f9032fe7b7e26 Author: Masahiro Yamada Date: Mon Jul 8 00:38:06 2024 +0900 kconfig: remove SYMBOL_CHOICEVAL flag This flag is unneeded because a choice member can be detected by other means. Signed-off-by: Masahiro Yamada scripts/kconfig/expr.h | 1 - scripts/kconfig/gconf.c | 2 +- scripts/kconfig/lkc.h | 5 +---- scripts/kconfig/menu.c | 5 ----- scripts/kconfig/symbol.c | 6 ++++++ 5 files changed, 8 insertions(+), 11 deletions(-) commit 6425e3b247b1eff04c64091b2af8811d05546a86 Author: Masahiro Yamada Date: Mon Jul 8 00:38:05 2024 +0900 kconfig: add const qualifiers to several function arguments Clarify that the given structures are not modified. Signed-off-by: Masahiro Yamada scripts/kconfig/expr.c | 4 ++-- scripts/kconfig/expr.h | 4 ++-- scripts/kconfig/lkc.h | 21 +++++++++++---------- scripts/kconfig/lkc_proto.h | 12 +++++++----- scripts/kconfig/menu.c | 15 ++++++++------- scripts/kconfig/parser.y | 4 ++-- scripts/kconfig/symbol.c | 14 +++++++------- scripts/kconfig/util.c | 2 +- 8 files changed, 40 insertions(+), 36 deletions(-) commit 8bfd6f0923cd7e48aa5d9e5a4e20af818a32c30a Author: Masahiro Yamada Date: Mon Jul 8 00:38:04 2024 +0900 kconfig: call expr_eliminate_yn() at least once in expr_eliminate_dups() Kconfig simplifies expressions, but redundant '&&' and '||' operators involving constant symbols 'y' and 'n' are sometimes trimmed and sometimes not. [Test Code] config DEP def_bool y config A bool "A" depends on DEP && y config B bool "B" depends on DEP && y && y [Result] $ make helpnewconfig [ snip ] ----- There is no help available for this option. Symbol: A [=n] Type : bool Defined at Kconfig:4 Prompt: A Depends on: DEP [=y] && y [=y] Location: -> A (A [=n]) ----- ----- There is no help available for this option. Symbol: B [=n] Type : bool Defined at Kconfig:8 Prompt: B Depends on: DEP [=y] Location: -> B (B [=n]) ----- The dependency for A, 'DEP && y', remains as-is, while that for B, 'DEP && y && y', has been reduced to 'DEP'. Currently, expr_eliminate_dups() calls expr_eliminate_yn() only when trans_count != 0, in other words, only when expr_eliminate_dups1() has trimmed at least one leaf. It fails to trim a single '&& y', etc. To fix this inconsistent behavior, expr_eliminate_yn() should be called at least once even if no leaf has been trimmed. Signed-off-by: Masahiro Yamada scripts/kconfig/expr.c | 7 ++----- 1 file changed, 2 insertions(+), 5 deletions(-) commit d67015eedd9722cfbf9d929be743ce27dfcd0744 Author: Masahiro Yamada Date: Fri Jul 5 00:23:32 2024 +0900 kbuild: deb-pkg: use default string when variable is unset or null ${DEBFULLNAME-${user}} falls back to ${user} when DEBFULLNAME is unset. It is more reasonable to do so when DEBFULLNAME is unset or null. Otherwise, the command: $ DEBFULLNAME= make deb-pkg will leave the name field blank. The same applies to KBUILD_BUILD_USER and KBUILD_BUILD_HOST. Signed-off-by: Masahiro Yamada Reviewed-by: Nathan Chancellor scripts/package/mkdebian | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) commit f58437aba0a35825dc14dbbf7a1e452662ef797d Author: Masahiro Yamada Date: Thu Jul 4 22:47:57 2024 +0900 modpost: rename R_ARM_THM_CALL to R_ARM_THM_PC22 /usr/include/elf.h, which originates from the glibc/musl, defines R_ARM_THM_PC22 instead of R_ARM_THM_CALL. Signed-off-by: Masahiro Yamada Reviewed-by: Nathan Chancellor scripts/mod/modpost.c | 6 +----- 1 file changed, 1 insertion(+), 5 deletions(-) commit 3914cdde89c29b681e73e507a04ca50f147482a3 Author: Masahiro Yamada Date: Thu Jul 4 22:47:56 2024 +0900 modpost: remove self-definitions of R_ARM_* macros Commit f5983dab0ead ("modpost: define more R_ARM_* for old distributions") added self-definitions for the R_ARM_* macros to fix build errors on CentOS 7. RHEL/CentOS 7 were retired at the end of June. Remove all the R_ARM_* definitions (except for R_ARM_THM_CALL), which should be available in recent distributions. glibc and musl added most of R_ARM_* macros in 2013. [1] [2] [1]: https://sourceware.org/git/?p=glibc.git;a=commitdiff;h=08cbd996d33114ca50644d060fbe3a08260430fb [2]: https://git.musl-libc.org/cgit/musl/commit/?id=268375c1c017c0bdefeed1a330811e433c4dfaef Signed-off-by: Masahiro Yamada Reviewed-by: Nathan Chancellor scripts/mod/modpost.c | 30 ------------------------------ 1 file changed, 30 deletions(-) commit 5f99665ee8f4335f334a5292b6d5b41a577fc2c0 Author: Masahiro Yamada Date: Thu Jul 4 22:47:55 2024 +0900 kbuild: raise the minimum GNU Make requirement to 4.0 RHEL/CentOS 7, popular distributions that install GNU Make 3.82, reached EOM/EOL on June 30, 2024. While you may get extended support, it is a good time to raise the minimum GNU Make version. The new requirement, GNU Make 4.0, was released in October, 2013. I did not touch the Makefiles under tools/ because I do not know the requirements for building tools. I do not find any GNU Make version checks under tools/. Signed-off-by: Masahiro Yamada Reviewed-by: Nathan Chancellor Documentation/process/changes.rst | 4 ++-- Makefile | 22 +++------------------- scripts/Kbuild.include | 2 +- 3 files changed, 6 insertions(+), 22 deletions(-) commit 712aba5543b88996bc4682086471076fbf048927 Author: Masahiro Yamada Date: Thu Jul 4 22:13:58 2024 +0900 kbuild: avoid build error when single DTB is turned into composite DTB As commit afa974b77128 ("kbuild: add real-prereqs shorthand for $(filter-out FORCE,$^)") explained, $(real-prereqs) is not just a list of objects when linking a multi-object module. If a single-object module is turned into a multi-object module, $^ (and therefore $(real-prereqs) as well) contains header files recorded in the *.cmd file. Such headers must be filtered out. Now that a DTB can be built either from a single source or multiple source files, the same issue can occur. Consider the following scenario: First, foo.dtb is implemented as a single-blob device tree. The code looks something like this: [Sample Code 1] Makefile: dtb-y += foo.dtb foo.dts: #include /dts-v1/; / { }; When it is compiled, .foo.dtb.cmd records that foo.dtb depends on scripts/dtc/include-prefixes/dt-bindings/gpio/gpio.h. Later, foo.dtb is split into a base and an overlay. The code looks something like this: [Sample Code 2] Makefile: dtb-y += foo.dtb foo-dtbs := foo-base.dtb foo-addon.dtbo foo-base.dts: #include /dts-v1/; / { }; foo-addon.dtso: /dts-v1/; /plugin/; / { }; If you rebuild foo.dtb without 'make clean', you will get this error: Overlay 'scripts/dtc/include-prefixes/dt-bindings/gpio/gpio.h' is incomplete $(real-prereqs) contains not only foo-base.dtb and foo-addon.dtbo but also scripts/dtc/include-prefixes/dt-bindings/gpio/gpio.h, which is passed to scripts/dtc/fdtoverlay. Fixes: 15d16d6dadf6 ("kbuild: Add generic rule to apply fdtoverlay") Signed-off-by: Masahiro Yamada scripts/Makefile.lib | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) commit c0414419758b2521c2038847960af258c678db8d Author: Masahiro Yamada Date: Wed Jul 3 03:02:42 2024 +0900 kbuild: package: add -e and -u options to some shell scripts Set -e to make these scripts fail on the first error. Set -u because these scripts are invoked by Makefile, and do not work properly without necessary variables defined. I tweaked mkdebian to cope with optional environment variables. Remove the explicit "test -n ..." from install-extmod-build. Both options are described in POSIX. [1] [1]: https://pubs.opengroup.org/onlinepubs/009604499/utilities/set.html Signed-off-by: Masahiro Yamada Reviewed-by: Nicolas Schier scripts/package/builddeb | 2 +- scripts/package/buildtar | 2 +- scripts/package/gen-diff-patch | 2 ++ scripts/package/install-extmod-build | 5 +---- scripts/package/mkdebian | 22 +++++++++++++++------- scripts/package/mkspec | 2 ++ 6 files changed, 22 insertions(+), 13 deletions(-) commit d67978318827d06f1c0fa4c31343a279e9df6fde Merge: 2439a5eaa753 34b3fc558b53 Author: Linus Torvalds Date: Mon Jul 15 20:25:16 2024 -0700 Merge tag 'x86_cpu_for_v6.11_rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull x86 cpu model updates from Borislav Petkov: - Flip the logic to add feature names to /proc/cpuinfo to having to explicitly specify the flag if there's a valid reason to show it in /proc/cpuinfo - Switch a bunch of Intel x86 model checking code to the new CPU model defines - Fixes and cleanups * tag 'x86_cpu_for_v6.11_rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: x86/cpu/intel: Drop stray FAM6 check with new Intel CPU model defines x86/cpufeatures: Flip the /proc/cpuinfo appearance logic x86/CPU/AMD: Always inline amd_clear_divider() x86/mce/inject: Add missing MODULE_DESCRIPTION() line perf/x86/rapl: Switch to new Intel CPU model defines x86/boot: Switch to new Intel CPU model defines x86/cpu: Switch to new Intel CPU model defines perf/x86/intel: Switch to new Intel CPU model defines x86/virt/tdx: Switch to new Intel CPU model defines x86/PCI: Switch to new Intel CPU model defines x86/cpu/intel: Switch to new Intel CPU model defines x86/platform/intel-mid: Switch to new Intel CPU model defines x86/pconfig: Remove unused MKTME pconfig code x86/cpu: Remove useless work in detect_tme_early() commit 2439a5eaa753d22759fb4248e0f5e459503fffad Merge: f998678baf3c 42c141fbb651 Author: Linus Torvalds Date: Mon Jul 15 20:07:27 2024 -0700 Merge tag 'x86_bugs_for_v6.11_rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull x86 cpu mitigation updates from Borislav Petkov: - Add a spectre_bhi=vmexit mitigation option aimed at cloud environments - Remove duplicated Spectre cmdline option documentation - Add separate macro definitions for syscall handlers which do not return in order to address objtool warnings * tag 'x86_bugs_for_v6.11_rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: x86/bugs: Add 'spectre_bhi=vmexit' cmdline option x86/bugs: Remove duplicate Spectre cmdline option descriptions x86/syscall: Mark exit[_group] syscall handlers __noreturn commit f998678baf3c143fec4c66e7f3a84bae3b25ff12 Merge: 222dfb8326dc 57b7b6acb41b Author: Linus Torvalds Date: Mon Jul 15 20:05:40 2024 -0700 Merge tag 'x86_vmware_for_v6.11_rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull x86 vmware updates from Borislav Petkov: - Add a unified VMware hypercall API layer which should be used by all callers instead of them doing homegrown solutions. This will provide for adding API support for confidential computing solutions like TDX * tag 'x86_vmware_for_v6.11_rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: x86/vmware: Add TDX hypercall support x86/vmware: Remove legacy VMWARE_HYPERCALL* macros x86/vmware: Correct macro names x86/vmware: Use VMware hypercall API drm/vmwgfx: Use VMware hypercall API input/vmmouse: Use VMware hypercall API ptp/vmware: Use VMware hypercall API x86/vmware: Introduce VMware hypercall API commit 3911af778f208e5f49d43ce739332b91e26bc48e Author: Peter Wang Date: Mon Jul 15 14:38:31 2024 +0800 scsi: ufs: core: Fix deadlock during RTC update There is a deadlock when runtime suspend waits for the flush of RTC work, and the RTC work calls ufshcd_rpm_get_sync() to wait for runtime resume. Here is deadlock backtrace: kworker/0:1 D 4892.876354 10 10971 4859 0x4208060 0x8 10 0 120 670730152367 ptr f0ffff80c2e40000 0 1 0x00000001 0x000000ff 0x000000ff 0x000000ff __switch_to+0x1a8/0x2d4 __schedule+0x684/0xa98 schedule+0x48/0xc8 schedule_timeout+0x48/0x170 do_wait_for_common+0x108/0x1b0 wait_for_completion+0x44/0x60 __flush_work+0x39c/0x424 __cancel_work_sync+0xd8/0x208 cancel_delayed_work_sync+0x14/0x28 __ufshcd_wl_suspend+0x19c/0x480 ufshcd_wl_runtime_suspend+0x3c/0x1d4 scsi_runtime_suspend+0x78/0xc8 __rpm_callback+0x94/0x3e0 rpm_suspend+0x2d4/0x65c __pm_runtime_suspend+0x80/0x114 scsi_runtime_idle+0x38/0x6c rpm_idle+0x264/0x338 __pm_runtime_idle+0x80/0x110 ufshcd_rtc_work+0x128/0x1e4 process_one_work+0x26c/0x650 worker_thread+0x260/0x3d8 kthread+0x110/0x134 ret_from_fork+0x10/0x20 Skip updating RTC if RPM state is not RPM_ACTIVE. Fixes: 6bf999e0eb41 ("scsi: ufs: core: Add UFS RTC support") Cc: stable@vger.kernel.org # 6.9.x Signed-off-by: Peter Wang Link: https://lore.kernel.org/r/20240715063831.29792-1-peter.wang@mediatek.com Reviewed-by: Bean Huo Reviewed-by: Bart Van Assche Signed-off-by: Martin K. Petersen drivers/ufs/core/ufshcd-priv.h | 5 +++++ drivers/ufs/core/ufshcd.c | 5 ++++- 2 files changed, 9 insertions(+), 1 deletion(-) commit 022587d8aec3da1d1698ddae9fb8cfe35f3ad49c Author: Peter Wang Date: Fri Jul 12 17:45:06 2024 +0800 scsi: ufs: core: Bypass quick recovery if force reset is needed If force_reset is true, bypass quick recovery. This will shorten error recovery time. Signed-off-by: Peter Wang Link: https://lore.kernel.org/r/20240712094506.11284-1-peter.wang@mediatek.com Reviewed-by: Bean Huo Reviewed-by: Bart Van Assche Signed-off-by: Martin K. Petersen drivers/ufs/core/ufshcd.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) commit 222dfb8326dcdc3181832d80331d2d4956cab42e Merge: 1d86d352411d bf6ab33d8487 Author: Linus Torvalds Date: Mon Jul 15 19:53:07 2024 -0700 Merge tag 'x86_misc_for_v6.11_rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull misc x86 updates from Borislav Petkov: - Make error checking of AMD SMN accesses more robust in the callers as they're the only ones who can interpret the results properly - The usual cleanups and fixes, left and right * tag 'x86_misc_for_v6.11_rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: x86/kmsan: Fix hook for unaligned accesses x86/platform/iosf_mbi: Convert PCIBIOS_* return codes to errnos x86/pci/xen: Fix PCIBIOS_* return code handling x86/pci/intel_mid_pci: Fix PCIBIOS_* return code handling x86/of: Return consistent error type from x86_of_pci_irq_enable() hwmon: (k10temp) Rename _data variable hwmon: (k10temp) Remove unused HAVE_TDIE() macro hwmon: (k10temp) Reduce k10temp_get_ccd_support() parameters hwmon: (k10temp) Define a helper function to read CCD temperature x86/amd_nb: Enhance SMN access error checking hwmon: (k10temp) Check return value of amd_smn_read() EDAC/amd64: Check return value of amd_smn_read() EDAC/amd64: Remove unused register accesses tools/x86/kcpuid: Add missing dir via Makefile x86, arm: Add missing license tag to syscall tables files commit 1d86d352411dab9bf9312c9eb4b2d4020195be45 Merge: 93196575442e 469169803d52 Author: Linus Torvalds Date: Mon Jul 15 19:51:23 2024 -0700 Merge tag 'x86_build_for_v6.11_rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull x86 build update from Borislav Petkov: - Make sure insn support detection uses the proper compiler flag in bi-arch builds * tag 'x86_build_for_v6.11_rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: x86/kconfig: Add as-instr64 macro to properly evaluate AS_WRUSS commit 0c60eb0cc320fffbb8b10329d276af14f6f5e6bf Author: Kyoungrul Kim Date: Wed Jul 10 08:25:20 2024 +0900 scsi: ufs: core: Check LSDBS cap when !mcq If the user sets use_mcq_mode to 0, the host will try to activate the LSDB mode unconditionally even when the LSDBS of device HCI cap is 1. This makes commands time out and causes device probing to fail. To prevent that problem, check the LSDBS cap when MCQ is not supported. Signed-off-by: Kyoungrul Kim Link: https://lore.kernel.org/r/20240709232520epcms2p8ebdb5c4fccc30a6221390566589bf122@epcms2p8 Reviewed-by: Bart Van Assche Signed-off-by: Martin K. Petersen drivers/ufs/core/ufshcd.c | 16 ++++++++++++++++ include/ufs/ufshcd.h | 1 + include/ufs/ufshci.h | 1 + 3 files changed, 18 insertions(+) commit 93196575442e13a1bc4190ecd870ceb21866013c Merge: 98896d8795d7 8a2462df1547 Author: Linus Torvalds Date: Mon Jul 15 19:49:55 2024 -0700 Merge tag 'x86_core_for_v6.11_rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull x86 uaccess update from Borislav Petkov: - Cleanup the 8-byte getuser() asm case * tag 'x86_core_for_v6.11_rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: x86/uaccess: Improve the 8-byte getuser() case commit 98896d8795d72acf166f83b06c2706effa019d92 Merge: 181a984b7d8d 16df35946120 Author: Linus Torvalds Date: Mon Jul 15 19:36:01 2024 -0700 Merge tag 'x86_cc_for_v6.11_rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull x86 confidential computing updates from Borislav Petkov: "Unrelated x86/cc changes queued here to avoid ugly cross-merges and conflicts: - Carve out CPU hotplug function declarations into a separate header with the goal to be able to use the lockdep assertions in a more flexible manner - As a result, refactor cacheinfo code after carving out a function to return the cache ID associated with a given cache level - Cleanups Add support to be able to kexec TDX guests: - Expand ACPI MADT CPU offlining support - Add machinery to prepare CoCo guests memory before kexec-ing into a new kernel - Cleanup, readjust and massage related code" * tag 'x86_cc_for_v6.11_rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: (24 commits) ACPI: tables: Print MULTIPROC_WAKEUP when MADT is parsed x86/acpi: Add support for CPU offlining for ACPI MADT wakeup method x86/mm: Introduce kernel_ident_mapping_free() x86/smp: Add smp_ops.stop_this_cpu() callback x86/acpi: Do not attempt to bring up secondary CPUs in the kexec case x86/acpi: Rename fields in the acpi_madt_multiproc_wakeup structure x86/mm: Do not zap page table entries mapping unaccepted memory table during kdump x86/mm: Make e820__end_ram_pfn() cover E820_TYPE_ACPI ranges x86/tdx: Convert shared memory back to private on kexec x86/mm: Add callbacks to prepare encrypted memory for kexec x86/tdx: Account shared memory x86/mm: Return correct level from lookup_address() if pte is none x86/mm: Make x86_platform.guest.enc_status_change_*() return an error x86/kexec: Keep CR4.MCE set during kexec for TDX guest x86/relocate_kernel: Use named labels for less confusion cpu/hotplug, x86/acpi: Disable CPU offlining for ACPI MADT wakeup cpu/hotplug: Add support for declaring CPU offlining not supported x86/apic: Mark acpi_mp_wake_* variables as __ro_after_init x86/acpi: Extract ACPI MADT wakeup code into a separate file x86/kexec: Remove spurious unconditional JMP from from identity_mapped() ... commit 181a984b7d8d98e5997bcd8e2ebe6ade1b36978e Merge: 4578d072fa8f 71315037cb7d Author: Linus Torvalds Date: Mon Jul 15 19:34:20 2024 -0700 Merge tag 'x86_cleanups_for_v6.11_rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull x86 cleanups from Borislav Petkov: - Remove an unused function and the documentation of an already removed cmdline parameter * tag 'x86_cleanups_for_v6.11_rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: x86/boot: Remove unused function __fortify_panic() Documentation: Remove "mfgpt_irq=" from the kernel-parameters.txt file commit 4578d072fa8f840d2492e1bba30871dbe1e9609a Merge: 208c6772d383 0c40b1c7a897 Author: Linus Torvalds Date: Mon Jul 15 19:31:59 2024 -0700 Merge tag 'x86_boot_for_v6.11_rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull x86 boot updates from Borislav Petkov: - Add a check to warn when cmdline parsing happens before the final cmdline string has been built and thus arguments can get lost - Code cleanups and simplifications * tag 'x86_boot_for_v6.11_rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: x86/setup: Warn when option parsing is done too early x86/boot: Clean up the arch/x86/boot/main.c code a bit x86/boot: Use current_stack_pointer to avoid asm() in init_heap() commit 208c6772d3839203fa34a8c77dd1fb7750c4f34a Merge: 1467b49869df 0d3db1f14abb Author: Linus Torvalds Date: Mon Jul 15 19:11:28 2024 -0700 Merge tag 'x86_alternatives_for_v6.11_rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull x86 alternatives updates from Borislav Petkov: "This is basically PeterZ's idea to nest the alternative macros to avoid the need to "spell out" the number of alternates in an ALTERNATIVE_n() macro and thus have an ever-increasing complexity in those definitions. For ease of bisection, the old macros are converted to the new, nested variants in a step-by-step manner so that in case an issue is encountered during testing, one can pinpoint the place where it fails easier. Because debugging alternatives is a serious pain" * tag 'x86_alternatives_for_v6.11_rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: x86/alternatives, kvm: Fix a couple of CALLs without a frame pointer x86/alternative: Replace the old macros x86/alternative: Convert the asm ALTERNATIVE_3() macro x86/alternative: Convert the asm ALTERNATIVE_2() macro x86/alternative: Convert the asm ALTERNATIVE() macro x86/alternative: Convert ALTERNATIVE_3() x86/alternative: Convert ALTERNATIVE_TERNARY() x86/alternative: Convert alternative_call_2() x86/alternative: Convert alternative_call() x86/alternative: Convert alternative_io() x86/alternative: Convert alternative_input() x86/alternative: Convert alternative_2() x86/alternative: Convert alternative() x86/alternatives: Add nested alternatives macros x86/alternative: Zap alternative_ternary() commit 1467b49869df43c4ee51bdaa0ec1cb69e333407d Merge: 8028e290b635 5b9d292ea87c Author: Linus Torvalds Date: Mon Jul 15 18:22:48 2024 -0700 Merge tag 'ras_core_for_v6.11_rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull RAS updates from Borislav Petkov: - A cleanup and a correction to the error injection driver to inject a MCA_MISC value only when one has actually been supplied by the user * tag 'ras_core_for_v6.11_rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: x86/mce: Remove unused variable and return value in machine_check_poll() x86/mce/inject: Only write MCA_MISC when a value has been supplied commit 8028e290b6354ddb404e88f17fe5d37945cb122f Merge: e23dd95cfd06 03a9b67087ba Author: Linus Torvalds Date: Mon Jul 15 18:20:24 2024 -0700 Merge tag 'edac_updates_for_v6.11' of git://git.kernel.org/pub/scm/linux/kernel/git/ras/ras Pull EDAC updates from Borislav Petkov: - The AMD memory controllers data fabric version 4.5 supports non-power-of-2 denormalization in the sense that certain bits of the system physical address cannot be reconstructed from the normalized address reported by the RAS hardware. Add support for handling such addresses - Switch the EDAC drivers to the new Intel CPU model defines - The usual fixes and cleanups all over the place * tag 'edac_updates_for_v6.11' of git://git.kernel.org/pub/scm/linux/kernel/git/ras/ras: EDAC: Add missing MODULE_DESCRIPTION() macros EDAC/dmc520: Use devm_platform_ioremap_resource() EDAC/igen6: Add Intel Arrow Lake-U/H SoCs support RAS/AMD/FMPM: Use atl internal.h for INVALID_SPA RAS/AMD/ATL: Implement DF 4.5 NP2 denormalization RAS/AMD/ATL: Validate address map when information is gathered RAS/AMD/ATL: Expand helpers for adding and removing base and hole RAS/AMD/ATL: Read DRAM hole base early RAS/AMD/ATL: Add amd_atl pr_fmt() prefix RAS/AMD/ATL: Add a missing module description EDAC, i10nm: make skx_common.o a separate module EDAC/skx: Switch to new Intel CPU model defines EDAC/sb_edac: Switch to new Intel CPU model defines EDAC, pnd2: Switch to new Intel CPU model defines EDAC/i10nm: Switch to new Intel CPU model defines EDAC/ghes: Add missing newline to pr_info() statement RAS/AMD/ATL: Add missing newline to pr_info() statement EDAC/thunderx: Remove unused struct error_syndrome commit e23dd95cfd063632fb212390740940f2761e322d Merge: 584aeccc0b71 3048dc8ba46b Author: Linus Torvalds Date: Mon Jul 15 18:03:43 2024 -0700 Merge tag 'spi-v6.11' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/spi Pull spi updates from Mark Brown: "There's some quite exciting core work in this release, we've got the beginnings of support for hardware initiated transfers which is itself independently useful for optimising fast paths in existing drivers. We also have a rework of the DMA mapping which allows finer grained decisions about DMA mapping messages and also helps remove some bodges that we'd had. Otherwise it's a fairly quiet release, a few new drivers and features for existing drivers, together with various cleanups and DT binding conversions. One regmap SPI fix made it's way in here too which I should probably have sent as a regmap fix instead. Summary: - Support for pre-optimising messages, reducing the overhead for messages that are repeatedly used (eg, reading the interrupt status from a device). This will also be used for hardware initiated transfers in future. - A reworking of how DMA mapping is done, introducing a new helper and allowing the DMA mapping decision to be done per transfer instead of per message. - Support for Atmel SAMA7D64, Freescale LX2160A DSPI and WCH CH341A" * tag 'spi-v6.11' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/spi: (72 commits) spi: dt-bindings: at91: Add sama7d65 compatible string spi: add ch341a usb2spi driver spi: dt-bindings: fsl-dspi: add compatible string 'fsl,lx2160a-dspi' spi: dt-bindings: fsl-dspi: add dmas and dma-names properties spi: spi: Remove unnecessary ‘0’ values from status spi: spi: Remove unnecessary ‘0’ values from rc spi: xcomm: fix coding style spi: xcomm: remove i2c_set_clientdata() spi: xcomm: make use of devm_spi_alloc_host() spi: xcomm: add gpiochip support spi: dt-bindings: snps,dw-apb-ssi.yaml: update compatible property spi: dt-bindings: fsl-dspi: Convert to yaml format spi: fsl-dspi: use common proptery 'spi-cs-setup(hold)-delay-ns' spi: axi-spi-engine: remove platform_set_drvdata() spi: spi-fsl-lpspi: Pass pm_ptr() spi: spi-imx: Pass pm_ptr() spi: spi-fsl-lpspi: Switch to SYSTEM_SLEEP_PM_OPS() spi: spi-imx: Switch to RUNTIME_PM_OPS/SYSTEM_SLEEP_PM_OPS() spi: add EXPORT_SYMBOL_GPL(devm_spi_optimize_message) spi: add devm_spi_optimize_message() helper ... commit 584aeccc0b717f447505cc738d8c2f292d9d1a66 Merge: 25617a5c4503 ef0b29e74496 Author: Linus Torvalds Date: Mon Jul 15 17:59:12 2024 -0700 Merge tag 'regulator-v6.11' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/regulator Pull regulator updates from Mark Brown: "This s a very quiet release for the regulator API, we have a few new devices (most of which are just ID updates) and one new fairly specialist core feature for use in interrupt context. - An API allowing lockless enable/disable for regulators acquired in exclusive mode, for use in interrupt contexts - A rewrite of the MedaTek DVFSRC regulator driver which apparently never worked - Support for Mediaktek MT6312, Qualcomm QCA6390 and WCN7850, Renesas RZ/G2L USB VBUS regulator and ST Microelectronics STM32MP13" * tag 'regulator-v6.11' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/regulator: (26 commits) regulator: dt-bindings: pca9450: Make interrupt optional regulator: pca9450: Make IRQ optional dt-bindings: regulator: sprd,sc2731-regulator: convert to YAML regulator: max77857: Constify struct regmap_config regulator: da9121: Constify struct regmap_config dt-bindings: regulator: ti,tps65132: document VIN supply dt-bindings: mfd: twl: Fix example regulator: Add Renesas RZ/G2L USB VBUS regulator driver regulator: core: Add helper for allow HW access to enable/disable regulator regulator: Add bindings for MediaTek DVFSRC Regulators regulator: Add refactored mtk-dvfsrc-regulator driver regulator: Remove mtk-dvfsrc-regulator.c regulator: userspace-consumer: quiet device deferral regulator: dt-bindings: mt6315: Document MT6319 PMIC regulator: add missing MODULE_DESCRIPTION() macro dt-bindings: regulator: twl-regulator: convert to yaml regulator: dt-bindings: describe the PMU module of the WCN7850 package regulator: dt-bindings: describe the PMU module of the QCA6390 package regulator: dt-bindings: rtq2208: Add specified fixed LDO VOUT property regulator: rtq2208: Add fixed LDO VOUT property and check that matches the constraints ... commit 25617a5c4503b20d2edcc75804169960e7c0d88e Merge: b3c0eccb4854 c2bb8198fee8 Author: Linus Torvalds Date: Mon Jul 15 17:56:11 2024 -0700 Merge tag 'regmap-v6.11' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/regmap Pull regmap updates from Mark Brown: "There's one new feature here, a regmap_multi_reg_read() matching the existing write function which has some IIO users coming. This allows atomic reads from multiple registers without the need to wrap a higher level lock in the client driver just for regmap (which already has locks anyway). We also have one fix for the KUnit tests, and a bunch of cleanups" * tag 'regmap-v6.11' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/regmap: regmap: kunit: Add test cases for regmap_multi_reg_(read,write}() regmap: Implement regmap_multi_reg_read() regmap-irq: handle const struct regmap_irq_sub_irq_map const_structs.checkpatch: add regmap structs regmap: add missing MODULE_DESCRIPTION() macros regmap-i2c: add missing MODULE_DESCRIPTION() macro regmap: kunit: Use array_size() and sizeof(*ptr) consistently regmap: maple: Switch to use kmemdup_array() regmap: cache: Switch to use kmemdup_array() regmap: cache: Use correct type of the rb_for_each() parameter regmap: Switch to use kmemdup_array() regmap: kunit: add missing MODULE_DESCRIPTION() regmap: kunit: Fix memory leaks in gen_regmap() and gen_raw_regmap() commit b3c0eccb485404d3ea5eaae483b1a2e9e2134d21 Merge: 3f32ab146c55 dfda97e37de4 Author: Linus Torvalds Date: Mon Jul 15 17:53:24 2024 -0700 Merge tag 'gpio-updates-for-v6.11-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/brgl/linux Pull gpio updates from Bartosz Golaszewski: "The majority of added lines are two new modules: the GPIO virtual consumer module that improves our ability to add automated tests for the kernel API and the "sloppy" logic analyzer module that uses the GPIO API to implement a coarse-grained debugging tool for useful for remote development. Other than that we have the usual assortment of various driver extensions, improvements to the core GPIO code, DT-bindings and other documentation updates as well as an extension to the interrupt simulator: GPIOLIB core: - rework kfifo handling rework in the character device code - improve the labeling of GPIOs requested as interrupts and show more info on interrupt-only GPIOs in debugfs - remove unused APIs - unexport interfaces that are only used from the core GPIO code - drop the return value from gpiochip_set_desc_names() as it cannot fail - move a string array definition out of a header and into a specific compilation unit - convert the last user of gpiochip_get_desc() other than GPIO core to using a safer alternative - use array_index_nospec() where applicable New drivers: - add a "virtual GPIO consumer" module that allows requesting GPIOs from actual hardware and driving tests of the in-kernel GPIO API from user-space over debugfs - add a GPIO-based "sloppy" logic analyzer module useful for "first glance" debugging on remote boards Driver improvements: - add support for a new model to gpio-pca953x - lock GPIOs as interrupts in gpio-sim when the lines are requested as irqs via the simulator domain + some other minor improvements - improve error reporting in gpio-syscon - convert gpio-ath79 to using dynamic GPIO base and range - use pcibios_err_to_errno() for converting PCIBIOS error codes to errno vaues in gpio-amd8111 and gpio-rdc321x - allow building gpio-brcmstb for the BCM2835 architecture DT bindings: - convert DT bindings for lsi,zevio, mpc8xxx, and atmel to DT schema - document new properties for aspeed,gpio, fsl,qoriq-gpio and gpio-vf610 - document new compatibles for pca953x and fsl,qoriq-gpio Documentation: - document stricter behavior of the GPIO character device uAPI with regards to reconfiguring requested line without direction set - clarify the effect of the active-low flag on line values and edges - remove documentation for the legacy GPIO API in order to stop tempting people to use it - document the preference for using pread() for reading edge events in the sysfs API Other: - add an extended initializer to the interrupt simulator allowing to specify a number of callbacks callers can use to be notified about irqs being requested and released" * tag 'gpio-updates-for-v6.11-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/brgl/linux: (41 commits) gpio: mc33880: Convert comma to semicolon gpio: virtuser: actually use the "trimmed" local variable dt-bindings: gpio: convert Atmel GPIO to json-schema gpio: virtuser: new virtual testing driver for the GPIO API dt-bindings: gpio: vf610: Allow gpio-line-names to be set gpio: sim: lock GPIOs as interrupts when they are requested genirq/irq_sim: add an extended irq_sim initializer dt-bindings: gpio: fsl,qoriq-gpio: Add compatible string fsl,ls1046a-gpio gpiolib: unexport gpiochip_get_desc() gpio: add sloppy logic analyzer using polling Documentation: gpio: Reconfiguration with unset direction (uAPI v2) Documentation: gpio: Reconfiguration with unset direction (uAPI v1) dt-bindings: gpio: fsl,qoriq-gpio: add common property gpio-line-names gpio: ath79: convert to dynamic GPIO base allocation pinctrl: da9062: replace gpiochip_get_desc() with gpio_device_get_desc() gpiolib: put gpio_suffixes in a single compilation unit Documentation: gpio: Clarify effect of active low flag on line edges Documentation: gpio: Clarify effect of active low flag on line values gpiolib: Remove data-less gpiochip_add() function gpio: sim: use devm_mutex_init() ... commit 3f32ab146c557f0fd9060b03003d0d4b2815968a Merge: d46ede31887f b85e02185397 Author: Linus Torvalds Date: Mon Jul 15 17:48:12 2024 -0700 Merge tag 'mmc-v6.11' of git://git.kernel.org/pub/scm/linux/kernel/git/ulfh/mmc Pull MMC updates from Ulf Hansson: "MMC host: - Convert from using tasklet to the BH workqueue - dw_mmc-bluefield: Add support for eMMC HW reset - mmc_spi: Allow spi controllers incapable of lower than 400kHz - sdhci: Rework code to eliminate SDHCI_QUIRK_UNSTABLE_RO_DETECT - sdhci-brcmstb: Add support for the BCM2712 variant - sdhci-esdhc-imx: Disable card-detect as system wakeup on S32G platforms - sdhci-msm: Add support for the SDX75 variant - sdhci-of-dwcmshc: Enable CQE support for some Rockchip variants - sdhci-of-esdhc: Convert DT-bindings to yaml - sdhci-sprd: Convert DT-bindings to yaml MEMSTICK: - rtsx_pci_ms: Remove the unused Realtek PCI memstick driver" * tag 'mmc-v6.11' of git://git.kernel.org/pub/scm/linux/kernel/git/ulfh/mmc: (26 commits) MAINTAINERS: add 's32@nxp.com' as relevant mailing list for 'sdhci-esdhc-imx' driver mmc: sdhci-esdhc-imx: obtain the 'per' clock rate after its enablement mmc: sdhci-esdhc-imx: disable card detect wake for S32G based platforms dt-bindings: mmc: sdhci-sprd: convert to YAML mmc: davinci_mmc: report all possible bus widths mmc: dw_mmc-bluefield: Add support for eMMC HW reset mmc: dw_mmc: Add support for platform specific eMMC HW reset mmc: sdhci_am654: Constify struct regmap_config mmc: Convert from tasklet to BH workqueue mmc: sdhi: Convert from tasklet to BH workqueue mmc: mmc_spi: allow for spi controllers incapable of getting as low as 400k memstick: rtsx_pci_ms: Remove Realtek PCI memstick driver MAINTAINERS: drop entry for VIA SD/MMC controller mmc: tmio: Remove obsolete .set_pwr() callback() mfd: tmio: Remove obsolete .set_clk_div() callback mmc: sdhci-brcmstb: Add ARCH_BCM2835 option mmc: sdhci: Eliminate SDHCI_QUIRK_UNSTABLE_RO_DETECT dt-bindings: mmc: Convert fsl-esdhc.txt to yaml dt-bindings: mmc: mmc-spi-slot: Change voltage-ranges to uint32-matrix mmc: add missing MODULE_DESCRIPTION() macros ... commit d46ede31887ff511a75c2544a2b2739703c3c1cd Merge: c6e63a9882c9 67ce905f5f72 Author: Linus Torvalds Date: Mon Jul 15 17:44:59 2024 -0700 Merge tag 'pmdomain-v6.11' of git://git.kernel.org/pub/scm/linux/kernel/git/ulfh/linux-pm Pull pmdomain updates from Ulf Hansson: "pmdomain core: - Add support for HW-managed devices pmdomain providers: - amlogic: Add support for the A5 and the A4 power domains - arm: Enable system wakeups for the SCMI PM domain - qcom/clk: Add HW-mode callbacks to allow switching of GDSC mode pmdomain consumers: - qcom/media/venus: Enable support for switching GDSC HW-mode on V6" * tag 'pmdomain-v6.11' of git://git.kernel.org/pub/scm/linux/kernel/git/ulfh/linux-pm: pmdomain: amlogic: Constify struct meson_secure_pwrc_domain_desc venus: pm_helpers: Use dev_pm_genpd_set_hwmode to switch GDSC mode on V6 clk: qcom: videocc: Use HW_CTRL_TRIGGER for SM8250, SC7280 vcodec GDSC's clk: qcom: gdsc: Add set and get hwmode callbacks to switch GDSC mode PM: domains: Add the domain HW-managed mode to the summary PM: domains: Allow devices attached to genpd to be managed by HW pmdomain: amlogic: Add support for A5 power domains controller dt-bindings: power: add Amlogic A5 power domains pmdomain: amlogic: add missing MODULE_DESCRIPTION() macros pmdomain: arm: scmi_pm_domain: set flag GENPD_FLAG_ACTIVE_WAKEUP pmdomain: renesas: rmobile-sysc: Use for_each_child_of_node_scoped() pmdomain: core: Use genpd_is_irq_safe() helper pmdomain: amlogic: Add support for A4 power domains controller dt-bindings: power: add Amlogic A4 power domains commit c6e63a9882c90f753b11c82db4308a9aba94e38d Merge: 500a711df663 240b129d597c Author: Linus Torvalds Date: Mon Jul 15 17:42:28 2024 -0700 Merge tag 'pwm/for-6.11-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/ukleinek/linux Pull pwm updates from Uwe Kleine-König: "This contains the usual mix of fixes, cleanups, two new drivers and several dt binding updates. The fixes are for minor issues that are already old (4.11-rc1 and 3.9-rc1) and were found by code review and not during usage, so I didn't sent them for earlier inclusion. The changes to include/linux/mfd/stm32-timers.h and drivers/counter/stm32-timer-cnt.c are part of an immutable branch that will also be included in the mfd and counter pulls. It changes some register definitions and affects the pwm-stm32 driver. Thanks go to Andy Shevchenko, AngeloGioacchino Del Regno, Conor Dooley, David Lechner, Dhruva Gole, Drew Fustini, Frank Li, Jeff Johnson, Junyi Zhao, Kelvin Zhang, Krzysztof Kozlowski, Lee Jones, Linus Walleij, Linus Walleij, Michael Hennerich, Nicola Di Lieto, Nicolas Ferre, Nuno Sa, Paul Cercueil, Raag Jadav, Rob Herring, Sean Anderson, Sean Young, Shenwei Wang, Stefan Wahren, Trevor Gamblin, Tzung-Bi Shih, Vincent Whitchurch and William Breathitt Gray for their contributions to this pull request; they authored changes, spend time reviewing changes and coordinated the above mentioned immutable branch" * tag 'pwm/for-6.11-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/ukleinek/linux: (38 commits) pwm: axi-pwmgen: add .max_register to regmap dt-bindings: pwm: at91: Add sama7d65 compatible string pwm: atmel-tcb: Make private data variable naming consistent pwm: atmel-tcb: Simplify checking the companion output pwm: Allow pwm state transitions from an invalid state pwm: xilinx: Simplify using devm_ functions pwm: Use guards for pwm_lookup_lock instead of explicity mutex_lock + mutex_unlock pwm: Use guards for export->lock instead of explicity mutex_lock + mutex_unlock pwm: Use guards for pwm_lock instead of explicity mutex_lock + mutex_unlock pwm: Register debugfs operations after the pwm class pwm: imx-tpm: Enable pinctrl setting for sleep state pwm: lpss: drop redundant runtime PM handles pwm: lpss: use devm_pm_runtime_enable() helper pwm-stm32: Make use of parametrised register definitions dt-bindings: pwm: imx: remove interrupt property from required pwm: meson: Add support for Amlogic S4 PWM pwm: Add GPIO PWM driver dt-bindings: pwm: Add pwm-gpio pwm: Drop pwm_apply_state() bus: ts-nbus: Use pwm_apply_might_sleep() ... commit 500a711df663adccb30fd3508960ff90c73f1cd4 Merge: e763c9ec71dd 1ea3fd1eb986 Author: Linus Torvalds Date: Mon Jul 15 17:39:13 2024 -0700 Merge tag 'hwmon-for-v6.11' of git://git.kernel.org/pub/scm/linux/kernel/git/groeck/linux-staging Pull hwmon updates from Guenter Roeck: "Obsolete driver removals: - Removed obsolete adm1021 and max6642 drivers New drivers: - MPS MP2891, MP2993, MP9941, and MP5920 - SPD5118 (Temperature Sensor and EEPROM) Added device support to existing drivers: - g762: G761 - dell-smm: Dell OptiPlex 7060 - asus-ec-sensors: ProArt X670E-CREATOR WIFI - corsair-psu: HX1200i Series 2023 psu - nzxt-smart2: Additional USB IS for NZXT RGB & Fan Controller Notable enhancements and fixes: - Removed use of i2c_match_id() - Constified struct regmap_config where feasible - Cleaned up amc6821 driver, and converted to use regmap and with_info API - Converted max6639 driver to use with_info API; added support for additional sysfs attributes - Fixed various sysfs attribute underflows - Added PEC support to hwmon core, and use in lm90 and max31827 drivers And various other minor fixes and improvements" * tag 'hwmon-for-v6.11' of git://git.kernel.org/pub/scm/linux/kernel/git/groeck/linux-staging: (103 commits) hwmon: (max6697) Fix swapped temp{1,8} critical alarms hwmon: (max6697) Fix underflow when writing limit attributes hwmon: Remove obsolete adm1021 and max6642 drivers hwmon: (pmbus/ltc4286) Drop unused i2c device ids hwmon: (g762) Initialize fans after configuring clock hwmon: (amc6821) Add support for pwm1_mode attribute hwmon: (amc6821) Convert to with_info API hwmon: (amc6821) Convert to use regmap hwmon: (amc6821) Drop unnecessary enum chips hwmon: (amc6821) Use BIT() and GENMASK() hwmon: (amc6821) Use tabs for column alignment in defines hwmon: (amc6821) Reorder include files, drop unnecessary ones hwmon: (amc6821) Add support for fan1_target and pwm1_enable mode 4 hwmon: (amc6821) Rename fan1_div to fan1_pulses hwmon: (amc6821) Make reading and writing fan speed limits consistent hwmon: (amc6821) Stop accepting invalid pwm values hwmon: (w83627ehf) Fix underflows seen when writing limit attributes hwmon: (nct6775-core) Fix underflows seen when writing limit attributes hwmon: (lm95234) Fix underflows seen when writing limit attributes hwmon: (adc128d818) Fix underflows seen when writing limit attributes ... commit e763c9ec71dd462337d0b671ec5014b737c5342e Merge: cdf471c348c1 50b040ef3732 Author: Linus Torvalds Date: Mon Jul 15 17:34:31 2024 -0700 Merge tag 'pwrseq-updates-for-v6.11-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/brgl/linux Pull power sequencing updates from Bartosz Golaszewski: "This has been in development since last year's Linux Plumbers Conference and was inspired by the need to enable support upstream for Bluetooth/WLAN chips on Qualcomm platforms. The main problem we're fixing is powering up devices which are represented as separate objects in the kernel (binding to different drivers) but which share parts of the power-up sequence and thus need some kind of a mediator who knows the possible interactions and can assure they don't interfere with neither device's bring up. An example of such an inter-driver interaction is the WCN family of BT/WLAN chips from Qualcomm of which some models require the user to observe a certain delay between driving the bt-enable and wlan-enable GPIOs. This is not a new problem but up to this point all attempts at addressing it ended up hitting one wall or another and being dropped. The main obstacle was the fact that most these attempts tried to introduce the concept of a "power sequence" into the device-tree bindings which breaks the main DT rule: describe the hardware, not its behavior. The solution I proposed focuses on making the power sequencer drivers interpret the actual HW description flexibly. More details on that are in the linked cover letter. The second problem fixed here is powering up PCI devices before they are detected on the bus. This is achieved by creating special platform devices for device-tree nodes describing hard-wired PCI devices which bind to the so-called PCI power control drivers which enable required resources and trigger a bus rescan once the controlled device is up then setup the correct devlink hierarchy for power-management. By combining the two new frameworks we implemented the power sequencing PCI power control driver which is capable of powering up the WLAN modules of the QCom WCN family of chipsets. All this has spent a significant amount of time in linux-next and enabled WLAN/BT support on several Qualcomm platforms. To further prove that this is useful and needed: right after this was picked up into next, I was sent a series using the subsystem for a similar use-case on Amlogic platforms. This contains the core power sequencing framework, the first driver, PCI changes using the pwrseq library (blessed by Bjorn Helgaas) and some fixes that came later" * tag 'pwrseq-updates-for-v6.11-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/brgl/linux: PCI/pwrctl: only call of_platform_populate() if CONFIG_OF is enabled power: sequencing: simplify returning pointer without cleanup PCI/pwrctl: Add a PCI power control driver for power sequenced devices PCI/pwrctl: Add PCI power control core code PCI/pwrctl: Create platform devices for child OF nodes of the port node PCI/pwrctl: Reuse the OF node for power controlled devices PCI: Hold the rescan mutex when scanning for the first time power: pwrseq: add a driver for the PMU module on the QCom WCN chipsets power: sequencing: implement the pwrseq core commit cdf471c348c1200ca243775b4b8d6eaa6d7f3979 Merge: 89c491389331 fc2c1d716d4a Author: Linus Torvalds Date: Mon Jul 15 17:28:40 2024 -0700 Merge tag 'tag-chrome-platform-firmware-for-v6.11' of git://git.kernel.org/pub/scm/linux/kernel/git/chrome-platform/linux Pull chrome platform firmware update from Tzung-Bi Shih: - Minor cleanup: add missing MODULE_DESCRIPTION * tag 'tag-chrome-platform-firmware-for-v6.11' of git://git.kernel.org/pub/scm/linux/kernel/git/chrome-platform/linux: firmware: google: add missing MODULE_DESCRIPTION() macros commit 89c491389331faea09a247da47ebd95982dae06e Merge: d8764c1931a4 4baf1cc54433 Author: Linus Torvalds Date: Mon Jul 15 17:25:38 2024 -0700 Merge tag 'tag-chrome-platform-for-v6.11' of git://git.kernel.org/pub/scm/linux/kernel/git/chrome-platform/linux Pull chrome platform updates from Tzung-Bi Shih: "New code: - Add "cros_ec_hwmon" driver to expose fan speed and temperature - Add "cros_charge-control" driver to control charge thresholds and behaviour - Add module parameter "log_poll_period_ms" in cros_ec_debugfs for tuning the poll period - Support version 3 of EC_CMD_GET_NEXT_EVENT and keyboard matrix Fixes: - Fix a race condition in accessing MEC (Microchip EC) memory between ACPI and kernel. Serialize the memory access by an AML (ACPI Machine Language) mutex - Fix an issue of wrong EC message version in cros_ec_debugfs Misc: - Fix kernel-doc errors and cleanups" * tag 'tag-chrome-platform-for-v6.11' of git://git.kernel.org/pub/scm/linux/kernel/git/chrome-platform/linux: (28 commits) power: supply: cros_charge-control: Fix signedness bug in charge_behaviour_store() power: supply: cros_charge-control: Avoid accessing attributes out of bounds power: supply: cros_charge-control: don't load if Framework control is present power: supply: add ChromeOS EC based charge control driver platform/chrome: cros_ec_proto: Introduce cros_ec_get_cmd_versions() platform/chrome: Update binary interface for EC-based charge control ACPI: battery: add devm_battery_hook_register() dt-bindings: input: cros-ec-keyboard: Add keyboard matrix v3.0 platform/chrome: cros_ec_lpc: Handle zero length read/write platform/chrome: cros_ec_lpc: Fix error code in cros_ec_lpc_mec_read_bytes() platform/chrome: cros_ec_debugfs: fix wrong EC message version platform/chrome: cros_ec_proto: update Kunit test for get_next_data_v3 platform/chrome: cros_ec_proto: add missing MODULE_DESCRIPTION() macro hwmon: (cros_ec) Fix access to restricted __le16 hwmon: (cros_ec) Prevent read overflow in probe() platform/chrome: cros_ec_lpc: Add quirks for Framework Laptop platform/chrome: cros_ec_lpc: Add a new quirk for AML mutex platform/chrome: cros_ec_lpc: Add a new quirk for ACPI id platform/chrome: cros_ec_lpc: MEC access can use an AML mutex platform/chrome: cros_ec_lpc: MEC access can return error code ... commit d8764c1931a4c91b9b53ee183757f70999da2bb3 Merge: c89d780cc195 aa8684755a28 Author: Linus Torvalds Date: Mon Jul 15 17:23:32 2024 -0700 Merge tag 'wq-for-6.11-rc1-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/wq Pull workqueue fix from Tejun Heo: "cpus_read_lock() was dropped from workqueue creation path but there were still remaining lockdep_assert_cpus_held() triggering spurious lockdep failures. Remove them" * tag 'wq-for-6.11-rc1-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/wq: workqueue: Remove unneeded lockdep_assert_cpus_held() commit c89d780cc195a63dcd9c3d2fc239308b3920a9a1 Merge: bbb3556c014d 4f3a6c4de7d9 Author: Linus Torvalds Date: Mon Jul 15 17:06:19 2024 -0700 Merge tag 'arm64-upstream' of git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux Pull arm64 updates from Catalin Marinas: "The biggest part is the virtual CPU hotplug that touches ACPI, irqchip. We also have some GICv3 optimisation for pseudo-NMIs that has been queued via the arm64 tree. Otherwise the usual perf updates, kselftest, various small cleanups. Core: - Virtual CPU hotplug support for arm64 ACPI systems - cpufeature infrastructure cleanups and making the FEAT_ECBHB ID bits visible to guests - CPU errata: expand the speculative SSBS workaround to more CPUs - GICv3, use compile-time PMR values: optimise the way regular IRQs are masked/unmasked when GICv3 pseudo-NMIs are used, removing the need for a static key in fast paths by using a priority value chosen dynamically at boot time ACPI: - 'acpi=nospcr' option to disable SPCR as default console for arm64 - Move some ACPI code (cpuidle, FFH) to drivers/acpi/arm64/ Perf updates: - Rework of the IMX PMU driver to enable support for I.MX95 - Enable support for tertiary match groups in the CMN PMU driver - Initial refactoring of the CPU PMU code to prepare for the fixed instruction counter introduced by Arm v9.4 - Add missing PMU driver MODULE_DESCRIPTION() strings - Hook up DT compatibles for recent CPU PMUs Kselftest updates: - Kernel mode NEON fp-stress - Cleanups, spelling mistakes Miscellaneous: - arm64 Documentation update with a minor clarification on TBI - Fix missing IPI statistics - Implement raw_smp_processor_id() using thread_info rather than a per-CPU variable (better code generation) - Make MTE checking of in-kernel asynchronous tag faults conditional on KASAN being enabled - Minor cleanups, typos" * tag 'arm64-upstream' of git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux: (69 commits) selftests: arm64: tags: remove the result script selftests: arm64: tags_test: conform test to TAP output perf: add missing MODULE_DESCRIPTION() macros arm64: smp: Fix missing IPI statistics irqchip/gic-v3: Fix 'broken_rdists' unused warning when !SMP and !ACPI ACPI: Add acpi=nospcr to disable ACPI SPCR as default console on ARM64 Documentation: arm64: Update memory.rst for TBI arm64/cpufeature: Replace custom macros with fields from ID_AA64PFR0_EL1 KVM: arm64: Replace custom macros with fields from ID_AA64PFR0_EL1 perf: arm_pmuv3: Include asm/arm_pmuv3.h from linux/perf/arm_pmuv3.h perf: arm_v6/7_pmu: Drop non-DT probe support perf/arm: Move 32-bit PMU drivers to drivers/perf/ perf: arm_pmuv3: Drop unnecessary IS_ENABLED(CONFIG_ARM64) check perf: arm_pmuv3: Avoid assigning fixed cycle counter with threshold arm64: Kconfig: Fix dependencies to enable ACPI_HOTPLUG_CPU perf: imx_perf: add support for i.MX95 platform perf: imx_perf: fix counter start and config sequence perf: imx_perf: refactor driver for imx93 perf: imx_perf: let the driver manage the counter usage rather the user perf: imx_perf: add macro definitions for parsing config attr ... commit aa8684755a283536bd8ad93141052f47a4faa5a3 Author: Lai Jiangshan Date: Tue Jul 16 01:29:31 2024 +0800 workqueue: Remove unneeded lockdep_assert_cpus_held() The commit 19af45757383 ("workqueue: Remove cpus_read_lock() from apply_wqattrs_lock()") removes the unneed cpus_read_lock() after the pwq creations and installations have been reworked based on wq_online_cpumask rather than cpu_online_mask making cpus_read_lock() is unneeded during wqattrs changes. But it desn't remove the lockdep_assert_cpus_held() checks during wqattrs changes, which leads to complaints from lockdep reported by kernel test robot: [ 15.726567][ T131] ------------[ cut here ]------------ [ 15.728117][ T131] WARNING: CPU: 1 PID: 131 at kernel/cpu.c:525 lockdep_assert_cpus_held (kernel/cpu.c:525) [ 15.731191][ T131] Modules linked in: floppy(+) parport_pc(+) parport qemu_fw_cfg rtc_cmos [ 15.733423][ T131] CPU: 1 PID: 131 Comm: systemd-udevd Tainted: G T 6.10.0-rc2-00254-g19af45757383 #1 df6f039f42e8818bf9a534449362ebad1aad32e2 [ 15.737011][ T131] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.2-debian-1.16.2-1 04/01/2014 [ 15.739760][ T131] EIP: lockdep_assert_cpus_held (kernel/cpu.c:525) [ 15.741326][ T131] Code: 97 c2 03 72 20 83 3d f4 73 97 c2 00 74 17 55 89 e5 b8 fc bd 4d c2 ba ff ff ff ff e8 e4 57 d1 00 85 c0 74 06 5d 31 c0 31 d2 c3 <0f> 0b eb f6 90 90 90 90 90 90 90 90 90 90 90 90 90 90 55 89 e5 b8 Fix it by removing the unneeded lockdep_assert_cpus_held(). Also remove the unneed cpus_read_lock() from wq_affn_dfl_set(). tj: Dropped the removal of cpus_read_lock/unlock() in wq_affn_dfl_set() to keep this patch fix only. Cc: kernel test robot Fixes: 19af45757383("workqueue: Remove cpus_read_lock() from apply_wqattrs_lock()") Reported-by: kernel test robot Closes: https://lore.kernel.org/oe-lkp/202407141846.665c0446-lkp@intel.com Signed-off-by: Lai Jiangshan Signed-off-by: Tejun Heo kernel/workqueue.c | 12 ++---------- 1 file changed, 2 insertions(+), 10 deletions(-) commit bbb3556c014dc8ed1645b725ad84477603553743 Merge: 4cb9dc10a6c3 84edd7adcc9d Author: Linus Torvalds Date: Mon Jul 15 16:59:58 2024 -0700 Merge tag 'keys-next-6.11-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/jarkko/linux-tpmdd Pull keys updates from Jarkko Sakkinen: "Contains cosmetic fixes only" * tag 'keys-next-6.11-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/jarkko/linux-tpmdd: KEYS: encrypted: add missing MODULE_DESCRIPTION() KEYS: trusted: add missing MODULE_DESCRIPTION() commit 4cb9dc10a6c32f2e485f2be47f3d32a45a3fe499 Merge: b02c520fee63 0543f29408a1 Author: Linus Torvalds Date: Mon Jul 15 16:57:27 2024 -0700 Merge tag 'tpmdd-next-6.11-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/jarkko/linux-tpmdd Pull tpm updates from Jarkko Sakkinen: "A couple of bug fixes. No new features are coming for this release. I had one in progress but decided to let it mature up until 6.12" * tag 'tpmdd-next-6.11-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/jarkko/linux-tpmdd: tpm_tis_spi: add missing attpm20p SPI device ID entry char: tpm: Fix possible memory leak in tpm_bios_measurements_open() commit b02c520fee6327eb4b25696c5e2d6732f362213c Merge: 895b9b1207f2 58629d4871e8 Author: Linus Torvalds Date: Mon Jul 15 16:51:22 2024 -0700 Merge tag 'wq-for-6.11' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/wq Pull workqueue updates from Tejun Heo: - Lai fixed a bug where CPU hotplug and workqueue attribute changes race leaving some workqueues not fully updated. This involved refactoring and changing how online CPUs are tracked. The resulting code is cleaner. - Workqueue watchdog touch operation was causing too much cacheline contention on very large machines. Nicholas improved scalabililty by avoiding unnecessary global updates. - Code cleanups and minor rescuer behavior improvement. - The last commit 58629d4871e8 ("workqueue: Always queue work items to the newest PWQ for order workqueues") is a cherry-picked straggler commit from for-6.10-fixes, a fix for a bug which may not actually trigger. * tag 'wq-for-6.11' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/wq: (24 commits) workqueue: Always queue work items to the newest PWQ for order workqueues workqueue: Rename wq_update_pod() to unbound_wq_update_pwq() workqueue: Remove the arguments @hotplug_cpu and @online from wq_update_pod() workqueue: Remove the argument @cpu_going_down from wq_calc_pod_cpumask() workqueue: Remove the unneeded cpumask empty check in wq_calc_pod_cpumask() workqueue: Remove cpus_read_lock() from apply_wqattrs_lock() workqueue: Simplify wq_calc_pod_cpumask() with wq_online_cpumask workqueue: Add wq_online_cpumask workqueue: Init rescuer's affinities as the wq's effective cpumask workqueue: Put PWQ allocation and WQ enlistment in the same lock C.S. workqueue: Move kthread_flush_worker() out of alloc_and_link_pwqs() workqueue: Make rescuer initialization as the last step of the creation of a new wq workqueue: Register sysfs after the whole creation of the new wq workqueue: Simplify goto statement workqueue: Update cpumasks after only applying it successfully workqueue: Improve scalability of workqueue watchdog touch workqueue: wq_watchdog_touch is always called with valid CPU workqueue: Remove useless pool->dying_workers workqueue: Detach workers directly in idle_cull_fn() workqueue: Don't bind the rescuer in the last working cpu ... commit 895b9b1207f26f020f18b5b54e072d119defffc4 Merge: f97b956b631a 9283ff5be151 Author: Linus Torvalds Date: Mon Jul 15 16:41:32 2024 -0700 Merge tag 'cgroup-for-6.11' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/cgroup Pull cgroup updates from Tejun Heo: - Added Michal Koutný as a maintainer - Counters in pids.events were behaving inconsistently. pids.events made properly hierarchical and pids.events.local added - misc.peak and misc.events.local added - cpuset remote partition creation and cpuset.cpus.exclusive handling improved - Code cleanups, non-critical fixes, doc updates - for-6.10-fixes is merged in to receive two non-critical fixes that didn't trigger pull * tag 'cgroup-for-6.11' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/cgroup: (23 commits) cgroup: Add Michal Koutný as a maintainer cgroup/misc: Introduce misc.events.local cgroup/rstat: add force idle show helper cgroup: Protect css->cgroup write under css_set_lock cgroup/misc: Introduce misc.peak cgroup_misc: add kernel-doc comments for enum misc_res_type cgroup/cpuset: Prevent UAF in proc_cpuset_show() selftest/cgroup: Update test_cpuset_prs.sh to match changes cgroup/cpuset: Make cpuset.cpus.exclusive independent of cpuset.cpus cgroup/cpuset: Delay setting of CS_CPU_EXCLUSIVE until valid partition selftest/cgroup: Fix test_cpuset_prs.sh problems reported by test robot cgroup/cpuset: Fix remote root partition creation problem cgroup: avoid the unnecessary list_add(dying_tasks) in cgroup_exit() cgroup/cpuset: Optimize isolated partition only generate_sched_domains() calls cgroup/cpuset: Reduce the lock protecting CS_SCHED_LOAD_BALANCE kernel/cgroup: cleanup cgroup_base_files when fail to add cgroup_psi_files selftests: cgroup: Add basic tests for pids controller selftests: cgroup: Lexicographic order in Makefile cgroup/pids: Add pids.events.local cgroup/pids: Make event counters hierarchical ... commit f97b956b631a0340f5bf8abcca891a8e5a874f69 Merge: e4b2b0b1e41e 6ca8f2e20bd1 Author: Linus Torvalds Date: Mon Jul 15 16:38:28 2024 -0700 Merge tag 'nolibc.2024.07.15a' of git://git.kernel.org/pub/scm/linux/kernel/git/paulmck/linux-rcu Pull nolibc updates from Paul McKenney: - Fix selftest printf format mismatch in expect_str_buf_eq() - Stop using brk() and sbrk() when testing against musl, which implements these two functions with ENOMEM - Make tests use -Werror to force failure on compiler warnings - Add limits for the {u,}intmax_t, ulong and {u,}llong types - Implement strtol() and friends - Add facility to skip nolibc-specific tests when running against non-nolibc libraries - Implement strerror() - Also use strerror() on nolibc when running kselftests * tag 'nolibc.2024.07.15a' of git://git.kernel.org/pub/scm/linux/kernel/git/paulmck/linux-rcu: selftests: kselftest: also use strerror() on nolibc tools/nolibc: implement strerror() selftests/nolibc: introduce condition to run tests only on nolibc tools/nolibc: implement strtol() and friends tools/nolibc: add limits for {u,}intmax_t, ulong and {u,}llong selftests/nolibc: run-tests.sh: use -Werror by default selftests/nolibc: disable brk()/sbrk() tests on musl selftests/nolibc: fix printf format mismatch in expect_str_buf_eq() commit e4b2b0b1e41e3b5c542a18639cd4f11c9efbb465 Merge: b176e21d812a ddd7432d621d Author: Linus Torvalds Date: Mon Jul 15 15:44:40 2024 -0700 Merge tag 'kcsan.2024.07.12a' of git://git.kernel.org/pub/scm/linux/kernel/git/paulmck/linux-rcu Pull KCSAN updates from Paul McKenney: - improve the documentation for the new __data_racy type qualifier to the data_race() macro's kernel-doc header and to the LKMM's access-marking documentation - add missing MODULE_DESCRIPTION * tag 'kcsan.2024.07.12a' of git://git.kernel.org/pub/scm/linux/kernel/git/paulmck/linux-rcu: kcsan: Add missing MODULE_DESCRIPTION() macro kcsan: Add example to data_race() kerneldoc header commit b176e21d812a0674196996e2f53d481208c5d832 Merge: 9855e873285f d4641fa67d3d Author: Linus Torvalds Date: Mon Jul 15 15:39:25 2024 -0700 Merge tag 'torture.2024.07.12a' of git://git.kernel.org/pub/scm/linux/kernel/git/paulmck/linux-rcu Pull torture-test updates from Paul McKenney: "This adds MODULE_DESCRIPTION() to torture.c, locktorture.c, and scftorture.c, and also adds 'static' to a global variable that is used only in scftorture.c" * tag 'torture.2024.07.12a' of git://git.kernel.org/pub/scm/linux/kernel/git/paulmck/linux-rcu: scftorture: Make torture_type static scftorture: Add MODULE_DESCRIPTION() locktorture: Add MODULE_DESCRIPTION() torture: Add MODULE_DESCRIPTION() commit 9855e873285f1395b9a04613c56101f04a5ec9fb Merge: 253e1e98180a 02219caa92b5 Author: Linus Torvalds Date: Mon Jul 15 15:25:27 2024 -0700 Merge tag 'rcu.2024.07.12a' of git://git.kernel.org/pub/scm/linux/kernel/git/paulmck/linux-rcu Pull RCU updates from Paul McKenney: - Update Tasks RCU and Tasks Rude RCU description in Requirements.rst and clarify rcu_assign_pointer() and rcu_dereference() ordering properties - Add lockdep assertions for RCU readers, limit inline wakeups for callback-bypass synchronize_rcu(), add an rcutree.nohz_full_patience_delay to reduce nohz_full OS jitter, add Uladzislau Rezki as RCU maintainer, and fix a subtle callback-migration memory-ordering issue - Remove a number of redundant memory barriers - Remove unnecessary bypass-list lock-contention mitigation, use parking API instead of open-coded ad-hoc equivalent, and upgrade obsolete comments - Revert avoidance of a deadlock that can no longer occur and properly synchronize Tasks Trace RCU checking of runqueues - Add tests for handling of double-call_rcu() bug, add missing MODULE_DESCRIPTION, and add a script that histograms the number of calls to RCU updaters - Fill out SRCU polled-grace-period API * tag 'rcu.2024.07.12a' of git://git.kernel.org/pub/scm/linux/kernel/git/paulmck/linux-rcu: (29 commits) rcu: Fix rcu_barrier() VS post CPUHP_TEARDOWN_CPU invocation rcu: Eliminate lockless accesses to rcu_sync->gp_count MAINTAINERS: Add Uladzislau Rezki as RCU maintainer rcu: Add rcutree.nohz_full_patience_delay to reduce nohz_full OS jitter rcu/exp: Remove redundant full memory barrier at the end of GP rcu: Remove full memory barrier on RCU stall printout rcu: Remove full memory barrier on boot time eqs sanity check rcu/exp: Remove superfluous full memory barrier upon first EQS snapshot rcu: Remove superfluous full memory barrier upon first EQS snapshot rcu: Remove full ordering on second EQS snapshot srcu: Fill out polled grace-period APIs srcu: Update cleanup_srcu_struct() comment srcu: Add NUM_ACTIVE_SRCU_POLL_OLDSTATE srcu: Disable interrupts directly in srcu_gp_end() rcu: Disable interrupts directly in rcu_gp_init() rcu/tree: Reduce wake up for synchronize_rcu() common case rcu/tasks: Fix stale task snaphot for Tasks Trace tools/rcu: Add rcu-updaters.sh script rcutorture: Add missing MODULE_DESCRIPTION() macros rcutorture: Fix rcu_torture_fwd_cb_cr() data race ... commit 253e1e98180a124475327f2ce7b6f15f2e4d0d45 Merge: c4b729b0fac2 ea6ee1bac603 Author: Linus Torvalds Date: Mon Jul 15 15:22:35 2024 -0700 Merge tag 'lkmm.2024.07.12a' of git://git.kernel.org/pub/scm/linux/kernel/git/paulmck/linux-rcu Pull memory model updates from Paul McKenney: "lkmm: Fix corner-case locking bug and improve documentation A simple but odd single-process litmus test acquires and immediately releases a lock, then calls spin_is_locked(). LKMM acts if it was a deadlock due to an assumption that spin_is_locked() will follow a spin_lock() or some other process's spin_unlock(). This litmus test manages to violate this assumption because the spin_is_locked() follows the same process's spin_unlock(). This series fixes this bug, reorganizes and optimizes the lock.cat model, and updates documentation" * tag 'lkmm.2024.07.12a' of git://git.kernel.org/pub/scm/linux/kernel/git/paulmck/linux-rcu: tools/memory-model: Code reorganization in lock.cat tools/memory-model: Fix bug in lock.cat tools/memory-model: Add access-marking.txt to README tools/memory-model: Add KCSAN LF mentorship session citation commit c4b729b0fac2d1b336df6d3e8c3fdb67ee9fff82 Merge: 4fd9435641bb f1b5644862c5 Author: Linus Torvalds Date: Mon Jul 15 15:19:36 2024 -0700 Merge tag 'cmpxchg.2024.07.12a' of git://git.kernel.org/pub/scm/linux/kernel/git/paulmck/linux-rcu Pull arm byte cmpxchg from Paul McKenney: "ARM: Provide one-byte cmpxchg emulation This provides emulated one-byte cmpxchg() support for ARM using the cmpxchg_emu_u8() function that uses a four-byte cmpxchg() to emulate the one-byte variant. Similar patches for emulation of one-byte cmpxchg() for arc, sh, and xtensa have not yet received maintainer acks, so they are slated for the v6.12 merge window" * tag 'cmpxchg.2024.07.12a' of git://git.kernel.org/pub/scm/linux/kernel/git/paulmck/linux-rcu: ARM: Emulate one-byte cmpxchg commit 4fd9435641bb80c04863c9a35afafe4c3f953bbf Merge: 0eff0491e74c b7625d67eb1a Author: Linus Torvalds Date: Mon Jul 15 15:03:09 2024 -0700 Merge tag 'timers-core-2024-07-14' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull timer updates from Thomas Gleixner: "Updates for timers, timekeeping and related functionality: Core: - Make the takeover of a hrtimer based broadcast timer reliable during CPU hot-unplug. The current implementation suffers from a race which can lead to broadcast timer starvation in the worst case. - VDSO related cleanups and simplifications - Small cleanups and enhancements all over the place PTP: - Replace the architecture specific base clock to clocksource, e.g. ART to TSC, conversion function with generic functionality to avoid exposing such internals to drivers and convert all existing drivers over. This also allows to provide functionality which converts the other way round in the core code based on the same parameter set. - Provide a function to convert CLOCK_REALTIME to the base clock to support the upcoming PPS output driver on Intel platforms. Drivers: - A set of Device Tree bindings for new hardware - Cleanups and enhancements all over the place" * tag 'timers-core-2024-07-14' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: (30 commits) clocksource/drivers/realtek: Add timer driver for rtl-otto platforms dt-bindings: timer: Add schema for realtek,otto-timer dt-bindings: timer: Add SOPHGO SG2002 clint dt-bindings: timer: renesas,tmu: Add R-Car Gen2 support dt-bindings: timer: renesas,tmu: Add RZ/G1 support dt-bindings: timer: renesas,tmu: Add R-Mobile APE6 support clocksource/drivers/mips-gic-timer: Correct sched_clock width clocksource/drivers/mips-gic-timer: Refine rating computation clocksource/drivers/sh_cmt: Address race condition for clock events clocksource/driver/arm_global_timer: Remove unnecessary ‘0’ values from err clocksource/drivers/arm_arch_timer: Remove unnecessary ‘0’ values from irq tick/broadcast: Make takeover of broadcast hrtimer reliable tick/sched: Combine WARN_ON_ONCE and print_once x86/vdso: Remove unused include x86/vgtod: Remove unused typedef gtod_long_t x86/vdso: Fix function reference in comment vdso: Add comment about reason for vdso struct ordering vdso/gettimeofday: Clarify comment about open coded function timekeeping: Add missing kernel-doc function comments tick: Remove unnused tick_nohz_get_idle_calls() ... commit 0eff0491e74c4df69bbe43555243ecec85577823 Merge: 0e4b77d4eaa1 77aeb1b685f9 Author: Linus Torvalds Date: Mon Jul 15 14:55:30 2024 -0700 Merge tag 'smp-core-2024-07-14' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull CPU hotplug updates from Thomas Gleixner: "A small set of SMP/CPU hotplug updates: - Reverse the order of iteration when freezing secondary CPUs for hibernation. This avoids that drivers like the Intel uncore performance counter have to transfer the assignement of handling the per package uncore events for every CPU in a package, which is a considerable speedup on larger systems. - Add a missing destroy_work_on_stack() invocation in smp_call_on_cpu() to prevent debug objects to emit a false positive warning when the stack is freed. - Small cleanups in comments and a str_plural() conversion" * tag 'smp-core-2024-07-14' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: smp: Add missing destroy_work_on_stack() call in smp_call_on_cpu() cpu/hotplug: Reverse order of iteration in freeze_secondary_cpus() smp: Use str_plural() to fix Coccinelle warnings cpu/hotplug: Fix typo in comment commit 0e4b77d4eaa121bdcf8cb2b07aa4a16e7a9e7c6d Merge: 3e7819886281 5b5baba62222 Author: Linus Torvalds Date: Mon Jul 15 14:52:21 2024 -0700 Merge tag 'core-debugobjects-2024-07-14' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull debugobjects update from Thomas Gleixner: "A single update for debugobjects to annotate all intentionally racy global debug variables so that KCSAN ignores them" * tag 'core-debugobjects-2024-07-14' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: debugobjects: Annotate racy debug variables commit 7bbae44cf1bda02537a84cd8ad75bd81694acfc7 Author: Aurabindo Pillai Date: Mon Jul 15 15:02:20 2024 -0400 drm/amd/display: fix doc entry for bb_from_dmub Fixes the warning: Function parameter or struct member 'bb_from_dmub' not described in 'amdgpu_display_manager' Reported-by: Stephen Rothwell Signed-off-by: Aurabindo Pillai Reviewed-by: Alex Deucher Signed-off-by: Alex Deucher drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.h | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) commit 28814be8823002eca06d857d4bce70eb4c6fccd3 Author: Aurabindo Pillai Date: Wed Jul 10 20:20:47 2024 +0000 drm/amd: Bump KMS_DRIVER_MINOR version Increase the KMS minor version to indicate GFX12 DCC support since this contains a major change in how DCC is managed across IPs like GFX, DCN etc. This will be used mainly by userspace like Mesa to figure out DCC support on GFX12 hardware. v2: fix version number (Alex) Signed-off-by: Aurabindo Pillai Acked-by: Alex Deucher Reviewed-by: Marek Olšák Signed-off-by: Alex Deucher drivers/gpu/drm/amd/amdgpu/amdgpu_drv.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) commit 3e7819886281e077e82006fe4804b0d6b0f5643b Merge: 3a56e2417329 3c1743a685b1 Author: Linus Torvalds Date: Mon Jul 15 14:20:22 2024 -0700 Merge tag 'for-6.11/block-20240710' of git://git.kernel.dk/linux Pull block updates from Jens Axboe: - NVMe updates via Keith: - Device initialization memory leak fixes (Keith) - More constants defined (Weiwen) - Target debugfs support (Hannes) - PCIe subsystem reset enhancements (Keith) - Queue-depth multipath policy (Redhat and PureStorage) - Implement get_unique_id (Christoph) - Authentication error fixes (Gaosheng) - MD updates via Song - sync_action fix and refactoring (Yu Kuai) - Various small fixes (Christoph Hellwig, Li Nan, and Ofir Gal, Yu Kuai, Benjamin Marzinski, Christophe JAILLET, Yang Li) - Fix loop detach/open race (Gulam) - Fix lower control limit for blk-throttle (Yu) - Add module descriptions to various drivers (Jeff) - Add support for atomic writes for block devices, and statx reporting for same. Includes SCSI and NVMe (John, Prasad, Alan) - Add IO priority information to block trace points (Dongliang) - Various zone improvements and tweaks (Damien) - mq-deadline tag reservation improvements (Bart) - Ignore direct reclaim swap writes in writeback throttling (Baokun) - Block integrity improvements and fixes (Anuj) - Add basic support for rust based block drivers. Has a dummy null_blk variant for now (Andreas) - Series converting driver settings to queue limits, and cleanups and fixes related to that (Christoph) - Cleanup for poking too deeply into the bvec internals, in preparation for DMA mapping API changes (Christoph) - Various minor tweaks and fixes (Jiapeng, John, Kanchan, Mikulas, Ming, Zhu, Damien, Christophe, Chaitanya) * tag 'for-6.11/block-20240710' of git://git.kernel.dk/linux: (206 commits) floppy: add missing MODULE_DESCRIPTION() macro loop: add missing MODULE_DESCRIPTION() macro ublk_drv: add missing MODULE_DESCRIPTION() macro xen/blkback: add missing MODULE_DESCRIPTION() macro block/rnbd: Constify struct kobj_type block: take offset into account in blk_bvec_map_sg again block: fix get_max_segment_size() warning loop: Don't bother validating blocksize virtio_blk: Don't bother validating blocksize null_blk: Don't bother validating blocksize block: Validate logical block size in blk_validate_limits() virtio_blk: Fix default logical block size fallback nvmet-auth: fix nvmet_auth hash error handling nvme: implement ->get_unique_id block: pass a phys_addr_t to get_max_segment_size block: add a bvec_phys helper blk-lib: check for kill signal in ioctl BLKZEROOUT block: limit the Write Zeroes to manually writing zeroes fallback block: refacto blkdev_issue_zeroout block: move read-only and supported checks into (__)blkdev_issue_zeroout ... commit a23e1966932464e1c5226cb9ac4ce1d5fc10ba22 Merge: 7c7b1be19b22 f3efefb6fdcc Author: Dmitry Torokhov Date: Mon Jul 15 14:03:44 2024 -0700 Merge branch 'next' into for-linus Prepare input updates for 6.11 merge window. commit 3a56e241732975c2c1247047ddbfc0ac6f6a4905 Merge: 4f5e249ec0ea ad00e629145b Author: Linus Torvalds Date: Mon Jul 15 13:49:10 2024 -0700 Merge tag 'for-6.11/io_uring-20240714' of git://git.kernel.dk/linux Pull io_uring updates from Jens Axboe: "Here are the io_uring updates queued up for 6.11. Nothing major this time around, various minor improvements and cleanups/fixes. This contains: - Add bind/listen opcodes. Main motivation is to support direct descriptors, to avoid needing a regular fd just for doing these two operations (Gabriel) - Probe fixes (Gabriel) - Treat io-wq work flags as atomics. Not fixing a real issue, but may as well and it silences a KCSAN warning (me) - Cleanup of rsrc __set_current_state() usage (me) - Add 64-bit for {m,f}advise operations (me) - Improve performance of data ring messages (me) - Fix for ring message overflow posting (Pavel) - Fix for freezer interaction with TWA_NOTIFY_SIGNAL. Not strictly an io_uring thing, but since TWA_NOTIFY_SIGNAL was originally added for faster task_work signaling for io_uring, bundling it with this pull (Pavel) - Add Pavel as a co-maintainer - Various cleanups (me, Thorsten)" * tag 'for-6.11/io_uring-20240714' of git://git.kernel.dk/linux: (28 commits) io_uring/net: check socket is valid in io_bind()/io_listen() kernel: rerun task_work while freezing in get_signal() io_uring/io-wq: limit retrying worker initialisation io_uring/napi: Remove unnecessary s64 cast io_uring/net: cleanup io_recv_finish() bundle handling io_uring/msg_ring: fix overflow posting MAINTAINERS: change Pavel Begunkov from io_uring reviewer to maintainer io_uring/msg_ring: use kmem_cache_free() to free request io_uring/msg_ring: check for dead submitter task io_uring/msg_ring: add an alloc cache for io_kiocb entries io_uring/msg_ring: improve handling of target CQE posting io_uring: add io_add_aux_cqe() helper io_uring: add remote task_work execution helper io_uring/msg_ring: tighten requirement for remote posting io_uring: Allocate only necessary memory in io_probe io_uring: Fix probe of disabled operations io_uring: Introduce IORING_OP_LISTEN io_uring: Introduce IORING_OP_BIND net: Split a __sys_listen helper for io_uring net: Split a __sys_bind helper for io_uring ... commit 92fc2c469eb26060384e9b2cd4cb0cc228aba582 Author: Bart Van Assche Date: Thu Jul 11 15:59:52 2024 -0700 nvme-pci: Fix the instructions for disabling power management pcie_aspm=off tells the kernel not to modify the ASPM configuration. This setting does not guarantee that ASPM (Active State Power Management) is disabled. Hence add pcie_port_pm=off. This disables power management for all PCIe ports. This patch has been tested on a workstation with a Samsung SSD 970 EVO Plus NVMe SSD. Fixes: 4641a8e6e145 ("nvme-pci: add trouble shooting steps for timeouts") Cc: Keith Busch Cc: Christoph Hellwig Cc: Chaitanya Kulkarni Signed-off-by: Bart Van Assche Signed-off-by: Keith Busch drivers/nvme/host/pci.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 88c918d1ee2c88cc5be3aa67ce048414fee471ff Author: Israel Rukshin Date: Thu Jul 11 14:40:53 2024 +0300 nvme: remove redundant bdev local variable Use disk directly instead of getting it from bdev->bd_disk. Signed-off-by: Israel Rukshin Reviewed-by: Sagi Grimberg Reviewed-by: Christoph Hellwig Reviewed-by: Chaitanya Kulkarni Signed-off-by: Keith Busch drivers/nvme/host/sysfs.c | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-) commit 1a7812b25e69f6c63c52d3bc93c0970ab7ad9660 Author: Markus Elfring Date: Sat Jul 13 15:43:17 2024 +0200 nvme-fabrics: Use seq_putc() in __nvmf_concat_opt_tokens() Single characters should be put into a sequence. Thus use the corresponding function “seq_putc”. This issue was transformed by using the Coccinelle software. Signed-off-by: Markus Elfring Signed-off-by: Keith Busch drivers/nvme/host/fabrics.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) commit ab091ec536cb7b271983c0c063b17f62f3591583 Author: WangYuli Date: Mon Jul 15 17:31:44 2024 +0800 nvme/pci: Add APST quirk for Lenovo N60z laptop There is a hardware power-saving problem with the Lenovo N60z board. When turn it on and leave it for 10 hours, there is a 20% chance that a nvme disk will not wake up until reboot. Link: https://lore.kernel.org/all/2B5581C46AC6E335+9c7a81f1-05fb-4fd0-9fbb-108757c21628@uniontech.com Signed-off-by: hmy Signed-off-by: Wentao Guan Signed-off-by: WangYuli Signed-off-by: Keith Busch drivers/nvme/host/pci.c | 7 +++++++ 1 file changed, 7 insertions(+) commit 4f5e249ec0ea8872e1644df23cffffbe28007188 Merge: 98f3a9a4fd44 602f09f4029c Author: Linus Torvalds Date: Mon Jul 15 13:28:14 2024 -0700 Merge tag 'vfs-6.11.iomap' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs Pull iomap updates from Christian Brauner: "This contains some minor work for the iomap subsystem: - Add documentation on the design of iomap and how to port to it - Optimize iomap_read_folio() - Bring back the change to iomap_write_end() to no increase i_size. This is accompanied by a change to xfs to reserve blocks for truncating large realtime inodes to avoid exposing stale data when iomap_write_end() stops increasing i_size" * tag 'vfs-6.11.iomap' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs: iomap: don't increase i_size in iomap_write_end() xfs: reserve blocks for truncating large realtime inode Documentation: the design of iomap and how to port iomap: Optimize iomap_read_folio commit 51b35d4f9d8860b7c181e545a90bc0ad370efbdb Merge: af58de31bebe 0a1868b93fad Author: Jakub Kicinski Date: Mon Jul 15 13:05:05 2024 -0700 Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net Merge in late fixes to prepare for the 6.11 net-next PR. Conflicts: 93c3a96c301f ("net: pse-pd: Do not return EOPNOSUPP if config is null") 4cddb0f15ea9 ("net: ethtool: pse-pd: Fix possible null-deref") 30d7b6727724 ("net: ethtool: Add new power limit get and set features") https://lore.kernel.org/20240715123204.623520bb@canb.auug.org.au/ Signed-off-by: Jakub Kicinski commit af58de31bebe737235f0238843f2054996998bd5 Merge: dd3cd3ca691d 355440a6981a Author: Jakub Kicinski Date: Mon Jul 15 12:50:57 2024 -0700 Merge branch 'eth-fbnic-add-network-driver-for-meta-platforms-host-network-interface' Alexander Duyck says: ==================== eth: fbnic: Add network driver for Meta Platforms Host Network Interface This patch set includes the necessary patches to enable basic Tx and Rx over the Meta Platforms Host Network Interface. To do this we introduce a new driver and driver directories in the form of "drivers/net/ethernet/meta/fbnic". The NIC itself is fairly simplistic. As far as speeds we support 25Gb, 50Gb, and 100Gb and we are mostly focused on speeds and feeds. As far as future patch sets we will be supporting the basic Rx/Tx offloads such as header/payload data split, TSO, checksum, and timestamp offloads. We have access to the MAC and PCS from the NIC, however the PHY and QSFP are hidden behind a FW layer as it is shared between 4 slices and the BMC. Due to submission limits the general plan to submit a minimal driver for now almost equivalent to a UEFI driver in functionality, and then follow up over the coming months enabling additional offloads and enabling more features for the device. ==================== Link: https://patch.msgid.link/172079913640.1778861.11459276843992867323.stgit@ahduyck-xeon-server.home.arpa Signed-off-by: Jakub Kicinski commit 355440a6981ab8166a8291678424bb38d3c1f5f9 Author: Alexander Duyck Date: Fri Jul 12 08:50:35 2024 -0700 eth: fbnic: Write the TCAM tables used for RSS control and Rx to host RSS is controlled by the Rx filter tables. Program rules matching on appropriate traffic types and set hashing fields using actions. We need a separate set of rules for broadcast and multicast because the action there needs to include forwarding to BMC. This patch only initializes the default settings, the control of the configuration using ethtool will come soon. With this the necessary rules are put in place to enable Rx of packets by the host. Signed-off-by: Alexander Duyck Link: https://patch.msgid.link/172079943591.1778861.17778587068185893750.stgit@ahduyck-xeon-server.home.arpa Signed-off-by: Jakub Kicinski drivers/net/ethernet/meta/fbnic/fbnic.h | 1 + drivers/net/ethernet/meta/fbnic/fbnic_csr.h | 59 ++++ drivers/net/ethernet/meta/fbnic/fbnic_netdev.c | 6 + drivers/net/ethernet/meta/fbnic/fbnic_netdev.h | 7 + drivers/net/ethernet/meta/fbnic/fbnic_pci.c | 4 + drivers/net/ethernet/meta/fbnic/fbnic_rpc.c | 370 +++++++++++++++++++++++++ drivers/net/ethernet/meta/fbnic/fbnic_rpc.h | 52 +++- 7 files changed, 498 insertions(+), 1 deletion(-) commit eb690ef8d1c2a1b60e8c11721ace1538f027459e Author: Alexander Duyck Date: Fri Jul 12 08:50:32 2024 -0700 eth: fbnic: Add L2 address programming Program the Rx TCAM to control L2 forwarding. Since we are in full control of the NIC we need to make sure we include BMC forwarding in the rules. When host is not present BMC will program the TCAM to get onto the network but once we take ownership it's up to Linux driver to make sure BMC L2 addresses are handled correctly. Co-developed-by: Sanman Pradhan Signed-off-by: Sanman Pradhan Signed-off-by: Alexander Duyck Link: https://patch.msgid.link/172079943202.1778861.4410412697614789017.stgit@ahduyck-xeon-server.home.arpa Signed-off-by: Jakub Kicinski drivers/net/ethernet/meta/fbnic/Makefile | 1 + drivers/net/ethernet/meta/fbnic/fbnic.h | 5 + drivers/net/ethernet/meta/fbnic/fbnic_csr.h | 14 ++ drivers/net/ethernet/meta/fbnic/fbnic_devlink.c | 2 + drivers/net/ethernet/meta/fbnic/fbnic_netdev.c | 230 +++++++++++++++++++ drivers/net/ethernet/meta/fbnic/fbnic_netdev.h | 3 + drivers/net/ethernet/meta/fbnic/fbnic_pci.c | 3 + drivers/net/ethernet/meta/fbnic/fbnic_rpc.c | 281 ++++++++++++++++++++++++ drivers/net/ethernet/meta/fbnic/fbnic_rpc.h | 139 ++++++++++++ 9 files changed, 678 insertions(+) commit a29b8eb6e5337f569f4a08937573dce7cc183493 Author: Alexander Duyck Date: Fri Jul 12 08:50:28 2024 -0700 eth: fbnic: Add basic Rx handling Handle Rx packets with basic csum and Rx hash offloads. NIC writes back to the completion ring a head buffer descriptor (data buffer allocated from header pages), variable number of payload descriptors (data buffers in payload pages), an optional metadata descriptor (type 2) and finally the primary metadata descriptor (type 3). This format makes scatter support fairly easy - start gathering the pages when we see head page, gather until we see the primary metadata descriptor, do the processing. Use XDP infra to collect the packet fragments as we traverse the descriptors. XDP itself is not supported yet, but it will be soon. Signed-off-by: Alexander Duyck Link: https://patch.msgid.link/172079942839.1778861.10509071985738726125.stgit@ahduyck-xeon-server.home.arpa Signed-off-by: Jakub Kicinski drivers/net/ethernet/meta/fbnic/fbnic_csr.h | 63 +++++ drivers/net/ethernet/meta/fbnic/fbnic_netdev.c | 4 +- drivers/net/ethernet/meta/fbnic/fbnic_pci.c | 3 + drivers/net/ethernet/meta/fbnic/fbnic_txrx.c | 333 ++++++++++++++++++++++++- drivers/net/ethernet/meta/fbnic/fbnic_txrx.h | 2 + 5 files changed, 402 insertions(+), 3 deletions(-) commit 9a57bacd574b52b08bc2c600af6a8c7a87049ecf Author: Alexander Duyck Date: Fri Jul 12 08:50:24 2024 -0700 eth: fbnic: Add basic Tx handling Handle Tx of simple packets. Support checksum offload and gather. Use .ndo_features_check to make sure packet geometry will be supported by the HW, i.e. we can fit the header lengths into the descriptor fields. The device writes to the completion rings the position of the tail (consumer) pointer. Read all those writebacks, obviously the last one will be the most recent, complete skbs up to that point. Signed-off-by: Alexander Duyck Link: https://patch.msgid.link/172079942464.1778861.17919428039428796180.stgit@ahduyck-xeon-server.home.arpa Signed-off-by: Jakub Kicinski drivers/net/ethernet/meta/fbnic/fbnic_csr.h | 66 +++++ drivers/net/ethernet/meta/fbnic/fbnic_netdev.c | 9 + drivers/net/ethernet/meta/fbnic/fbnic_txrx.c | 388 ++++++++++++++++++++++++- drivers/net/ethernet/meta/fbnic/fbnic_txrx.h | 15 + 4 files changed, 477 insertions(+), 1 deletion(-) commit 69684376eed517817251ea6a768cfc315350d5c1 Author: Alexander Duyck Date: Fri Jul 12 08:49:58 2024 -0700 eth: fbnic: Add link detection Add basic support for detecting the link and reporting it at the netdev layer. For now we will just use the values reporeted by the firmware as the link configuration and assume that is the current configuration of the MAC and PCS. With this we start the stubbing out of the phylink interface that will be used to provide the configuration interface for ethtool in a future patch set. The phylink interface isn't an exact fit. As such we are currently working around several issues in this patch set that we plan to address in the future such as: 1. Support for FEC 2. Support for multiple lanes to handle 50GbaseR2 vs 50GbaseR1 3. Support for BMC CC: Russell King CC: Andrew Lunn Signed-off-by: Alexander Duyck Link: https://patch.msgid.link/172079939835.1778861.5964790909718481811.stgit@ahduyck-xeon-server.home.arpa Signed-off-by: Jakub Kicinski drivers/net/ethernet/meta/Kconfig | 1 + drivers/net/ethernet/meta/fbnic/Makefile | 1 + drivers/net/ethernet/meta/fbnic/fbnic.h | 10 + drivers/net/ethernet/meta/fbnic/fbnic_csr.h | 39 ++++ drivers/net/ethernet/meta/fbnic/fbnic_fw.h | 13 ++ drivers/net/ethernet/meta/fbnic/fbnic_irq.c | 67 +++++++ drivers/net/ethernet/meta/fbnic/fbnic_mac.c | 241 ++++++++++++++++++++++++ drivers/net/ethernet/meta/fbnic/fbnic_mac.h | 61 ++++++ drivers/net/ethernet/meta/fbnic/fbnic_netdev.c | 22 +++ drivers/net/ethernet/meta/fbnic/fbnic_netdev.h | 11 ++ drivers/net/ethernet/meta/fbnic/fbnic_pci.c | 2 + drivers/net/ethernet/meta/fbnic/fbnic_phylink.c | 161 ++++++++++++++++ 12 files changed, 629 insertions(+) commit 20d2e88cc7461b03b97293d62d780a2d4b08ed8b Author: Alexander Duyck Date: Fri Jul 12 08:49:54 2024 -0700 eth: fbnic: Add initial messaging to notify FW of our presence After the driver loads we need to get some initial capabilities from the firmware to determine what the device is capable of and what functionality needs to be enabled. Specifically we receive information about the current state of the link and if a BMC is present. After that when we bring the interface up we will need the ability to take ownership from the FW. To do that we will need to notify it that we are taking control before we start configuring the traffic classifier and MAC. Once we have ownership we need to notify the firmware that we are still present and active. To do that we will send a regular heartbeat to the FW. If the FW doesn't receive the heartbeat in a timely fashion it will retake control of the RPC and MAC and assume that the host has gone offline. Signed-off-by: Alexander Duyck Link: https://patch.msgid.link/172079939458.1778861.8966209942099133957.stgit@ahduyck-xeon-server.home.arpa Signed-off-by: Jakub Kicinski drivers/net/ethernet/meta/fbnic/fbnic.h | 5 + drivers/net/ethernet/meta/fbnic/fbnic_csr.h | 8 + drivers/net/ethernet/meta/fbnic/fbnic_fw.c | 411 +++++++++++++++++++++++++ drivers/net/ethernet/meta/fbnic/fbnic_fw.h | 85 +++++ drivers/net/ethernet/meta/fbnic/fbnic_netdev.c | 18 ++ drivers/net/ethernet/meta/fbnic/fbnic_pci.c | 28 ++ 6 files changed, 555 insertions(+) commit 0cb4c0a13723ef6dd06be8f913443897a0ffccb5 Author: Alexander Duyck Date: Fri Jul 12 08:49:50 2024 -0700 eth: fbnic: Implement Rx queue alloc/start/stop/free Implement control path parts of Rx queue handling. The NIC consumes memory in pages. It takes a full page and places packets into it in a configurable manner (with the ability to define headroom / tailroom as well as head alignment requirements). As mentioned in prior patches there are two page submissions queues one for packet headers and second (optional) for packet payloads. For now feed both queues from a single page pool. Use the page pool "fragment" API, as we can't predict upfront how the page will be sliced. Signed-off-by: Alexander Duyck Link: https://patch.msgid.link/172079939092.1778861.3780136633831329550.stgit@ahduyck-xeon-server.home.arpa Signed-off-by: Jakub Kicinski drivers/net/ethernet/meta/fbnic/fbnic_csr.h | 103 ++++- drivers/net/ethernet/meta/fbnic/fbnic_netdev.c | 3 + drivers/net/ethernet/meta/fbnic/fbnic_netdev.h | 3 + drivers/net/ethernet/meta/fbnic/fbnic_pci.c | 2 + drivers/net/ethernet/meta/fbnic/fbnic_txrx.c | 503 ++++++++++++++++++++++++- drivers/net/ethernet/meta/fbnic/fbnic_txrx.h | 33 ++ 6 files changed, 638 insertions(+), 9 deletions(-) commit 40bf06a160a14eb910c491b6c0deca1821d34cd9 Author: Alexander Duyck Date: Fri Jul 12 08:49:47 2024 -0700 eth: fbnic: Implement Tx queue alloc/start/stop/free Implement basic management operations for Tx queues. Allocate memory for submission and completion rings. Learn how to start the queues, stop them, and wait for HW to be idle. We call HW rings "descriptor rings" (stored in ring->desc), and SW context rings "buffer rings" (stored in ring->*_buf union). This is the first patch which actually touches CSRs so add CSR helpers. No actual datapath / packet handling here, yet. Signed-off-by: Alexander Duyck Link: https://patch.msgid.link/172079938724.1778861.8329677776612865169.stgit@ahduyck-xeon-server.home.arpa Signed-off-by: Jakub Kicinski drivers/net/ethernet/meta/fbnic/fbnic_csr.h | 72 +++- drivers/net/ethernet/meta/fbnic/fbnic_netdev.c | 9 + drivers/net/ethernet/meta/fbnic/fbnic_netdev.h | 2 + drivers/net/ethernet/meta/fbnic/fbnic_pci.c | 19 +- drivers/net/ethernet/meta/fbnic/fbnic_txrx.c | 437 +++++++++++++++++++++++++ drivers/net/ethernet/meta/fbnic/fbnic_txrx.h | 22 ++ 6 files changed, 550 insertions(+), 11 deletions(-) commit bc6107771bb4be3009168cfda24d22131c026fe8 Author: Alexander Duyck Date: Fri Jul 12 08:49:43 2024 -0700 eth: fbnic: Allocate a netdevice and napi vectors with queues Allocate a netdev and figure out basics like how many queues we need, MAC address, MTU bounds. Kick off a service task to do various periodic things like health checking. The service task only runs when device is open. We have four levels of objects here: - ring - A HW ring with head / tail pointers, - triad - Two submission and one completion ring, - NAPI - NAPI, with one IRQ and any number of Rx and Tx triads, - Netdev - The ultimate container of the rings and napi vectors. The "triad" is the only less-than-usual construct. On Rx we have two "free buffer" submission rings, one for packet headers and one for packet data. On Tx we have separate rings for XDP Tx and normal Tx. So we ended up with ring triplets in both directions. We keep NAPIs on a local list, even though core already maintains a list. Later on having a separate list will matter for live reconfig. We introduce the list already, the churn would not be worth it. Signed-off-by: Alexander Duyck Link: https://patch.msgid.link/172079938358.1778861.11681469974633489463.stgit@ahduyck-xeon-server.home.arpa Signed-off-by: Jakub Kicinski drivers/net/ethernet/meta/fbnic/Makefile | 4 +- drivers/net/ethernet/meta/fbnic/fbnic.h | 18 ++ drivers/net/ethernet/meta/fbnic/fbnic_csr.h | 40 ++++ drivers/net/ethernet/meta/fbnic/fbnic_irq.c | 26 ++- drivers/net/ethernet/meta/fbnic/fbnic_netdev.c | 189 +++++++++++++++++ drivers/net/ethernet/meta/fbnic/fbnic_netdev.h | 37 ++++ drivers/net/ethernet/meta/fbnic/fbnic_pci.c | 138 +++++++++++++ drivers/net/ethernet/meta/fbnic/fbnic_txrx.c | 270 +++++++++++++++++++++++++ drivers/net/ethernet/meta/fbnic/fbnic_txrx.h | 55 +++++ 9 files changed, 775 insertions(+), 2 deletions(-) commit da3cde08209ec1c915195c2331c275397f34a731 Author: Alexander Duyck Date: Fri Jul 12 08:49:31 2024 -0700 eth: fbnic: Add FW communication mechanism Add a mechanism for sending messages to and receiving messages from the FW. The FW has fairly limited functionality, so the mechanism doesn't have to support high message rate. Use device mailbox registers to form two rings, one "to" and one "from" the device. The rings are just a convention between driver and FW, not a HW construct. We don't expect messages larger than 4k so use page-sized buffers. Signed-off-by: Alexander Duyck Link: https://patch.msgid.link/172079937113.1778861.10669864213768701947.stgit@ahduyck-xeon-server.home.arpa Signed-off-by: Jakub Kicinski drivers/net/ethernet/meta/fbnic/Makefile | 1 + drivers/net/ethernet/meta/fbnic/fbnic.h | 18 ++ drivers/net/ethernet/meta/fbnic/fbnic_csr.h | 79 ++++++ drivers/net/ethernet/meta/fbnic/fbnic_fw.c | 380 ++++++++++++++++++++++++++++ drivers/net/ethernet/meta/fbnic/fbnic_fw.h | 26 ++ drivers/net/ethernet/meta/fbnic/fbnic_irq.c | 78 ++++++ drivers/net/ethernet/meta/fbnic/fbnic_pci.c | 59 +++++ 7 files changed, 641 insertions(+) commit c6203e678cc9a5bf01ec7ae382851f504870777f Author: Alexander Duyck Date: Fri Jul 12 08:49:27 2024 -0700 eth: fbnic: Add message parsing for FW messages Add FW message formatting and parsing. The TLV format should look very familiar to those familiar with netlink. Since we don't have to deal with backward compatibility we tweaked the format a little to make it easier to deal with, and more appropriate for tightly coupled interfaces like driver<>FW communication. Signed-off-by: Alexander Duyck Link: https://patch.msgid.link/172079936754.1778861.1029830244010564007.stgit@ahduyck-xeon-server.home.arpa Signed-off-by: Jakub Kicinski drivers/net/ethernet/meta/fbnic/Makefile | 3 +- drivers/net/ethernet/meta/fbnic/fbnic_tlv.c | 529 ++++++++++++++++++++++++++++ drivers/net/ethernet/meta/fbnic/fbnic_tlv.h | 175 +++++++++ 3 files changed, 706 insertions(+), 1 deletion(-) commit 3646153161f1052972d9d2062d8c27b0e30c89f8 Author: Alexander Duyck Date: Fri Jul 12 08:49:23 2024 -0700 eth: fbnic: Add register init to set PCIe/Ethernet device config As a part of enabling the device the first step is to configure the AXI and Ethernet interfaces to allow for basic traffic. This consists of configuring several registers related to the PCIe and Ethernet FIFOs as well as configuring the handlers for moving traffic between entities. Signed-off-by: Alexander Duyck Link: https://patch.msgid.link/172079936376.1778861.15942501417449077552.stgit@ahduyck-xeon-server.home.arpa Signed-off-by: Jakub Kicinski drivers/net/ethernet/meta/fbnic/Makefile | 1 + drivers/net/ethernet/meta/fbnic/fbnic.h | 41 +++ drivers/net/ethernet/meta/fbnic/fbnic_csr.h | 312 +++++++++++++++++ drivers/net/ethernet/meta/fbnic/fbnic_devlink.c | 2 + drivers/net/ethernet/meta/fbnic/fbnic_mac.c | 425 ++++++++++++++++++++++++ drivers/net/ethernet/meta/fbnic/fbnic_mac.h | 25 ++ drivers/net/ethernet/meta/fbnic/fbnic_pci.c | 39 +++ 7 files changed, 845 insertions(+) commit 1a9d48892ea5bf27f359f40d96511acc3eecea58 Author: Alexander Duyck Date: Fri Jul 12 08:49:20 2024 -0700 eth: fbnic: Allocate core device specific structures and devlink interface At the core of the fbnic device will be the devlink interface. This interface will eventually provide basic functionality in the event that there are any issues with the network interface. Add support for allocating the MSI-X vectors and setting up the BAR mapping. With this we can start enabling various subsystems and start brining up additional interfaces such the AXI fabric and the firmware mailbox. Signed-off-by: Alexander Duyck Link: https://patch.msgid.link/172079936012.1778861.4670986685222676467.stgit@ahduyck-xeon-server.home.arpa Signed-off-by: Jakub Kicinski drivers/net/ethernet/meta/fbnic/Makefile | 4 +- drivers/net/ethernet/meta/fbnic/fbnic.h | 27 ++++++++ drivers/net/ethernet/meta/fbnic/fbnic_devlink.c | 84 +++++++++++++++++++++++++ drivers/net/ethernet/meta/fbnic/fbnic_irq.c | 39 ++++++++++++ drivers/net/ethernet/meta/fbnic/fbnic_pci.c | 70 ++++++++++++++++++++- 5 files changed, 222 insertions(+), 2 deletions(-) commit 546dd90be97913c775b5bcd20b665f4ff5df9cd4 Author: Alexander Duyck Date: Fri Jul 12 08:49:16 2024 -0700 eth: fbnic: Add scaffolding for Meta's NIC driver Create a bare-bones PCI driver for Meta's NIC. Subsequent changes will flesh it out. Signed-off-by: Alexander Duyck Reviewed-by: Andrew Lunn Link: https://patch.msgid.link/172079935646.1778861.9710282776096050607.stgit@ahduyck-xeon-server.home.arpa Signed-off-by: Jakub Kicinski MAINTAINERS | 7 + drivers/net/ethernet/Kconfig | 1 + drivers/net/ethernet/Makefile | 1 + drivers/net/ethernet/meta/Kconfig | 30 ++++ drivers/net/ethernet/meta/Makefile | 6 + drivers/net/ethernet/meta/fbnic/Makefile | 10 ++ drivers/net/ethernet/meta/fbnic/fbnic.h | 19 +++ drivers/net/ethernet/meta/fbnic/fbnic_csr.h | 9 ++ drivers/net/ethernet/meta/fbnic/fbnic_drvinfo.h | 5 + drivers/net/ethernet/meta/fbnic/fbnic_pci.c | 201 ++++++++++++++++++++++++ 10 files changed, 289 insertions(+) commit c5eaf1b3f824369b6dcb33a39232b871d2ca8e33 Author: Alexander Duyck Date: Fri Jul 12 08:49:12 2024 -0700 PCI: Add Meta Platforms vendor ID Add Meta as a vendor ID for PCI devices so we can use the macro for future drivers. Signed-off-by: Alexander Duyck Acked-by: Bjorn Helgaas Link: https://patch.msgid.link/172079935272.1778861.13619056509276833225.stgit@ahduyck-xeon-server.home.arpa Signed-off-by: Jakub Kicinski include/linux/pci_ids.h | 2 ++ 1 file changed, 2 insertions(+) commit dd3cd3ca691df33292e73996f92d2a98906f69c5 Merge: e7afb958fa90 0477d5168bbb Author: Jakub Kicinski Date: Mon Jul 15 12:42:44 2024 -0700 Merge tag 'aux-sysfs-irqs' of git://git.kernel.org/pub/scm/linux/kernel/git/mellanox/linux Saeed Mahameed says: ==================== aux-sysfs-irqs Shay Says: ========== Introduce auxiliary bus IRQs sysfs Today, PCI PFs and VFs, which are anchored on the PCI bus, display their IRQ information in the /msi_irqs/ sysfs files. PCI subfunctions (SFs) are similar to PFs and VFs and these SFs are anchored on the auxiliary bus. However, these PCI SFs lack such IRQ information on the auxiliary bus, leaving users without visibility into which IRQs are used by the SFs. This absence makes it impossible to debug situations and to understand the source of interrupts/SFs for performance tuning and debug. Additionally, the SFs are multifunctional devices supporting RDMA, network devices, clocks, and more, similar to their peer PCI PFs and VFs. Therefore, it is desirable to have SFs' IRQ information available at the bus/device level. To overcome the above limitations, this short series extends the auxiliary bus to display IRQ information in sysfs, similar to that of PFs and VFs. It adds an 'irqs' directory under the auxiliary device and includes an sysfs file within it. For example: $ ls /sys/bus/auxiliary/devices/mlx5_core.sf.1/irqs/ 50 51 52 53 54 55 56 57 58 Patch summary: patch-1 adds auxiliary bus to support irqs used by auxiliary device patch-2 mlx5 driver using exposing irqs for PCI SF devices via auxiliary bus ========== * tag 'aux-sysfs-irqs' of git://git.kernel.org/pub/scm/linux/kernel/git/mellanox/linux: net/mlx5: Expose SFs IRQs driver core: auxiliary bus: show auxiliary device IRQs RDMA/mlx5: Add Qcounters req_transport_retries_exceeded/req_rnr_retries_exceeded net/mlx5: Reimplement write combining test ==================== Link: https://patch.msgid.link/20240711213140.256997-1-saeed@kernel.org Signed-off-by: Jakub Kicinski commit 98f3a9a4fd449641010c77abca16aebb0b8d4419 Merge: 1b074abe885f 5b08bd408534 Author: Linus Torvalds Date: Mon Jul 15 12:34:01 2024 -0700 Merge tag 'vfs-6.11.pidfs' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs Pull pidfs updates from Christian Brauner: "This contains work to make it possible to derive namespace file descriptors from pidfd file descriptors. Right now it is already possible to use a pidfd with setns() to atomically change multiple namespaces at the same time. In other words, it is possible to switch to the namespace context of a process using a pidfd. There is no need to first open namespace file descriptors via procfs. The work included here is an extension of these abilities by allowing to open namespace file descriptors using a pidfd. This means it is now possible to interact with namespaces without ever touching procfs. To this end a new set of ioctls() on pidfds is introduced covering all supported namespace types" * tag 'vfs-6.11.pidfs' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs: pidfs: allow retrieval of namespace file descriptors nsfs: add open_namespace() nsproxy: add helper to go from arbitrary namespace to ns_common nsproxy: add a cleanup helper for nsproxy file: add take_fd() cleanup helper commit 1b074abe885f43b2c207b5e748ffa60604dbc020 Merge: f608cabaeda4 ca567df74a28 Author: Linus Torvalds Date: Mon Jul 15 12:27:39 2024 -0700 Merge tag 'vfs-6.11.nsfs' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs Pull namespace-fs updates from Christian Brauner: "This adds ioctls allowing to translate PIDs between PID namespaces. The motivating use-case comes from LXCFS which is a tiny fuse filesystem used to virtualize various aspects of procfs. LXCFS is run on the host. The files and directories it creates can be bind-mounted by e.g. a container at startup and mounted over the various procfs files the container wishes to have virtualized. When e.g. a read request for uptime is received, LXCFS will receive the pid of the reader. In order to virtualize the corresponding read, LXCFS needs to know the pid of the init process of the reader's pid namespace. In order to do this, LXCFS first needs to fork() two helper processes. The first helper process setns() to the readers pid namespace. The second helper process is needed to create a process that is a proper member of the pid namespace. The second helper process then creates a ucred message with ucred.pid set to 1 and sends it back to LXCFS. The kernel will translate the ucred.pid field to the corresponding pid number in LXCFS's pid namespace. This way LXCFS can learn the init pid number of the reader's pid namespace and can go on to virtualize. Since these two forks() are costly LXCFS maintains an init pid cache that caches a given pid for a fixed amount of time. The cache is pruned during new read requests. However, even with the cache the hit of the two forks() is singificant when a very large number of containers are running. So this adds a simple set of ioctls that let's a caller translate PIDs from and into a given PID namespace. This significantly improves performance with a very simple change. To protect against races pidfds can be used to check whether the process is still valid" * tag 'vfs-6.11.nsfs' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs: nsfs: add pid translation ioctls commit ae81b69fd2b1eb4885b352749b1fd1172e2f0f18 Author: Drew Fustini Date: Thu Jul 11 09:56:20 2024 -0700 clk: thead: Add support for T-Head TH1520 AP_SUBSYS clocks Add support for the AP sub-system clock controller in the T-Head TH1520. This include CPU, DPU, GMAC and TEE PLLs. Link: https://openbeagle.org/beaglev-ahead/beaglev-ahead/-/blob/main/docs/TH1520%20System%20User%20Manual.pdf Co-developed-by: Yangtao Li Signed-off-by: Yangtao Li Co-developed-by: Jisheng Zhang Signed-off-by: Jisheng Zhang Link: https://git.beagleboard.org/beaglev-ahead/beaglev-ahead/-/tree/main/docs Signed-off-by: Drew Fustini Link: https://lore.kernel.org/r/20240711-th1520-clk-v3-2-6ff17bb318fb@tenstorrent.com Signed-off-by: Stephen Boyd MAINTAINERS | 1 + drivers/clk/Kconfig | 1 + drivers/clk/Makefile | 1 + drivers/clk/thead/Kconfig | 12 + drivers/clk/thead/Makefile | 2 + drivers/clk/thead/clk-th1520-ap.c | 1089 +++++++++++++++++++++++++++++++++++++ 6 files changed, 1106 insertions(+) commit 7dc836187f7c6f70a82b4521503e9f9f96194581 Author: levi.yun Date: Thu Jul 4 16:02:26 2024 +0100 trace/pid_list: Change gfp flags in pid_list_fill_irq() pid_list_fill_irq() runs via irq_work. When CONFIG_PREEMPT_RT is disabled, it would run in irq_context. so it shouldn't sleep while memory allocation. Change gfp flags from GFP_KERNEL to GFP_NOWAIT to prevent sleep in irq_work. This change wouldn't impact functionality in practice because the worst-size is 2K. Cc: stable@goodmis.org Fixes: 8d6e90983ade2 ("tracing: Create a sparse bitmask for pid filtering") Link: https://lore.kernel.org/20240704150226.1359936-1-yeoreum.yun@arm.com Acked-by: Masami Hiramatsu (Google) Signed-off-by: levi.yun Signed-off-by: Steven Rostedt (Google) kernel/trace/pid_list.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) commit a325742505f6f08141fd7a530a82a907780bfd2c Author: Tio Zhang Date: Wed Jul 3 11:33:53 2024 +0800 tracing/sched: sched_switch: place prev_comm and next_comm in right order Switch the order of prev_comm and next_comm in sched_switch's code to align with its printing order. Cc: Signed-off-by: Tio Zhang Link: https://lore.kernel.org/20240703033353.GA2833@didi-ThinkCentre-M930t-N000 Reviewed-by: Madadi Vineeth Reddy Signed-off-by: Steven Rostedt (Google) include/trace/events/sched.h | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) commit f608cabaeda472887c008e42398e8fca14e8f411 Merge: 2aae1d67fd1d 4bed843b1000 Author: Linus Torvalds Date: Mon Jul 15 11:54:04 2024 -0700 Merge tag 'vfs-6.11.mount' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs Pull vfs mount query updates from Christian Brauner: "This contains work to extend the abilities of listmount() and statmount() and various fixes and cleanups. Features: - Allow iterating through mounts via listmount() from newest to oldest. This makes it possible for mount(8) to keep iterating the mount table in reverse order so it gets newest mounts first. - Relax permissions on listmount() and statmount(). It's not necessary to have capabilities in the initial namespace: it is sufficient to have capabilities in the owning namespace of the mount namespace we're located in to list unreachable mounts in that namespace. - Extend both listmount() and statmount() to list and stat mounts in foreign mount namespaces. Currently the only way to iterate over mount entries in mount namespaces that aren't in the caller's mount namespace is by crawling through /proc in order to find /proc//mountinfo for the relevant mount namespace. This is both very clumsy and hugely inefficient. So extend struct mnt_id_req with a new member that allows to specify the mount namespace id of the mount namespace we want to look at. Luckily internally we already have most of the infrastructure for this so we just need to expose it to userspace. Give userspace a way to retrieve the id of a mount namespace via statmount() and through a new nsfs ioctl() on mount namespace file descriptor. This comes with appropriate selftests. - Expose mount options through statmount(). Currently if userspace wants to get mount options for a mount and with statmount(), they still have to open /proc//mountinfo to parse mount options. Simply the information through statmount() directly. Afterwards it's possible to only rely on statmount() and listmount() to retrieve all and more information than /proc//mountinfo provides. This comes with appropriate selftests. Fixes: - Avoid copying to userspace under the namespace semaphore in listmount. Cleanups: - Simplify the error handling in listmount by relying on our newly added cleanup infrastructure. - Refuse invalid mount ids early for both listmount and statmount" * tag 'vfs-6.11.mount' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs: fs: reject invalid last mount id early fs: refuse mnt id requests with invalid ids early fs: find rootfs mount of the mount namespace fs: only copy to userspace on success in listmount() sefltests: extend the statmount test for mount options fs: use guard for namespace_sem in statmount() fs: export mount options via statmount() fs: rename show_mnt_opts -> show_vfsmnt_opts selftests: add a test for the foreign mnt ns extensions fs: add an ioctl to get the mnt ns id from nsfs fs: Allow statmount() in foreign mount namespace fs: Allow listmount() in foreign mount namespace fs: export the mount ns id via statmount fs: keep an index of current mount namespaces fs: relax permissions for statmount() listmount: allow listing in reverse order fs: relax permissions for listmount() fs: simplify error handling fs: don't copy to userspace under namespace semaphore path: add cleanup helper commit 281cfec53b4484ce2092c89b6909f5573cb23443 Merge: ab33da3a2208 b755367602d7 Author: Rafael J. Wysocki Date: Mon Jul 15 20:44:31 2024 +0200 Merge branch 'thermal-intel' Merge updates of Intel thermal drivers for 6.11-rc1: - Switch Intel thermal drivers to new Intel CPU model defines (Tony Luck). - Clean up the int3400 and int3403 drivers (Erick Archer and David Alan Gilbert). - Improve intel_pch_thermal kernel log messages printed during suspend to idle (Zhang Rui). - Make the intel_tcc_cooling driver use a model-specific bitmask for TCC offset (Ricardo Neri). - Add DLVR and MSI interrupt support for the Lunar Lake platform to the int340x thermal driver (Srinivas Pandruvada). - Enable workload type hints (WLT) support and power floor interrupt support for the Lunar Lake platform in int340x ((Srinivas Pandruvada). - Make the HFI thermal driver use package scope for HFI instances as per the Intel SDM (Zhang Rui). * thermal-intel: thermal: intel: hfi: Give HFI instances package scope thermal: intel: int340x: Enable WLT and power floor support for Lunar Lake thermal: intel: int340x: Support MSI interrupt for Lunar Lake thermal: intel: int340x: Remove unnecessary calls to free irq thermal: intel: int340x: Add DLVR support for Lunar Lake thermal: intel: int340x: Capability to map user space to firmware values thermal: intel: int340x: Cleanup of DLVR sysfs on driver remove thermal: intel: intel_tcc_cooling: Use a model-specific bitmask for TCC offset thermal: intel: intel_tcc: Add model checks for temperature registers thermal: intel: intel_pch: Improve cooling log thermal: int3403: remove unused struct 'int3403_performance_state' thermal: int3400: Use sizeof(*pointer) instead of sizeof(type) thermal: intel: intel_soc_dts_thermal: Switch to new Intel CPU model defines thermal: intel: intel_tcc_cooling: Switch to new Intel CPU model defines commit ab33da3a220809e4b18fd8782785c90d02a96795 Merge: 3fdd8ea39f0b 366971640192 Author: Rafael J. Wysocki Date: Mon Jul 15 20:43:21 2024 +0200 Merge branch 'thermal-core' Merge updates related to the thermal core for 6.11-rc1: - Redesign the .set_trip_temp() thermal zone callback to take a trip pointer instead of a trip ID and update its users (Rafael Wysocki). - Avoid using invalid combinations of polling_delay and passive_delay thermal zone parameters (Rafael Wysocki). - Update a cooling device registration function to take a const argument (Krzysztof Kozlowski). - Make the uniphier thermal driver use thermal_zone_for_each_trip() for walking trip points (Rafael Wysocki). * thermal-core: thermal: core: Add sanity checks for polling_delay and passive_delay thermal: trip: Fold __thermal_zone_get_trip() into its caller thermal: trip: Pass trip pointer to .set_trip_temp() thermal zone callback thermal: imx: Drop critical trip check from imx_set_trip_temp() thermal: trip: Add conversion macros for thermal trip priv field thermal: helpers: Introduce thermal_trip_is_bound_to_cdev() thermal: core: Change passive_delay and polling_delay data type thermal: core: constify 'type' in devm_thermal_of_cooling_device_register() thermal: uniphier: Use thermal_zone_for_each_trip() for walking trip points commit 2aae1d67fd1d9070f8f23a6e7d9a7a093cf35fbb Merge: b8fc1bd73a5a dc99c0ff53f5 Author: Linus Torvalds Date: Mon Jul 15 11:39:44 2024 -0700 Merge tag 'vfs-6.11.inode' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs Pull vfs inode / dentry updates from Christian Brauner: "This contains smaller performance improvements to inodes and dentries: inode: - Add rcu based inode lookup variants. They avoid one inode hash lock acquire in the common case thereby significantly reducing contention. We already support RCU-based operations but didn't take advantage of them during inode insertion. Callers of iget_locked() get the improvement without any code changes. Callers that need a custom callback can switch to iget5_locked_rcu() as e.g., did btrfs. With 20 threads each walking a dedicated 1000 dirs * 1000 files directory tree to stat(2) on a 32 core + 24GB ram vm: before: 3.54s user 892.30s system 1966% cpu 45.549 total after: 3.28s user 738.66s system 1955% cpu 37.932 total (-16.7%) Long-term we should pick up the effort to introduce more fine-grained locking and possibly improve on the currently used hash implementation. - Start zeroing i_state in inode_init_always() instead of doing it in individual filesystems. This allows us to remove an unneeded lock acquire in new_inode() and not burden individual filesystems with this. dcache: - Move d_lockref out of the area used by RCU lookup to avoid cacheline ping poing because the embedded name is sharing a cacheline with d_lockref. - Fix dentry size on 32bit with CONFIG_SMP=y so it does actually end up with 128 bytes in total" * tag 'vfs-6.11.inode' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs: fs: fix dentry size vfs: move d_lockref out of the area used by RCU lookup bcachefs: remove now spurious i_state initialization xfs: remove now spurious i_state initialization in xfs_inode_alloc vfs: partially sanitize i_state zeroing on inode creation xfs: preserve i_state around inode_init_always in xfs_reinit_inode btrfs: use iget5_locked_rcu vfs: add rcu-based find_inode variants for iget ops commit b8fc1bd73a5a12e48f9fd2e7ccea60cadf718c93 Merge: 4a051e4c21df eea6a8322efd Author: Linus Torvalds Date: Mon Jul 15 11:31:32 2024 -0700 Merge tag 'vfs-6.11.mount.api' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs Pull vfs mount API updates from Christian Brauner: - Add a generic helper to parse uid and gid mount options. Currently we open-code the same logic in various filesystems which is error prone, especially since the verification of uid and gid mount options is a sensitive operation in the face of idmappings. Add a generic helper and convert all filesystems over to it. Make sure that filesystems that are mountable in unprivileged containers verify that the specified uid and gid can be represented in the owning namespace of the filesystem. - Convert hostfs to the new mount api. * tag 'vfs-6.11.mount.api' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs: fuse: Convert to new uid/gid option parsing helpers fuse: verify {g,u}id mount options correctly fat: Convert to new uid/gid option parsing helpers fat: Convert to new mount api fat: move debug into fat_mount_options vboxsf: Convert to new uid/gid option parsing helpers tracefs: Convert to new uid/gid option parsing helpers smb: client: Convert to new uid/gid option parsing helpers tmpfs: Convert to new uid/gid option parsing helpers ntfs3: Convert to new uid/gid option parsing helpers isofs: Convert to new uid/gid option parsing helpers hugetlbfs: Convert to new uid/gid option parsing helpers ext4: Convert to new uid/gid option parsing helpers exfat: Convert to new uid/gid option parsing helpers efivarfs: Convert to new uid/gid option parsing helpers debugfs: Convert to new uid/gid option parsing helpers autofs: Convert to new uid/gid option parsing helpers fs_parse: add uid & gid option option parsing helpers hostfs: Add const qualifier to host_root in hostfs_fill_super() hostfs: convert hostfs to use the new mount API commit 4a051e4c21dfb1c65ef54c44a7a4d0e6845e24f6 Merge: 7d156879ffd6 28add38d545f Author: Linus Torvalds Date: Mon Jul 15 11:18:49 2024 -0700 Merge tag 'vfs-6.11.casefold' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs Pull vfs casefolding updates from Christian Brauner: "This contains some work to simplify the handling of casefolded names: - Simplify the handling of casefolded names in f2fs and ext4 by keeping the names as a qstr to avoiding unnecessary conversions - Introduce a new generic_ci_match() libfs case-insensitive lookup helper and use it in both f2fs and ext4 allowing to remove the filesystem specific implementations - Remove a bunch of ifdefs by making the unicode build checks part of the code flow" * tag 'vfs-6.11.casefold' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs: f2fs: Move CONFIG_UNICODE defguards into the code flow ext4: Move CONFIG_UNICODE defguards into the code flow f2fs: Reuse generic_ci_match for ci comparisons ext4: Reuse generic_ci_match for ci comparisons libfs: Introduce case-insensitive string comparison helper f2fs: Simplify the handling of cached casefolded names ext4: Simplify the handling of cached casefolded names commit 7d156879ffd6c48428c2f46d5c2b4b80d9c9ee79 Merge: aff31330e037 807221c54db6 Author: Linus Torvalds Date: Mon Jul 15 11:14:59 2024 -0700 Merge tag 'vfs-6.11.module.description' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs Pull vfs module description updates from Christian Brauner: "This contains patches to add module descriptions to all modules under fs/ currently lacking them" * tag 'vfs-6.11.module.description' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs: openpromfs: add missing MODULE_DESCRIPTION() macro fs: nls: add missing MODULE_DESCRIPTION() macros fs: autofs: add MODULE_DESCRIPTION() fs: fat: add missing MODULE_DESCRIPTION() macros fs: binfmt: add missing MODULE_DESCRIPTION() macros fs: cramfs: add MODULE_DESCRIPTION() fs: hfs: add MODULE_DESCRIPTION() fs: hpfs: add MODULE_DESCRIPTION() qnx4: add MODULE_DESCRIPTION() qnx6: add MODULE_DESCRIPTION() fs: sysv: add MODULE_DESCRIPTION() fs: efs: add MODULE_DESCRIPTION() fs: minix: add MODULE_DESCRIPTION() commit 87232ea8a5caf8d050f8ea7acd210a2cfcbe6309 Author: Steve Wilkins Date: Mon Jul 15 12:13:57 2024 +0100 spi: microchip-core: add support for word sizes of 1 to 32 bits The current implementation only supports a word size of 8 bits, which limits the devices it can be used with. Add support for any word size between 1 and 32 bits, as supported by the hardware. Signed-off-by: Steve Wilkins Signed-off-by: Conor Dooley Link: https://patch.msgid.link/20240715-cogwheel-uniquely-0d4ef518b809@wendy Signed-off-by: Mark Brown drivers/spi/spi-microchip-core.c | 53 +++++++++++++++++++++++----------------- 1 file changed, 31 insertions(+), 22 deletions(-) commit 9cf71eb0faef4bff01df4264841b8465382d7927 Author: Steve Wilkins Date: Mon Jul 15 12:13:56 2024 +0100 spi: microchip-core: ensure TX and RX FIFOs are empty at start of a transfer While transmitting with rx_len == 0, the RX FIFO is not going to be emptied in the interrupt handler. A subsequent transfer could then read crap from the previous transfer out of the RX FIFO into the start RX buffer. The core provides a register that will empty the RX and TX FIFOs, so do that before each transfer. Fixes: 9ac8d17694b6 ("spi: add support for microchip fpga spi controllers") Signed-off-by: Steve Wilkins Signed-off-by: Conor Dooley Link: https://patch.msgid.link/20240715-flammable-provoke-459226d08e70@wendy Signed-off-by: Mark Brown drivers/spi/spi-microchip-core.c | 4 ++++ 1 file changed, 4 insertions(+) commit 3a5e76283672efddf47cea39ccfe9f5735cc91d5 Author: Steve Wilkins Date: Mon Jul 15 12:13:55 2024 +0100 spi: microchip-core: fix init function not setting the master and motorola modes mchp_corespi_init() reads the CONTROL register, sets the master and motorola bits, but doesn't write the value back to the register. The function also doesn't ensure the controller is disabled at the start, which may present a problem if the controller was used by an earlier boot stage as some settings (including the mode) can only be modified while the controller is disabled. Fixes: 9ac8d17694b6 ("spi: add support for microchip fpga spi controllers") Signed-off-by: Steve Wilkins Signed-off-by: Conor Dooley Link: https://patch.msgid.link/20240715-designing-thus-05f7c26e1da7@wendy Signed-off-by: Mark Brown drivers/spi/spi-microchip-core.c | 17 +++++++++-------- 1 file changed, 9 insertions(+), 8 deletions(-) commit de9850b5c606b754dd7861678d6e2874b96b04f8 Author: Steve Wilkins Date: Mon Jul 15 12:13:54 2024 +0100 spi: microchip-core: only disable SPI controller when register value change requires it Setting up many of the registers for a new SPI transfer involves unconditionally disabling the SPI controller, writing the register value and re-enabling the controller. This is being done for registers even when the value is unchanged and is also done for registers that don't require the controller to be disabled for the change to take effect. Make an effort to detect changes to the register values, and only disables the controller if the new register value is different and disabling the controller is required. This stops the controller being repeated disabled and the bus going tristate before every transfer. Fixes: 9ac8d17694b6 ("spi: add support for microchip fpga spi controllers") Signed-off-by: Steve Wilkins Co-developed-by: Conor Dooley Signed-off-by: Conor Dooley Link: https://patch.msgid.link/20240715-depict-twirl-7e592eeabaad@wendy Signed-off-by: Mark Brown drivers/spi/spi-microchip-core.c | 79 +++++++++++++++++++++------------------- 1 file changed, 41 insertions(+), 38 deletions(-) commit 22fd98c107c792e35db7abe45298bc3a29bf4723 Author: Steve Wilkins Date: Mon Jul 15 12:13:53 2024 +0100 spi: microchip-core: defer asserting chip select until just before write to TX FIFO Setting up many of the registers for a new SPI transfer requires the SPI controller to be disabled after set_cs() has been called to assert the chip select line. However, disabling the controller results in the SCLK and MOSI output pins being tristate, which can cause clock transitions to be seen by a slave device whilst SS is active. To fix this, the CS is only set to inactive inline, whilst setting it active is deferred until all registers are set up and the any controller disables have been completed. Fixes: 9ac8d17694b6 ("spi: add support for microchip fpga spi controllers") Signed-off-by: Steve Wilkins Signed-off-by: Conor Dooley Link: https://patch.msgid.link/20240715-sanitizer-recant-dd96b7a97048@wendy Signed-off-by: Mark Brown drivers/spi/spi-microchip-core.c | 19 +++++++++++++++++-- 1 file changed, 17 insertions(+), 2 deletions(-) commit 502a582b8dd897d9282db47c0911d5320ef2e6b9 Author: Naga Sureshkumar Relli Date: Mon Jul 15 12:13:52 2024 +0100 spi: microchip-core: fix the issues in the isr It is possible for the TXDONE interrupt be raised if the tx FIFO becomes temporarily empty while transmitting, resulting in recursive calls to mchp_corespi_write_fifo() and therefore a garbage message might be transmitted depending on when the interrupt is triggered. Moving all of the tx FIFO writes out of the TXDONE portion of the interrupt handler avoids this problem. Most of rest of the TXDONE portion of the handler is problematic too. Only reading the rx FIFO (and finalising the transfer) when the TXDONE interrupt is raised can cause the transfer to stall, if the final bytes of rx data are not available in the rx FIFO when the final TXDONE interrupt is raised. The transfer should be finalised regardless of which interrupt is raised, provided that all tx data has been set and all rx data received. The first issue was encountered "in the wild", the second is theoretical. Fixes: 9ac8d17694b6 ("spi: add support for microchip fpga spi controllers") Signed-off-by: Naga Sureshkumar Relli Signed-off-by: Conor Dooley Link: https://patch.msgid.link/20240715-candied-deforest-585685ef3c8a@wendy Signed-off-by: Mark Brown drivers/spi/spi-microchip-core.c | 18 ++++++++---------- 1 file changed, 8 insertions(+), 10 deletions(-) commit aff31330e037f75de7820bc7deb494eeaeaadd35 Merge: b051320d6ab8 7ad635ea8270 Author: Linus Torvalds Date: Mon Jul 15 11:08:14 2024 -0700 Merge tag 'vfs-6.11.pg_error' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs Pull PG_error removal updates from Christian Brauner: "This contains work to remove almost all remaining users of PG_error from filesystems and filesystem helper libraries. An additional patch will be coming in via the jfs tree which tests the PG_error bit. Afterwards nothing will be testing it anymore and it's safe to remove all places which set or clear the PG_error bit. The goal is to fully remove PG_error by the next merge window" * tag 'vfs-6.11.pg_error' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs: buffer: Remove calls to set and clear the folio error flag iomap: Remove calls to set and clear folio error flag vboxsf: Convert vboxsf_read_folio() to use a folio ufs: Remove call to set the folio error flag romfs: Convert romfs_read_folio() to use a folio reiserfs: Remove call to folio_set_error() orangefs: Remove calls to set/clear the error flag nfs: Remove calls to folio_set_error jffs2: Remove calls to set/clear the folio error flag hostfs: Convert hostfs_read_folio() to use a folio isofs: Convert rock_ridge_symlink_read_folio to use a folio hpfs: Convert hpfs_symlink_read_folio to use a folio efs: Convert efs_symlink_read_folio to use a folio cramfs: Convert cramfs_read_folio to use a folio coda: Convert coda_symlink_filler() to use folio_end_read() befs: Convert befs_symlink_read_folio() to use folio_end_read() commit 2634f745eac25a33f032df32cf98fca8538a534a Author: Daniel Baluta Date: Mon Jul 15 18:16:53 2024 +0300 ASoC: SOF: imx8m: Fix DSP control regmap retrieval According to Documentation/devicetree/bindings/dsp/fsl,dsp.yaml fsl,dsp-ctrl is a phandle to syscon block so we need to use correct function to retrieve it. Currently there is no SOF DSP DTS merged into mainline so there is no need to support the old way of retrieving the dsp control node. Fixes: 9ba23717b292 ("ASoC: SOF: imx8m: Implement DSP start") Signed-off-by: Daniel Baluta Link: https://patch.msgid.link/20240715151653.114751-1-daniel.baluta@oss.nxp.com Signed-off-by: Mark Brown sound/soc/sof/imx/imx8m.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit b051320d6ab8cfdd77a48ef4e563584cd7681d2d Merge: 2ffd45da0b06 b80cc4df1124 Author: Linus Torvalds Date: Mon Jul 15 10:52:51 2024 -0700 Merge tag 'vfs-6.11.misc' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs Pull misc vfs updates from Christian Brauner: "Features: - Support passing NULL along AT_EMPTY_PATH for statx(). NULL paths with any flag value other than AT_EMPTY_PATH go the usual route and end up with -EFAULT to retain compatibility (Rust is abusing calls of the sort to detect availability of statx) This avoids path lookup code, lockref management, memory allocation and in case of NULL path userspace memory access (which can be quite expensive with SMAP on x86_64) - Don't block i_writecount during exec. Remove the deny_write_access() mechanism for executables - Relax open_by_handle_at() permissions in specific cases where we can prove that the caller had sufficient privileges to open a file - Switch timespec64 fields in struct inode to discrete integers freeing up 4 bytes Fixes: - Fix false positive circular locking warning in hfsplus - Initialize hfs_inode_info after hfs_alloc_inode() in hfs - Avoid accidental overflows in vfs_fallocate() - Don't interrupt fallocate with EINTR in tmpfs to avoid constantly restarting shmem_fallocate() - Add missing quote in comment in fs/readdir Cleanups: - Don't assign and test in an if statement in mqueue. Move the assignment out of the if statement - Reflow the logic in may_create_in_sticky() - Remove the usage of the deprecated ida_simple_xx() API from procfs - Reject FSCONFIG_CMD_CREATE_EXCL requets that depend on the new mount api early - Rename variables in copy_tree() to make it easier to understand - Replace WARN(down_read_trylock, ...) abuse with proper asserts in various places in the VFS - Get rid of user_path_at_empty() and drop the empty argument from getname_flags() - Check for error while copying and no path in one branch in getname_flags() - Avoid redundant smp_mb() for THP handling in do_dentry_open() - Rename parent_ino to d_parent_ino and make it use RCU - Remove unused header include in fs/readdir - Export in_group_capable() helper and switch f2fs and fuse over to it instead of open-coding the logic in both places" * tag 'vfs-6.11.misc' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs: (27 commits) ipc: mqueue: remove assignment from IS_ERR argument vfs: rename parent_ino to d_parent_ino and make it use RCU vfs: support statx(..., NULL, AT_EMPTY_PATH, ...) stat: use vfs_empty_path() helper fs: new helper vfs_empty_path() fs: reflow may_create_in_sticky() vfs: remove redundant smp_mb for thp handling in do_dentry_open fuse: Use in_group_or_capable() helper f2fs: Use in_group_or_capable() helper fs: Export in_group_or_capable() vfs: reorder checks in may_create_in_sticky hfs: fix to initialize fields of hfs_inode_info after hfs_alloc_inode() proc: Remove usage of the deprecated ida_simple_xx() API hfsplus: fix to avoid false alarm of circular locking Improve readability of copy_tree vfs: shave a branch in getname_flags vfs: retire user_path_at_empty and drop empty arg from getname_flags vfs: stop using user_path_at_empty in do_readlinkat tmpfs: don't interrupt fallocate with EINTR fs: don't block i_writecount during exec ... commit b77b0bc85b117119764107f3ee76e8877bf826ab Merge: 3128ff234730 abba7f922d8b Author: Rafael J. Wysocki Date: Mon Jul 15 19:20:51 2024 +0200 Merge branch 'acpi-misc' Merge a miscellaneous ACPI change for 6.11-rc1: - Add missing MODULE_DESCRIPTION() macros in two places (Jeff Johnson). * acpi-misc: ACPI: add missing MODULE_DESCRIPTION() macros commit 3128ff23473024f5a64f5ffad351591faf971286 Merge: fa0d938c2855 83c2ec72efa2 117478c9d710 e2e7f037b400 d010a0282e04 Author: Rafael J. Wysocki Date: Mon Jul 15 19:14:48 2024 +0200 Merge branches 'acpi-processor', 'acpi-pad', 'acpi-resource' and 'acpi-video' Merge changes in the ACPI processor and ACPI PAD drivers, ACPI resources management quirks and ACPI backlight (video) driver changes for 6.11-rc1: - Downgrade Intel _OSC and _PDC messages in the ACPI processor driver to debug to reduce log noise (Mario Limonciello). - Still evaluate _OST when _PUR evaluation fails in the ACPI PAD (processor aggregator) driver as per the spec (Armin Wolf). - Skip ACPI IRQ override on Asus Vivobook Pro N6506MJ and N6506MU platforms (Tamim Khan). - Force native mode on some T2 macbooks in the ACPI backlight driver and replace strcpy() with strscpy() in it (Orlando Chamberlain, Muhammad Qasim Abdul Majeed). * acpi-processor: ACPI: processor: Downgrade Intel _OSC and _PDC messages to debug * acpi-pad: ACPI: acpi_pad: Still evaluate _OST when _PUR evaluation fails * acpi-resource: ACPI: resource: Skip IRQ override on Asus Vivobook Pro N6506MJ ACPI: resource: Skip IRQ override on Asus Vivobook Pro N6506MU * acpi-video: ACPI: video: force native for some T2 macbooks ACPI: video: Use strscpy() instead of strcpy() commit fa0d938c2855cbf8e4521c6dd97099d6c2002522 Merge: e598dd44b381 cfff1997aafa face1c543e89 79a947bd5434 Author: Rafael J. Wysocki Date: Mon Jul 15 19:08:18 2024 +0200 Merge branches 'acpi-pmic', 'acpi-battery' and 'acpi-numa' Merge ACPI PMIC driver changes, updates related to the ACPI battery and SBS drivers and NUMA-related ACPI updates for 6.11-rc1: - Clean up the ACPI PMIC driver in multiple ways (Andy Shevchenko, Christophe JAILLET). - Add support for charge limiting state to the ACPI battery driver and update _OSC to indicate support for it (Armin Wolf). - Clean up the sysfs interface in the ACPI battery, SBS (smart battery subsystem) and AC drivers (Thomas Weißschuh). - Coordinate header includes in the ACPI NUMA code and make it use ACCESS_COORDINATE_CPU when appropriate (Huang Ying, Thorsten Blum). * acpi-pmic: ACPI: PMIC: Constify struct pmic_table ACPI: PMIC: Replace open coded be16_to_cpu() ACPI: PMIC: Convert pr_*() to dev_*() printing macros ACPI: PMIC: Use sizeof() instead of hard coded value * acpi-battery: ACPI: bus: Indicate support for battery charge limiting thru _OSC ACPI: battery: Add support for charge limiting state ACPI: SBS: manage alarm sysfs attribute through psy core ACPI: battery: create alarm sysfs attribute atomically ACPI: battery: use sysfs_emit over sprintf ACPI: battery: constify powersupply properties ACPI: SBS: constify powersupply properties ACPI: AC: constify powersupply properties * acpi-numa: ACPI: NUMA: Consolidate header includes ACPI: HMAT: Use ACCESS_COORDINATE_CPU when appropriate commit 2ffd45da0b06b26f30480584de7c660d84b2d7dc Merge: 5e0497553643 8b68788bebd3 Author: Linus Torvalds Date: Mon Jul 15 10:07:31 2024 -0700 Merge tag 'drm-fixes-2024-07-12' of https://gitlab.freedesktop.org/drm/kernel Pull drm fixes from Dave Airlie: "Oh I screwed up last week's fixes pull, and forgot to send.. Back to work, thanks to Sima for last week, not too many fixes as expected getting close to release [ sic - Linus ], amdgpu and xe have a couple each, and then some other misc ones. amdgpu: - PSR-SU fix - Reseved VMID fix xe: - Use write-back caching mode for system memory on DGFX - Do not leak object when finalizing hdcp gsc bridge: - adv7511 EDID irq fix gma500: - NULL mode fixes. meson: - fix resource leak" * tag 'drm-fixes-2024-07-12' of https://gitlab.freedesktop.org/drm/kernel: Revert "drm/amd/display: Reset freesync config before update new state" drm/xe/display/xe_hdcp_gsc: Free arbiter on driver removal drm/xe: Use write-back caching mode for system memory on DGFX drm/amdgpu: reject gang submit on reserved VMIDs drm/gma500: fix null pointer dereference in cdv_intel_lvds_get_modes drm/gma500: fix null pointer dereference in psb_intel_lvds_get_modes drm/meson: fix canvas release in bind function drm/bridge: adv7511: Fix Intermittent EDID failures commit e598dd44b381b2ccd64e47034122663f55ae7089 Merge: 233323f9b9f8 35ba8ec0fbd0 35c50d853adc dde8ec86c3fd 86932cd8ccd4 Author: Rafael J. Wysocki Date: Mon Jul 15 19:04:15 2024 +0200 Merge branches 'acpi-x86', 'acpi-fan', 'acpi-soc' and 'acpi-cppc' Merge changes in the ACPI x86-specific code, ACPI fan driverm ACPI LPSS (Intel SoC) driver and the ACPI CPPC library for 6.11-rc1: - Switch the ACPI x86 utility code and the ACPI LPSS driver to new Intel CPU model defines (Tony Luck). - Add hwmon interface support to the ACPI fan driver (Armin Wolf). - Add sysfs entry for guaranteed performance to the ACPI CPPC library and replace a ternary operator with umax() in it (Petr Tesařík, Prabhakar Pujeri). * acpi-x86: ACPI: x86: Switch to new Intel CPU model defines * acpi-fan: ACPI: fan: Add hwmon support * acpi-soc: ACPI: LPSS: Switch to new Intel CPU model defines * acpi-cppc: ACPI: CPPC: Replace ternary operator with umax() ACPI: CPPC: add sysfs entry for guaranteed performance commit 8e64d2356cbc800b4cd0e3e614797f76bcf0cdb8 Author: Carlos López Date: Mon Jul 15 13:24:34 2024 +0200 s390/dasd: fix error checks in dasd_copy_pair_store() dasd_add_busid() can return an error via ERR_PTR() if an allocation fails. However, two callsites in dasd_copy_pair_store() do not check the result, potentially resulting in a NULL pointer dereference. Fix this by checking the result with IS_ERR() and returning the error up the stack. Fixes: a91ff09d39f9b ("s390/dasd: add copy pair setup") Signed-off-by: Carlos López Signed-off-by: Stefan Haberland Link: https://lore.kernel.org/r/20240715112434.2111291-3-sth@linux.ibm.com Signed-off-by: Jens Axboe drivers/s390/block/dasd_devmap.c | 10 ++++++++-- 1 file changed, 8 insertions(+), 2 deletions(-) commit 1f5a33315362cb8ade2b15489c985ada0cc8623b Author: Jeff Johnson Date: Mon Jul 15 13:24:33 2024 +0200 s390/dasd: add missing MODULE_DESCRIPTION() macros With ARCH=s390, make allmodconfig && make W=1 C=1 reports: WARNING: modpost: missing MODULE_DESCRIPTION() in drivers/s390/block/dasd_diag_mod.o WARNING: modpost: missing MODULE_DESCRIPTION() in drivers/s390/block/dasd_eckd_mod.o WARNING: modpost: missing MODULE_DESCRIPTION() in drivers/s390/block/dasd_fba_mod.o Add the missing invocations of the MODULE_DESCRIPTION() macro. Signed-off-by: Jeff Johnson Signed-off-by: Stefan Haberland Link: https://lore.kernel.org/r/20240715112434.2111291-2-sth@linux.ibm.com Signed-off-by: Jens Axboe drivers/s390/block/dasd_diag.c | 1 + drivers/s390/block/dasd_eckd.c | 1 + drivers/s390/block/dasd_fba.c | 1 + 3 files changed, 3 insertions(+) commit a02bed4183c48d42a2855a4e70867b6239c45770 Merge: 7fae6f8b97ed 161bd53e3248 b48b342dd5e6 Author: Rafael J. Wysocki Date: Mon Jul 15 18:55:14 2024 +0200 Merge branches 'pm-opp' and 'pm-tools' Merge OPP (operating performance points) and tooling updates for 6.11-rc1: - Fix missing cleanup on error in _opp_attach_genpd() (Viresh Kumar). - Introduce an OF helper function to inform if required-opps is used and drop a redundant in-parameter to _set_opp_level() (Ulf Hansson). - Update pm-graph to v5.12 which includes fixes and major code revamp for python3.12 (Todd Brandt). - Address several assorted issues in the cpupower utility (Roman Storozhenko). * pm-opp: OPP: Introduce an OF helper function to inform if required-opps is used OPP: Drop a redundant in-parameter to _set_opp_level() OPP: Fix missing cleanup on error in _opp_attach_genpd() * pm-tools: cpupower: fix lib default installation path cpupower: Disable direct build of the 'bench' subproject cpupower: Change the var type of the 'monitor' subcommand display mode cpupower: Remove absent 'v' parameter from monitor man page cpupower: Improve cpupower build process description cpupower: Add 'help' target to the main Makefile cpupower: Replace a dead reference link with working ones pm-graph: v5.12, code revamp for python3.12 pm-graph: v5.12, fixes commit 7fae6f8b97ed5f9d60d6af54614724cdca7dc5de Merge: a18abb873bee 4b20b07ce72f e5753da31c61 Author: Rafael J. Wysocki Date: Mon Jul 15 18:53:48 2024 +0200 Merge branches 'pm-cpuidle' and 'pm-powercap' Merge cpuidle and power capping changes for 6.11-rc1: - Improve the teo cpuidle governor and clean up leftover comments from the menu cpuidle governor (Christian Loehle). - Clean up a comment typo in the teo cpuidle governor (Atul Kumar Pant). - Add missing MODULE_DESCRIPTION() macro to cpuidle haltpoll (Jeff Johnson). - Switch the intel_idle driver to new Intel CPU model defines (Tony Luck). - Switch the Intel RAPL driver new Intel CPU model defines (Tony Luck). - Simplify if condition in the idle_inject driver (Thorsten Blum). * pm-cpuidle: cpuidle: teo: Don't count non-existent intercepts cpuidle: teo: Remove recent intercepts metric Revert: "cpuidle: teo: Introduce util-awareness" cpuidle: governors: teo: Fix a typo in a comment cpuidle: haltpoll: add missing MODULE_DESCRIPTION() macro cpuidle: menu: Cleanup after loadavg removal intel_idle: Switch to new Intel CPU model defines * pm-powercap: powercap: idle_inject: Simplify if condition powercap: intel_rapl: Switch to new Intel CPU model defines powercap: intel_rapl_msr: Switch to new Intel CPU model defines commit a18abb873bee8fa48d18216009c1c5a8bde19e7f Merge: 130abfe9a184 9dabb5b48fe5 Author: Rafael J. Wysocki Date: Mon Jul 15 18:51:35 2024 +0200 Merge branch 'pm-cpufreq' Merge cpufreq changes for 6.11-rc1: - Add Loongson-3 CPUFreq driver support (Huacai Chen). - Add support for the Arrow Lake and Lunar Lake platforms and the out-of-band (OOB) mode on Emerald Rapids to the intel_pstate cpufreq driver, make it support the highest performance change interrupt and clean it up (Srinivas Pandruvada). - Switch cpufreq to new Intel CPU model defines (Tony Luck). - Simplify the cpufreq driver interface by switching the .exit() driver callback to the void return data type (Lizhe, Viresh Kumar). - Make cpufreq_boost_enabled() return bool (Dhruva Gole). - Add fast CPPC support to the amd-pstate cpufreq driver, address multiple assorted issues in it and clean it up (Perry Yuan, Mario Limonciello, Dhananjay Ugwekar, Meng Li, Xiaojian Du). - Add Allwinner H700 speed bin to the sun50i cpufreq driver (Ryan Walklin). - Fix memory leaks and of_node_put() usage in the sun50i and qcom-nvmem cpufreq drivers (Javier Carrasco). - Clean up the sti and dt-platdev cpufreq drivers (Jeff Johnson, Raphael Gallais-Pou). - Fix deferred probe handling in the TI cpufreq driver and wrong return values of ti_opp_supply_probe(), and add OPP tables for the AM62Ax and AM62Px SoCs to it (Bryan Brattlof, Primoz Fiser). - Avoid overflow of target_freq in .fast_switch() in the SCMI cpufreq driver (Jagadeesh Kona). - Use dev_err_probe() in every error path in probe in the Mediatek cpufreq driver (Nícolas Prado). - Fix kernel-doc param for longhaul_setstate in the longhaul cpufreq driver (Yang Li). - Fix system resume handling in the CPPC cpufreq driver (Riwen Lu). * pm-cpufreq: (55 commits) cpufreq: sti: fix build warning cpufreq: mediatek: Use dev_err_probe in every error path in probe cpufreq: Add Loongson-3 CPUFreq driver support cpufreq: Make cpufreq_driver->exit() return void cpufreq/amd-pstate: Fix the scaling_max_freq setting on shared memory CPPC systems cpufreq/amd-pstate-ut: Convert nominal_freq to khz during comparisons cpufreq: pcc: Remove empty exit() callback cpufreq: loongson2: Remove empty exit() callback cpufreq: nforce2: Remove empty exit() callback cpufreq: docs: Add missing scaling_available_frequencies description cpufreq: make cpufreq_boost_enabled() return bool cpufreq: intel_pstate: Support highest performance change interrupt x86/cpufeatures: Add HWP highest perf change feature flag Documentation: cpufreq: amd-pstate: update doc for Per CPU boost control method cpufreq: amd-pstate: Cap the CPPC.max_perf to nominal_perf if CPB is off cpufreq: amd-pstate: initialize core precision boost state cpufreq: acpi: move MSR_K7_HWCR_CPB_DIS_BIT into msr-index.h cpufreq: sti: add missing MODULE_DEVICE_TABLE entry for stih418 cpufreq: intel_pstate: Replace boot_cpu_has() cpufreq: ti: update OPP table for AM62Px SoCs ... commit 5e0497553643b6c6acd16c389afb9cec210f4ea9 Merge: 1654c37ddbfc 13694f0dbc07 Author: Linus Torvalds Date: Mon Jul 15 09:39:33 2024 -0700 Merge branch 'link_path_walk' This is the last - for now - of the "look, we generated some questionable code for basic pathname lookup operations" set of branches. This is mainly just re-organizing the name hashing code in link_path_walk(), mostly by improving the calling conventions to the inlined helper functions and moving some of the code around to allow for more straightforward code generation. The profiles - and the generated code - look much more palatable to me now. * link_path_walk: vfs: link_path_walk: move more of the name hashing into hash_name() vfs: link_path_walk: improve may_lookup() code generation vfs: link_path_walk: do '.' and '..' detection while hashing vfs: link_path_walk: clarify and improve name hashing interface vfs: link_path_walk: simplify name hash flow commit 161bd53e3248358029e1cdad02ab74f0003e6b02 Merge: 4e89a5309a75 d92467ad9d9e Author: Rafael J. Wysocki Date: Mon Jul 15 18:27:13 2024 +0200 Merge back final cpufreq fixes for 6.10. commit bb2d63500b5c8fd1ea425caffe2d44c931fefc6b Author: Jiaxun Yang Date: Sun Jul 14 10:20:50 2024 +0800 MIPS: config: Add ip30_defconfig Add ip30_defconfig derived from ip27_defconfig to ensure this target is build tested by various kernel testing projects. Signed-off-by: Jiaxun Yang Signed-off-by: Thomas Bogendoerfer arch/mips/configs/ip30_defconfig | 183 +++++++++++++++++++++++++++++++++++++++ 1 file changed, 183 insertions(+) commit 31ebd6e11f2450f20317e399b08680a80cbff484 Author: Jiaxun Yang Date: Sun Jul 14 10:20:49 2024 +0800 MIPS: config: lemote2f: Regenerate defconfig Regenerate defconfig to include some drivers that are used by this platform, including sm712fb, simplefb, rtl8187. Signed-off-by: Jiaxun Yang Signed-off-by: Thomas Bogendoerfer arch/mips/configs/lemote2f_defconfig | 54 +++++++++++++++--------------------- 1 file changed, 23 insertions(+), 31 deletions(-) commit 10f338bd0a42140d8a18a31c89309c5a03e38fc2 Author: Jiaxun Yang Date: Sun Jul 14 10:20:48 2024 +0800 MIPS: config: generic: Add board-litex The LiteX framework provides a convenient and efficient infrastructure to create FPGA Cores/SoCs. We have implemented LiteX support for a couple of opensource MIPS CPU cores including microAptiv UP from MIPS, GS232 from Loongson, and CDIM from CQU. For this platform, devicetree is generated by litex python scripts so there is no devicetree addition necessary. Link: https://github.com/enjoy-digital/litex/pull/1990 Signed-off-by: Jiaxun Yang Signed-off-by: Thomas Bogendoerfer arch/mips/configs/generic/board-litex.config | 8 ++++++++ 1 file changed, 8 insertions(+) commit 9ce4250eeed47d732015c459726fc2c32481395f Author: Jiaxun Yang Date: Sun Jul 14 10:20:47 2024 +0800 MIPS: config: Enable MSA and virtualization for MIPS64R6 All MIPS64R6 cores so far supports MSA and vz, so it makes sense to enable them in 64R6 default config. Signed-off-by: Jiaxun Yang Signed-off-by: Thomas Bogendoerfer arch/mips/configs/generic/64r6.config | 2 ++ 1 file changed, 2 insertions(+) commit 2326c8f2022636a1e47402ffd09a3b28f737275f Author: Jiaxun Yang Date: Sun Jul 14 10:52:57 2024 +0800 MIPS: Fix fallback march for SB1 Fallback march for SB1 should be mips64 instead of mips64r1. Reported-by: kernel test robot Closes: https://lore.kernel.org/oe-kbuild-all/202407111851.LwDasTcp-lkp@intel.com/ Fixes: bfc0a330c1b4 ("MIPS: Fallback CPU -march flag to ISA level if unsupported") Signed-off-by: Jiaxun Yang Signed-off-by: Thomas Bogendoerfer arch/mips/Makefile | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit e7afb958fa90c4c9bd1d375e5292d8ea5f8f11b5 Merge: ba7a0f4436ac 536b97acddd7 Author: Jakub Kicinski Date: Mon Jul 15 09:14:45 2024 -0700 Merge branch 'flower-rework-tca_flower_key_enc_flags-usage' Asbjørn Sloth Tønnesen says: ==================== flower: rework TCA_FLOWER_KEY_ENC_FLAGS usage This series reworks the recently added TCA_FLOWER_KEY_ENC_FLAGS attribute, to be more like TCA_FLOWER_KEY_FLAGS, and use the unused u32 flags field in FLOW_DISSECTOR_KEY_ENC_CONTROL, instead of adding a new flags field as FLOW_DISSECTOR_KEY_ENC_FLAGS. I have defined the new FLOW_DIS_F_* and TCA_FLOWER_KEY_FLAGS_* flags to co-exist with the existing flags, so the meaning of the flags field in struct flow_dissector_key_control is not depending on the context it is used in. If we run out of bits then we can always split them up later, if we really want to. Future flags might also be valid in both contexts. iproute2 RFC v2 patch: https://lore.kernel.org/560bcd549ca8ab24b1ad5abe352580a621f6d426.1720790774.git.dcaratti@redhat.com/ v3: https://lore.kernel.org/20240709163825.1210046-1-ast@fiberby.net/ v2: https://lore.kernel.org/20240705133348.728901-1-ast@fiberby.net/ v1: https://lore.kernel.org/20240703104600.455125-1-ast@fiberby.net/ RFC: https://lore.kernel.org/20240611235355.177667-1-ast@fiberby.net/ ==================== Link: https://patch.msgid.link/20240713021911.1631517-1-ast@fiberby.net Signed-off-by: Jakub Kicinski commit 536b97acddd702edacbe5f89c95dcd5a145b490f Author: Asbjørn Sloth Tønnesen Date: Sat Jul 13 02:19:10 2024 +0000 net/sched: cls_flower: propagate tca[TCA_OPTIONS] to NL_REQ_ATTR_CHECK NL_REQ_ATTR_CHECK() is used in fl_set_key_flags() to set extended attributes about the origin of an error, this patch propagates tca[TCA_OPTIONS] through. Before this patch: $ sudo ./tools/net/ynl/cli.py --spec Documentation/netlink/specs/tc.yaml \ --do newtfilter --json '{ "chain": 0, "family": 0, "handle": 4, "ifindex": 22, "info": 262152, "kind": "flower", "options": { "flags": 0, "key-enc-flags": 8, "key-eth-type": 2048 }, "parent": 4294967283 }' Netlink error: Invalid argument nl_len = 68 (52) nl_flags = 0x300 nl_type = 2 error: -22 extack: {'msg': 'Missing flags mask', 'miss-type': 111} After this patch: [same cmd] Netlink error: Invalid argument nl_len = 76 (60) nl_flags = 0x300 nl_type = 2 error: -22 extack: {'msg': 'Missing flags mask', 'miss-type': 111, 'miss-nest': 56} Suggested-by: Jakub Kicinski Signed-off-by: Asbjørn Sloth Tønnesen Link: https://patch.msgid.link/20240713021911.1631517-14-ast@fiberby.net Signed-off-by: Jakub Kicinski net/sched/cls_flower.c | 34 ++++++++++++++++++++-------------- 1 file changed, 20 insertions(+), 14 deletions(-) commit 706bf4f44c6d2ae2fdeefeb816b2c35a173ecfa4 Author: Asbjørn Sloth Tønnesen Date: Sat Jul 13 02:19:09 2024 +0000 flow_dissector: set encapsulation control flags for non-IP Make sure to set encapsulated control flags also for non-IP packets, such that it's possible to allow matching on e.g. TUNNEL_OAM on a geneve packet carrying a non-IP packet. Suggested-by: Davide Caratti Signed-off-by: Asbjørn Sloth Tønnesen Tested-by: Davide Caratti Reviewed-by: Davide Caratti Link: https://patch.msgid.link/20240713021911.1631517-13-ast@fiberby.net Signed-off-by: Jakub Kicinski net/core/flow_dissector.c | 4 ++++ net/sched/cls_flower.c | 3 ++- 2 files changed, 6 insertions(+), 1 deletion(-) commit db5271d50ec155abf287a27fa84e2e33a81dbd55 Author: Asbjørn Sloth Tønnesen Date: Sat Jul 13 02:19:08 2024 +0000 flow_dissector: cleanup FLOW_DISSECTOR_KEY_ENC_FLAGS Now that TCA_FLOWER_KEY_ENC_FLAGS is unused, as it's former data is stored behind TCA_FLOWER_KEY_ENC_CONTROL, then remove the last bits of FLOW_DISSECTOR_KEY_ENC_FLAGS. FLOW_DISSECTOR_KEY_ENC_FLAGS is unreleased, and have been in net-next since 2024-06-04. Signed-off-by: Asbjørn Sloth Tønnesen Tested-by: Davide Caratti Reviewed-by: Davide Caratti Link: https://patch.msgid.link/20240713021911.1631517-12-ast@fiberby.net Signed-off-by: Jakub Kicinski include/net/flow_dissector.h | 9 --------- include/net/ip_tunnels.h | 12 ------------ net/core/flow_dissector.c | 16 +--------------- net/sched/cls_flower.c | 3 --- 4 files changed, 1 insertion(+), 39 deletions(-) commit 880a51a8ab8cbdeb9c2d35a5147d30b7fc0893e4 Author: Asbjørn Sloth Tønnesen Date: Sat Jul 13 02:19:07 2024 +0000 doc: netlink: specs: tc: flower: add enc-flags Describe key-enc-flags and key-enc-flags-mask. These are defined similarly to key-flags and key-flags-mask. Suggested-by: Jakub Kicinski Signed-off-by: Asbjørn Sloth Tønnesen Reviewed-by: Donald Hunter Link: https://patch.msgid.link/20240713021911.1631517-11-ast@fiberby.net Signed-off-by: Jakub Kicinski Documentation/netlink/specs/tc.yaml | 12 ++++++++++++ 1 file changed, 12 insertions(+) commit 11036bd7a0b3b05c5e1f43d107ddb02abf83adb9 Author: Asbjørn Sloth Tønnesen Date: Sat Jul 13 02:19:06 2024 +0000 net/sched: cls_flower: rework TCA_FLOWER_KEY_ENC_FLAGS usage This patch changes how TCA_FLOWER_KEY_ENC_FLAGS is used, so that it is used with TCA_FLOWER_KEY_FLAGS_* flags, in the same way as TCA_FLOWER_KEY_FLAGS is currently used. Where TCA_FLOWER_KEY_FLAGS uses {key,mask}->control.flags, then TCA_FLOWER_KEY_ENC_FLAGS now uses {key,mask}->enc_control.flags, therefore {key,mask}->enc_flags is now unused. As the generic fl_set_key_flags/fl_dump_key_flags() is used with encap set to true, then fl_{set,dump}_key_enc_flags() is removed. This breaks unreleased userspace API (net-next since 2024-06-04). Signed-off-by: Asbjørn Sloth Tønnesen Tested-by: Davide Caratti Reviewed-by: Davide Caratti Link: https://patch.msgid.link/20240713021911.1631517-10-ast@fiberby.net Signed-off-by: Jakub Kicinski include/uapi/linux/pkt_cls.h | 4 ++-- net/sched/cls_flower.c | 56 ++++++++++---------------------------------- 2 files changed, 15 insertions(+), 45 deletions(-) commit 988f8723d398cf122c112342d12d67ba31cadf3b Author: Asbjørn Sloth Tønnesen Date: Sat Jul 13 02:19:05 2024 +0000 net/sched: cls_flower: add tunnel flags to fl_{set,dump}_key_flags() Prepare to set and dump the tunnel flags. This code won't see any of these flags yet, as these flags aren't allowed by the NLA_POLICY_MASK, and the functions doesn't get called with encap set to true yet. Signed-off-by: Asbjørn Sloth Tønnesen Tested-by: Davide Caratti Reviewed-by: Davide Caratti Link: https://patch.msgid.link/20240713021911.1631517-9-ast@fiberby.net Signed-off-by: Jakub Kicinski net/sched/cls_flower.c | 30 ++++++++++++++++++++++++++++++ 1 file changed, 30 insertions(+) commit 03afeb613bfe6b0c28e8b843959f716a3d2c42df Author: Asbjørn Sloth Tønnesen Date: Sat Jul 13 02:19:04 2024 +0000 flow_dissector: set encapsulated control flags from tun_flags Set the new FLOW_DIS_F_TUNNEL_* encapsulated control flags, based on if their counter-part is set in tun_flags. These flags are not userspace visible yet, as the code to dump encapsulated control flags will first be added, and later activated in the following patches. Signed-off-by: Asbjørn Sloth Tønnesen Tested-by: Davide Caratti Reviewed-by: Davide Caratti Link: https://patch.msgid.link/20240713021911.1631517-8-ast@fiberby.net Signed-off-by: Jakub Kicinski net/core/flow_dissector.c | 9 +++++++++ 1 file changed, 9 insertions(+) commit 4d0aed380f9ddf24dfb1d06a05096b778442c403 Author: Asbjørn Sloth Tønnesen Date: Sat Jul 13 02:19:03 2024 +0000 flow_dissector: prepare for encapsulated control flags Rename skb_flow_dissect_set_enc_addr_type() to skb_flow_dissect_set_enc_control(), and make it set both addr_type and flags in FLOW_DISSECTOR_KEY_ENC_CONTROL. Signed-off-by: Asbjørn Sloth Tønnesen Tested-by: Davide Caratti Reviewed-by: Davide Caratti Link: https://patch.msgid.link/20240713021911.1631517-7-ast@fiberby.net Signed-off-by: Jakub Kicinski net/core/flow_dissector.c | 21 ++++++++++++--------- 1 file changed, 12 insertions(+), 9 deletions(-) commit 0e83a7875d691f5b76c87d9223b22e5a0d34511e Author: Asbjørn Sloth Tønnesen Date: Sat Jul 13 02:19:02 2024 +0000 net/sched: cls_flower: add policy for TCA_FLOWER_KEY_FLAGS This policy guards fl_set_key_flags() from seeing flags not used in the context of TCA_FLOWER_KEY_FLAGS. In order For the policy check to be performed with the correct endianness, then we also needs to change the attribute type to NLA_BE32 (Thanks Davide). TCA_FLOWER_KEY_FLAGS{,_MASK} already has a be32 comment in include/uapi/linux/pkt_cls.h. Signed-off-by: Asbjørn Sloth Tønnesen Tested-by: Davide Caratti Reviewed-by: Davide Caratti Link: https://patch.msgid.link/20240713021911.1631517-6-ast@fiberby.net Signed-off-by: Jakub Kicinski net/sched/cls_flower.c | 10 ++++++++-- 1 file changed, 8 insertions(+), 2 deletions(-) commit fcb4bb07a9276bfb63c82ce5e8c4f8ff23646635 Author: Asbjørn Sloth Tønnesen Date: Sat Jul 13 02:19:01 2024 +0000 net/sched: cls_flower: prepare fl_{set,dump}_key_flags() for ENC_FLAGS Prepare fl_set_key_flags/fl_dump_key_flags() for use with TCA_FLOWER_KEY_ENC_FLAGS{,_MASK}. This patch adds an encap argument, similar to fl_set_key_ip/ fl_dump_key_ip(), and determine the flower keys based on the encap argument, and use them in the rest of the two functions. Since these functions are so far, only called with encap set false, then there is no functional change. Signed-off-by: Asbjørn Sloth Tønnesen Tested-by: Davide Caratti Reviewed-by: Davide Caratti Link: https://patch.msgid.link/20240713021911.1631517-5-ast@fiberby.net Signed-off-by: Jakub Kicinski net/sched/cls_flower.c | 40 ++++++++++++++++++++++++++++++---------- 1 file changed, 30 insertions(+), 10 deletions(-) commit bfda5a63137bc83c344c4d995f404c8e701ff0fa Author: Asbjørn Sloth Tønnesen Date: Sat Jul 13 02:19:00 2024 +0000 net/sched: flower: define new tunnel flags Define new TCA_FLOWER_KEY_FLAGS_* flags for use in struct flow_dissector_key_control, covering the same flags as currently exposed through TCA_FLOWER_KEY_ENC_FLAGS. Put the new flags under FLOW_DIS_F_*. The idea is that we can later, move the existing flags under FLOW_DIS_F_* as well. The ynl flag names have been taken from the RFC iproute2 patch. Signed-off-by: Asbjørn Sloth Tønnesen Reviewed-by: Donald Hunter Link: https://patch.msgid.link/20240713021911.1631517-4-ast@fiberby.net Signed-off-by: Jakub Kicinski Documentation/netlink/specs/tc.yaml | 4 ++++ include/net/flow_dissector.h | 7 ++++++- include/uapi/linux/pkt_cls.h | 4 ++++ 3 files changed, 14 insertions(+), 1 deletion(-) commit 49ba9fc1c7736e935f7606920c5092b2bbb0d1e4 Author: Asbjørn Sloth Tønnesen Date: Sat Jul 13 02:18:59 2024 +0000 doc: netlink: specs: tc: describe flower control flags Describe the flower control flags, and use them for key-flags and key-flags-mask. The flag names have been taken from iproute2. Suggested-by: Jakub Kicinski Signed-off-by: Asbjørn Sloth Tønnesen Reviewed-by: Donald Hunter Link: https://patch.msgid.link/20240713021911.1631517-3-ast@fiberby.net Signed-off-by: Jakub Kicinski Documentation/netlink/specs/tc.yaml | 10 ++++++++++ 1 file changed, 10 insertions(+) commit 6e5c85c003e47fd49b72ca052b9181644e04a520 Author: Asbjørn Sloth Tønnesen Date: Sat Jul 13 02:18:58 2024 +0000 net/sched: flower: refactor control flag definitions Redefine the flower control flags as an enum, so they are included in BTF info. Make the kernel-side enum a more explicit superset of TCA_FLOWER_KEY_FLAGS_*, new flags still need to be added to both enums, but at least the bit position only has to be defined once. FLOW_DIS_ENCAPSULATION is never set for mask, so it can't be exposed to userspace in an unsupported flags mask error message, so it will be placed one bit position above the last uAPI flag. Suggested-by: Alexander Lobakin Suggested-by: Jakub Kicinski Signed-off-by: Asbjørn Sloth Tønnesen Reviewed-by: Davide Caratti Link: https://patch.msgid.link/20240713021911.1631517-2-ast@fiberby.net Signed-off-by: Jakub Kicinski include/net/flow_dissector.h | 14 +++++++++++--- include/uapi/linux/pkt_cls.h | 3 +++ 2 files changed, 14 insertions(+), 3 deletions(-) commit 1654c37ddbfce5d50bc2895d7ea9c5e0edcc4d77 Merge: 6a31ffdfed10 7fd298d4b39d Author: Linus Torvalds Date: Mon Jul 15 09:10:31 2024 -0700 Merge branch 'arm64-uaccess' (early part) Merge arm64 support for proper 'unsafe' user accessor functionality, with 'asm goto' for handling exceptions. The arm64 user access code used the slow fallback code for the user access code, which generates horrendous code for things like strncpy_from_user(), because it causes us to generate code for SW PAN and for range checking for every individual word. Teach arm64 about 'user_access_begin()' and the so-called 'unsafe' user access functions that take an error label and use 'asm goto' to make all the exception handling be entirely out of line. [ These user access functions are called 'unsafe' not because the concept is unsafe, but because the low-level accessor functions absolutely have to be protected by the 'user_access_begin()' code, because that's what does the range checking. So the accessor functions have that scary name to make sure people don't think they are usable on their own, and cannot be mis-used the way our old "double underscore" versions of __get_user() and friends were ] The "(early part)" of the branch is because the full branch also improved on the "access_ok()" function, but the exact semantics of TBI (top byte ignore) have to be discussed before doing that part. So this just does the low-level accessor update to use "asm goto". * 'arm64-uaccess' (early part): arm64: start using 'asm goto' for put_user() arm64: start using 'asm goto' for get_user() when available commit c52090805382387f60c8e4cf8d613d0cf77ee1e9 Author: Masahiro Yamada Date: Wed Jul 3 03:02:41 2024 +0900 kbuild: deb-pkg: remove support for "name " form for DEBEMAIL Commit d5940c60e057 ("kbuild: deb-pkg improve maintainer address generation") supported the "name " form for DEBEMAIL, with behavior slightly different from devscripts. In Kbuild, if DEBEMAIL is given in the form "name ", it is used as-is, and DEBFULLNAME is ignored. In contrast, debchange takes the name from DEBFULLNAME (or NAME) if set, as described in 'man debchange': If this variable has the form "name ", then the maintainer name will also be taken from here if neither DEBFULLNAME nor NAME is set. This commit removes support for the "name form for DEBEMAIL, as the current behavior is already different from debchange, and the Debian manual suggests setting the email address and name separately in DEBEMAIL and DEBFULLNAME. [1] If there are any complaints about this removal, we can re-add it, with better alignment with the debchange implementation. [2] [1]: https://www.debian.org/doc/manuals/debmake-doc/ch03.en.html#email-setup [2]: https://salsa.debian.org/debian/devscripts/-/blob/v2.23.7/scripts/debchange.pl#L802 Signed-off-by: Masahiro Yamada Reviewed-by: Nicolas Schier scripts/package/mkdebian | 20 +++++++------------- 1 file changed, 7 insertions(+), 13 deletions(-) commit 6276761955817fd8259093a6e6a9ad88ab466b21 Author: Masahiro Yamada Date: Wed Jul 3 03:02:40 2024 +0900 kbuild: deb-pkg: remove support for EMAIL environment variable Commit edec611db047 ("kbuild, deb-pkg: improve maintainer identification") added the EMAIL and NAME environment variables. Commit d5940c60e057 ("kbuild: deb-pkg improve maintainer address generation") removed support for NAME, but kept support for EMAIL. The EMAIL and NAME environment variables are supported by some tools (see 'man debchange'), but not by all. We should support both of them, or neither of them. We should not stop halfway. Signed-off-by: Masahiro Yamada Reviewed-by: Nicolas Schier scripts/package/mkdebian | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit d5afb4824f142205900aa4a3a133b5dd68720e67 Author: Masahiro Yamada Date: Thu Jun 27 03:22:04 2024 +0900 kconfig: refactor error messages in sym_check_print_recursive() Improve the error messages and clean up redundant code. [1] remove redundant next_sym->name checks If 'next_sym' is a choice, the first 'if' block is executed. In the subsequent 'else if' blocks, 'next_sym" is not a choice, hence next_sym->name is not NULL. [2] remove redundant sym->name checks A choice is never selected or implied by anyone because it has no name (it is syntactically impossible). If it is, sym->name is not NULL. [3] Show the location of choice instead of "" "part of choice " does not convey useful information. Since a choice has no name, it is more informative to display the file name and line number. Signed-off-by: Masahiro Yamada scripts/kconfig/symbol.c | 18 +++++++++--------- 1 file changed, 9 insertions(+), 9 deletions(-) commit d67624d814ae40a655981992b0f0d652e6f591b8 Author: Masahiro Yamada Date: Thu Jun 27 03:22:03 2024 +0900 kconfig: improve error message for recursive dependency in choice Kconfig detects recursive dependencies in a choice block, but the error message is unclear. [Test Code] choice prompt "choose" depends on A config A bool "A" config B bool "B" endchoice [Result] Kconfig:1:error: recursive dependency detected! Kconfig:1: choice contains symbol A Kconfig:5: symbol A is part of choice For a resolution refer to Documentation/kbuild/kconfig-language.rst subsection "Kconfig recursive dependency limitations" The phrase "contains symbol A" does not accurately describe the problem. The issue is that the choice depends on A, which is a member of itself. The first if-block does not print a sensible message. Remove it. This commit improves the error message to: Kconfig:1:error: recursive dependency detected! Kconfig:1: symbol symbol is visible depending on A Kconfig:5: symbol A is part of choice For a resolution refer to Documentation/kbuild/kconfig-language.rst subsection "Kconfig recursive dependency limitations" Signed-off-by: Masahiro Yamada scripts/kconfig/symbol.c | 7 +------ 1 file changed, 1 insertion(+), 6 deletions(-) commit 1a7d0ea83e620fd8d7b3ced00a1c31f64cb70730 Author: Masahiro Yamada Date: Thu Jun 27 03:22:02 2024 +0900 kconfig: improve error message for dependency between choice members A choice member must not depend on another member within the same choice block. Kconfig detects this, but the error message is not sensible. [Test Code] choice prompt "choose" config A bool "A" depends on B config B bool "B" endchoice [Result] Kconfig:1:error: recursive dependency detected! Kconfig:1: choice contains symbol A Kconfig:4: symbol A is part of choice B Kconfig:8: symbol B is part of choice For a resolution refer to Documentation/kbuild/kconfig-language.rst subsection "Kconfig recursive dependency limitations" The phrase "part of choice B" is weird because B is not a choice block, but a choice member. To determine whether the current symbol is a part of a choice block, sym_is_choice(next_sym) must be checked. This commit improves the error message to: Kconfig:1:error: recursive dependency detected! Kconfig:1: choice contains symbol A Kconfig:4: symbol A symbol is visible depending on B Kconfig:8: symbol B is part of choice For a resolution refer to Documentation/kbuild/kconfig-language.rst subsection "Kconfig recursive dependency limitations" Signed-off-by: Masahiro Yamada scripts/kconfig/symbol.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit d533828ef3cafc2178dda44851d7cd8875781d55 Author: Masahiro Yamada Date: Thu Jun 27 03:22:01 2024 +0900 kconfig: fix conditional prompt behavior for choice When a prompt is followed by "if ", the symbol is configurable when the if-conditional evaluates to true. A typical usage is as follows: menuconfig BLOCK bool "Enable the block layer" if EXPERT default y When EXPERT=n, the prompt is hidden, but this config entry is still active, and BLOCK is set to its default value 'y'. When EXPERT=y, the prompt is shown, making BLOCK a user-configurable option. This usage is common throughout the kernel tree, but it has never worked within a choice block. [Test Code] config EXPERT bool "Allow expert users to modify more options" choice prompt "Choose" if EXPERT config A bool "A" config B bool "B" endchoice [Result] # CONFIG_EXPERT is not set When the prompt is hidden, the choice block should produce the default without asking for the user's preference. Hence, the output should be: # CONFIG_EXPERT is not set CONFIG_A=y # CONFIG_B is not set Removing unnecessary hacks fixes the issue. This commit also changes the behavior of 'select' by choice members. [Test Code 2] config MODULES def_bool y modules config DEP def_tristate m if DEP choice prompt "choose" config A bool "A" select C endchoice config B def_bool y select D endif config C tristate config D tristate The current output is as follows: CONFIG_MODULES=y CONFIG_DEP=m CONFIG_A=y CONFIG_B=y CONFIG_C=y CONFIG_D=m With this commit, the output will be changed as follows: CONFIG_MODULES=y CONFIG_DEP=m CONFIG_A=y CONFIG_B=y CONFIG_C=m CONFIG_D=m CONFIG_C will be changed to 'm' because 'select C' will inherit the dependency on DEP, which is 'm'. This change is aligned with the behavior of 'select' outside a choice block; 'select D' depends on DEP, therefore D is selected by (B && DEP). Note: With this commit, allmodconfig will set CONFIG_USB_ROLE_SWITCH to 'm' instead of 'y'. I did not see any build regression with this change. Signed-off-by: Masahiro Yamada scripts/kconfig/menu.c | 38 +++----------------------------------- scripts/kconfig/symbol.c | 2 +- 2 files changed, 4 insertions(+), 36 deletions(-) commit b9d73218d78778effd2924664ed93d78ff6949de Author: Masahiro Yamada Date: Thu Jun 27 03:22:00 2024 +0900 treewide: change conditional prompt for choices to 'depends on' While Documentation/kbuild/kconfig-language.rst provides a brief explanation, there are recurring confusions regarding the usage of a prompt followed by 'if '. This conditional controls _only_ the prompt. A typical usage is as follows: menuconfig BLOCK bool "Enable the block layer" if EXPERT default y When EXPERT=n, the prompt is hidden, but this config entry is still active, and BLOCK is set to its default value 'y'. This is reasonable because you are likely want to enable the block device support. When EXPERT=y, the prompt is shown, allowing you to toggle BLOCK. Please note that it is different from 'depends on EXPERT', which would enable and disable the entire config entry. However, this conditional prompt has never worked in a choice block. The following two work in the same way: when EXPERT is disabled, the choice block is entirely disabled. [Test Code 1] choice prompt "choose" if EXPERT config A bool "A" config B bool "B" endchoice [Test Code 2] choice prompt "choose" depends on EXPERT config A bool "A" config B bool "B" endchoice I believe the first case should hide only the prompt, producing the default: CONFIG_A=y # CONFIG_B is not set The next commit will change (fix) the behavior of the conditional prompt in choice blocks. I see several choice blocks wrongly using a conditional prompt, where 'depends on' makes more sense. To preserve the current behavior, this commit converts such misuses. I did not touch the following entry in arch/x86/Kconfig: choice prompt "Memory split" if EXPERT default VMSPLIT_3G This is truly the correct use of the conditional prompt; when EXPERT=n, this choice block should silently select the reasonable VMSPLIT_3G, although the resulting PAGE_OFFSET will not be affected anyway. Presumably, the one in fs/jffs2/Kconfig is also correct, but I converted it to 'depends on' to avoid any potential behavioral change. Signed-off-by: Masahiro Yamada arch/arm/Kconfig | 6 ++++-- arch/arm64/Kconfig | 3 ++- arch/mips/Kconfig | 6 ++++-- arch/powerpc/Kconfig | 3 ++- arch/riscv/Kconfig | 3 ++- fs/jffs2/Kconfig | 3 ++- 6 files changed, 16 insertions(+), 8 deletions(-) commit 7c9bb07a6e9439fb7bdeee15eb188fe127a0d0e0 Author: Masahiro Yamada Date: Tue Jun 18 19:35:31 2024 +0900 kconfig: remove E_LIST expression type E_LIST was preveously used to form an expression tree consisting of choice members. It is no longer used. Signed-off-by: Masahiro Yamada scripts/kconfig/expr.c | 15 --------------- scripts/kconfig/expr.h | 2 +- scripts/kconfig/symbol.c | 3 +-- 3 files changed, 2 insertions(+), 18 deletions(-) commit ca4c74ba306e28cebf53908e69b773dcbb700cbc Author: Masahiro Yamada Date: Tue Jun 18 19:35:30 2024 +0900 kconfig: remove P_CHOICE property P_CHOICE is a pseudo property used to link a choice with its members. There is no more code relying on this, except for some debug code. Signed-off-by: Masahiro Yamada scripts/kconfig/expr.h | 4 +--- scripts/kconfig/lkc_proto.h | 1 - scripts/kconfig/menu.c | 9 +-------- scripts/kconfig/parser.y | 4 ---- scripts/kconfig/qconf.cc | 8 -------- scripts/kconfig/symbol.c | 14 +------------- 6 files changed, 3 insertions(+), 37 deletions(-) commit b139b43e9d47552b3f998fade184ed19e45d0c32 Author: Masahiro Yamada Date: Tue Jun 18 19:35:29 2024 +0900 kconfig: use sym_get_choice_menu() in sym_check_deps() Choices and their members are associated via the P_CHOICE property. Currently, prop_get_symbol(sym_get_choice_prop()) is used to obtain the choice of the given choice member. Replace it with sym_get_choice_menu(), which retrieves the choice without relying on P_CHOICE. Signed-off-by: Masahiro Yamada scripts/kconfig/symbol.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) commit 609fc4099b3482ba774712376d56316c561432ff Author: Masahiro Yamada Date: Tue Jun 18 19:35:28 2024 +0900 kconfig: use sym_get_choice_menu() in sym_check_choice_deps() Choices and their members are associated via the P_CHOICE property. Currently, prop_get_symbol(sym_get_choice_prop()) is used to obtain the choice of the given choice member. Replace it with sym_get_choice_menu(), which retrieves the choice without relying on P_CHOICE. Signed-off-by: Masahiro Yamada scripts/kconfig/symbol.c | 10 +++++++--- 1 file changed, 7 insertions(+), 3 deletions(-) commit d8f8bbcf4b94fefbf9e2f0d3a67b7190507afc48 Author: Masahiro Yamada Date: Tue Jun 18 19:35:27 2024 +0900 kconfig: use sym_get_choice_menu() in sym_check_print_recursive() Choices and their members are associated via the P_CHOICE property. Currently, prop_get_symbol(sym_get_choice_prop()) is used to obtain the choice of the given choice member. Replace it with sym_get_choice_menu(), which retrieves the choice without relying on P_CHOICE. Signed-off-by: Masahiro Yamada scripts/kconfig/symbol.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) commit 8926bc901d617f21d5ebd2eda17aeea55bbecd9a Author: Masahiro Yamada Date: Tue Jun 18 19:35:26 2024 +0900 kconfig: remove expr_list_for_each_sym() macro All users of this macro have been converted. Remove it. Signed-off-by: Masahiro Yamada scripts/kconfig/expr.h | 3 --- 1 file changed, 3 deletions(-) commit 6e6d0e917a9714297614b41fbbfde1625249e197 Author: Masahiro Yamada Date: Tue Jun 18 19:35:25 2024 +0900 kconfig: use menu_list_for_each_sym() in sym_choice_default() Choices and their members are associated via the P_CHOICE property. Currently, sym_get_choice_prop() and expr_list_for_each_sym() are used to iterate on choice members. Replace them with menu_for_each_sub_entry(), which achieves the same without relying on P_CHOICE. Signed-off-by: Masahiro Yamada scripts/kconfig/symbol.c | 9 ++++----- 1 file changed, 4 insertions(+), 5 deletions(-) commit e8fcd915e3c07a2ef90341fa307a224cfd5d865d Author: Masahiro Yamada Date: Tue Jun 18 19:35:24 2024 +0900 kconfig: change sym_choice_default() to take the choice menu Change the argument of sym_choice_default() to ease further cleanups. Signed-off-by: Masahiro Yamada scripts/kconfig/confdata.c | 2 +- scripts/kconfig/lkc.h | 2 +- scripts/kconfig/symbol.c | 8 ++++---- 3 files changed, 6 insertions(+), 6 deletions(-) commit cca318378d6dcb38acd0ba8801b34d1a9be16028 Author: Masahiro Yamada Date: Tue Jun 18 19:35:23 2024 +0900 kconfig: remove conf_unsaved in conf_read_simple() This variable is unnecessary. Call conf_set_changed(true) directly. Signed-off-by: Masahiro Yamada scripts/kconfig/confdata.c | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-) commit bd0db4b6ad03abb39708e3c09d9d275973052b6f Author: Masahiro Yamada Date: Tue Jun 18 19:35:22 2024 +0900 kconfig: remove sym_get_choice_value() sym_get_choice_value(menu->sym) is equivalent to sym_calc_choice(menu). Convert all call sites of sym_get_choice_value() and then remove it. Signed-off-by: Masahiro Yamada scripts/kconfig/conf.c | 6 ++---- scripts/kconfig/gconf.c | 2 +- scripts/kconfig/lkc.h | 3 +-- scripts/kconfig/mconf.c | 6 +++--- scripts/kconfig/nconf.c | 6 +++--- scripts/kconfig/symbol.c | 9 +-------- 6 files changed, 11 insertions(+), 21 deletions(-) commit f79dc03fe68c79d388908182e68d702f7f1786bc Author: Masahiro Yamada Date: Tue Jun 18 19:35:21 2024 +0900 kconfig: refactor choice value calculation Handling choices has always been in a PITA in Kconfig. For example, fixes and reverts were repeated for randconfig with KCONFIG_ALLCONFIG: - 422c809f03f0 ("kconfig: fix randomising choice entries in presence of KCONFIG_ALLCONFIG") - 23a5dfdad22a ("Revert "kconfig: fix randomising choice entries in presence of KCONFIG_ALLCONFIG"") - 8357b48549e1 ("kconfig: fix randomising choice entries in presence of KCONFIG_ALLCONFIG") - 490f16171119 ("Revert "kconfig: fix randomising choice entries in presence of KCONFIG_ALLCONFIG"") As these commits pointed out, randconfig does not randomize choices when KCONFIG_ALLCONFIG is used. This issue still remains. [Test Case] choice prompt "choose" config A bool "A" config B bool "B" endchoice $ echo > all.config $ make KCONFIG_ALLCONFIG=1 randconfig The output is always as follows: CONFIG_A=y # CONFIG_B is not set Not only randconfig, but other all*config variants are also broken with KCONFIG_ALLCONFIG. With the same Kconfig, $ echo '# CONFIG_A is not set' > all.config $ make KCONFIG_ALLCONFIG=1 allyesconfig You will get this: CONFIG_A=y # CONFIG_B is not set This is incorrect because it does not respect all.config. The correct output should be: # CONFIG_A is not set CONFIG_B=y To handle user inputs more accurately, this commit refactors the code based on the following principles: - When a user value is given, Kconfig must set it immediately. Do not defer it by setting SYMBOL_NEED_SET_CHOICE_VALUES. - The SYMBOL_DEF_USER flag must not be cleared, unless a new config file is loaded. Kconfig must not forget user inputs. In addition, user values for choices must be managed with priority. If user inputs conflict within a choice block, the newest value wins. The values given by randconfig have lower priority than explicit user inputs. This commit implements it by using a linked list. Every time a choice block gets a new input, it is moved to the top of the list. Let me explain how it works. Let's say, we have a choice block that consists of five symbols: A, B, C, D, and E. Initially, the linked list looks like this: A(=?) --> B(=?) --> C(=?) --> D(=?) --> E(=?) Suppose randconfig is executed with the following KCONFIG_ALLCONFIG: CONFIG_C=y # CONFIG_A is not set CONFIG_D=y First, CONFIG_C=y is read. C is set to 'y' and moved to the top. C(=y) --> A(=?) --> B(=?) --> D(=?) --> E(=?) Next, '# CONFIG_A is not set' is read. A is set to 'n' and moved to the top. A(=n) --> C(=y) --> B(=?) --> D(=?) --> E(=?) Then, 'CONFIG_D=y' is read. D is set to 'y' and moved to the top. D(=y) --> A(=n) --> C(=y) --> B(=?) --> E(=?) Lastly, randconfig shuffles the order of the remaining symbols, resulting in: D(=y) --> A(=n) --> C(=y) --> B(=y) --> E(=y) or D(=y) --> A(=n) --> C(=y) --> E(=y) --> B(=y) When calculating the output, the linked list is traversed and the first visible symbol with 'y' is taken. In this case, it is D if visible. If D is hidden by 'depends on', the next node, A, is examined. Since it is already specified as 'n', it is skipped. Next, C is checked, and selected if it is visible. If C is also invisible, either B or E is chosen as a result of the randomization. If B and E are also invisible, the linked list is traversed in the reverse order, and the least prioritized 'n' symbol is chosen. It is A in this case. Now, Kconfig remembers all user values. This is a big difference from the previous implementation, where Kconfig would forget CONFIG_C=y when CONFIG_D=y appeared in the same input file. The new appaorch respects user-specified values as much as possible. Signed-off-by: Masahiro Yamada scripts/kconfig/conf.c | 131 ++++++++++++++++++------------------- scripts/kconfig/confdata.c | 54 +++------------ scripts/kconfig/expr.h | 12 ++-- scripts/kconfig/lkc.h | 7 +- scripts/kconfig/menu.c | 17 +---- scripts/kconfig/parser.y | 4 ++ scripts/kconfig/symbol.c | 159 ++++++++++++++++++++++++++++----------------- 7 files changed, 187 insertions(+), 197 deletions(-) commit ee29e6204c32dce013ac6d1078d98dce5607ce86 Author: Masahiro Yamada Date: Tue Jun 18 19:35:20 2024 +0900 kconfig: import list_move(_tail) and list_for_each_entry_reverse macros Import more macros from include/linux/list.h. These will be used in the next commit. Signed-off-by: Masahiro Yamada scripts/kconfig/list.h | 53 ++++++++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 53 insertions(+) commit 17c31aded9a1ee87e37f0ea0e3737797ef3f8c97 Author: Chen-Yu Tsai Date: Thu Jun 13 17:34:32 2024 +0800 scripts/make_fit: Support decomposing DTBs The kernel tree builds some "composite" DTBs, where the final DTB is the result of applying one or more DTB overlays on top of a base DTB with fdtoverlay. The FIT image specification already supports configurations having one base DTB and overlays applied on top. It is then up to the bootloader to apply said overlays and either use or pass on the final result. This allows the FIT image builder to reuse the same FDT images for multiple configurations, if such cases exist. The decomposition function depends on the kernel build system, reading back the .cmd files for the to-be-packaged DTB files to check for the fdtoverlay command being called. This will not work outside the kernel tree. The function is off by default to keep compatibility with possible existing users. To facilitate the decomposition and keep the code clean, the model and compatitble string extraction have been moved out of the output_dtb function. The FDT image description is replaced with the base file name of the included image. Signed-off-by: Chen-Yu Tsai Reviewed-by: Simon Glass Signed-off-by: Masahiro Yamada scripts/Makefile.lib | 1 + scripts/make_fit.py | 86 ++++++++++++++++++++++++++++++++++++++-------------- 2 files changed, 65 insertions(+), 22 deletions(-) commit e61b190b1a273201bf8a4169fb52e54b633f5349 Author: Rafael Aquini Date: Tue Jun 11 17:11:21 2024 -0400 kbuild: rpm-pkg: make sure to have versioned 'Obsoletes' for kernel.spec Fix the following rpmbuild warning: $ make srcrpm-pkg ... RPM build warnings: line 34: It's not recommended to have unversioned Obsoletes: Obsoletes: kernel-headers Signed-off-by: Rafael Aquini Tested-by: Nathan Chancellor Signed-off-by: Masahiro Yamada scripts/package/kernel.spec | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 7308bf8a2c3d008f3662eaa3b4c3bbe55852d6c6 Author: Uwe Kleine-König Date: Tue Jun 11 22:59:00 2024 +0200 modpost: Enable section warning from *driver to .exit.text There used to be several offenders, but now that for all of them patches were sent and most of them were applied, enable the warning also for builds without W=1. Signed-off-by: Uwe Kleine-König Reviewed-by: Nathan Chancellor Signed-off-by: Masahiro Yamada scripts/mod/modpost.c | 11 ----------- 1 file changed, 11 deletions(-) commit ae4c4cee8110a986f5a884c5d91d137e2b994303 Author: Masahiro Yamada Date: Wed Jun 12 03:24:47 2024 +0900 kbuild: move init/build-version to scripts/ At first, I thought this script would be needed only in init/Makefile. However, commit 5db8face97f8 ("kbuild: Restore .version auto-increment behaviour for Debian packages") and commit 1789fc912541 ("kbuild: rpm-pkg: invoke the kernel build from rpmbuild for binrpm-pkg") revealed that it was actually needed for scripts/package/mk* as well. After all, scripts/ is a better place for it. Signed-off-by: Masahiro Yamada Reviewed-by: Nathan Chancellor init/Makefile | 2 +- {init => scripts}/build-version | 0 scripts/package/mkdebian | 2 +- scripts/package/mkspec | 2 +- 4 files changed, 3 insertions(+), 3 deletions(-) commit 9b114520837a5f08b8eeeee30947bb9e7f44be1e Author: Masahiro Yamada Date: Wed Jun 12 02:55:13 2024 +0900 kconfig: remember the current choice while parsing the choice block Instead of the boolean flag, it will be more useful to remember the current choice being parsed. Signed-off-by: Masahiro Yamada scripts/kconfig/parser.y | 10 ++++------ 1 file changed, 4 insertions(+), 6 deletions(-) commit bd988e7cb84a7f27e8ec100c5f68498b7d4fa69c Author: Masahiro Yamada Date: Wed Jun 12 02:55:12 2024 +0900 kconfig: introduce choice_set_value() helper Currently, sym_set_tristate_value() is used to set 'y' to a choice member, which is confusing because it not only sets 'y' to the given symbol but also tweaks flags of other symbols as a side effect. Add a dedicated function for setting the value of the given choice. Signed-off-by: Masahiro Yamada scripts/kconfig/conf.c | 2 +- scripts/kconfig/lkc_proto.h | 1 + scripts/kconfig/mconf.c | 2 +- scripts/kconfig/nconf.c | 2 +- scripts/kconfig/symbol.c | 62 +++++++++++++++++++++++++++++++-------------- 5 files changed, 47 insertions(+), 22 deletions(-) commit dfe8e56fc604a6000550174d1002c6076efd8003 Author: Masahiro Yamada Date: Wed Jun 12 02:55:11 2024 +0900 kconfig: add fallthrough comments to expr_compare_type() Clarify the missing 'break' is intentional. Signed-off-by: Masahiro Yamada scripts/kconfig/expr.c | 5 +++++ 1 file changed, 5 insertions(+) commit cd90952101c86267193b263ed3f0753f0715700e Author: Masahiro Yamada Date: Wed Jun 12 02:55:10 2024 +0900 kconfig: remove unneeded code in expr_compare_type() The condition (t2 == 0) never becomes true because the zero value (i.e., E_NONE) is only used as a dummy type for prevtoken. It can be passed to t1, but not to t2. The caller of this function only checks expr_compare_type() > 0. Therefore, the distinction between 0 and -1 is unnecessary. Signed-off-by: Masahiro Yamada scripts/kconfig/expr.c | 5 +---- 1 file changed, 1 insertion(+), 4 deletions(-) commit e570ef438fcd279514691f0aae903272d45e45e9 Author: Masahiro Yamada Date: Wed Jun 12 01:08:05 2024 +0900 kconfig: add -e and -u options to *conf-cfg.sh scripts Set -e to make these scripts fail on the first error. Set -u because these scripts are invoked by Makefile, and do not work properly without necessary variables defined. Both options are described in POSIX. [1] [1]: https://pubs.opengroup.org/onlinepubs/009604499/utilities/set.html Signed-off-by: Masahiro Yamada Reviewed-by: Nicolas Schier scripts/kconfig/gconf-cfg.sh | 2 ++ scripts/kconfig/mconf-cfg.sh | 2 ++ scripts/kconfig/nconf-cfg.sh | 2 ++ scripts/kconfig/qconf-cfg.sh | 2 ++ 4 files changed, 8 insertions(+) commit b1a9a5e04767e2a78783e19c9e55c25812ceccc3 Author: Masahiro Yamada Date: Mon Jun 10 20:25:18 2024 +0900 kbuild: merge temporary vmlinux for BTF and kallsyms CONFIG_DEBUG_INFO_BTF=y requires one additional link step. (.tmp_vmlinux.btf) CONFIG_KALLSYMS=y requires two additional link steps. (.tmp_vmlinux.kallsyms1 and .tmp_vmlinux.kallsyms2) Enabling both requires three additional link steps. When CONFIG_DEBUG_INFO_BTF=y and CONFIG_KALLSYMS=y, the current build process is as follows: KSYMS .tmp_vmlinux.kallsyms0.S AS .tmp_vmlinux.kallsyms0.o LD .tmp_vmlinux.btf # temporary vmlinux for BTF BTF .btf.vmlinux.bin.o LD .tmp_vmlinux.kallsyms1 # temporary vmlinux for kallsyms step 1 NM .tmp_vmlinux.kallsyms1.syms KSYMS .tmp_vmlinux.kallsyms1.S AS .tmp_vmlinux.kallsyms1.o LD .tmp_vmlinux.kallsyms2 # temporary vmlinux for kallsyms step 2 NM .tmp_vmlinux.kallsyms2.syms KSYMS .tmp_vmlinux.kallsyms2.S AS .tmp_vmlinux.kallsyms2.o LD vmlinux # final vmlinux This is redundant because the BTF generation and the kallsyms step 1 can be performed against the same temporary vmlinux. When both CONFIG_DEBUG_INFO_BTF and CONFIG_KALLSYMS are enabled, we can reduce the number of link steps by one. This commit changes the build process as follows: KSYMS .tmp_vmlinux0.kallsyms.S AS .tmp_vmlinux0.kallsyms.o LD .tmp_vmlinux1 # temporary vmlinux for BTF and kallsyms step 1 BTF .tmp_vmlinux1.btf.o NM .tmp_vmlinux1.syms KSYMS .tmp_vmlinux1.kallsyms.S AS .tmp_vmlinux1.kallsyms.o LD .tmp_vmlinux2 # temporary vmlinux for kallsyms step 2 NM .tmp_vmlinux2.syms KSYMS .tmp_vmlinux2.kallsyms.S AS .tmp_vmlinux2.kallsyms.o LD vmlinux # final vmlinux Signed-off-by: Masahiro Yamada Acked-by: Andrii Nakryiko scripts/link-vmlinux.sh | 41 ++++++++++++++++++++++++----------------- 1 file changed, 24 insertions(+), 17 deletions(-) commit c442db3f49f27e5a60a641b2ac9a3c6320796ed6 Author: Masahiro Yamada Date: Mon Jun 10 20:25:17 2024 +0900 kbuild: remove PROVIDE() for kallsyms symbols This reimplements commit 951bcae6c5a0 ("kallsyms: Avoid weak references for kallsyms symbols") because I am not a big fan of PROVIDE(). As an alternative solution, this commit prepends one more kallsyms step. KSYMS .tmp_vmlinux.kallsyms0.S # added AS .tmp_vmlinux.kallsyms0.o # added LD .tmp_vmlinux.btf BTF .btf.vmlinux.bin.o LD .tmp_vmlinux.kallsyms1 NM .tmp_vmlinux.kallsyms1.syms KSYMS .tmp_vmlinux.kallsyms1.S AS .tmp_vmlinux.kallsyms1.o LD .tmp_vmlinux.kallsyms2 NM .tmp_vmlinux.kallsyms2.syms KSYMS .tmp_vmlinux.kallsyms2.S AS .tmp_vmlinux.kallsyms2.o LD vmlinux Step 0 takes /dev/null as input, and generates .tmp_vmlinux.kallsyms0.o, which has a valid kallsyms format with the empty symbol list, and can be linked to vmlinux. Since it is really small, the added compile-time cost is negligible. Signed-off-by: Masahiro Yamada Acked-by: Ard Biesheuvel Reviewed-by: Nicolas Schier include/asm-generic/vmlinux.lds.h | 19 ------------------- kernel/kallsyms_internal.h | 5 ----- scripts/kallsyms.c | 6 ------ scripts/link-vmlinux.sh | 9 +++++++-- 4 files changed, 7 insertions(+), 32 deletions(-) commit ddf41329839f49dadf26973cd845ea160ac1784d Author: Masahiro Yamada Date: Mon Jun 10 20:25:16 2024 +0900 kbuild: refactor variables in scripts/link-vmlinux.sh Clean up the variables in scripts/link-vmlinux.sh - Specify the extra objects directly in vmlinux_link() - Move the AS rule to kallsyms() - Set kallsymso and btf_vmlinux_bin_o where they are generated - Remove unneeded variable, kallsymso_prev - Introduce the btf_data variable - Introduce the strip_debug flag instead of checking the output name No functional change intended. Signed-off-by: Masahiro Yamada Reviewed-by: Nicolas Schier scripts/link-vmlinux.sh | 65 ++++++++++++++++++++++++++----------------------- 1 file changed, 34 insertions(+), 31 deletions(-) commit 995150e4de13cee75b28265dabcd0c289b4ed3fa Author: Masahiro Yamada Date: Sun Jun 2 21:54:16 2024 +0900 kconfig: refactor conf_write_defconfig() to reduce indentation level Reduce the indentation level by continue'ing the loop earlier if (!sym || sym_is_choice(sym)). No functional change intended. Signed-off-by: Masahiro Yamada Reviewed-by: Nicolas Schier scripts/kconfig/confdata.c | 47 ++++++++++++++++++++++------------------------ 1 file changed, 22 insertions(+), 25 deletions(-) commit 826ee96dd4f72028b98366a21d986d35e1d781d5 Author: Masahiro Yamada Date: Sun Jun 2 21:54:15 2024 +0900 kconfig: refactor conf_set_all_new_symbols() to reduce indentation level The outer switch statement can be avoided by continue'ing earlier the loop when the symbol type is neither S_BOOLEAN nor S_TRISTATE. Remove it to reduce the indentation level by one. In addition, avoid the repetition of sym->def[S_DEF_USER].tri. No functional change intended. Signed-off-by: Masahiro Yamada Reviewed-by: Nicolas Schier scripts/kconfig/conf.c | 61 +++++++++++++++++++++++++------------------------- 1 file changed, 30 insertions(+), 31 deletions(-) commit fde192511bdbff554320b31574bb8a9cb3275522 Author: Masahiro Yamada Date: Sun Jun 2 21:54:14 2024 +0900 kconfig: remove tristate choice support I previously submitted a fix for a bug in the choice feature [1], where I mentioned, "Another (much cleaner) approach would be to remove the tristate choice support entirely". There are more issues in the tristate choice feature. For example, you can observe a couple of bugs in the following test code. [Test Code] config MODULES def_bool y modules choice prompt "tristate choice" default A config A tristate "A" config B tristate "B" endchoice Bug 1: the 'default' property is not correctly processed 'make alldefconfig' produces: CONFIG_MODULES=y # CONFIG_A is not set # CONFIG_B is not set However, the correct output should be: CONFIG_MODULES=y CONFIG_A=y # CONFIG_B is not set The unit test file, scripts/kconfig/tests/choice/alldef_expected_config, is wrong as well. Bug 2: choice members never get 'y' with randconfig For the test code above, the following combinations are possible: A B (1) y n (2) n y (3) m m (4) m n (5) n m (6) n n 'make randconfig' never produces (1) or (2). These bugs are fixable, but a more critical problem is the lack of a sensible syntax to specify the default for the tristate choice. The default for the choice must be one of the choice members, which cannot specify any of the patterns (3) through (6) above. In addition, I have never seen it being used in a useful way. The following commits removed unnecessary use of tristate choices: - df8df5e4bc37 ("usb: get rid of 'choice' for legacy gadget drivers") - bfb57ef0544a ("rapidio: remove choice for enumeration") This commit removes the tristate choice support entirely, which allows me to delete a lot of code, making further refactoring easier. Note: This includes the revert of commit fa64e5f6a35e ("kconfig/symbol.c: handle choice_values that depend on 'm' symbols"). It was suspicious because it did not address the root cause but introduced inconsistency in visibility between choice members and other symbols. [1]: https://lore.kernel.org/linux-kbuild/20240427104231.2728905-1-masahiroy@kernel.org/T/#m0a1bb6992581462ceca861b409bb33cb8fd7dbae Signed-off-by: Masahiro Yamada Reviewed-by: Nicolas Schier Documentation/kbuild/kconfig-language.rst | 13 ++--- scripts/kconfig/conf.c | 56 +++------------------- scripts/kconfig/confdata.c | 17 ++----- scripts/kconfig/gconf.c | 6 +-- scripts/kconfig/mconf.c | 28 +++-------- scripts/kconfig/menu.c | 31 +----------- scripts/kconfig/nconf.c | 28 ++--------- scripts/kconfig/parser.y | 23 +++++---- scripts/kconfig/qconf.cc | 2 +- scripts/kconfig/symbol.c | 22 +-------- scripts/kconfig/tests/choice/Kconfig | 17 ------- scripts/kconfig/tests/choice/__init__.py | 10 ---- .../kconfig/tests/choice/alldef_expected_config | 3 -- .../kconfig/tests/choice/allmod_expected_config | 3 -- scripts/kconfig/tests/choice/allno_expected_config | 3 -- .../kconfig/tests/choice/allyes_expected_config | 3 -- .../kconfig/tests/choice/oldask0_expected_stdout | 4 -- scripts/kconfig/tests/choice/oldask1_config | 1 - .../kconfig/tests/choice/oldask1_expected_stdout | 9 ---- .../kconfig/tests/choice_value_with_m_dep/Kconfig | 21 -------- .../tests/choice_value_with_m_dep/__init__.py | 16 ------- .../kconfig/tests/choice_value_with_m_dep/config | 2 - .../tests/choice_value_with_m_dep/expected_config | 3 -- .../tests/choice_value_with_m_dep/expected_stdout | 4 -- scripts/kconfig/tests/inter_choice/Kconfig | 25 ---------- scripts/kconfig/tests/inter_choice/__init__.py | 15 ------ scripts/kconfig/tests/inter_choice/defconfig | 1 - scripts/kconfig/tests/inter_choice/expected_config | 4 -- 28 files changed, 45 insertions(+), 325 deletions(-) commit 03638aaa7995c07376f2e51ac2640ccd25b4ba75 Author: Masahiro Yamada Date: Sun Jun 2 03:20:43 2024 +0900 kconfig: pass new conf_changed value to the callback Commit ee06a3ef7e3c ("kconfig: Update config changed flag before calling callback") pointed out that conf_updated flag must be updated _before_ calling the callback, which needs to know the new value. Given that, it makes sense to directly pass the new value to the callback. Signed-off-by: Masahiro Yamada scripts/kconfig/confdata.c | 10 ++++------ scripts/kconfig/gconf.c | 7 +++---- scripts/kconfig/lkc_proto.h | 2 +- scripts/kconfig/qconf.cc | 4 ++-- scripts/kconfig/qconf.h | 2 +- 5 files changed, 11 insertions(+), 14 deletions(-) commit 0b62fe46d77878645d117e70b9f135d7c9fcab47 Author: Masahiro Yamada Date: Sun Jun 2 03:20:42 2024 +0900 kconfig: gconf: move conf_changed() definition up Define conf_changed() before its call site to remove the forward declaration. Signed-off-by: Masahiro Yamada scripts/kconfig/gconf.c | 15 +++++++-------- 1 file changed, 7 insertions(+), 8 deletions(-) commit 300bf53ecb3673bf41db5dad2afcd77b8de3a662 Author: Masahiro Yamada Date: Sun Jun 2 03:20:41 2024 +0900 kconfig: gconf: remove unnecessary forward declarations These are defined before their call sites. Signed-off-by: Masahiro Yamada scripts/kconfig/gconf.c | 2 -- 1 file changed, 2 deletions(-) commit 060e05c3b422f7ed7112e14f5039870ecdd449cc Author: Masahiro Yamada Date: Sun Jun 2 03:20:39 2024 +0900 kconfig: qconf: remove initial call to conf_changed() If any CONFIG option is changed while loading the .config file, conf_read() calls conf_set_changed(true) and then the conf_changed() callback. With conf_read() moved after window initialization, the explicit conf_changed() call can be removed. Signed-off-by: Masahiro Yamada scripts/kconfig/qconf.cc | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) commit fb3f7f0f156a111da7d43f6ffe52b48bac5b7159 Author: Masahiro Yamada Date: Fri May 31 21:28:25 2024 +0900 initramfs: shorten cmd_initfs in usr/Makefile Avoid repetition of long variables. No functional change intended. Signed-off-by: Masahiro Yamada Reviewed-by: Nathan Chancellor usr/Makefile | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) commit ba7a0f4436ac73850a4110acf04d65f6e8a67d82 Author: Jakub Kicinski Date: Mon Jul 15 09:05:52 2024 -0700 Revert "net: mvpp2: Improve data types and use min()" This reverts commit f7023b3d697c6a7dfe2d9c70e0d8c2c580ccbd76. Russell indicates that assuming 32bits are sufficient isn't necessarily safe. Link: https://lore.kernel.org/20240711154741.174745-1-thorsten.blum@toblux.com/ Signed-off-by: Jakub Kicinski drivers/net/ethernet/marvell/mvpp2/mvpp2_main.c | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-) commit 6a31ffdfed10dc48e6fd1775d50c22429382ab98 Merge: a5819099f601 f915a3e5b018 Author: Linus Torvalds Date: Mon Jul 15 08:55:10 2024 -0700 Merge branch 'word-at-a-time' Merge minor word-at-a-time instruction choice improvements for x86 and arm64. This is the second of four branches that came out of me looking at the code generation for path lookup on arm64. The word-at-a-time infrastructure is used to do string operations in chunks of one word both when copying the pathname from user space (in strncpy_from_user()), and when parsing and hashing the individual path components (in link_path_walk()). In particular, the "find the first zero byte" uses various bit tricks to figure out the end of the string or path component, and get the length without having to do things one byte at a time. Both x86-64 and arm64 had less than optimal code choices for that. The commit message for the arm64 change in particular tries to explain the exact code flow for the zero byte finding for people who care. It's made a bit more complicated by the fact that we support big-endian hardware too, and so we have some extra abstraction layers to allow different models for finding the zero byte, quite apart from the issue of picking specialized instructions. * word-at-a-time: arm64: word-at-a-time: improve byte count calculations for LE x86-64: word-at-a-time: improve byte count calculations commit 0970bf676f86c2c4d9bf7e672f5504d390c9fce6 Author: Christophe JAILLET Date: Sun Jul 14 18:15:20 2024 +0200 llc: Constify struct llc_sap_state_trans 'struct llc_sap_state_trans' are not modified in this driver. Constifying this structure moves some data to a read-only section, so increase overall security. On a x86_64, with allmodconfig, as an example: Before: ====== text data bss dec hex filename 339 456 24 819 333 net/llc/llc_s_st.o After: ===== text data bss dec hex filename 683 144 0 827 33b net/llc/llc_s_st.o Signed-off-by: Christophe JAILLET Reviewed-by: Simon Horman Link: https://patch.msgid.link/9d17587639195ee94b74ff06a11ef97d1833ee52.1720973710.git.christophe.jaillet@wanadoo.fr Signed-off-by: Jakub Kicinski include/net/llc_s_st.h | 4 ++-- net/llc/llc_s_st.c | 26 +++++++++++++------------- net/llc/llc_sap.c | 12 ++++++------ 3 files changed, 21 insertions(+), 21 deletions(-) commit 70de41ef78573ce958ac04ecc2b5671851723c59 Author: Christophe JAILLET Date: Sun Jul 14 18:05:56 2024 +0200 llc: Constify struct llc_conn_state_trans 'struct llc_conn_state_trans' are not modified in this driver. Constifying this structure moves some data to a read-only section, so increase overall security. On a x86_64, with allmodconfig, as an example: Before: ====== text data bss dec hex filename 13923 10896 32 24851 6113 net/llc/llc_c_st.o After: ===== text data bss dec hex filename 21859 3328 0 25187 6263 net/llc/llc_c_st.o Signed-off-by: Christophe JAILLET Reviewed-by: Simon Horman Link: https://patch.msgid.link/87cda89e4c9414e71d1a54bb1eb491b0e7f70375.1720973029.git.christophe.jaillet@wanadoo.fr Signed-off-by: Jakub Kicinski include/net/llc_c_st.h | 4 +- net/llc/llc_c_st.c | 500 ++++++++++++++++++++++++------------------------- net/llc/llc_conn.c | 20 +- 3 files changed, 262 insertions(+), 262 deletions(-) commit f96eb1172ed8d74cfed7da92d2045ec64028cc38 Author: Christian Eggers Date: Mon Jul 15 14:30:50 2024 +0200 dsa: lan9303: consistent naming for PHY address parameter Name it 'addr' instead of 'port' or 'phy'. Signed-off-by: Christian Eggers Link: https://patch.msgid.link/20240715123050.21202-1-ceggers@arri.de Signed-off-by: Jakub Kicinski drivers/net/dsa/lan9303_mdio.c | 8 ++++---- include/linux/dsa/lan9303.h | 4 ++-- 2 files changed, 6 insertions(+), 6 deletions(-) commit 1fe1c66274fb80cc1ac42e0d38917d53adc7d7a3 Author: Maíra Canal Date: Sun Jul 14 11:49:12 2024 -0300 drm/v3d: Fix Indirect Dispatch configuration for V3D 7.1.6 and later `args->cfg[4]` is configured in Indirect Dispatch using the number of batches. Currently, for all V3D tech versions, `args->cfg[4]` equals the number of batches subtracted by 1. But, for V3D 7.1.6 and later, we must not subtract 1 from the number of batches. Implement the fix by checking the V3D tech version and revision. Fixes several `dEQP-VK.synchronization*` CTS tests related to Indirect Dispatch. Fixes: 18b8413b25b7 ("drm/v3d: Create a CPU job extension for a indirect CSD job") Signed-off-by: Maíra Canal Reviewed-by: Iago Toral Quiroga Link: https://patchwork.freedesktop.org/patch/msgid/20240714145243.1223131-2-mcanal@igalia.com drivers/gpu/drm/v3d/v3d_sched.c | 16 +++++++++++++--- 1 file changed, 13 insertions(+), 3 deletions(-) commit 93b63f68d00a0483b450b446e2ea5386a1b94213 Author: Qingfang Deng Date: Mon May 27 17:24:04 2024 +0800 riscv: lib: relax assembly constraints in hweight rd and rs don't have to be the same. In some cases where rs needs to be saved for later usage, this will save us some mv instructions. Signed-off-by: Qingfang Deng Reviewed-by: Xiao Wang Link: https://lore.kernel.org/r/20240527092405.134967-1-dqfext@gmail.com Signed-off-by: Palmer Dabbelt arch/riscv/include/asm/arch_hweight.h | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) commit 7c78fdbace0ff9bd2a2f1206182c054462b006af Author: Maíra Canal Date: Sun Jul 14 11:49:11 2024 -0300 drm/v3d: Add V3D tech revision to the device information The V3D tech revision can be a useful information when configuring jobs. Therefore, expose it in the `struct v3d_dev` with the V3D tech version. Signed-off-by: Maíra Canal Reviewed-by: Iago Toral Quiroga Link: https://patchwork.freedesktop.org/patch/msgid/20240714145243.1223131-1-mcanal@igalia.com drivers/gpu/drm/v3d/v3d_drv.c | 5 ++++- drivers/gpu/drm/v3d/v3d_drv.h | 8 +++++--- 2 files changed, 9 insertions(+), 4 deletions(-) commit a5819099f601c1af5b86b1f5921a56859e45b19a Merge: 0c3836482481 94a2bc0f611c Author: Linus Torvalds Date: Mon Jul 15 08:36:13 2024 -0700 Merge branch 'runtime-constants' Merge runtime constants infrastructure with implementations for x86 and arm64. This is one of four branches that came out of me looking at profiles of my kernel build filesystem load on my 128-core Altra arm64 system, where pathname walking and the user copies (particularly strncpy_from_user() for fetching the pathname from user space) is very hot. This is a very specialized "instruction alternatives" model where the dentry hash pointer and hash count will be constants for the lifetime of the kernel, but the allocation are not static but done early during the kernel boot. In order to avoid the pointer load and dynamic shift, we just rewrite the constants in the instructions in place. We can't use the "generic" alternative instructions infrastructure, because different architectures do it very differently, and it's actually simpler to just have very specific helpers, with a fallback to the generic ("old") model of just using variables for architectures that do not implement the runtime constant patching infrastructure. Link: https://lore.kernel.org/all/CAHk-=widPe38fUNjUOmX11ByDckaeEo9tN4Eiyke9u1SAtu9sA@mail.gmail.com/ * runtime-constants: arm64: add 'runtime constant' support runtime constants: add x86 architecture support runtime constants: add default dummy infrastructure vfs: dcache: move hashlen_hash() from callers into d_hash() commit cd9b6f4795e7002fa2fb51e6d172294e28453df3 Merge: 30b356005048 23e88450bb04 Author: Jakub Kicinski Date: Mon Jul 15 08:27:40 2024 -0700 Merge tag 'for-net-next-2024-07-15' of git://git.kernel.org/pub/scm/linux/kernel/git/bluetooth/bluetooth-next Luiz Augusto von Dentz says: ==================== bluetooth-next pull request for net-next: - qca: use the power sequencer for QCA6390 - btusb: mediatek: add ISO data transmission functions - hci_bcm4377: Add BCM4388 support - btintel: Add support for BlazarU core - btintel: Add support for Whale Peak2 - btnxpuart: Add support for AW693 A1 chipset - btnxpuart: Add support for IW615 chipset - btusb: Add Realtek RTL8852BE support ID 0x13d3:0x3591 * tag 'for-net-next-2024-07-15' of git://git.kernel.org/pub/scm/linux/kernel/git/bluetooth/bluetooth-next: (71 commits) Bluetooth: btmtk: Mark all stub functions as inline Bluetooth: hci_qca: Fix build error Bluetooth: hci_qca: use the power sequencer for wcn7850 and wcn6855 Bluetooth: hci_qca: make pwrseq calls the default if available Bluetooth: hci_qca: unduplicate calls to hci_uart_register_device() Bluetooth: hci_qca: schedule a devm action for disabling the clock dt-bindings: bluetooth: qualcomm: describe the inputs from PMU for wcn7850 Bluetooth: btnxpuart: Fix warnings for suspend and resume functions Bluetooth: btnxpuart: Add system suspend and resume handlers Bluetooth: btnxpuart: Add support for IW615 chipset Bluetooth: btnxpuart: Add support for AW693 A1 chipset Bluetooth: btintel: Add support for Whale Peak2 Bluetooth: btintel: Add support for BlazarU core Bluetooth: btusb: mediatek: add ISO data transmission functions Bluetooth: btmtk: move btusb_recv_acl_mtk to btmtk.c Bluetooth: btmtk: move btusb_mtk_[setup, shutdown] to btmtk.c Bluetooth: btmtk: move btusb_mtk_hci_wmt_sync to btmtk.c Bluetooth: btusb: add callback function in btusb suspend/resume Bluetooth: btmtk: rename btmediatek_data Bluetooth: btusb: mediatek: return error for failed reg access ... ==================== Link: https://patch.msgid.link/20240715142543.303944-1-luiz.dentz@gmail.com Signed-off-by: Jakub Kicinski commit 30b3560050486275c6207c8c90c0d53a7cc73ac1 Merge: 9283477e2891 2111375b85ad Author: Jakub Kicinski Date: Mon Jul 15 07:13:00 2024 -0700 Merge branch 'net-make-timestamping-selectable' First part of "net: Make timestamping selectable" from Kory Maincent. Change the driver-facing type already to lower rebasing pain. Link: https://lore.kernel.org/20240709-feature_ptp_netnext-v17-0-b5317f50df2a@bootlin.com/ Signed-off-by: Jakub Kicinski commit 2111375b85ad173d58e7b8604246a3de60950ac8 Author: Kory Maincent Date: Tue Jul 9 15:53:38 2024 +0200 net: Add struct kernel_ethtool_ts_info In prevision to add new UAPI for hwtstamp we will be limited to the struct ethtool_ts_info that is currently passed in fixed binary format through the ETHTOOL_GET_TS_INFO ethtool ioctl. It would be good if new kernel code already started operating on an extensible kernel variant of that structure, similar in concept to struct kernel_hwtstamp_config vs struct hwtstamp_config. Since struct ethtool_ts_info is in include/uapi/linux/ethtool.h, here we introduce the kernel-only structure in include/linux/ethtool.h. The manual copy is then made in the function called by ETHTOOL_GET_TS_INFO. Acked-by: Shannon Nelson Acked-by: Alexandra Winter Signed-off-by: Kory Maincent Link: https://patch.msgid.link/20240709-feature_ptp_netnext-v17-6-b5317f50df2a@bootlin.com Signed-off-by: Jakub Kicinski drivers/net/bonding/bond_main.c | 4 ++-- drivers/net/can/dev/dev.c | 2 +- drivers/net/can/peak_canfd/peak_canfd.c | 2 +- drivers/net/can/usb/gs_usb.c | 2 +- drivers/net/can/usb/peak_usb/pcan_usb_core.c | 2 +- drivers/net/can/usb/peak_usb/pcan_usb_core.h | 2 +- drivers/net/dsa/hirschmann/hellcreek_hwtstamp.c | 2 +- drivers/net/dsa/hirschmann/hellcreek_hwtstamp.h | 2 +- drivers/net/dsa/microchip/ksz_ptp.c | 2 +- drivers/net/dsa/microchip/ksz_ptp.h | 2 +- drivers/net/dsa/mv88e6xxx/hwtstamp.c | 2 +- drivers/net/dsa/mv88e6xxx/hwtstamp.h | 4 ++-- drivers/net/dsa/ocelot/felix.c | 2 +- drivers/net/dsa/sja1105/sja1105_ptp.c | 2 +- drivers/net/dsa/sja1105/sja1105_ptp.h | 2 +- drivers/net/ethernet/amd/xgbe/xgbe-ethtool.c | 2 +- .../net/ethernet/aquantia/atlantic/aq_ethtool.c | 2 +- .../net/ethernet/broadcom/bnx2x/bnx2x_ethtool.c | 2 +- drivers/net/ethernet/broadcom/bnxt/bnxt_ethtool.c | 2 +- drivers/net/ethernet/broadcom/tg3.c | 2 +- drivers/net/ethernet/cadence/macb.h | 2 +- drivers/net/ethernet/cadence/macb_main.c | 4 ++-- drivers/net/ethernet/cavium/liquidio/lio_ethtool.c | 2 +- .../net/ethernet/cavium/thunder/nicvf_ethtool.c | 2 +- drivers/net/ethernet/chelsio/cxgb4/cxgb4_ethtool.c | 2 +- drivers/net/ethernet/cisco/enic/enic_ethtool.c | 2 +- drivers/net/ethernet/engleder/tsnep_ethtool.c | 2 +- drivers/net/ethernet/freescale/dpaa/dpaa_ethtool.c | 2 +- .../net/ethernet/freescale/dpaa2/dpaa2-ethtool.c | 2 +- .../net/ethernet/freescale/enetc/enetc_ethtool.c | 2 +- drivers/net/ethernet/freescale/fec_main.c | 2 +- drivers/net/ethernet/freescale/gianfar_ethtool.c | 2 +- .../net/ethernet/fungible/funeth/funeth_ethtool.c | 2 +- drivers/net/ethernet/hisilicon/hns3/hnae3.h | 2 +- drivers/net/ethernet/hisilicon/hns3/hns3_ethtool.c | 2 +- .../net/ethernet/hisilicon/hns3/hns3pf/hclge_ptp.c | 2 +- .../net/ethernet/hisilicon/hns3/hns3pf/hclge_ptp.h | 2 +- drivers/net/ethernet/intel/e1000e/ethtool.c | 2 +- drivers/net/ethernet/intel/i40e/i40e_ethtool.c | 2 +- drivers/net/ethernet/intel/ice/ice_ethtool.c | 2 +- drivers/net/ethernet/intel/igb/igb_ethtool.c | 2 +- drivers/net/ethernet/intel/igc/igc_ethtool.c | 2 +- drivers/net/ethernet/intel/ixgbe/ixgbe_ethtool.c | 2 +- drivers/net/ethernet/marvell/mvpp2/mvpp2_main.c | 2 +- .../ethernet/marvell/octeontx2/nic/otx2_ethtool.c | 2 +- drivers/net/ethernet/mellanox/mlx4/en_ethtool.c | 2 +- drivers/net/ethernet/mellanox/mlx5/core/en.h | 2 +- .../net/ethernet/mellanox/mlx5/core/en_ethtool.c | 4 ++-- .../ethernet/mellanox/mlx5/core/ipoib/ethtool.c | 2 +- drivers/net/ethernet/mellanox/mlxsw/spectrum.h | 2 +- .../net/ethernet/mellanox/mlxsw/spectrum_ethtool.c | 2 +- drivers/net/ethernet/mellanox/mlxsw/spectrum_ptp.c | 4 ++-- drivers/net/ethernet/mellanox/mlxsw/spectrum_ptp.h | 10 ++++----- drivers/net/ethernet/microchip/lan743x_ethtool.c | 2 +- .../ethernet/microchip/lan966x/lan966x_ethtool.c | 2 +- .../net/ethernet/microchip/sparx5/sparx5_ethtool.c | 2 +- drivers/net/ethernet/mscc/ocelot_net.c | 2 +- drivers/net/ethernet/mscc/ocelot_ptp.c | 2 +- .../net/ethernet/pensando/ionic/ionic_ethtool.c | 2 +- drivers/net/ethernet/qlogic/qede/qede_ethtool.c | 2 +- drivers/net/ethernet/qlogic/qede/qede_ptp.c | 2 +- drivers/net/ethernet/qlogic/qede/qede_ptp.h | 2 +- drivers/net/ethernet/renesas/ravb_main.c | 2 +- drivers/net/ethernet/renesas/rswitch.c | 2 +- drivers/net/ethernet/renesas/rtsn.c | 2 +- drivers/net/ethernet/sfc/ethtool.c | 2 +- drivers/net/ethernet/sfc/falcon/nic.h | 2 +- drivers/net/ethernet/sfc/ptp.c | 2 +- drivers/net/ethernet/sfc/ptp.h | 5 +++-- drivers/net/ethernet/sfc/siena/ethtool.c | 2 +- drivers/net/ethernet/sfc/siena/ptp.c | 2 +- drivers/net/ethernet/sfc/siena/ptp.h | 4 ++-- .../net/ethernet/stmicro/stmmac/stmmac_ethtool.c | 2 +- drivers/net/ethernet/ti/am65-cpsw-ethtool.c | 2 +- drivers/net/ethernet/ti/cpsw_ethtool.c | 4 ++-- drivers/net/ethernet/ti/cpsw_priv.h | 2 +- drivers/net/ethernet/ti/icssg/icssg_ethtool.c | 2 +- drivers/net/ethernet/ti/netcp_ethss.c | 4 ++-- drivers/net/ethernet/xscale/ixp4xx_eth.c | 2 +- drivers/net/macvlan.c | 2 +- drivers/net/netdevsim/ethtool.c | 2 +- drivers/net/phy/bcm-phy-ptp.c | 2 +- drivers/net/phy/dp83640.c | 2 +- drivers/net/phy/micrel.c | 4 ++-- drivers/net/phy/mscc/mscc_ptp.c | 2 +- drivers/net/phy/nxp-c45-tja11xx.c | 2 +- drivers/ptp/ptp_ines.c | 2 +- drivers/s390/net/qeth_ethtool.c | 2 +- include/linux/can/dev.h | 2 +- include/linux/ethtool.h | 25 +++++++++++++++++++--- include/linux/mii_timestamper.h | 2 +- include/linux/phy.h | 2 +- include/net/dsa.h | 2 +- include/soc/mscc/ocelot.h | 2 +- net/8021q/vlan_dev.c | 2 +- net/dsa/user.c | 2 +- net/ethtool/common.c | 6 +++--- net/ethtool/common.h | 2 +- net/ethtool/ioctl.c | 14 +++++++++--- net/ethtool/tsinfo.c | 6 +++--- net/sched/sch_taprio.c | 2 +- 101 files changed, 151 insertions(+), 123 deletions(-) commit bc5a07ed15a3d30df3e8af2ef6bb0472f1d337f9 Author: Kory Maincent Date: Tue Jul 9 15:53:37 2024 +0200 net: net_tstamp: Add unspec field to hwtstamp_source enumeration Prepare for future support of saving hwtstamp source in PTP xarray by introducing HWTSTAMP_SOURCE_UNSPEC to hwtstamp_source enum, setting it to 0 to match old behavior of no source defined. Signed-off-by: Kory Maincent Link: https://patch.msgid.link/20240709-feature_ptp_netnext-v17-5-b5317f50df2a@bootlin.com Signed-off-by: Jakub Kicinski include/linux/net_tstamp.h | 1 + 1 file changed, 1 insertion(+) commit 2dd35600590148d843367c04975acad3c1a527c3 Author: Kory Maincent Date: Tue Jul 9 15:53:36 2024 +0200 net: Change the API of PHY default timestamp to MAC Change the API to select MAC default time stamping instead of the PHY. Indeed the PHY is closer to the wire therefore theoretically it has less delay than the MAC timestamping but the reality is different. Due to lower time stamping clock frequency, latency in the MDIO bus and no PHC hardware synchronization between different PHY, the PHY PTP is often less precise than the MAC. The exception is for PHY designed specially for PTP case but these devices are not very widespread. For not breaking the compatibility default_timestamp flag has been introduced in phy_device that is set by the phy driver to know we are using the old API behavior. Reviewed-by: Rahul Rameshbabu Signed-off-by: Kory Maincent Link: https://patch.msgid.link/20240709-feature_ptp_netnext-v17-4-b5317f50df2a@bootlin.com Signed-off-by: Jakub Kicinski drivers/net/phy/bcm-phy-ptp.c | 3 +++ drivers/net/phy/dp83640.c | 2 ++ drivers/net/phy/micrel.c | 6 ++++++ drivers/net/phy/mscc/mscc_ptp.c | 3 +++ drivers/net/phy/nxp-c45-tja11xx.c | 3 +++ include/linux/phy.h | 19 +++++++++++++++++++ net/core/dev_ioctl.c | 8 +++----- net/core/timestamping.c | 5 +++-- net/ethtool/common.c | 2 +- 9 files changed, 43 insertions(+), 8 deletions(-) commit 3fdd8ea39f0bcb6acff160a1fc6e331e7b21cbfc Merge: 462be1c35340 e61cc85edbbe Author: Rafael J. Wysocki Date: Mon Jul 15 16:59:14 2024 +0200 Merge tag 'thermal-v6.11-rc1' of ssh://gitolite.kernel.org/pub/scm/linux/kernel/git/thermal/linux into thermal Merge thermal drivers updates for 6.11-rc1 from Daniel Lezcano: "- Group all Renesas drivers inside a dedicated sub directory and add the missing dependency to OF (Niklas Söderlund) - Add suspend/resume support on k3_j72xx_bandgap and take the opportunity to remove a unneeded delay in the init time code path (Théo Lebrun) - Fix thermal zone definition for MT8186 and MT8188 (Julien Panis) - Convert hisilicon-thermal.txt to dt-schema (Abdulrasaq Lawani) - Add the DT bindings for the X1E80100 temperature sensor (Abel Vesa) - Fix the thermal zone node name regular expression in the DT schema (Krzysztof Kozlowski) - Take into account some production platforms may not have calibration data. Deal with it with a default value instead of failing the initialization (Chen-Yu Tsai) - Fix the sensor cell size on the Exynos platform (Krzysztof Kozlowski) - Bring the common definition of '#thermal-sensor-cells' property in order to simplify the bindings on all the platforms where this change makes sense and do some minor cleanups (Krzysztof Kozlowski) - Fix a race between removal and clock disable on the broadcom driver (Krzysztof Kozlowski) - Drop 'trips' node as required from the thermal zone bindings in order to fix the remaining warnings appearing with thermal zone whithout trip points defined (Rob Herring) - Simplify all the drivers where dev_err_probe() can apply (Krzysztof Kozlowski) - Cleanup code related to stih416 as this platform is not described anywhere (Raphael Gallais-Pou)" * tag 'thermal-v6.11-rc1' of ssh://gitolite.kernel.org/pub/scm/linux/kernel/git/thermal/linux: (45 commits) thermal/drivers/sti: Cleanup code related to stih416 thermal/drivers/generic-adc: Simplify with dev_err_probe() thermal/drivers/generic-adc: Simplify probe() with local dev variable thermal/drivers/qcom-tsens: Simplify with dev_err_probe() thermal/drivers/qcom-spmi-adc-tm5: Simplify with dev_err_probe() thermal/drivers/imx: Simplify with dev_err_probe() thermal/drivers/imx: Simplify probe() with local dev variable thermal/drivers/hisi: Simplify with dev_err_probe() thermal/drivers/exynos: Simplify with dev_err_probe() thermal/drivers/exynos: Simplify probe() with local dev variable thermal/drivers/broadcom: Simplify with dev_err_probe() thermal/drivers/broadcom: Simplify probe() with local dev variable thermal/drivers/broadcom: Fix race between removal and clock disable dt-bindings: thermal: Drop 'trips' node as required dt-bindings: thermal: qoriq: reference thermal-sensor schema dt-bindings: thermal: cleanup examples indentation dt-bindings: thermal: simplify few bindings dt-bindings: thermal: ti,j72xx: reference thermal-sensor schema dt-bindings: thermal: ti,am654: reference thermal-sensor schema dt-bindings: thermal: st,stm32: reference thermal-sensor schema ... commit 49e24c80d3c81c43e2a56101449e1eea32fcf292 Author: Marek Behún Date: Mon Jul 15 13:59:12 2024 +0200 firmware: turris-mox-rwtm: Initialize completion before mailbox Initialize the completion before the mailbox channel is requested. Fixes: 389711b37493 ("firmware: Add Turris Mox rWTM firmware driver") Signed-off-by: Marek Behún Reviewed-by: Andy Shevchenko Signed-off-by: Arnd Bergmann drivers/firmware/turris-mox-rwtm.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) commit 8467cfe821ac3526f7598682ad5f90689fa8cc49 Author: Marek Behún Date: Mon Jul 15 13:59:11 2024 +0200 firmware: turris-mox-rwtm: Fix checking return value of wait_for_completion_timeout() The wait_for_completion_timeout() function returns 0 if timed out, and a positive value if completed. Fix the usage of this function. Fixes: 389711b37493 ("firmware: Add Turris Mox rWTM firmware driver") Fixes: 2eab59cf0d20 ("firmware: turris-mox-rwtm: fail probing when firmware does not support hwrng") Signed-off-by: Marek Behún Reviewed-by: Ilpo Järvinen Reviewed-by: Andy Shevchenko Signed-off-by: Arnd Bergmann drivers/firmware/turris-mox-rwtm.c | 15 ++++++--------- 1 file changed, 6 insertions(+), 9 deletions(-) commit 0bafb172b111ab27251af0eb684e7bde9570ce4c Author: Marek Behún Date: Mon Jul 15 13:59:10 2024 +0200 firmware: turris-mox-rwtm: Do not complete if there are no waiters Do not complete the "command done" completion if there are no waiters. This can happen if a wait_for_completion() timed out or was interrupted. Fixes: 389711b37493 ("firmware: Add Turris Mox rWTM firmware driver") Signed-off-by: Marek Behún Reviewed-by: Andy Shevchenko Signed-off-by: Arnd Bergmann drivers/firmware/turris-mox-rwtm.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) commit 97b10a77b150df664bb521ae217dd6bceb40d5d3 Merge: e54dc34318f6 c51cba475560 Author: Takashi Iwai Date: Mon Jul 15 16:31:00 2024 +0200 Merge tag 'asoc-v6.11' of https://git.kernel.org/pub/scm/linux/kernel/git/broonie/sound into for-linus ASoC: Updates for for v6.11 There are a lot of changes in here, though the big bulk of things is cleanups and simplifications of various kinds which are internally rather than externally visible. A good chunk of those are DT schema conversions, but there's also a lot of changes in the code. Highlights: - Syncing of features between simple-audio-card and the two audio-graph cards so there is no reason to stick with an older driver. - Support for specifying the order of operations for components within cards to allow quirking for unusual systems. - New support for Asahi Kasei AK4619, Cirrus Logic CS530x, Everest Semiconductors ES8311, NXP i.MX95 and LPC32xx, Qualcomm LPASS v2.5 and WCD937x, Realtek RT1318 and RT1320 and Texas Instruments PCM5242. commit 7164122e25b18806f5dce68c8a0bdaa9e4f902a5 Author: Biju Das Date: Mon Jul 15 14:41:12 2024 +0100 regulator: renesas-usb-vbus-regulator: Update the default As the "rzg2l-usb-vbus-regulator" platform device is only created by drivers/reset/reset-rzg2l-usbphy-ctrl.c, update the default stricter by replacing ARCH_RZG2L->RESET_RZG2L_USBPHY_CTRL. Signed-off-by: Biju Das Reported-by: Geert Uytterhoeven Closes: https://lore.kernel.org/all/CAMuHMdX5ayWbLEEa6nAipECVB6H9eCpRg21pu3zYrTdiER0F+Q@mail.gmail.com/ Link: https://patch.msgid.link/20240715134120.312610-1-biju.das.jz@bp.renesas.com Signed-off-by: Mark Brown drivers/regulator/Kconfig | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 23e88450bb04f6b44ce4cacbd76cd775e426a5b2 Author: Nathan Chancellor Date: Wed Jul 10 10:56:24 2024 -0700 Bluetooth: btmtk: Mark all stub functions as inline Several recent patches added static stubs to btmtk.h without the inline keyword, which causes instances of -Wunused-function when those stubs are not used anywhere in a file that includes the header: In file included from drivers/bluetooth/btusb.c:28: drivers/bluetooth/btmtk.h:254:13: warning: 'btmtk_fw_get_filename' defined but not used [-Wunused-function] 254 | static void btmtk_fw_get_filename(char *buf, size_t size, u32 dev_id, | ^~~~~~~~~~~~~~~~~~~~~ drivers/bluetooth/btmtk.h:249:12: warning: 'btmtk_process_coredump' defined but not used [-Wunused-function] 249 | static int btmtk_process_coredump(struct hci_dev *hdev, struct sk_buff *skb) | ^~~~~~~~~~~~~~~~~~~~~~ drivers/bluetooth/btmtk.h:243:12: warning: 'btmtk_register_coredump' defined but not used [-Wunused-function] 243 | static int btmtk_register_coredump(struct hci_dev *hdev, const char *name, | ^~~~~~~~~~~~~~~~~~~~~~~ drivers/bluetooth/btmtk.h:233:12: warning: 'btmtk_setup_firmware' defined but not used [-Wunused-function] 233 | static int btmtk_setup_firmware(struct hci_dev *hdev, const char *fwname, | ^~~~~~~~~~~~~~~~~~~~ drivers/bluetooth/btmtk.h:227:12: warning: 'btmtk_setup_firmware_79xx' defined but not used [-Wunused-function] 227 | static int btmtk_setup_firmware_79xx(struct hci_dev *hdev, const char *fwname, | ^~~~~~~~~~~~~~~~~~~~~~~~~ Add inline to all the stubs in btmtk.h (even ones that do not currently have any warnings associated with them) to ensure there are never unused function warnings from these stubs, as is customary for the kernel. Signed-off-by: Nathan Chancellor Signed-off-by: Luiz Augusto von Dentz drivers/bluetooth/btmtk.h | 39 +++++++++++++++++++++------------------ 1 file changed, 21 insertions(+), 18 deletions(-) commit 84f9288208dfcd955446060a53add15b9e01af4e Author: Luiz Augusto von Dentz Date: Wed Jul 10 22:30:57 2024 -0400 Bluetooth: hci_qca: Fix build error This fixes the following build error introduced by b80f4e3b8cb8 ("Bluetooth: hci_qca: schedule a devm action for disabling the clock"): drivers/bluetooth/hci_qca.c: In function ‘qca_serdev_remove’: drivers/bluetooth/hci_qca.c:2501:2: error: label at end of compound statement 2501 | default: | ^~~~~~~ Fixes: b80f4e3b8cb8 ("Bluetooth: hci_qca: schedule a devm action for disabling the clock") Signed-off-by: Luiz Augusto von Dentz drivers/bluetooth/hci_qca.c | 1 + 1 file changed, 1 insertion(+) commit 921ad2879aa7733620585e4904ba673c6c916dab Author: Bartosz Golaszewski Date: Tue Jul 9 14:18:36 2024 +0200 Bluetooth: hci_qca: use the power sequencer for wcn7850 and wcn6855 In preparation for using the power sequencing subsystem on sm8650 boards and X13s laptop let's make pwrseq the default for wcn7850 and wcn6855. Both these models require an enable GPIO so we can safely assume that if the property is not there, then we should try to get the power sequencer. Due to how the pwrseq lookup works - checking the provider at run-time - we cannot really do it the other way around as we'd get stuck forever on -EPROBE_DEFER. If the relevant OF node does have the 'enable-gpios' property, we fallback to the existing code for backward compatibility with older DTs. Signed-off-by: Bartosz Golaszewski Signed-off-by: Luiz Augusto von Dentz drivers/bluetooth/hci_qca.c | 19 +++++++++++++++++-- 1 file changed, 17 insertions(+), 2 deletions(-) commit eba1718717b097d825f26a33ae7d8a5b9d478396 Author: Bartosz Golaszewski Date: Tue Jul 9 14:18:35 2024 +0200 Bluetooth: hci_qca: make pwrseq calls the default if available If the device has a power sequencing handle, use it first. Otherwise fall back to whatever code already exists. Signed-off-by: Bartosz Golaszewski Signed-off-by: Luiz Augusto von Dentz drivers/bluetooth/hci_qca.c | 24 +++++++++++++----------- 1 file changed, 13 insertions(+), 11 deletions(-) commit b8093157714fb0e1475909d744007d102efeaff1 Author: Bartosz Golaszewski Date: Tue Jul 9 14:18:34 2024 +0200 Bluetooth: hci_qca: unduplicate calls to hci_uart_register_device() Now that all three branches of the switch end up doing the same thing, we can move the call to hci_uart_register_device() past it and unify the error message. Signed-off-by: Bartosz Golaszewski Signed-off-by: Luiz Augusto von Dentz drivers/bluetooth/hci_qca.c | 23 ++++++----------------- 1 file changed, 6 insertions(+), 17 deletions(-) commit b80f4e3b8cb8a4a41cc038807cd0a1e889154902 Author: Bartosz Golaszewski Date: Tue Jul 9 14:18:33 2024 +0200 Bluetooth: hci_qca: schedule a devm action for disabling the clock In preparation for unduplicating the hci_uart registration code, schedule a devres action for disabling the SUSCLK rather than doing it manually. We cannot really use devm_clk_get_enabled() as we also set the rate before enabling the clock. While this should in theory work, I don't want to risk breaking existing users. One solution for the future is to add devm_clk_get_enabled_with_rate() to the clock framework. Signed-off-by: Bartosz Golaszewski Signed-off-by: Luiz Augusto von Dentz drivers/bluetooth/hci_qca.c | 23 +++++++++++++++-------- 1 file changed, 15 insertions(+), 8 deletions(-) commit bd3f305886adc07c27b8e998719c73688dad0991 Author: Bartosz Golaszewski Date: Tue Jul 9 14:18:32 2024 +0200 dt-bindings: bluetooth: qualcomm: describe the inputs from PMU for wcn7850 Drop the inputs from the host and instead expect the Bluetooth node to consume the outputs of the internal PMU. This model is closer to reality than how we represent it now. Signed-off-by: Bartosz Golaszewski Acked-by: Rob Herring (Arm) Signed-off-by: Luiz Augusto von Dentz .../bindings/net/bluetooth/qualcomm-bluetooth.yaml | 18 +++++++++++++----- 1 file changed, 13 insertions(+), 5 deletions(-) commit 3aa7901e44bb2b6f6d3a14ad5a47e07ec81dcd47 Author: Neeraj Sanjay Kale Date: Wed Jul 10 18:04:26 2024 +0530 Bluetooth: btnxpuart: Fix warnings for suspend and resume functions This fixes the warnings 'nxp_serdev_resume' and 'nxp_serdev_suspend' defined but not used. Signed-off-by: Neeraj Sanjay Kale Reported-by: kernel test robot Closes: https://lore.kernel.org/oe-kbuild-all/202407100518.06Xxq5PK-lkp@intel.com/ Signed-off-by: Luiz Augusto von Dentz drivers/bluetooth/btnxpuart.c | 2 ++ 1 file changed, 2 insertions(+) commit 658c56d5b3b3a41e52ea4236f5dd023cbb139ece Author: Neeraj Sanjay Kale Date: Fri Jul 5 12:28:26 2024 +0530 Bluetooth: btnxpuart: Add system suspend and resume handlers This adds handling for system suspend and resume. While the host enters suspend state, the driver will drive the chip into low power state. Similarly when system is resuming, the driver will wake up the chip. Signed-off-by: Neeraj Sanjay Kale Signed-off-by: Luiz Augusto von Dentz drivers/bluetooth/btnxpuart.c | 23 +++++++++++++++++++++++ 1 file changed, 23 insertions(+) commit d4f6acfcb0b0962e2a59165108e212a976d1f078 Author: Neeraj Sanjay Kale Date: Thu Jul 4 18:50:58 2024 +0530 Bluetooth: btnxpuart: Add support for IW615 chipset This adds support for IW615 chipset with it's bootloader signature and firmware file. Signed-off-by: Neeraj Sanjay Kale Signed-off-by: Luiz Augusto von Dentz drivers/bluetooth/btnxpuart.c | 13 +++++++++++++ 1 file changed, 13 insertions(+) commit e50bfd6bb231a6e2b7221ad78dce294330238c76 Author: Kory Maincent Date: Tue Jul 9 15:53:33 2024 +0200 net_tstamp: Add TIMESTAMPING SOFTWARE and HARDWARE mask Timestamping software or hardware flags are often used as a group, therefore adding these masks will ease future use. I did not use SOF_TIMESTAMPING_SYS_HARDWARE flag as it is deprecated and not used at all. Reviewed-by: Willem de Bruijn Reviewed-by: Florian Fainelli Signed-off-by: Kory Maincent Link: https://patch.msgid.link/20240709-feature_ptp_netnext-v17-1-b5317f50df2a@bootlin.com Signed-off-by: Jakub Kicinski include/linux/net_tstamp.h | 8 ++++++++ 1 file changed, 8 insertions(+) commit 358534152c59fdea7731c204d5a91151e4e91e2b Author: Neeraj Sanjay Kale Date: Thu Jul 4 18:50:57 2024 +0530 Bluetooth: btnxpuart: Add support for AW693 A1 chipset This adds support for AW693 A1 chipset with it's bootloader signature and firmware file. No firmware name change needed for AW693 A0 chipset. Signed-off-by: Neeraj Sanjay Kale Signed-off-by: Luiz Augusto von Dentz drivers/bluetooth/btnxpuart.c | 15 +++++++++++++-- 1 file changed, 13 insertions(+), 2 deletions(-) commit f6dc9214e526c2f735d93b5330f4dcd42a2b5308 Author: Kiran K Date: Fri Jul 5 15:59:23 2024 +0530 Bluetooth: btintel: Add support for Whale Peak2 from /sys/kernel/debug/usb/devices: T: Bus=03 Lev=01 Prnt=01 Port=09 Cnt=02 Dev#= 3 Spd=12 MxCh= 0 D: Ver= 2.00 Cls=e0(wlcon) Sub=01 Prot=01 MxPS=64 #Cfgs= 1 P: Vendor=8087 ProdID=0039 Rev= 0.00 C:* #Ifs= 2 Cfg#= 1 Atr=e0 MxPwr=100mA I:* If#= 0 Alt= 0 #EPs= 3 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb E: Ad=81(I) Atr=03(Int.) MxPS= 64 Ivl=1ms E: Ad=02(O) Atr=02(Bulk) MxPS= 64 Ivl=0ms E: Ad=82(I) Atr=02(Bulk) MxPS= 64 Ivl=0ms I:* If#= 1 Alt= 0 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb E: Ad=03(O) Atr=01(Isoc) MxPS= 0 Ivl=1ms E: Ad=83(I) Atr=01(Isoc) MxPS= 0 Ivl=1ms I: If#= 1 Alt= 1 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb E: Ad=03(O) Atr=01(Isoc) MxPS= 9 Ivl=1ms E: Ad=83(I) Atr=01(Isoc) MxPS= 9 Ivl=1ms I: If#= 1 Alt= 2 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb E: Ad=03(O) Atr=01(Isoc) MxPS= 17 Ivl=1ms E: Ad=83(I) Atr=01(Isoc) MxPS= 17 Ivl=1ms I: If#= 1 Alt= 3 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb E: Ad=03(O) Atr=01(Isoc) MxPS= 25 Ivl=1ms E: Ad=83(I) Atr=01(Isoc) MxPS= 25 Ivl=1ms I: If#= 1 Alt= 4 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb E: Ad=03(O) Atr=01(Isoc) MxPS= 33 Ivl=1ms E: Ad=83(I) Atr=01(Isoc) MxPS= 33 Ivl=1ms I: If#= 1 Alt= 5 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb E: Ad=03(O) Atr=01(Isoc) MxPS= 49 Ivl=1ms E: Ad=83(I) Atr=01(Isoc) MxPS= 49 Ivl=1ms I: If#= 1 Alt= 6 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb E: Ad=03(O) Atr=01(Isoc) MxPS= 63 Ivl=1ms E: Ad=83(I) Atr=01(Isoc) MxPS= 63 Ivl=1ms Signed-off-by: Kiran K Signed-off-by: Luiz Augusto von Dentz drivers/bluetooth/btusb.c | 1 + 1 file changed, 1 insertion(+) commit 880120d5f12e3e9af6472f2ddddb33a6c2648418 Author: Kiran K Date: Fri Jul 5 15:59:22 2024 +0530 Bluetooth: btintel: Add support for BlazarU core Add support for BlazarU core (CNVi). Signed-off-by: Kiran K Signed-off-by: Luiz Augusto von Dentz drivers/bluetooth/btintel.c | 3 +++ 1 file changed, 3 insertions(+) commit ceac1cb0259de682d78f5c784ef8e0b13022e9d9 Author: Chris Lu Date: Thu Jul 4 14:01:16 2024 +0800 Bluetooth: btusb: mediatek: add ISO data transmission functions This patch implements functions for ISO data send and receive in btusb driver for MediaTek's controller. MediaTek defines a specific interrupt endpoint for ISO data transmissin because the characteristics of interrupt endpoint are similar to the application of ISO data which can support guaranteed transmissin bandwidth, enough maximum data length and error checking mechanism. Driver sets up ISO interface and endpoints in btusb_mtk_setup and clears the setup in btusb_mtk_shutdown. These flow can't move to btmtk.c due to btusb_driver is only defined in btusb.c when claiming/relaesing interface. ISO packet anchor stops when driver suspending and resubmit interrupt urb for ISO data when driver resuming. Signed-off-by: Chris Lu Signed-off-by: Luiz Augusto von Dentz drivers/bluetooth/btmtk.c | 311 ++++++++++++++++++++++++++++++++++++++++++++++ drivers/bluetooth/btmtk.h | 36 ++++++ drivers/bluetooth/btusb.c | 68 ++++++++++ 3 files changed, 415 insertions(+) commit 6dc22ab9f085ae165e4ce89d61fb426f94e8a969 Author: Chris Lu Date: Thu Jul 4 14:01:15 2024 +0800 Bluetooth: btmtk: move btusb_recv_acl_mtk to btmtk.c Move btusb_recv_acl_mtk from btusb.c to btmtk.c which holds vendor specific stuff and would make btusb.c clean. Signed-off-by: Sean Wang Signed-off-by: Chris Lu Signed-off-by: Luiz Augusto von Dentz drivers/bluetooth/btmtk.c | 33 +++++++++++++++++++++++++++++++++ drivers/bluetooth/btmtk.h | 7 +++++++ drivers/bluetooth/btusb.c | 34 +--------------------------------- 3 files changed, 41 insertions(+), 33 deletions(-) commit 5c5e8c52e3cafaa6f71efd44a42a674271e5b3ad Author: Chris Lu Date: Thu Jul 4 14:01:14 2024 +0800 Bluetooth: btmtk: move btusb_mtk_[setup, shutdown] to btmtk.c Move btusb_mtk_[setup, shutdown] and related function from btusb.c to btmtk.c which holds vendor specific stuff and would make btusb.c clean. Signed-off-by: Sean Wang Signed-off-by: Chris Lu Signed-off-by: Luiz Augusto von Dentz drivers/bluetooth/btmtk.c | 454 +++++++++++++++++++++++++++++++++++++++++++++- drivers/bluetooth/btmtk.h | 23 ++- drivers/bluetooth/btusb.c | 452 ++------------------------------------------- 3 files changed, 484 insertions(+), 445 deletions(-) commit d019930b0049fc2648a6b279893d8ad330596e81 Author: Chris Lu Date: Thu Jul 4 14:01:13 2024 +0800 Bluetooth: btmtk: move btusb_mtk_hci_wmt_sync to btmtk.c Move btusb_mtk_hci_wmt_sync from btusb.c to btmtk.c which holds vendor specific stuff and would make btusb.c clean. Add usb.h header to btmtksdio.c/btmtkuart.c for usb related element defined in btmtk.h Signed-off-by: Sean Wang Signed-off-by: Chris Lu Signed-off-by: Luiz Augusto von Dentz drivers/bluetooth/btmtk.c | 265 ++++++++++++++++++++++++++++++++++++++ drivers/bluetooth/btmtk.h | 31 +++++ drivers/bluetooth/btmtksdio.c | 1 + drivers/bluetooth/btmtkuart.c | 1 + drivers/bluetooth/btusb.c | 290 +----------------------------------------- 5 files changed, 305 insertions(+), 283 deletions(-) commit 95f92928ad2215b5f524903e67eebd8e14f99564 Author: Chris Lu Date: Thu Jul 4 14:01:12 2024 +0800 Bluetooth: btusb: add callback function in btusb suspend/resume Add suspend/resum callback function in btusb_data which are reserved for vendor specific usage during suspend/resume. hdev->suspend will be added before stop traffic in btusb_suspend and hdev-> resume will be added after resubmit urb in btusb_resume. Signed-off-by: Chris Lu Signed-off-by: Sean Wang Signed-off-by: Luiz Augusto von Dentz drivers/bluetooth/btusb.c | 9 +++++++++ 1 file changed, 9 insertions(+) commit d3e6236053958a8f1c7c7a885d9cecdd383e4615 Author: Chris Lu Date: Thu Jul 4 14:01:11 2024 +0800 Bluetooth: btmtk: rename btmediatek_data Rename btmediatek_data to have a consistent prefix throughout the driver. Signed-off-by: Sean Wang Signed-off-by: Chris Lu Signed-off-by: Luiz Augusto von Dentz drivers/bluetooth/btmtk.c | 10 +++++----- drivers/bluetooth/btmtk.h | 2 +- drivers/bluetooth/btusb.c | 9 ++++----- 3 files changed, 10 insertions(+), 11 deletions(-) commit 3dcb122b30643444352ff4b9aa16367dd24d7571 Author: Chris Lu Date: Thu Jul 4 14:01:10 2024 +0800 Bluetooth: btusb: mediatek: return error for failed reg access Update the code to immediately return an error code if accessing a related register fails. This ensures that our desired logic for subsequent register operations is maintained and allows us to promptly catch any unexpected errors. Signed-off-by: Sean Wang Signed-off-by: Chris Lu Signed-off-by: Luiz Augusto von Dentz drivers/bluetooth/btusb.c | 114 ++++++++++++++++++++++++++++++++++------------ 1 file changed, 84 insertions(+), 30 deletions(-) commit be71dfb9ad2042bba713975ef50c3a5b0429f1d2 Author: Chris Lu Date: Thu Jul 4 14:01:09 2024 +0800 Bluetooth: btusb: mediatek: remove the unnecessary goto tag Remove the unnecessary goto tag whether there is an error or not, we have to free the buffer at the end of the function. Signed-off-by: Sean Wang Signed-off-by: Chris Lu Signed-off-by: Luiz Augusto von Dentz drivers/bluetooth/btusb.c | 5 +---- 1 file changed, 1 insertion(+), 4 deletions(-) commit 936daee9cf08c5e58c9a0fe687f52adb2d80e87d Author: Luiz Augusto von Dentz Date: Mon Jul 1 17:10:41 2024 -0400 Bluetooth: Remove hci_request.{c,h} This removes hci_request.{c,h} since it shall no longer be used. Signed-off-by: Luiz Augusto von Dentz include/net/bluetooth/bluetooth.h | 4 + net/bluetooth/Makefile | 3 +- net/bluetooth/hci_conn.c | 1 - net/bluetooth/hci_core.c | 1 - net/bluetooth/hci_debugfs.c | 1 - net/bluetooth/hci_event.c | 1 - net/bluetooth/hci_request.c | 903 -------------------------------------- net/bluetooth/hci_request.h | 54 --- net/bluetooth/mgmt.c | 1 - net/bluetooth/msft.c | 1 - 10 files changed, 5 insertions(+), 965 deletions(-) commit f2d89775358606c7ab6b6b6c4a02fe1e8cd270b1 Author: Luiz Augusto von Dentz Date: Mon Jul 1 16:52:57 2024 -0400 Bluetooth: hci_sync: Remove remaining dependencies of hci_request This removes the dependencies of hci_req_init and hci_request_cancel_all from hci_sync.c. Signed-off-by: Luiz Augusto von Dentz include/net/bluetooth/hci_sync.h | 17 +++++++++++++++++ net/bluetooth/hci_request.h | 17 ----------------- net/bluetooth/hci_sync.c | 14 +++++++++++--- 3 files changed, 28 insertions(+), 20 deletions(-) commit 8bedf130c265384fb136b19b20504239240c51bf Author: Luiz Augusto von Dentz Date: Mon Jul 1 16:50:30 2024 -0400 Bluetooth: hci_sync: Move handling of interleave_scan This moves handling of interleave_scan work to hci_sync.c since hci_request.c is deprecated. Signed-off-by: Luiz Augusto von Dentz net/bluetooth/hci_core.c | 3 +-- net/bluetooth/hci_sync.c | 53 +++++++++++++++++++++++++++++++++++++++++++----- 2 files changed, 49 insertions(+), 7 deletions(-) commit 176cbeceb5c5a740216a6be3e751e76aaddf94b9 Author: Luiz Augusto von Dentz Date: Mon Jul 1 16:13:56 2024 -0400 Bluetooth: hci_core: Don't use hci_prepare_cmd This replaces the instance of hci_prepare_cmd with hci_cmd_sync_alloc since the former is part of hci_request.c which is considered deprecated. Signed-off-by: Luiz Augusto von Dentz include/net/bluetooth/hci_sync.h | 4 ++++ net/bluetooth/hci_core.c | 4 ++-- net/bluetooth/hci_sync.c | 5 ++--- 3 files changed, 8 insertions(+), 5 deletions(-) commit 92048ab2e2e6cc90ad1cc9f55deb5cec4d731793 Author: Luiz Augusto von Dentz Date: Mon Jul 1 16:00:08 2024 -0400 Bluetooth: hci_core: Remove usage of hci_req_sync hci_request functions are considered deprecated so this replaces the usage of hci_req_sync with hci_inquiry_sync. Signed-off-by: Luiz Augusto von Dentz include/net/bluetooth/hci_sync.h | 2 ++ net/bluetooth/hci_core.c | 29 ++++------------------------- net/bluetooth/hci_sync.c | 10 +++++----- 3 files changed, 11 insertions(+), 30 deletions(-) commit 88b73fdc8144de7daf1156509df4d82830f48202 Author: Rafał Miłecki Date: Fri Jun 28 07:46:35 2024 +0200 dt-bindings: net: bluetooth: convert MT7622 Bluetooth to the json-schema This helps validating DTS files. Introduced changes: 1. Dropped serial details from example 2. Added required example include Signed-off-by: Rafał Miłecki Reviewed-by: Rob Herring (Arm) Signed-off-by: Luiz Augusto von Dentz .../net/bluetooth/mediatek,mt7622-bluetooth.yaml | 51 ++++++++++++++++++++++ .../devicetree/bindings/net/mediatek-bluetooth.txt | 36 --------------- 2 files changed, 51 insertions(+), 36 deletions(-) commit 87be7b189b2c50d4b51512f59e4e97db4eedee8a Author: Luiz Augusto von Dentz Date: Mon Jul 1 12:07:46 2024 -0400 Bluetooth: Fix usage of __hci_cmd_sync_status __hci_cmd_sync_status shall only be used if hci_req_sync_lock is _not_ required which is not the case of hci_dev_cmd so it needs to use hci_cmd_sync_status which uses hci_req_sync_lock internally. Fixes: f1a8f402f13f ("Bluetooth: L2CAP: Fix deadlock") Reported-by: Pauli Virtanen Signed-off-by: Luiz Augusto von Dentz net/bluetooth/hci_core.c | 27 ++++++++++++--------------- 1 file changed, 12 insertions(+), 15 deletions(-) commit 473a89b4ed7fd52a419340f7c540d5c8fc96fc75 Author: WangYuli Date: Sat Jun 22 12:09:59 2024 +0800 Bluetooth: btusb: Add Realtek RTL8852BE support ID 0x13d3:0x3591 Add the support ID(0x13d3, 0x3591) to usb_device_id table for Realtek RTL8852BE. The device table is as follows: T: Bus=01 Lev=02 Prnt=03 Port=00 Cnt=01 Dev#= 5 Spd=12 MxCh= 0 D: Ver= 1.00 Cls=e0(wlcon) Sub=01 Prot=01 MxPS=64 #Cfgs= 1 P: Vendor=13d3 ProdID=3591 Rev= 0.00 S: Manufacturer=Realtek S: Product=Bluetooth Radio S: SerialNumber=00e04c000001 C:* #Ifs= 2 Cfg#= 1 Atr=e0 MxPwr=500mA I:* If#= 0 Alt= 0 #EPs= 3 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb E: Ad=81(I) Atr=03(Int.) MxPS= 16 Ivl=1ms E: Ad=02(O) Atr=02(Bulk) MxPS= 64 Ivl=0ms E: Ad=82(I) Atr=02(Bulk) MxPS= 64 Ivl=0ms I:* If#= 1 Alt= 0 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb E: Ad=03(O) Atr=01(Isoc) MxPS= 0 Ivl=1ms E: Ad=83(I) Atr=01(Isoc) MxPS= 0 Ivl=1ms I: If#= 1 Alt= 1 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb E: Ad=03(O) Atr=01(Isoc) MxPS= 9 Ivl=1ms E: Ad=83(I) Atr=01(Isoc) MxPS= 9 Ivl=1ms I: If#= 1 Alt= 2 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb E: Ad=03(O) Atr=01(Isoc) MxPS= 17 Ivl=1ms E: Ad=83(I) Atr=01(Isoc) MxPS= 17 Ivl=1ms I: If#= 1 Alt= 3 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb E: Ad=03(O) Atr=01(Isoc) MxPS= 25 Ivl=1ms E: Ad=83(I) Atr=01(Isoc) MxPS= 25 Ivl=1ms I: If#= 1 Alt= 4 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb E: Ad=03(O) Atr=01(Isoc) MxPS= 33 Ivl=1ms E: Ad=83(I) Atr=01(Isoc) MxPS= 33 Ivl=1ms I: If#= 1 Alt= 5 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb E: Ad=03(O) Atr=01(Isoc) MxPS= 49 Ivl=1ms E: Ad=83(I) Atr=01(Isoc) MxPS= 49 Ivl=1ms Cc: stable@vger.kernel.org Signed-off-by: Wentao Guan Signed-off-by: WangYuli Signed-off-by: Luiz Augusto von Dentz drivers/bluetooth/btusb.c | 2 ++ 1 file changed, 2 insertions(+) commit 3ba74b2f288bbc17c0c2a58ab219e1df19f80153 Author: Dmitry Antipov Date: Fri Jun 21 16:01:55 2024 +0300 Bluetooth: hci_core: cleanup struct hci_dev Remove unused and set but otherwise unused 'discovery_old_state' and 'sco_last_tx' members of 'struct hci_dev'. The first one is a leftover after commit 182ee45da083 ("Bluetooth: hci_sync: Rework hci_suspend_notifier"); the second one is originated from ancient 2.4.19 and I was unable to find any actual use since that. Signed-off-by: Dmitry Antipov Reviewed-by: Paul Menzel Signed-off-by: Luiz Augusto von Dentz include/net/bluetooth/hci_core.h | 2 -- net/bluetooth/hci_sync.c | 1 - 2 files changed, 3 deletions(-) commit 1723b550b66aebea9b8e9d6fb5f3c468adea69ce Author: Kiran K Date: Thu Jun 27 18:36:39 2024 +0530 Bluetooth: btintel: Fix the sfi name for BlazarU Use INTEL_HW_VARIANT() instead of CNVi Id to decide to load Intermediate Loader (IML) image. Fix the driver loading incorrect firmware for BlazarU product. dmesg: ..... [146.111834] Bluetooth: hci0: Minimum firmware build 1 week 10 2014 [146.111839] Bluetooth: hci0: Bootloader timestamp 2022.18 buildtype 1 build 16362 [146.111848] Bluetooth: hci0: No support for _PRR ACPI method [146.112204] Bluetooth: hci0: Failed to load Intel firmware file intel/ibt-0291-0291-iml.sfi (-2) Fixes: 164c62f958f8 ("Bluetooth: btintel: Add firmware ID to firmware name") Reported-by: Tsigan, Vladislav Signed-off-by: Kiran K Signed-off-by: Luiz Augusto von Dentz drivers/bluetooth/btintel.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) commit fb5e4713fc185f6283ba0704edccea312253e805 Author: Bartosz Golaszewski Date: Mon Jun 24 21:45:18 2024 +0200 Bluetooth: qca: don't disable power management for QCA6390 We unnecessarily fallthrough the case for QCA6390 when initializing the device and hit the condition where - due to the lack of the enable-gpio - we disable power management despite using the power sequencer. We don't need to look for clocks on this model so it makes more sense to just register the hci device and break the switch. Reported-by: Dmitry Baryshkov Fixes: 9a15ce685706 ("Bluetooth: qca: use the power sequencer for QCA6390") Signed-off-by: Bartosz Golaszewski Acked-by: Dmitry Baryshkov Tested-by: Dmitry Baryshkov # RB5 Signed-off-by: Luiz Augusto von Dentz drivers/bluetooth/hci_qca.c | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-) commit b96bac9607b285d4316e74fbf469df084c4f8adb Author: Krzysztof Kozlowski Date: Sun Jun 23 19:13:52 2024 +0200 Bluetooth: hci: fix build when POWER_SEQUENCING=m BT_HCIUART_QCA, which is a bool and an HCI UART component, uses now power sequencing, so we need to be sure BT_HCIUART_QCA=y and POWER_SEQUENCING=m cannot happen: /usr/bin/aarch64-linux-gnu-ld: drivers/bluetooth/hci_qca.o: in function `qca_serdev_probe': drivers/bluetooth/hci_qca.c:2401:(.text+0xc48): undefined reference to `devm_pwrseq_get' /usr/bin/aarch64-linux-gnu-ld: drivers/bluetooth/hci_qca.o: in function `qca_power_shutdown': drivers/bluetooth/hci_qca.c:2192:(.text+0x29e8): undefined reference to `pwrseq_power_off' /usr/bin/aarch64-linux-gnu-ld: drivers/bluetooth/hci_qca.o: in function `qca_power_on': drivers/bluetooth/hci_qca.c:1808:(.text+0x3390): undefined reference to `pwrseq_power_on' Fixes: 9a15ce685706 ("Bluetooth: qca: use the power sequencer for QCA6390") Signed-off-by: Krzysztof Kozlowski Reviewed-by: Bartosz Golaszewski Signed-off-by: Luiz Augusto von Dentz drivers/bluetooth/Kconfig | 1 + 1 file changed, 1 insertion(+) commit 519d849acb6523a9e9500f7a4345018fe92a131a Author: Paul Menzel Date: Fri Jun 21 09:18:57 2024 +0200 Bluetooth: btintel: Fix spelling of *intermediate* in comment Fixes: f3b845e0aea3 ("Bluetooth: btintel: Add support to download intermediate loader") Cc: Kiran K Signed-off-by: Paul Menzel Signed-off-by: Luiz Augusto von Dentz drivers/bluetooth/btintel.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 9a15ce685706e73154f03341b35ff5943e46d039 Author: Bartosz Golaszewski Date: Wed Jun 12 10:01:50 2024 +0200 Bluetooth: qca: use the power sequencer for QCA6390 Use the pwrseq subsystem's consumer API to run the power-up sequence for the Bluetooth module of the QCA6390 package. Tested-by: Amit Pundir Tested-by: Neil Armstrong # on SM8550-QRD, SM8650-QRD & SM8650-HDK Tested-by: Caleb Connolly # OnePlus 8T Signed-off-by: Bartosz Golaszewski Signed-off-by: Luiz Augusto von Dentz drivers/bluetooth/hci_qca.c | 74 ++++++++++++++++++++++++++++++++++++--------- 1 file changed, 59 insertions(+), 15 deletions(-) commit 66ef82c66e9c462c893909b35ee4cbdfccf02bb2 Author: Bartosz Golaszewski Date: Wed Jun 12 10:01:49 2024 +0200 dt-bindings: net: bluetooth: qualcomm: describe regulators for QCA6390 QCA6390 has a compatible listed in the bindings but is missing the regulators description. Add the missing supply property and list the required ones in the allOf section. Reviewed-by: Krzysztof Kozlowski Signed-off-by: Bartosz Golaszewski Signed-off-by: Luiz Augusto von Dentz .../bindings/net/bluetooth/qualcomm-bluetooth.yaml | 17 +++++++++++++++++ 1 file changed, 17 insertions(+) commit f497862d99ddbf4e46d6e26cd0f40adb724f55c9 Merge: 164c62f958f8 2f1630f437df Author: Luiz Augusto von Dentz Date: Mon Jul 15 10:09:20 2024 -0400 Merge tag 'pwrseq-initial-for-v6.11' of git://git.kernel.org/pub/scm/linux/kernel/git/brgl/linux into HEAD Initial implementation of the power sequencing subsystem for linux v6.11 commit e54dc34318f62bdeea7edefed386d47fae155618 Author: Takashi Iwai Date: Mon Jul 15 14:36:45 2024 +0200 ALSA: usb: Use BIT() for bit values Instead of the explicit "1 << x", use BIT() macro for one bit values. This will improve the readability and also avoids the possible bad value for 31bit shift. Link: https://patch.msgid.link/20240715123646.26679-1-tiwai@suse.de Signed-off-by: Takashi Iwai sound/usb/format.c | 17 +++++++---------- sound/usb/mixer.c | 38 +++++++++++++++++++------------------- sound/usb/mixer_quirks.c | 20 ++++++++++---------- 3 files changed, 36 insertions(+), 39 deletions(-) commit 2f38cf730caedaeacdefb7ff35b0a3c1168117f9 Author: Takashi Iwai Date: Mon Jul 15 14:35:54 2024 +0200 ALSA: usb: Fix UBSAN warning in parse_audio_unit() A malformed USB descriptor may pass the lengthy mixer description with a lot of channels, and this may overflow the 32bit integer shift size, as caught by syzbot UBSAN test. Although this won't cause any real trouble, it's better to address. This patch introduces a sanity check of the number of channels to bail out the parsing when too many channels are found. Reported-by: syzbot+78d5b129a762182225aa@syzkaller.appspotmail.com Closes: https://lore.kernel.org/0000000000000adac5061d3c7355@google.com Link: https://patch.msgid.link/20240715123619.26612-1-tiwai@suse.de Signed-off-by: Takashi Iwai sound/usb/mixer.c | 7 +++++++ 1 file changed, 7 insertions(+) commit 9283477e28913c1e7625c0a8d6959745e2431533 Author: Aleksander Jan Bajkowski Date: Sat Jul 13 19:09:20 2024 +0200 net: ethernet: lantiq_etop: remove redundant device name setup The same name is set when allocating the netdevice structure in the alloc_etherdev_mq()->alloc_etherrdev_mqs() function. Therefore, there is no need to manually set it. This fixes CheckPatch warnings: WARNING: Prefer strscpy over strcpy - see: https://github.com/KSPP/linux/issues/88 strcpy(dev->name, "eth%d"); Signed-off-by: Aleksander Jan Bajkowski Link: https://patch.msgid.link/20240713170920.863171-1-olek2@wp.pl Signed-off-by: Jakub Kicinski drivers/net/ethernet/lantiq_etop.c | 1 - 1 file changed, 1 deletion(-) commit c49379dcda748adb8ba84d7a8eb3b02d4f1ebfcf Merge: a8ea8d531d1e 259a7061c2f1 Author: Jakub Kicinski Date: Mon Jul 15 06:55:19 2024 -0700 Merge branch 'net-dsa-vsc73xx-implement-vlan-operations' Pawel Dembicki says: ==================== net: dsa: vsc73xx: Implement VLAN operations This patch series is a result of splitting a larger patch series [0], where some parts was merged before. The first patch implements port state configuration, which is required for bridge functionality. STP frames are not forwarded at this moment. BPDU frames are only forwarded from/to the PI/SI interface. For more information, see chapter 2.7.1 (CPU Forwarding) in the datasheet. Patches 2, 7-9 and 11 provide a basic implementation of tag_8021q functionality with QinQ support, without VLAN filtering in the bridge and simple VLAN awareness in VLAN filtering mode. Patches 3-6 came from Vladimir Oltean. They prepare for making tag8021q more common. VSC73XX uses very similar tag recognition, and some code from tag_sja1105 could be moved to tag_8021q for common use. Patch 10 is preparation for use tag_8021q bridge functions as generic implementation of the 'ds->ops->port_bridge_*()'. Patch 12 is required to avoid problem with learning on standalone ports. [0] https://patchwork.kernel.org/project/netdevbpf/list/?series=841034&state=%2A&archive=both ==================== Link: https://patch.msgid.link/20240713211620.1125910-1-paweldembicki@gmail.com Signed-off-by: Jakub Kicinski commit 259a7061c2f14bbf5845598f69ac63cdb77d6346 Author: Pawel Dembicki Date: Sat Jul 13 23:16:18 2024 +0200 net: dsa: vsc73xx: start treating the BR_LEARNING flag This patch implements .port_pre_bridge_flags() and .port_bridge_flags(), which are required for properly treating the BR_LEARNING flag. Also, .port_stp_state_set() is tweaked and now disables learning for standalone ports. Disabling learning for standalone ports is required to avoid situations where one port sees traffic originating from another, which could cause packet drops. Signed-off-by: Pawel Dembicki Acked-by: Linus Walleij Reviewed-by: Florian Fainelli Reviewed-by: Vladimir Oltean Link: https://patch.msgid.link/20240713211620.1125910-13-paweldembicki@gmail.com Signed-off-by: Jakub Kicinski drivers/net/dsa/vitesse-vsc73xx-core.c | 41 +++++++++++++++++++++++++++++----- 1 file changed, 35 insertions(+), 6 deletions(-) commit 6dfaaa27633711ba52c418d578b3a13b0c8bfd8d Author: Pawel Dembicki Date: Sat Jul 13 23:16:17 2024 +0200 net: dsa: vsc73xx: Add bridge support This patch adds bridge support for the vsc73xx driver. The vsc73xx requires minimal operations and ithe generic dsa_tag_8021q_bridge_* API is sufficient. The forwarding matrix is managed by vsc73xx_port_stp_state_set() -> vsc73xx_refresh_fwd_map()i routine, which is called immediately after .port_bridge_join() and .port_bridge_leave(). Reviewed-by: Vladimir Oltean Signed-off-by: Pawel Dembicki Link: https://patch.msgid.link/20240713211620.1125910-12-paweldembicki@gmail.com Signed-off-by: Jakub Kicinski drivers/net/dsa/vitesse-vsc73xx-core.c | 5 +++++ 1 file changed, 5 insertions(+) commit 85aabd1fe9d6af4dc5d11a2d8be567ec45d1dc5e Author: Pawel Dembicki Date: Sat Jul 13 23:16:16 2024 +0200 net: dsa: prepare 'dsa_tag_8021q_bridge_join' for standalone use The 'dsa_tag_8021q_bridge_join' could be used as a generic implementation of the 'ds->ops->port_bridge_join()' function. However, it is necessary to synchronize their arguments. This patch also moves the 'tx_fwd_offload' flag configuration line into 'dsa_tag_8021q_bridge_join' body. Currently, every (sja1105) driver sets it, and the future vsc73xx implementation will also need it for simplification. Suggested-by: Vladimir Oltean Signed-off-by: Pawel Dembicki Reviewed-by: Vladimir Oltean Link: https://patch.msgid.link/20240713211620.1125910-11-paweldembicki@gmail.com Signed-off-by: Jakub Kicinski drivers/net/dsa/sja1105/sja1105_main.c | 5 ++--- include/linux/dsa/8021q.h | 3 ++- net/dsa/tag_8021q.c | 5 ++++- 3 files changed, 8 insertions(+), 5 deletions(-) commit ce20fdd670ac375a4e3dff91c2888ad9ff9eef56 Author: Pawel Dembicki Date: Sat Jul 13 23:16:15 2024 +0200 net: dsa: Define max num of bridges in tag8021q implementation Max number of bridges in tag8021q implementation is strictly limited by VBID size: 3 bits. But zero is reserved and only 7 values can be used. This patch adds define which describe maximum possible value. Suggested-by: Vladimir Oltean Signed-off-by: Pawel Dembicki Reviewed-by: Florian Fainelli Reviewed-by: Linus Walleij Reviewed-by: Vladimir Oltean Link: https://patch.msgid.link/20240713211620.1125910-10-paweldembicki@gmail.com Signed-off-by: Jakub Kicinski drivers/net/dsa/sja1105/sja1105_main.c | 3 +-- include/linux/dsa/8021q.h | 5 +++++ 2 files changed, 6 insertions(+), 2 deletions(-) commit e3386ec4ec9083522c36ab0ddfc638c90395c741 Author: Pawel Dembicki Date: Sat Jul 13 23:16:14 2024 +0200 net: dsa: vsc73xx: Implement the tag_8021q VLAN operations This patch is a simple implementation of 802.1q tagging in the vsc73xx driver. Currently, devices with DSA_TAG_PROTO_NONE are not functional. The VSC73XX family doesn't provide any tag support for external Ethernet ports. The only option available is VLAN-based tagging, which requires constant hardware VLAN filtering. While the VSC73XX family supports provider bridging, it only supports QinQ without full implementation of 802.1AD. This means it only allows the doubled 0x8100 TPID. In the simple port mode, QinQ is enabled to preserve forwarding of VLAN-tagged frames. Signed-off-by: Pawel Dembicki Reviewed-by: Vladimir Oltean Link: https://patch.msgid.link/20240713211620.1125910-9-paweldembicki@gmail.com Signed-off-by: Jakub Kicinski drivers/net/dsa/Kconfig | 2 +- drivers/net/dsa/vitesse-vsc73xx-core.c | 73 ++++++++++++++++++++++++++++++++-- 2 files changed, 71 insertions(+), 4 deletions(-) commit 6c87e1a4792804efce8ab3dfdb6e9ada314ec6dd Author: Pawel Dembicki Date: Sat Jul 13 23:16:13 2024 +0200 net: dsa: vsc73xx: introduce tag 8021q for vsc73xx This commit introduces a new tagger based on 802.1q tagging. It's designed for the vsc73xx driver. The VSC73xx family doesn't have any tag support for the RGMII port, but it could be based on VLANs. Reviewed-by: Florian Fainelli Reviewed-by: Vladimir Oltean Signed-off-by: Pawel Dembicki Reviewed-by: Linus Walleij Link: https://patch.msgid.link/20240713211620.1125910-8-paweldembicki@gmail.com Signed-off-by: Jakub Kicinski include/net/dsa.h | 2 ++ net/dsa/Kconfig | 6 ++++ net/dsa/Makefile | 1 + net/dsa/tag_vsc73xx_8021q.c | 68 +++++++++++++++++++++++++++++++++++++++++++++ 4 files changed, 77 insertions(+) commit d124cf54df6fafa5ab63d3ee40d64bd54487b5cc Author: Vladimir Oltean Date: Sat Jul 13 23:16:12 2024 +0200 net: dsa: tag_sja1105: refactor skb->dev assignment to dsa_tag_8021q_find_user() A new tagging protocol implementation based on tag_8021q is on the horizon, and it appears that it also has to open-code the complicated logic of finding a source port based on a VLAN header. Create a single dsa_tag_8021q_find_user() and make sja1105 call it. Signed-off-by: Vladimir Oltean Signed-off-by: Pawel Dembicki Reviewed-by: Florian Fainelli Link: https://patch.msgid.link/20240713211620.1125910-7-paweldembicki@gmail.com Signed-off-by: Jakub Kicinski net/dsa/tag_8021q.c | 19 ++++++++++++++++--- net/dsa/tag_8021q.h | 5 +++-- net/dsa/tag_sja1105.c | 17 +++++------------ 3 files changed, 24 insertions(+), 17 deletions(-) commit 823e5cc141c6408b470b8302dd8b5082636fbfaf Author: Vladimir Oltean Date: Sat Jul 13 23:16:11 2024 +0200 net: dsa: tag_sja1105: prefer precise source port info on SJA1110 too Now that dsa_8021q_rcv() handles better the case where we don't overwrite the precise source information if it comes from an external (non-tag_8021q) source, we can now unify the call sequence between sja1105_rcv() and sja1110_rcv(). This is a preparatory change for creating a higher-level wrapper for the entire sequence which will live in tag_8021q. Signed-off-by: Vladimir Oltean Signed-off-by: Pawel Dembicki Reviewed-by: Vladimir Oltean Link: https://patch.msgid.link/20240713211620.1125910-6-paweldembicki@gmail.com Signed-off-by: Jakub Kicinski net/dsa/tag_sja1105.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) commit 0064b863abdc7bd5e209cdbce7619464069458fe Author: Vladimir Oltean Date: Sat Jul 13 23:16:10 2024 +0200 net: dsa: tag_sja1105: absorb entire sja1105_vlan_rcv() into dsa_8021q_rcv() tag_sja1105 has a wrapper over dsa_8021q_rcv(): sja1105_vlan_rcv(), which determines whether the packet came from a bridge with vlan_filtering=1 (the case resolved via dsa_find_designated_bridge_port_by_vid()), or if it contains a tag_8021q header. Looking at a new tagger implementation for vsc73xx, based also on tag_8021q, it is becoming clear that the logic is needed there as well. So instead of forcing each tagger to wrap around dsa_8021q_rcv(), let's merge the logic into the core. Signed-off-by: Vladimir Oltean Reviewed-by: Vladimir Oltean Tested-by: Vladimir Oltean Signed-off-by: Pawel Dembicki Link: https://patch.msgid.link/20240713211620.1125910-5-paweldembicki@gmail.com Signed-off-by: Jakub Kicinski net/dsa/tag_8021q.c | 34 ++++++++++++++++++++++++++++------ net/dsa/tag_8021q.h | 2 +- net/dsa/tag_ocelot_8021q.c | 2 +- net/dsa/tag_sja1105.c | 32 ++++---------------------------- 4 files changed, 34 insertions(+), 36 deletions(-) commit dcfe7673787b4bfea2c213df443d312aa754757b Author: Vladimir Oltean Date: Sat Jul 13 23:16:09 2024 +0200 net: dsa: tag_sja1105: absorb logic for not overwriting precise info into dsa_8021q_rcv() In both sja1105_rcv() and sja1110_rcv(), we may have precise source port information coming from parallel hardware mechanisms, in addition to the tag_8021q header. Only sja1105_rcv() has extra logic to not overwrite that precise info with what's present in the VLAN tag. This is because sja1110_rcv() gets by, by having a reversed set of checks when assigning skb->dev. When the source port is imprecise (vbid >=1), source_port and switch_id will be set to zeroes by dsa_8021q_rcv(), which might be problematic. But by checking for vbid >= 1 first, sja1110_rcv() fends that off. We would like to make more code common between sja1105_rcv() and sja1110_rcv(), and for that, we need to make sure that sja1110_rcv() also goes through the precise source port preservation logic. Signed-off-by: Vladimir Oltean Signed-off-by: Pawel Dembicki Reviewed-by: Vladimir Oltean Tested-by: Vladimir Oltean Link: https://patch.msgid.link/20240713211620.1125910-4-paweldembicki@gmail.com Signed-off-by: Jakub Kicinski net/dsa/tag_8021q.c | 32 +++++++++++++++++++++++++++++--- net/dsa/tag_sja1105.c | 23 +++-------------------- 2 files changed, 32 insertions(+), 23 deletions(-) commit 6b783ded364ad037dd526c0be5860f58a51ca084 Author: Pawel Dembicki Date: Sat Jul 13 23:16:08 2024 +0200 net: dsa: vsc73xx: Add vlan filtering This patch implements VLAN filtering for the vsc73xx driver. After starting VLAN filtering, the switch is reconfigured from QinQ to a simple VLAN aware mode. This is required because VSC73XX chips do not support inner VLAN tag filtering. Signed-off-by: Pawel Dembicki Reviewed-by: Vladimir Oltean Link: https://patch.msgid.link/20240713211620.1125910-3-paweldembicki@gmail.com Signed-off-by: Jakub Kicinski drivers/net/dsa/vitesse-vsc73xx-core.c | 532 ++++++++++++++++++++++++++++++++- drivers/net/dsa/vitesse-vsc73xx.h | 37 +++ 2 files changed, 566 insertions(+), 3 deletions(-) commit 1e5b23e50ffbbca91351812d4f7b4d1b151f04b0 Author: Pawel Dembicki Date: Sat Jul 13 23:16:07 2024 +0200 net: dsa: vsc73xx: add port_stp_state_set function This isn't a fully functional implementation of 802.1D, but port_stp_state_set is required for a future tag8021q operations. This implementation handles properly all states, but vsc73xx doesn't forward STP packets. Reviewed-by: Linus Walleij Reviewed-by: Florian Fainelli Reviewed-by: Vladimir Oltean Signed-off-by: Pawel Dembicki Link: https://patch.msgid.link/20240713211620.1125910-2-paweldembicki@gmail.com Signed-off-by: Jakub Kicinski drivers/net/dsa/vitesse-vsc73xx-core.c | 96 ++++++++++++++++++++++++++++++---- 1 file changed, 85 insertions(+), 11 deletions(-) commit d60c429610a14560085d98fa6f4cdb43040ca8f0 Author: Philip Mueller Date: Mon Jul 15 11:57:49 2024 +0700 drm: panel-orientation-quirks: Add quirk for OrangePi Neo This adds a DMI orientation quirk for the OrangePi Neo Linux Gaming Handheld. Signed-off-by: Philip Mueller Reviewed-by: Hans de Goede Signed-off-by: Hans de Goede Link: https://patchwork.freedesktop.org/patch/msgid/20240715045818.1019979-1-philm@manjaro.org drivers/gpu/drm/drm_panel_orientation_quirks.c | 6 ++++++ 1 file changed, 6 insertions(+) commit 887cd308fd46a1c6956e9ccda1aaca830edc8ed7 Author: Christophe JAILLET Date: Sun Jul 14 14:15:25 2024 +0200 IB/hfi1: Constify struct flag_table 'struct flag_table' are not modified in this driver. Constifying this structure moves some data to a read-only section, so increase overall security. On a x86_64, with allmodconfig: Before: ====== text data bss dec hex filename 302932 40271 112 343315 53d13 drivers/infiniband/hw/hfi1/chip.o After: ===== text data bss dec hex filename 311636 31567 112 343315 53d13 drivers/infiniband/hw/hfi1/chip.o Link: https://lore.kernel.org/r/782b6a648bfbbf2bb83f81a73c0460b5bb7642a1.1720959310.git.christophe.jaillet@wanadoo.fr Signed-off-by: Christophe JAILLET Signed-off-by: Jason Gunthorpe drivers/infiniband/hw/hfi1/chip.c | 30 +++++++++++++++--------------- 1 file changed, 15 insertions(+), 15 deletions(-) commit b7b377332b96a38bc98928d7ec2674c77a95fcb3 Author: Jiri Slaby (SUSE) Date: Fri Jul 12 08:41:48 2024 +0200 irqdomain: Fix the kernel-doc and plug it into Documentation There were several undocumented fields in structs irq_domain_ops and irq_domain_info. Document them. irq_domain_ops::revmap_size contained "[]" in the description, which is not allowed in sphinx. Remove that. Finally, plug the whole header (irqdomain.h) into genericirq.rst, so that the docs is autogenerated and hyperlinks to these structure are created. Signed-off-by: Jiri Slaby (SUSE) Signed-off-by: Thomas Gleixner Tested-by: Randy Dunlap Reviewed-by: Randy Dunlap Link: https://lore.kernel.org/r/20240712064148.157040-1-jirislaby@kernel.org Documentation/core-api/genericirq.rst | 2 ++ include/linux/irqdomain.h | 20 +++++++++++++++++++- 2 files changed, 21 insertions(+), 1 deletion(-) commit c37927a203fa283950f6045602b9f71328ad786c Author: Rafael J. Wysocki Date: Thu Jul 11 12:20:04 2024 +0200 genirq: Set IRQF_COND_ONESHOT in request_irq() The callers of request_irq() don't care about IRQF_ONESHOT because they don't provide threaded handlers, but if they happen to share the IRQ with the ACPI SCI, which has a threaded handler and sets IRQF_ONESHOT, request_irq() will fail for them due to a flags mismatch. Address this by making request_irq() add IRQF_COND_ONESHOT to the flags passed to request_threaded_irq() for all of its callers. Fixes: 7a36b901a6eb ("ACPI: OSL: Use a threaded interrupt handler for SCI") Reported-by: Stefan Seyfried Signed-off-by: Rafael J. Wysocki Signed-off-by: Thomas Gleixner Tested-by: Stefan Seyfried Cc: stable@vger.kerel.org Link: https://lore.kernel.org/r/5800834.DvuYhMxLoT@rjwysocki.net Closes: https://lore.kernel.org/lkml/205bd84a-fe8e-4963-968e-0763285f35ba@message-id.googlemail.com include/linux/interrupt.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 33b1c47d1fc0b5f06a393bb915db85baacba18ea Author: Shenwei Wang Date: Wed Jul 3 11:32:50 2024 -0500 irqchip/imx-irqsteer: Handle runtime power management correctly The power domain is automatically activated from clk_prepare(). However, on certain platforms like i.MX8QM and i.MX8QXP, the power-on handling invokes sleeping functions, which triggers the 'scheduling while atomic' bug in the context switch path during device probing: BUG: scheduling while atomic: kworker/u13:1/48/0x00000002 Call trace: __schedule_bug+0x54/0x6c __schedule+0x7f0/0xa94 schedule+0x5c/0xc4 schedule_preempt_disabled+0x24/0x40 __mutex_lock.constprop.0+0x2c0/0x540 __mutex_lock_slowpath+0x14/0x20 mutex_lock+0x48/0x54 clk_prepare_lock+0x44/0xa0 clk_prepare+0x20/0x44 imx_irqsteer_resume+0x28/0xe0 pm_generic_runtime_resume+0x2c/0x44 __genpd_runtime_resume+0x30/0x80 genpd_runtime_resume+0xc8/0x2c0 __rpm_callback+0x48/0x1d8 rpm_callback+0x6c/0x78 rpm_resume+0x490/0x6b4 __pm_runtime_resume+0x50/0x94 irq_chip_pm_get+0x2c/0xa0 __irq_do_set_handler+0x178/0x24c irq_set_chained_handler_and_data+0x60/0xa4 mxc_gpio_probe+0x160/0x4b0 Cure this by implementing the irq_bus_lock/sync_unlock() interrupt chip callbacks and handle power management in them as they are invoked from non-atomic context. [ tglx: Rewrote change log, added Fixes tag ] Fixes: 0136afa08967 ("irqchip: Add driver for imx-irqsteer controller") Signed-off-by: Shenwei Wang Signed-off-by: Thomas Gleixner Cc: stable@vger.kernel.org Link: https://lore.kernel.org/r/20240703163250.47887-1-shenwei.wang@nxp.com drivers/irqchip/irq-imx-irqsteer.c | 24 +++++++++++++++++++++--- 1 file changed, 21 insertions(+), 3 deletions(-) commit 10697eee6a6ff59207663f536dc8e8de7a4fd3e7 Author: Geert Uytterhoeven Date: Tue Jul 2 11:24:14 2024 +0200 irqchip/gic-v3: Pass #redistributor-regions to gic_of_setup_kvm_info() The caller of gic_of_setup_kvm_info() already queried DT for the value of the #redistributor-regions property. So just pass this value, instead of doing the DT look-up again in the callee. Signed-off-by: Geert Uytterhoeven Signed-off-by: Thomas Gleixner Acked-by: Marc Zyngier Link: https://lore.kernel.org/r/808286a3ac08f60585ae7e2c848e0f9b3cb79cf8.1719912215.git.geert+renesas@glider.be drivers/irqchip/irq-gic-v3.c | 13 ++++--------- 1 file changed, 4 insertions(+), 9 deletions(-) commit 9a58480e5e532903f08b2a34f05076d3ec3a5c00 Author: Stefan Wahren Date: Sun Jun 30 17:36:46 2024 +0200 irqchip/bcm2835: Enable SKIP_SET_WAKE and MASK_ON_SUSPEND The BCM2835 ARMCTRL interrupt controller doesn't provide any facility to configure the wakeup sources. That's the reason why the driver lacks the irq_set_wake() callback for the interrupt chip. But this prevent to properly enter power management states like "suspend to idle". Enable the flags IRQCHIP_SKIP_SET_WAKE and IRQCHIP_MASK_ON_SUSPEND so the interrupt suspend logic can handle the chip correctly. Signed-off-by: Stefan Wahren Signed-off-by: Thomas Gleixner Reviewed-by: Florian Fainelli drivers/irqchip/irq-bcm2835.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) commit a84a07fa3100d7ad46a3d6882af25a3df9c9e7e3 Author: Marc Zyngier Date: Fri Jul 5 10:31:55 2024 +0100 irqchip/gic-v4: Make sure a VPE is locked when VMAPP is issued In order to make sure that vpe->col_idx is correctly sampled when a VMAPP command is issued, the vpe_lock must be held for the VPE. This is now possible since the introduction of the per-VM vmapp_lock, which can be taken before vpe_lock in the correct locking order. Signed-off-by: Marc Zyngier Signed-off-by: Thomas Gleixner Tested-by: Nianyao Tang Link: https://lore.kernel.org/r/20240705093155.871070-4-maz@kernel.org drivers/irqchip/irq-gic-v3-its.c | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) commit f0eb154c39471bf881422e8ac23e4c037289ece9 Author: Marc Zyngier Date: Fri Jul 5 10:31:54 2024 +0100 irqchip/gic-v4: Substitute vmovp_lock for a per-VM lock vmovp_lock is abused in a number of cases to serialise updates to vlpi_count[] and deal with map/unmap of a VM to ITSs. Instead, provide a per-VM lock and revisit the use of vlpi_count[] so that it is always wrapped in this per-VM vmapp_lock. This reduces the potential contention on a concurrent VMOVP command, and paves the way for subsequent VPE locking that holding vmovp_lock actively prevents due to the lock ordering. Signed-off-by: Marc Zyngier Signed-off-by: Thomas Gleixner Tested-by: Nianyao Tang Link: https://lore.kernel.org/r/20240705093155.871070-3-maz@kernel.org drivers/irqchip/irq-gic-v3-its.c | 27 ++++++++++++--------------- include/linux/irqchip/arm-gic-v4.h | 8 ++++++++ 2 files changed, 20 insertions(+), 15 deletions(-) commit 7d2c2048a86477461f7bc75d064579ed349472bc Author: Marc Zyngier Date: Fri Jul 5 10:31:53 2024 +0100 irqchip/gic-v4: Always configure affinity on VPE activation There are currently two paths to set the initial affinity of a VPE: - at activation time on GICv4 without the stupid VMOVP list, and on GICv4.1 - at map time for GICv4 with VMOVP list The latter location may end-up modifying the affinity of VPE that is currently running, making the results unpredictible. Instead, unify the two paths, making sure to set the initial affinity only at activation time. Reported-by: Nianyao Tang Signed-off-by: Marc Zyngier Signed-off-by: Thomas Gleixner Tested-by: Nianyao Tang Link: https://lore.kernel.org/r/20240705093155.871070-2-maz@kernel.org drivers/irqchip/irq-gic-v3-its.c | 13 ++++--------- 1 file changed, 4 insertions(+), 9 deletions(-) commit a8ea8d531d1edf7b29e559713fe1aaab3530d7d9 Author: MD Danish Anwar Date: Fri Jul 12 17:36:36 2024 +0530 net: ti: icssg-prueth: Split out common object into module icssg_prueth.c and icssg_prueth_sr1.c drivers use multiple common .c files. These common objects are getting added to multiple modules. As a result when both drivers are enabled in .config, below warning is seen. drivers/net/ethernet/ti/Makefile: icssg/icssg_common.o is added to multiple modules: icssg-prueth icssg-prueth-sr1 drivers/net/ethernet/ti/Makefile: icssg/icssg_classifier.o is added to multiple modules: icssg-prueth icssg-prueth-sr1 drivers/net/ethernet/ti/Makefile: icssg/icssg_config.o is added to multiple modules: icssg-prueth icssg-prueth-sr1 drivers/net/ethernet/ti/Makefile: icssg/icssg_mii_cfg.o is added to multiple modules: icssg-prueth icssg-prueth-sr1 drivers/net/ethernet/ti/Makefile: icssg/icssg_stats.o is added to multiple modules: icssg-prueth icssg-prueth-sr1 drivers/net/ethernet/ti/Makefile: icssg/icssg_ethtool.o is added to multiple modules: icssg-prueth icssg-prueth-sr1 Fix this by building a new module (icssg.o) for all the common objects. Both the driver can then depend on this common module. Some APIs being exported have emac_ as the prefix which may result into confusion with other existing APIs with emac_ prefix, to avoid confusion, rename the APIs being exported with emac_ to icssg_ prefix. This also fixes below error seen when both drivers are built. ERROR: modpost: "icssg_queue_pop" [drivers/net/ethernet/ti/icssg-prueth-sr1.ko] undefined! ERROR: modpost: "icssg_queue_push" [drivers/net/ethernet/ti/icssg-prueth-sr1.ko] undefined! Reported-and-tested-by: Thorsten Leemhuis Closes: https://lore.kernel.org/oe-kbuild-all/202405182038.ncf1mL7Z-lkp@intel.com/ Fixes: 487f7323f39a ("net: ti: icssg-prueth: Add helper functions to configure FDB") Reviewed-by: Roger Quadros Signed-off-by: MD Danish Anwar Reviewed-by: Sai Krishna Signed-off-by: David S. Miller drivers/net/ethernet/ti/Makefile | 32 +++++++-------- drivers/net/ethernet/ti/icssg/icssg_classifier.c | 6 +++ drivers/net/ethernet/ti/icssg/icssg_common.c | 50 +++++++++++++++++++----- drivers/net/ethernet/ti/icssg/icssg_config.c | 15 ++++++- drivers/net/ethernet/ti/icssg/icssg_ethtool.c | 1 + drivers/net/ethernet/ti/icssg/icssg_mii_cfg.c | 4 ++ drivers/net/ethernet/ti/icssg/icssg_prueth.c | 38 +++++++++--------- drivers/net/ethernet/ti/icssg/icssg_prueth.h | 22 +++++------ drivers/net/ethernet/ti/icssg/icssg_prueth_sr1.c | 14 +++---- drivers/net/ethernet/ti/icssg/icssg_queues.c | 2 + drivers/net/ethernet/ti/icssg/icssg_stats.c | 3 +- drivers/net/ethernet/ti/icssg/icssg_switchdev.c | 4 +- 12 files changed, 122 insertions(+), 69 deletions(-) commit 136a8066676e593cd29627219467fc222c8f3b04 Author: Jason Gunthorpe Date: Thu Jul 11 21:11:03 2024 -0300 iommufd: Put constants for all the uAPI enums Relying on position in the enum makes it subtly harder when doing merge resolutions or backporting as it is easy to grab a patch and not notice it is a uAPI change with a differently ordered enum. This may become a bigger problem in next cycles when iommu_hwpt_invalidate_data_type and other per-driver enums have patches flowing through different trees. So lets start including constants for all the uAPI enums to make this safer. No functional change. Link: https://lore.kernel.org/r/0-v1-2c06ec044924+133-iommufd_uapi_const_jgg@nvidia.com Reviewed-by: Kevin Tian Reviewed-by: Yi Liu Tested-by: Yi Liu Signed-off-by: Jason Gunthorpe include/uapi/linux/iommufd.h | 40 ++++++++++++++++++++-------------------- 1 file changed, 20 insertions(+), 20 deletions(-) commit 89fc548767a2155231128cb98726d6d2ea1256c9 Author: Sungjong Seo Date: Fri May 31 19:14:44 2024 +0900 exfat: fix potential deadlock on __exfat_get_dentry_set When accessing a file with more entries than ES_MAX_ENTRY_NUM, the bh-array is allocated in __exfat_get_entry_set. The problem is that the bh-array is allocated with GFP_KERNEL. It does not make sense. In the following cases, a deadlock for sbi->s_lock between the two processes may occur. CPU0 CPU1 ---- ---- kswapd balance_pgdat lock(fs_reclaim) exfat_iterate lock(&sbi->s_lock) exfat_readdir exfat_get_uniname_from_ext_entry exfat_get_dentry_set __exfat_get_dentry_set kmalloc_array ... lock(fs_reclaim) ... evict exfat_evict_inode lock(&sbi->s_lock) To fix this, let's allocate bh-array with GFP_NOFS. Fixes: a3ff29a95fde ("exfat: support dynamic allocate bh for exfat_entry_set_cache") Cc: stable@vger.kernel.org # v6.2+ Reported-by: syzbot+412a392a2cd4a65e71db@syzkaller.appspotmail.com Closes: https://lore.kernel.org/lkml/000000000000fef47e0618c0327f@google.com Signed-off-by: Sungjong Seo Signed-off-by: Namjae Jeon fs/exfat/dir.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 224821766f4355cfa63f825660f5922e670d6fc6 Author: Michael Jeanson Date: Wed May 22 21:10:07 2024 -0400 exfat: handle idmapped mounts Pass the idmapped mount information to the different helper functions. Adapt the uid/gid checks in exfat_setattr to use the vfsuid/vfsgid helpers. Based on the fat implementation in commit 4b7899368108 ("fat: handle idmapped mounts") by Christian Brauner. Signed-off-by: Michael Jeanson Reviewed-by: Christian Brauner Signed-off-by: Namjae Jeon fs/exfat/file.c | 22 +++++++++++++--------- fs/exfat/super.c | 2 +- 2 files changed, 14 insertions(+), 10 deletions(-) commit 0a1868b93fad5938dbcca77286b25bf211c49f7a Author: Elliot Ayrey Date: Fri Jul 12 13:31:33 2024 +1200 net: bridge: mst: Check vlan state for egress decision If a port is blocking in the common instance but forwarding in an MST instance, traffic egressing the bridge will be dropped because the state of the common instance is overriding that of the MST instance. Fix this by skipping the port state check in MST mode to allow checking the vlan state via br_allowed_egress(). This is similar to what happens in br_handle_frame_finish() when checking ingress traffic, which was introduced in the change below. Fixes: ec7328b59176 ("net: bridge: mst: Multiple Spanning Tree (MST) mode") Signed-off-by: Elliot Ayrey Acked-by: Nikolay Aleksandrov Signed-off-by: David S. Miller net/bridge/br_forward.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) commit dead06c5e110c25931bafc8cf017e3077b871ac5 Author: Dmitry Torokhov Date: Fri Jul 12 20:34:51 2024 -0700 ARM: pxa: fix build breakage on PXA3xx Commit 917195d6f829 ("ARM: pxa: consolidate GPIO chip platform data") tried to reuse the same instance of platform data for PXA25x and PXA27x GPIO controllers by moving it into arch/arm/mach-pxa/devices.c Unfortunately this file is built for other PXA variants which resulted in the following error: >> arm-linux-gnueabi-ld: arch/arm/mach-pxa/devices.o:(.data+0x167c): undefined reference to `gpio_set_wake' Fix this by using #ifdef around PXA25x and PXA27x GPIO controller device structures and associated data. Reported-by: kernel test robot Closes: https://lore.kernel.org/oe-kbuild-all/202407112039.cyyIQ3Js-lkp@intel.com/ Fixes: 917195d6f829 ("ARM: pxa: consolidate GPIO chip platform data") Signed-off-by: Dmitry Torokhov Signed-off-by: Arnd Bergmann arch/arm/mach-pxa/devices.c | 2 ++ 1 file changed, 2 insertions(+) commit 6bad1bef26ca2b3fd6412c6e2ac943ae6f45351c Author: Conor Dooley Date: Mon Jul 15 12:21:48 2024 +0100 MAINTAINERS: drop riscv list from cache controllers When adding the bindings for cache controllers to the MAINTAINERS entry, I forgot to drop the riscv mailing list - and so completely unrelated to riscv stuff is now being sent there. Drop it. Fixes: 4ca47d8bcca0 ("MAINTAINERS: add cache binding directory to cache driver entry") Signed-off-by: Conor Dooley Signed-off-by: Arnd Bergmann MAINTAINERS | 1 - 1 file changed, 1 deletion(-) commit 250b8b86b683e6b52b58514bff94146a47d3251f Merge: 97d9fba9a812 59a931c5b732 Author: David S. Miller Date: Mon Jul 15 12:43:46 2024 +0100 Merge branch 'main' of ra.kernel.org:/pub/scm/linux/kernel/git/davem/net into main Steffen Klassert says: ==================== 1) Fix esp_output_tail_tcp() on unsupported ESPINTCP. From Hagar Hemdan. 2) Fix two bugs in the recently introduced SA direction separation. From Antony Antony. 3) Fix unregister netdevice hang on hardware offload. We had to add another list where skbs linked to that are unlinked from the lists (deleted) but not yet freed. 4) Fix netdev reference count imbalance in xfrm_state_find. From Jianbo Liu. 5) Call xfrm_dev_policy_delete when killingi them on offloaded policies. Jianbo Liu. ==================== Signed-off-by: David S. Miller commit e61cc85edbbeb71e53fbf049dc9ec763bc274479 Author: Raphael Gallais-Pou Date: Mon Jul 8 18:18:40 2024 +0200 thermal/drivers/sti: Cleanup code related to stih416 "st,stih416-mpe-thermal" compatible seems to appear nowhere in the device-tree nor in the documentation. Remove compatible and related code. Signed-off-by: Raphael Gallais-Pou Link: https://lore.kernel.org/r/20240708161840.102004-1-rgallaispou@gmail.com Signed-off-by: Daniel Lezcano drivers/thermal/st/st_thermal_memmap.c | 10 ---------- 1 file changed, 10 deletions(-) commit d5c38eec5d58d5d017bb8c73b4387943d080c32f Author: Krzysztof Kozlowski Date: Tue Jul 9 14:59:42 2024 +0200 thermal/drivers/generic-adc: Simplify with dev_err_probe() Error handling in probe() can be a bit simpler with dev_err_probe(). Signed-off-by: Krzysztof Kozlowski Link: https://lore.kernel.org/r/20240709-thermal-probe-v1-12-241644e2b6e0@linaro.org Signed-off-by: Daniel Lezcano drivers/thermal/thermal-generic-adc.c | 8 ++------ 1 file changed, 2 insertions(+), 6 deletions(-) commit f637bfe26c23c8e4a38076da286f6a0de1291323 Author: Krzysztof Kozlowski Date: Tue Jul 9 14:59:41 2024 +0200 thermal/drivers/generic-adc: Simplify probe() with local dev variable Simplify the probe() function by using local 'dev' instead of &pdev->dev. Signed-off-by: Krzysztof Kozlowski Link: https://lore.kernel.org/r/20240709-thermal-probe-v1-11-241644e2b6e0@linaro.org Signed-off-by: Daniel Lezcano drivers/thermal/thermal-generic-adc.c | 21 +++++++++++---------- 1 file changed, 11 insertions(+), 10 deletions(-) commit bc55630c657a7f81e65b6993e8113f453cdcef4b Author: Krzysztof Kozlowski Date: Tue Jul 9 14:59:40 2024 +0200 thermal/drivers/qcom-tsens: Simplify with dev_err_probe() Error handling in probe() can be a bit simpler with dev_err_probe(). Signed-off-by: Krzysztof Kozlowski Reviewed-by: Bjorn Andersson Link: https://lore.kernel.org/r/20240709-thermal-probe-v1-10-241644e2b6e0@linaro.org Signed-off-by: Daniel Lezcano drivers/thermal/qcom/tsens.c | 8 +++----- 1 file changed, 3 insertions(+), 5 deletions(-) commit ecfee9176b8fd68178a9682fc7285054266012ef Author: Krzysztof Kozlowski Date: Tue Jul 9 14:59:39 2024 +0200 thermal/drivers/qcom-spmi-adc-tm5: Simplify with dev_err_probe() Error handling in probe() can be a bit simpler with dev_err_probe(). Signed-off-by: Krzysztof Kozlowski Reviewed-by: Bjorn Andersson Link: https://lore.kernel.org/r/20240709-thermal-probe-v1-9-241644e2b6e0@linaro.org Signed-off-by: Daniel Lezcano drivers/thermal/qcom/qcom-spmi-adc-tm5.c | 9 +++------ 1 file changed, 3 insertions(+), 6 deletions(-) commit d0b297e76b5cb06bd67577dc1b710cc13e4f4300 Author: Krzysztof Kozlowski Date: Tue Jul 9 14:59:38 2024 +0200 thermal/drivers/imx: Simplify with dev_err_probe() Error handling in probe() can be a bit simpler with dev_err_probe(). Signed-off-by: Krzysztof Kozlowski Link: https://lore.kernel.org/r/20240709-thermal-probe-v1-8-241644e2b6e0@linaro.org Signed-off-by: Daniel Lezcano drivers/thermal/imx_thermal.c | 4 +--- 1 file changed, 1 insertion(+), 3 deletions(-) commit e9ac90242b83dde46406723bc00d1616e3083431 Author: Krzysztof Kozlowski Date: Tue Jul 9 14:59:37 2024 +0200 thermal/drivers/imx: Simplify probe() with local dev variable Simplify the probe() function by using local 'dev' instead of &pdev->dev. Signed-off-by: Krzysztof Kozlowski Link: https://lore.kernel.org/r/20240709-thermal-probe-v1-7-241644e2b6e0@linaro.org Signed-off-by: Daniel Lezcano drivers/thermal/imx_thermal.c | 40 ++++++++++++++++++++-------------------- 1 file changed, 20 insertions(+), 20 deletions(-) commit 3e1a0680bbeddd30f1df23bffa00b906714f6da0 Author: Krzysztof Kozlowski Date: Tue Jul 9 14:59:36 2024 +0200 thermal/drivers/hisi: Simplify with dev_err_probe() Error handling in probe() can be a bit simpler with dev_err_probe(). Signed-off-by: Krzysztof Kozlowski Link: https://lore.kernel.org/r/20240709-thermal-probe-v1-6-241644e2b6e0@linaro.org Signed-off-by: Daniel Lezcano drivers/thermal/hisi_thermal.c | 9 ++------- 1 file changed, 2 insertions(+), 7 deletions(-) commit ca6176693f86cbff58c5eda82a2617bd9143cafb Author: Krzysztof Kozlowski Date: Tue Jul 9 14:59:35 2024 +0200 thermal/drivers/exynos: Simplify with dev_err_probe() Error handling in probe() can be a bit simpler with dev_err_probe(). Signed-off-by: Krzysztof Kozlowski Link: https://lore.kernel.org/r/20240709-thermal-probe-v1-5-241644e2b6e0@linaro.org Signed-off-by: Daniel Lezcano drivers/thermal/samsung/exynos_tmu.c | 20 +++++++------------- 1 file changed, 7 insertions(+), 13 deletions(-) commit 4a6cf76edf5c8cda4def7b1578836a88b547ff69 Author: Krzysztof Kozlowski Date: Tue Jul 9 14:59:34 2024 +0200 thermal/drivers/exynos: Simplify probe() with local dev variable Simplify the probe() function by using local 'dev' instead of &pdev->dev. While touching devm_kzalloc(), use preferred sizeof(*) syntax. Signed-off-by: Krzysztof Kozlowski Reviewed-by: Alim Akhtar Link: https://lore.kernel.org/r/20240709-thermal-probe-v1-4-241644e2b6e0@linaro.org Signed-off-by: Daniel Lezcano drivers/thermal/samsung/exynos_tmu.c | 42 +++++++++++++++++------------------- 1 file changed, 20 insertions(+), 22 deletions(-) commit 9d55cb3ba36e218839ca04c55e977ab6faac1707 Author: Krzysztof Kozlowski Date: Tue Jul 9 14:59:33 2024 +0200 thermal/drivers/broadcom: Simplify with dev_err_probe() Error handling in probe() can be a bit simpler with dev_err_probe(). Signed-off-by: Krzysztof Kozlowski Link: https://lore.kernel.org/r/20240709-thermal-probe-v1-3-241644e2b6e0@linaro.org Signed-off-by: Daniel Lezcano drivers/thermal/broadcom/bcm2835_thermal.c | 15 ++++----------- 1 file changed, 4 insertions(+), 11 deletions(-) commit fd972a17451f9cd4f6c99415b5a9dcf856d93433 Author: Krzysztof Kozlowski Date: Tue Jul 9 14:59:32 2024 +0200 thermal/drivers/broadcom: Simplify probe() with local dev variable Simplify the probe() function by using local 'dev' instead of &pdev->dev. Signed-off-by: Krzysztof Kozlowski Link: https://lore.kernel.org/r/20240709-thermal-probe-v1-2-241644e2b6e0@linaro.org Signed-off-by: Daniel Lezcano drivers/thermal/broadcom/bcm2835_thermal.c | 23 +++++++++-------------- 1 file changed, 9 insertions(+), 14 deletions(-) commit e90c369cc2ffcf7145a46448de101f715a1f5584 Author: Krzysztof Kozlowski Date: Tue Jul 9 14:59:31 2024 +0200 thermal/drivers/broadcom: Fix race between removal and clock disable During the probe, driver enables clocks necessary to access registers (in get_temp()) and then registers thermal zone with managed-resources (devm) interface. Removal of device is not done in reversed order, because: 1. Clock will be disabled in driver remove() callback - thermal zone is still registered and accessible to users, 2. devm interface will unregister thermal zone. This leaves short window between (1) and (2) for accessing the get_temp() callback with disabled clock. Fix this by enabling clock also via devm-interface, so entire cleanup path will be in proper, reversed order. Fixes: 8454c8c09c77 ("thermal/drivers/bcm2835: Remove buggy call to thermal_of_zone_unregister") Cc: stable@vger.kernel.org Signed-off-by: Krzysztof Kozlowski Link: https://lore.kernel.org/r/20240709-thermal-probe-v1-1-241644e2b6e0@linaro.org Signed-off-by: Daniel Lezcano drivers/thermal/broadcom/bcm2835_thermal.c | 19 ++++--------------- 1 file changed, 4 insertions(+), 15 deletions(-) commit 6f48290b1a18dba5870920188725eee6fe603ee6 Author: Rob Herring (Arm) Date: Tue Jul 9 09:01:53 2024 -0600 dt-bindings: thermal: Drop 'trips' node as required It is possible to have thermal zones which don't have any trip points. These zones in effect simply represent a temperature sensor without any action associated with it. While the schema has always required a 'trips' node, users have existed for a long time without it. Update the schema to match reality. Signed-off-by: Rob Herring (Arm) Reviewed-by: Krzysztof Kozlowski Link: https://lore.kernel.org/r/20240709150154.3272825-1-robh@kernel.org Signed-off-by: Daniel Lezcano Documentation/devicetree/bindings/thermal/thermal-zones.yaml | 1 - 1 file changed, 1 deletion(-) commit fd1f85b2e7a6cdf84fb590fe17c7664b202cb9bb Author: Krzysztof Kozlowski Date: Fri Jul 5 11:51:31 2024 +0200 dt-bindings: thermal: qoriq: reference thermal-sensor schema Device is a thermal sensor and it requires '#thermal-sensor-cells', so reference the thermal-sensor.yaml to simplify it and bring the common definition of '#thermal-sensor-cells' property. Acked-by: Conor Dooley Signed-off-by: Krzysztof Kozlowski Link: https://lore.kernel.org/r/20240705-dt-bindings-thermal-allof-v1-12-554061b52fbc@linaro.org Signed-off-by: Daniel Lezcano Documentation/devicetree/bindings/thermal/qoriq-thermal.yaml | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) commit f062dc5ccaf2cdca9b1d9282ddae1cdb77b9d902 Author: Krzysztof Kozlowski Date: Fri Jul 5 11:51:41 2024 +0200 dt-bindings: thermal: cleanup examples indentation Preferred indentation for DTS examples in the bindings is 4-space. It is also preferred not to have redundant/unused labels. No functional change Acked-by: Conor Dooley Signed-off-by: Krzysztof Kozlowski Link: https://lore.kernel.org/r/20240705-dt-bindings-thermal-allof-v1-22-554061b52fbc@linaro.org Signed-off-by: Daniel Lezcano .../bindings/thermal/amlogic,thermal.yaml | 18 ++--- .../bindings/thermal/brcm,avs-ro-thermal.yaml | 18 ++--- .../devicetree/bindings/thermal/brcm,avs-tmon.yaml | 16 ++-- .../devicetree/bindings/thermal/qcom-tsens.yaml | 88 ++++++++++------------ .../bindings/thermal/rcar-gen3-thermal.yaml | 66 ++++++++-------- .../devicetree/bindings/thermal/rcar-thermal.yaml | 64 ++++++++-------- .../devicetree/bindings/thermal/rzg2l-thermal.yaml | 38 +++++----- .../devicetree/bindings/thermal/sprd-thermal.yaml | 44 +++++------ .../bindings/thermal/ti,am654-thermal.yaml | 10 +-- 9 files changed, 178 insertions(+), 184 deletions(-) commit bbb4c179397c0af1ff403b2f13fff4753874bf7d Author: Krzysztof Kozlowski Date: Fri Jul 5 11:51:40 2024 +0200 dt-bindings: thermal: simplify few bindings Simplify few bindings which already reference thermal-sensor.yaml schema by dropping unneeded requiring of '#thermal-sensor-cells' and dropping assigned-clocks properties (core schema allows it if 'clocks' are there). Reviewed-by: AngeloGioacchino Del Regno Acked-by: Conor Dooley Signed-off-by: Krzysztof Kozlowski Link: https://lore.kernel.org/r/20240705-dt-bindings-thermal-allof-v1-21-554061b52fbc@linaro.org Signed-off-by: Daniel Lezcano Documentation/devicetree/bindings/thermal/brcm,avs-tmon.yaml | 1 - Documentation/devicetree/bindings/thermal/brcm,bcm2835-thermal.yaml | 1 - Documentation/devicetree/bindings/thermal/fsl,scu-thermal.yaml | 1 - Documentation/devicetree/bindings/thermal/loongson,ls2k-thermal.yaml | 1 - Documentation/devicetree/bindings/thermal/mediatek,lvts-thermal.yaml | 1 - .../devicetree/bindings/thermal/nvidia,tegra124-soctherm.yaml | 1 - Documentation/devicetree/bindings/thermal/nvidia,tegra30-tsensor.yaml | 4 ---- Documentation/devicetree/bindings/thermal/qcom,spmi-temp-alarm.yaml | 1 - 8 files changed, 11 deletions(-) commit a985dceccd82850b93d392ae9c4d5748f40c3e2a Author: Krzysztof Kozlowski Date: Fri Jul 5 11:51:39 2024 +0200 dt-bindings: thermal: ti,j72xx: reference thermal-sensor schema Device is a thermal sensor and it requires '#thermal-sensor-cells', so reference the thermal-sensor.yaml to simplify it and bring the common definition of '#thermal-sensor-cells' property. Acked-by: Conor Dooley Signed-off-by: Krzysztof Kozlowski Link: https://lore.kernel.org/r/20240705-dt-bindings-thermal-allof-v1-20-554061b52fbc@linaro.org Signed-off-by: Daniel Lezcano Documentation/devicetree/bindings/thermal/ti,j72xx-thermal.yaml | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) commit 323a6134e7d0f146e7185167025c2b1c7993f5b2 Author: Krzysztof Kozlowski Date: Fri Jul 5 11:51:38 2024 +0200 dt-bindings: thermal: ti,am654: reference thermal-sensor schema Device is a thermal sensor and it requires '#thermal-sensor-cells', so reference the thermal-sensor.yaml to simplify it and bring the common definition of '#thermal-sensor-cells' property. Acked-by: Conor Dooley Signed-off-by: Krzysztof Kozlowski Link: https://lore.kernel.org/r/20240705-dt-bindings-thermal-allof-v1-19-554061b52fbc@linaro.org Signed-off-by: Daniel Lezcano Documentation/devicetree/bindings/thermal/ti,am654-thermal.yaml | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) commit 17cdc4717dabe9a84fe81bcd310ea8035fca475a Author: Krzysztof Kozlowski Date: Fri Jul 5 11:51:37 2024 +0200 dt-bindings: thermal: st,stm32: reference thermal-sensor schema Device is a thermal sensor and it requires '#thermal-sensor-cells', so reference the thermal-sensor.yaml to simplify it and bring the common definition of '#thermal-sensor-cells' property. Acked-by: Conor Dooley Signed-off-by: Krzysztof Kozlowski Link: https://lore.kernel.org/r/20240705-dt-bindings-thermal-allof-v1-18-554061b52fbc@linaro.org Signed-off-by: Daniel Lezcano Documentation/devicetree/bindings/thermal/st,stm32-thermal.yaml | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) commit f9b2d6b840d50d23086b9638dee7e622f3db6638 Author: Krzysztof Kozlowski Date: Fri Jul 5 11:51:36 2024 +0200 dt-bindings: thermal: sprd: reference thermal-sensor schema Device is a thermal sensor and it requires '#thermal-sensor-cells', so reference the thermal-sensor.yaml to simplify it and bring the common definition of '#thermal-sensor-cells' property. Reviewed-by: Baolin Wang Acked-by: Conor Dooley Signed-off-by: Krzysztof Kozlowski Link: https://lore.kernel.org/r/20240705-dt-bindings-thermal-allof-v1-17-554061b52fbc@linaro.org Signed-off-by: Daniel Lezcano Documentation/devicetree/bindings/thermal/sprd-thermal.yaml | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) commit 28b317510582fad1d1a64775250e57a886826897 Author: Krzysztof Kozlowski Date: Fri Jul 5 11:51:35 2024 +0200 dt-bindings: thermal: socionext,uniphier: reference thermal-sensor schema Device is a thermal sensor and it requires '#thermal-sensor-cells', so reference the thermal-sensor.yaml to simplify it and bring the common definition of '#thermal-sensor-cells' property. Acked-by: Conor Dooley Signed-off-by: Krzysztof Kozlowski Link: https://lore.kernel.org/r/20240705-dt-bindings-thermal-allof-v1-16-554061b52fbc@linaro.org Signed-off-by: Daniel Lezcano .../devicetree/bindings/thermal/socionext,uniphier-thermal.yaml | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) commit bf1163bb009885e89eda82bb48b0e638c2860a28 Author: Krzysztof Kozlowski Date: Fri Jul 5 11:51:34 2024 +0200 dt-bindings: thermal: rzg2l: reference thermal-sensor schema Device is a thermal sensor and it requires '#thermal-sensor-cells', so reference the thermal-sensor.yaml to simplify it and bring the common definition of '#thermal-sensor-cells' property. Reviewed-by: Biju Das Acked-by: Conor Dooley Signed-off-by: Krzysztof Kozlowski Link: https://lore.kernel.org/r/20240705-dt-bindings-thermal-allof-v1-15-554061b52fbc@linaro.org Signed-off-by: Daniel Lezcano Documentation/devicetree/bindings/thermal/rzg2l-thermal.yaml | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) commit 9abcf4ac35908ee6db36354e4545cc88600b56b3 Author: Krzysztof Kozlowski Date: Fri Jul 5 11:51:33 2024 +0200 dt-bindings: thermal: rockchip: reference thermal-sensor schema Device is a thermal sensor and it requires '#thermal-sensor-cells', so reference the thermal-sensor.yaml to simplify it and bring the common definition of '#thermal-sensor-cells' property. Reviewed-by: Heiko Stuebner Acked-by: Conor Dooley Signed-off-by: Krzysztof Kozlowski Link: https://lore.kernel.org/r/20240705-dt-bindings-thermal-allof-v1-14-554061b52fbc@linaro.org Signed-off-by: Daniel Lezcano Documentation/devicetree/bindings/thermal/rockchip-thermal.yaml | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) commit 7410853a1d0065572b5097f114e210870bd2f0cb Author: Krzysztof Kozlowski Date: Fri Jul 5 11:51:32 2024 +0200 dt-bindings: thermal: rcar-gen3: reference thermal-sensor schema Device is a thermal sensor and it requires '#thermal-sensor-cells', so reference the thermal-sensor.yaml to simplify it and bring the common definition of '#thermal-sensor-cells' property. Reviewed-by: Niklas Söderlund Acked-by: Conor Dooley Signed-off-by: Krzysztof Kozlowski Link: https://lore.kernel.org/r/20240705-dt-bindings-thermal-allof-v1-13-554061b52fbc@linaro.org Signed-off-by: Daniel Lezcano Documentation/devicetree/bindings/thermal/rcar-gen3-thermal.yaml | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) commit 80c3fda5de2cf5ff0680626da70da0f9a8eac351 Author: Krzysztof Kozlowski Date: Fri Jul 5 11:51:30 2024 +0200 dt-bindings: thermal: qcom-tsens: reference thermal-sensor schema Device is a thermal sensor and it requires '#thermal-sensor-cells', so reference the thermal-sensor.yaml to simplify it and bring the common definition of '#thermal-sensor-cells' property. Acked-by: Dmitry Baryshkov Reviewed-by: Amit Kucheria Acked-by: Conor Dooley Signed-off-by: Krzysztof Kozlowski Link: https://lore.kernel.org/r/20240705-dt-bindings-thermal-allof-v1-11-554061b52fbc@linaro.org Signed-off-by: Daniel Lezcano Documentation/devicetree/bindings/thermal/qcom-tsens.yaml | 8 +++----- 1 file changed, 3 insertions(+), 5 deletions(-) commit c1bca276d8100b141a1244e8e357b0bbfbc2bed3 Author: Krzysztof Kozlowski Date: Fri Jul 5 11:51:29 2024 +0200 dt-bindings: thermal: qcom-spmi-adc-tm5: reference thermal-sensor schema Device is a thermal sensor and it requires '#thermal-sensor-cells', so reference the thermal-sensor.yaml to simplify it and bring the common definition of '#thermal-sensor-cells' property. Reviewed-by: Dmitry Baryshkov Acked-by: Conor Dooley Signed-off-by: Krzysztof Kozlowski Link: https://lore.kernel.org/r/20240705-dt-bindings-thermal-allof-v1-10-554061b52fbc@linaro.org Signed-off-by: Daniel Lezcano Documentation/devicetree/bindings/thermal/qcom-spmi-adc-tm5.yaml | 8 +++----- 1 file changed, 3 insertions(+), 5 deletions(-) commit df300226f6f630daf96be0a82f3f61f2cf2898dd Author: Krzysztof Kozlowski Date: Fri Jul 5 11:51:28 2024 +0200 dt-bindings: thermal: qcom-spmi-adc-tm-hc: reference thermal-sensor schema Device is a thermal sensor and it requires '#thermal-sensor-cells', so reference the thermal-sensor.yaml to simplify it and bring the common definition of '#thermal-sensor-cells' property. Reviewed-by: Dmitry Baryshkov Acked-by: Conor Dooley Signed-off-by: Krzysztof Kozlowski Link: https://lore.kernel.org/r/20240705-dt-bindings-thermal-allof-v1-9-554061b52fbc@linaro.org Signed-off-by: Daniel Lezcano .../devicetree/bindings/thermal/qcom-spmi-adc-tm-hc.yaml | 8 +++----- 1 file changed, 3 insertions(+), 5 deletions(-) commit b760aeec3d2b50d8680f4b52d851de7dd4fa8127 Author: Krzysztof Kozlowski Date: Fri Jul 5 11:51:27 2024 +0200 dt-bindings: thermal: nvidia,tegra30-tsensor: reference thermal-sensor schema Device is a thermal sensor and it requires '#thermal-sensor-cells', so reference the thermal-sensor.yaml to simplify it and bring the common definition of '#thermal-sensor-cells' property. Acked-by: Conor Dooley Signed-off-by: Krzysztof Kozlowski Link: https://lore.kernel.org/r/20240705-dt-bindings-thermal-allof-v1-8-554061b52fbc@linaro.org Signed-off-by: Daniel Lezcano .../devicetree/bindings/thermal/nvidia,tegra30-tsensor.yaml | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) commit b6f4d62c53e6e2eb4560a5a20315bee2adfe7b6d Author: Krzysztof Kozlowski Date: Fri Jul 5 11:51:26 2024 +0200 dt-bindings: thermal: nvidia,tegra186-bpmp: reference thermal-sensor schema Device is a thermal sensor and it requires '#thermal-sensor-cells', so reference the thermal-sensor.yaml to simplify it and bring the common definition of '#thermal-sensor-cells' property. Acked-by: Conor Dooley Signed-off-by: Krzysztof Kozlowski Link: https://lore.kernel.org/r/20240705-dt-bindings-thermal-allof-v1-7-554061b52fbc@linaro.org Signed-off-by: Daniel Lezcano .../bindings/thermal/nvidia,tegra186-bpmp-thermal.yaml | 12 ++---------- 1 file changed, 2 insertions(+), 10 deletions(-) commit 57fa7d668770780932acf83c2dcf4e15741efd1a Author: Krzysztof Kozlowski Date: Fri Jul 5 11:51:25 2024 +0200 dt-bindings: thermal: imx8mm: reference thermal-sensor schema Device is a thermal sensor and it requires '#thermal-sensor-cells', so reference the thermal-sensor.yaml to simplify it and bring the common definition of '#thermal-sensor-cells' property. Acked-by: Conor Dooley Signed-off-by: Krzysztof Kozlowski Link: https://lore.kernel.org/r/20240705-dt-bindings-thermal-allof-v1-6-554061b52fbc@linaro.org Signed-off-by: Daniel Lezcano Documentation/devicetree/bindings/thermal/imx8mm-thermal.yaml | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) commit 2410427cc87bf843e6871730f18b10dcbb91e992 Author: Krzysztof Kozlowski Date: Fri Jul 5 11:51:24 2024 +0200 dt-bindings: thermal: generic-adc: reference thermal-sensor schema Device is a thermal sensor and it requires '#thermal-sensor-cells', so reference the thermal-sensor.yaml to simplify it and bring the common definition of '#thermal-sensor-cells' property. Acked-by: Conor Dooley Signed-off-by: Krzysztof Kozlowski Link: https://lore.kernel.org/r/20240705-dt-bindings-thermal-allof-v1-5-554061b52fbc@linaro.org Signed-off-by: Daniel Lezcano Documentation/devicetree/bindings/thermal/generic-adc-thermal.yaml | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) commit 0ae2a1a6146f1ae6936919deb3150a24d1bdc118 Author: Krzysztof Kozlowski Date: Fri Jul 5 11:51:23 2024 +0200 dt-bindings: thermal: brcm,avs-ro: reference thermal-sensor schema Device is a thermal sensor and it requires '#thermal-sensor-cells', so reference the thermal-sensor.yaml to simplify it and bring the common definition of '#thermal-sensor-cells' property. Acked-by: Florian Fainelli Acked-by: Conor Dooley Signed-off-by: Krzysztof Kozlowski Link: https://lore.kernel.org/r/20240705-dt-bindings-thermal-allof-v1-4-554061b52fbc@linaro.org Signed-off-by: Daniel Lezcano Documentation/devicetree/bindings/thermal/brcm,avs-ro-thermal.yaml | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) commit e8eca74902eba1df568eda0b1b88781439a58bd8 Author: Krzysztof Kozlowski Date: Fri Jul 5 11:51:22 2024 +0200 dt-bindings: thermal: allwinner,sun8i-a83t-ths: reference thermal-sensor schema Device is a thermal sensor and it requires '#thermal-sensor-cells', so reference the thermal-sensor.yaml to simplify it and bring the common definition of '#thermal-sensor-cells' property. Reviewed-by: Vasily Khoruzhick Acked-by: Chen-Yu Tsai Acked-by: Conor Dooley Signed-off-by: Krzysztof Kozlowski Link: https://lore.kernel.org/r/20240705-dt-bindings-thermal-allof-v1-3-554061b52fbc@linaro.org Signed-off-by: Daniel Lezcano .../devicetree/bindings/thermal/allwinner,sun8i-a83t-ths.yaml | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) commit da1f72fbe7a8b562a0cb0a9b771347c78ef4a612 Author: Krzysztof Kozlowski Date: Fri Jul 5 11:51:21 2024 +0200 dt-bindings: thermal: amlogic: reference thermal-sensor schema Device is a thermal sensor and all in-tree DTS provide '#thermal-sensor-cells', so reference the thermal-sensor.yaml to simplify it, bring the common definition of '#thermal-sensor-cells' property and require it. Reviewed-by: Neil Armstrong Reviewed-by: Guillaume LA ROQUE Acked-by: Conor Dooley Signed-off-by: Krzysztof Kozlowski Link: https://lore.kernel.org/r/20240705-dt-bindings-thermal-allof-v1-2-554061b52fbc@linaro.org Signed-off-by: Daniel Lezcano Documentation/devicetree/bindings/thermal/amlogic,thermal.yaml | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) commit f5a890927ec47c11427ed1f11192a9b4a7be3d34 Author: Krzysztof Kozlowski Date: Fri Jul 5 11:51:20 2024 +0200 dt-bindings: thermal: samsung,exynos: specify cells All Samsung Exynos SoCs Thermal Management Units have only one sensor, so make '#thermal-sensor-cells' fixed at 0. Acked-by: Conor Dooley Signed-off-by: Krzysztof Kozlowski Link: https://lore.kernel.org/r/20240705-dt-bindings-thermal-allof-v1-1-554061b52fbc@linaro.org Signed-off-by: Daniel Lezcano Documentation/devicetree/bindings/thermal/samsung,exynos-thermal.yaml | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) commit a5d4afb92eca216b27f662d77e91f2d464345c6e Author: Chen-Yu Tsai Date: Thu Jun 20 17:23:03 2024 +0800 thermal/drivers/mediatek/lvts_thermal: Provide default calibration data On some pre-production hardware, the SoCs do not contain calibration data for the thermal sensors. The downstream drivers provide default values that sort of work, instead of having the thermal sensors not work at all. Port the default values to the upstream driver. These values are from the ChromeOS kernels, which sadly do not cover the MT7988. Signed-off-by: Chen-Yu Tsai Reviewed-by: AngeloGioacchino Del Regno Link: https://lore.kernel.org/r/20240620092306.2352606-1-wenst@chromium.org Signed-off-by: Daniel Lezcano drivers/thermal/mediatek/lvts_thermal.c | 34 +++++++++++++++++++++++++-------- 1 file changed, 26 insertions(+), 8 deletions(-) commit 97e32381d0fc6c2602a767b0c46e15eb2b75971d Author: Krzysztof Kozlowski Date: Tue Jul 2 16:52:48 2024 +0200 dt-bindings: thermal: correct thermal zone node name limit Linux kernel uses thermal zone node name during registering thermal zones and has a hard-coded limit of 20 characters, including terminating NUL byte. The bindings expect node names to finish with '-thermal' which is eight bytes long, thus we have only 11 characters for the reset of the node name (thus 10 for the pattern after leading fixed character). Reported-by: Rob Herring Closes: https://lore.kernel.org/all/CAL_JsqKogbT_4DPd1n94xqeHaU_J8ve5K09WOyVsRX3jxxUW3w@mail.gmail.com/ Fixes: 1202a442a31f ("dt-bindings: thermal: Add yaml bindings for thermal zones") Cc: stable@vger.kernel.org Signed-off-by: Krzysztof Kozlowski Link: https://lore.kernel.org/r/20240702145248.47184-1-krzysztof.kozlowski@linaro.org Signed-off-by: Daniel Lezcano Documentation/devicetree/bindings/thermal/thermal-zones.yaml | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) commit b18ce693a26526603e104d95ce91040fd73e98a7 Author: Abel Vesa Date: Fri Jun 28 11:31:01 2024 +0300 dt-bindings: thermal: qcom-tsens: Document the X1E80100 Temperature Sensor Document the Temperature Sensor (TSENS) on the X1E80100 Platform. Reviewed-by: Krzysztof Kozlowski Signed-off-by: Abel Vesa Reviewed-by: Amit Kucheria Link: https://lore.kernel.org/r/20240628-x1e80100-bindings-thermal-qcom-tsens-v2-1-4843d4c2ba24@linaro.org Signed-off-by: Daniel Lezcano Documentation/devicetree/bindings/thermal/qcom-tsens.yaml | 1 + 1 file changed, 1 insertion(+) commit bb6972fad98fbe6555653e762e5b31ff352a9e73 Author: Abdulrasaq Lawani Date: Tue Jun 18 22:31:35 2024 -0400 dt-bindings: thermal: convert hisilicon-thermal.txt to dt-schema Convert the hisilicon SoCs tsensor txt bindings to dt-schema Signed-off-by: Abdulrasaq Lawani Reviewed-by: Krzysztof Kozlowski Link: https://lore.kernel.org/r/20240618-hisilicon-thermal-dt-bindings-conversion-v4-1-7eba97fbe6d0@gmail.com Signed-off-by: Daniel Lezcano .../bindings/thermal/hisilicon,tsensor.yaml | 57 ++++++++++++++++++++++ .../bindings/thermal/hisilicon-thermal.txt | 32 ------------ 2 files changed, 57 insertions(+), 32 deletions(-) commit be3e224ec502d49cf9017304286c14418b230fe6 Author: Julien Panis Date: Mon Jun 3 12:50:49 2024 +0200 dt-bindings: thermal: mediatek: Fix thermal zone definitions for MT8188 Fix thermal zone names for consistency with the other SoCs: - GPU0 must be used as the first GPU item. - SOCx deal with audio DSP, video, and infra subsystems. The naming must be fixed "atomically" so compilation does not break. As a result, the change is made in the dt-bindings and in the LVTS driver within a single commit, despite the checkpatch warning. The definitions can be safely modified here because they are used only in the LVTS driver, which is modified accordingly, and have not yet been included in a released kernel. Fixes: 78c88534e5e1 ("dt-bindings: thermal: mediatek: Add LVTS thermal controller definition for MT8188") Reviewed-by: AngeloGioacchino Del Regno Acked-by: Conor Dooley Signed-off-by: Julien Panis Link: https://lore.kernel.org/r/20240603-mtk-thermal-mt818x-dtsi-v7-2-8c8e3c7a3643@baylibre.com Signed-off-by: Daniel Lezcano drivers/thermal/mediatek/lvts_thermal.c | 10 +++++----- include/dt-bindings/thermal/mediatek,lvts-thermal.h | 10 +++++----- 2 files changed, 10 insertions(+), 10 deletions(-) commit 6b04928e83f298d99359f3ba67187a328c223357 Author: Julien Panis Date: Mon Jun 3 12:50:48 2024 +0200 dt-bindings: thermal: mediatek: Fix thermal zone definition for MT8186 Fix a thermal zone name for consistency with the other SoCs: MFG contains GPU, the latter is more specific and must be used here. The naming must be fixed "atomically" so compilation does not break. As a result, the change is made in the dt-bindings and in the LVTS driver within a single commit, despite the checkpatch warning. The definition can be safely modified here because it is used only in the LVTS driver, which is modified accordingly, and has not yet been included in a released kernel. Fixes: a2ca202350f9 ("dt-bindings: thermal: mediatek: Add LVTS thermal controller definition for MT8186") Reviewed-by: AngeloGioacchino Del Regno Acked-by: Conor Dooley Signed-off-by: Julien Panis Link: https://lore.kernel.org/r/20240603-mtk-thermal-mt818x-dtsi-v7-1-8c8e3c7a3643@baylibre.com Signed-off-by: Daniel Lezcano drivers/thermal/mediatek/lvts_thermal.c | 2 +- include/dt-bindings/thermal/mediatek,lvts-thermal.h | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) commit 854a8e208c26b60708785d4ef8d5cf8ee014335a Author: Théo Lebrun Date: Thu Apr 25 17:32:38 2024 +0200 thermal/drivers/k3_j72xx_bandgap: Implement suspend/resume support This add suspend-to-ram support. The derived_table is kept-as is, so the resume is only about pm_runtime_* calls and restoring the same registers as the probe. Extract the hardware initialization procedure to a function called at both probe-time & resume-time. The probe-time loop is split in two to ensure doing the hardware initialization before registering thermal zones. That ensures our callbacks cannot be called while in bad state. The 100ms delay in the hardware initialization sequence was removed. It was initially added to be sure the thresholds are programmed before enabling the interrupt, but in fact it's not needed (tested on J7200 platform). Signed-off-by: Théo Lebrun Acked-by: Keerthy Signed-off-by: Thomas Richard Link: https://lore.kernel.org/r/20240425153238.498750-1-thomas.richard@bootlin.com Signed-off-by: Daniel Lezcano drivers/thermal/k3_j72xx_bandgap.c | 111 ++++++++++++++++++++++++++----------- 1 file changed, 78 insertions(+), 33 deletions(-) commit f996e2b17a30c2919ed018d3902d1e633ae40ab2 Author: Niklas Söderlund Date: Mon May 6 17:40:11 2024 +0200 thermal/drivers/renesas/rcar: Add dependency on OF The R-Car thermal driver depends on OF, describe this. Signed-off-by: Niklas Söderlund Signed-off-by: Daniel Lezcano Link: https://lore.kernel.org/r/20240506154011.344324-3-niklas.soderlund+renesas@ragnatech.se drivers/thermal/renesas/Kconfig | 1 + 1 file changed, 1 insertion(+) commit 9d617949d49099d549175979e6454ce64461eaa2 Author: Niklas Söderlund Date: Mon May 6 17:40:10 2024 +0200 thermal/drivers/renesas: Group all renesas thermal drivers together Move all Renesas thermal drivers to a vendor specific directory. All drivers are moved verbatim apart from the updated include path for thermal_hwmon.h. Signed-off-by: Niklas Söderlund Signed-off-by: Daniel Lezcano Link: https://lore.kernel.org/r/20240506154011.344324-2-niklas.soderlund+renesas@ragnatech.se MAINTAINERS | 4 ++-- drivers/thermal/Kconfig | 28 ++--------------------- drivers/thermal/Makefile | 4 +--- drivers/thermal/renesas/Kconfig | 27 ++++++++++++++++++++++ drivers/thermal/renesas/Makefile | 5 ++++ drivers/thermal/{ => renesas}/rcar_gen3_thermal.c | 2 +- drivers/thermal/{ => renesas}/rcar_thermal.c | 2 +- drivers/thermal/{ => renesas}/rzg2l_thermal.c | 2 +- 8 files changed, 40 insertions(+), 34 deletions(-) commit 76be2f9823b10c07daf814cb6c732eb1456a0b9e Author: Stanislav Jakubek Date: Wed Jul 3 14:02:46 2024 +0200 dt-bindings: timer: sprd-timer: convert to YAML Convert the Spreadtrum SC9860 timer bindings to DT schema. Changes during conversion: - rename file to match compatible - add sprd,sc9860-suspend-timer which was previously undocumented - minor grammar fix in description Signed-off-by: Stanislav Jakubek Reviewed-by: Conor Dooley Reviewed-by: Baolin Wang Link: https://lore.kernel.org/r/ZoU95lBgoyF/8Md3@standask-GA-A55M-S2HP Signed-off-by: Rob Herring (Arm) .../bindings/timer/sprd,sc9860-timer.yaml | 68 ++++++++++++++++++++++ .../bindings/timer/spreadtrum,sprd-timer.txt | 20 ------- 2 files changed, 68 insertions(+), 20 deletions(-) commit 03a9b67087ba071f69b12d730b36aa7c2d3dbf21 Merge: f4c0cd1870af 3afa157f43b3 Author: Borislav Petkov (AMD) Date: Mon Jul 15 11:59:10 2024 +0200 Merge remote-tracking branches 'ras/edac-amd-atl' and 'ras/edac-misc' into edac-updates * ras/edac-amd-atl: RAS/AMD/FMPM: Use atl internal.h for INVALID_SPA RAS/AMD/ATL: Implement DF 4.5 NP2 denormalization RAS/AMD/ATL: Validate address map when information is gathered RAS/AMD/ATL: Expand helpers for adding and removing base and hole RAS/AMD/ATL: Read DRAM hole base early RAS/AMD/ATL: Add amd_atl pr_fmt() prefix RAS/AMD/ATL: Add a missing module description * ras/edac-misc: EDAC: Add missing MODULE_DESCRIPTION() macros EDAC/dmc520: Use devm_platform_ioremap_resource() EDAC/igen6: Add Intel Arrow Lake-U/H SoCs support EDAC, i10nm: make skx_common.o a separate module EDAC/skx: Switch to new Intel CPU model defines EDAC/sb_edac: Switch to new Intel CPU model defines EDAC, pnd2: Switch to new Intel CPU model defines EDAC/i10nm: Switch to new Intel CPU model defines EDAC/ghes: Add missing newline to pr_info() statement RAS/AMD/ATL: Add missing newline to pr_info() statement EDAC/thunderx: Remove unused struct error_syndrome Signed-off-by: Borislav Petkov (AMD) commit 7c25946f345838c3d66e54dd808ec5183640a75a Author: Gergo Koteles Date: Tue Jul 9 11:33:05 2024 +0200 platform/x86: ideapad-laptop: use cleanup.h Use cleanup.h helpers to simplify some code paths. Signed-off-by: Gergo Koteles Link: https://lore.kernel.org/r/851d4180f1df5a10ca6e2feaf429611f1c0ccc88.1720515666.git.soyer@irl.hu Reviewed-by: Ilpo Järvinen Signed-off-by: Ilpo Järvinen drivers/platform/x86/ideapad-laptop.c | 71 +++++++++++++++-------------------- 1 file changed, 31 insertions(+), 40 deletions(-) commit f6bd2f633b686cdd6a466a4d8484fb74492b1125 Author: Alexis Belmonte Date: Fri Jul 12 19:26:47 2024 +0200 platform/x86: hp-wmi: Fix implementation of the platform_profile_omen_get function Fix ill-formed implementation of the platform_profile_omen_get function introduced by the commit d23430233494 ("platform/x86: hp-wmi: Fix platform profile option switch bug on Omen and Victus laptops"). platform_profile_omen_get() is .profile_get function that should set *profile and return 0 on success. Reported-by: Dan Carpenter Fixes: d23430233494 ("platform/x86: hp-wmi: Fix platform profile option switch bug on Omen and Victus laptops") Signed-off-by: Alexis Belmonte Reviewed-by: Armin Wolf Link: https://lore.kernel.org/r/ZpFnV8w1558BW7iZ@alexis-pc Reviewed-by: Ilpo Järvinen Signed-off-by: Ilpo Järvinen drivers/platform/x86/hp/hp-wmi.c | 6 ++---- 1 file changed, 2 insertions(+), 4 deletions(-) commit 436381eaf2a423e60fc8340399f7d2458091b383 Merge: a52c6330ff2f d73778e4b867 Author: Vlastimil Babka Date: Mon Jul 15 10:44:16 2024 +0200 Merge branch 'slab/for-6.11/buckets' into slab/for-next Merge all the slab patches previously collected on top of v6.10-rc1, over cleanups/fixes that had to be based on rc6. commit a52c6330ff2fe1163333fa6609bdc6e8763ec286 Author: Alex Shi (Tencent) Date: Fri Jul 12 12:14:35 2024 +0800 mm/memcg: alignment memcg_data define condition commit 21c690a349ba ("mm: introduce slabobj_ext to support slab object extensions") changed the folio/page->memcg_data define condition from MEMCG to SLAB_OBJ_EXT. This action make memcg_data exposed while !MEMCG. As Vlastimil Babka suggested, let's add _unused_slab_obj_exts for SLAB_MATCH for slab.obj_exts while !MEMCG. That could resolve the match issue, clean up the feature logical. Signed-off-by: Alex Shi (Tencent) Cc: Randy Dunlap Cc: Yoann Congal Cc: Masahiro Yamada Cc: Petr Mladek Cc: Suren Baghdasaryan Cc: Vlastimil Babka Signed-off-by: Vlastimil Babka include/linux/mm_types.h | 9 +++++++-- mm/slab.h | 4 +++- 2 files changed, 10 insertions(+), 3 deletions(-) commit 5fa87a081b2d633b944d5a93f5767623ef2a961d Merge: 8fc1e8b23077 d2eb433c8546 Author: Takashi Iwai Date: Mon Jul 15 08:17:55 2024 +0200 Merge branch 'for-next' into for-linus Pull 6.11 devel branch Signed-off-by: Takashi Iwai commit ed46f1f7731d2cd77d623c0f895df9e23c0bffb6 Author: Arnd Bergmann Date: Mon Jul 15 08:02:30 2024 +0200 platform: cznic: turris-omnia-mcu: fix Kconfig dependencies The newly added driver causes a Kconfig warning: WARNING: unmet direct dependencies detected for RTC_CLASS Depends on [n]: !S390 [=y] Selected by [m]: - TURRIS_OMNIA_MCU [=m] && CZNIC_PLATFORMS [=y] && (MACH_ARMADA_38X || COMPILE_TEST [=y]) && I2C [=m] && OF [=y] && WATCHDOG [=y] The problem here is that it selects entire subsystems, which normal device drivers should not do. Changes all of these to 'depends on' instead. Fixes: dfa556e45ae9e ("platform: cznic: turris-omnia-mcu: Add support for MCU connected GPIOs") Fixes: 90e700fd12b61 ("platform: cznic: turris-omnia-mcu: Add support for poweroff and wakeup") Fixes: ab89fb5fb92c7 ("platform: cznic: turris-omnia-mcu: Add support for MCU watchdog") Fixes: 41bb142a40289 ("platform: cznic: turris-omnia-mcu: Add support for MCU provided TRNG") Reported-by: Nathan Chancellor Signed-off-by: Arnd Bergmann drivers/platform/cznic/Kconfig | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) commit 3e301b431b91e4b973dbc520e90e220acb5b91f5 Author: Jiri Olsa Date: Fri Jul 12 15:52:28 2024 +0200 selftests/bpf: Change uretprobe syscall number in uprobe_syscall test Fixing the syscall number value. Link: https://lore.kernel.org/all/20240712135228.1619332-3-jolsa@kernel.org/ Fixes: 9e7f74e64ae5 ("selftests/bpf: Add uretprobe syscall call from user space test") Signed-off-by: Jiri Olsa Acked-by: Andrii Nakryiko Signed-off-by: Masami Hiramatsu (Google) tools/testing/selftests/bpf/prog_tests/uprobe_syscall.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 63ded110979bdd8741542ec66fb9e2d2074aed8c Author: Jiri Olsa Date: Fri Jul 12 15:52:27 2024 +0200 uprobe: Change uretprobe syscall scope and number After discussing with Arnd [1] it's preferable to change uretprobe syscall number to 467 to omit the merge conflict with xattrat syscalls. Also changing the ABI to 'common' which will ease up the global scripts/syscall.tbl management. One consequence is we generate uretprobe syscall numbers for ABIs that do not support uretprobe syscall, but the syscall still returns -ENOSYS when called in that ABI. [1] https://lore.kernel.org/lkml/784a34e5-4654-44c9-9c07-f9f4ffd952a0@app.fastmail.com/ Link: https://lore.kernel.org/all/20240712135228.1619332-2-jolsa@kernel.org/ Fixes: 190fec72df4a ("uprobe: Wire up uretprobe system call") Suggested-by: Arnd Bergmann Signed-off-by: Jiri Olsa Acked-by: Andrii Nakryiko Signed-off-by: Masami Hiramatsu (Google) arch/x86/entry/syscalls/syscall_64.tbl | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 58629d4871e8eb2c385b16a73a8451669db59f39 Author: Lai Jiangshan Date: Wed Jul 3 17:27:41 2024 +0800 workqueue: Always queue work items to the newest PWQ for order workqueues To ensure non-reentrancy, __queue_work() attempts to enqueue a work item to the pool of the currently executing worker. This is not only unnecessary for an ordered workqueue, where order inherently suggests non-reentrancy, but it could also disrupt the sequence if the item is not enqueued on the newest PWQ. Just queue it to the newest PWQ and let order management guarantees non-reentrancy. Signed-off-by: Lai Jiangshan Fixes: 4c065dbce1e8 ("workqueue: Enable unbound cpumask update on ordered workqueues") Cc: stable@vger.kernel.org # v6.9+ Signed-off-by: Tejun Heo (cherry picked from commit 74347be3edfd11277799242766edf844c43dd5d3) kernel/workqueue.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) commit 9283ff5be1510a35356656a6c1efe14f765c936a Merge: 226c49446bcc 57b56d16800e Author: Tejun Heo Date: Sun Jul 14 18:04:03 2024 -1000 Merge branch 'for-6.10-fixes' into for-6.11 commit 59a931c5b732ca5fc2ca727f5a72aeabaafa85ec Author: Taehee Yoo Date: Fri Jul 12 09:51:16 2024 +0000 xdp: fix invalid wait context of page_pool_destroy() If the driver uses a page pool, it creates a page pool with page_pool_create(). The reference count of page pool is 1 as default. A page pool will be destroyed only when a reference count reaches 0. page_pool_destroy() is used to destroy page pool, it decreases a reference count. When a page pool is destroyed, ->disconnect() is called, which is mem_allocator_disconnect(). This function internally acquires mutex_lock(). If the driver uses XDP, it registers a memory model with xdp_rxq_info_reg_mem_model(). The xdp_rxq_info_reg_mem_model() internally increases a page pool reference count if a memory model is a page pool. Now the reference count is 2. To destroy a page pool, the driver should call both page_pool_destroy() and xdp_unreg_mem_model(). The xdp_unreg_mem_model() internally calls page_pool_destroy(). Only page_pool_destroy() decreases a reference count. If a driver calls page_pool_destroy() then xdp_unreg_mem_model(), we will face an invalid wait context warning. Because xdp_unreg_mem_model() calls page_pool_destroy() with rcu_read_lock(). The page_pool_destroy() internally acquires mutex_lock(). Splat looks like: ============================= [ BUG: Invalid wait context ] 6.10.0-rc6+ #4 Tainted: G W ----------------------------- ethtool/1806 is trying to lock: ffffffff90387b90 (mem_id_lock){+.+.}-{4:4}, at: mem_allocator_disconnect+0x73/0x150 other info that might help us debug this: context-{5:5} 3 locks held by ethtool/1806: stack backtrace: CPU: 0 PID: 1806 Comm: ethtool Tainted: G W 6.10.0-rc6+ #4 f916f41f172891c800f2fed Hardware name: ASUS System Product Name/PRIME Z690-P D4, BIOS 0603 11/01/2021 Call Trace: dump_stack_lvl+0x7e/0xc0 __lock_acquire+0x1681/0x4de0 ? _printk+0x64/0xe0 ? __pfx_mark_lock.part.0+0x10/0x10 ? __pfx___lock_acquire+0x10/0x10 lock_acquire+0x1b3/0x580 ? mem_allocator_disconnect+0x73/0x150 ? __wake_up_klogd.part.0+0x16/0xc0 ? __pfx_lock_acquire+0x10/0x10 ? dump_stack_lvl+0x91/0xc0 __mutex_lock+0x15c/0x1690 ? mem_allocator_disconnect+0x73/0x150 ? __pfx_prb_read_valid+0x10/0x10 ? mem_allocator_disconnect+0x73/0x150 ? __pfx_llist_add_batch+0x10/0x10 ? console_unlock+0x193/0x1b0 ? lockdep_hardirqs_on+0xbe/0x140 ? __pfx___mutex_lock+0x10/0x10 ? tick_nohz_tick_stopped+0x16/0x90 ? __irq_work_queue_local+0x1e5/0x330 ? irq_work_queue+0x39/0x50 ? __wake_up_klogd.part.0+0x79/0xc0 ? mem_allocator_disconnect+0x73/0x150 mem_allocator_disconnect+0x73/0x150 ? __pfx_mem_allocator_disconnect+0x10/0x10 ? mark_held_locks+0xa5/0xf0 ? rcu_is_watching+0x11/0xb0 page_pool_release+0x36e/0x6d0 page_pool_destroy+0xd7/0x440 xdp_unreg_mem_model+0x1a7/0x2a0 ? __pfx_xdp_unreg_mem_model+0x10/0x10 ? kfree+0x125/0x370 ? bnxt_free_ring.isra.0+0x2eb/0x500 ? bnxt_free_mem+0x5ac/0x2500 xdp_rxq_info_unreg+0x4a/0xd0 bnxt_free_mem+0x1356/0x2500 bnxt_close_nic+0xf0/0x3b0 ? __pfx_bnxt_close_nic+0x10/0x10 ? ethnl_parse_bit+0x2c6/0x6d0 ? __pfx___nla_validate_parse+0x10/0x10 ? __pfx_ethnl_parse_bit+0x10/0x10 bnxt_set_features+0x2a8/0x3e0 __netdev_update_features+0x4dc/0x1370 ? ethnl_parse_bitset+0x4ff/0x750 ? __pfx_ethnl_parse_bitset+0x10/0x10 ? __pfx___netdev_update_features+0x10/0x10 ? mark_held_locks+0xa5/0xf0 ? _raw_spin_unlock_irqrestore+0x42/0x70 ? __pm_runtime_resume+0x7d/0x110 ethnl_set_features+0x32d/0xa20 To fix this problem, it uses rhashtable_lookup_fast() instead of rhashtable_lookup() with rcu_read_lock(). Using xa without rcu_read_lock() here is safe. xa is freed by __xdp_mem_allocator_rcu_free() and this is called by call_rcu() of mem_xa_remove(). The mem_xa_remove() is called by page_pool_destroy() if a reference count reaches 0. The xa is already protected by the reference count mechanism well in the control plane. So removing rcu_read_lock() for page_pool_destroy() is safe. Fixes: c3f812cea0d7 ("page_pool: do not release pool until inflight == 0.") Signed-off-by: Taehee Yoo Reviewed-by: Jakub Kicinski Link: https://patch.msgid.link/20240712095116.3801586-1-ap420073@gmail.com Signed-off-by: Jakub Kicinski net/core/xdp.c | 4 +--- 1 file changed, 1 insertion(+), 3 deletions(-) commit f8321fa75102246d7415a6af441872f6637c93ab Author: Breno Leitao Date: Fri Jul 12 04:53:25 2024 -0700 virtio_net: Fix napi_skb_cache_put warning After the commit bdacf3e34945 ("net: Use nested-BH locking for napi_alloc_cache.") was merged, the following warning began to appear: WARNING: CPU: 5 PID: 1 at net/core/skbuff.c:1451 napi_skb_cache_put+0x82/0x4b0 __warn+0x12f/0x340 napi_skb_cache_put+0x82/0x4b0 napi_skb_cache_put+0x82/0x4b0 report_bug+0x165/0x370 handle_bug+0x3d/0x80 exc_invalid_op+0x1a/0x50 asm_exc_invalid_op+0x1a/0x20 __free_old_xmit+0x1c8/0x510 napi_skb_cache_put+0x82/0x4b0 __free_old_xmit+0x1c8/0x510 __free_old_xmit+0x1c8/0x510 __pfx___free_old_xmit+0x10/0x10 The issue arises because virtio is assuming it's running in NAPI context even when it's not, such as in the netpoll case. To resolve this, modify virtnet_poll_tx() to only set NAPI when budget is available. Same for virtnet_poll_cleantx(), which always assumed that it was in a NAPI context. Fixes: df133f3f9625 ("virtio_net: bulk free tx skbs") Suggested-by: Jakub Kicinski Signed-off-by: Breno Leitao Reviewed-by: Jakub Kicinski Acked-by: Michael S. Tsirkin Acked-by: Jason Wang Reviewed-by: Heng Qi Link: https://patch.msgid.link/20240712115325.54175-1-leitao@debian.org Signed-off-by: Jakub Kicinski drivers/net/virtio_net.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) commit 217b953a8ca6af14dc81935d7ab4b3815966bb62 Merge: d944c27a9d58 03ab6c244bb0 Author: Jakub Kicinski Date: Sun Jul 14 20:38:38 2024 -0700 Merge branch 'net-phy-bcm5481x-add-support-for-broadr-reach-mode' Kamil Horák says: ==================== net: phy: bcm5481x: add support for BroadR-Reach mode PATCH 1 - Add the 10baseT1BRR_Full link mode PATCH 2 - Add the definitions of LRE registers, necessary to use BroadR-Reach modes on the BCM5481x PHY PATCH 3 - Add brr-mode flag to switch between IEEE802.3 and BroadR-Reach PATCH 4 - Implementation of the BroadR-Reach modes for the Broadcom PHYs ==================== Link: https://patch.msgid.link/20240712150709.3134474-1-kamilh@axis.com Signed-off-by: Jakub Kicinski commit 03ab6c244bb0ced0a67b86399a282987740bb116 Author: Kamil Horák (2N) Date: Fri Jul 12 17:07:09 2024 +0200 net: phy: bcm-phy-lib: Implement BroadR-Reach link modes Implement single-pair BroadR-Reach modes on bcm5481x PHY by Broadcom. Create set of functions alternative to IEEE 802.3 to handle configuration of these modes on compatible Broadcom PHYs. There is only subset of capabilities supported because of limited collection of hardware available for the development. For BroadR-Reach capable PHYs, the LRE (Long Reach Ethernet) alternative register set is handled. Only bcm54811 PHY is verified, for bcm54810, there is some support possible but untested. There is no auto-negotiation of the link parameters (called LDS in the Broadcom terminology, Long-Distance Signaling) for bcm54811. It should be possible to enable LDS for bcm54810. Signed-off-by: Kamil Horák (2N) Reviewed-by: Andrew Lunn Reviewed-by: Florian Fainelli Link: https://patch.msgid.link/20240712150709.3134474-5-kamilh@axis.com Signed-off-by: Jakub Kicinski drivers/net/phy/bcm-phy-lib.c | 115 ++++++++++++ drivers/net/phy/bcm-phy-lib.h | 4 + drivers/net/phy/broadcom.c | 403 +++++++++++++++++++++++++++++++++++++++--- 3 files changed, 494 insertions(+), 28 deletions(-) commit 775631d7845b34996ceb0d975725c16d9a414430 Author: Kamil Horák (2N) Date: Fri Jul 12 17:07:08 2024 +0200 dt-bindings: ethernet-phy: add optional brr-mode flag There is a group of PHY chips supporting BroadR-Reach link modes in a manner allowing for more or less identical register usage as standard Clause 22 PHY. These chips support standard Ethernet link modes as well, however, the circuitry is mutually exclusive and cannot be auto-detected. The link modes in question are 100Base-T1 as defined in IEEE802.3bw, based on Broadcom's 1BR-100 link mode, and newly defined 10Base-T1BRR (1BR-10 in Broadcom documents). Add optional brr-mode flag to switch the PHY to BroadR-Reach mode. Signed-off-by: Kamil Horák (2N) Reviewed-by: Rob Herring (Arm) Reviewed-by: Florian Fainelli Link: https://patch.msgid.link/20240712150709.3134474-4-kamilh@axis.com Signed-off-by: Jakub Kicinski Documentation/devicetree/bindings/net/ethernet-phy.yaml | 8 ++++++++ 1 file changed, 8 insertions(+) commit ff253875ff3bab75214c4e94352956dc02a0d965 Author: Kamil Horák (2N) Date: Fri Jul 12 17:07:07 2024 +0200 net: phy: bcm54811: Add LRE registers definitions Add the definitions of LRE registers for Broadcom BCM5481x PHY Signed-off-by: Kamil Horák (2N) Reviewed-by: Andrew Lunn Reviewed-by: Florian Fainelli Link: https://patch.msgid.link/20240712150709.3134474-3-kamilh@axis.com Signed-off-by: Jakub Kicinski include/linux/brcmphy.h | 88 +++++++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 88 insertions(+) commit 2c1583290b08c5aa9005178a573be8f329de2976 Author: Kamil Horák (2N) Date: Fri Jul 12 17:07:06 2024 +0200 net: phy: bcm54811: New link mode for BroadR-Reach Introduce a new link mode necessary for 10 MBit single-pair connection in BroadR-Reach mode on bcm5481x PHY by Broadcom. This new link mode, 10baseT1BRR, is known as 1BR10 in the Broadcom terminology. Another link mode to be used is 1BR100 and it is already present as 100baseT1, because Broadcom's 1BR100 became 100baseT1 (IEEE 802.3bw). Signed-off-by: Kamil Horák (2N) Reviewed-by: Florian Fainelli Reviewed-by: Andrew Lunn Link: https://patch.msgid.link/20240712150709.3134474-2-kamilh@axis.com Signed-off-by: Jakub Kicinski drivers/net/phy/phy-core.c | 3 ++- include/uapi/linux/ethtool.h | 1 + net/ethtool/common.c | 3 +++ 3 files changed, 6 insertions(+), 1 deletion(-) commit d944c27a9d58179b2fd96e23104f213481ec1e8d Merge: e6c29506b2ec 99c861b44eb1 Author: Jakub Kicinski Date: Sun Jul 14 20:32:41 2024 -0700 Merge branch 'virtio-net-support-af_xdp-zero-copy' Xuan Zhuo says: ==================== virtio-net: support AF_XDP zero copy v5: http://lore.kernel.org/all/20240611114147.31320-1-xuanzhuo@linux.alibaba.com XDP socket(AF_XDP) is an excellent bypass kernel network framework. The zero copy feature of xsk (XDP socket) needs to be supported by the driver. The performance of zero copy is very good. mlx5 and intel ixgbe already support this feature, This patch set allows virtio-net to support xsk's zerocopy xmit feature. At present, we have completed some preparation: 1. vq-reset (virtio spec and kernel code) 2. virtio-core premapped dma 3. virtio-net xdp refactor So it is time for Virtio-Net to complete the support for the XDP Socket Zerocopy. Virtio-net can not increase the queue num at will, so xsk shares the queue with kernel. On the other hand, Virtio-Net does not support generate interrupt from driver manually, so when we wakeup tx xmit, we used some tips. If the CPU run by TX NAPI last time is other CPUs, use IPI to wake up NAPI on the remote CPU. If it is also the local CPU, then we wake up napi directly. This patch set includes some refactor to the virtio-net to let that to support AF_XDP. Because there are too many commits, the work of virtio net supporting af-xdp is split to rx part and tx part. This patch set is for rx part. So the flag NETDEV_XDP_ACT_XSK_ZEROCOPY is not added, if someone want to test for af-xdp rx, the flag needs to be adding locally. ENV: Qemu with vhost-user(polling mode). Host CPU: Intel(R) Xeon(R) Platinum 8163 CPU @ 2.50GHz testpmd> show port stats all ######################## NIC statistics for port 0 ######################## RX-packets: 19531092064 RX-missed: 0 RX-bytes: 1093741155584 RX-errors: 0 RX-nombuf: 0 TX-packets: 5959955552 TX-errors: 0 TX-bytes: 371030645664 Throughput (since last show) Rx-pps: 8861574 Rx-bps: 3969985208 Tx-pps: 8861493 Tx-bps: 3969962736 ############################################################################ testpmd> show port stats all ######################## NIC statistics for port 0 ######################## RX-packets: 68152727 RX-missed: 0 RX-bytes: 3816552712 RX-errors: 0 RX-nombuf: 0 TX-packets: 68114967 TX-errors: 33216 TX-bytes: 3814438152 Throughput (since last show) Rx-pps: 6333196 Rx-bps: 2837272088 Tx-pps: 6333227 Tx-bps: 2837285936 ############################################################################ But AF_XDP consumes more CPU for tx and rx napi(100% and 86%). ==================== Link: https://patch.msgid.link/20240708112537.96291-1-xuanzhuo@linux.alibaba.com Signed-off-by: Jakub Kicinski commit 99c861b44eb1fb9dfe8776854116a6a9064c19bb Author: Xuan Zhuo Date: Mon Jul 8 19:25:37 2024 +0800 virtio_net: xsk: rx: support recv merge mode Support AF-XDP for merge mode. Signed-off-by: Xuan Zhuo Acked-by: Jason Wang Acked-by: Michael S. Tsirkin Link: https://patch.msgid.link/20240708112537.96291-11-xuanzhuo@linux.alibaba.com Signed-off-by: Jakub Kicinski drivers/net/virtio_net.c | 144 +++++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 144 insertions(+) commit a4e7ba7027012f009f22a68bcfde670f9298d3a4 Author: Xuan Zhuo Date: Mon Jul 8 19:25:36 2024 +0800 virtio_net: xsk: rx: support recv small mode In the process: 1. We may need to copy data to create skb for XDP_PASS. 2. We may need to call xsk_buff_free() to release the buffer. 3. The handle for xdp_buff is difference from the buffer. If we pushed this logic into existing receive handle(merge and small), we would have to maintain code scattered inside merge and small (and big). So I think it is a good choice for us to put the xsk code into an independent function. Signed-off-by: Xuan Zhuo Acked-by: Jason Wang Acked-by: Michael S. Tsirkin Link: https://patch.msgid.link/20240708112537.96291-10-xuanzhuo@linux.alibaba.com Signed-off-by: Jakub Kicinski drivers/net/virtio_net.c | 176 ++++++++++++++++++++++++++++++++++++++++++++--- 1 file changed, 168 insertions(+), 8 deletions(-) commit e9f3962441c0a4d6f16c656e6c8aa02a3ccdd568 Author: Xuan Zhuo Date: Mon Jul 8 19:25:35 2024 +0800 virtio_net: xsk: rx: support fill with xsk buffer Implement the logic of filling rq with XSK buffers. Signed-off-by: Xuan Zhuo Acked-by: Jason Wang Acked-by: Michael S. Tsirkin Link: https://patch.msgid.link/20240708112537.96291-9-xuanzhuo@linux.alibaba.com Signed-off-by: Jakub Kicinski drivers/net/virtio_net.c | 70 +++++++++++++++++++++++++++++++++++++++++++++--- 1 file changed, 66 insertions(+), 4 deletions(-) commit 19a5a7710ee1c60e491e326f9107666435f94044 Author: Xuan Zhuo Date: Mon Jul 8 19:25:34 2024 +0800 virtio_net: xsk: support wakeup xsk wakeup is used to trigger the logic for xsk xmit by xsk framework or user. Virtio-net does not support to actively generate an interruption, so it tries to trigger tx NAPI on the local cpu. Signed-off-by: Xuan Zhuo Acked-by: Jason Wang Acked-by: Michael S. Tsirkin Link: https://patch.msgid.link/20240708112537.96291-8-xuanzhuo@linux.alibaba.com Signed-off-by: Jakub Kicinski drivers/net/virtio_net.c | 24 ++++++++++++++++++++++++ 1 file changed, 24 insertions(+) commit 09d2b3182c8e3a215a9b2a1834f81dd07305989f Author: Xuan Zhuo Date: Mon Jul 8 19:25:33 2024 +0800 virtio_net: xsk: bind/unbind xsk for rx This patch implement the logic of bind/unbind xsk pool to rq. Signed-off-by: Xuan Zhuo Acked-by: Jason Wang Acked-by: Michael S. Tsirkin Link: https://patch.msgid.link/20240708112537.96291-7-xuanzhuo@linux.alibaba.com Signed-off-by: Jakub Kicinski drivers/net/virtio_net.c | 134 +++++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 134 insertions(+) commit 5db481059d79e304596881af0bd195a4418f987a Author: Xuan Zhuo Date: Mon Jul 8 19:25:32 2024 +0800 virtio_net: separate receive_mergeable This commit separates the function receive_mergeable(), put the logic of appending frag to the skb as an independent function. The subsequent commit will reuse it. Signed-off-by: Xuan Zhuo Acked-by: Jason Wang Acked-by: Michael S. Tsirkin Link: https://patch.msgid.link/20240708112537.96291-6-xuanzhuo@linux.alibaba.com Signed-off-by: Jakub Kicinski drivers/net/virtio_net.c | 77 +++++++++++++++++++++++++++++------------------- 1 file changed, 47 insertions(+), 30 deletions(-) commit c86c120fde29dc659a50540f749b6033f7267a62 Author: Xuan Zhuo Date: Mon Jul 8 19:25:31 2024 +0800 virtio_net: separate receive_buf This commit separates the function receive_buf(), then we wrap the logic of handling the skb to an independent function virtnet_receive_done(). The subsequent commit will reuse it. Signed-off-by: Xuan Zhuo Acked-by: Jason Wang Acked-by: Michael S. Tsirkin Link: https://patch.msgid.link/20240708112537.96291-5-xuanzhuo@linux.alibaba.com Signed-off-by: Jakub Kicinski drivers/net/virtio_net.c | 62 +++++++++++++++++++++++++++--------------------- 1 file changed, 35 insertions(+), 27 deletions(-) commit 391aa2aad0229d0f34aed6270c5266a0754893a2 Author: Xuan Zhuo Date: Mon Jul 8 19:25:30 2024 +0800 virtio_net: separate virtnet_tx_resize() This patch separates two sub-functions from virtnet_tx_resize(): * virtnet_tx_pause * virtnet_tx_resume Then the subsequent virtnet_tx_reset() can share these two functions. Signed-off-by: Xuan Zhuo Acked-by: Jason Wang Acked-by: Michael S. Tsirkin Link: https://patch.msgid.link/20240708112537.96291-4-xuanzhuo@linux.alibaba.com Signed-off-by: Jakub Kicinski drivers/net/virtio_net.c | 35 +++++++++++++++++++++++++++++------ 1 file changed, 29 insertions(+), 6 deletions(-) commit 47879b7322fa0d53c54970099a0ec0aee1d281e2 Author: Xuan Zhuo Date: Mon Jul 8 19:25:29 2024 +0800 virtio_net: separate virtnet_rx_resize() This patch separates two sub-functions from virtnet_rx_resize(): * virtnet_rx_pause * virtnet_rx_resume Then the subsequent reset rx for xsk can share these two functions. Signed-off-by: Xuan Zhuo Acked-by: Jason Wang Acked-by: Michael S. Tsirkin Link: https://patch.msgid.link/20240708112537.96291-3-xuanzhuo@linux.alibaba.com Signed-off-by: Jakub Kicinski drivers/net/virtio_net.c | 29 +++++++++++++++++++++-------- 1 file changed, 21 insertions(+), 8 deletions(-) commit 41d4a174201e62fc95562dc8e53097baf8568f24 Author: Xuan Zhuo Date: Mon Jul 8 19:25:28 2024 +0800 virtio_net: replace VIRTIO_XDP_HEADROOM by XDP_PACKET_HEADROOM virtio net has VIRTIO_XDP_HEADROOM that is equal to XDP_PACKET_HEADROOM to calculate the headroom for xdp. But here we should use the macro XDP_PACKET_HEADROOM from bpf.h to calculate the headroom for xdp. So here we remove the VIRTIO_XDP_HEADROOM, and use the XDP_PACKET_HEADROOM to replace it. Signed-off-by: Xuan Zhuo Acked-by: Jason Wang Acked-by: Michael S. Tsirkin Link: https://patch.msgid.link/20240708112537.96291-2-xuanzhuo@linux.alibaba.com Signed-off-by: Jakub Kicinski drivers/net/virtio_net.c | 21 +++++++++------------ 1 file changed, 9 insertions(+), 12 deletions(-) commit 79eecf631c14e7f4057186570ac20e2cfac3802e Author: Chengen Du Date: Sat Jul 13 19:47:35 2024 +0800 af_packet: Handle outgoing VLAN packets without hardware offloading The issue initially stems from libpcap. The ethertype will be overwritten as the VLAN TPID if the network interface lacks hardware VLAN offloading. In the outbound packet path, if hardware VLAN offloading is unavailable, the VLAN tag is inserted into the payload but then cleared from the sk_buff struct. Consequently, this can lead to a false negative when checking for the presence of a VLAN tag, causing the packet sniffing outcome to lack VLAN tag information (i.e., TCI-TPID). As a result, the packet capturing tool may be unable to parse packets as expected. The TCI-TPID is missing because the prb_fill_vlan_info() function does not modify the tp_vlan_tci/tp_vlan_tpid values, as the information is in the payload and not in the sk_buff struct. The skb_vlan_tag_present() function only checks vlan_all in the sk_buff struct. In cooked mode, the L2 header is stripped, preventing the packet capturing tool from determining the correct TCI-TPID value. Additionally, the protocol in SLL is incorrect, which means the packet capturing tool cannot parse the L3 header correctly. Link: https://github.com/the-tcpdump-group/libpcap/issues/1105 Link: https://lore.kernel.org/netdev/20240520070348.26725-1-chengen.du@canonical.com/T/#u Fixes: 393e52e33c6c ("packet: deliver VLAN TCI to userspace") Cc: stable@vger.kernel.org Signed-off-by: Chengen Du Reviewed-by: Willem de Bruijn Link: https://patch.msgid.link/20240713114735.62360-1-chengen.du@canonical.com Signed-off-by: Jakub Kicinski net/packet/af_packet.c | 86 ++++++++++++++++++++++++++++++++++++++++++++++++-- 1 file changed, 84 insertions(+), 2 deletions(-) commit e6c29506b2ec94e634819c03445ffe9eb350caed Merge: 62fdd1708fcb 782fe08e9861 Author: Jakub Kicinski Date: Sun Jul 14 20:26:18 2024 -0700 Merge branch 'eliminate-config_nr_cpus-dependency-in-dpaa-eth-and-enable-compile_test-in-fsl_qbman' Vladimir Oltean says: ==================== Eliminate CONFIG_NR_CPUS dependency in dpaa-eth and enable COMPILE_TEST in fsl_qbman Breno's previous attempt at enabling COMPILE_TEST for the fsl_qbman driver (now included here as patch 5/5) triggered compilation warnings for large CONFIG_NR_CPUS values: https://lore.kernel.org/all/202406261920.l5pzM1rj-lkp@intel.com/ Patch 1/5 switches two NR_CPUS arrays in the dpaa-eth driver to dynamic allocation to avoid that warning. There is more NR_CPUS usage in the fsl-qbman driver, but that looks relatively harmless and I couldn't find a good reason to change it. I noticed, while testing, that the driver doesn't actually work properly with high CONFIG_NR_CPUS values, and patch 2/5 addresses that. During code analysis, I have identified two places which treat conditions that can never happen. Patches 3/5 and 4/5 simplify the probing code - dpaa_fq_setup() - just a little bit. Finally we have at 5/5 the patch that triggered all of this. There is an okay from Herbert to take it via netdev, despite it being on soc/qbman: https://lore.kernel.org/all/Zns%2FeVVBc7pdv0yM@gondor.apana.org.au/ Link to v1: https://lore.kernel.org/netdev/20240710230025.46487-1-vladimir.oltean@nxp.com/ ==================== Link: https://patch.msgid.link/20240713225336.1746343-1-vladimir.oltean@nxp.com Signed-off-by: Jakub Kicinski commit 782fe08e9861d00ce8aca370453dd9ceb9a23d50 Author: Breno Leitao Date: Sun Jul 14 01:53:36 2024 +0300 soc: fsl: qbman: FSL_DPAA depends on COMPILE_TEST As most of the drivers that depend on ARCH_LAYERSCAPE, make FSL_DPAA depend on COMPILE_TEST for compilation and testing. # grep -r depends.\*ARCH_LAYERSCAPE.\*COMPILE_TEST | wc -l 29 Signed-off-by: Breno Leitao Signed-off-by: Vladimir Oltean Acked-by: Madalin Bucur Link: https://patch.msgid.link/20240713225336.1746343-6-vladimir.oltean@nxp.com Signed-off-by: Jakub Kicinski drivers/soc/fsl/qbman/Kconfig | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 6d2338205d78bb27ec2a3e035a4c2867320a0719 Author: Vladimir Oltean Date: Sun Jul 14 01:53:35 2024 +0300 net: dpaa: no need to make sure all CPUs receive a corresponding Tx queue dpaa_fq_setup() iterates through the &priv->dpaa_fq_list elements allocated by dpaa_alloc_all_fqs(). This includes a call to: if (!dpaa_fq_alloc(dev, 0, dpaa_max_num_txqs(), list, FQ_TYPE_TX)) goto fq_alloc_failed; which gives us dpaa_max_num_txqs() elements of FQ_TYPE_TX type. The code block which we are deleting runs after an earlier iteration through &priv->dpaa_fq_list. So at the end of this iteration (for which there is no early break), egress_cnt will be unconditionally equal to dpaa_max_num_txqs(). In other words, dpaa_alloc_all_fqs() has already allocated TX queues for all possible CPUs and the maximal number of traffic classes, and we've already iterated once through them all. The while() condition is dead code, remove it. Signed-off-by: Vladimir Oltean Acked-by: Madalin Bucur Link: https://patch.msgid.link/20240713225336.1746343-5-vladimir.oltean@nxp.com Signed-off-by: Jakub Kicinski drivers/net/ethernet/freescale/dpaa/dpaa_eth.c | 11 ----------- 1 file changed, 11 deletions(-) commit e3672a6d5e89589b734fdbf1e79528b7bcafd11f Author: Vladimir Oltean Date: Sun Jul 14 01:53:34 2024 +0300 net: dpaa: stop ignoring TX queues past the number of CPUs dpaa_fq_setup() iterates through the queues allocated by dpaa_alloc_all_fqs() and saved in &priv->dpaa_fq_list. The allocation for FQ_TYPE_TX looks as follows: if (!dpaa_fq_alloc(dev, 0, dpaa_max_num_txqs(), list, FQ_TYPE_TX)) goto fq_alloc_failed; Thus, iterating again through FQ_TYPE_TX queues in dpaa_fq_setup() and counting them will never yield an egress_cnt larger than the allocated size, dpaa_max_num_txqs(). The comparison serves no purpose since it is always true; remove it. Signed-off-by: Vladimir Oltean Acked-by: Madalin Bucur Link: https://patch.msgid.link/20240713225336.1746343-4-vladimir.oltean@nxp.com Signed-off-by: Jakub Kicinski drivers/net/ethernet/freescale/dpaa/dpaa_eth.c | 6 +----- 1 file changed, 1 insertion(+), 5 deletions(-) commit e7072750bbcb4d74945ed1e22070b96cc3457def Author: Vladimir Oltean Date: Sun Jul 14 01:53:33 2024 +0300 net: dpaa: eliminate NR_CPUS dependency in egress_fqs[] and conf_fqs[] The driver uses the DPAA_TC_TXQ_NUM and DPAA_ETH_TXQ_NUM macros for TX queue handling, and they depend on CONFIG_NR_CPUS. In generic .config files, these can go to very large (8096 CPUs) values for the systems that DPAA1 is integrated in (1-24 CPUs). We allocate a lot of resources that will never be used. Those are: - system memory - QMan FQIDs as managed by qman_alloc_fqid_range(). This is especially painful since currently, when booting with CONFIG_NR_CPUS=8096, a LS1046A-RDB system will only manage to probe 3 of its 6 interfaces. The rest will run out of FQD ("/reserved-memory/qman-fqd" in the device tree) and fail at the qman_create_fq() stage of the probing process. - netdev queues as alloc_etherdev_mq() argument. The high queue indices are simply hidden from the network stack after the call to netif_set_real_num_tx_queues(). With just a tiny bit more effort, we can replace the NR_CPUS compile-time constant with the num_possible_cpus() run-time constant, and dynamically allocate the egress_fqs[] and conf_fqs[] arrays. Even on a system with a high CONFIG_NR_CPUS, num_possible_cpus() will remain equal to the number of available cores on the SoC. The replacement is as follows: - DPAA_TC_TXQ_NUM -> dpaa_num_txqs_per_tc() - DPAA_ETH_TXQ_NUM -> dpaa_max_num_txqs() Signed-off-by: Vladimir Oltean Acked-by: Madalin Bucur Link: https://patch.msgid.link/20240713225336.1746343-3-vladimir.oltean@nxp.com Signed-off-by: Jakub Kicinski drivers/net/ethernet/freescale/dpaa/dpaa_eth.c | 47 ++++++++++++++++++-------- drivers/net/ethernet/freescale/dpaa/dpaa_eth.h | 20 +++++++---- 2 files changed, 47 insertions(+), 20 deletions(-) commit 555a05d84ca2c587e2d4777006e2c2fb3dfbd91d Author: Vladimir Oltean Date: Sun Jul 14 01:53:32 2024 +0300 net: dpaa: avoid on-stack arrays of NR_CPUS elements The dpaa-eth driver is written for PowerPC and Arm SoCs which have 1-24 CPUs. It depends on CONFIG_NR_CPUS having a reasonably small value in Kconfig. Otherwise, there are 2 functions which allocate on-stack arrays of NR_CPUS elements, and these can quickly explode in size, leading to warnings such as: drivers/net/ethernet/freescale/dpaa/dpaa_eth.c:3280:12: warning: stack frame size (16664) exceeds limit (2048) in 'dpaa_eth_probe' [-Wframe-larger-than] The problem is twofold: - Reducing the array size to the boot-time num_possible_cpus() (rather than the compile-time NR_CPUS) creates a variable-length array, which should be avoided in the Linux kernel. - Using NR_CPUS as an array size makes the driver blow up in stack consumption with generic, as opposed to hand-crafted, .config files. A simple solution is to use dynamic allocation for num_possible_cpus() elements (aka a small number determined at runtime). Link: https://lore.kernel.org/all/202406261920.l5pzM1rj-lkp@intel.com/ Signed-off-by: Vladimir Oltean Reviewed-by: Breno Leitao Acked-by: Madalin Bucur Link: https://patch.msgid.link/20240713225336.1746343-2-vladimir.oltean@nxp.com Signed-off-by: Jakub Kicinski drivers/net/ethernet/freescale/dpaa/dpaa_eth.c | 20 +++++++++++++++----- drivers/net/ethernet/freescale/dpaa/dpaa_ethtool.c | 10 +++++++++- 2 files changed, 24 insertions(+), 6 deletions(-) commit d484d621d40f4a8b8959008802d79bef3609641b Author: Namjae Jeon Date: Mon Jul 15 08:29:39 2024 +0900 ksmbd: add durable scavenger timer Launch ksmbd-durable-scavenger kernel thread to scan durable fps that have not been reclaimed by a client within the configured time. Signed-off-by: Namjae Jeon Signed-off-by: Steve French fs/smb/server/mgmt/user_session.c | 2 + fs/smb/server/server.c | 1 + fs/smb/server/server.h | 1 + fs/smb/server/smb2pdu.c | 2 +- fs/smb/server/smb2pdu.h | 2 + fs/smb/server/vfs_cache.c | 164 ++++++++++++++++++++++++++++++++++++-- fs/smb/server/vfs_cache.h | 2 + 7 files changed, 168 insertions(+), 6 deletions(-) commit 2e118ba36d56acf78084518dfb7cb53b1d417da0 Author: Tavian Barnes Date: Fri Jun 21 16:29:32 2024 -0400 bcachefs: darray: Don't pass NULL to memcpy() memcpy's second parameter must not be NULL, even if size is zero. Signed-off-by: Tavian Barnes Signed-off-by: Kent Overstreet fs/bcachefs/darray.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) commit 164c62f958f8c7f0bde1e9a5a8677971c6f28205 Author: Kiran K Date: Wed Jun 19 15:39:33 2024 +0530 Bluetooth: btintel: Add firmware ID to firmware name From BlazarI onwards, driver shall append the firmware ID (usually represents transport type) while constructing the firmware name. Firmware ID is returned on Intel Read Version command. The new firmware file name for operational image and ddc file shall be, ibt--.[sfi|ddc] dmesg snippet from BlazarI pcie product: ...... [17.098858] Bluetooth: hci0: Found device firmware: intel/ibt-0190-0291-pci.sfi [17.098871] Bluetooth: hci0: Boot Address: 0x10000800 [17.098872] Bluetooth: hci0: Firmware Version: 214-25.24 [17.158229] Bluetooth: BNEP (Ethernet Emulation) ver 1.3 [17.158236] Bluetooth: BNEP filters: protocol multicast [17.158241] Bluetooth: BNEP socket layer initialized [17.468789] Bluetooth: hci0: Waiting for firmware download to complete [17.468793] Bluetooth: hci0: Firmware loaded in 361262 usecs [17.468872] Bluetooth: hci0: Waiting for device to boot [17.504148] Bluetooth: hci0: Device booted in 34512 usecs [17.504148] Bluetooth: hci0: Malformed MSFT vendor event: 0x02 [17.504682] Bluetooth: hci0: Found Intel DDC parameters: intel/ibt-0190-0291-pci.ddc [17.505380] Bluetooth: hci0: Applying Intel DDC parameters completed [17.505622] Bluetooth: hci0: Firmware timestamp 2024.25 buildtype 3 build 64726 [17.505624] Bluetooth: hci0: Firmware SHA1: 0x9f4adddc [17.505838] Bluetooth: hci0: Fseq status: Success (0x00) [17.505839] Bluetooth: hci0: Fseq executed: 00.00.04.183 [17.505840] Bluetooth: hci0: Fseq BT Top: 00.00.04.183 dmesg snippet from BlazarI usb product: ....... [14.212072] Bluetooth: hci0: Found device firmware: intel/ibt-0190-0291-usb.sfi [14.212091] Bluetooth: hci0: Boot Address: 0x10000800 [14.212093] Bluetooth: hci0: Firmware Version: 79-21.24 [14.262125] Bluetooth: BNEP (Ethernet Emulation) ver 1.3 [14.262129] Bluetooth: BNEP filters: protocol multicast [14.262133] Bluetooth: BNEP socket layer initialized [15.865421] Bluetooth: hci0: Waiting for firmware download to complete [15.865991] Bluetooth: hci0: Firmware loaded in 1615150 usecs [15.866017] Bluetooth: hci0: Waiting for device to boot [15.899934] Bluetooth: hci0: Malformed MSFT vendor event: 0x02 [15.899942] Bluetooth: hci0: Device booted in 33139 usecs [15.900172] Bluetooth: hci0: Found Intel DDC parameters: intel/ibt-0190-0291-usb.ddc [15.901928] Bluetooth: hci0: Applying Intel DDC parameters completed [15.904993] Bluetooth: hci0: Firmware timestamp 2024.21 buildtype 3 build 63311 [15.904996] Bluetooth: hci0: Firmware SHA1: 0x8b217cf7 [15.908929] Bluetooth: hci0: Fseq status: Success (0x00) [15.908934] Bluetooth: hci0: Fseq executed: 00.00.04.180 [15.908935] Bluetooth: hci0: Fseq BT Top: 00.00.04.180 Signed-off-by: Kiran K Signed-off-by: Luiz Augusto von Dentz drivers/bluetooth/btintel.c | 88 ++++++++++++++++++++++++++++++++++----------- drivers/bluetooth/btintel.h | 6 +++- 2 files changed, 73 insertions(+), 21 deletions(-) commit da63f331353c9e1e6dc29e49e28f8f4fe5d642fd Author: Dmitry Antipov Date: Tue Jun 18 21:59:32 2024 +0300 Bluetooth: hci_core, hci_sync: cleanup struct discovery_state After commit 78db544b5d27 ("Bluetooth: hci_core: Remove le_restart_scan work"), 'scan_start' and 'scan_duration' of 'struct discovery_state' are still initialized but actually unused. So remove the aforementioned fields and adjust 'hci_discovery_filter_clear()' and 'le_scan_disable()' accordingly. Compile tested only. Fixes: 78db544b5d27 ("Bluetooth: hci_core: Remove le_restart_scan work") Signed-off-by: Dmitry Antipov Signed-off-by: Luiz Augusto von Dentz include/net/bluetooth/hci_core.h | 4 ---- net/bluetooth/hci_sync.c | 2 -- 2 files changed, 6 deletions(-) commit 295ef07a9dae6182ad4b689aa8c6a7dbba21474c Author: Hilda Wu Date: Mon Jun 17 17:05:18 2024 +0800 Bluetooth: btusb: Add RTL8852BE device 0489:e125 to device tables Add the support ID 0489:e125 to usb_device_id table for Realtek RTL8852B chip. The device info from /sys/kernel/debug/usb/devices as below. T: Bus=01 Lev=01 Prnt=01 Port=07 Cnt=03 Dev#= 5 Spd=12 MxCh= 0 D: Ver= 1.00 Cls=e0(wlcon) Sub=01 Prot=01 MxPS=64 #Cfgs= 1 P: Vendor=0489 ProdID=e125 Rev= 0.00 S: Manufacturer=Realtek S: Product=Bluetooth Radio S: SerialNumber=00e04c000001 C:* #Ifs= 2 Cfg#= 1 Atr=e0 MxPwr=500mA I:* If#= 0 Alt= 0 #EPs= 3 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb E: Ad=81(I) Atr=03(Int.) MxPS= 16 Ivl=1ms E: Ad=02(O) Atr=02(Bulk) MxPS= 64 Ivl=0ms E: Ad=82(I) Atr=02(Bulk) MxPS= 64 Ivl=0ms I:* If#= 1 Alt= 0 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb E: Ad=03(O) Atr=01(Isoc) MxPS= 0 Ivl=1ms E: Ad=83(I) Atr=01(Isoc) MxPS= 0 Ivl=1ms I: If#= 1 Alt= 1 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb E: Ad=03(O) Atr=01(Isoc) MxPS= 9 Ivl=1ms E: Ad=83(I) Atr=01(Isoc) MxPS= 9 Ivl=1ms I: If#= 1 Alt= 2 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb E: Ad=03(O) Atr=01(Isoc) MxPS= 17 Ivl=1ms E: Ad=83(I) Atr=01(Isoc) MxPS= 17 Ivl=1ms I: If#= 1 Alt= 3 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb E: Ad=03(O) Atr=01(Isoc) MxPS= 25 Ivl=1ms E: Ad=83(I) Atr=01(Isoc) MxPS= 25 Ivl=1ms I: If#= 1 Alt= 4 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb E: Ad=03(O) Atr=01(Isoc) MxPS= 33 Ivl=1ms E: Ad=83(I) Atr=01(Isoc) MxPS= 33 Ivl=1ms I: If#= 1 Alt= 5 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb E: Ad=03(O) Atr=01(Isoc) MxPS= 49 Ivl=1ms E: Ad=83(I) Atr=01(Isoc) MxPS= 49 Ivl=1ms Signed-off-by: Hilda Wu Signed-off-by: Luiz Augusto von Dentz drivers/bluetooth/btusb.c | 2 ++ 1 file changed, 2 insertions(+) commit 5a820b13db3988122080f8de2920721f770c37a0 Author: Iulia Tanasescu Date: Mon Jun 17 11:52:06 2024 +0300 Bluetooth: hci_event: Set QoS encryption from BIGInfo report On a Broadcast Sink, after synchronizing to the PA transimitted by a Broadcast Source, the BIGInfo advertising reports emitted by the Controller hold the encryption field, which indicates whether the Broadcast Source is transmitting encrypted streams. This updates the PA sync hcon QoS with the encryption value reported in the BIGInfo report, so that this information is accurate if the userspace tries to access the QoS struct via getsockopt. Fixes: 1d11d70d1f6b ("Bluetooth: ISO: Pass BIG encryption info through QoS") Signed-off-by: Iulia Tanasescu Signed-off-by: Luiz Augusto von Dentz net/bluetooth/hci_event.c | 2 ++ 1 file changed, 2 insertions(+) commit 27489364299a2ddb5c54cd9f29a3f41bd8d151ab Author: Neeraj Sanjay Kale Date: Fri Jun 14 13:53:38 2024 +0530 Bluetooth: btnxpuart: Add handling for boot-signature timeout errors This handles the timeout error codes sent by the chip as part of the bootloader signatures during firmware download process. When the bootloader does not receive a response packet from the host within a specific time, it adds an error code to the bootloader signature while requesting for the FW chunk from the same offset. The host is expected to clear this error code with a NAK, and reply to only those bootloader signatures which have error code 0. However, the driver was ignoring this error code and replying with the firmware chunks instead, which is apparently ignored by the chip and the chip resends the same bootloader signature with the error code again. This happens in a loop until the error code self clears and firmware download proceeds ahead, adding a couple of milliseconds to the total firmware download time. Commit 689ca16e5232 was an initial implementation which simply printed the following line during driver debug: - FW Download received err 0x04 from chip This commit adds the expected handling to the error codes. This error handling is valid for data_req bootloader signatures for V3 and future bootloader versions. Signed-off-by: Neeraj Sanjay Kale Fixes: 689ca16e5232 ("Bluetooth: NXP: Add protocol support for NXP Bluetooth chipsets") Signed-off-by: Luiz Augusto von Dentz drivers/bluetooth/btnxpuart.c | 52 +++++++++++++++++++++++++++++++++++++++---- 1 file changed, 48 insertions(+), 4 deletions(-) commit cb24bb7e6f8ae569c699f569ac4b5093606dca49 Author: Neeraj Sanjay Kale Date: Fri Jun 14 14:19:41 2024 +0530 Bluetooth: btnxpuart: Update firmware names This updates the firmware names of 3 chipsets: w8987, w8997, w9098. These changes are been done to standardize chip specific firmware file names to be in sync with firmware names of newer chipsets. The naming convention for BT-only files would be as follows: For dual-radio WiFi+BT chipsets: - _bt_v.bin For tri-radio WiFi+BT+15.4 chipsets: - _bt_v.bin To maintain backward compatibility, this commit adds a provision to request older firmware file name, if new firmware file name not found in /lib/firmware/nxp/. A new device tree property has been introduced called firmware-name, to override the hardcoded firmware names (old and new) in the driver. Signed-off-by: Neeraj Sanjay Kale Signed-off-by: Luiz Augusto von Dentz drivers/bluetooth/btnxpuart.c | 67 ++++++++++++++++++++++++++++++++----------- 1 file changed, 50 insertions(+), 17 deletions(-) commit 921825453873a15e8c83d6c171f0a6cf128fc963 Author: Neeraj Sanjay Kale Date: Fri Jun 14 14:19:40 2024 +0530 dt-bindings: net: bluetooth: nxp: Add firmware-name property This adds a new optional device tree property called firware-name. Signed-off-by: Neeraj Sanjay Kale Reviewed-by: Krzysztof Kozlowski Signed-off-by: Luiz Augusto von Dentz Documentation/devicetree/bindings/net/bluetooth/nxp,88w8987-bt.yaml | 4 ++++ 1 file changed, 4 insertions(+) commit 08c22b52262041164990eef4b0e076bce173a3b2 Author: Hector Martin Date: Sun Jun 2 09:57:05 2024 +0000 Bluetooth: hci_bcm4377: Add BCM4388 support This new variant needs a different core2_window1 and always uses beamforming. The BAR2 also has an offset (RAM start, presumably), so add that. Signed-off-by: Hector Martin Reviewed-by: Sven Peter [sven: rebased, updated some comments, mentioned 4388 in Kconfig] Signed-off-by: Sven Peter Signed-off-by: Luiz Augusto von Dentz drivers/bluetooth/Kconfig | 6 ++-- drivers/bluetooth/hci_bcm4377.c | 61 +++++++++++++++++++++++++++++++---------- 2 files changed, 50 insertions(+), 17 deletions(-) commit f25b7fd36cc3a850e006aed686f5bbecd200de1b Author: Ying Hsu Date: Wed May 29 08:00:00 2024 +0000 Bluetooth: Add vendor-specific packet classification for ISO data When HCI raw sockets are opened, the Bluetooth kernel module doesn't track CIS/BIS connections. User-space applications have to identify ISO data by maintaining connection information and look up the mapping for each ACL data packet received. Besides, btsnoop log captured in kernel couldn't tell ISO data from ACL data in this case. To avoid additional lookups, this patch introduces vendor-specific packet classification for Intel BT controllers to distinguish ISO data packets from ACL data packets. Signed-off-by: Ying Hsu Signed-off-by: Luiz Augusto von Dentz drivers/bluetooth/btintel.c | 25 +++++++++++++++++++++++-- include/net/bluetooth/hci_core.h | 1 + net/bluetooth/hci_core.c | 16 ++++++++++++++++ 3 files changed, 40 insertions(+), 2 deletions(-) commit d4cc4ee48167b4c25abf49ead19412c29a1ad9f4 Author: Dr. David Alan Gilbert Date: Sat Jun 1 00:26:14 2024 +0100 Bluetooth: iso: remove unused struct 'iso_list_data' 'iso_list_data' has been unused since the original commit ccf74f2390d6 ("Bluetooth: Add BTPROTO_ISO socket type"). Remove it. Signed-off-by: Dr. David Alan Gilbert Signed-off-by: Luiz Augusto von Dentz net/bluetooth/iso.c | 5 ----- 1 file changed, 5 deletions(-) commit 67c3bceabb42780f18362d7c5ec72a700051ca36 Author: Thorsten Blum Date: Sat Jun 1 01:51:33 2024 +0200 Bluetooth: btintel_pcie: Remove unnecessary memset(0) calls Remove memset(0) after dma_alloc_coherent(), which already zeroes out the memory, and fix the following two Coccinelle/coccicheck warnings reported by zalloc-simple.cocci: btintel_pcie.c:837:19-37: WARNING: dma_alloc_coherent used in /* Allocate full chunk of data buffer for DMA first and do indexing and * initialization next, so it can be freed easily */ rxq->buf_v_addr already zeroes out memory, so memset is not needed btintel_pcie.c:792:19-37: WARNING: dma_alloc_coherent used in /* Allocate full chunk of data buffer for DMA first and do indexing and * initialization next, so it can be freed easily */ txq->buf_v_addr already zeroes out memory, so memset is not needed Fixes: c2b636b3f788 ("Bluetooth: btintel_pcie: Add support for PCIe transport") Signed-off-by: Thorsten Blum Signed-off-by: Luiz Augusto von Dentz drivers/bluetooth/btintel_pcie.c | 2 -- 1 file changed, 2 deletions(-) commit 973dd9c4db4746200f88fe46e30eada7054fdbea Author: Erick Archer Date: Fri May 24 19:11:51 2024 +0200 Bluetooth: Use sizeof(*pointer) instead of sizeof(type) It is preferred to use sizeof(*pointer) instead of sizeof(type) due to the type of the variable can change and one needs not change the former (unlike the latter). This patch has no effect on runtime behavior. Signed-off-by: Erick Archer Signed-off-by: Luiz Augusto von Dentz drivers/bluetooth/btrtl.c | 2 +- drivers/bluetooth/hci_ldisc.c | 2 +- drivers/bluetooth/hci_qca.c | 5 ++--- drivers/bluetooth/hci_vhci.c | 2 +- 4 files changed, 5 insertions(+), 6 deletions(-) commit 183469bccf68cb05dfb56cc47e73520217854bab Author: Dan Carpenter Date: Fri May 24 13:14:02 2024 +0300 Bluetooth: MGMT: Uninitialized variable in load_conn_param() The "update" variable needs to be initialized to false. Fixes: 0ece498c27d8 ("Bluetooth: MGMT: Make MGMT_OP_LOAD_CONN_PARAM update existing connection") Signed-off-by: Dan Carpenter Signed-off-by: Luiz Augusto von Dentz net/bluetooth/mgmt.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit fbcd1492d8c0ae39bf9f1d3d85228e7e279c4d24 Author: Dr. David Alan Gilbert Date: Thu May 9 01:11:38 2024 +0100 Bluetooth/nokia: Remove unused struct 'hci_nokia_radio_hdr' 'hci_nokia_radio_hdr' looks like it was unused since it's initial commit. Signed-off-by: Dr. David Alan Gilbert Signed-off-by: Luiz Augusto von Dentz drivers/bluetooth/hci_nokia.c | 5 ----- 1 file changed, 5 deletions(-) commit b1c7cd6caaf6209ed9f7df59b61a2ac885eb79b3 Author: Erick Archer Date: Fri May 17 19:21:50 2024 +0200 tty: rfcomm: prefer array indexing over pointer arithmetic Refactor the list_for_each_entry() loop of rfcomm_get_dev_list() function to use array indexing instead of pointer arithmetic. This way, the code is more readable and idiomatic. Reviewed-by: Kees Cook Signed-off-by: Erick Archer Signed-off-by: Luiz Augusto von Dentz net/bluetooth/rfcomm/tty.c | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-) commit 7d2c7ddba6238e6a14cd89ef869878dd22f2a661 Author: Erick Archer Date: Fri May 17 19:21:49 2024 +0200 tty: rfcomm: prefer struct_size over open coded arithmetic This is an effort to get rid of all multiplications from allocation functions in order to prevent integer overflows [1][2]. As the "dl" variable is a pointer to "struct rfcomm_dev_list_req" and this structure ends in a flexible array: struct rfcomm_dev_list_req { [...] struct rfcomm_dev_info dev_info[]; }; the preferred way in the kernel is to use the struct_size() helper to do the arithmetic instead of the calculation "size + count * size" in the kzalloc() and copy_to_user() functions. At the same time, prepare for the coming implementation by GCC and Clang of the __counted_by attribute. Flexible array members annotated with __counted_by can have their accesses bounds-checked at run-time via CONFIG_UBSAN_BOUNDS (for array indexing) and CONFIG_FORTIFY_SOURCE (for strcpy/memcpy-family functions). In this case, it is important to note that the logic needs a little refactoring to ensure that the "dev_num" member is initialized before the first access to the flex array. Specifically, add the assignment before the list_for_each_entry() loop. Also remove the "size" variable as it is no longer needed. This way, the code is more readable and safer. This code was detected with the help of Coccinelle, and audited and modified manually. Link: https://www.kernel.org/doc/html/latest/process/deprecated.html#open-coded-arithmetic-in-allocator-arguments [1] Link: https://github.com/KSPP/linux/issues/160 [2] Reviewed-by: Kees Cook Signed-off-by: Erick Archer Signed-off-by: Luiz Augusto von Dentz include/net/bluetooth/rfcomm.h | 2 +- net/bluetooth/rfcomm/tty.c | 11 ++++------- 2 files changed, 5 insertions(+), 8 deletions(-) commit c61e41121036aa610e904ef60f8520e10455ee8c Author: Erick Archer Date: Sat May 18 10:30:39 2024 +0200 Bluetooth: hci_core: Prefer array indexing over pointer arithmetic Refactor the list_for_each_entry() loop of hci_get_dev_list() function to use array indexing instead of pointer arithmetic. This way, the code is more readable and idiomatic. Reviewed-by: Kees Cook Signed-off-by: Erick Archer Signed-off-by: Luiz Augusto von Dentz net/bluetooth/hci_core.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) commit 8f7dfe171c576aaec4911cc59feaed26d79c7c7f Author: Erick Archer Date: Sat May 18 10:30:38 2024 +0200 Bluetooth: hci_core: Prefer struct_size over open coded arithmetic This is an effort to get rid of all multiplications from allocation functions in order to prevent integer overflows [1][2]. As the "dl" variable is a pointer to "struct hci_dev_list_req" and this structure ends in a flexible array: struct hci_dev_list_req { [...] struct hci_dev_req dev_req[]; /* hci_dev_req structures */ }; the preferred way in the kernel is to use the struct_size() helper to do the arithmetic instead of the calculation "size + count * size" in the kzalloc() and copy_to_user() functions. At the same time, prepare for the coming implementation by GCC and Clang of the __counted_by attribute. Flexible array members annotated with __counted_by can have their accesses bounds-checked at run-time via CONFIG_UBSAN_BOUNDS (for array indexing) and CONFIG_FORTIFY_SOURCE (for strcpy/memcpy-family functions). In this case, it is important to note that the logic needs a little refactoring to ensure that the "dev_num" member is initialized before the first access to the flex array. Specifically, add the assignment before the list_for_each_entry() loop. Also remove the "size" variable as it is no longer needed. This way, the code is more readable and safer. This code was detected with the help of Coccinelle, and audited and modified manually. Link: https://www.kernel.org/doc/html/latest/process/deprecated.html#open-coded-arithmetic-in-allocator-arguments [1] Link: https://github.com/KSPP/linux/issues/160 [2] Reviewed-by: Kees Cook Signed-off-by: Erick Archer Signed-off-by: Luiz Augusto von Dentz include/net/bluetooth/hci_sock.h | 2 +- net/bluetooth/hci_core.c | 11 ++++------- 2 files changed, 5 insertions(+), 8 deletions(-) commit 041677e7aad6f57020aa271aafd4cb9e2af1536f Author: Kiran K Date: Fri May 17 15:24:46 2024 +0530 Bluetooth: btintel_pcie: Fix irq leak Free irq before releasing irq vector. Fixes: c2b636b3f788 ("Bluetooth: btintel_pcie: Add support for PCIe transport") Signed-off-by: Kiran K Signed-off-by: Luiz Augusto von Dentz drivers/bluetooth/btintel_pcie.c | 6 ++++++ 1 file changed, 6 insertions(+) commit 17813af5656b1f47fc3bc2c486ac8014e0026ad8 Author: Kiran K Date: Fri May 17 15:24:45 2024 +0530 Bluetooth: btintel_pcie: Print Firmware Sequencer information Firmware sequencer (FSEQ) is a common code shared across Bluetooth and Wifi. Printing FSEQ will help to debug if there is any mismatch between Bluetooth and Wifi FSEQ. Make 'btintel_print_fseq_info' public and use it in btintel_pcie.c. dmesg: .... [ 5335.695740] Bluetooth: hci0: Device booted in 33872 usecs [ 5335.695918] Bluetooth: hci0: Found Intel DDC parameters: intel/ibt-0190-0291.ddc [ 5335.697011] Bluetooth: hci0: Applying Intel DDC parameters completed [ 5335.697837] Bluetooth: hci0: Firmware timestamp 2024.20 buildtype 0 build 62871 [ 5335.697848] Bluetooth: hci0: Firmware SHA1: 0xeffdce06 [ 5335.698655] Bluetooth: hci0: Fseq status: Success (0x00) [ 5335.698666] Bluetooth: hci0: Fseq executed: 00.00.04.176 [ 5335.698670] Bluetooth: hci0: Fseq BT Top: 00.00.04.176 [ 5335.750204] Bluetooth: MGMT ver 1.22 Signed-off-by: Kiran K Signed-off-by: Luiz Augusto von Dentz drivers/bluetooth/btintel.c | 3 ++- drivers/bluetooth/btintel.h | 5 +++++ drivers/bluetooth/btintel_pcie.c | 2 ++ 3 files changed, 9 insertions(+), 1 deletion(-) commit 064aee501012eaeeeb40a2acb991598e0a89fac9 Author: Hao Qin Date: Wed May 15 16:15:21 2024 -0700 Bluetooth: btusb: mediatek: add MT7922 subsystem reset Add the support of MT7922 bluetooth subsystem reset that was called the auto revert to self-recover from the fatal error in the controller like the host encounters HCI cmd timeout or the controller crashes. Co-developed-by: Sean Wang Signed-off-by: Sean Wang Signed-off-by: Hao Qin Signed-off-by: Luiz Augusto von Dentz drivers/bluetooth/btusb.c | 14 +++++++++++++- 1 file changed, 13 insertions(+), 1 deletion(-) commit ccfc8948d7e4d93cab341a99774b24586717d89a Author: Hao Qin Date: Wed May 15 16:15:20 2024 -0700 Bluetooth: btusb: mediatek: reset the controller before downloading the fw Reset the controller before downloading the firmware to improve its reliability. This includes situations like cold or warm reboots, ensuring the controller is in its initial state before starting the firmware download. Co-developed-by: Sean Wang Signed-off-by: Sean Wang Co-developed-by: Chris Lu Signed-off-by: Chris Lu Signed-off-by: Hao Qin Signed-off-by: Luiz Augusto von Dentz drivers/bluetooth/btusb.c | 10 ++++++++++ 1 file changed, 10 insertions(+) commit 4c0c28f2bbec0c51395fd1f13c697da67483964b Author: Hao Qin Date: Wed May 15 16:15:19 2024 -0700 Bluetooth: btusb: mediatek: refactor the function btusb_mtk_reset Extract the function btusb_mtk_subsys_reset from the btusb_mtk_reset for the future handling of resetting bluetooth controller without the USB reset. Co-developed-by: Sean Wang Signed-off-by: Sean Wang Signed-off-by: Hao Qin Signed-off-by: Luiz Augusto von Dentz drivers/bluetooth/btusb.c | 45 +++++++++++++++++++++++++++------------------ 1 file changed, 27 insertions(+), 18 deletions(-) commit 7f935b21bee4d8a9f26b57ae6c3682161b247809 Author: Sean Wang Date: Wed May 15 16:15:18 2024 -0700 Bluetooth: btmtk: apply the common btmtk_fw_get_filename Apply the common btmtk_fw_get_filename to avoid the similar coding in each driver. Signed-off-by: Sean Wang Signed-off-by: Luiz Augusto von Dentz drivers/bluetooth/btmtksdio.c | 3 +++ drivers/bluetooth/btusb.c | 14 ++------------ 2 files changed, 5 insertions(+), 12 deletions(-) commit 00f993fdec06c8f036a1b9c8ee6b004c17143bd1 Author: Sean Wang Date: Wed May 15 16:15:17 2024 -0700 Bluetooth: btmtk: add the function to get the fw name Include a shared function to get the firmware name, to prevent repeating code for similar chipsets. Signed-off-by: Sean Wang Signed-off-by: Luiz Augusto von Dentz drivers/bluetooth/btmtk.c | 18 ++++++++++++++++++ drivers/bluetooth/btmtk.h | 8 ++++++++ 2 files changed, 26 insertions(+) commit 0a3e2eca1daa5627c8ecd1554e3146de82d61dd2 Author: Kiran K Date: Thu May 16 17:54:36 2024 +0530 Bluetooth: btintel: Refactor btintel_set_ppag() Current flow iterates the ACPI table associated with Bluetooth controller looking for PPAG method. Method name can be directly passed to acpi_evaluate_object function instead of iterating the table. Fixes: c585a92b2f9c ("Bluetooth: btintel: Set Per Platform Antenna Gain(PPAG)") Signed-off-by: Kiran K Signed-off-by: Luiz Augusto von Dentz drivers/bluetooth/btintel.c | 119 +++++++++++++------------------------------- 1 file changed, 34 insertions(+), 85 deletions(-) commit 0d0df1e750bac0fdaa77940e711c1625cff08d33 Author: Luke Wang Date: Fri May 17 19:15:35 2024 +0800 Bluetooth: btnxpuart: Shutdown timer and prevent rearming when driver unloading When unload the btnxpuart driver, its associated timer will be deleted. If the timer happens to be modified at this moment, it leads to the kernel call this timer even after the driver unloaded, resulting in kernel panic. Use timer_shutdown_sync() instead of del_timer_sync() to prevent rearming. panic log: Internal error: Oops: 0000000086000007 [#1] PREEMPT SMP Modules linked in: algif_hash algif_skcipher af_alg moal(O) mlan(O) crct10dif_ce polyval_ce polyval_generic snd_soc_imx_card snd_soc_fsl_asoc_card snd_soc_imx_audmux mxc_jpeg_encdec v4l2_jpeg snd_soc_wm8962 snd_soc_fsl_micfil snd_soc_fsl_sai flexcan snd_soc_fsl_utils ap130x rpmsg_ctrl imx_pcm_dma can_dev rpmsg_char pwm_fan fuse [last unloaded: btnxpuart] CPU: 5 PID: 723 Comm: memtester Tainted: G O 6.6.23-lts-next-06207-g4aef2658ac28 #1 Hardware name: NXP i.MX95 19X19 board (DT) pstate: 20400009 (nzCv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--) pc : 0xffff80007a2cf464 lr : call_timer_fn.isra.0+0x24/0x80 ... Call trace: 0xffff80007a2cf464 __run_timers+0x234/0x280 run_timer_softirq+0x20/0x40 __do_softirq+0x100/0x26c ____do_softirq+0x10/0x1c call_on_irq_stack+0x24/0x4c do_softirq_own_stack+0x1c/0x2c irq_exit_rcu+0xc0/0xdc el0_interrupt+0x54/0xd8 __el0_irq_handler_common+0x18/0x24 el0t_64_irq_handler+0x10/0x1c el0t_64_irq+0x190/0x194 Code: ???????? ???????? ???????? ???????? (????????) ---[ end trace 0000000000000000 ]--- Kernel panic - not syncing: Oops: Fatal exception in interrupt SMP: stopping secondary CPUs Kernel Offset: disabled CPU features: 0x0,c0000000,40028143,1000721b Memory Limit: none ---[ end Kernel panic - not syncing: Oops: Fatal exception in interrupt ]--- Signed-off-by: Luke Wang Signed-off-by: Luiz Augusto von Dentz drivers/bluetooth/btnxpuart.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit e3c4891098c875a63ab0c3b31d584f6d4f1895fd Author: Neeraj Sanjay Kale Date: Wed May 15 12:36:57 2024 +0530 Bluetooth: btnxpuart: Handle FW Download Abort scenario This adds a new flag BTNXPUART_FW_DOWNLOAD_ABORT which handles the situation where driver is removed while firmware download is in progress. logs: modprobe btnxpuart [65239.230431] Bluetooth: hci0: ChipID: 7601, Version: 0 [65239.236670] Bluetooth: hci0: Request Firmware: nxp/uartspi_n61x_v1.bin.se rmmod btnxpuart [65241.425300] Bluetooth: hci0: FW Download Aborted Signed-off-by: Neeraj Sanjay Kale Tested-by: Guillaume Legoupil Signed-off-by: Luiz Augusto von Dentz drivers/bluetooth/btnxpuart.c | 47 ++++++++++++++++++++++++++++++------------- 1 file changed, 33 insertions(+), 14 deletions(-) commit 2684dd614ccf085b64456d78e2c23911006d503d Author: Neeraj Sanjay Kale Date: Wed May 15 12:36:56 2024 +0530 Bluetooth: btnxpuart: Enable status prints for firmware download This enables prints for firmware download which can help automation tests to verify firmware download functionality. dmesg logs before: modprobe btnxpuart [ 1999.187264] Bluetooth: MGMT ver 1.22 dmesg logs with this patch: modprobe btnxpuart [16179.758515] Bluetooth: hci0: ChipID: 7601, Version: 0 [16179.764748] Bluetooth: hci0: Request Firmware: nxp/uartspi_n61x_v1.bin.se [16181.217490] Bluetooth: hci0: FW Download Complete: 372696 bytes [16182.701398] Bluetooth: MGMT ver 1.22 Signed-off-by: Neeraj Sanjay Kale Tested-by: Guillaume Legoupil Signed-off-by: Luiz Augusto von Dentz drivers/bluetooth/btnxpuart.c | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-) commit c68bbf5e334b35b36ac5b9f0419f1f93f796bad1 Author: Neeraj Sanjay Kale Date: Wed May 15 12:36:55 2024 +0530 Bluetooth: btnxpuart: Fix Null pointer dereference in btnxpuart_flush() This adds a check before freeing the rx->skb in flush and close functions to handle the kernel crash seen while removing driver after FW download fails or before FW download completes. dmesg log: [ 54.634586] Unable to handle kernel NULL pointer dereference at virtual address 0000000000000080 [ 54.643398] Mem abort info: [ 54.646204] ESR = 0x0000000096000004 [ 54.649964] EC = 0x25: DABT (current EL), IL = 32 bits [ 54.655286] SET = 0, FnV = 0 [ 54.658348] EA = 0, S1PTW = 0 [ 54.661498] FSC = 0x04: level 0 translation fault [ 54.666391] Data abort info: [ 54.669273] ISV = 0, ISS = 0x00000004, ISS2 = 0x00000000 [ 54.674768] CM = 0, WnR = 0, TnD = 0, TagAccess = 0 [ 54.674771] GCS = 0, Overlay = 0, DirtyBit = 0, Xs = 0 [ 54.674775] user pgtable: 4k pages, 48-bit VAs, pgdp=0000000048860000 [ 54.674780] [0000000000000080] pgd=0000000000000000, p4d=0000000000000000 [ 54.703880] Internal error: Oops: 0000000096000004 [#1] PREEMPT SMP [ 54.710152] Modules linked in: btnxpuart(-) overlay fsl_jr_uio caam_jr caamkeyblob_desc caamhash_desc caamalg_desc crypto_engine authenc libdes crct10dif_ce polyval_ce polyval_generic snd_soc_imx_spdif snd_soc_imx_card snd_soc_ak5558 snd_soc_ak4458 caam secvio error snd_soc_fsl_micfil snd_soc_fsl_spdif snd_soc_fsl_sai snd_soc_fsl_utils imx_pcm_dma gpio_ir_recv rc_core sch_fq_codel fuse [ 54.744357] CPU: 3 PID: 72 Comm: kworker/u9:0 Not tainted 6.6.3-otbr-g128004619037 #2 [ 54.744364] Hardware name: FSL i.MX8MM EVK board (DT) [ 54.744368] Workqueue: hci0 hci_power_on [ 54.757244] pstate: 60000005 (nZCv daif -PAN -UAO -TCO -DIT -SSBS BTYPE=--) [ 54.757249] pc : kfree_skb_reason+0x18/0xb0 [ 54.772299] lr : btnxpuart_flush+0x40/0x58 [btnxpuart] [ 54.782921] sp : ffff8000805ebca0 [ 54.782923] x29: ffff8000805ebca0 x28: ffffa5c6cf1869c0 x27: ffffa5c6cf186000 [ 54.782931] x26: ffff377b84852400 x25: ffff377b848523c0 x24: ffff377b845e7230 [ 54.782938] x23: ffffa5c6ce8dbe08 x22: ffffa5c6ceb65410 x21: 00000000ffffff92 [ 54.782945] x20: ffffa5c6ce8dbe98 x19: ffffffffffffffac x18: ffffffffffffffff [ 54.807651] x17: 0000000000000000 x16: ffffa5c6ce2824ec x15: ffff8001005eb857 [ 54.821917] x14: 0000000000000000 x13: ffffa5c6cf1a02e0 x12: 0000000000000642 [ 54.821924] x11: 0000000000000040 x10: ffffa5c6cf19d690 x9 : ffffa5c6cf19d688 [ 54.821931] x8 : ffff377b86000028 x7 : 0000000000000000 x6 : 0000000000000000 [ 54.821938] x5 : ffff377b86000000 x4 : 0000000000000000 x3 : 0000000000000000 [ 54.843331] x2 : 0000000000000000 x1 : 0000000000000002 x0 : ffffffffffffffac [ 54.857599] Call trace: [ 54.857601] kfree_skb_reason+0x18/0xb0 [ 54.863878] btnxpuart_flush+0x40/0x58 [btnxpuart] [ 54.863888] hci_dev_open_sync+0x3a8/0xa04 [ 54.872773] hci_power_on+0x54/0x2e4 [ 54.881832] process_one_work+0x138/0x260 [ 54.881842] worker_thread+0x32c/0x438 [ 54.881847] kthread+0x118/0x11c [ 54.881853] ret_from_fork+0x10/0x20 [ 54.896406] Code: a9be7bfd 910003fd f9000bf3 aa0003f3 (b940d400) [ 54.896410] ---[ end trace 0000000000000000 ]--- Signed-off-by: Neeraj Sanjay Kale Tested-by: Guillaume Legoupil Signed-off-by: Luiz Augusto von Dentz drivers/bluetooth/btnxpuart.c | 12 ++++++++---- 1 file changed, 8 insertions(+), 4 deletions(-) commit 3b867602854058c6d26b146372f3b33c3a5040b9 Author: Hector Martin Date: Wed May 15 18:15:03 2024 +0000 Bluetooth: hci_bcm4377: Increase boot timeout BCM4388 takes over 2 seconds to boot, so increase the timeout. Signed-off-by: Hector Martin Reviewed-by: Sven Peter Signed-off-by: Sven Peter Signed-off-by: Luiz Augusto von Dentz drivers/bluetooth/hci_bcm4377.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) commit 56c695a823e4ee1e5294a8340d5afe5de73828ec Author: Sven Peter Date: Wed May 15 18:15:02 2024 +0000 Bluetooth: hci_bcm4377: Use correct unit for timeouts BCM4377_TIMEOUT is always used to wait for completitions and their API expects a timeout in jiffies instead of msecs. Fixes: 8a06127602de ("Bluetooth: hci_bcm4377: Add new driver for BCM4377 PCIe boards") Signed-off-by: Sven Peter Signed-off-by: Luiz Augusto von Dentz drivers/bluetooth/hci_bcm4377.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 0ece498c27d8cd2fdad6f49a6abc34b8badd8fbc Author: Luiz Augusto von Dentz Date: Fri May 10 10:36:45 2024 -0400 Bluetooth: MGMT: Make MGMT_OP_LOAD_CONN_PARAM update existing connection This makes MGMT_OP_LOAD_CONN_PARAM update existing connection by dectecting the request is just for one connection, parameters already exists and there is a connection. Since this is a new behavior the revision is also updated to enable userspace to detect it. Signed-off-by: Luiz Augusto von Dentz include/net/bluetooth/hci_sync.h | 3 +++ net/bluetooth/hci_sync.c | 18 +++++++++++++++ net/bluetooth/mgmt.c | 50 ++++++++++++++++++++++++++++++++++++++-- 3 files changed, 69 insertions(+), 2 deletions(-) commit efb2018e4d238cc205690ac62c0917d60d291e66 Author: Kent Overstreet Date: Sun Jul 14 19:51:01 2024 -0400 bcachefs: Kill bch2_assert_btree_nodes_not_locked() We no longer track individual btree node locks with lockdep, so this will never be enabled. Signed-off-by: Kent Overstreet fs/bcachefs/btree_io.c | 6 ------ fs/bcachefs/btree_locking.c | 10 ---------- fs/bcachefs/btree_locking.h | 6 ------ 3 files changed, 22 deletions(-) commit ae469056313f7d8a63646de8ef53eebfefc2d9c0 Author: Kent Overstreet Date: Mon Aug 28 16:13:18 2023 -0400 bcachefs: Rename BCH_WRITE_DONE -> BCH_WRITE_SUBMITTED Signed-off-by: Kent Overstreet fs/bcachefs/io_write.c | 24 ++++++++++++------------ fs/bcachefs/io_write.h | 2 +- 2 files changed, 13 insertions(+), 13 deletions(-) commit 520da3c488c5bb177871634e713eb8a106082e6b Author: Namjae Jeon Date: Tue May 21 22:57:52 2024 +0900 ksmbd: avoid reclaiming expired durable opens by the client The expired durable opens should not be reclaimed by client. This patch add ->durable_scavenger_timeout to fp and check it in ksmbd_lookup_durable_fd(). Signed-off-by: Namjae Jeon Signed-off-by: Steve French fs/smb/server/vfs_cache.c | 9 ++++++++- fs/smb/server/vfs_cache.h | 1 + 2 files changed, 9 insertions(+), 1 deletion(-) commit 051d469be1b355ffc62fcd9c82195230c780228a Author: Christophe JAILLET Date: Sun Jun 23 20:07:58 2024 +0200 ksmbd: Constify struct ksmbd_transport_ops 'struct ksmbd_transport_ops' is not modified in these drivers. Constifying this structure moves some data to a read-only section, so increase overall security. On a x86_64, with allmodconfig, as an example: Before: ====== text data bss dec hex filename 52184 2085 256 54525 d4fd fs/smb/server/transport_rdma.o After: ===== text data bss dec hex filename 52260 2021 256 54537 d509 fs/smb/server/transport_rdma.o Signed-off-by: Christophe JAILLET Acked-by: Namjae Jeon Signed-off-by: Steve French fs/smb/server/connection.h | 4 ++-- fs/smb/server/transport_rdma.c | 4 ++-- fs/smb/server/transport_tcp.c | 4 ++-- 3 files changed, 6 insertions(+), 6 deletions(-) commit ac5399d48616644cb6ddfe39f8babe807d5f5cbd Author: ChenXiaoSong Date: Wed Jun 19 16:17:53 2024 +0000 ksmbd: remove duplicate SMB2 Oplock levels definitions smb/common already have SMB2 Oplock levels definitions, remove duplicate definitions in server. Signed-off-by: ChenXiaoSong Acked-by: Namjae Jeon Signed-off-by: Steve French fs/smb/server/oplock.h | 7 ------- 1 file changed, 7 deletions(-) commit 1d18b5cabc89f9c0ea0a3a1d738d5a02d478117f Author: Kent Overstreet Date: Sun Jul 14 16:32:11 2024 -0400 bcachefs: __bch2_read(): call trans_begin() on every loop iter perusal of /sys/kernel/debug/bcachefs/*/btree_transaction_stats shows that the read path has been acculumalating unneeded paths on the reflink btree, which we don't want. The solution is to call bch2_trans_begin(), which drops paths not used on previous loop iteration. bch2_readahead: Max mem used: 0 Transaction duration: count: 194235 since mount recent duration of events min: 150 ns max: 9 ms total: 838 ms mean: 4 us 6 us stddev: 34 us 7 us time between events min: 10 ns max: 15 h mean: 2 s 12 s stddev: 2 s 3 ms Maximum allocated btree paths (193): path: idx 2 ref 0:0 P btree=extents l=0 pos 270943112:392:U32_MAX locks 0 path: idx 3 ref 1:0 S btree=extents l=0 pos 270943112:24578:U32_MAX locks 1 path: idx 4 ref 0:0 P btree=reflink l=0 pos 0:24773509:0 locks 0 path: idx 5 ref 0:0 P S btree=reflink l=0 pos 0:24773631:0 locks 1 path: idx 6 ref 0:0 P S btree=reflink l=0 pos 0:24773759:0 locks 1 path: idx 7 ref 0:0 P S btree=reflink l=0 pos 0:24773887:0 locks 1 path: idx 8 ref 0:0 P S btree=reflink l=0 pos 0:24774015:0 locks 1 path: idx 9 ref 0:0 P S btree=reflink l=0 pos 0:24774143:0 locks 1 path: idx 10 ref 0:0 P S btree=reflink l=0 pos 0:24774271:0 locks 1 Signed-off-by: Kent Overstreet fs/bcachefs/io_read.c | 45 +++++++++++++++++++-------------------------- 1 file changed, 19 insertions(+), 26 deletions(-) commit 114f530e1e600245b0f9c114aa75c1ecc4376c67 Author: Hongbo Li Date: Fri Jul 12 15:09:25 2024 +0800 bcachefs: show none if label is not set If label is not set, the Label tag in superblock info show '(none)'. ``` [Before] Device index: 0 Label: Version: 1.4: member_seq [After] Device index: 0 Label: (none) Version: 1.4: member_seq ``` Signed-off-by: Hongbo Li Signed-off-by: Kent Overstreet fs/bcachefs/super-io.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) commit 7b6dda7282b1f26094aac21e1862690c79152e51 Author: Kent Overstreet Date: Fri Jul 12 14:35:46 2024 -0400 bcachefs: drop packed, aligned from bkey_inode_buf Unnecessary here, and this broke the rust bindings: error[E0588]: packed type cannot transitively contain a `#[repr(align)]` type --> /build/source/target/release/build/bch_bindgen-9445b24c90aca2a3/out/bcachefs.rs:29025:1 | 29025 | pub struct bkey_i_inode_v3 { | ^^^^^^^^^^^^^^^^^^^^^^^^^^ | note: `bch_inode_v3` has a `#[repr(align)]` attribute --> /build/source/target/release/build/bch_bindgen-9445b24c90aca2a3/out/bcachefs.rs:8949:1 | 8949 | pub struct bch_inode_v3 { | ^^^^^^^^^^^^^^^^^^^^^^^ error[E0588]: packed type cannot transitively contain a `#[repr(align)]` type --> /build/source/target/release/build/bch_bindgen-9445b24c90aca2a3/out/bcachefs.rs:32826:1 | 32826 | pub struct bkey_inode_buf { | ^^^^^^^^^^^^^^^^^^^^^^^^^ | note: `bch_inode_v3` has a `#[repr(align)]` attribute --> /build/source/target/release/build/bch_bindgen-9445b24c90aca2a3/out/bcachefs.rs:8949:1 | 8949 | pub struct bch_inode_v3 { | ^^^^^^^^^^^^^^^^^^^^^^^ note: `bkey_inode_buf` contains a field of type `bkey_i_inode_v3` --> /build/source/target/release/build/bch_bindgen-9445b24c90aca2a3/out/bcachefs.rs:32827:9 | 32827 | pub inode: bkey_i_inode_v3, | ^^^^^ note: ...which contains a field of type `bch_inode_v3` --> /build/source/target/release/build/bch_bindgen-9445b24c90aca2a3/out/bcachefs.rs:29027:9 | 29027 | pub v: bch_inode_v3, | ^ Signed-off-by: Kent Overstreet fs/bcachefs/inode.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 6ec8623f7cdd7e32a560fbef1e742bd8bc23925e Author: Kent Overstreet Date: Fri Jul 12 14:16:01 2024 -0400 bcachefs: btree node scan: fall back to comparing by journal seq highly damaged filesystems, or filesystems that have been damaged and repair and damaged again, may have sequence numbers we can't fully trust - which in itself is something we need to debug. Add a journal_seq fallback so that repair doesn't get stuck. Signed-off-by: Kent Overstreet fs/bcachefs/btree_io.c | 4 +++ fs/bcachefs/btree_node_scan.c | 51 ++++++++++++++++++++++++++----------- fs/bcachefs/btree_node_scan_types.h | 1 + 3 files changed, 41 insertions(+), 15 deletions(-) commit 375476c41405ff6fc379cdbf1ad1df35c737500c Author: Kent Overstreet Date: Thu Dec 21 18:54:09 2023 -0500 bcachefs: Add lockdep support for btree node locks This adds lockdep tracking for held btree locks with a single dep_map in btree_trans, i.e. tracking all held btree locks as one object. This is more practical and more useful than having lockdep track held btree locks individually, because - we can take more locks than lockdep can track (unbounded, now that we have dynamically resizable btree paths) - there's no lock ordering between btree locks for lockdep to track (we do cycle detection) - and this makes it easy to teach lockdep that btree locks are not safe to hold while invoking memory reclaim. The last rule is one that lockdep would never learn, because we only do trylock() from within shrinkers - but we very much do not want to be invoking memory reclaim while holding btree node locks. Signed-off-by: Kent Overstreet fs/bcachefs/btree_iter.c | 24 +++++++++++++++++++++--- fs/bcachefs/btree_locking.h | 2 ++ fs/bcachefs/btree_types.h | 3 +++ 3 files changed, 26 insertions(+), 3 deletions(-) commit 1a616c2fe96b357894b74b41787d4ea6987f6199 Author: Kent Overstreet Date: Thu Dec 21 20:34:17 2023 -0500 lockdep: lockdep_set_notrack_class() Add a new helper to disable lockdep tracking entirely for a given class. This is needed for bcachefs, which takes too many btree node locks for lockdep to track. Instead, we have a single lockdep_map for "btree_trans has any btree nodes locked", which makes more since given that we have centralized lock management and a cycle detector. Cc: Peter Zijlstra Cc: Ingo Molnar Cc: Will Deacon Cc: Waiman Long Cc: Boqun Feng Signed-off-by: Kent Overstreet fs/bcachefs/btree_locking.c | 2 +- include/linux/lockdep.h | 4 ++++ include/linux/lockdep_types.h | 1 + kernel/locking/lockdep.c | 9 ++++++++- 4 files changed, 14 insertions(+), 2 deletions(-) commit 8f523d425e0255a68d2f47f9b21db4f684c185c9 Author: Kent Overstreet Date: Sat Jun 29 16:04:40 2024 -0400 bcachefs: Improve copygc_wait_to_text() printing the raw values can occasionally be very useful Signed-off-by: Kent Overstreet fs/bcachefs/movinggc.c | 11 ++++++++--- 1 file changed, 8 insertions(+), 3 deletions(-) commit 27d033df35154256e0063450d651000bd1b36d72 Author: Kent Overstreet Date: Sat Jun 29 18:08:20 2024 -0400 bcachefs: Convert clock code to u64s Eliminate possible integer truncation bugs on 32 bit Signed-off-by: Kent Overstreet fs/bcachefs/clock.c | 65 +++++++++++++++++++++-------------------------- fs/bcachefs/clock.h | 9 +++---- fs/bcachefs/clock_types.h | 3 ++- 3 files changed, 35 insertions(+), 42 deletions(-) commit ec8bf491a9008b8db97076ba7a6905edb4537bb9 Author: Kent Overstreet Date: Sat Jun 29 11:43:23 2024 -0400 bcachefs: Improve startup message We're not always mounting when we start the filesystem Signed-off-by: Kent Overstreet fs/bcachefs/super.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit a2cb8a6236daafbea5e3d9d720f5e55ba692817b Author: Kent Overstreet Date: Fri Jun 28 13:28:30 2024 -0400 bcachefs: Self healing on read IO error This repurposes the promote path, which already knows how to call data_update() after a read: we now automatically rewrite bad data when we get a read error and then successfully retry from a different replica. Signed-off-by: Kent Overstreet fs/bcachefs/extents.c | 8 +++--- fs/bcachefs/extents.h | 2 ++ fs/bcachefs/io_read.c | 69 +++++++++++++++++++++++++++++++++++---------------- 3 files changed, 53 insertions(+), 26 deletions(-) commit b1d63b06e8398eb048dcc455acc628e6655d7499 Author: Kent Overstreet Date: Fri Jun 28 18:10:47 2024 -0400 bcachefs: Make read_only a mount option again, but hidden fsck passes read_only as a mount option, and it's required for nochanges, which it also uses. Usually read_only is handled by the VFS, but we need to be able to handle it too; we just don't want to print it out twice, so mark it as a hidden option. Signed-off-by: Kent Overstreet fs/bcachefs/chardev.c | 13 ------------- fs/bcachefs/fs.c | 3 ++- fs/bcachefs/opts.h | 3 ++- 3 files changed, 4 insertions(+), 15 deletions(-) commit 9d9d212e26399c04c567c232f500179cbdc8dc7e Author: Kent Overstreet Date: Fri Jun 28 16:25:39 2024 -0400 bcachefs: bch2_extent_crc_unpacked_to_text() Signed-off-by: Kent Overstreet fs/bcachefs/extents.c | 21 ++++++++++++++------- fs/bcachefs/extents.h | 2 ++ 2 files changed, 16 insertions(+), 7 deletions(-) commit 5e3c208325189df6d0c08307cbadb2a03b2fbe2e Author: Kent Overstreet Date: Fri Jun 28 13:51:38 2024 -0400 bcachefs: Ratelimit checksum error messages Signed-off-by: Kent Overstreet fs/bcachefs/checksum.c | 5 +++-- fs/bcachefs/io_write.c | 5 ++++- 2 files changed, 7 insertions(+), 3 deletions(-) commit 0f3372dcee6212ad49a8c32ea3ca80b91f36b9d3 Author: Kent Overstreet Date: Fri Jun 28 13:36:00 2024 -0400 bcachefs: spelling fix Signed-off-by: Kent Overstreet fs/bcachefs/io_write.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit d2cb6b219d37284d78deeac1be8eb9d7670eebd1 Author: Kent Overstreet Date: Sat Jun 8 17:49:11 2024 -0400 bcachefs: Simplify btree key cache fill path Don't allocate the new bkey_cached until after we've done the btree lookup; this means we can kill bkey_cached.valid. Signed-off-by: Kent Overstreet fs/bcachefs/btree_iter.c | 9 +- fs/bcachefs/btree_key_cache.c | 317 ++++++++++++++++-------------------------- fs/bcachefs/btree_types.h | 1 - 3 files changed, 122 insertions(+), 205 deletions(-) commit 39d5d8290cd4ae709b5c9625f991a2b028234315 Author: Kent Overstreet Date: Sun Jun 23 02:13:44 2024 -0400 bcachefs: Improve "unable to allocate journal write" message Signed-off-by: Kent Overstreet fs/bcachefs/journal_io.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) commit e0d5bc6a66182dd68e117638c04a6794f2604331 Author: Kent Overstreet Date: Sun Jun 23 18:48:22 2024 -0400 bcachefs: Fix missing BTREE_TRIGGER_bucket_invalidate flag This fixes an accounting mismatch for cached data. Signed-off-by: Kent Overstreet fs/bcachefs/alloc_background.c | 7 ++++--- fs/bcachefs/alloc_background.h | 3 ++- fs/bcachefs/buckets.c | 2 +- fs/bcachefs/ec.c | 2 +- 4 files changed, 8 insertions(+), 6 deletions(-) commit 7554a8bb6ddeeca87fa8abd1d9766111477a6643 Author: Kent Overstreet Date: Sun Sep 10 17:29:39 2023 -0400 bcachefs: Ensure buffered writes write as much as they can This adds a new helper, bch2_folio_reservation_get_partial(), which reserves as many blocks as possible and may return partial success. __bch2_buffered_write() is switched to the new helper - this fixes fstests generic/275, the write until -ENOSPC test. generic/230 now fails: this appears to be a test bug, where xfs_io isn't looping after a partial write to get the error code. Signed-off-by: Kent Overstreet fs/bcachefs/fs-io-buffered.c | 32 +++++++++++++++++--------------- fs/bcachefs/fs-io-pagecache.c | 37 +++++++++++++++++++++++++++++-------- fs/bcachefs/fs-io-pagecache.h | 7 ++++++- 3 files changed, 52 insertions(+), 24 deletions(-) commit 95924420b038a0d025c4d16c75be2a858e7c09df Author: Hongbo Li Date: Thu Jun 20 21:21:12 2024 +0800 bcachefs: support STATX_DIOALIGN for statx file Add support for STATX_DIOALIGN to bcachefs, so that direct I/O alignment restrictions are exposed to userspace in a generic way. [Before] ``` ./statx_test /mnt/bcachefs/test statx(/mnt/bcachefs/test) = 0 dio mem align:0 dio offset align:0 ``` [After] ``` ./statx_test /mnt/bcachefs/test statx(/mnt/bcachefs/test) = 0 dio mem align:1 dio offset align:512 ``` Signed-off-by: Hongbo Li Signed-off-by: Kent Overstreet fs/bcachefs/fs.c | 10 ++++++++++ 1 file changed, 10 insertions(+) commit 7aa7183e00d92539c61b3a01a7ebf676b0ecb91e Author: Kent Overstreet Date: Wed Jun 19 09:00:11 2024 -0400 bcachefs: split out lru_format.h Signed-off-by: Kent Overstreet fs/bcachefs/bcachefs_format.h | 13 +------------ fs/bcachefs/lru.h | 12 ------------ fs/bcachefs/lru_format.h | 25 +++++++++++++++++++++++++ 3 files changed, 26 insertions(+), 24 deletions(-) commit 789566da258f27ec5bffd4ae685306c71d7b4809 Author: Kent Overstreet Date: Sat Jun 8 15:20:53 2024 -0400 bcachefs: bch2_btree_key_cache_drop() now evicts As part of improving btree key cache coherency, the bkey_cached.valid flag is going away. Signed-off-by: Kent Overstreet fs/bcachefs/btree_key_cache.c | 7 ++++++- fs/bcachefs/btree_trans_commit.c | 11 +++++------ 2 files changed, 11 insertions(+), 7 deletions(-) commit febc33cb352afb8c8dc87286635c35cc644fbdb9 Author: Pankaj Raghav Date: Fri Jun 14 10:50:31 2024 +0000 bcachefs: set fgf order hint before starting a buffered write Set the preferred folio order in the fgp_flags by calling fgf_set_order(). Page cache will try to allocate large folio of the preferred order whenever possible instead of allocating multiple 0 order folios. This improves the buffered write performance up to 1.25x with default mount options and up to 1.57x when mounted with no_data_io option with the following fio workload: fio --name=bcachefs --filename=/mnt/test --size=100G \ --ioengine=io_uring --iodepth=16 --rw=write --bs=128k Signed-off-by: Pankaj Raghav Signed-off-by: Kent Overstreet fs/bcachefs/fs-io-buffered.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) commit 2b02b9552c7839840e4ce05244d20738515ab05c Author: Pankaj Raghav Date: Fri Jun 14 10:50:30 2024 +0000 bcachefs: use FGP_WRITEBEGIN instead of combining individual flags Use FGP_WRITEBEGIN to avoid repeating the individual FGP flags before starting a buffered write. Signed-off-by: Pankaj Raghav Signed-off-by: Kent Overstreet fs/bcachefs/fs-io-buffered.c | 10 ++++------ 1 file changed, 4 insertions(+), 6 deletions(-) commit b0d3ab531f07b6fc22ed9b84e7b9a5ff9be90df9 Author: Kent Overstreet Date: Thu Jun 13 17:07:36 2024 -0400 bcachefs: Reduce the scope of gc_lock gc_lock is now only for synchronization between check_alloc_info and interior btree updates - nothing else Signed-off-by: Kent Overstreet fs/bcachefs/alloc_background.c | 3 --- fs/bcachefs/bcachefs.h | 4 ++-- fs/bcachefs/btree_gc.c | 7 ++++--- fs/bcachefs/buckets.c | 2 -- fs/bcachefs/buckets.h | 4 ++-- fs/bcachefs/recovery_passes.c | 4 ++++ 6 files changed, 12 insertions(+), 12 deletions(-) commit 132e1a2380d06c31a17c773aac6c676658b9686a Author: Kent Overstreet Date: Thu Jun 13 14:11:48 2024 -0400 bcachefs: per_cpu_sum() Signed-off-by: Kent Overstreet fs/bcachefs/util.h | 17 +++++++++++------ 1 file changed, 11 insertions(+), 6 deletions(-) commit 63567f643a3e2cdc54d0e190a7a14c01c523b71c Author: Brian Foster Date: Mon Jun 10 08:26:39 2024 -0400 MAINTAINERS: remove Brian Foster as a reviewer for bcachefs Signed-off-by: Brian Foster Signed-off-by: Kent Overstreet MAINTAINERS | 1 - 1 file changed, 1 deletion(-) commit 385f0c05d670a252943299506750ed90a4843861 Author: Kent Overstreet Date: Sat Jun 8 16:46:58 2024 -0400 bcachefs: kill key cache arg to bch2_assert_pos_locked() this is an internal implementation detail - and we're improving key cache coherency Signed-off-by: Kent Overstreet fs/bcachefs/btree_iter.c | 27 +++++++++++++-------------- fs/bcachefs/btree_iter.h | 5 ++--- fs/bcachefs/fs.c | 4 +--- 3 files changed, 16 insertions(+), 20 deletions(-) commit c30402e5483df785a5319ffe07127bfd7238d8d9 Author: Kent Overstreet Date: Sat Jun 8 15:24:14 2024 -0400 bcachefs: btree_path_cached_set() new helper - small refactoring Signed-off-by: Kent Overstreet fs/bcachefs/btree_key_cache.c | 50 +++++++++++++++++++++---------------------- 1 file changed, 24 insertions(+), 26 deletions(-) commit 71fdc0b5a678766e874c5001e8bc83bde5931655 Author: Kent Overstreet Date: Sat Jun 8 15:25:12 2024 -0400 bcachefs: btree_node_unlock() assert we have a separate helper for releasing write locks Signed-off-by: Kent Overstreet fs/bcachefs/btree_locking.h | 1 + 1 file changed, 1 insertion(+) commit dd3995a6a4fcf041297d73fb7a12c6edde339986 Author: Kent Overstreet Date: Fri Jun 7 20:53:02 2024 -0400 bcachefs: bch2_gc_pos_to_text() Signed-off-by: Kent Overstreet fs/bcachefs/btree_gc.c | 16 ++++++++++++++++ fs/bcachefs/btree_gc.h | 2 ++ fs/bcachefs/btree_gc_types.h | 13 +++++++++---- 3 files changed, 27 insertions(+), 4 deletions(-) commit 11169d9983d55f1550ba2d65e074128dd0373937 Author: Kent Overstreet Date: Fri Jun 7 18:19:39 2024 -0400 bcachefs: bch2_btree_id_to_text() Signed-off-by: Kent Overstreet fs/bcachefs/btree_cache.c | 8 ++++++++ fs/bcachefs/btree_cache.h | 2 ++ 2 files changed, 10 insertions(+) commit ae4fb17e86701c55da6867ded662d1b7aef40f12 Author: Kent Overstreet Date: Fri Jun 7 20:51:57 2024 -0400 bcachefs: Kill gc_pos_btree_node() gc_pos is now based on keys, not nodes, for invariantness w.r.t. splits and merges Signed-off-by: Kent Overstreet fs/bcachefs/btree_gc.h | 9 --------- fs/bcachefs/btree_trans_commit.c | 2 +- 2 files changed, 1 insertion(+), 10 deletions(-) commit 820b9efeb142a45b2c55df0806feb34936025c2a Author: Kent Overstreet Date: Thu Jun 6 14:33:27 2024 -0400 bcachefs: Fix bch2_gc_accounting_done() locking The transaction commit path takes mark_lock, so we shouldn't be holding it; use a bpos as an iterator so that we can drop and retake. Signed-off-by: Kent Overstreet fs/bcachefs/disk_accounting.c | 18 ++++++++++++++---- fs/bcachefs/eytzinger.h | 11 +++++++++++ 2 files changed, 25 insertions(+), 4 deletions(-) commit f73e6bb6d6c70b72aff021237b8c4722cc43a919 Author: Kent Overstreet Date: Thu Jun 6 13:48:54 2024 -0400 bcachefs: bch2_accounting_mem_gc() Add a new helper to free zeroed out accounting entries, and use it in bch2_replicas_gc2(); bch2_replicas_gc2() was killing superblock replicas entries if their corresponding accounting counters were nonzero, but that's incorrect - the superblock replicas entry needs to exist if the accounting entry exists, not if it's nonzero, because we check and create the replicas entry when creating the new accounting entry - we don't know when it's becoming nonzero. Signed-off-by: Kent Overstreet fs/bcachefs/disk_accounting.c | 32 ++++++++++++++++++++++++++++++++ fs/bcachefs/disk_accounting.h | 1 + fs/bcachefs/replicas.c | 15 +++++++++------ 3 files changed, 42 insertions(+), 6 deletions(-) commit 2574e95a8b78ef853100d6889f154883fec989a2 Author: Kent Overstreet Date: Thu Jun 6 13:25:28 2024 -0400 bcachefs: Refactor disk accounting data structures Break up the percpu counter allocations into individual allocations for each disk accounting counter; this fixes an issue on large systems where we have too many replica entries to for the percpu allocator's max practical size. Also, use just one eytzinger tree for the normal set of counters and the gc counters; this simplifies accounting_gc_done() where we need the same set of counters to be present in both tables. Signed-off-by: Kent Overstreet fs/bcachefs/bcachefs.h | 2 +- fs/bcachefs/btree_gc.c | 7 +- fs/bcachefs/disk_accounting.c | 184 ++++++++++++++++-------------------- fs/bcachefs/disk_accounting.h | 31 +++--- fs/bcachefs/disk_accounting_types.h | 11 +-- 5 files changed, 109 insertions(+), 126 deletions(-) commit b5597347a5c7182dba80f9fb561c404abb3cead8 Author: Brian Foster Date: Thu Jun 6 09:58:26 2024 -0400 bcachefs: fix smatch data leak warning in fs usage ioctl smatch warns that the copy of arg to userspace is a potential data leak by virtue of arg.pad not being checked or zeroed. This was introduced by the commit referenced below that switched arg from being a zeroed runtime allocation to living on the stack. Fix by simply zero initializing the structure. Fixes: cde738a61e65 ("bcachefs: Convert bch2_ioctl_fs_usage() to new accounting") Reported-by: Dan Carpenter Signed-off-by: Brian Foster Signed-off-by: Kent Overstreet fs/bcachefs/chardev.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit f295920bc4a0f34f7c4182f53c8f0c929e4358a2 Author: Kent Overstreet Date: Wed Jun 5 12:35:48 2024 -0400 bcachefs: Fix race in bch2_accounting_mem_insert() bch2_accounting_mem_insert() drops and retakes mark_lock; thus, we need to check if the entry in question has already been inserted. Signed-off-by: Kent Overstreet fs/bcachefs/disk_accounting.c | 14 ++++++++------ fs/bcachefs/disk_accounting.h | 14 +++++++++----- 2 files changed, 17 insertions(+), 11 deletions(-) commit 49858d869b62446e552bf9421077fb6c3125b13a Author: Ariel Miculas Date: Mon Jun 3 23:47:31 2024 +0300 bcachefs: bch2_btree_insert() - add btree iter flags The commit 65bd44239727 ("bcachefs: bch2_btree_insert_trans() no longer specifies BTREE_ITER_cached") removes BTREE_ITER_cached from bch2_btree_insert_trans, which causes the update_inode function from bcachefs-tools to take a long time (~20s). Add an iter_flags parameter to bch2_btree_insert, so the users can specify iter update trigger flags, such as BTREE_ITER_cached. Signed-off-by: Ariel Miculas Signed-off-by: Kent Overstreet fs/bcachefs/btree_update.c | 6 ++++-- fs/bcachefs/btree_update.h | 5 +++-- fs/bcachefs/recovery.c | 2 +- fs/bcachefs/subvolume.c | 6 +++--- fs/bcachefs/tests.c | 14 +++++++------- 5 files changed, 18 insertions(+), 15 deletions(-) commit 8863d1e092005d5b31f7e712827a5605f8a7ba22 Author: Kent Overstreet Date: Fri Mar 1 18:43:39 2024 -0500 bcachefs: BCH_IOCTL_QUERY_ACCOUNTING Add a new ioctl that can return the new accounting counter types; it takes as input a bitmask of accounting types to return. This will be used for returning e.g. compression accounting and rebalance_work accounting. Signed-off-by: Kent Overstreet fs/bcachefs/bcachefs_ioctl.h | 29 +++++++++++++++++++++++++++++ fs/bcachefs/chardev.c | 30 ++++++++++++++++++++++++++++++ fs/bcachefs/disk_accounting.c | 38 ++++++++++++++++++++++++++++++++++++++ fs/bcachefs/disk_accounting.h | 1 + 4 files changed, 98 insertions(+) commit 7f3dc6c98b52204c0060fa7eee0fbced05958544 Author: Reed Riley Date: Sat May 11 00:20:12 2024 +0000 bcachefs: support REMAP_FILE_DEDUP in bch2_remap_file_range By removing the early-exit when REMAP_FILE_DEDUP is set, we should be able to support the fideduperange ioctl, albeit less efficiently than if we handled some of the extent locking and comparison logic inside bcachefs. Extent comparison logic already exists inside of `__generic_remap_file_range_prep`. Signed-off-by: Reed Riley Signed-off-by: Kent Overstreet fs/bcachefs/fs-io.c | 6 ++---- 1 file changed, 2 insertions(+), 4 deletions(-) commit 7a254053a59008913247606d0ce4a0a8b61fe6ee Author: Hongbo Li Date: Mon Jun 3 21:26:20 2024 +0800 bcachefs: support FS_IOC_SETFSLABEL Implement support for FS_IOC_SETFSLABEL ioctl to set filesystem label. Signed-off-by: Hongbo Li Signed-off-by: Kent Overstreet fs/bcachefs/fs-ioctl.c | 40 ++++++++++++++++++++++++++++++++++++++++ 1 file changed, 40 insertions(+) commit 81bce3cf2b2b4adcba4eda58fb3ebc4082b13fb3 Author: Hongbo Li Date: Mon Jun 3 21:26:19 2024 +0800 bcachefs: support get fs label Implement support for FS_IOC_GETFSLABEL ioctl to read filesystem label. Signed-off-by: Hongbo Li Signed-off-by: Kent Overstreet fs/bcachefs/fs-ioctl.c | 30 ++++++++++++++++++++++++++++++ 1 file changed, 30 insertions(+) commit 8a4ef7e28abade861d894e25b167988c5b8977a7 Author: Hongbo Li Date: Mon Jun 3 21:26:18 2024 +0800 bcachefs: implement FS_IOC_GETVERSION to support lsattr In this patch we add the FS_IOC_GETVERSION ioctl for getting i_generation from inode, after that, users can list file's generation number by using "lsattr". Signed-off-by: Hongbo Li Signed-off-by: Kent Overstreet fs/bcachefs/fs-ioctl.c | 10 +++++++++- 1 file changed, 9 insertions(+), 1 deletion(-) commit 889fb3dc5d6f8e0931649cb5f016dd38d50fd9fe Author: Kent Overstreet Date: Wed May 29 21:14:40 2024 -0400 bcachefs: Unlock trans when waiting for user input in fsck We can't hold locks while waiting for user input, that's a deadlock. Signed-off-by: Kent Overstreet fs/bcachefs/error.c | 32 ++++++++++++++++++++++++++++---- 1 file changed, 28 insertions(+), 4 deletions(-) commit 747d1d6c7efdfb4e59a93a129eaf434cb9325eb8 Author: Youling Tang Date: Fri May 31 10:35:09 2024 +0800 bcachefs: Add tracepoints for bch2_sync_fs() and bch2_fsync() Add trace_bch2_sync_fs() and trace_bch2_fsync() implementations. The output in trace is as follows: sync-29779 [000] ..... 193.700935: bch2_sync_fs: dev 254,16 wait 1 <...>-40027 [002] ..... 342.535227: bch2_fsync: dev 254,32 ino 4099 parent 4096 datasync 1 Signed-off-by: Youling Tang Signed-off-by: Kent Overstreet fs/bcachefs/fs-io.c | 2 ++ fs/bcachefs/fs.c | 3 +++ fs/bcachefs/trace.h | 50 ++++++++++++++++++++++++++++++++++++++++++++++++++ 3 files changed, 55 insertions(+) commit 8b0882505d012ef5f309a1b547fae53080a62f07 Author: Youling Tang Date: Fri May 31 10:31:15 2024 +0800 bcachefs: track writeback errors using the generic tracking infrastructure We already using mapping_set_error() in bch2_writepage_io_done(), so all we need to do is to use file_check_and_advance_wb_err() when handling fsync() requests in bch2_fsync(). Signed-off-by: Youling Tang Signed-off-by: Kent Overstreet fs/bcachefs/fs-io.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) commit f8b0147364d5938c71c0bf315becd7a9de0d64b0 Author: Ariel Miculas Date: Fri May 31 00:13:58 2024 +0300 bcachefs: bch2_dir_emit() - fix directory reads in the fuse driver Commit 0c0cbfdb84725e9933a24ecf47c61bdeeda06ba2 dropped the ctx->pos update before the call to dir_emit. This breaks the userspace implementation, causing the directory reads to be stuck in an infinite loop. This doesn't happen in the kernel because the vfs handles the updates to ctx->pos, but in the fuse implementation nobody updates it. Signed-off-by: Ariel Miculas Signed-off-by: Kent Overstreet fs/bcachefs/dirent.c | 8 ++++++++ 1 file changed, 8 insertions(+) commit 7ed122aea2e26686467c6ec63dc4a1c060e0ff44 Author: Kent Overstreet Date: Thu May 30 15:54:08 2024 -0400 bcachefs: twf: delete dead struct fields Signed-off-by: Kent Overstreet fs/bcachefs/thread_with_file_types.h | 4 ---- 1 file changed, 4 deletions(-) commit d37dd9b60487357cf831720383e335ee9baf5f25 Author: Kent Overstreet Date: Wed May 29 20:37:39 2024 -0400 bcachefs: bch2_stdio_redirect_readline_timeout() Signed-off-by: Kent Overstreet fs/bcachefs/thread_with_file.c | 25 ++++++++++++++++++++++--- fs/bcachefs/thread_with_file.h | 1 + 2 files changed, 23 insertions(+), 3 deletions(-) commit 0c97c437e362fb825b7501bd5da801bac77981b4 Author: Kent Overstreet Date: Wed May 29 20:34:48 2024 -0400 bcachefs: twf: convert bch2_stdio_redirect_readline() to darray We now read the line from the buffer atomically, which means we have to allow the buffer to grow past STDIO_REDIRECT_BUFSIZE if we're waiting for a full line - this behaviour is necessary for stdio_redirect_readline_timeout() in the next patch. Signed-off-by: Kent Overstreet fs/bcachefs/error.c | 15 ++++---- fs/bcachefs/thread_with_file.c | 70 +++++++++++++++++++++--------------- fs/bcachefs/thread_with_file.h | 3 +- fs/bcachefs/thread_with_file_types.h | 1 + 4 files changed, 54 insertions(+), 35 deletions(-) commit 36008d5d01ad155e14fd9df876d4356433613088 Author: Kent Overstreet Date: Wed May 29 22:06:00 2024 -0400 bcachefs: Plumb more logging through stdio redirect Signed-off-by: Kent Overstreet fs/bcachefs/bcachefs.h | 2 ++ fs/bcachefs/btree_iter.c | 4 ++-- fs/bcachefs/super.c | 13 +++++++++++++ 3 files changed, 17 insertions(+), 2 deletions(-) commit a850bde6498b46d6e3143d8847f9aa9598491f9f Author: Kent Overstreet Date: Thu Feb 8 21:10:32 2024 -0500 bcachefs: fsck_err() may now take a btree_trans fsck_err() now optionally takes a btree_trans; if the current thread has one, it is required that it be passed. The next patch will use this to unlock when waiting for user input. Signed-off-by: Kent Overstreet fs/bcachefs/alloc_background.c | 40 +++++++++--------- fs/bcachefs/backpointers.c | 12 +++--- fs/bcachefs/btree_gc.c | 54 +++++++++++++------------ fs/bcachefs/btree_io.c | 2 +- fs/bcachefs/btree_iter.c | 14 +++++++ fs/bcachefs/btree_iter.h | 2 + fs/bcachefs/btree_update_interior.c | 10 ++--- fs/bcachefs/buckets.c | 40 +++++++++--------- fs/bcachefs/disk_accounting.c | 18 +++++---- fs/bcachefs/error.c | 9 ++++- fs/bcachefs/error.h | 19 ++++++--- fs/bcachefs/fsck.c | 81 +++++++++++++++++++------------------ fs/bcachefs/inode.c | 13 +++--- fs/bcachefs/lru.c | 8 ++-- fs/bcachefs/reflink.c | 2 +- fs/bcachefs/snapshot.c | 24 ++++++----- fs/bcachefs/subvolume.c | 14 +++---- 17 files changed, 200 insertions(+), 162 deletions(-) commit 38e3ca275cb00034d9bd5006573f6e32fc5e2a45 Author: Kent Overstreet Date: Wed May 29 19:37:29 2024 -0400 bcachefs: btree_types bitmask cleanups Make things more consistent and ensure that we're using u64 bitfields - key types and btree ids are already around 32 bits. Signed-off-by: Kent Overstreet fs/bcachefs/btree_gc.c | 2 +- fs/bcachefs/btree_trans_commit.c | 50 ++++++++++++++++++---------------------- fs/bcachefs/btree_types.h | 14 +++++++++-- 3 files changed, 35 insertions(+), 31 deletions(-) commit 174722de552a8f0e3cffbe93d48420275141cc77 Author: Kent Overstreet Date: Sat Apr 6 23:58:01 2024 -0400 bcachefs: Delete old assertion for online fsck the order in which btree_gc walks keys have changed, so we no longer have the sort of issues with online fsck this assertion was warning about. Signed-off-by: Kent Overstreet fs/bcachefs/btree_trans_commit.c | 9 +-------- 1 file changed, 1 insertion(+), 8 deletions(-) commit 38ad9dc8c6194413a468f1eb288836b6c2783c6f Author: Kent Overstreet Date: Wed May 29 18:54:39 2024 -0400 bcachefs: Initialize gc buckets in alloc trigger Needed for online fsck; we need the trigger to initialize newly allocated buckets and generation number changes while gc is running. Signed-off-by: Kent Overstreet fs/bcachefs/alloc_background.c | 22 +++++++++++++++------- fs/bcachefs/btree_gc.c | 29 +++++------------------------ 2 files changed, 20 insertions(+), 31 deletions(-) commit 9ab55df5991eb967f6b94f8e1b855ffacdc50668 Author: Kent Overstreet Date: Wed May 29 18:53:48 2024 -0400 bcachefs: Walk leaf to root in btree_gc Next change will move gc_alloc_start initialization into the alloc trigger, so we have to mark those first. Signed-off-by: Kent Overstreet fs/bcachefs/btree_gc.c | 37 +++++++++++++++++-------------------- fs/bcachefs/btree_gc.h | 12 +++++++----- 2 files changed, 24 insertions(+), 25 deletions(-) commit 86d46471d52bf33e8652b220741d3223338d1724 Author: Kent Overstreet Date: Wed May 29 17:54:46 2024 -0400 bcachefs: Don't block journal when finishing check_allocations() Blocking the journal was needed to finish checking old style accounting, but that code is gone and it's not needed in the alloc rewrite, mark_lock is sufficient for synchronization. Signed-off-by: Kent Overstreet fs/bcachefs/btree_gc.c | 6 +----- 1 file changed, 1 insertion(+), 5 deletions(-) commit 5645c32ccf3197ee900dd0c0fbf66a40ad39f79f Author: Kent Overstreet Date: Wed May 29 13:55:49 2024 -0400 bcachefs: bch2_fs_get_tree() cleanup - improve error paths - call bch2_fs_start() separately, after applying late-parsed options Signed-off-by: Kent Overstreet fs/bcachefs/fs.c | 59 ++++++++++++++++++++++++++++---------------------------- 1 file changed, 29 insertions(+), 30 deletions(-) commit 25ee25e637a6f734ed549b79b1294b0bb96d112e Author: Kent Overstreet Date: Wed May 29 13:38:06 2024 -0400 bcachefs: Kill bch2_mount() Fold into bch2_fs_get_tree() Signed-off-by: Kent Overstreet fs/bcachefs/fs.c | 46 +++++++++++++++------------------------------- 1 file changed, 15 insertions(+), 31 deletions(-) commit b9efa9673e1d3fee530b582dbde1827d336513a8 Author: Kent Overstreet Date: Wed Dec 27 11:33:21 2023 -0500 bcachefs: Eytzinger accumulation for accounting keys The btree write buffer takes as input keys from the journal, sorts them, deduplicates them, and flushes them back to the btree in sorted order. The disk space accounting rewrite is moving accounting to normal btree keys, with update (in this case deltas) accumulated in the write buffer and then flushed to the btree; but this is going to increase the number of keys handled by the write buffer by perhaps as much as a factor of 3x-5x. The overhead from copying around and sorting this many keys would cause a significant performance regression, but: there is huge locality in updates to accounting keys that we can take advantage of. Instead of appending accounting keys to the list of keys to be sorted, this patch adds an eytzinger search tree of recently seen accounting keys. We look up the accounting key in the eytzinger search tree and apply the delta directly, adding it if it doesn't exist, and periodically prune the eytzinger tree of unused entries. Signed-off-by: Kent Overstreet fs/bcachefs/btree_write_buffer.c | 54 ++++++++++++++++++++++++++++++++-- fs/bcachefs/btree_write_buffer.h | 49 +++++++++++++++++++++++++++--- fs/bcachefs/btree_write_buffer_types.h | 2 ++ fs/bcachefs/journal_io.c | 10 +++++-- 4 files changed, 107 insertions(+), 8 deletions(-) commit 20ac515a9cc73d48be1462d2a04cda75215a1867 Author: Kent Overstreet Date: Tue Mar 19 00:04:52 2024 -0400 bcachefs: bch_acct_rebalance_work Signed-off-by: Kent Overstreet fs/bcachefs/buckets.c | 9 +++++++++ fs/bcachefs/disk_accounting_format.h | 3 ++- 2 files changed, 11 insertions(+), 1 deletion(-) commit 6af91147b6b90552cdf1dd400eeb9da66920f3ce Author: Kent Overstreet Date: Wed Feb 28 22:37:21 2024 -0500 bcachefs: bch_acct_btree Add counters for how much disk space we're using per btree. Signed-off-by: Kent Overstreet fs/bcachefs/buckets.c | 10 ++++++++++ fs/bcachefs/disk_accounting.c | 4 ++++ fs/bcachefs/disk_accounting_format.h | 8 +++++++- 3 files changed, 21 insertions(+), 1 deletion(-) commit 6675c37662341cf1a2e3b502a4dafbf7571978b2 Author: Kent Overstreet Date: Mon Feb 12 02:17:02 2024 -0500 bcachefs: bch_acct_snapshot Signed-off-by: Kent Overstreet fs/bcachefs/buckets.c | 10 ++++++++++ fs/bcachefs/disk_accounting.c | 3 +++ fs/bcachefs/disk_accounting_format.h | 8 +++++++- 3 files changed, 20 insertions(+), 1 deletion(-) commit 72c277878031a988ca472aa41370488c726d33b0 Author: Kent Overstreet Date: Fri Feb 23 17:23:41 2024 -0500 bcachefs: bch2_fs_usage_base_to_text() Helper to show raw accounting in sysfs, mainly for debugging. Signed-off-by: Kent Overstreet fs/bcachefs/sysfs.c | 19 +++++++++++++++++++ 1 file changed, 19 insertions(+) commit f93bb76ba288ccc1e014037413b007b174e03f3a Author: Kent Overstreet Date: Sat Feb 24 19:58:07 2024 -0500 bcachefs: bch2_fs_accounting_to_text() Helper to show raw accounting in sysfs, mainly for debugging. Signed-off-by: Kent Overstreet fs/bcachefs/disk_accounting.c | 26 ++++++++++++++++++++++++++ fs/bcachefs/disk_accounting.h | 1 + fs/bcachefs/sysfs.c | 5 +++++ 3 files changed, 32 insertions(+) commit 91f44781d59a00a3478240e0b907c70d972e8897 Author: Kent Overstreet Date: Sat Feb 24 21:09:51 2024 -0500 bcachefs: Convert bch2_compression_stats_to_text() to new accounting We no longer have to walk the whole btree to calculate compression stats. Signed-off-by: Kent Overstreet fs/bcachefs/sysfs.c | 86 ++++++++++++----------------------------------------- 1 file changed, 19 insertions(+), 67 deletions(-) commit bfcaa9079d91cb843630403e7379bbb86d2f73b0 Author: Kent Overstreet Date: Sat Jan 6 21:42:36 2024 -0500 bcachefs: bch_acct_compression This adds per-compression-type accounting of compressed and uncompressed size as well as number of extents - meaning we can now see compression ratio (without walking the whole filesystem). Signed-off-by: Kent Overstreet fs/bcachefs/buckets.c | 57 +++++++++++++++++++++++++++++------- fs/bcachefs/disk_accounting.c | 4 +++ fs/bcachefs/disk_accounting_format.h | 8 ++++- 3 files changed, 58 insertions(+), 11 deletions(-) commit 5668e5deec253dc4674aea00997716cc3a66aaac Author: Kent Overstreet Date: Sun Feb 18 00:13:22 2024 -0500 bcachefs: bch2_verify_accounting_clean() Verify that the in-memory accounting verifies the on-disk accounting after a clean shutdown. Signed-off-by: Kent Overstreet fs/bcachefs/disk_accounting.c | 87 +++++++++++++++++++++++++++++++++++++++++++ fs/bcachefs/disk_accounting.h | 4 +- fs/bcachefs/super.c | 1 + 3 files changed, 91 insertions(+), 1 deletion(-) commit 00839addfc771e5653bb9562c5a87cd78eea0eee Author: Kent Overstreet Date: Mon Feb 12 15:21:10 2024 -0500 bcachefs: Convert bch2_replicas_gc2() to new accounting bch2_replicas_gc2() is used for garbage collection superblock replicas entries that are empty - this converts it to the new accounting scheme. Signed-off-by: Kent Overstreet fs/bcachefs/replicas.c | 26 +++++++++++++++----------- 1 file changed, 15 insertions(+), 11 deletions(-) commit fb23d57a6dfc4e521c003dc542799f07d22d269e Author: Kent Overstreet Date: Sun Feb 11 22:48:05 2024 -0500 bcachefs: Convert gc to new accounting Rewrite fsck/gc for the new accounting scheme. This adds a second set of in-memory accounting counters for gc to use; like with other parts of gc we run all trigger in TRIGGER_GC mode, then compare what we calculated to existing in-memory accounting at the end. Signed-off-by: Kent Overstreet fs/bcachefs/alloc_background.c | 34 +------ fs/bcachefs/alloc_foreground.c | 16 ++-- fs/bcachefs/bcachefs.h | 4 +- fs/bcachefs/btree_gc.c | 133 ++++----------------------- fs/bcachefs/btree_trans_commit.c | 4 +- fs/bcachefs/buckets.c | 185 +++++++------------------------------ fs/bcachefs/buckets.h | 16 ---- fs/bcachefs/buckets_types.h | 7 -- fs/bcachefs/disk_accounting.c | 191 +++++++++++++++++++++++++++++++++------ fs/bcachefs/disk_accounting.h | 86 ++++++++++-------- fs/bcachefs/ec.c | 97 +++++++++----------- fs/bcachefs/inode.c | 43 +++------ fs/bcachefs/recovery.c | 3 +- fs/bcachefs/replicas.c | 86 ++---------------- fs/bcachefs/replicas.h | 1 - fs/bcachefs/super.c | 9 +- fs/bcachefs/util.h | 4 +- 17 files changed, 343 insertions(+), 576 deletions(-) commit 4c4a7d48bd59380fa4fc75f2cd341e9de09adbf7 Author: Kent Overstreet Date: Tue Jan 2 00:22:57 2024 -0500 bcachefs: Kill replicas_journal_res More dead code deletion Signed-off-by: Kent Overstreet fs/bcachefs/bcachefs.h | 2 -- fs/bcachefs/replicas.c | 34 ---------------------------------- fs/bcachefs/super.c | 21 --------------------- 3 files changed, 57 deletions(-) commit 66a57684c6afce8e20ac38b389caca078407ac29 Author: Kent Overstreet Date: Tue Jan 2 00:15:16 2024 -0500 bcachefs: Kill fs_usage_online More dead code deletion. Signed-off-by: Kent Overstreet fs/bcachefs/buckets.c | 10 ---------- fs/bcachefs/buckets.h | 12 ------------ fs/bcachefs/buckets_types.h | 5 ----- 3 files changed, 27 deletions(-) commit fe5eddc0d02176d54609c9e38044c2870750bf1d Author: Kent Overstreet Date: Sat Feb 24 20:04:48 2024 -0500 bcachefs: Kill bch2_fs_usage_to_text() Dead code. Signed-off-by: Kent Overstreet fs/bcachefs/buckets.c | 39 --------------------------------------- fs/bcachefs/buckets.h | 3 --- 2 files changed, 42 deletions(-) commit 8bb8d683a4013f94953da3991da4bb2c38111063 Author: Kent Overstreet Date: Wed Dec 27 22:09:25 2023 -0500 bcachefs: Delete journal-buf-sharded old style accounting More deletion of dead code. Signed-off-by: Kent Overstreet fs/bcachefs/bcachefs.h | 3 +-- fs/bcachefs/btree_gc.c | 9 ++++--- fs/bcachefs/buckets.c | 61 +++++------------------------------------ fs/bcachefs/buckets.h | 4 --- fs/bcachefs/disk_accounting.c | 2 +- fs/bcachefs/recovery.c | 20 +------------- fs/bcachefs/replicas.c | 63 ++++--------------------------------------- fs/bcachefs/replicas.h | 4 --- fs/bcachefs/super.c | 2 ++ 9 files changed, 21 insertions(+), 147 deletions(-) commit 5b9bc272e6c37406fcc5dba720a477d00240477a Author: Kent Overstreet Date: Sun Dec 31 22:30:15 2023 -0500 bcachefs: Kill writing old accounting to journal More ripping out of the old disk space accounting. Note that the new disk space accounting is incompatible with the old, and writing out old style disk space accounting with the new code is infeasible. This means upgrading and downgrading past this version requires regenerating accounting. Signed-off-by: Kent Overstreet fs/bcachefs/sb-clean.c | 45 --------------------------------------------- 1 file changed, 45 deletions(-) commit 3afb8dbf03408099e745f12e4d121f1412575618 Author: Kent Overstreet Date: Mon Jan 1 23:36:23 2024 -0500 bcachefs: kill bch2_fs_usage_read() With bch2_ioctl_fs_usage(), this is now dead code. Signed-off-by: Kent Overstreet fs/bcachefs/bcachefs.h | 4 ---- fs/bcachefs/buckets.c | 34 ---------------------------------- fs/bcachefs/buckets.h | 2 -- fs/bcachefs/chardev.c | 25 ++++++++++++------------- fs/bcachefs/disk_accounting.c | 2 +- fs/bcachefs/replicas.c | 7 ------- fs/bcachefs/super.c | 2 -- 7 files changed, 13 insertions(+), 63 deletions(-) commit 6b39638b84b462e29e8008f5b5f6fad93e021544 Author: Kent Overstreet Date: Sat Jan 6 20:29:25 2024 -0500 bcachefs: Convert bch2_ioctl_fs_usage() to new accounting This converts bch2_ioctl_fs_usage() to read from the new disk accounting, via bch2_fs_replicas_usage_read(). Signed-off-by: Kent Overstreet fs/bcachefs/chardev.c | 68 ++++++++++++++------------------------------------- 1 file changed, 19 insertions(+), 49 deletions(-) commit 72a6bb098c5879ce6aa51f714730971737a0b3ca Author: Kent Overstreet Date: Fri Jan 5 21:23:07 2024 -0500 bcachefs: Kill bch2_fs_usage_initialize() Deleting code for the old disk accounting scheme. Signed-off-by: Kent Overstreet fs/bcachefs/buckets.c | 29 ----------------------------- fs/bcachefs/buckets.h | 2 -- fs/bcachefs/recovery.c | 2 -- 3 files changed, 33 deletions(-) commit f5095b9f85a1674a92d00e7ab466499a8ba49ce1 Author: Kent Overstreet Date: Mon Jan 1 19:42:37 2024 -0500 bcachefs: dev_usage updated by new accounting Reading disk accounting now requires an eytzinger lookup (see: bch2_accounting_mem_read()), but the per-device counters are used frequently enough that we'd like to still be able to read them with just a percpu sum, as in the old code. This patch special cases the device counters; when we update in-memory accounting we also update the old style percpu counters if it's a deice counter update. Signed-off-by: Kent Overstreet fs/bcachefs/bcachefs.h | 3 +-- fs/bcachefs/btree_gc.c | 2 +- fs/bcachefs/buckets.c | 36 +++++------------------------------- fs/bcachefs/buckets_types.h | 2 +- fs/bcachefs/disk_accounting.c | 15 +++++++++++++++ fs/bcachefs/disk_accounting.h | 14 +++++++++++++- fs/bcachefs/recovery.c | 17 ----------------- fs/bcachefs/sb-clean.c | 17 ----------------- 8 files changed, 36 insertions(+), 70 deletions(-) commit 2e8d686a4a13c01d9a2b329507a0f5ce6455b5a8 Author: Kent Overstreet Date: Tue Jun 4 18:31:13 2024 -0400 bcachefs: Coalesce accounting keys before journal replay This fixes a performance regression in journal replay; without colaescing accounting keys we have multiple keys at the same position, which means journal_keys_peek_upto() has to skip past many overwritten keys - turning journal replay into an O(n^2) algorithm. Signed-off-by: Kent Overstreet fs/bcachefs/btree_journal_iter.h | 2 ++ fs/bcachefs/disk_accounting.c | 18 ++++++++++++++++++ 2 files changed, 20 insertions(+) commit 1d16c605cc55ef26f0c65b362665a6c99080ccbc Author: Kent Overstreet Date: Thu Nov 9 14:22:46 2023 -0500 bcachefs: Disk space accounting rewrite Main part of the disk accounting rewrite. This is a wholesale rewrite of the existing disk space accounting, which relies on percepu counters that are sharded by journal buffer, and rolled up and added to each journal write. With the new scheme, every set of counters is a distinct key in the accounting btree; this fixes scaling limitations of the old scheme, where counters took up space in each journal entry and required multiple percpu counters. Now, in memory accounting requires a single set of percpu counters - not multiple for each in flight journal buffer - and in the future we'll probably also have counters that don't use in memory percpu counters, they're not strictly required. An accounting update is now a normal btree update, using the btree write buffer path. At transaction commit time, we apply accounting updates to the in memory counters, which are percpu counters indexed in an eytzinger tree by the accounting key. Signed-off-by: Kent Overstreet fs/bcachefs/alloc_background.c | 79 ++++++-- fs/bcachefs/alloc_background.h | 27 ++- fs/bcachefs/bcachefs.h | 6 +- fs/bcachefs/bcachefs_format.h | 1 - fs/bcachefs/bcachefs_ioctl.h | 7 +- fs/bcachefs/btree_gc.c | 5 +- fs/bcachefs/btree_iter.c | 9 - fs/bcachefs/btree_trans_commit.c | 65 +++++-- fs/bcachefs/btree_types.h | 1 - fs/bcachefs/btree_update.h | 9 +- fs/bcachefs/buckets.c | 291 +++++----------------------- fs/bcachefs/buckets.h | 26 +-- fs/bcachefs/disk_accounting.c | 366 ++++++++++++++++++++++++++++++++++- fs/bcachefs/disk_accounting.h | 131 +++++++++++++ fs/bcachefs/disk_accounting_format.h | 3 +- fs/bcachefs/disk_accounting_types.h | 20 ++ fs/bcachefs/ec.c | 26 +-- fs/bcachefs/inode.c | 9 +- fs/bcachefs/recovery.c | 17 +- fs/bcachefs/recovery_passes.c | 1 + fs/bcachefs/recovery_passes_types.h | 1 + fs/bcachefs/replicas.c | 42 ++-- fs/bcachefs/replicas.h | 11 +- fs/bcachefs/replicas_types.h | 16 -- fs/bcachefs/super.c | 49 +++-- 25 files changed, 795 insertions(+), 423 deletions(-) commit 5d9667d1d6eaca3f6cd3c63cd6a0f309147c7f5c Author: Kent Overstreet Date: Fri Nov 17 00:23:07 2023 -0500 bcachefs: btree write buffer knows how to accumulate bch_accounting keys Teach the btree write buffer how to accumulate accounting keys - instead of having the newer key overwrite the older key as we do with other updates, we need to add them together. Also, add a flag so that write buffer flush knows when journal replay is finished flushing accounting, and teach it to hold accounting keys until that flag is set. Signed-off-by: Kent Overstreet fs/bcachefs/bcachefs.h | 1 + fs/bcachefs/btree_write_buffer.c | 84 +++++++++++++++++++++++++++++++++++----- fs/bcachefs/recovery.c | 3 ++ 3 files changed, 79 insertions(+), 9 deletions(-) commit 9dec2a473bd1ba6a111382928e3ceaddfbb720ba Author: Kent Overstreet Date: Wed Dec 27 20:59:01 2023 -0500 bcachefs: Accumulate accounting keys in journal replay Until accounting keys hit the btree, they are deltas, not new versions of the existing key; this means we have to teach journal replay to accumulate them. Additionally, the journal doesn't track precisely which entries have been flushed to the btree; it only tracks a range of entries that may possibly still need to be flushed. That means we need to compare accounting keys against the version in the btree and only flush updates that are newer. There's another wrinkle with the write buffer: if the write buffer starts flushing accounting keys before journal replay has finished flushing accounting keys, journal replay will see the version number from the new updates and updates from the journal will be lost. To avoid this, journal replay has to flush accounting keys first, and we'll be adding a flag so that write buffer flush knows to hold accounting keys until then. Signed-off-by: Kent Overstreet fs/bcachefs/btree_journal_iter.c | 23 ++++--------- fs/bcachefs/btree_journal_iter.h | 15 +++++++++ fs/bcachefs/btree_trans_commit.c | 26 ++++++++++++--- fs/bcachefs/btree_update.h | 14 +++++++- fs/bcachefs/recovery.c | 72 ++++++++++++++++++++++++++++++++++++++-- 5 files changed, 126 insertions(+), 24 deletions(-) commit 2744e5c9eb1a1090b5f61c955e934c70bfe6b04c Author: Kent Overstreet Date: Wed Dec 27 18:31:46 2023 -0500 bcachefs: KEY_TYPE_accounting New key type for the disk space accounting rewrite. - Holds a variable sized array of u64s (may be more than one for accounting e.g. compressed and uncompressed size, or buckets and sectors for a given data type) - Updates are deltas, not new versions of the key: this means updates to accounting can happen via the btree write buffer, which we'll be teaching to accumulate deltas. Signed-off-by: Kent Overstreet fs/bcachefs/Makefile | 3 +- fs/bcachefs/bcachefs_format.h | 56 +++----------- fs/bcachefs/bkey_methods.c | 1 + fs/bcachefs/disk_accounting.c | 70 +++++++++++++++++ fs/bcachefs/disk_accounting.h | 52 +++++++++++++ fs/bcachefs/disk_accounting_format.h | 144 +++++++++++++++++++++++++++++++++++ fs/bcachefs/recovery.c | 1 + fs/bcachefs/sb-downgrade.c | 25 +++++- 8 files changed, 303 insertions(+), 49 deletions(-) commit 929d954330142a6273697b2cbf855f0f904a12f5 Author: Thomas Bertschinger Date: Mon May 27 22:36:11 2024 -0600 bcachefs: use new mount API This updates bcachefs to use the new mount API: - Update the file_system_type to use the new init_fs_context() function. - Define the new fs_context_operations functions. - No longer register bch2_mount() and bch2_remount(); these are now called via the new fs_context functions. - Define a new helper type, bch2_opts_parse that includes a struct bch_opts and additionally a printbuf used to save options that can't be parsed until after the FS is opened. This enables us to parse as many options as possible prior to opening the filesystem while saving those options that need the open FS for later parsing. Signed-off-by: Thomas Bertschinger Signed-off-by: Kent Overstreet fs/bcachefs/fs.c | 115 +++++++++++++++++++++++++++++++++++++++++++---------- fs/bcachefs/opts.h | 7 ++++ 2 files changed, 100 insertions(+), 22 deletions(-) commit 1c12d1caf8d627d8b791f4dc25af2522dac7cd10 Author: Thomas Bertschinger Date: Mon May 27 22:36:10 2024 -0600 bcachefs: Add error code to defer option parsing This introduces a new error code, option_needs_open_fs, which is used to indicate that an attempt was made to parse a mount option prior to opening a filesystem, when that mount option requires an open filesystem in order to be validated. Returning this error results in bch2_parse_one_mount_opt() saving that option for later parsing, after the filesystem is opened. Signed-off-by: Thomas Bertschinger Signed-off-by: Kent Overstreet fs/bcachefs/disk_groups.c | 2 +- fs/bcachefs/errcode.h | 3 ++- fs/bcachefs/opts.c | 15 +++++++++++++++ 3 files changed, 18 insertions(+), 2 deletions(-) commit 9b7f0b5d3d220ccba3151b95a5532780e04e1954 Author: Thomas Bertschinger Date: Mon May 27 22:36:09 2024 -0600 bcachefs: add printbuf arg to bch2_parse_mount_opts() Mount options that take the name of a device that may be part of a filesystem, for example "metadata_target", cannot be validated until after the filesystem has been opened. However, an attempt to parse those options may be made prior to the filesystem being opened. This change adds a printbuf parameter to bch2_parse_mount_opts() which will be used to save those mount options, when they are supplied prior to the FS being opened, so that they can be parsed later. This functionality is not currently needed, but will be used after bcachefs starts using the new mount API to parse mount options. This is because using the new mount API, we will process mount options prior to opening the FS, but the new API doesn't provide a convenient way to "replay" mount option parsing. So we save these options ourselves to accomplish this. This change also splits out the code to parse a single option into bch2_parse_one_mount_opt(), which will be useful when using the new mount API which deals with a single mount option at a time. Signed-off-by: Thomas Bertschinger Signed-off-by: Kent Overstreet fs/bcachefs/chardev.c | 4 +- fs/bcachefs/fs.c | 6 +-- fs/bcachefs/opts.c | 105 +++++++++++++++++++++++++++++--------------------- fs/bcachefs/opts.h | 5 ++- 4 files changed, 71 insertions(+), 49 deletions(-) commit 7773df19c35fabdcc8c36176a480a1b19ad32866 Author: Kent Overstreet Date: Thu Apr 25 20:45:00 2024 -0400 bcachefs: metadata version bucket_stripe_sectors New on disk format version for bch_alloc->stripe_sectors and BCH_DATA_unstriped - accounting for unstriped data in stripe buckets. Upgrade/downgrade requires regenerating alloc info - but only if erasure coding is in use. Signed-off-by: Kent Overstreet fs/bcachefs/bcachefs.h | 1 + fs/bcachefs/bcachefs_format.h | 3 +- fs/bcachefs/btree_iter.h | 8 ++++ fs/bcachefs/btree_update.h | 8 ---- fs/bcachefs/recovery.c | 5 +++ fs/bcachefs/sb-downgrade.c | 88 ++++++++++++++++++++++++++++++++++++++----- fs/bcachefs/sb-downgrade.h | 1 + 7 files changed, 96 insertions(+), 18 deletions(-) commit 2612e29142ff718e6f120c62e6792f0a67fd3005 Author: Kent Overstreet Date: Thu Nov 23 16:34:03 2023 -0500 bcachefs: BCH_DATA_unstriped Add a new pseudo data type, to track buckets that are members of a stripe, but have unstriped data in them. Signed-off-by: Kent Overstreet fs/bcachefs/alloc_background.h | 5 +++++ fs/bcachefs/bcachefs_format.h | 3 ++- fs/bcachefs/buckets.c | 14 +++++++++++--- fs/bcachefs/chardev.c | 2 +- 4 files changed, 19 insertions(+), 5 deletions(-) commit 55f7962da3bb2d34525c1973189413a113667a24 Author: Kent Overstreet Date: Thu Nov 23 17:21:23 2023 -0500 bcachefs: bch_alloc->stripe_sectors Add a separate counter to bch_alloc_v4 for amount of striped data; this lets us separately track striped and unstriped data in a bucket, which lets us see when erasure coding has failed to update extents with stripe pointers, and also find buckets to continue updating if we crash mid way through creating a new stripe. Signed-off-by: Kent Overstreet fs/bcachefs/alloc_background.c | 25 +++++++++++++++++++++---- fs/bcachefs/alloc_background.h | 8 +++++--- fs/bcachefs/alloc_background_format.h | 2 ++ fs/bcachefs/btree_gc.c | 2 ++ fs/bcachefs/buckets.c | 16 +++++++++------- fs/bcachefs/buckets_types.h | 3 ++- 6 files changed, 41 insertions(+), 15 deletions(-) commit c13d526d9dc1aa0c4962b017c881c28c1e23ca26 Author: Kent Overstreet Date: Sun May 26 18:11:37 2024 -0400 bcachefs: check_key_has_inode() Consolidate duplicated checks for extents/dirents/xattrs - these keys should all have a corresponding inode of the correct type. Signed-off-by: Kent Overstreet fs/bcachefs/fsck.c | 203 ++++++++++++++++++++++------------------- fs/bcachefs/sb-errors_format.h | 4 +- 2 files changed, 113 insertions(+), 94 deletions(-) commit 51fc436c806c638512ea745579dbc4098a60b2d5 Author: Thomas Bertschinger Date: Sat May 25 13:36:19 2024 -0600 bcachefs: allow passing full device path for target options The output of mount options such as "metadata_target" in `/proc/mounts` uses the full path to the device. mount(8) from util-linux uses the output from `/proc/mounts` to pass existing mount options when performing a remount, so bcachefs should accept as input the same form that it prints as output. Without this change: $ mount -t bcachefs -o metadata_target=vdb /dev/vdb /mnt $ strace mount -o remount /mnt ... fsconfig(4, FSCONFIG_SET_STRING, "metadata_target", "/dev/vdb", 0) = -1 EINVAL (Invalid argument) ... Signed-off-by: Thomas Bertschinger Signed-off-by: Kent Overstreet fs/bcachefs/super.c | 3 +++ 1 file changed, 3 insertions(+) commit 3811f48aa3d6ab97b199bdf4bdacce7abe7cfdeb Author: Kent Overstreet Date: Sun May 26 22:20:34 2024 -0400 bcachefs: bch2_printbuf_strip_trailing_newline() Add a new helper to fix inode_to_text() Signed-off-by: Kent Overstreet fs/bcachefs/inode.c | 2 ++ fs/bcachefs/printbuf.c | 14 ++++++++++++++ fs/bcachefs/printbuf.h | 1 + 3 files changed, 17 insertions(+) commit babe30fe8db62b79f7e3df4144acc344b3672f60 Author: Thomas Bertschinger Date: Sun May 26 13:08:20 2024 -0600 bcachefs: don't expose "read_only" as a mount option When "read_only" is exposed as a mount option, it is redundant with the standard option "ro" and gives users multiple ways to specify that a bcachefs filesystem should be mounted read-only. This presents the risk of having inconsistent options specified. This can be seen when remounting a read-only filesystem in read-write mode, using mount(8) from util-linux. Because mount(8) parses the existing mount options from `/proc/mounts` and applies them when remounting, it can end up applying both "read_only" and "rw": $ mount img -o ro /mnt $ strace mount -o remount,rw /mnt ... fsconfig(4, FSCONFIG_SET_FLAG, "read_only", NULL, 0) = 0 fsconfig(4, FSCONFIG_SET_FLAG, "rw", NULL, 0) = 0 ... Making "read_only" no longer a mount option means this edge case cannot occur. Fixes: 62719cf33c3a ("bcachefs: Fix nochanges/read_only interaction") Signed-off-by: Thomas Bertschinger Signed-off-by: Kent Overstreet fs/bcachefs/opts.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 03ec0927fa15e1af1268c8637f61b0ac98082907 Author: Thomas Bertschinger Date: Sun May 26 13:08:19 2024 -0600 bcachefs: make offline fsck set read_only fs flag A subsequent change will remove "read_only" as a mount option in favor of the standard option "ro", meaning the userspace fsck command cannot pass it to the fsck ioctl. Instead, in offline fsck, set "read_only" kernel-side without trying to parse it as a mount option. For compatibility with versions of the "bcachefs fsck" command that try to pass the "read_only" mount opt, remove it from the mount options string prior to parsing when it is present. Signed-off-by: Thomas Bertschinger Signed-off-by: Kent Overstreet fs/bcachefs/chardev.c | 13 +++++++++++++ 1 file changed, 13 insertions(+) commit 652bc7fabc28294e6a6798c4d37861db605bda8d Author: Kent Overstreet Date: Fri May 24 18:04:22 2024 -0400 bcachefs: btree_ptr_sectors_written() now takes bkey_s_c this is for the userspace metadata dump tool Signed-off-by: Kent Overstreet fs/bcachefs/btree_io.c | 8 ++++---- fs/bcachefs/btree_io.h | 6 +++--- fs/bcachefs/btree_update_interior.c | 2 +- fs/bcachefs/move.c | 2 +- 4 files changed, 9 insertions(+), 9 deletions(-) commit 9cc8eb3098b8e78c727bc136f8e97ce5178fcce8 Author: Kent Overstreet Date: Fri May 10 09:27:09 2024 -0400 bcachefs: Check for bsets past bch_btree_ptr_v2.sectors_written Signed-off-by: Kent Overstreet fs/bcachefs/btree_io.c | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) commit 68573b936d3fceda9cd5cce3a577e035d19ad426 Author: Uros Bizjak Date: Thu May 23 11:19:26 2024 +0200 bcachefs: Use try_cmpxchg() family of functions instead of cmpxchg() Use try_cmpxchg() family of functions instead of cmpxchg (*ptr, old, new) == old. x86 CMPXCHG instruction returns success in ZF flag, so this change saves a compare after cmpxchg (and related move instruction in front of cmpxchg). Also, try_cmpxchg() implicitly assigns old *ptr value to "old" when cmpxchg fails. There is no need to re-read the value in the loop. No functional change intended. Signed-off-by: Uros Bizjak Cc: Kent Overstreet Cc: Brian Foster Signed-off-by: Kent Overstreet fs/bcachefs/btree_cache.c | 8 ++++---- fs/bcachefs/btree_io.c | 20 +++++++++++--------- fs/bcachefs/btree_trans_commit.c | 8 ++++---- fs/bcachefs/btree_update_interior.c | 8 ++++---- fs/bcachefs/buckets.c | 17 ++++++++--------- fs/bcachefs/buckets.h | 4 ++-- fs/bcachefs/io_write.c | 7 +++---- fs/bcachefs/journal.c | 17 ++++++++--------- fs/bcachefs/journal.h | 8 ++++---- fs/bcachefs/journal_io.c | 9 +++++---- fs/bcachefs/two_state_shared_lock.h | 11 +++++------ 11 files changed, 58 insertions(+), 59 deletions(-) commit e76a2b65b0565f55ea668ec46d54f6a00b8ea9fc Author: Kent Overstreet Date: Fri Jun 7 16:35:42 2024 -0400 bcachefs: add might_sleep() annotations for fsck_err() Signed-off-by: Kent Overstreet fs/bcachefs/error.c | 2 ++ fs/bcachefs/error.h | 5 ++++- 2 files changed, 6 insertions(+), 1 deletion(-) commit 546b65378d0436f55cd6fcbbba890525b77d65f3 Author: Kent Overstreet Date: Mon Jun 17 13:58:17 2024 -0400 bcachefs: fix missing include fs-common.h needs dirent.h for enum bch_rename_mode Signed-off-by: Kent Overstreet fs/bcachefs/fs-common.h | 2 ++ 1 file changed, 2 insertions(+) commit 630d565ddad52c1777ec3b48de04ecdc21004991 Author: Youling Tang Date: Thu Apr 25 17:16:59 2024 +0800 bcachefs: Use filemap_read() to simplify the execution flow Using filemap_read() can reduce unnecessary code execution for non IOCB_DIRECT paths. Signed-off-by: Youling Tang Signed-off-by: Kent Overstreet fs/bcachefs/fs-io-direct.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) commit da6fa380d369a7e4d61f7a654efb48a018e3e563 Author: Youling Tang Date: Thu Apr 18 08:50:55 2024 +0800 bcachefs: Align the display format of `btrees/inodes/keys` Before patch: ``` #cat btrees/inodes/keys u64s 17 type inode_v3 0:4096:U32_MAX len 0 ver 0: mode=40755 flags= (16300000) bi_size=0 ``` After patch: ``` #cat btrees/inodes/keys u64s 17 type inode_v3 0:4096:U32_MAX len 0 ver 0: mode=40755 flags=(16300000) bi_size=0 ``` Signed-off-by: Youling Tang Signed-off-by: Kent Overstreet fs/bcachefs/inode.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) commit 12e7ff1a1ee5dda5880116db451a3f3d23a79267 Author: Youling Tang Date: Thu Apr 18 16:31:03 2024 +0800 bcachefs: Fix missing spaces in journal_entry_dev_usage_to_text Fixed missing spaces displayed in journal_entry_dev_usage_to_text while adjusting the display format to improve readability. before: ``` # bcachefs list_journal -a -t alloc:1:0 /dev/sdb ... dev_usage: dev=0free: buckets=233180 sectors=0 fragmented=0sb: buckets=13 sectors=6152 fragmented=504journal: buckets=1847 sectors=945664 fragmented=0btree: buckets=20 sectors=10240 fragmented=0user: buckets=1419 sectors=726513 fragmented=15cached: buckets=0 sectors=0 fragmented=0parity: buckets=0 sectors=0 fragmented=0stripe: buckets=0 sectors=0 fragmented=0need_gc_gens: buckets=0 sectors=0 fragmented=0need_discard: buckets=1 sectors=0 fragmented=0 ``` after: ``` # bcachefs list_journal -a -t alloc:1:0 /dev/sdb ... dev_usage: dev=0 free: buckets=233180 sectors=0 fragmented=0 sb: buckets=13 sectors=6152 fragmented=504 journal: buckets=1847 sectors=945664 fragmented=0 btree: buckets=20 sectors=10240 fragmented=0 user: buckets=1419 sectors=726513 fragmented=15 cached: buckets=0 sectors=0 fragmented=0 parity: buckets=0 sectors=0 fragmented=0 stripe: buckets=0 sectors=0 fragmented=0 need_gc_gens: buckets=0 sectors=0 fragmented=0 need_discard: buckets=1 sectors=0 fragmented=0 ``` Signed-off-by: Youling Tang Signed-off-by: Kent Overstreet fs/bcachefs/journal_io.c | 3 +++ 1 file changed, 3 insertions(+) commit f369de82679f4f71d4f5e8a3149a80ebc1bfc987 Author: Kent Overstreet Date: Thu Jul 4 17:10:29 2024 -0400 bcachefs: fix ei_update_lock lock ordering ei_update_lock is largely vestigal and will probably be removed, but we're not ready for that just yet. this fixes some lockdep splats with the new lockdep support for btree node locks; they're harmless, since we were taking ei_update_lock before actually locking any btree nodes, but "any btree nodes locked" are now tracked at the btree_trans level. Signed-off-by: Kent Overstreet fs/bcachefs/acl.c | 4 ++-- fs/bcachefs/fs.c | 11 ++++++----- 2 files changed, 8 insertions(+), 7 deletions(-) commit cdda2126ab0dfeafc52c725f808baed7ea26d0b5 Author: Kent Overstreet Date: Thu Jul 11 16:30:41 2024 -0400 bcachefs: bch2_btree_reserve_cache_to_text() Add a pretty printer so the btree reserve cache can be seen in sysfs; as it pins open_buckets we need it for tracking down open_buckets issues. Signed-off-by: Kent Overstreet fs/bcachefs/alloc_foreground.c | 2 +- fs/bcachefs/alloc_foreground.h | 1 + fs/bcachefs/btree_update_interior.c | 22 ++++++++++++++++++++++ fs/bcachefs/btree_update_interior.h | 2 ++ fs/bcachefs/sysfs.c | 6 ++++++ 5 files changed, 32 insertions(+), 1 deletion(-) commit d06a26d24db090d8be0ea4c9bfa1457e334940b7 Author: Kent Overstreet Date: Thu Jul 11 16:11:45 2024 -0400 bcachefs: sysfs trigger_freelist_wakeup another debugging knob Signed-off-by: Kent Overstreet fs/bcachefs/sysfs.c | 5 +++++ 1 file changed, 5 insertions(+) commit a1e7a97f22bf688a1234e698d342726e70f8a25b Author: Kent Overstreet Date: Fri Jun 28 21:40:00 2024 -0400 bcachefs: sysfs internal/trigger_journal_writes another debugging knob - trigger the journal to do ready journal writes Signed-off-by: Kent Overstreet fs/bcachefs/sysfs.c | 5 +++++ 1 file changed, 5 insertions(+) commit 26a170aa6182209723f7654eaeddcab7b58a9d83 Author: Kent Overstreet Date: Thu Jul 11 16:00:46 2024 -0400 bcachefs: add capacity, reserved to fs_alloc_debug_to_text() Signed-off-by: Kent Overstreet fs/bcachefs/alloc_background.c | 1 + fs/bcachefs/alloc_foreground.c | 2 ++ fs/bcachefs/bcachefs.h | 1 + 3 files changed, 4 insertions(+) commit 8a3c8303e2f1834a79e00305d94ef562946c2ef4 Author: Kent Overstreet Date: Sat Jun 29 14:37:46 2024 -0400 bcachefs: uninline fallocate functions better stack traces Signed-off-by: Kent Overstreet fs/bcachefs/fs-io.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) commit 52fd0f96206831ed4b75d2060f2e2a96bf2624b0 Author: Kent Overstreet Date: Wed Jul 10 18:03:11 2024 -0400 bcachefs: btree ids are 64 bit bitmasks Signed-off-by: Kent Overstreet fs/bcachefs/backpointers.c | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) commit 3de8fd4a33c9caf5ca798373800a37e4f206d8ed Author: Kent Overstreet Date: Thu Jul 11 14:08:38 2024 -0400 bcachefs: Print allocator stuck on timeout in fallocate path same as in io_write.c, if we're waiting on the allocator for an excessive amount of time, print what's going on Signed-off-by: Kent Overstreet fs/bcachefs/io_misc.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) commit 1ea3fd1eb9869fcdcbc9c68f9728bfc47b9503f1 Author: Guenter Roeck Date: Sat Jul 13 12:03:53 2024 -0700 hwmon: (max6697) Fix swapped temp{1,8} critical alarms The critical alarm bit for the local temperature sensor (temp1) is in bit 7 of register 0x45 (not bit 6), and the critical alarm bit for remote temperature sensor 7 (temp8) is in bit 6 (not bit 7). This only affects MAX6581 since all other chips supported by this driver do not support those critical alarms. Fixes: 5372d2d71c46 ("hwmon: Driver for Maxim MAX6697 and compatibles") Reviewed-by: Tzung-Bi Shih Signed-off-by: Guenter Roeck drivers/hwmon/max6697.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) commit cbf7467828cd4ec7ceac7a8b5b5ddb2f69f07b0e Author: Guenter Roeck Date: Sat Jul 13 14:26:19 2024 -0700 hwmon: (max6697) Fix underflow when writing limit attributes Using DIV_ROUND_CLOSEST() on an unbound value can result in underflows. Indeed, module test scripts report: temp1_max: Suspected underflow: [min=0, read 255000, written -9223372036854775808] temp1_crit: Suspected underflow: [min=0, read 255000, written -9223372036854775808] Fix by introducing an extra set of clamping. Fixes: 5372d2d71c46 ("hwmon: Driver for Maxim MAX6697 and compatibles") Reviewed-by: Tzung-Bi Shih Signed-off-by: Guenter Roeck drivers/hwmon/max6697.c | 1 + 1 file changed, 1 insertion(+) commit ed99ae74f2328e42286880c946953a8f9dd95a7e Author: Guenter Roeck Date: Fri Jul 12 10:27:26 2024 -0700 hwmon: Remove obsolete adm1021 and max6642 drivers ADM1021, MAX6642, and compatible chips are supported by the lm90 driver. Remove the obsolete stand-alone drivers to reduce maintenance overhead. Reviewed-by: Tzung-Bi Shih Signed-off-by: Guenter Roeck Documentation/hwmon/adm1021.rst | 153 ------------ Documentation/hwmon/index.rst | 2 - Documentation/hwmon/max6642.rst | 27 --- drivers/hwmon/Kconfig | 24 -- drivers/hwmon/Makefile | 2 - drivers/hwmon/adm1021.c | 503 ---------------------------------------- drivers/hwmon/max6642.c | 314 ------------------------- 7 files changed, 1025 deletions(-) commit 8fc1e8b230771442133d5cf5fa4313277aa2bb8b Author: Edson Juliano Drosdeck Date: Fri Jul 12 15:06:42 2024 -0300 ALSA: hda/realtek: Enable headset mic on Positivo SU C1400 Positivo SU C1400 is equipped with ALC256, and it needs ALC269_FIXUP_ASPIRE_HEADSET_MIC quirk to make its headset mic work. Signed-off-by: Edson Juliano Drosdeck Cc: Link: https://patch.msgid.link/20240712180642.22564-1-edson.drosdeck@gmail.com Signed-off-by: Takashi Iwai sound/pci/hda/patch_realtek.c | 1 + 1 file changed, 1 insertion(+) commit 62fdd1708fcb3e1c58d21221bf0861a8b1975f90 Merge: ecb1e1dcb7b5 d5b60c6517d2 Author: Jakub Kicinski Date: Sun Jul 14 07:56:32 2024 -0700 Merge tag 'ipsec-next-2024-07-13' of git://git.kernel.org/pub/scm/linux/kernel/git/klassert/ipsec-next Steffen Klassert says: ==================== pull request (net-next): ipsec-next 2024-07-13 1) Support sending NAT keepalives in ESP in UDP states. Userspace IKE daemon had to do this before, but the kernel can better keep track of it. From Eyal Birger. 2) Support IPsec crypto offload for IPv6 ESP and IPv4 UDP-encapsulated ESP data paths. Currently, IPsec crypto offload is enabled for GRO code path only. This patchset support UDP encapsulation for the non GRO path. From Mike Yu. * tag 'ipsec-next-2024-07-13' of git://git.kernel.org/pub/scm/linux/kernel/git/klassert/ipsec-next: xfrm: Support crypto offload for outbound IPv4 UDP-encapsulated ESP packet xfrm: Support crypto offload for inbound IPv4 UDP-encapsulated ESP packet xfrm: Allow UDP encapsulation in crypto offload control path xfrm: Support crypto offload for inbound IPv6 ESP packets not in GRO path xfrm: support sending NAT keepalives in ESP in UDP states ==================== Link: https://patch.msgid.link/20240713102416.3272997-1-steffen.klassert@secunet.com Signed-off-by: Jakub Kicinski commit ecb1e1dcb7b5d68828c13ab3f99e399b4ec0c350 Merge: 861f34e61774 23020f049327 Author: Jakub Kicinski Date: Sun Jul 14 07:46:55 2024 -0700 Merge branch 'introduce-en7581-ethernet-support' Lorenzo Bianconi says: ==================== Introduce EN7581 ethernet support Add airoha_eth driver in order to introduce ethernet support for Airoha EN7581 SoC available on EN7581 development board. EN7581 mac controller is mainly composed by Frame Engine (FE) and QoS-DMA (QDMA) modules. FE is used for traffic offloading (just basic functionalities are supported now) while QDMA is used for DMA operation and QOS functionalities between mac layer and the dsa switch (hw QoS is not available yet and it will be added in the future). Currently only hw lan features are available, hw wan will be added with subsequent patches. ==================== Link: https://patch.msgid.link/cover.1720818878.git.lorenzo@kernel.org Signed-off-by: Jakub Kicinski commit 23020f04932701d5c8363e60756f12b43b8ed752 Author: Lorenzo Bianconi Date: Fri Jul 12 23:27:58 2024 +0200 net: airoha: Introduce ethernet support for EN7581 SoC Add airoha_eth driver in order to introduce ethernet support for Airoha EN7581 SoC available on EN7581 development board (en7581-evb). EN7581 mac controller is mainly composed by the Frame Engine (PSE+PPE) and QoS-DMA (QDMA) modules. FE is used for traffic offloading (just basic functionalities are currently supported) while QDMA is used for DMA operations and QOS functionalities between the mac layer and the external modules conncted to the FE GDM ports (e.g MT7530 DSA switch or external phys). A general overview of airoha_eth architecture is reported below: ┌───────┐ ┌───────┐ │ QDMA2 │ │ QDMA1 │ └───┬───┘ └───┬───┘ │ │ ┌───────▼─────────────────────────────────────────────▼────────┐ │ │ │ P5 P0 │ │ │ │ │ │ │ ┌──────┐ │ P3 ├────► GDM3 │ │ │ └──────┘ │ │ │ │ ┌─────┐ │ │ │ PPE ◄────┤ P4 PSE │ └─────┘ │ │ │ │ │ │ │ │ ┌──────┐ │ P9 ├────► GDM4 │ │ │ └──────┘ │ │ │ │ │ │ │ P2 P1 │ └─────────┬───────────────────────────────────────────┬────────┘ │ │ ┌───▼──┐ ┌──▼───┐ │ GDM2 │ │ GDM1 │ └──────┘ └──┬───┘ │ ┌────▼─────┐ │ MT7530 │ └──────────┘ Currently only hw LAN features (QDMA1+GDM1) are available while hw WAN (QDMA2+GDM{2,3,4}) ones will be added with subsequent patches introducing traffic offloading support. Tested-by: Benjamin Larsson Signed-off-by: Lorenzo Bianconi Link: https://patch.msgid.link/274945d2391c195098ab180a46d0617b18b9e42c.1720818878.git.lorenzo@kernel.org Signed-off-by: Jakub Kicinski MAINTAINERS | 9 + drivers/net/ethernet/mediatek/Kconfig | 10 +- drivers/net/ethernet/mediatek/Makefile | 1 + drivers/net/ethernet/mediatek/airoha_eth.c | 2730 ++++++++++++++++++++++++++++ 4 files changed, 2749 insertions(+), 1 deletion(-) commit 6bc8719c9dbf2d107760a238394dd77bb7df9ab9 Author: Lorenzo Bianconi Date: Fri Jul 12 23:27:57 2024 +0200 dt-bindings: net: airoha: Add EN7581 ethernet controller Introduce device-tree binding documentation for Airoha EN7581 ethernet mac controller. Reviewed-by: Rob Herring (Arm) Signed-off-by: Lorenzo Bianconi Link: https://patch.msgid.link/7dfecf8aa4e6519562a94455b95c49e1b3c858a0.1720818878.git.lorenzo@kernel.org Signed-off-by: Jakub Kicinski .../devicetree/bindings/net/airoha,en7581-eth.yaml | 143 +++++++++++++++++++++ 1 file changed, 143 insertions(+) commit 97d9fba9a812cada5484667a46e14a4c976ca330 Author: Breno Leitao Date: Fri Jul 12 07:34:15 2024 -0700 net: netconsole: Disable target before netpoll cleanup Currently, netconsole cleans up the netpoll structure before disabling the target. This approach can lead to race conditions, as message senders (write_ext_msg() and write_msg()) check if the target is enabled before using netpoll. The sender can validate that the target is enabled, but, the netpoll might be de-allocated already, causing undesired behaviours. This patch reverses the order of operations: 1. Disable the target 2. Clean up the netpoll structure This change eliminates the potential race condition, ensuring that no messages are sent through a partially cleaned-up netpoll structure. Fixes: 2382b15bcc39 ("netconsole: take care of NETDEV_UNREGISTER event") Cc: stable@vger.kernel.org Signed-off-by: Breno Leitao Reviewed-by: Eric Dumazet Link: https://patch.msgid.link/20240712143415.1141039-1-leitao@debian.org Signed-off-by: Jakub Kicinski drivers/net/netconsole.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 861f34e61774ff3c2c0d0a87592518ff6e68d889 Merge: 852e42cc2dd4 e10989e56f52 Author: Jakub Kicinski Date: Sun Jul 14 07:37:29 2024 -0700 Merge branch '100GbE' of git://git.kernel.org/pub/scm/linux/kernel/git/tnguy/next-queue Tony Nguyen says: ==================== ice: Switch API optimizations Marcin Szycik says: Optimize the process of creating a recipe in the switch block by removing duplicate switch ID words and changing how result indexes are fitted into recipes. In many cases this can decrease the number of recipes required to add a certain set of rules, potentially allowing a more varied set of rules to be created. Total rule count will also increase, since less words will be left unused/wasted. There are only 64 rules available in total, so every one counts. After this modification, many fields and some structs became unused or were simplified, resulting in overall simpler implementation. * '100GbE' of git://git.kernel.org/pub/scm/linux/kernel/git/tnguy/next-queue: ice: Add tracepoint for adding and removing switch rules ice: Remove unused members from switch API ice: Optimize switch recipe creation ice: remove unused recipe bookkeeping data ice: Simplify bitmap setting in adding recipe ice: Remove reading all recipes before adding a new one ice: Remove unused struct ice_prot_lkup_ext members ==================== Link: https://patch.msgid.link/20240711181312.2019606-1-anthony.l.nguyen@intel.com Signed-off-by: Jakub Kicinski commit d657f5c76c47eca50dd61b5c1e150dac05e07046 Merge: f67a90a0c8f5 39367183aecf Author: Jakub Kicinski Date: Sun Jul 14 07:34:17 2024 -0700 Merge branch 'vrf-fix-source-address-selection-with-route-leak' Nicolas Dichtel says: ==================== vrf: fix source address selection with route leak For patch 1 and 2, I didn't find the exact commit that introduced this bug, but I suspect it has been here since the first version. I arbitrarily choose one. ==================== Link: https://patch.msgid.link/20240710081521.3809742-1-nicolas.dichtel@6wind.com Signed-off-by: Jakub Kicinski commit 39367183aecfc05f006a29b1f96708a6d1a3d8c3 Author: Nicolas Dichtel Date: Wed Jul 10 10:14:30 2024 +0200 selftests: vrf_route_leaking: add local test The goal is to check that the source address selected by the kernel is routable when a leaking route is used. ICMP, TCP and UDP connections are tested. The symmetric topology is enough for this test. Signed-off-by: Nicolas Dichtel Reviewed-by: David Ahern Link: https://patch.msgid.link/20240710081521.3809742-5-nicolas.dichtel@6wind.com Signed-off-by: Jakub Kicinski tools/testing/selftests/net/vrf_route_leaking.sh | 93 +++++++++++++++++++++++- 1 file changed, 91 insertions(+), 2 deletions(-) commit abb9a68d2c64dd9b128ae1f2e635e4d805e7ce64 Author: Nicolas Dichtel Date: Wed Jul 10 10:14:29 2024 +0200 ipv6: take care of scope when choosing the src addr When the source address is selected, the scope must be checked. For example, if a loopback address is assigned to the vrf device, it must not be chosen for packets sent outside. CC: stable@vger.kernel.org Fixes: afbac6010aec ("net: ipv6: Address selection needs to consider L3 domains") Signed-off-by: Nicolas Dichtel Reviewed-by: David Ahern Link: https://patch.msgid.link/20240710081521.3809742-4-nicolas.dichtel@6wind.com Signed-off-by: Jakub Kicinski net/ipv6/addrconf.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) commit 252442f2ae317d109ef0b4b39ce0608c09563042 Author: Nicolas Dichtel Date: Wed Jul 10 10:14:28 2024 +0200 ipv6: fix source address selection with route leak By default, an address assigned to the output interface is selected when the source address is not specified. This is problematic when a route, configured in a vrf, uses an interface from another vrf (aka route leak). The original vrf does not own the selected source address. Let's add a check against the output interface and call the appropriate function to select the source address. CC: stable@vger.kernel.org Fixes: 0d240e7811c4 ("net: vrf: Implement get_saddr for IPv6") Signed-off-by: Nicolas Dichtel Link: https://patch.msgid.link/20240710081521.3809742-3-nicolas.dichtel@6wind.com Signed-off-by: Jakub Kicinski include/net/ip6_route.h | 20 ++++++++++++++------ net/ipv6/ip6_output.c | 1 + net/ipv6/route.c | 2 +- 3 files changed, 16 insertions(+), 7 deletions(-) commit 6807352353561187a718e87204458999dbcbba1b Author: Nicolas Dichtel Date: Wed Jul 10 10:14:27 2024 +0200 ipv4: fix source address selection with route leak By default, an address assigned to the output interface is selected when the source address is not specified. This is problematic when a route, configured in a vrf, uses an interface from another vrf (aka route leak). The original vrf does not own the selected source address. Let's add a check against the output interface and call the appropriate function to select the source address. CC: stable@vger.kernel.org Fixes: 8cbb512c923d ("net: Add source address lookup op for VRF") Signed-off-by: Nicolas Dichtel Reviewed-by: David Ahern Link: https://patch.msgid.link/20240710081521.3809742-2-nicolas.dichtel@6wind.com Signed-off-by: Jakub Kicinski net/ipv4/fib_semantics.c | 13 +++++++++++-- 1 file changed, 11 insertions(+), 2 deletions(-) commit f67a90a0c8f5b3d0acc18f10650d90fec44775f9 Author: Amit Cohen Date: Thu Jul 11 17:27:02 2024 +0200 selftests: forwarding: devlink_lib: Wait for udev events after reloading Lately, an additional locking was added by commit c0a40097f0bc ("drivers: core: synchronize really_probe() and dev_uevent()"). The locking protects dev_uevent() calling. This function is used to send messages from the kernel to user space. Uevent messages notify user space about changes in device states, such as when a device is added, removed, or changed. These messages are used by udev (or other similar user-space tools) to apply device-specific rules. After reloading devlink instance, udev events should be processed. This locking causes a short delay of udev events handling. One example for useful udev rule is renaming ports. 'forwading.config' can be configured to use names after udev rules are applied. Some tests run devlink_reload() and immediately use the updated names. This worked before the above mentioned commit was pushed, but now the delay of uevent messages causes that devlink_reload() returns before udev events are handled and tests fail. Adjust devlink_reload() to not assume that udev events are already processed when devlink reload is done, instead, wait for udev events to ensure they are processed before returning from the function. Without this patch: TESTS='rif_mac_profile' ./resource_scale.sh TEST: 'rif_mac_profile' 4 [ OK ] sysctl: cannot stat /proc/sys/net/ipv6/conf/swp1/disable_ipv6: No such file or directory sysctl: cannot stat /proc/sys/net/ipv6/conf/swp1/disable_ipv6: No such file or directory sysctl: cannot stat /proc/sys/net/ipv6/conf/swp2/disable_ipv6: No such file or directory sysctl: cannot stat /proc/sys/net/ipv6/conf/swp2/disable_ipv6: No such file or directory Cannot find device "swp1" Cannot find device "swp2" TEST: setup_wait_dev (: Interface swp1 does not come up.) [FAIL] With this patch: $ TESTS='rif_mac_profile' ./resource_scale.sh TEST: 'rif_mac_profile' 4 [ OK ] TEST: 'rif_mac_profile' overflow 5 [ OK ] This is relevant not only for this test. Fixes: bc7cbb1e9f4c ("selftests: forwarding: Add devlink_lib.sh") Signed-off-by: Amit Cohen Reviewed-by: Ido Schimmel Signed-off-by: Petr Machata Link: https://patch.msgid.link/89367666e04b38a8993027f1526801ca327ab96a.1720709333.git.petrm@nvidia.com Signed-off-by: Jakub Kicinski tools/testing/selftests/net/forwarding/devlink_lib.sh | 2 ++ 1 file changed, 2 insertions(+) commit 5f25f553b823d8d047662de8cc186f272bfd7fee Merge: 70c676cb3dfc 4cddb0f15ea9 Author: Jakub Kicinski Date: Sun Jul 14 07:16:21 2024 -0700 Merge branch 'net-pse-pd-fix-possible-issues-with-a-pse-supporting-both-c33-and-podl' Kory Maincent says: ==================== net: pse-pd: Fix possible issues with a PSE supporting both c33 and PoDL Although PSE controllers supporting both c33 and PoDL are not on the market yet, we want to prevent potential issues from arising in the future. Two possible issues could occur with a PSE supporting both c33 and PoDL: - Setting the config for one type of PSE leaves the other type's config null. In this case, the PSE core would return EOPNOTSUPP, which is not the correct behavior. - Null dereference of Netlink attributes as only one of the Netlink attributes would be specified at a time. This patch series contains two patches to fix these issues. ==================== Link: https://patch.msgid.link/20240711-fix_pse_pd_deref-v3-0-edd78fc4fe42@bootlin.com Signed-off-by: Jakub Kicinski commit 4cddb0f15ea9c62f81b4889ea69a99368cc63a86 Author: Kory Maincent Date: Thu Jul 11 15:55:19 2024 +0200 net: ethtool: pse-pd: Fix possible null-deref Fix a possible null dereference when a PSE supports both c33 and PoDL, but only one of the netlink attributes is specified. The c33 or PoDL PSE capabilities are already validated in the ethnl_set_pse_validate() call. Signed-off-by: Kory Maincent Reported-by: Jakub Kicinski Closes: https://lore.kernel.org/netdev/20240705184116.13d8235a@kernel.org/ Fixes: 4d18e3ddf427 ("net: ethtool: pse-pd: Expand pse commands with the PSE PoE interface") Link: https://patch.msgid.link/20240711-fix_pse_pd_deref-v3-2-edd78fc4fe42@bootlin.com Signed-off-by: Jakub Kicinski net/ethtool/pse-pd.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) commit 93c3a96c301f0b1ac0bafb5e74bef58e79937648 Author: Kory Maincent Date: Thu Jul 11 15:55:18 2024 +0200 net: pse-pd: Do not return EOPNOSUPP if config is null For a PSE supporting both c33 and PoDL, setting config for one type of PoE leaves the other type's config null. Currently, this case returns EOPNOTSUPP, which is incorrect. Instead, we should do nothing if the configuration is empty. Signed-off-by: Kory Maincent Fixes: d83e13761d5b ("net: pse-pd: Use regulator framework within PSE framework") Link: https://patch.msgid.link/20240711-fix_pse_pd_deref-v3-1-edd78fc4fe42@bootlin.com Signed-off-by: Jakub Kicinski drivers/net/pse-pd/pse_core.c | 4 ++-- net/ethtool/pse-pd.c | 4 +++- 2 files changed, 5 insertions(+), 3 deletions(-) commit 70c676cb3dfcc75e32eaf0e98eba6814ebfc6af6 Merge: 528dd46d0fc3 89a2aefe4b08 Author: Jakub Kicinski Date: Sun Jul 14 07:10:49 2024 -0700 Merge tag 'ipsec-2024-07-11' of git://git.kernel.org/pub/scm/linux/kernel/git/klassert/ipsec Steffen Klassert says: ==================== pull request (net): ipsec 2024-07-11 1) Fix esp_output_tail_tcp() on unsupported ESPINTCP. From Hagar Hemdan. 2) Fix two bugs in the recently introduced SA direction separation. From Antony Antony. 3) Fix unregister netdevice hang on hardware offload. We had to add another list where skbs linked to that are unlinked from the lists (deleted) but not yet freed. 4) Fix netdev reference count imbalance in xfrm_state_find. From Jianbo Liu. 5) Call xfrm_dev_policy_delete when killingi them on offloaded policies. Jianbo Liu. * tag 'ipsec-2024-07-11' of git://git.kernel.org/pub/scm/linux/kernel/git/klassert/ipsec: xfrm: call xfrm_dev_policy_delete when kill policy xfrm: fix netdev reference count imbalance xfrm: Export symbol xfrm_dev_state_delete. xfrm: Fix unregister netdevice hang on hardware offload. xfrm: Log input direction mismatch error in one place xfrm: Fix input error path memory access net: esp: cleanup esp_output_tail_tcp() in case of unsupported ESPINTCP ==================== Link: https://patch.msgid.link/20240711100025.1949454-1-steffen.klassert@secunet.com Signed-off-by: Jakub Kicinski commit 6887a9ace00413c9538261b13e07b22cc13cf099 Author: Oscar Salvador Date: Sat May 18 13:58:08 2024 +0200 sh: config: Drop CONFIG_MEMORY_{HOTPLUG,HOTREMOVE} Signed-off-by: Oscar Salvador Reviewed-by: John Paul Adrian Glaubitz Link: https://lore.kernel.org/r/20240518115808.8888-3-osalvador@suse.de Signed-off-by: John Paul Adrian Glaubitz arch/sh/configs/apsh4ad0a_defconfig | 2 -- arch/sh/configs/sdk7786_defconfig | 2 -- arch/sh/configs/shx3_defconfig | 2 -- 3 files changed, 6 deletions(-) commit a71ac6c956ee8aac289c7c9dd12dfe1ee3447006 Author: Oscar Salvador Date: Sat May 18 13:58:07 2024 +0200 sh: Drop support for memory hotplug and memory hotremove Support for memory hotplug was restricted to 64-bit platforms in 7ec58a2b941e ("mm/memory_hotplug: restrict CONFIG_MEMORY_HOTPLUG to 64 bit") while sh is a pure 32-bit platform since the removal of sh5 support. Thus, drop support for memory hotplug and the associated memory hotremove on this platform. Signed-off-by: Oscar Salvador Reviewed-by: John Paul Adrian Glaubitz Link: https://lore.kernel.org/r/20240518115808.8888-2-osalvador@suse.de Signed-off-by: John Paul Adrian Glaubitz arch/sh/Kconfig | 2 -- arch/sh/mm/Kconfig | 4 ---- arch/sh/mm/init.c | 28 ---------------------------- 3 files changed, 34 deletions(-) commit 3c80ebb70e7beea39924939e3f1c6e7433b3b81f Merge: 3c1743a685b1 36a5c03f2327 Author: Jens Axboe Date: Sun Jul 14 01:50:42 2024 -0600 Merge tag 'md-6.11-20240712' of git://git.kernel.org/pub/scm/linux/kernel/git/song/md into for-6.11/block Pull MD fixes from Song: "Changes in this set are: 1. md-cluster fixes by Heming Zhao; 2. raid1 fix by Mateusz Jończyk." * tag 'md-6.11-20240712' of git://git.kernel.org/pub/scm/linux/kernel/git/song/md: md/raid1: set max_sectors during early return from choose_slow_rdev() md-cluster: fix no recovery job when adding/re-adding a disk md-cluster: fix hanging issue while a new disk adding commit 1df03a4b44146c4f720d793915747272c7773a3e Author: Konstantin Taranov Date: Thu Jul 11 06:37:57 2024 -0700 RDMA/mana_ib: Set correct device into ib Add mana_get_primary_netdev_rcu helper to get a primary netdevice for a given port. When mana is used with netvsc, the VF netdev is controlled by an upper netvsc device. In a baremetal case, the VF netdev is the primary device. Use the mana_get_primary_netdev_rcu() helper in the mana_ib to get the correct device for querying network states. Fixes: 8b184e4f1c32 ("RDMA/mana_ib: Enable RoCE on port 1") Signed-off-by: Konstantin Taranov Link: https://lore.kernel.org/r/1720705077-322-1-git-send-email-kotaranov@linux.microsoft.com Reviewed-by: Long Li Reviewed-by: Zhu Yanjun Signed-off-by: Leon Romanovsky drivers/infiniband/hw/mana/device.c | 16 ++++++++-------- drivers/net/ethernet/microsoft/mana/mana_en.c | 19 +++++++++++++++++++ include/net/mana/mana.h | 2 ++ 3 files changed, 29 insertions(+), 8 deletions(-) commit 95b087f87b780daafad1dbb2c84e81b729d5d33f Author: Jack Wang Date: Wed Jul 10 14:21:02 2024 +0200 bnxt_re: Fix imm_data endianness When map a device between servers with MLX and BCM RoCE nics, RTRS server complain about unknown imm type, and can't map the device, After more debug, it seems bnxt_re wrongly handle the imm_data, this patch fixed the compat issue with MLX for us. In off list discussion, Selvin confirmed HW is working in little endian format and all data needs to be converted to LE while providing. This patch fix the endianness for imm_data Fixes: 1ac5a4047975 ("RDMA/bnxt_re: Add bnxt_re RoCE driver") Signed-off-by: Jack Wang Link: https://lore.kernel.org/r/20240710122102.37569-1-jinpu.wang@ionos.com Acked-by: Selvin Xavier Signed-off-by: Leon Romanovsky drivers/infiniband/hw/bnxt_re/ib_verbs.c | 8 ++++---- drivers/infiniband/hw/bnxt_re/qplib_fp.h | 6 +++--- 2 files changed, 7 insertions(+), 7 deletions(-) commit 2043a14fb3de9d88440b21590f714306fcbbd55f Author: David Ahern Date: Wed Jul 10 13:33:10 2024 -0700 RDMA: Fix netdev tracker in ib_device_set_netdev If a netdev has already been assigned, ib_device_set_netdev needs to release the reference on the older netdev but it is mistakenly being called for the new netdev. Fix it and in the process use netdev_put to be symmetrical with the netdev_hold. Fixes: 09f530f0c6d6 ("RDMA: Add netdevice_tracker to ib_device_set_netdev()") Signed-off-by: David Ahern Link: https://lore.kernel.org/r/20240710203310.19317-1-dsahern@kernel.org Signed-off-by: Leon Romanovsky drivers/infiniband/core/device.c | 8 ++------ 1 file changed, 2 insertions(+), 6 deletions(-) commit 872bb37f6829d4f7f3ed5afe2786add3d4384b4b Author: Kees Cook Date: Tue Jul 2 14:16:16 2024 -0700 randomize_kstack: Improve stack alignment codegen The codgen for adding architecture-specific stack alignment to the effective alloca() usage is somewhat inefficient and allows a bit to get carried beyond the desired entropy range. This isn't really a problem, but it's unexpected and the codegen is kind of bad. Quoting Mark[1], the disassembly for arm64's invoke_syscall() looks like: // offset = raw_cpu_read(kstack_offset) mov x4, sp adrp x0, kstack_offset mrs x5, tpidr_el1 add x0, x0, #:lo12:kstack_offset ldr w0, [x0, x5] // offset = KSTACK_OFFSET_MAX(offset) and x0, x0, #0x3ff // alloca(offset) add x0, x0, #0xf and x0, x0, #0x7f0 sub sp, x4, x0 ... which in C would be: offset = raw_cpu_read(kstack_offset) offset &= 0x3ff; // [0x0, 0x3ff] offset += 0xf; // [0xf, 0x40e] offset &= 0x7f0; // [0x0, ... so when *all* bits [3:0] are 0, they'll have no impact, and when *any* of bits [3:0] are 1 they'll trigger a carry into bit 4, which could ripple all the way up and spill into bit 10. Switch the masking in KSTACK_OFFSET_MAX() to explicitly clear the bottom bits to avoid the rounding by using 0b1111110000 instead of 0b1111111111: // offset = raw_cpu_read(kstack_offset) mov x4, sp adrp x0, 0 mrs x5, tpidr_el1 add x0, x0, #:lo12:kstack_offset ldr w0, [x0, x5] // offset = KSTACK_OFFSET_MAX(offset) and x0, x0, #0x3f0 // alloca(offset) sub sp, x4, x0 Suggested-by: Mark Rutland Link: https://lore.kernel.org/lkml/ZnVfOnIuFl2kNWkT@J2N7QTR9R3/ [1] Link: https://lore.kernel.org/r/20240702211612.work.576-kees@kernel.org Signed-off-by: Kees Cook include/linux/randomize_kstack.h | 18 ++++++++++++------ 1 file changed, 12 insertions(+), 6 deletions(-) commit 21f93108306026b8066db31c24a097192c8c36c7 Author: Kees Cook Date: Fri Jun 21 13:50:44 2024 -0700 exec: Avoid pathological argc, envc, and bprm->p values Make sure nothing goes wrong with the string counters or the bprm's belief about the stack pointer. Add checks and matching self-tests. Take special care for !CONFIG_MMU, since argmin is not exposed there. For 32-bit validation, 32-bit UML was used: $ tools/testing/kunit/kunit.py run \ --make_options CROSS_COMPILE=i686-linux-gnu- \ --make_options SUBARCH=i386 \ exec For !MMU validation, m68k was used: $ tools/testing/kunit/kunit.py run \ --arch m68k --make_option CROSS_COMPILE=m68k-linux-gnu- \ exec Link: https://lore.kernel.org/r/20240520021615.741800-2-keescook@chromium.org Link: https://lore.kernel.org/r/20240621205046.4001362-2-kees@kernel.org Signed-off-by: Kees Cook fs/exec.c | 10 +++++++++- fs/exec_test.c | 28 +++++++++++++++++++++++++++- 2 files changed, 36 insertions(+), 2 deletions(-) commit 084ebf7ca83e6cb743784f2eecc654193ce064fb Author: Kees Cook Date: Fri Jun 21 13:50:43 2024 -0700 execve: Keep bprm->argmin behind CONFIG_MMU When argmin was added in commit 655c16a8ce9c ("exec: separate MM_ANONPAGES and RLIMIT_STACK accounting"), it was intended only for validating stack limits on CONFIG_MMU[1]. All checking for reaching the limit (argmin) is wrapped in CONFIG_MMU ifdef checks, though setting argmin was not. That argmin is only supposed to be used under CONFIG_MMU was rediscovered recently[2], and I don't want to trip over this again. Move argmin's declaration into the existing CONFIG_MMU area, and add helpers functions so the MMU tests can be consolidated. Link: https://lore.kernel.org/all/20181126122307.GA1660@redhat.com [1] Link: https://lore.kernel.org/all/202406211253.7037F69@keescook/ [2] Link: https://lore.kernel.org/r/20240621205046.4001362-1-kees@kernel.org Signed-off-by: Kees Cook fs/exec.c | 26 ++++++++++++++++++++------ fs/exec_test.c | 2 ++ include/linux/binfmts.h | 2 +- 3 files changed, 23 insertions(+), 7 deletions(-) commit bb032b2352c33be374136889789103d724f1b613 Merge: bc2e3253ca96 88a0a4f6068c Author: Oliver Upton Date: Sun Jul 14 00:28:57 2024 +0000 Merge branch kvm-arm64/docs into kvmarm/next * kvm-arm64/docs: : KVM Documentation fixes, courtesy of Changyuan Lyu : : Small set of typo fixes / corrections to the KVM API documentation : relating to MSIs and arm64 VGIC UAPI. MAINTAINERS: Include documentation in KVM/arm64 entry KVM: Documentation: Correct the VGIC V2 CPU interface addr space size KVM: Documentation: Enumerate allowed value macros of `irq_type` KVM: Documentation: Fix typo `BFD` Signed-off-by: Oliver Upton commit bc2e3253ca965fc6a2df1ba242cf10a4ef9462f1 Merge: 8c2899e7706e 91e9cc70b775 Author: Oliver Upton Date: Sun Jul 14 00:28:30 2024 +0000 Merge branch kvm-arm64/nv-tcr2 into kvmarm/next * kvm-arm64/nv-tcr2: : Fixes to the handling of TCR_EL1, courtesy of Marc Zyngier : : Series addresses a couple gaps that are present in KVM (from cover : letter): : : - VM configuration: HCRX_EL2.TCR2En is forced to 1, and we blindly : save/restore stuff. : : - trap bit description and routing: none, obviously, since we make a : point in not trapping. KVM: arm64: Honor trap routing for TCR2_EL1 KVM: arm64: Make PIR{,E0}_EL1 save/restore conditional on FEAT_TCRX KVM: arm64: Make TCR2_EL1 save/restore dependent on the VM features KVM: arm64: Get rid of HCRX_GUEST_FLAGS KVM: arm64: Correctly honor the presence of FEAT_TCRX Signed-off-by: Oliver Upton commit 8c2899e7706edee1486bd8f4b77d3c71f44807c6 Merge: 1270dad31097 f1ee914fb626 Author: Oliver Upton Date: Sun Jul 14 00:27:01 2024 +0000 Merge branch kvm-arm64/nv-sve into kvmarm/next * kvm-arm64/nv-sve: : CPTR_EL2, FPSIMD/SVE support for nested : : This series brings support for honoring the guest hypervisor's CPTR_EL2 : trap configuration when running a nested guest, along with support for : FPSIMD/SVE usage at L1 and L2. KVM: arm64: Allow the use of SVE+NV KVM: arm64: nv: Add additional trap setup for CPTR_EL2 KVM: arm64: nv: Add trap description for CPTR_EL2 KVM: arm64: nv: Add TCPAC/TTA to CPTR->CPACR conversion helper KVM: arm64: nv: Honor guest hypervisor's FP/SVE traps in CPTR_EL2 KVM: arm64: nv: Load guest FP state for ZCR_EL2 trap KVM: arm64: nv: Handle CPACR_EL1 traps KVM: arm64: Spin off helper for programming CPTR traps KVM: arm64: nv: Ensure correct VL is loaded before saving SVE state KVM: arm64: nv: Use guest hypervisor's max VL when running nested guest KVM: arm64: nv: Save guest's ZCR_EL2 when in hyp context KVM: arm64: nv: Load guest hyp's ZCR into EL1 state KVM: arm64: nv: Handle ZCR_EL2 traps KVM: arm64: nv: Forward SVE traps to guest hypervisor KVM: arm64: nv: Forward FP/ASIMD traps to guest hypervisor Signed-off-by: Oliver Upton commit 1270dad3109770fc12c1f09f7bab4bceaf2fb829 Merge: 377d0e5d7795 eca4ba5b6dff Author: Oliver Upton Date: Sun Jul 14 00:23:32 2024 +0000 Merge branch kvm-arm64/el2-kcfi into kvmarm/next * kvm-arm64/el2-kcfi: : kCFI support in the EL2 hypervisor, courtesy of Pierre-Clément Tosi : : Enable the usage fo CONFIG_CFI_CLANG (kCFI) for hardening indirect : branches in the EL2 hypervisor. Unlike kernel support for the feature, : CFI failures at EL2 are always fatal. KVM: arm64: nVHE: Support CONFIG_CFI_CLANG at EL2 KVM: arm64: Introduce print_nvhe_hyp_panic helper arm64: Introduce esr_brk_comment, esr_is_cfi_brk KVM: arm64: VHE: Mark __hyp_call_panic __noreturn KVM: arm64: nVHE: gen-hyprel: Skip R_AARCH64_ABS32 KVM: arm64: nVHE: Simplify invalid_host_el2_vect KVM: arm64: Fix __pkvm_init_switch_pgd call ABI KVM: arm64: Fix clobbered ELR in sync abort/SError Signed-off-by: Oliver Upton commit 377d0e5d7795381a4b676d7030266b4836cec53a Merge: 435a9f60eda4 b0539664cbc3 Author: Oliver Upton Date: Sun Jul 14 00:15:00 2024 +0000 Merge branch kvm-arm64/ctr-el0 into kvmarm/next * kvm-arm64/ctr-el0: : Support for user changes to CTR_EL0, courtesy of Sebastian Ott : : Allow userspace to change the guest-visible value of CTR_EL0 for a VM, : so long as the requested value represents a subset of features supported : by hardware. In other words, prevent the VMM from over-promising the : capabilities of hardware. : : Make this happen by fitting CTR_EL0 into the existing infrastructure for : feature ID registers. KVM: selftests: Assert that MPIDR_EL1 is unchanged across vCPU reset KVM: arm64: nv: Unfudge ID_AA64PFR0_EL1 masking KVM: selftests: arm64: Test writes to CTR_EL0 KVM: arm64: rename functions for invariant sys regs KVM: arm64: show writable masks for feature registers KVM: arm64: Treat CTR_EL0 as a VM feature ID register KVM: arm64: unify code to prepare traps KVM: arm64: nv: Use accessors for modifying ID registers KVM: arm64: Add helper for writing ID regs KVM: arm64: Use read-only helper for reading VM ID registers KVM: arm64: Make idregs debugfs iterator search sysreg table directly KVM: arm64: Get sys_reg encoding from descriptor in idregs_debug_show() Signed-off-by: Oliver Upton commit 435a9f60eda4437cb779db940d8f407640e525c7 Merge: a35d5b2032ce 3cfde36df7ab Author: Oliver Upton Date: Sun Jul 14 00:11:45 2024 +0000 Merge branch kvm-arm64/shadow-mmu into kvmarm/next * kvm-arm64/shadow-mmu: : Shadow stage-2 MMU support for NV, courtesy of Marc Zyngier : : Initial implementation of shadow stage-2 page tables to support a guest : hypervisor. In the author's words: : : So here's the 10000m (approximately 30000ft for those of you stuck : with the wrong units) view of what this is doing: : : - for each {VMID,VTTBR,VTCR} tuple the guest uses, we use a : separate shadow s2_mmu context. This context has its own "real" : VMID and a set of page tables that are the combination of the : guest's S2 and the host S2, built dynamically one fault at a time. : : - these shadow S2 contexts are ephemeral, and behave exactly as : TLBs. For all intent and purposes, they *are* TLBs, and we discard : them pretty often. : : - TLB invalidation takes three possible paths: : : * either this is an EL2 S1 invalidation, and we directly emulate : it as early as possible : : * or this is an EL1 S1 invalidation, and we need to apply it to : the shadow S2s (plural!) that match the VMID set by the L1 guest : : * or finally, this is affecting S2, and we need to teardown the : corresponding part of the shadow S2s, which invalidates the TLBs KVM: arm64: nv: Truely enable nXS TLBI operations KVM: arm64: nv: Add handling of NXS-flavoured TLBI operations KVM: arm64: nv: Add handling of range-based TLBI operations KVM: arm64: nv: Add handling of outer-shareable TLBI operations KVM: arm64: nv: Invalidate TLBs based on shadow S2 TTL-like information KVM: arm64: nv: Tag shadow S2 entries with guest's leaf S2 level KVM: arm64: nv: Handle FEAT_TTL hinted TLB operations KVM: arm64: nv: Handle TLBI IPAS2E1{,IS} operations KVM: arm64: nv: Handle TLBI ALLE1{,IS} operations KVM: arm64: nv: Handle TLBI VMALLS12E1{,IS} operations KVM: arm64: nv: Handle TLB invalidation targeting L2 stage-1 KVM: arm64: nv: Handle EL2 Stage-1 TLB invalidation KVM: arm64: nv: Add Stage-1 EL2 invalidation primitives KVM: arm64: nv: Unmap/flush shadow stage 2 page tables KVM: arm64: nv: Handle shadow stage 2 page faults KVM: arm64: nv: Implement nested Stage-2 page table walk logic KVM: arm64: nv: Support multiple nested Stage-2 mmu structures Signed-off-by: Oliver Upton commit a35d5b2032cec947212a30291f2091d0ed5f724c Merge: bd2e95136ba4 42fb33dde42b Author: Oliver Upton Date: Sun Jul 14 00:11:34 2024 +0000 Merge branch kvm-arm64/ffa-1p1 into kvmarm/next * kvm-arm64/ffa-1p1: : Improvements to the pKVM FF-A Proxy, courtesy of Sebastian Ene : : Various minor improvements to how host FF-A calls are proxied with the : TEE, along with support for v1.1 of the protocol. KVM: arm64: Use FF-A 1.1 with pKVM KVM: arm64: Update the identification range for the FF-A smcs KVM: arm64: Add support for FFA_PARTITION_INFO_GET KVM: arm64: Trap FFA_VERSION host call in pKVM Signed-off-by: Oliver Upton commit bd2e95136ba4d69e15279583d158f8403df5950f Merge: 83a7eefedc9b cb52b5c8b81b Author: Oliver Upton Date: Sun Jul 14 00:11:26 2024 +0000 Merge branch kvm-arm64/misc into kvmarm/next * kvm-arm64/misc: : Miscellaneous updates : : - Provide a command-line parameter to statically control the WFx trap : selection in KVM : : - Make sysreg masks allocation accounted Revert "KVM: arm64: nv: Fix RESx behaviour of disabled FGTs with negative polarity" KVM: arm64: nv: Use GFP_KERNEL_ACCOUNT for sysreg_masks allocation KVM: arm64: nv: Fix RESx behaviour of disabled FGTs with negative polarity KVM: arm64: Add early_param to control WFx trapping Signed-off-by: Oliver Upton commit 852e42cc2dd4783744b0ea4fd0d9ab80a06eb21d Merge: ba88b47816a2 1712c9ee36d1 Author: Jakub Kicinski Date: Sat Jul 13 16:04:52 2024 -0700 Merge branch '40GbE' of git://git.kernel.org/pub/scm/linux/kernel/git/tnguy/next-queue Tony Nguyen says: ==================== Intel Wired LAN Driver Updates 2024-07-11 (net/intel) This series contains updates to most Intel network drivers. Tony removes MODULE_AUTHOR from drivers containing the entry. Simon Horman corrects a kdoc entry for i40e. Pawel adds implementation for devlink param "local_forwarding" on ice. Michal removes unneeded call, and code, for eswitch rebuild for ice. Sasha removed a no longer used field from igc. * '40GbE' of git://git.kernel.org/pub/scm/linux/kernel/git/tnguy/next-queue: igc: Remove the internal 'eee_advert' field ice: remove eswitch rebuild ice: Add support for devlink local_forwarding param i40e: correct i40e_addr_to_hkey() name in kdoc net: intel: Remove MODULE_AUTHORs ==================== Link: https://patch.msgid.link/20240711201932.2019925-1-anthony.l.nguyen@intel.com Signed-off-by: Jakub Kicinski commit ba88b47816a2089cd270a38fc002bc7df13f8ebe Author: Easwar Hariharan Date: Thu Jul 11 05:27:32 2024 +0000 sfc: falcon: Make I2C terminology more inclusive I2C v7, SMBus 3.2, and I3C 1.1.1 specifications have replaced "master/slave" with more appropriate terms. Inspired by Wolfram's series to fix drivers/i2c/, fix the terminology for users of I2C_ALGOBIT bitbanging interface, now that the approved verbiage exists in the specification. Reviewed-by: Martin Habets Reviewed-by: Simon Horman Signed-off-by: Easwar Hariharan Link: https://patch.msgid.link/20240711052734.1273652-5-eahariha@linux.microsoft.com Signed-off-by: Jakub Kicinski drivers/net/ethernet/sfc/falcon/falcon.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 0cda1acfa235f2ee75597e7b378de54a91d69e99 Author: Oleksij Rempel Date: Fri Jul 12 17:28:48 2024 +0200 net: phy: dp83td510: add cable testing support This patch implements the TDR test procedure as described in "Application Note DP83TD510E Cable Diagnostics Toolkit revC", section 3.2. The procedure was tested with "draka 08 signalkabel 2x0.8mm". The reported cable length was 5 meters more for each 20 meters of actual cable length. For instance, a 20-meter cable showed as 25 meters, and a 40-meter cable showed as 50 meters. Since other parts of the diagnostics provided by this PHY (e.g., Active Link Cable Diagnostics) require accurate cable characterization to provide proper results, this tuning can be implemented in a separate patch/interface. Signed-off-by: Oleksij Rempel changes v2: - add comments - change post silence time to 1000ms Reviewed-by: Andrew Lunn Link: https://patch.msgid.link/20240712152848.2479912-1-o.rempel@pengutronix.de Signed-off-by: Jakub Kicinski drivers/net/phy/dp83td510.c | 264 ++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 264 insertions(+) commit e7cdef626f1d7ca69eb3351a8c4ae6a8ec46feed Author: Breno Leitao Date: Fri Jul 12 06:48:16 2024 -0700 net: dpaa: Fix compilation Warning Remove variables that are defined and incremented but never read. This issue appeared in network tests[1] as: drivers/net/ethernet/freescale/dpaa/dpaa_eth_sysfs.c:38:6: warning: variable 'i' set but not used [-Wunused-but-set-variable] 38 | int i = 0; | ^ Link: https://netdev.bots.linux.dev/static/nipa/870263/13729811/build_clang/stderr [1] Signed-off-by: Breno Leitao Reviewed-by: Vladimir Oltean Link: https://patch.msgid.link/20240712134817.913756-1-leitao@debian.org Signed-off-by: Jakub Kicinski drivers/net/ethernet/freescale/dpaa/dpaa_eth_sysfs.c | 2 -- 1 file changed, 2 deletions(-) commit 3771266bf8418904794175fdc83aaf4732114cba Author: Jakub Kicinski Date: Thu Jul 11 15:37:22 2024 -0700 eth: mlx5: expose NETIF_F_NTUPLE when ARFS is compiled out ARFS depends on NTUPLE filters, but the inverse is not true. Drivers which don't support ARFS commonly still support NTUPLE filtering. mlx5 has a Kconfig option to disable ARFS (MLX5_EN_ARFS) and does not advertise NTUPLE filters as a feature at all when ARFS is compiled out. That's not correct, ntuple filters indeed still work just fine (as long as MLX5_EN_RXNFC is enabled). This is needed to make the RSS test not skip all RSS context related testing. Acked-by: Saeed Mahameed Link: https://patch.msgid.link/20240711223722.297676-1-kuba@kernel.org Signed-off-by: Jakub Kicinski drivers/net/ethernet/mellanox/mlx5/core/en/fs.h | 13 +++++++++++++ drivers/net/ethernet/mellanox/mlx5/core/en_ethtool.c | 2 +- drivers/net/ethernet/mellanox/mlx5/core/en_fs.c | 5 ++--- drivers/net/ethernet/mellanox/mlx5/core/en_main.c | 8 +++++--- drivers/net/ethernet/mellanox/mlx5/core/ipoib/ipoib.c | 8 +++----- 5 files changed, 24 insertions(+), 12 deletions(-) commit 464b99e77b3d024a319db0dabe917d04824039db Author: Matthieu Baerts (NGI0) Date: Fri Jul 12 12:00:15 2024 +0200 selftests: mptcp: lib: fix shellcheck errors It looks like we missed these two errors recently: - SC2068: Double quote array expansions to avoid re-splitting elements. - SC2145: Argument mixes string and array. Use * or separate argument. Two simple fixes, it is not supposed to change the behaviour as the variable names should not have any spaces in their names. Still, better to fix them to easily spot new issues. Fixes: f265d3119a29 ("selftests: mptcp: lib: use setup/cleanup_ns helpers") Signed-off-by: Matthieu Baerts (NGI0) Reviewed-by: Simon Horman Link: https://patch.msgid.link/20240712-upstream-net-next-20240712-selftests-mptcp-fix-shellcheck-v1-1-1cb7180db40a@kernel.org Signed-off-by: Jakub Kicinski tools/testing/selftests/net/mptcp/mptcp_lib.sh | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) commit 22767eecd62f7bb5c83541c291297cf24326a997 Merge: f7023b3d697c 4b66be76a6fb Author: Jakub Kicinski Date: Sat Jul 13 15:44:18 2024 -0700 Merge branch 'mlx5-misc-2023-07-08-sf-max-eq' Saeed Mahameed says: ==================== mlx5 misc 2023-07-08 (sf max eq) Link: https://patchwork.kernel.org/project/netdevbpf/patch/20240708080025.1593555-2-tariqt@nvidia.com/ ==================== Link: https://patch.msgid.link/20240712003310.355106-1-saeed@kernel.org Signed-off-by: Jakub Kicinski commit 4b66be76a6fbe16918a01439bb9023da154d7694 Author: Daniel Jurgens Date: Thu Jul 11 17:33:10 2024 -0700 net/mlx5: Use set number of max EQs If a maximum number of EQs has been set for an SF, use that amount. Signed-off-by: Daniel Jurgens Reviewed-by: William Tu Signed-off-by: Tariq Toukan Signed-off-by: Saeed Mahameed Link: https://patch.msgid.link/20240712003310.355106-5-saeed@kernel.org Signed-off-by: Jakub Kicinski drivers/net/ethernet/mellanox/mlx5/core/eq.c | 7 +++++-- drivers/net/ethernet/mellanox/mlx5/core/pci_irq.c | 12 ++++-------- 2 files changed, 9 insertions(+), 10 deletions(-) commit 20d80b95a7e4adbd1963c152cf79a58a93b4f577 Author: Daniel Jurgens Date: Thu Jul 11 17:33:09 2024 -0700 net/mlx5: Set default max eqs for SFs If the user hasn't configured max_io_eqs set a low default. The SF driver shouldn't try to create more than this, but FW will enforce this limit. Signed-off-by: Daniel Jurgens Reviewed-by: William Tu Signed-off-by: Tariq Toukan Signed-off-by: Saeed Mahameed Link: https://patch.msgid.link/20240712003310.355106-4-saeed@kernel.org Signed-off-by: Jakub Kicinski drivers/net/ethernet/mellanox/mlx5/core/eswitch.h | 3 +++ drivers/net/ethernet/mellanox/mlx5/core/eswitch_offloads.c | 12 +++++++++++- drivers/net/ethernet/mellanox/mlx5/core/sf/devlink.c | 12 ++++++++++++ 3 files changed, 26 insertions(+), 1 deletion(-) commit 2ece6c72ea040b2bec823b11f8e5bad0d92d8af2 Author: Daniel Jurgens Date: Thu Jul 11 17:33:08 2024 -0700 net/mlx5: Set sf_eq_usage for SF max EQs When setting max_io_eqs for an SF function also set the sf_eq_usage_cap. This is to indicate to the SF driver from the PF that the user has set the max io eqs via devlink. So the SF driver can later query the proper max eq value from the new cap. Signed-off-by: Daniel Jurgens Reviewed-by: William Tu Signed-off-by: Tariq Toukan Signed-off-by: Saeed Mahameed Link: https://patch.msgid.link/20240712003310.355106-3-saeed@kernel.org Signed-off-by: Jakub Kicinski drivers/net/ethernet/mellanox/mlx5/core/eswitch_offloads.c | 3 +++ 1 file changed, 3 insertions(+) commit 63c6e08eac8e7e2ad2e883c968e58e23e1dc8c70 Author: Daniel Jurgens Date: Thu Jul 11 17:33:07 2024 -0700 net/mlx5: IFC updates for SF max IO EQs Expose a new cap sf_eq_usage. The vhca_resource_manager can write this cap, indicating the SF driver should use max_num_eqs_24b to determine how many EQs to use. Will be used in the next patch, to indicate to the SF driver from the PF that the user has set the max io eqs via devlink. So the SF driver can later query the proper max eq value from the new cap. devlink port function set pci/0000:08:00.0/32768 max_io_eqs 32 Signed-off-by: Daniel Jurgens Reviewed-by: William Tu Signed-off-by: Tariq Toukan Signed-off-by: Saeed Mahameed Link: https://patch.msgid.link/20240712003310.355106-2-saeed@kernel.org Signed-off-by: Jakub Kicinski include/linux/mlx5/mlx5_ifc.h | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) commit f7023b3d697c6a7dfe2d9c70e0d8c2c580ccbd76 Author: Thorsten Blum Date: Thu Jul 11 17:47:43 2024 +0200 net: mvpp2: Improve data types and use min() Change the data type of the variable freq in mvpp2_rx_time_coal_set() and mvpp2_tx_time_coal_set() to u32 because port->priv->tclk also has the data type u32. Change the data type of the function parameter clk_hz in mvpp2_usec_to_cycles() and mvpp2_cycles_to_usec() to u32 accordingly and remove the following Coccinelle/coccicheck warning reported by do_div.cocci: WARNING: do_div() does a 64-by-32 division, please consider using div64_ul instead Use min() to simplify the code and improve its readability. Compile-tested only. Signed-off-by: Thorsten Blum Reviewed-by: Simon Horman Link: https://patch.msgid.link/20240711154741.174745-1-thorsten.blum@toblux.com Signed-off-by: Jakub Kicinski drivers/net/ethernet/marvell/mvpp2/mvpp2_main.c | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-) commit 275a63c9fe10f39066782d2d775d7d3efb20b01f Author: Danielle Ratson Date: Thu Jul 11 11:09:34 2024 +0300 net: ethtool: Monotonically increase the message sequence number Currently, during the module firmware flashing process, unicast notifications are sent from the kernel using the same sequence number, making it impossible for user space to track missed notifications. Monotonically increase the message sequence number, so the order of notifications could be tracked effectively. Signed-off-by: Danielle Ratson Reviewed-by: Ido Schimmel Reviewed-by: Jakub Kicinski Link: https://patch.msgid.link/20240711080934.2071869-1-danieller@nvidia.com Signed-off-by: Jakub Kicinski net/ethtool/module.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 646d2ac752db921bb97349fa1037a5b862cf87c4 Merge: 42ffe242860c b3bb4d23a41b Author: Jakub Kicinski Date: Sat Jul 13 15:19:53 2024 -0700 Merge branch 'tcp-make-simultaneous-connect-rfc-compliant' Kuniyuki Iwashima says: ==================== tcp: Make simultaneous connect() RFC-compliant. Patch 1 fixes an issue that BPF TCP option parser is triggered for ACK instead of SYN+ACK in the case of simultaneous connect(). Patch 2 removes an wrong assumption in tcp_ao/self-connnect tests. v2: https://lore.kernel.org/netdev/20240708180852.92919-1-kuniyu@amazon.com/ v1: https://lore.kernel.org/netdev/20240704035703.95065-1-kuniyu@amazon.com/ ==================== Link: https://patch.msgid.link/20240710171246.87533-1-kuniyu@amazon.com Signed-off-by: Jakub Kicinski commit b3bb4d23a41b825c78ff4436c9dc8650b1ea5704 Author: Kuniyuki Iwashima Date: Wed Jul 10 10:12:46 2024 -0700 selftests: tcp: Remove broken SNMP assumptions for TCP AO self-connect tests. tcp_ao/self-connect.c checked the following SNMP stats before/after connect() to confirm that the test exercises the simultaneous connect() path. * TCPChallengeACK * TCPSYNChallenge But the stats should not be counted for self-connect in the first place, and the assumption is no longer true. Let's remove the check. Signed-off-by: Kuniyuki Iwashima Reviewed-by: Eric Dumazet Reviewed-by: Dmitry Safonov Link: https://patch.msgid.link/20240710171246.87533-3-kuniyu@amazon.com Signed-off-by: Jakub Kicinski tools/testing/selftests/net/tcp_ao/self-connect.c | 18 ------------------ 1 file changed, 18 deletions(-) commit 23e89e8ee7be73e21200947885a6d3a109a2c58d Author: Kuniyuki Iwashima Date: Wed Jul 10 10:12:45 2024 -0700 tcp: Don't drop SYN+ACK for simultaneous connect(). RFC 9293 states that in the case of simultaneous connect(), the connection gets established when SYN+ACK is received. [0] TCP Peer A TCP Peer B 1. CLOSED CLOSED 2. SYN-SENT --> ... 3. SYN-RECEIVED <-- <-- SYN-SENT 4. ... --> SYN-RECEIVED 5. SYN-RECEIVED --> ... 6. ESTABLISHED <-- <-- SYN-RECEIVED 7. ... --> ESTABLISHED However, since commit 0c24604b68fc ("tcp: implement RFC 5961 4.2"), such a SYN+ACK is dropped in tcp_validate_incoming() and responded with Challenge ACK. For example, the write() syscall in the following packetdrill script fails with -EAGAIN, and wrong SNMP stats get incremented. 0 socket(..., SOCK_STREAM|SOCK_NONBLOCK, IPPROTO_TCP) = 3 +0 connect(3, ..., ...) = -1 EINPROGRESS (Operation now in progress) +0 > S 0:0(0) +0 < S 0:0(0) win 1000 +0 > S. 0:0(0) ack 1 +0 < S. 0:0(0) ack 1 win 1000 +0 write(3, ..., 100) = 100 +0 > P. 1:101(100) ack 1 -- # packetdrill cross-synack.pkt cross-synack.pkt:13: runtime error in write call: Expected result 100 but got -1 with errno 11 (Resource temporarily unavailable) # nstat ... TcpExtTCPChallengeACK 1 0.0 TcpExtTCPSYNChallenge 1 0.0 The problem is that bpf_skops_established() is triggered by the Challenge ACK instead of SYN+ACK. This causes the bpf prog to miss the chance to check if the peer supports a TCP option that is expected to be exchanged in SYN and SYN+ACK. Let's accept a bare SYN+ACK for active-open TCP_SYN_RECV sockets to avoid such a situation. Note that tcp_ack_snd_check() in tcp_rcv_state_process() is skipped not to send an unnecessary ACK, but this could be a bit risky for net.git, so this targets for net-next. Link: https://www.rfc-editor.org/rfc/rfc9293.html#section-3.5-7 [0] Signed-off-by: Kuniyuki Iwashima Reviewed-by: Eric Dumazet Link: https://patch.msgid.link/20240710171246.87533-2-kuniyu@amazon.com Signed-off-by: Jakub Kicinski net/ipv4/tcp_input.c | 9 +++++++++ 1 file changed, 9 insertions(+) commit 42ffe242860c401c34c62aa369c2add341a6eece Author: Peng Fan Date: Wed Jul 10 20:27:28 2024 +0800 test/vsock: add install target Add install target for vsock to make Yocto easy to install the images. Signed-off-by: Peng Fan Reviewed-by: Stefano Garzarella Link: https://patch.msgid.link/20240710122728.45044-1-peng.fan@oss.nxp.com Signed-off-by: Jakub Kicinski tools/testing/vsock/Makefile | 13 +++++++++++++ 1 file changed, 13 insertions(+) commit 8e5f53a684338c04b7f7487c65e1519b83295046 Author: Eric Dumazet Date: Fri Jul 12 23:42:13 2024 +0000 MAINTAINERS: add 5 missing tcp-related files Following files are part of TCP stack: - net/ipv4/inet_connection_sock.c - net/ipv4/inet_hashtables.c - net/ipv4/inet_timewait_sock.c - net/ipv6/inet6_connection_sock.c - net/ipv6/inet6_hashtables.c Signed-off-by: Eric Dumazet Link: https://patch.msgid.link/20240712234213.3178593-1-edumazet@google.com Signed-off-by: Jakub Kicinski MAINTAINERS | 5 +++++ 1 file changed, 5 insertions(+) commit ad00e629145b2b9f0d78aa46e204a9df7d628978 Author: Tetsuo Handa Date: Sat Jul 13 19:05:02 2024 +0900 io_uring/net: check socket is valid in io_bind()/io_listen() We need to check that sock_from_file(req->file) != NULL. Reported-by: syzbot Closes: https://syzkaller.appspot.com/bug?extid=1e811482aa2c70afa9a0 Fixes: 7481fd93fa0a ("io_uring: Introduce IORING_OP_BIND") Fixes: ff140cc8628a ("io_uring: Introduce IORING_OP_LISTEN") Signed-off-by: Tetsuo Handa Link: https://lore.kernel.org/r/903da529-eaa3-43ef-ae41-d30f376c60cc@I-love.SAKURA.ne.jp [axboe: move assignment of sock to where the NULL check is] Signed-off-by: Jens Axboe io_uring/net.c | 14 ++++++++++++-- 1 file changed, 12 insertions(+), 2 deletions(-) commit b7625d67eb1a63d33b0a2a4518ce4897d27f7465 Merge: f7d43dd206e7 4bdc3eaa102b Author: Thomas Gleixner Date: Sat Jul 13 12:07:10 2024 +0200 Merge tag 'timers-v6.11-rc1' of https://git.linaro.org/people/daniel.lezcano/linux into timers/core Pull clocksource/event driver updates from Daniel Lezcano: - Remove unnecessary local variables initialization as they will be initialized in the code path anyway right after on the ARM arch timer and the ARM global timer (Li kunyu) - Fix a race condition in the interrupt leading to a deadlock on the SH CMT driver. Note that this fix was not tested on the platform using this timer but the fix seems reasonable enough to be picked confidently (Niklas Söderlund) - Increase the rating of the gic-timer and use the configured width clocksource register on the MIPS architecture (Jiaxun Yang) - Add the DT bindings for the TMU on the Renesas platforms (Geert Uytterhoeven) - Add the DT bindings for the SOPHGO SG2002 clint on RiscV (Thomas Bonnefille) - Add the rtl-otto timer driver along with the DT bindings for the Realtek platform (Chris Packham) Link: https://lore.kernel.org/all/91cd05de-4c5d-4242-a381-3b8a4fe6a2a2@linaro.org commit d5b60c6517d227b044674718a993caae19080f7b Merge: f531d13bdfe3 447bc4b1906f Author: Steffen Klassert Date: Sat Jul 13 11:14:04 2024 +0200 Merge branch 'Support IPsec crypto offload for IPv6 ESP and IPv4 UDP-encapsulated ESP data paths' Mike Yu says: ==================== Currently, IPsec crypto offload is enabled for GRO code path. However, there are other code paths where the XFRM stack is involved; for example, IPv6 ESP packets handled by xfrm6_esp_rcv() in ESP layer, and IPv4 UDP-encapsulated ESP packets handled by udp_rcv() in UDP layer. This patchset extends the crypto offload support to cover these two cases. This is useful for devices with traffic accounting (e.g., Android), where GRO can lead to inaccurate accounting on the underlying network. For example, VPN traffic might not be counted on the wifi network interface wlan0 if the packets are handled in GRO code path before entering the network stack for accounting. Below is the RX data path scenario the crypto offload can be applied to. +-----------+ +-------+ | HW Driver |-->| wlan0 |--------+ +-----------+ +-------+ | v +---------------+ +------+ +------>| Network Stack |-->| Apps | | +---------------+ +------+ | | | v +--------+ +------------+ | ipsec1 |<--| XFRM Stack | +--------+ +------------+ ==================== Signed-off-by: Steffen Klassert commit 5d89b5bdbce3937c86f05ffe19455c3068fd94f7 Author: Wolfram Sang Date: Fri Jul 12 11:52:40 2024 +0200 i2c: document new callbacks in i2c_algorithm When updating the callbacks, adding their kernel-doc was forgotten. Add it now. Reported-by: Stephen Rothwell Closes: https://lore.kernel.org/r/20240712165527.75e4ddc9@canb.auug.org.au Fixes: a93c2e5fe766 ("i2c: reword i2c_algorithm according to newest specification") Signed-off-by: Wolfram Sang include/linux/i2c.h | 20 +++++++++++++------- 1 file changed, 13 insertions(+), 7 deletions(-) commit 479f18ccca110b727d99c2db60d769736bf390e6 Merge: 500c20fe3ea4 ab1c7ea48f6e Author: Wolfram Sang Date: Sat Jul 13 11:10:54 2024 +0200 Merge tag 'i2c-host-6.11' of git://git.kernel.org/pub/scm/linux/kernel/git/andi.shyti/linux into i2c/for-mergewindow This release includes significant updates, with the primary change being the renaming from "master/slave" to "controller/target" to adhere to I2C v7 and SMBus 3.2 standards. New Support: - Added support for Intel Arrow Lake-H. - Added I2C support in the Arioha SoC by linking the Mediatek I2C controller. Cleanups: - Added the MODULE_DESCRIPTION() macro, resolving a modpost warning in the ALi 1563 Southbridge driver. - Constified the regmap_config declaration in the i2c-designware driver. - Improved the coding style in the Renesas R-Car driver by removing unnecessary semicolons after brackets. General improvements: - In the OMAP device, replaced NOIRQ_SYSTEM_SLEEP_PM_OPS with RUNTIME_PM_OPS to enable waking up the controller during suspend() before suspend_noirq() kicks in. - Improved logging in the Xilinx driver. - Added a warning (WARN()) in the Renesas R-Car driver for spurious interrupts. DTS Changes: - Removed address-cell and size-cell from the Atmel at91sam, nVidia Tegra 20, and Samsung S3c2410 devices. - Fixed Texas Instruments OMAP4 I2C controller to comply with the i2c-controller.yaml schema. - Improved indentation in DTS examples for several I2C devices. - Converted the NXP LPC1788 binding to the dt-schema. - Added documentation for the compatible string thead,th1520-i2c. - Added the "power-domains" property for the Meson I2C driver. commit b69bdba5a37eb6224039e9572e0e98fc3a931fee Author: Yang Li Date: Fri Jul 12 15:38:16 2024 +0800 swiotlb: fix kernel-doc description for swiotlb_del_transient Describe the pool argument in the kernel-doc comment for swiotlb_del_transient. Reported-by: Abaci Robot Signed-off-by: Yang Li Signed-off-by: Christoph Hellwig kernel/dma/swiotlb.c | 1 + 1 file changed, 1 insertion(+) commit 69cf87304dcb08d61e35bcfccdb1a5d52ce2969c Merge: 26f453176a66 74d1412ac8f3 Author: Jakub Kicinski Date: Fri Jul 12 22:27:25 2024 -0700 Merge branch '200GbE' of git://git.kernel.org/pub/scm/linux/kernel/git/tnguy/next-queue Tony Nguyen says: ==================== idpf: XDP chapter I: convert Rx to libeth Alexander Lobakin says: XDP for idpf is currently 5 chapters: * convert Rx to libeth (this); * convert Tx and stats to libeth; * generic XDP and XSk code changes, libeth_xdp; * actual XDP for idpf via libeth_xdp; * XSk for idpf (^). Part I does the following: * splits &idpf_queue into 4 (RQ, SQ, FQ, CQ) and puts them on a diet; * ensures optimal cacheline placement, strictly asserts CL sizes; * moves currently unused/dead singleq mode out of line; * reuses libeth's Rx ptype definitions and helpers; * uses libeth's Rx buffer management for both header and payload; * eliminates memcpy()s and coherent DMA uses on hotpath, uses napi_build_skb() instead of in-place short skb allocation. Most idpf patches, except for the queue split, removes more lines than adds. Expect far better memory utilization and +5-8% on Rx depending on the case (+17% on skb XDP_DROP :>). * '200GbE' of git://git.kernel.org/pub/scm/linux/kernel/git/tnguy/next-queue: idpf: use libeth Rx buffer management for payload buffer idpf: convert header split mode to libeth + napi_build_skb() libeth: support different types of buffers for Rx idpf: remove legacy Page Pool Ethtool stats idpf: reuse libeth's definitions of parsed ptype structures idpf: compile singleq code only under default-n CONFIG_IDPF_SINGLEQ idpf: merge singleq and splitq &net_device_ops idpf: strictly assert cachelines of queue and queue vector structures idpf: avoid bloating &idpf_q_vector with big %NR_CPUS idpf: split &idpf_queue into 4 strictly-typed queue structures idpf: stop using macros for accessing queue descriptors libeth: add cacheline / struct layout assertion helpers page_pool: use __cacheline_group_{begin, end}_aligned() cache: add __cacheline_group_{begin, end}_aligned() (+ couple more) ==================== Link: https://patch.msgid.link/20240710203031.188081-1-anthony.l.nguyen@intel.com Signed-off-by: Jakub Kicinski commit 26f453176a66bb36bf9e3a8abad808b144a94f6a Merge: e5abd12f3df1 e435b043d89a Author: Jakub Kicinski Date: Fri Jul 12 22:25:53 2024 -0700 Merge tag 'for-netdev' of https://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf-next Daniel Borkmann says: ==================== pull-request: bpf-next 2024-07-12 We've added 23 non-merge commits during the last 3 day(s) which contain a total of 18 files changed, 234 insertions(+), 243 deletions(-). The main changes are: 1) Improve BPF verifier by utilizing overflow.h helpers to check for overflows, from Shung-Hsi Yu. 2) Fix NULL pointer dereference in resolve_prog_type() for BPF_PROG_TYPE_EXT when attr->attach_prog_fd was not specified, from Tengda Wu. 3) Fix arm64 BPF JIT when generating code for BPF trampolines with BPF_TRAMP_F_CALL_ORIG which corrupted upper address bits, from Puranjay Mohan. 4) Remove test_run callback from lwt_seg6local_prog_ops which never worked in the first place and caused syzbot reports, from Sebastian Andrzej Siewior. 5) Relax BPF verifier to accept non-zero offset on KF_TRUSTED_ARGS/ /KF_RCU-typed BPF kfuncs, from Matt Bobrowski. 6) Fix a long standing bug in libbpf with regards to handling of BPF skeleton's forward and backward compatibility, from Andrii Nakryiko. 7) Annotate btf_{seq,snprintf}_show functions with __printf, from Alan Maguire. 8) BPF selftest improvements to reuse common network helpers in sk_lookup test and dropping the open-coded inetaddr_len() and make_socket() ones, from Geliang Tang. * tag 'for-netdev' of https://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf-next: (23 commits) selftests/bpf: Test for null-pointer-deref bugfix in resolve_prog_type() bpf: Fix null pointer dereference in resolve_prog_type() for BPF_PROG_TYPE_EXT selftests/bpf: DENYLIST.aarch64: Skip fexit_sleep again bpf: use check_sub_overflow() to check for subtraction overflows bpf: use check_add_overflow() to check for addition overflows bpf: fix overflow check in adjust_jmp_off() bpf: Eliminate remaining "make W=1" warnings in kernel/bpf/btf.o bpf: annotate BTF show functions with __printf bpf, arm64: Fix trampoline for BPF_TRAMP_F_CALL_ORIG selftests/bpf: Close obj in error path in xdp_adjust_tail selftests/bpf: Null checks for links in bpf_tcp_ca selftests/bpf: Use connect_fd_to_fd in sk_lookup selftests/bpf: Use start_server_addr in sk_lookup selftests/bpf: Use start_server_str in sk_lookup selftests/bpf: Close fd in error path in drop_on_reuseport selftests/bpf: Add ASSERT_OK_FD macro selftests/bpf: Add backlog for network_helper_opts selftests/bpf: fix compilation failure when CONFIG_NF_FLOW_TABLE=m bpf: Remove tst_run from lwt_seg6local_prog_ops. bpf: relax zero fixed offset constraint on KF_TRUSTED_ARGS/KF_RCU ... ==================== Link: https://patch.msgid.link/20240712212448.5378-1-daniel@iogearbox.net Signed-off-by: Jakub Kicinski commit e5abd12f3df13e92e2fb3c02fe825aa6c57f8306 Merge: 75fd6079326d 528dd46d0fc3 Author: Jakub Kicinski Date: Fri Jul 12 22:17:55 2024 -0700 Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net Cross-merge networking fixes after downstream PR. Conflicts: drivers/net/ethernet/broadcom/bnxt/bnxt.c f7ce5eb2cb79 ("bnxt_en: Fix crash in bnxt_get_max_rss_ctx_ring()") 20c8ad72eb7f ("eth: bnxt: use the RSS context XArray instead of the local list") Adjacent changes: net/ethtool/ioctl.c 503757c80928 ("net: ethtool: Fix RSS setting") eac9122f0c41 ("net: ethtool: record custom RSS contexts in the XArray") Signed-off-by: Jakub Kicinski commit 75fd6079326da816caba51f9a4192c1876f37423 Merge: 338a93cf4a18 46e457a454de Author: Jakub Kicinski Date: Fri Jul 12 22:16:28 2024 -0700 Merge branch 'eth-bnxt-use-the-new-rss-api' Jakub Kicinski says: ==================== eth: bnxt: use the new RSS API Convert bnxt from using the set_rxfh API to separate create/modify/remove callbacks. Two small extensions to the core APIs are necessary: - the ability to discard contexts if for some catastrophic reasons device can no longer provide them; - the ability to reserve space in the context for RSS table growth. The driver is adjusted to store indirection tables on u32 to make it easier to use core structs directly. With that out of the way the conversion is fairly straightforward. Since the opposition to discarding contexts was relatively mild and its what bnxt does already, I'm sticking to that. We may very well need to revisit that at a later time. v1: https://lore.kernel.org/all/20240702234757.4188344-1-kuba@kernel.org/ ==================== Link: https://patch.msgid.link/20240711220713.283778-1-kuba@kernel.org Signed-off-by: Jakub Kicinski commit 46e457a454de1d95c57394129a2be6eac8bf85e4 Author: Jakub Kicinski Date: Thu Jul 11 15:07:13 2024 -0700 eth: bnxt: use the indir table from ethtool context Instead of allocating a separate indir table in the vnic use the one already present in the RSS context allocated by the core. This saves some LoC and also we won't have to worry about syncing the local version back to the core, once core learns how to dump contexts. Reviewed-by: Pavan Chebbi Link: https://patch.msgid.link/20240711220713.283778-12-kuba@kernel.org Signed-off-by: Jakub Kicinski drivers/net/ethernet/broadcom/bnxt/bnxt.c | 23 ++++++--------- drivers/net/ethernet/broadcom/bnxt/bnxt.h | 7 ++--- drivers/net/ethernet/broadcom/bnxt/bnxt_ethtool.c | 36 +++++++++++------------ 3 files changed, 29 insertions(+), 37 deletions(-) commit 73afb518af4af2364793849b069716425a665c6c Author: Jakub Kicinski Date: Thu Jul 11 15:07:12 2024 -0700 eth: bnxt: bump the entry size in indir tables to u32 Ethtool core stores indirection table with u32 entries, "just to be safe". Switch the type in the driver, so that it's easier to swap local tables for the core ones. Memory allocations already use sizeof(*entry), switch the memset()s as well. Reviewed-by: Pavan Chebbi Link: https://patch.msgid.link/20240711220713.283778-11-kuba@kernel.org Signed-off-by: Jakub Kicinski drivers/net/ethernet/broadcom/bnxt/bnxt.c | 8 ++++---- drivers/net/ethernet/broadcom/bnxt/bnxt.h | 4 ++-- drivers/net/ethernet/broadcom/bnxt/bnxt_ethtool.c | 6 +++--- 3 files changed, 9 insertions(+), 9 deletions(-) commit 9c34c6c28c704fb2f6124d7b6a6837bdbc8e72fc Author: Jakub Kicinski Date: Thu Jul 11 15:07:11 2024 -0700 eth: bnxt: pad out the correct indirection table bnxt allocates tables of max size, and changes the used size based on number of active rings. The unused entries get padded out with zeros. bnxt_modify_rss() seems to always pad out the table of the main / default RSS context, instead of the table of the modified context. I haven't observed any behavior change due to this patch, so I don't think it's a fix. Not entirely sure what role the padding plays, 0 is a valid queue ID. Reviewed-by: Pavan Chebbi Link: https://patch.msgid.link/20240711220713.283778-10-kuba@kernel.org Signed-off-by: Jakub Kicinski drivers/net/ethernet/broadcom/bnxt/bnxt_ethtool.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 20c8ad72eb7f1510d2a802328cd0809b4db9e18a Author: Jakub Kicinski Date: Thu Jul 11 15:07:10 2024 -0700 eth: bnxt: use the RSS context XArray instead of the local list Core already maintains all RSS contexts in an XArray, no need to keep a second list in the driver. Remove bnxt_get_max_rss_ctx_ring() completely since core performs the same check already. Reviewed-by: Pavan Chebbi Link: https://patch.msgid.link/20240711220713.283778-9-kuba@kernel.org Signed-off-by: Jakub Kicinski drivers/net/ethernet/broadcom/bnxt/bnxt.c | 56 +++++++++-------------- drivers/net/ethernet/broadcom/bnxt/bnxt.h | 3 -- drivers/net/ethernet/broadcom/bnxt/bnxt_ethtool.c | 17 ++----- 3 files changed, 26 insertions(+), 50 deletions(-) commit 63d4769cf74acfc42a3436ff28e92ef4f70e617c Author: Jakub Kicinski Date: Thu Jul 11 15:07:09 2024 -0700 eth: bnxt: use context priv for struct bnxt_rss_ctx Core can allocate space for per-context driver-private data, use it for struct bnxt_rss_ctx. Inline bnxt_alloc_rss_ctx() at this point, most of the init (as in the actions bnxt_del_one_rss_ctx() will undo) is open coded in bnxt_create_rxfh_context(), anyway. Reviewed-by: Pavan Chebbi Link: https://patch.msgid.link/20240711220713.283778-8-kuba@kernel.org Signed-off-by: Jakub Kicinski drivers/net/ethernet/broadcom/bnxt/bnxt.c | 14 ------------- drivers/net/ethernet/broadcom/bnxt/bnxt.h | 1 - drivers/net/ethernet/broadcom/bnxt/bnxt_ethtool.c | 24 +++++++++-------------- 3 files changed, 9 insertions(+), 30 deletions(-) commit bf30162915f890c113bb2aefcea8be20b3326d00 Author: Jakub Kicinski Date: Thu Jul 11 15:07:08 2024 -0700 eth: bnxt: depend on core cleaning up RSS contexts New RSS context API removes old contexts on netdev unregister. No need to wipe them manually. Reviewed-by: Pavan Chebbi Link: https://patch.msgid.link/20240711220713.283778-7-kuba@kernel.org Signed-off-by: Jakub Kicinski drivers/net/ethernet/broadcom/bnxt/bnxt.c | 11 ++++------- drivers/net/ethernet/broadcom/bnxt/bnxt.h | 2 +- drivers/net/ethernet/broadcom/bnxt/bnxt_ethtool.c | 2 +- 3 files changed, 6 insertions(+), 9 deletions(-) commit 1a49a23c034b9c991f01b7034efc555886cee11a Author: Jakub Kicinski Date: Thu Jul 11 15:07:07 2024 -0700 eth: bnxt: remove rss_ctx_bmap Core will allocate IDs for the driver, from the range [1, BNXT_MAX_ETH_RSS_CTX], no need to track the allocations. Reviewed-by: Pavan Chebbi Link: https://patch.msgid.link/20240711220713.283778-6-kuba@kernel.org Signed-off-by: Jakub Kicinski drivers/net/ethernet/broadcom/bnxt/bnxt.c | 13 ++----------- drivers/net/ethernet/broadcom/bnxt/bnxt.h | 2 -- drivers/net/ethernet/broadcom/bnxt/bnxt_ethtool.c | 5 ----- 3 files changed, 2 insertions(+), 18 deletions(-) commit 5c466b4d4e75c09a5a3e8d7a79cc20a22bc83809 Author: Jakub Kicinski Date: Thu Jul 11 15:07:06 2024 -0700 eth: bnxt: move from .set_rxfh to .create_rxfh_context and friends Use the new ethtool ops for RSS context management. The conversion is pretty straightforward cut / paste of the right chunks of the combined handler. Main change is that we let the core pick the IDs (bitmap will be removed separately for ease of review), so we need to tell the core when we lose a context. Since the new API passes rxfh as const, change bnxt_modify_rss() to also take const. Reviewed-by: Pavan Chebbi Link: https://patch.msgid.link/20240711220713.283778-5-kuba@kernel.org Signed-off-by: Jakub Kicinski drivers/net/ethernet/broadcom/bnxt/bnxt.c | 1 + drivers/net/ethernet/broadcom/bnxt/bnxt_ethtool.c | 119 ++++++++++++++-------- 2 files changed, 75 insertions(+), 45 deletions(-) commit 667ac333dbb7e265b3f5bc4bc94e236f64682c86 Author: Jakub Kicinski Date: Thu Jul 11 15:07:05 2024 -0700 eth: bnxt: allow deleting RSS contexts when the device is down Contexts get deleted from FW when the device is down, but they are kept in SW and re-added back on open. bnxt_set_rxfh_context() apparently does not want to deal with complexity of dealing with both the device down and device up cases. This is perhaps acceptable for creating new contexts, but not being able to delete contexts makes core-driven cleanups messy. Specifically with the new RSS API core will try to delete contexts automatically after bringing the device down. Support the delete-while-down case. Skip the FW logic and delete just the driver state. Reviewed-by: Pavan Chebbi Link: https://patch.msgid.link/20240711220713.283778-4-kuba@kernel.org Signed-off-by: Jakub Kicinski drivers/net/ethernet/broadcom/bnxt/bnxt.c | 10 ++++++---- drivers/net/ethernet/broadcom/bnxt/bnxt_ethtool.c | 6 ++++-- 2 files changed, 10 insertions(+), 6 deletions(-) commit 28c8757a792bbbc76407777bd0303862daa75057 Author: Jakub Kicinski Date: Thu Jul 11 15:07:04 2024 -0700 net: ethtool: let drivers declare max size of RSS indir table and key Some drivers (bnxt but I think also mlx5 from ML discussions) change the size of the indirection table depending on the number of Rx rings. Decouple the max table size from the size of the currently used table, so that we can reserve space in the context for table growth. Static members in ethtool_ops are good enough for now, we can add callbacks to read the max size more dynamically if someone needs that. Reviewed-by: Pavan Chebbi Link: https://patch.msgid.link/20240711220713.283778-3-kuba@kernel.org Signed-off-by: Jakub Kicinski include/linux/ethtool.h | 20 ++++++++------------ net/ethtool/ioctl.c | 46 ++++++++++++++++++++++++++++++++++++---------- 2 files changed, 44 insertions(+), 22 deletions(-) commit d69ba6bbaf1f606ac354e925571a54d025e32aae Author: Jakub Kicinski Date: Thu Jul 11 15:07:03 2024 -0700 net: ethtool: let drivers remove lost RSS contexts RSS contexts may get lost from a device, in various extreme circumstances. Specifically if the firmware leaks resources and resets, or crashes and either recovers in partially working state or the crash causes a different FW version to run - creating the context again may fail. Drivers should do their absolute best to prevent this from happening. When it does, however, telling user that a context exists, when it can't possibly be used any more is counter productive. Add a helper for drivers to discard contexts. Print an error, in the future netlink notification will also be sent. More robust approaches were proposed, like keeping the contexts but marking them as "dead" (but possibly resurrected by next reset). That may be better but it's unclear at this stage whether the effort is worth the benefits. Reviewed-by: Pavan Chebbi Link: https://patch.msgid.link/20240711220713.283778-2-kuba@kernel.org Signed-off-by: Jakub Kicinski include/linux/ethtool.h | 2 ++ net/ethtool/common.c | 14 ++++++++++++++ 2 files changed, 16 insertions(+) commit a3c10bed330b7ab401254a0c91098a03b04f1448 Author: Dan Carpenter Date: Fri Jul 12 20:04:16 2024 -0500 erofs: silence uninitialized variable warning in z_erofs_scan_folio() Smatch complains that: fs/erofs/zdata.c:1047 z_erofs_scan_folio() error: uninitialized symbol 'err'. The issue is if we hit this (!(map->m_flags & EROFS_MAP_MAPPED)) { condition then "err" isn't set. It's inside a loop so we would have to hit that condition on every iteration. Initialize "err" to zero to solve this. Fixes: 5b9654efb604 ("erofs: teach z_erofs_scan_folios() to handle multi-page folios") Signed-off-by: Dan Carpenter Link: https://lore.kernel.org/r/f78ab50e-ed6d-4275-8dd4-a4159fa565a2@stanley.mountain Signed-off-by: Gao Xiang fs/erofs/zdata.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit f3efefb6fdcce604413135bd8d4c5568e53a1f13 Author: Dmitry Torokhov Date: Wed Jul 10 16:48:54 2024 -0700 Input: yealink - simplify locking in sysfs attribute handling The locking rules in the driver came from era when sysfs attributes could live past the point of time when device would be unbound from the driver, and so used module-global semaphore (potentially shared between multiple yealink devices). Thankfully these times are long gone and attributes will not be accessible once they are removed. Simplify the logic by moving to per-device mutex, stop checking if there is driver data instance attached to the interface, and use guard notation to acquire the mutex. Reviewed-by: Greg Kroah-Hartman Link: https://lore.kernel.org/r/20240710234855.311366-2-dmitry.torokhov@gmail.com Signed-off-by: Dmitry Torokhov drivers/input/misc/yealink.c | 72 ++++++++++++-------------------------------- 1 file changed, 20 insertions(+), 52 deletions(-) commit 295b89a631fe2935d268a95a9dea284992a7a27d Author: Dmitry Torokhov Date: Wed Jul 10 16:48:53 2024 -0700 Input: yealink - use driver core to instantiate device attributes Instead of manually creating driver-specific device attributes set struct usb_driver->dev_groups pointer to have the driver core do it. Reviewed-by: Greg Kroah-Hartman Link: https://lore.kernel.org/r/20240710234855.311366-1-dmitry.torokhov@gmail.com Signed-off-by: Dmitry Torokhov drivers/input/misc/yealink.c | 11 +++-------- 1 file changed, 3 insertions(+), 8 deletions(-) commit b20d6bf8014b2d6fcf65c150453d95a6276fd1fa Author: Dmitry Torokhov Date: Wed Jul 10 16:59:36 2024 -0700 Input: ati-remote2 - use driver core to instantiate device attributes Instead of manually creating driver-specific device attributes set struct usb_driver->dev_groups pointer to have the driver core do it. Reviewed-by: Ville Syrjälä Reviewed-by: Greg Kroah-Hartman Link: https://lore.kernel.org/r/Zo8gaF_lKPAfcye1@google.com Signed-off-by: Dmitry Torokhov drivers/input/misc/ati_remote2.c | 50 ++++++++++++++-------------------------- 1 file changed, 17 insertions(+), 33 deletions(-) commit 2d7877d797aaa16b18ac156ed87fa0f23b9907c8 Author: Dmitry Torokhov Date: Wed Jul 10 22:03:29 2024 -0700 Input: omap-keypad - use driver core to instantiate device attributes Instead of manually creating driver-specific device attributes set struct driver->dev_groups pointer to have the driver core do it. This also fixes issue with the attribute not being deleted on driver unbind. Reviewed-by: Greg Kroah-Hartman Link: https://lore.kernel.org/r/Zo9nofWJ1xg9MgKs@google.com Signed-off-by: Dmitry Torokhov drivers/input/keyboard/omap-keypad.c | 21 +++++++++++---------- 1 file changed, 11 insertions(+), 10 deletions(-) commit a122a6fd72d64de1e2f7521046823e25cb269f06 Author: Dmitry Torokhov Date: Wed Jul 10 21:49:12 2024 -0700 Input: atmel_mxt_ts - use driver core to instantiate device attributes Instead of manually creating driver-specific device attributes, set struct driver->dev_groups pointer to have the driver core do it. Reviewed-by: Greg Kroah-Hartman Link: https://lore.kernel.org/r/Zo9kSFeGOZB9b3rq@google.com Signed-off-by: Dmitry Torokhov drivers/input/touchscreen/atmel_mxt_ts.c | 16 ++-------------- 1 file changed, 2 insertions(+), 14 deletions(-) commit df1e9791998a92fe9f1e7d3f031b34daaad39e2f Author: Masahiro Yamada Date: Sat Jul 6 23:41:24 2024 +0900 hwrng: core - remove (un)register_miscdev() These functions are redundant after commit 0daa7a0afd0f ("hwrng: Avoid manual device_create_file() calls"). Let's call misc_(de)register() directly. Signed-off-by: Masahiro Yamada Signed-off-by: Herbert Xu drivers/char/hw_random/core.c | 14 ++------------ 1 file changed, 2 insertions(+), 12 deletions(-) commit fe69b772e35e181ff0576ab4a610515ffe7a3325 Author: Dan Carpenter Date: Thu Jul 4 10:25:05 2024 -0500 crypto: lib/mpi - delete unnecessary condition We checked that "nlimbs" is non-zero in the outside if statement so delete the duplicate check here. Signed-off-by: Dan Carpenter Reviewed-by: Tianjia Zhang Signed-off-by: Herbert Xu lib/crypto/mpi/mpi-bit.c | 10 ++++------ 1 file changed, 4 insertions(+), 6 deletions(-) commit 101e99c23af9460890edc9055141e6aba6d3e08a Author: Eric Biggers Date: Wed Jul 3 12:04:31 2024 -0700 crypto: testmgr - generate power-of-2 lengths more often Implementations of hash functions often have special cases when lengths are a multiple of the hash function's internal block size (e.g. 64 for SHA-256, 128 for SHA-512). Currently, when the fuzz testing code generates lengths, it doesn't prefer any length mod 64 over any other. This limits the coverage of these special cases. Therefore, this patch updates the fuzz testing code to generate power-of-2 lengths and divide messages exactly in half a bit more often. Reviewed-by: Sami Tolvanen Acked-by: Ard Biesheuvel Signed-off-by: Eric Biggers Signed-off-by: Herbert Xu crypto/testmgr.c | 16 ++++++++++++---- 1 file changed, 12 insertions(+), 4 deletions(-) commit dd52b5eeb0f70893f762da7254e923fd23fd1379 Author: David Gstir Date: Wed Jul 3 14:49:58 2024 +0200 crypto: mxs-dcp - Ensure payload is zero when using key slot We could leak stack memory through the payload field when running AES with a key from one of the hardware's key slots. Fix this by ensuring the payload field is set to 0 in such cases. This does not affect the common use case when the key is supplied from main memory via the descriptor payload. Signed-off-by: David Gstir Reported-by: kernel test robot Reported-by: Dan Carpenter Closes: https://lore.kernel.org/r/202405270146.Y9tPoil8-lkp@intel.com/ Fixes: 3d16af0b4cfa ("crypto: mxs-dcp: Add support for hardware-bound keys") Signed-off-by: Herbert Xu drivers/crypto/mxs-dcp.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) commit addea5858b66a185d33bf1b90980316f5f375d75 Author: Francesco Dolcini Date: Tue Jun 25 21:57:46 2024 +0200 hwrng: Kconfig - Do not enable by default CN10K driver Do not enable by default the CN10K HW random generator driver. CN10K Random Number Generator is available only on some specific Marvell SoCs, however the driver is in practice enabled by default on all arm64 configs. Signed-off-by: Francesco Dolcini Signed-off-by: Herbert Xu drivers/char/hw_random/Kconfig | 1 - 1 file changed, 1 deletion(-) commit 0fe2356434e157b3952ff4dbdfe0a96070ddcaa2 Author: Kees Cook Date: Thu Jul 11 10:13:09 2024 -0700 tsacct: replace strncpy() with strscpy() Replace the deprecated[1] use of strncpy() in bacct_add_tsk(). Since this is UAPI, include trailing padding in the copy. Link: https://github.com/KSPP/linux/issues/90 [1] Link: https://lkml.kernel.org/r/20240711171308.work.995-kees@kernel.org Signed-off-by: Kees Cook Cc: "Dr. Thomas Orgis" Cc: Eric W. Biederman Cc: Ismael Luceno Cc: Peng Liu Signed-off-by: Andrew Morton kernel/tsacct.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit e1fb7430fcb00431087fc1c088ec9e8737cf6c7d Author: Thorsten Blum Date: Tue Jul 9 00:40:24 2024 +0200 lib/bch.c: use swap() to improve code Use the swap() macro to simplify the functions solve_linear_system() and gf_poly_gcd() and improve their readability. Remove the local variable tmp. Fixes the following three Coccinelle/coccicheck warnings reported by swap.cocci: WARNING opportunity for swap() WARNING opportunity for swap() WARNING opportunity for swap() Link: https://lkml.kernel.org/r/20240708224023.9312-2-thorsten.blum@toblux.com Signed-off-by: Thorsten Blum Signed-off-by: Andrew Morton lib/bch.c | 20 +++++--------------- 1 file changed, 5 insertions(+), 15 deletions(-) commit 4f5d4a1ba7a1a23173e356186f3f8b7c27d2e948 Author: Chen Ni Date: Tue Jul 9 11:43:23 2024 +0800 test_bpf: convert comma to semicolon Replace commas between expression statements with semicolons. Link: https://lkml.kernel.org/r/20240709034323.586185-1-nichen@iscas.ac.cn Signed-off-by: Chen Ni Cc: Alexei Starovoitov Cc: Andrii Nakryiko Cc: Daniel Borkmann Cc: Eduard Zingerman Cc: Hao Luo Cc: Jiri Olsa Cc: John Fastabend Cc: KP Singh Cc: Martin KaFai Lau Cc: Song Liu Cc: Stanislav Fomichev Cc: Yonghong Song Signed-off-by: Andrew Morton lib/test_bpf.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) commit 73db3abdca58c8a014ec4c88cf5ef925cbf63669 Author: Masahiro Yamada Date: Sun Jul 7 01:05:06 2024 +0900 init/modpost: conditionally check section mismatch to __meminit* This reverts commit eb8f689046b8 ("Use separate sections for __dev/ _cpu/__mem code/data"). Check section mismatch to __meminit* only when CONFIG_MEMORY_HOTPLUG=n. With this change, the linker script and modpost become simpler, and we can get rid of the __ref annotations from the memory hotplug code. [sfr@canb.auug.org.au: remove MEM_KEEP from arch/powerpc/kernel/vmlinux.lds.S] Link: https://lkml.kernel.org/r/20240710093213.2aefb25f@canb.auug.org.au Link: https://lkml.kernel.org/r/20240706160511.2331061-2-masahiroy@kernel.org Signed-off-by: Masahiro Yamada Signed-off-by: Stephen Rothwell Reviewed-by: Wei Yang Cc: Stephen Rothwell Signed-off-by: Andrew Morton arch/powerpc/kernel/vmlinux.lds.S | 2 -- include/asm-generic/vmlinux.lds.h | 18 ++---------------- include/linux/init.h | 14 +++++++++----- scripts/mod/modpost.c | 19 ++++--------------- 4 files changed, 15 insertions(+), 38 deletions(-) commit 7a7127aa33c9f5b7b54ffa80619f644c5e000846 Author: Masahiro Yamada Date: Sun Jul 7 01:05:05 2024 +0900 init: remove unused __MEMINIT* macros These macros are not used anywhere. Link: https://lkml.kernel.org/r/20240706160511.2331061-1-masahiroy@kernel.org Signed-off-by: Masahiro Yamada Reviewed-by: Wei Yang Signed-off-by: Andrew Morton include/linux/init.h | 4 ---- 1 file changed, 4 deletions(-) commit fbc8846cd9c258e3844d22afd4d1ae7240077aab Author: Christophe JAILLET Date: Mon Jul 8 23:32:42 2024 +0900 nilfs2: Constify struct kobj_type 'struct kobj_type' is not modified in this driver. It is only used with kobject_init_and_add() which takes a "const struct kobj_type *" parameter. Constifying this structure moves some data to a read-only section, so increase overall security. On a x86_64, with allmodconfig: Before: ====== text data bss dec hex filename 22403 4184 24 26611 67f3 fs/nilfs2/sysfs.o After: ===== text data bss dec hex filename 22723 3928 24 26675 6833 fs/nilfs2/sysfs.o Link: https://lkml.kernel.org/r/20240708143242.3296-1-konishi.ryusuke@gmail.com Signed-off-by: Christophe JAILLET Signed-off-by: Ryusuke Konishi Signed-off-by: Andrew Morton fs/nilfs2/sysfs.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) commit 63d9866ab01ffd0d0835d5564107283a4afc0a38 Author: Ryan Roberts Date: Wed Jul 10 10:55:01 2024 +0100 mm: shmem: rename mTHP shmem counters The legacy PMD-sized THP counters at /proc/vmstat include thp_file_alloc, thp_file_fallback and thp_file_fallback_charge, which rather confusingly refer to shmem THP and do not include any other types of file pages. This is inconsistent since in most other places in the kernel, THP counters are explicitly separated for anon, shmem and file flavours. However, we are stuck with it since it constitutes a user ABI. Recently, commit 66f44583f9b6 ("mm: shmem: add mTHP counters for anonymous shmem") added equivalent mTHP stats for shmem, keeping the same "file_" prefix in the names. But in future, we may want to add extra stats to cover actual file pages, at which point, it would all become very confusing. So let's take the opportunity to rename these new counters "shmem_" before the change makes it upstream and the ABI becomes immutable. While we are at it, let's improve the documentation for the legacy counters to make it clear that they count shmem pages only. Link: https://lkml.kernel.org/r/20240710095503.3193901-1-ryan.roberts@arm.com Signed-off-by: Ryan Roberts Reviewed-by: Baolin Wang Reviewed-by: Lance Yang Reviewed-by: Zi Yan Reviewed-by: Barry Song Acked-by: David Hildenbrand Cc: Daniel Gomez Cc: Hugh Dickins Cc: Jonathan Corbet Cc: Matthew Wilcox (Oracle) Cc: Signed-off-by: Andrew Morton Documentation/admin-guide/mm/transhuge.rst | 29 ++++++++++++++++------------- include/linux/huge_mm.h | 6 +++--- mm/huge_memory.c | 12 ++++++------ mm/shmem.c | 8 ++++---- 4 files changed, 29 insertions(+), 26 deletions(-) commit 2ef52d5bb78dc2d27d8141578e8095989ad5ca35 Author: Kefeng Wang Date: Tue Jul 9 18:55:08 2024 +0800 mm: swap_state: use folio_alloc_mpol() in __read_swap_cache_async() Convert to use folio_alloc_mpol() helper() in __read_swap_cache_async(). Link: https://lkml.kernel.org/r/20240709105508.3933823-1-wangkefeng.wang@huawei.com Signed-off-by: Kefeng Wang Cc: Hugh Dickins Signed-off-by: Andrew Morton mm/swap_state.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) commit 6e49019db5f7a09a9c0e8ac4d108e656c3f8e583 Author: Peter Xu Date: Mon Jul 8 17:55:37 2024 -0400 mm/migrate: putback split folios when numa hint migration fails This issue is not from any report yet, but by code observation only. This is yet another fix besides Hugh's patch [1] but on relevant code path, where eager split of folio can happen if the folio is already on deferred list during a folio migration. Here the issue is NUMA path (migrate_misplaced_folio()) may start to encounter such folio split now even with MR_NUMA_MISPLACED hint applied. Then when migrate_pages() didn't migrate all the folios, it's possible the split small folios be put onto the list instead of the original folio. Then putting back only the head page won't be enough. Fix it by putting back all the folios on the list. [1] https://lore.kernel.org/all/46c948b4-4dd8-6e03-4c7b-ce4e81cfa536@google.com/ [akpm@linux-foundation.org: remove now unused local `nr_pages'] Link: https://lkml.kernel.org/r/20240708215537.2630610-1-peterx@redhat.com Fixes: 7262f208ca68 ("mm/migrate: split source folio if it is on deferred split list") Signed-off-by: Peter Xu Reviewed-by: Zi Yan Reviewed-by: Baolin Wang Cc: Yang Shi Cc: Hugh Dickins Cc: Huang Ying Cc: David Hildenbrand Cc: Signed-off-by: Andrew Morton mm/migrate.c | 11 ++--------- 1 file changed, 2 insertions(+), 9 deletions(-) commit 61c663e020d263eaecc7f09afa40f7bbe160931e Author: Yu Zhao Date: Mon Jul 8 15:27:53 2024 -0600 mm/truncate: batch-clear shadow entries Make clear_shadow_entry() clear shadow entries in `struct folio_batch` so that it can reduce contention on i_lock and i_pages locks, e.g., watchdog: BUG: soft lockup - CPU#29 stuck for 11s! [fio:2701649] clear_shadow_entry+0x3d/0x100 mapping_try_invalidate+0x117/0x1d0 invalidate_mapping_pages+0x10/0x20 invalidate_bdev+0x3c/0x50 blkdev_common_ioctl+0x5f7/0xa90 blkdev_ioctl+0x109/0x270 Also, rename clear_shadow_entry() to clear_shadow_entries() accordingly. [yuzhao@google.com: v2] Link: https://lkml.kernel.org/r/20240710060933.3979380-1-yuzhao@google.com Link: https://lkml.kernel.org/r/20240708212753.3120511-1-yuzhao@google.com Reported-by: Bharata B Rao Closes: https://lore.kernel.org/d2841226-e27b-4d3d-a578-63587a3aa4f3@amd.com/ Signed-off-by: Yu Zhao Cc: Mel Gorman Cc: Johannes Weiner Signed-off-by: Andrew Morton mm/truncate.c | 68 +++++++++++++++++++++++++++-------------------------------- 1 file changed, 31 insertions(+), 37 deletions(-) commit 8a78882dac1c8c464e047a29415edb50421651ce Author: Miaohe Lin Date: Mon Jul 8 11:05:44 2024 +0800 mm/memory-failure: remove obsolete MF_MSG_DIFFERENT_COMPOUND The page cannot become compound pages again just after a folio is split as an extra refcnt is held. So the MF_MSG_DIFFERENT_COMPOUND case is obsolete and can be removed to get rid of this false assumption and code burden. But add one WARN_ON() here to keep the situation clear. Link: https://lkml.kernel.org/r/20240708030544.196919-1-linmiaohe@huawei.com Signed-off-by: Miaohe Lin Cc: Borislav Petkov (AMD) Cc: Naoya Horiguchi Cc: Tony Luck Signed-off-by: Andrew Morton include/ras/ras_event.h | 1 - mm/memory-failure.c | 19 +++---------------- 2 files changed, 3 insertions(+), 17 deletions(-) commit a5ea521250afdf3d70c72970660f44aebf56ea19 Author: Hugh Dickins Date: Sat Jul 6 14:29:00 2024 -0700 mm: simplify folio_migrate_mapping() Now that folio_undo_large_rmappable() is an inline function checking order and large_rmappable for itself (and __folio_undo_large_rmappable() is now declared even when CONFIG_TRANASPARENT_HUGEPAGE is off) there is no need for folio_migrate_mapping() to check large and large_rmappable first (in the mapping case when it has had to freeze anyway). Link: https://lkml.kernel.org/r/68feee73-050e-8e98-7a3a-abf78738d92c@google.com Signed-off-by: Hugh Dickins Reviewed-by: Zi Yan Cc: Baolin Wang Cc: Barry Song Cc: David Hildenbrand Cc: Kefeng Wang Cc: Matthew Wilcox (Oracle) Cc: Nhat Pham Cc: Yang Shi Signed-off-by: Andrew Morton mm/migrate.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) commit f6953e22af7dd1466f71102627791eae0c30ef68 Author: Wei Yang Date: Sat Jul 6 06:16:15 2024 +0000 mm/page_alloc: put __free_pages_core() in __meminit section __free_pages_core() is only used in bootmem init and hot-add memory init path. Let's put it in __meminit section. Link: https://lkml.kernel.org/r/20240706061615.30322-1-richard.weiyang@gmail.com Signed-off-by: Wei Yang Acked-by: David Hildenbrand Cc: Oscar Salvador Signed-off-by: Andrew Morton mm/memory_hotplug.c | 3 ++- mm/page_alloc.c | 2 +- 2 files changed, 3 insertions(+), 2 deletions(-) commit 26c7d8413aaf113a54b54f63e151416a5c5c2a88 Author: Bang Li Date: Fri Jul 5 11:23:09 2024 +0800 mm: thp: support "THPeligible" semantics for mTHP with anonymous shmem After the commit 7fb1b252afb5 ("mm: shmem: add mTHP support for anonymous shmem"), we can configure different policies through the multi-size THP sysfs interface for anonymous shmem. But currently "THPeligible" indicates only whether the mapping is eligible for allocating THP-pages as well as the THP is PMD mappable or not for anonymous shmem, we need to support semantics for mTHP with anonymous shmem similar to those for mTHP with anonymous memory. Link: https://lkml.kernel.org/r/20240705032309.24933-1-libang.li@antgroup.com Signed-off-by: Bang Li Reviewed-by: Baolin Wang Cc: David Hildenbrand Cc: Hugh Dickins Cc: Kefeng Wang Cc: Lance Yang Cc: Ryan Roberts Cc: Zi Yan Signed-off-by: Andrew Morton include/linux/shmem_fs.h | 9 +++++++++ mm/huge_memory.c | 13 +++++++++---- mm/shmem.c | 9 +-------- 3 files changed, 19 insertions(+), 12 deletions(-) commit 4c8763e84aae4d04d94b35aca9f7db6a8930ad77 Author: Ran Xiaokai Date: Fri Jul 5 10:43:43 2024 +0000 kpageflags: detect isolated KPF_THP folios When folio is isolated, the PG_lru bit is cleared. So the PG_lru check in stable_page_flags() will miss this kind of isolated folios. Use folio_test_large_rmappable() instead to also include isolated folios. Since pagecache supports large folios and the introduction of mTHP, the semantics of KPF_THP have been expanded, now it indicates not only PMD-sized THP. Update related documentation to clearly state that KPF_THP indicates multiple order THPs. [ran.xiaokai@zte.com.cn: directly use is_zero_folio(), per David] Link: https://lkml.kernel.org/r/20240708062601.165215-1-ranxiaokai627@163.com Link: https://lkml.kernel.org/r/20240705104343.112680-1-ranxiaokai627@163.com Signed-off-by: Ran Xiaokai Acked-by: David Hildenbrand Cc: Andrei Vagin Cc: Jonathan Corbet Cc: Muhammad Usama Anjum Cc: Ryan Roberts Cc: Svetly Todorov Cc: Vlastimil Babka Cc: Zi Yan Signed-off-by: Andrew Morton Documentation/admin-guide/mm/pagemap.rst | 4 ++-- fs/proc/page.c | 21 +++++++++------------ 2 files changed, 11 insertions(+), 14 deletions(-) commit 00f58104202c472e487f0866fbd38832523fd4f9 Author: Ryan Roberts Date: Thu Jul 4 10:10:50 2024 +0100 mm: fix khugepaged activation policy Since the introduction of mTHP, the docuementation has stated that khugepaged would be enabled when any mTHP size is enabled, and disabled when all mTHP sizes are disabled. There are 2 problems with this; 1. this is not what was implemented by the code and 2. this is not the desirable behavior. Desirable behavior is for khugepaged to be enabled when any PMD-sized THP is enabled, anon or file. (Note that file THP is still controlled by the top-level control so we must always consider that, as well as the PMD-size mTHP control for anon). khugepaged only supports collapsing to PMD-sized THP so there is no value in enabling it when PMD-sized THP is disabled. So let's change the code and documentation to reflect this policy. Further, per-size enabled control modification events were not previously forwarded to khugepaged to give it an opportunity to start or stop. Consequently the following was resulting in khugepaged eroneously not being activated: echo never > /sys/kernel/mm/transparent_hugepage/enabled echo always > /sys/kernel/mm/transparent_hugepage/hugepages-2048kB/enabled [ryan.roberts@arm.com: v3] Link: https://lkml.kernel.org/r/20240705102849.2479686-1-ryan.roberts@arm.com Link: https://lkml.kernel.org/r/20240705102849.2479686-1-ryan.roberts@arm.com Link: https://lkml.kernel.org/r/20240704091051.2411934-1-ryan.roberts@arm.com Signed-off-by: Ryan Roberts Fixes: 3485b88390b0 ("mm: thp: introduce multi-size THP sysfs interface") Closes: https://lore.kernel.org/linux-mm/7a0bbe69-1e3d-4263-b206-da007791a5c4@redhat.com/ Acked-by: David Hildenbrand Cc: Baolin Wang Cc: Barry Song Cc: Jonathan Corbet Cc: Lance Yang Cc: Yang Shi Cc: Signed-off-by: Andrew Morton Documentation/admin-guide/mm/transhuge.rst | 11 +++++----- include/linux/huge_mm.h | 12 ----------- mm/huge_memory.c | 7 +++++++ mm/khugepaged.c | 33 +++++++++++++++++++++++------- 4 files changed, 38 insertions(+), 25 deletions(-) commit 823430c8e9d98c5865af518c782d0493b76aa511 Author: Ho-Ren (Jack) Chuang Date: Thu Jul 4 07:26:44 2024 +0000 memory tier: consolidate the initialization of memory tiers The current memory tier initialization process is distributed across two different functions, memory_tier_init() and memory_tier_late_init(). This design is hard to maintain. Thus, this patch is proposed to reduce the possible code paths by consolidating different initialization patches into one. The earlier discussion with Jonathan and Ying is listed here: https://lore.kernel.org/lkml/20240405150244.00004b49@Huawei.com/ If we want to put these two initializations together, they must be placed together in the later function. Because only at that time, the HMAT information will be ready, adist between nodes can be calculated, and memory tiering can be established based on the adist. So we position the initialization at memory_tier_init() to the memory_tier_late_init() call. Moreover, it's natural to keep memory_tier initialization in drivers at device_initcall() level. If we simply move the set_node_memory_tier() from memory_tier_init() to late_initcall(), it will result in HMAT not registering the mt_adistance_algorithm callback function, because set_node_memory_tier() is not performed during the memory tiering initialization phase, leading to a lack of correct default_dram information. Therefore, we introduced a nodemask to pass the information of the default DRAM nodes. The reason for not choosing to reuse default_dram_type->nodes is that it is not clean enough. So in the end, we use a __initdata variable, which is a variable that is released once initialization is complete, including both CPU and memory nodes for HMAT to iterate through. Link: https://lkml.kernel.org/r/20240704072646.437579-1-horen.chuang@linux.dev Signed-off-by: Ho-Ren (Jack) Chuang Suggested-by: Jonathan Cameron Reviewed-by: "Huang, Ying" Reviewed-by: Jonathan Cameron Cc: Alistair Popple Cc: Aneesh Kumar K.V Cc: Dan Williams Cc: Dave Jiang Cc: Gregory Price Cc: Len Brown Cc: Michal Hocko Cc: Rafael J. Wysocki Cc: Ravi Jonnalagadda Cc: SeongJae Park Cc: Tejun Heo Signed-off-by: Andrew Morton drivers/acpi/numa/hmat.c | 5 +--- include/linux/memory-tiers.h | 2 ++ mm/memory-tiers.c | 54 +++++++++++++++++--------------------------- 3 files changed, 24 insertions(+), 37 deletions(-) commit a8585ac68621983587f1701b7567978fcbcd9573 Author: Maarten Lankhorst Date: Wed Jul 3 13:25:10 2024 +0200 mm/page_counter: move calculating protection values to page_counter It's a lot of math, and there is nothing memcontrol specific about it. This makes it easier to use inside of the drm cgroup controller. [akpm@linux-foundation.org: fix kerneldoc, per Jeff Johnson] Link: https://lkml.kernel.org/r/20240703112510.36424-1-maarten.lankhorst@linux.intel.com Signed-off-by: Maarten Lankhorst Acked-by: Roman Gushchin Acked-by: Shakeel Butt Cc: Michal Hocko Cc: Johannes Weiner Cc: Muchun Song Cc: Jeff Johnson Signed-off-by: Andrew Morton include/linux/page_counter.h | 4 + mm/memcontrol.c | 154 +------------------------------------- mm/page_counter.c | 173 +++++++++++++++++++++++++++++++++++++++++++ 3 files changed, 180 insertions(+), 151 deletions(-) commit 3b0ba54d5f8ff60553c01d3ec3c607ab7bb3b452 Author: Suren Baghdasaryan Date: Wed Jul 3 10:42:25 2024 -0700 mm: add comments for allocation helpers explaining why they are macros A number of allocation helper functions were converted into macros to account them at the call sites. Add a comment for each converted allocation helper explaining why it has to be a macro and why we typecast the return value wherever required. The patch also moves acpi_os_acquire_object() closer to other allocation helpers to group them together under the same comment. The patch has no functional changes. Link: https://lkml.kernel.org/r/20240703174225.3891393-1-surenb@google.com Fixes: 2c321f3f70bc ("mm: change inlined allocation helpers to account at the call site") Signed-off-by: Suren Baghdasaryan Suggested-by: Andrew Morton Cc: Christian König Cc: Christoph Hellwig Cc: Jan Kara Cc: Kent Overstreet Cc: Thorsten Blum Signed-off-by: Andrew Morton fs/nfs/iostat.h | 4 ++++ include/acpi/platform/aclinuxex.h | 9 ++++++--- include/linux/bpf.h | 4 ++++ include/linux/dma-fence-chain.h | 4 ++++ include/linux/hid_bpf.h | 5 +++++ include/linux/jbd2.h | 10 ++++++++++ include/linux/skbuff.h | 8 ++++++++ include/linux/skmsg.h | 5 +++++ 8 files changed, 46 insertions(+), 3 deletions(-) commit cd1e0dac3a3e57d86085eea95ab0cf3172950156 Author: Christoph Hellwig Date: Tue Jul 2 09:23:27 2024 +0200 mm: unexport vmf_insert_mixed_mkwrite vmf_insert_mixed_mkwrite is only used by the built-in DAX code. Link: https://lkml.kernel.org/r/20240702072327.1640911-1-hch@lst.de Signed-off-by: Christoph Hellwig Reviewed-by: Alistair Popple Reviewed-by: David Hildenbrand Signed-off-by: Andrew Morton mm/memory.c | 1 - 1 file changed, 1 deletion(-) commit 8268614b408be6b76c1cee6f67de7deb0d6593b3 Author: Christophe Leroy Date: Tue Jul 2 15:51:35 2024 +0200 mm: remove CONFIG_ARCH_HAS_HUGEPD powerpc was the only user of CONFIG_ARCH_HAS_HUGEPD and doesn't use it anymore, so remove all related code. Link: https://lkml.kernel.org/r/4b10c54c794780b955f3ad6c657d0199dd792146.1719928057.git.christophe.leroy@csgroup.eu Signed-off-by: Christophe Leroy Acked-by: Oscar Salvador Cc: Jason Gunthorpe Cc: Michael Ellerman Cc: Nicholas Piggin Cc: Peter Xu Signed-off-by: Andrew Morton include/linux/hugetlb.h | 6 -- mm/Kconfig | 10 --- mm/gup.c | 194 ++---------------------------------------------- mm/pagewalk.c | 57 +------------- 4 files changed, 9 insertions(+), 258 deletions(-) commit 0c22e4b2949b83ccaf530603d68239cb5b0fd512 Author: Christophe Leroy Date: Tue Jul 2 15:51:34 2024 +0200 powerpc/mm: remove hugepd leftovers All targets have now opted out of CONFIG_ARCH_HAS_HUGEPD so remove left over code. Link: https://lkml.kernel.org/r/39c0d0adee6790fc42cee9f458e05fb95136c3dd.1719928057.git.christophe.leroy@csgroup.eu Signed-off-by: Christophe Leroy Acked-by: Oscar Salvador Cc: Jason Gunthorpe Cc: Michael Ellerman Cc: Nicholas Piggin Cc: Peter Xu Signed-off-by: Andrew Morton arch/powerpc/include/asm/hugetlb.h | 7 - arch/powerpc/include/asm/page.h | 6 - arch/powerpc/include/asm/pgtable-be-types.h | 10 - arch/powerpc/include/asm/pgtable-types.h | 9 - arch/powerpc/mm/hugetlbpage.c | 413 ---------------------------- arch/powerpc/mm/init-common.c | 8 +- arch/powerpc/mm/pgtable.c | 27 +- 7 files changed, 3 insertions(+), 477 deletions(-) commit 57fb15c32f4f6a4f1a58f1fbc58a799c3f975ed8 Author: Christophe Leroy Date: Tue Jul 2 15:51:33 2024 +0200 powerpc/64s: use contiguous PMD/PUD instead of HUGEPD On book3s/64, the only user of hugepd is hash in 4k mode. All other setups (hash-64, radix-4, radix-64) use leaf PMD/PUD. Rework hash-4k to use contiguous PMD and PUD instead. In that setup there are only two huge page sizes: 16M and 16G. 16M sits at PMD level and 16G at PUD level. pte_update doesn't know page size, lets use the same trick as hpte_need_flush() to get page size from segment properties. That's not the most efficient way but let's do that until callers of pte_update() provide page size instead of just a huge flag. Link: https://lkml.kernel.org/r/7448f60a9b3efd396595f4f735d1e0babc5ae379.1719928057.git.christophe.leroy@csgroup.eu Signed-off-by: Christophe Leroy Acked-by: Michael Ellerman (powerpc) Cc: Jason Gunthorpe Cc: Nicholas Piggin Cc: Oscar Salvador Cc: Peter Xu Signed-off-by: Andrew Morton arch/powerpc/include/asm/book3s/64/hash-4k.h | 15 -------- arch/powerpc/include/asm/book3s/64/hash.h | 40 ++++++++++++++++---- arch/powerpc/include/asm/book3s/64/hugetlb.h | 38 ------------------- arch/powerpc/include/asm/book3s/64/pgtable-4k.h | 47 ------------------------ arch/powerpc/include/asm/book3s/64/pgtable-64k.h | 20 ---------- arch/powerpc/include/asm/book3s/64/pgtable.h | 22 +++++++++-- arch/powerpc/include/asm/hugetlb.h | 4 ++ arch/powerpc/include/asm/nohash/hugetlb-e500.h | 4 -- arch/powerpc/include/asm/page.h | 8 ---- arch/powerpc/mm/book3s64/hash_utils.c | 11 ++++-- arch/powerpc/mm/book3s64/hugetlbpage.c | 10 +++++ arch/powerpc/mm/book3s64/pgtable.c | 12 ------ arch/powerpc/mm/hugetlbpage.c | 26 ------------- arch/powerpc/mm/pgtable.c | 2 +- arch/powerpc/platforms/Kconfig.cputype | 1 - 15 files changed, 74 insertions(+), 186 deletions(-) commit 7c44202e36097e23240025298ccd1fe4eacfd94e Author: Christophe Leroy Date: Tue Jul 2 15:51:32 2024 +0200 powerpc/e500: use contiguous PMD instead of hugepd e500 supports many page sizes among which the following size are implemented in the kernel at the time being: 4M, 16M, 64M, 256M, 1G. On e500, TLB miss for hugepages is exclusively handled by SW even on e6500 which has HW assistance for 4k pages, so there are no constraints like on the 8xx. On e500/32, all are at PGD/PMD level and can be handled as cont-PMD. On e500/64, smaller ones are on PMD while bigger ones are on PUD. Again, they can easily be handled as cont-PMD and cont-PUD instead of hugepd. On e500/32, use the pagesize bits in PTE to know if it is a PMD or a leaf entry. This works because the pagesize bits are in the last 12 bits and page tables are 4k aligned. On e500/64, use highest bit which is always 1 on PxD (Because PxD contains virtual address of a kernel memory) and always 0 on PTEs because not all bits of RPN are used/possible. Link: https://lkml.kernel.org/r/dd085987816ed2a0c70adb7e34966cb833fc03e1.1719928057.git.christophe.leroy@csgroup.eu Signed-off-by: Christophe Leroy Cc: Jason Gunthorpe Cc: Michael Ellerman Cc: Nicholas Piggin Cc: Oscar Salvador Cc: Peter Xu Signed-off-by: Andrew Morton arch/powerpc/include/asm/nohash/hugetlb-e500.h | 32 ++------------------ arch/powerpc/include/asm/nohash/pgalloc.h | 2 -- arch/powerpc/include/asm/nohash/pgtable.h | 42 +++++++++++++++++++------- arch/powerpc/include/asm/nohash/pte-e500.h | 33 ++++++++++++++++++++ arch/powerpc/include/asm/page.h | 15 +-------- arch/powerpc/kernel/head_85xx.S | 21 +++++-------- arch/powerpc/mm/hugetlbpage.c | 2 -- arch/powerpc/mm/nohash/tlb_low_64e.S | 7 +---- arch/powerpc/mm/pgtable.c | 31 +++++++++++++++++++ arch/powerpc/platforms/Kconfig.cputype | 1 - 10 files changed, 107 insertions(+), 79 deletions(-) commit dc0aa538a954c90d71d6bc1fcac487ef01512120 Author: Christophe Leroy Date: Tue Jul 2 15:51:31 2024 +0200 powerpc/e500: free r10 for FIND_PTE Move r13 load after the call to FIND_PTE, and use r13 instead of r10 for storing fault address. This will allow using r10 freely in FIND_PTE in following patch to handle hugepage size. Link: https://lkml.kernel.org/r/a3ee563ad5b13c891a15d3aae6c136c44ce8aa63.1719928057.git.christophe.leroy@csgroup.eu Signed-off-by: Christophe Leroy Cc: Jason Gunthorpe Cc: Michael Ellerman Cc: Nicholas Piggin Cc: Oscar Salvador Cc: Peter Xu Signed-off-by: Andrew Morton arch/powerpc/kernel/head_85xx.S | 30 ++++++++++++++++-------------- 1 file changed, 16 insertions(+), 14 deletions(-) commit 276d5affbbaea4d369d1e5b9711cb2951037f6ee Author: Christophe Leroy Date: Tue Jul 2 15:51:30 2024 +0200 powerpc/e500: don't pre-check write access on data TLB error Don't pre-check write access on read-only pages on data TLB error. Load the TLB anyway and take a DSI exception when it happens. This avoids reading SPRN_ESR at every data TLB error exception. Link: https://lkml.kernel.org/r/8525518e1657d6032b7e980c1888102828d66950.1719928057.git.christophe.leroy@csgroup.eu Signed-off-by: Christophe Leroy Cc: Jason Gunthorpe Cc: Michael Ellerman Cc: Nicholas Piggin Cc: Oscar Salvador Cc: Peter Xu Signed-off-by: Andrew Morton arch/powerpc/kernel/head_85xx.S | 15 --------------- 1 file changed, 15 deletions(-) commit 84319905ca5f3759c42082e20ed978c81f4dead0 Author: Christophe Leroy Date: Tue Jul 2 15:51:29 2024 +0200 powerpc/e500: encode hugepage size in PTE bits Use PTE page size bits to encode hugepage size with the following format corresponding to the values expected in bits 52-55 in MAS1 register. Those bits are called TSIZE: 0001 4 Kbyte 0010 16 Kbyte 0011 64 Kbyte 0100 256 Kbyte 0101 1 Mbyte 0110 4 Mbyte 0111 16 Mbyte 1000 64 Mbyte 1001 256 Mbyte 1010 1 Gbyte 1011 4 Gbyte 1100 16 Gbyte 1101 64 Gbyte 1110 256 Gbyte 1111 1 Tbyte It corresponds to shift value minus 10 with lowest bit removed. It is not the value expected in the PTE in that field, but only e6500 performs HW based TLB loading and the e6500 reference manual explicitely says that this field is ignored. Also add pte_huge_size() which will be used later. Link: https://lkml.kernel.org/r/6f7ce82fa8c381d55f65342d77060fc55802e612.1719928057.git.christophe.leroy@csgroup.eu Signed-off-by: Christophe Leroy Cc: Jason Gunthorpe Cc: Michael Ellerman Cc: Nicholas Piggin Cc: Oscar Salvador Cc: Peter Xu Signed-off-by: Andrew Morton arch/powerpc/include/asm/nohash/hugetlb-e500.h | 9 +++++++++ arch/powerpc/include/asm/nohash/pte-e500.h | 28 ++++++++++++-------------- 2 files changed, 22 insertions(+), 15 deletions(-) commit 6b0e82791bd03b2326c7f7d8c1124c825742f2a4 Author: Christophe Leroy Date: Tue Jul 2 15:51:28 2024 +0200 powerpc/e500: switch to 64 bits PGD on 85xx (32 bits) At the time being when CONFIG_PTE_64BIT is selected, PTE entries are 64 bits but PGD entries are still 32 bits. In order to allow leaf PMD entries, switch the PGD to 64 bits entries. Link: https://lkml.kernel.org/r/ca85397df02564e5edc3a3c27b55cf43af3e4ef3.1719928057.git.christophe.leroy@csgroup.eu Signed-off-by: Christophe Leroy Cc: Jason Gunthorpe Cc: Michael Ellerman Cc: Nicholas Piggin Cc: Oscar Salvador Cc: Peter Xu Signed-off-by: Andrew Morton arch/powerpc/include/asm/pgtable-types.h | 4 ++++ arch/powerpc/kernel/head_85xx.S | 10 ++++++---- 2 files changed, 10 insertions(+), 4 deletions(-) commit e081c14744f4a93514069e1af1a7273d5451b909 Author: Christophe Leroy Date: Tue Jul 2 15:51:27 2024 +0200 powerpc/e500: remove enc and ind fields from struct mmu_psize_def enc field is hidden behind BOOK3E_PAGESZ_XX macros, and when you look closer you realise that this field is nothing else than the value of shift minus ten. So remove enc field and calculate tsize from shift field. Also remove inc field which is unused. Link: https://lkml.kernel.org/r/e99136779b5b0829c2c60d37f305a1410c65cf9b.1719928057.git.christophe.leroy@csgroup.eu Signed-off-by: Christophe Leroy Reviewed-by: Oscar Salvador Cc: Jason Gunthorpe Cc: Michael Ellerman Cc: Nicholas Piggin Cc: Peter Xu Signed-off-by: Andrew Morton arch/powerpc/include/asm/nohash/mmu-e500.h | 3 --- arch/powerpc/mm/nohash/book3e_pgtable.c | 4 ++-- arch/powerpc/mm/nohash/tlb.c | 9 +-------- arch/powerpc/mm/nohash/tlb_64e.c | 2 +- 4 files changed, 4 insertions(+), 14 deletions(-) commit b04c2da4ff89a06978da25c528378371b881e910 Author: Christophe Leroy Date: Tue Jul 2 15:51:26 2024 +0200 powerpc/8xx: simplify struct mmu_psize_def On 8xx, only the shift field is used in struct mmu_psize_def Remove other fields and related macros. Link: https://lkml.kernel.org/r/dd0587a9e8354005858c7f8c9a775ad05523b314.1719928057.git.christophe.leroy@csgroup.eu Signed-off-by: Christophe Leroy Reviewed-by: Oscar Salvador Cc: Jason Gunthorpe Cc: Michael Ellerman Cc: Nicholas Piggin Cc: Peter Xu Signed-off-by: Andrew Morton arch/powerpc/include/asm/nohash/32/mmu-8xx.h | 9 ++------- 1 file changed, 2 insertions(+), 7 deletions(-) commit 0549e76663730235a10395a7af7ad3d3ce6e2402 Author: Christophe Leroy Date: Tue Jul 2 15:51:25 2024 +0200 powerpc/8xx: rework support for 8M pages using contiguous PTE entries In order to fit better with standard Linux page tables layout, add support for 8M pages using contiguous PTE entries in a standard page table. Page tables will then be populated with 1024 similar entries and two PMD entries will point to that page table. The PMD entries also get a flag to tell it is addressing an 8M page, this is required for the HW tablewalk assistance. Link: https://lkml.kernel.org/r/8693d9a0408371043ca63bf9e4a9c140667af63e.1719928057.git.christophe.leroy@csgroup.eu Signed-off-by: Christophe Leroy Reviewed-by: Oscar Salvador Cc: Jason Gunthorpe Cc: Michael Ellerman Cc: Nicholas Piggin Cc: Peter Xu Signed-off-by: Andrew Morton arch/powerpc/include/asm/nohash/32/hugetlb-8xx.h | 38 ++++------------- arch/powerpc/include/asm/nohash/32/pte-8xx.h | 53 +++++++++++++++--------- arch/powerpc/include/asm/nohash/pgtable.h | 4 -- arch/powerpc/include/asm/page.h | 5 --- arch/powerpc/include/asm/pgtable.h | 3 ++ arch/powerpc/kernel/head_8xx.S | 10 +---- arch/powerpc/mm/hugetlbpage.c | 21 ++++++---- arch/powerpc/mm/kasan/8xx.c | 21 ++++++---- arch/powerpc/mm/nohash/8xx.c | 40 ++++++++---------- arch/powerpc/mm/pgtable.c | 27 ++++++++---- arch/powerpc/mm/pgtable_32.c | 2 +- arch/powerpc/platforms/Kconfig.cputype | 1 - 12 files changed, 111 insertions(+), 114 deletions(-) commit 7ea981070fd9ec24bc0111636038193aebb0289c Author: Christophe Leroy Date: Tue Jul 2 15:51:24 2024 +0200 powerpc/8xx: fix size given to set_huge_pte_at() set_huge_pte_at() expects the size of the hugepage as an int, not the psize which is the index of the page definition in table mmu_psize_defs[] Link: https://lkml.kernel.org/r/97f2090011e25d99b6b0aae73e22e1b921c5d1fb.1719928057.git.christophe.leroy@csgroup.eu Fixes: 935d4f0c6dc8 ("mm: hugetlb: add huge page size param to set_huge_pte_at()") Signed-off-by: Christophe Leroy Reviewed-by: Oscar Salvador Cc: Jason Gunthorpe Cc: Michael Ellerman Cc: Nicholas Piggin Cc: Peter Xu Signed-off-by: Andrew Morton arch/powerpc/mm/nohash/8xx.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) commit d6a1a9a3be8568e0cd37aeaa33dd115223eb0d82 Author: Christophe Leroy Date: Tue Jul 2 15:51:23 2024 +0200 powerpc/mm: allow hugepages without hugepd In preparation of implementing huge pages on powerpc 8xx without hugepd, enclose hugepd related code inside an ifdef CONFIG_ARCH_HAS_HUGEPD This also allows removing some stubs. Link: https://lkml.kernel.org/r/ada097ca8a4fa85a77f51719516ef2478800d77a.1719928057.git.christophe.leroy@csgroup.eu Signed-off-by: Christophe Leroy Reviewed-by: Oscar Salvador Cc: Jason Gunthorpe Cc: Michael Ellerman Cc: Nicholas Piggin Cc: Peter Xu Signed-off-by: Andrew Morton arch/powerpc/Kconfig | 1 - arch/powerpc/include/asm/book3s/32/pgalloc.h | 2 -- arch/powerpc/include/asm/hugetlb.h | 10 ++------- arch/powerpc/include/asm/nohash/pgtable.h | 2 +- arch/powerpc/mm/hugetlbpage.c | 33 ++++++++++++++++++++++++++++ arch/powerpc/mm/pgtable.c | 2 ++ arch/powerpc/platforms/Kconfig.cputype | 3 +++ 7 files changed, 41 insertions(+), 12 deletions(-) commit 6a9f66c84c4a1d8c874d10abf6a2be3e867d2764 Author: Christophe Leroy Date: Tue Jul 2 15:51:22 2024 +0200 powerpc/mm: fix __find_linux_pte() on 32 bits with PMD leaf entries Building on 32 bits with pmd_leaf() not returning always false leads to the following error: CC arch/powerpc/mm/pgtable.o arch/powerpc/mm/pgtable.c: In function '__find_linux_pte': arch/powerpc/mm/pgtable.c:506:1: error: function may return address of local variable [-Werror=return-local-addr] 506 | } | ^ arch/powerpc/mm/pgtable.c:394:15: note: declared here 394 | pud_t pud, *pudp; | ^~~ arch/powerpc/mm/pgtable.c:394:15: note: declared here This is due to pmd_offset() being a no-op in that case. So rework it for powerpc/32 so that pXd_offset() are used on real pointers and not on on-stack copies. Behind fixing the problem, it also has the advantage of simplifying __find_linux_pte() including the removal of stack frame: After this patch: 00000018 <__find_linux_pte>: 18: 2c 06 00 00 cmpwi r6,0 1c: 41 82 00 0c beq 28 <__find_linux_pte+0x10> 20: 39 20 00 00 li r9,0 24: 91 26 00 00 stw r9,0(r6) 28: 2f 85 00 00 cmpwi cr7,r5,0 2c: 41 9e 00 0c beq cr7,38 <__find_linux_pte+0x20> 30: 39 20 00 00 li r9,0 34: 99 25 00 00 stb r9,0(r5) 38: 54 89 65 3a rlwinm r9,r4,12,20,29 3c: 7c 63 48 2e lwzx r3,r3,r9 40: 2f 83 00 00 cmpwi cr7,r3,0 44: 41 9e 00 30 beq cr7,74 <__find_linux_pte+0x5c> 48: 54 69 07 3a rlwinm r9,r3,0,28,29 4c: 2f 89 00 0c cmpwi cr7,r9,12 50: 54 63 00 26 clrrwi r3,r3,12 54: 54 84 b5 36 rlwinm r4,r4,22,20,27 58: 3c 63 c0 00 addis r3,r3,-16384 5c: 7c 63 22 14 add r3,r3,r4 60: 4c be 00 20 bnelr+ cr7 64: 4d 82 00 20 beqlr 68: 39 20 00 17 li r9,23 6c: 91 26 00 00 stw r9,0(r6) 70: 4e 80 00 20 blr 74: 38 60 00 00 li r3,0 78: 4e 80 00 20 blr Before this patch: 00000018 <__find_linux_pte>: 18: 2c 06 00 00 cmpwi r6,0 1c: 94 21 ff e0 stwu r1,-32(r1) 20: 41 82 00 0c beq 2c <__find_linux_pte+0x14> 24: 39 20 00 00 li r9,0 28: 91 26 00 00 stw r9,0(r6) 2c: 2f 85 00 00 cmpwi cr7,r5,0 30: 41 9e 00 0c beq cr7,3c <__find_linux_pte+0x24> 34: 39 20 00 00 li r9,0 38: 99 25 00 00 stb r9,0(r5) 3c: 54 89 65 3a rlwinm r9,r4,12,20,29 40: 7c 63 48 2e lwzx r3,r3,r9 44: 54 69 07 3a rlwinm r9,r3,0,28,29 48: 2f 89 00 0c cmpwi cr7,r9,12 4c: 90 61 00 0c stw r3,12(r1) 50: 41 9e 00 4c beq cr7,9c <__find_linux_pte+0x84> 54: 80 61 00 0c lwz r3,12(r1) 58: 54 69 07 3a rlwinm r9,r3,0,28,29 5c: 2f 89 00 0c cmpwi cr7,r9,12 60: 90 61 00 08 stw r3,8(r1) 64: 41 9e 00 38 beq cr7,9c <__find_linux_pte+0x84> 68: 80 61 00 08 lwz r3,8(r1) 6c: 2f 83 00 00 cmpwi cr7,r3,0 70: 41 9e 00 54 beq cr7,c4 <__find_linux_pte+0xac> 74: 54 69 07 3a rlwinm r9,r3,0,28,29 78: 2f 89 00 0c cmpwi cr7,r9,12 7c: 54 69 00 26 clrrwi r9,r3,12 80: 54 8a b5 36 rlwinm r10,r4,22,20,27 84: 3c 69 c0 00 addis r3,r9,-16384 88: 7c 63 52 14 add r3,r3,r10 8c: 54 84 93 be srwi r4,r4,14 90: 41 9e 00 14 beq cr7,a4 <__find_linux_pte+0x8c> 94: 38 21 00 20 addi r1,r1,32 98: 4e 80 00 20 blr 9c: 54 69 00 26 clrrwi r9,r3,12 a0: 54 84 93 be srwi r4,r4,14 a4: 3c 69 c0 00 addis r3,r9,-16384 a8: 54 84 25 36 rlwinm r4,r4,4,20,27 ac: 7c 63 22 14 add r3,r3,r4 b0: 41 a2 ff e4 beq 94 <__find_linux_pte+0x7c> b4: 39 20 00 17 li r9,23 b8: 91 26 00 00 stw r9,0(r6) bc: 38 21 00 20 addi r1,r1,32 c0: 4e 80 00 20 blr c4: 38 60 00 00 li r3,0 c8: 38 21 00 20 addi r1,r1,32 cc: 4e 80 00 20 blr Link: https://lkml.kernel.org/r/50a3cfbab5b11890a0da027de5cb011a9d47ba89.1719928057.git.christophe.leroy@csgroup.eu Signed-off-by: Christophe Leroy Reviewed-by: Oscar Salvador Cc: Jason Gunthorpe Cc: Michael Ellerman Cc: Nicholas Piggin Cc: Peter Xu Signed-off-by: Andrew Morton arch/powerpc/mm/pgtable.c | 11 ++++++++++- 1 file changed, 10 insertions(+), 1 deletion(-) commit afc8969f6da223562221d7dc389f72fdc2038e35 Author: Christophe Leroy Date: Tue Jul 2 15:51:21 2024 +0200 powerpc/mm: remove _PAGE_PSIZE _PAGE_PSIZE macro is never used outside the place it is defined and is used only on 8xx and e500. Remove indirection, remove it and use its content directly. Link: https://lkml.kernel.org/r/c41da3b0ceda7311a50f0391cc4d54302ae15b74.1719928057.git.christophe.leroy@csgroup.eu Signed-off-by: Christophe Leroy Reviewed-by: Oscar Salvador Cc: Jason Gunthorpe Cc: Michael Ellerman Cc: Nicholas Piggin Cc: Peter Xu Signed-off-by: Andrew Morton arch/powerpc/include/asm/nohash/32/pte-44x.h | 3 --- arch/powerpc/include/asm/nohash/32/pte-85xx.h | 3 --- arch/powerpc/include/asm/nohash/32/pte-8xx.h | 5 ++--- arch/powerpc/include/asm/nohash/pte-e500.h | 4 +--- 4 files changed, 3 insertions(+), 12 deletions(-) commit e6c0c03245b14d6c205814aee67128257d0bea84 Author: Christophe Leroy Date: Tue Jul 2 15:51:20 2024 +0200 mm: provide mm_struct and address to huge_ptep_get() On powerpc 8xx huge_ptep_get() will need to know whether the given ptep is a PTE entry or a PMD entry. This cannot be known with the PMD entry itself because there is no easy way to know it from the content of the entry. So huge_ptep_get() will need to know either the size of the page or get the pmd. In order to be consistent with huge_ptep_get_and_clear(), give mm and address to huge_ptep_get(). Link: https://lkml.kernel.org/r/cc00c70dd384298796a4e1b25d6c4eb306d3af85.1719928057.git.christophe.leroy@csgroup.eu Signed-off-by: Christophe Leroy Reviewed-by: Oscar Salvador Cc: Jason Gunthorpe Cc: Michael Ellerman Cc: Nicholas Piggin Cc: Peter Xu Signed-off-by: Andrew Morton arch/arm/include/asm/hugetlb-3level.h | 4 ++-- arch/arm64/include/asm/hugetlb.h | 2 +- arch/arm64/mm/hugetlbpage.c | 2 +- arch/riscv/include/asm/hugetlb.h | 2 +- arch/riscv/mm/hugetlbpage.c | 2 +- arch/s390/include/asm/hugetlb.h | 4 ++-- arch/s390/mm/hugetlbpage.c | 4 ++-- fs/hugetlbfs/inode.c | 2 +- fs/proc/task_mmu.c | 10 ++++---- fs/userfaultfd.c | 2 +- include/asm-generic/hugetlb.h | 2 +- include/linux/swapops.h | 4 ++-- mm/damon/vaddr.c | 6 ++--- mm/gup.c | 2 +- mm/hmm.c | 2 +- mm/hugetlb.c | 44 +++++++++++++++++------------------ mm/memory-failure.c | 2 +- mm/mempolicy.c | 2 +- mm/migrate.c | 4 ++-- mm/mincore.c | 2 +- mm/userfaultfd.c | 2 +- 21 files changed, 53 insertions(+), 53 deletions(-) commit 18d095b2556e5e1292003c8e9f5d845ed42ef89b Author: Christophe Leroy Date: Tue Jul 2 15:51:19 2024 +0200 mm: define __pte_leaf_size() to also take a PMD entry On powerpc 8xx, when a page is 8M size, the information is in the PMD entry. So allow architectures to provide __pte_leaf_size() instead of pte_leaf_size() and provide the PMD entry to that function. When __pte_leaf_size() is not defined, define it as a pte_leaf_size() so that architectures not interested in the PMD arguments are not impacted. Only define a default pte_leaf_size() when __pte_leaf_size() is not defined to make sure nobody adds new calls to pte_leaf_size() in the core. Link: https://lkml.kernel.org/r/c7c008f0a314bf8029ad7288fdc908db1ec7e449.1719928057.git.christophe.leroy@csgroup.eu Signed-off-by: Christophe Leroy Reviewed-by: Oscar Salvador Cc: Jason Gunthorpe Cc: Michael Ellerman Cc: Nicholas Piggin Cc: Peter Xu Signed-off-by: Andrew Morton include/linux/pgtable.h | 3 +++ kernel/events/core.c | 2 +- 2 files changed, 4 insertions(+), 1 deletion(-) commit 0db46aaabe641e5565238dc3ef7ac2396a0c6286 Author: Michael Ellerman Date: Tue Jul 2 15:51:18 2024 +0200 powerpc/64e: drop unused TLB miss handlers There are two possibilities for book3e_htw_mode, PPC_HTW_E6500 or PPC_HTW_NONE. The TLB miss handlers are patched to use, respectively: - exc_[data|indstruction]_tlb_miss_e6500_book3e - exc_[data|indstruction]_tlb_miss_bolted_book3e Which means the default handlers are never used. Remove those, and use the bolted handlers (PPC_HTW_NONE) by default. Link: https://lkml.kernel.org/r/9a670adc1771fb1871fba93ace5372f7eadc286f.1719928057.git.christophe.leroy@csgroup.eu Signed-off-by: Michael Ellerman Signed-off-by: Christophe Leroy Cc: Jason Gunthorpe Cc: Nicholas Piggin Cc: Oscar Salvador Cc: Peter Xu Signed-off-by: Andrew Morton arch/powerpc/kernel/exceptions-64e.S | 4 +- arch/powerpc/mm/nohash/tlb_64e.c | 4 - arch/powerpc/mm/nohash/tlb_low_64e.S | 226 ----------------------------------- 3 files changed, 2 insertions(+), 232 deletions(-) commit 264488bf59864fa7a67983b9f1561c54ca71ddb3 Author: Michael Ellerman Date: Tue Jul 2 15:51:17 2024 +0200 powerpc/64e: consolidate TLB miss handler patching The 64e TLB miss handler patching is done in setup_mmu_htw(), and then again immediately afterward in early_init_mmu_global(). Consolidate it into a single location. Link: https://lkml.kernel.org/r/7033b37493fb48a3e5245b59d0a42afb75dabfc1.1719928057.git.christophe.leroy@csgroup.eu Signed-off-by: Michael Ellerman Signed-off-by: Christophe Leroy Cc: Jason Gunthorpe Cc: Nicholas Piggin Cc: Oscar Salvador Cc: Peter Xu Signed-off-by: Andrew Morton arch/powerpc/mm/nohash/tlb_64e.c | 38 +++++++++++++++----------------------- 1 file changed, 15 insertions(+), 23 deletions(-) commit aca69900d717f62ef3d4df671129b707f651af5d Author: Michael Ellerman Date: Tue Jul 2 15:51:16 2024 +0200 powerpc/64e: drop MMU_FTR_TYPE_FSL_E checks in 64-bit code All 64-bit Book3E have MMU_FTR_TYPE_FSL_E, since A2 was removed, so remove checks for it in 64-bit only code. Link: https://lkml.kernel.org/r/2b0b0bc9752e6cece222e4e2050358da70bb631d.1719928057.git.christophe.leroy@csgroup.eu Signed-off-by: Michael Ellerman Signed-off-by: Christophe Leroy Cc: Jason Gunthorpe Cc: Nicholas Piggin Cc: Oscar Salvador Cc: Peter Xu Signed-off-by: Andrew Morton arch/powerpc/kernel/setup_64.c | 6 +-- arch/powerpc/mm/nohash/tlb_64e.c | 97 +++++++++++++++------------------------- 2 files changed, 38 insertions(+), 65 deletions(-) commit ceb9314fd8ecc92467369c7463cb0bed728607fa Author: Michael Ellerman Date: Tue Jul 2 15:51:15 2024 +0200 powerpc/64e: drop E500 ifdefs in 64-bit code All 64-bit Book3E have E500=y, so drop the unneeded ifdefs. Link: https://lkml.kernel.org/r/7fb88809c88a1b774063eda602a9333079403f83.1719928057.git.christophe.leroy@csgroup.eu Signed-off-by: Michael Ellerman Signed-off-by: Christophe Leroy Cc: Jason Gunthorpe Cc: Nicholas Piggin Cc: Oscar Salvador Cc: Peter Xu Signed-off-by: Andrew Morton arch/powerpc/mm/nohash/tlb_64e.c | 12 ------------ 1 file changed, 12 deletions(-) commit a898530eea3d0ba08c17a60865995a3bb468d1bc Author: Michael Ellerman Date: Tue Jul 2 15:51:14 2024 +0200 powerpc/64e: split out nohash Book3E 64-bit code A reasonable chunk of nohash/tlb.c is 64-bit only code, split it out into a separate file. Link: https://lkml.kernel.org/r/cb2b118f9d8a86f82d01bfb9ad309d1d304480a1.1719928057.git.christophe.leroy@csgroup.eu Signed-off-by: Michael Ellerman Signed-off-by: Christophe Leroy Cc: Jason Gunthorpe Cc: Nicholas Piggin Cc: Oscar Salvador Cc: Peter Xu Signed-off-by: Andrew Morton arch/powerpc/mm/nohash/Makefile | 2 +- arch/powerpc/mm/nohash/tlb.c | 343 +------------------------------------ arch/powerpc/mm/nohash/tlb_64e.c | 361 +++++++++++++++++++++++++++++++++++++++ 3 files changed, 363 insertions(+), 343 deletions(-) commit 88715b6e5d529f4ef3830ad2a893e4624c6af0b8 Author: Michael Ellerman Date: Tue Jul 2 15:51:13 2024 +0200 powerpc/64e: remove unused IBM HTW code Patch series "Reimplement huge pages without hugepd on powerpc (8xx, e500, book3s/64)", v7. Unlike most architectures, powerpc 8xx HW requires a two-level pagetable topology for all page sizes. So a leaf PMD-contig approach is not feasible as such. Possible sizes on 8xx are 4k, 16k, 512k and 8M. First level (PGD/PMD) covers 4M per entry. For 8M pages, two PMD entries must point to a single entry level-2 page table. Until now that was done using hugepd. This series changes it to use standard page tables where the entry is replicated 1024 times on each of the two pagetables refered by the two associated PMD entries for that 8M page. For e500 and book3s/64 there are less constraints because it is not tied to the HW assisted tablewalk like on 8xx, so it is easier to use leaf PMDs (and PUDs). On e500 the supported page sizes are 4M, 16M, 64M, 256M and 1G. All at PMD level on e500/32 (mpc85xx) and mix of PMD and PUD for e500/64. We encode page size with 4 available bits in PTE entries. On e300/32 PGD entries size is increases to 64 bits in order to allow leaf-PMD entries because PTE are 64 bits on e500. On book3s/64 only the hash-4k mode is concerned. It supports 16M pages as cont-PMD and 16G pages as cont-PUD. In other modes (radix-4k, radix-6k and hash-64k) the sizes match with PMD and PUD sizes so that's just leaf entries. The hash processing make things a bit more complex. To ease things, __hash_page_huge() is modified to bail out when DIRTY or ACCESSED bits are missing, leaving it to mm core to fix it. This patch (of 23): The nohash HTW_IBM (Hardware Table Walk) code is unused since support for A2 was removed in commit fb5a515704d7 ("powerpc: Remove platforms/ wsp and associated pieces") (2014). The remaining supported CPUs use either no HTW (data_tlb_miss_bolted), or the e6500 HTW (data_tlb_miss_e6500). Link: https://lkml.kernel.org/r/cover.1719928057.git.christophe.leroy@csgroup.eu Link: https://lkml.kernel.org/r/820dd1385ecc931f07b0d7a0fa827b1613917ab6.1719928057.git.christophe.leroy@csgroup.eu Signed-off-by: Michael Ellerman Signed-off-by: Christophe Leroy Cc: Jason Gunthorpe Cc: Nicholas Piggin Cc: Oscar Salvador Cc: Peter Xu Signed-off-by: Andrew Morton arch/powerpc/include/asm/nohash/mmu-e500.h | 3 +- arch/powerpc/mm/nohash/tlb.c | 57 +-------- arch/powerpc/mm/nohash/tlb_low_64e.S | 195 ----------------------------- 3 files changed, 2 insertions(+), 253 deletions(-) commit 791abe1e420c3dad6ddbd0a6c40467e9e24059b7 Author: Sergey Senozhatsky Date: Mon Jul 1 12:11:37 2024 +0900 zsmalloc: rename class stat mutators A cosmetic change. o Rename class_stat_inc() and class_stat_dec() to class_stat_add() and class_stat_sub() correspondingly. inc/dec are usually associated with +1/-1 modifications, while zsmlloc can modify stats by up to ->objs_per_zspage. Use add/sub (follow atomics naming). o Rename zs_stat_get() to class_stat_read() get() is usually associated with ref-counting and is paired with put(). zs_stat_get() simply reads class stat so rename to reflect it. (This also follows atomics naming). Link: https://lkml.kernel.org/r/20240701031140.3756345-1-senozhatsky@chromium.org Signed-off-by: Sergey Senozhatsky Reviewed-by: Chengming Zhou Cc: Minchan Kim Signed-off-by: Andrew Morton mm/zsmalloc.c | 38 +++++++++++++++++++------------------- 1 file changed, 19 insertions(+), 19 deletions(-) commit 9b89e018990de47c72ef8b2ca29204f88fda8f05 Author: Lance Yang Date: Fri Jun 28 21:07:50 2024 +0800 mm: add docs for per-order mTHP split counters This commit introduces documentation for mTHP split counters in transhuge.rst. [ioworker0@gmail.com: improve the doc as suggested by Ryan] Link: https://lkml.kernel.org/r/20240704012905.42971-3-ioworker0@gmail.com [ioworker0@gmail.com: tweak Documentation/admin-guide/mm/transhuge.rst] Link: https://lkml.kernel.org/r/20240707013659.1151-1-ioworker0@gmail.com Link: https://lkml.kernel.org/r/20240628130750.73097-3-ioworker0@gmail.com Signed-off-by: Mingzhe Yang Signed-off-by: Lance Yang Reviewed-by: Barry Song Reviewed-by: Ryan Roberts Acked-by: David Hildenbrand Cc: Bang Li Cc: Baolin Wang Cc: Yang Shi Cc: Zi Yan Signed-off-by: Andrew Morton Documentation/admin-guide/mm/transhuge.rst | 19 +++++++++++++++---- 1 file changed, 15 insertions(+), 4 deletions(-) commit f216c845f3c772e54d27fe209fd300b10e7bf54a Author: Lance Yang Date: Fri Jun 28 21:07:49 2024 +0800 mm: add per-order mTHP split counters Patch series "mm: introduce per-order mTHP split counters", v3. At present, the split counters in THP statistics no longer include PTE-mapped mTHP. Therefore, we want to introduce per-order mTHP split counters to monitor the frequency of mTHP splits. This will assist developers in better analyzing and optimizing system performance. /sys/kernel/mm/transparent_hugepage/hugepages-/stats split split_failed split_deferred This patch (of 2): Currently, the split counters in THP statistics no longer include PTE-mapped mTHP. Therefore, we propose introducing per-order mTHP split counters to monitor the frequency of mTHP splits. This will help developers better analyze and optimize system performance. /sys/kernel/mm/transparent_hugepage/hugepages-/stats split split_failed split_deferred [ioworker0@gmail.com: make things more readable, per Barry and Baolin] Link: https://lkml.kernel.org/r/20240704012905.42971-2-ioworker0@gmail.com [ioworker0@gmail.com: use == for `order' test, per David] Link: https://lkml.kernel.org/r/20240705113119.82210-1-ioworker0@gmail.com Link: https://lkml.kernel.org/r/20240704012905.42971-1-ioworker0@gmail.com Link: https://lkml.kernel.org/r/20240704012905.42971-2-ioworker0@gmail.com Link: https://lkml.kernel.org/r/20240628130750.73097-1-ioworker0@gmail.com Link: https://lkml.kernel.org/r/20240628130750.73097-2-ioworker0@gmail.com Signed-off-by: Mingzhe Yang Signed-off-by: Lance Yang Reviewed-by: Ryan Roberts Acked-by: Barry Song Reviewed-by: Baolin Wang Acked-by: David Hildenbrand Cc: Bang Li Cc: Yang Shi Cc: Zi Yan Signed-off-by: Andrew Morton include/linux/huge_mm.h | 3 +++ mm/huge_memory.c | 12 ++++++++++-- 2 files changed, 13 insertions(+), 2 deletions(-) commit d468f1b8cb8e4c28ebb2282af2dd4021b60df7cb Author: Chengming Zhou Date: Thu Jun 27 15:59:59 2024 +0800 mm/zsmalloc: move record_obj() into obj_malloc() We always record_obj() to make handle points to object after obj_malloc(), so simplify the code by moving record_obj() into obj_malloc(). There should be no functional change. Link: https://lkml.kernel.org/r/20240627075959.611783-2-chengming.zhou@linux.dev Signed-off-by: Chengming Zhou Reviewed-by: Sergey Senozhatsky Cc: Minchan Kim Signed-off-by: Andrew Morton mm/zsmalloc.c | 15 ++++++--------- 1 file changed, 6 insertions(+), 9 deletions(-) commit 538148f9ba9e3136a877881e72ccbe56733daae2 Author: Chengming Zhou Date: Thu Jun 27 15:59:58 2024 +0800 mm/zsmalloc: clarify class per-fullness zspage counts We always use insert_zspage() and remove_zspage() to update zspage's fullness location, which will account correctly. But this special async free path use "splice" instead of remove_zspage(), so the per-fullness zspage count for ZS_INUSE_RATIO_0 won't decrease. Clean things up by decreasing when iterate over the zspage free list. This doesn't actually fix anything. ZS_INUSE_RATIO_0 is just a "placeholder" which is never used anywhere. Link: https://lkml.kernel.org/r/20240627075959.611783-1-chengming.zhou@linux.dev Signed-off-by: Chengming Zhou Cc: Minchan Kim Cc: Sergey Senozhatsky Signed-off-by: Andrew Morton mm/zsmalloc.c | 1 + 1 file changed, 1 insertion(+) commit 81510a0eaa6916c2fbb0b2639f3e617a296979a3 Author: Andrii Nakryiko Date: Thu Jun 27 10:08:58 2024 -0700 selftests/proc: add PROCMAP_QUERY ioctl tests Extend existing proc-pid-vm.c tests with PROCMAP_QUERY ioctl() API. Test a few successful and negative cases, validating querying filtering and exact vs next VMA logic works as expected. Link: https://lkml.kernel.org/r/20240627170900.1672542-7-andrii@kernel.org Signed-off-by: Andrii Nakryiko Acked-by: Liam R. Howlett Cc: Alexey Dobriyan Cc: Al Viro Cc: Christian Brauner Cc: Greg Kroah-Hartman Cc: Mike Rapoport (IBM) Cc: Suren Baghdasaryan Cc: Andi Kleen Cc: Arnd Bergmann Cc: Stephen Rothwell Signed-off-by: Andrew Morton tools/testing/selftests/proc/Makefile | 1 + tools/testing/selftests/proc/proc-pid-vm.c | 86 ++++++++++++++++++++++++++++++ 2 files changed, 87 insertions(+) commit 77179b6f30811bf0bd2f62fcdf235997123e70dc Author: Andrii Nakryiko Date: Thu Jun 27 10:08:57 2024 -0700 tools: sync uapi/linux/fs.h header into tools subdir We need this UAPI header in tools/include subdirectory for using it from BPF selftests. Link: https://lkml.kernel.org/r/20240627170900.1672542-6-andrii@kernel.org Signed-off-by: Andrii Nakryiko Acked-by: Liam R. Howlett Cc: Alexey Dobriyan Cc: Al Viro Cc: Christian Brauner Cc: Greg Kroah-Hartman Cc: Mike Rapoport (IBM) Cc: Suren Baghdasaryan Cc: Andi Kleen Cc: Arnd Bergmann Cc: Stephen Rothwell Signed-off-by: Andrew Morton tools/include/uapi/linux/fs.h | 180 +++++++++++++++++++++++++++++++++++++++--- 1 file changed, 170 insertions(+), 10 deletions(-) commit c10cb9148e5175e65326f81930ecebd0147e2721 Author: Andrii Nakryiko Date: Thu Jun 27 10:08:56 2024 -0700 docs/procfs: call out ioctl()-based PROCMAP_QUERY command existence Call out PROCMAP_QUERY ioctl() existence in the section describing /proc/PID/maps file in documentation. We refer user to UAPI header for low-level details of this programmatic interface. Link: https://lkml.kernel.org/r/20240627170900.1672542-5-andrii@kernel.org Signed-off-by: Andrii Nakryiko Acked-by: Liam R. Howlett Cc: Alexey Dobriyan Cc: Al Viro Cc: Christian Brauner Cc: Greg Kroah-Hartman Cc: Mike Rapoport (IBM) Cc: Suren Baghdasaryan Cc: Andi Kleen Cc: Arnd Bergmann Cc: Stephen Rothwell Signed-off-by: Andrew Morton Documentation/filesystems/proc.rst | 9 +++++++++ 1 file changed, 9 insertions(+) commit bfc69fd05ef9b6416f4811aafafb7f2b34daa000 Author: Andrii Nakryiko Date: Thu Jun 27 10:08:55 2024 -0700 fs/procfs: add build ID fetching to PROCMAP_QUERY API The need to get ELF build ID reliably is an important aspect when dealing with profiling and stack trace symbolization, and /proc//maps textual representation doesn't help with this. To get backing file's ELF build ID, application has to first resolve VMA, then use it's start/end address range to follow a special /proc//map_files/- symlink to open the ELF file (this is necessary because backing file might have been removed from the disk or was already replaced with another binary in the same file path. Such approach, beyond just adding complexity of having to do a bunch of extra work, has extra security implications. Because application opens underlying ELF file and needs read access to its entire contents (as far as kernel is concerned), kernel puts additional capable() checks on following /proc//map_files/- symlink. And that makes sense in general. But in the case of build ID, profiler/symbolizer doesn't need the contents of ELF file, per se. It's only build ID that is of interest, and ELF build ID itself doesn't provide any sensitive information. So this patch adds a way to request backing file's ELF build ID along the rest of VMA information in the same API. User has control over whether this piece of information is requested or not by either setting build_id_size field to zero or non-zero maximum buffer size they provided through build_id_addr field (which encodes user pointer as __u64 field). This is a completely optional piece of information, and so has no performance implications for user cases that don't care about build ID, while improving performance and simplifying the setup for those application that do need it. Kernel already implements build ID fetching, which is used from BPF subsystem. We are reusing this code here, but plan a follow up changes to make it work better under more relaxed assumption (compared to what existing code assumes) of being called from user process context, in which page faults are allowed. BPF-specific implementation currently bails out if necessary part of ELF file is not paged in, all due to extra BPF-specific restrictions (like the need to fetch build ID in restrictive contexts such as NMI handler). [andrii@kernel.org: fix integer to pointer cast warning in do_procmap_query()] Link: https://lkml.kernel.org/r/20240701174805.1897344-1-andrii@kernel.org Link: https://lkml.kernel.org/r/20240627170900.1672542-4-andrii@kernel.org Signed-off-by: Andrii Nakryiko Acked-by: Liam R. Howlett Cc: Alexey Dobriyan Cc: Al Viro Cc: Christian Brauner Cc: Greg Kroah-Hartman Cc: Mike Rapoport (IBM) Cc: Suren Baghdasaryan Cc: Andi Kleen Cc: Arnd Bergmann Cc: Stephen Rothwell Signed-off-by: Andrew Morton fs/proc/task_mmu.c | 27 +++++++++++++++++++++++++-- include/uapi/linux/fs.h | 28 ++++++++++++++++++++++++++++ 2 files changed, 53 insertions(+), 2 deletions(-) commit ed5d583a88a9207b866c14ba834984c6f3c51d23 Author: Andrii Nakryiko Date: Thu Jun 27 10:08:54 2024 -0700 fs/procfs: implement efficient VMA querying API for /proc//maps /proc//maps file is extremely useful in practice for various tasks involving figuring out process memory layout, what files are backing any given memory range, etc. One important class of applications that absolutely rely on this are profilers/stack symbolizers (perf tool being one of them). Patterns of use differ, but they generally would fall into two categories. In on-demand pattern, a profiler/symbolizer would normally capture stack trace containing absolute memory addresses of some functions, and would then use /proc//maps file to find corresponding backing ELF files (normally, only executable VMAs are of interest), file offsets within them, and then continue from there to get yet more information (ELF symbols, DWARF information) to get human-readable symbolic information. This pattern is used by Meta's fleet-wide profiler, as one example. In preprocessing pattern, application doesn't know the set of addresses of interest, so it has to fetch all relevant VMAs (again, probably only executable ones), store or cache them, then proceed with profiling and stack trace capture. Once done, it would do symbolization based on stored VMA information. This can happen at much later point in time. This patterns is used by perf tool, as an example. In either case, there are both performance and correctness requirement involved. This address to VMA information translation has to be done as efficiently as possible, but also not miss any VMA (especially in the case of loading/unloading shared libraries). In practice, correctness can't be guaranteed (due to process dying before VMA data can be captured, or shared library being unloaded, etc), but any effort to maximize the chance of finding the VMA is appreciated. Unfortunately, for all the /proc//maps file universality and usefulness, it doesn't fit the above use cases 100%. First, it's main purpose is to emit all VMAs sequentially, but in practice captured addresses would fall only into a smaller subset of all process' VMAs, mainly containing executable text. Yet, library would need to parse most or all of the contents to find needed VMAs, as there is no way to skip VMAs that are of no use. Efficient library can do the linear pass and it is still relatively efficient, but it's definitely an overhead that can be avoided, if there was a way to do more targeted querying of the relevant VMA information. Second, it's a text based interface, which makes its programmatic use from applications and libraries more cumbersome and inefficient due to the need to handle text parsing to get necessary pieces of information. The overhead is actually payed both by kernel, formatting originally binary VMA data into text, and then by user space application, parsing it back into binary data for further use. For the on-demand pattern of usage, described above, another problem when writing generic stack trace symbolization library is an unfortunate performance-vs-correctness tradeoff that needs to be made. Library has to make a decision to either cache parsed contents of /proc//maps (after initial processing) to service future requests (if application requests to symbolize another set of addresses (for the same process), captured at some later time, which is typical for periodic/continuous profiling cases) to avoid higher costs of re-parsing this file. Or it has to choose to cache the contents in memory to speed up future requests. In the former case, more memory is used for the cache and there is a risk of getting stale data if application loads or unloads shared libraries, or otherwise changed its set of VMAs somehow, e.g., through additional mmap() calls. In the latter case, it's the performance hit that comes from re-opening the file and re-parsing its contents all over again. This patch aims to solve this problem by providing a new API built on top of /proc//maps. It's meant to address both non-selectiveness and text nature of /proc//maps, by giving user more control of what sort of VMA(s) needs to be queried, and being binary-based interface eliminates the overhead of text formatting (on kernel side) and parsing (on user space side). It's also designed to be extensible and forward/backward compatible by including required struct size field, which user has to provide. We use established copy_struct_from_user() approach to handle extensibility. User has a choice to pick either getting VMA that covers provided address or -ENOENT if none is found (exact, least surprising, case). Or, with an extra query flag (PROCMAP_QUERY_COVERING_OR_NEXT_VMA), they can get either VMA that covers the address (if there is one), or the closest next VMA (i.e., VMA with the smallest vm_start > addr). The latter allows more efficient use, but, given it could be a surprising behavior, requires an explicit opt-in. There is another query flag that is useful for some use cases. PROCMAP_QUERY_FILE_BACKED_VMA instructs this API to only return file-backed VMAs. Combining this with PROCMAP_QUERY_COVERING_OR_NEXT_VMA makes it possible to efficiently iterate only file-backed VMAs of the process, which is what profilers/symbolizers are normally interested in. All the above querying flags can be combined with (also optional) set of desired VMA permissions flags. This allows to, for example, iterate only an executable subset of VMAs, which is what preprocessing pattern, used by perf tool, would benefit from, as the assumption is that captured stack traces would have addresses of executable code. This saves time by skipping non-executable VMAs altogether efficienty. All these querying flags (modifiers) are orthogonal and can be combined in a semantically meaningful and natural way. Basing this ioctl()-based API on top of /proc//maps's FD makes sense given it's querying the same set of VMA data. It's also benefitial because permission checks for /proc//maps is performed at open time once, and the actual data read of text contents of /proc//maps is done without further permission checks. We piggyback on this pattern with ioctl()-based API as well, as that's a desired property. Both for performance reasons, but also for security and flexibility reasons. Allowing application to open an FD for /proc/self/maps without any extra capabilities, and then passing it to some sort of profiling agent through Unix-domain socket, would allow such profiling agent to not require some of the capabilities that are otherwise expected when opening /proc//maps file for *another* process. This is a desirable property for some more restricted setups. This new ioctl-based implementation doesn't interfere with seq_file-based implementation of /proc//maps textual interface, and so could be used together or independently without paying any price for that. Note also, that fetching VMA name (e.g., backing file path, or special hard-coded or user-provided names) is optional just like build ID. If user sets vma_name_size to zero, kernel code won't attempt to retrieve it, saving resources. Earlier versions of this patch set were adding per-VMA locking, which is why we have a code structure that is ready for abstracting mmap_lock vs vm_lock differences (query_vma_setup(), query_vma_teardown(), and query_vma_find_by_addr()), but given anon_vma_name() is not yet compatible with per-VMA locking, initial implementation sticks to using only mmap_lock for now. It will be easy to add back per-VMA locking once all the pieces are ready later on. Which is why we keep existing code structure with setup/teardown/query helper functions. [andrii@kernel.org: improve PROCMAP_QUERY's compat mode handling] Link: https://lkml.kernel.org/r/20240701174805.1897344-2-andrii@kernel.org Link: https://lkml.kernel.org/r/20240627170900.1672542-3-andrii@kernel.org Signed-off-by: Andrii Nakryiko Acked-by: Liam R. Howlett Cc: Alexey Dobriyan Cc: Al Viro Cc: Christian Brauner Cc: Greg Kroah-Hartman Cc: Mike Rapoport (IBM) Cc: Suren Baghdasaryan Cc: Andi Kleen Cc: Arnd Bergmann Cc: Stephen Rothwell Signed-off-by: Andrew Morton fs/proc/task_mmu.c | 235 ++++++++++++++++++++++++++++++++++++++++++++++++ include/uapi/linux/fs.h | 130 ++++++++++++++++++++++++++- 2 files changed, 364 insertions(+), 1 deletion(-) commit acd4b2ecf3bb24a781aad7f703243fa00eb7efbb Author: Andrii Nakryiko Date: Thu Jun 27 10:08:53 2024 -0700 fs/procfs: extract logic for getting VMA name constituents Patch series "ioctl()-based API to query VMAs from /proc//maps", v6. Implement binary ioctl()-based interface to /proc//maps file to allow applications to query VMA information more efficiently than reading *all* VMAs nonselectively through text-based interface of /proc//maps file. Patch #2 goes into a lot of details and background on some common patterns of using /proc//maps in the area of performance profiling and subsequent symbolization of captured stack traces. As mentioned in that patch, patterns of VMA querying can differ depending on specific use case, but can generally be grouped into two main categories: the need to query a small subset of VMAs covering a given batch of addresses, or reading/storing/caching all (typically, executable) VMAs upfront for later processing. The new PROCMAP_QUERY ioctl() API added in this patch set was motivated by the former pattern of usage. Earlier revisions had a patch adding a tool that faithfully reproduces an efficient VMA matching pass of a symbolizer, collecting a subset of covering VMAs for a given set of addresses as efficiently as possible. This tool served both as a testing ground, as well as a benchmarking tool. It implements everything both for currently existing text-based /proc//maps interface, as well as for newly-added PROCMAP_QUERY ioctl(). This revision dropped the tool from the patch set and, once the API lands upstream, this tool might be added separately on Github as an example. Based on discussion on earlier revisions of this patch set, it turned out that this ioctl() API is competitive with highly-optimized text-based pre-processing pattern that perf tool is using. Based on perf discussion, this revision adds more flexibility in specifying a subset of VMAs that are of interest. Now it's possible to specify desired permissions of VMAs (e.g., request only executable ones) and/or restrict to only a subset of VMAs that have file backing. This further improves the efficiency when using this new API thanks to more selective (executable VMAs only) querying. In addition to a custom benchmarking tool, and experimental perf integration (available at [0]), Daniel Mueller has since also implemented an experimental integration into blazesym (see [1]), a library used for stack trace symbolization by our server fleet-wide profiler and another on-device profiler agent that runs on weaker ARM devices. The latter ARM-based device profiler is especially sensitive to performance, and so we benchmarked and compared text-based /proc//maps solution to the equivalent one using PROCMAP_QUERY ioctl(). Results are very encouraging, giving us 5x improvement for end-to-end so-called "address normalization" pass, which is the part of the symbolization process that happens locally on ARM device, before being sent out for further heavier-weight processing on more powerful remote server. Note that this is not an artificial microbenchmark. It's a full end-to-end API call being measured with real-world data on real-world device. TEXT-BASED ========== Benchmarking main/normalize_process_no_build_ids_uncached_maps main/normalize_process_no_build_ids_uncached_maps time: [49.777 µs 49.982 µs 50.250 µs] IOCTL-BASED =========== Benchmarking main/normalize_process_no_build_ids_uncached_maps main/normalize_process_no_build_ids_uncached_maps time: [10.328 µs 10.391 µs 10.457 µs] change: [−79.453% −79.304% −79.166%] (p = 0.00 < 0.02) Performance has improved. You can see above that we see the drop from 50µs down to 10µs for exactly the same amount of work, with the same data and target process. With the aforementioned custom tool, we see about ~40x improvement (it might vary a bit, depending on a specific captured set of addresses). And even for perf-based benchmark it's on par or slightly ahead when using permission-based filtering (fetching only executable VMAs). Earlier revisions attempted to use per-VMA locking, if kernel was compiled with CONFIG_PER_VMA_LOCK=y, but it turned out that anon_vma_name() is not yet compatible with per-VMA locking and assumes mmap_lock to be taken, which makes the use of per-VMA locking for this API premature. It was agreed ([2]) to continue for now with just mmap_lock, but the code structure is such that it should be easy to add per-VMA locking support once all the pieces are ready. One thing that did not change was basing this new API as an ioctl() command on /proc//maps file. An ioctl-based API on top of pidfd was considered, but has its own downsides. Implementing ioctl() directly on pidfd will cause access permission checks on every single ioctl(), which leads to performance concerns and potential spam of capable() audit messages. It also prevents a nice pattern, possible with /proc//maps, in which application opens /proc/self/maps FD (requiring no additional capabilities) and passed this FD to profiling agent for querying. To achieve similar pattern, a new file would have to be created from pidf just for VMA querying, which is considered to be inferior to just querying /proc//maps FD as proposed in current approach. These aspects were discussed in the hallway track at recent LSF/MM/BPF 2024 and sticking to procfs ioctl() was the final agreement we arrived at. [0] https://github.com/anakryiko/linux/commits/procfs-proc-maps-ioctl-v2/ [1] https://github.com/libbpf/blazesym/pull/675 [2] https://lore.kernel.org/bpf/7rm3izyq2vjp5evdjc7c6z4crdd3oerpiknumdnmmemwyiwx7t@hleldw7iozi3/ This patch (of 6): Extract generic logic to fetch relevant pieces of data to describe VMA name. This could be just some string (either special constant or user-provided), or a string with some formatted wrapping text (e.g., "[anon_shmem:]"), or, commonly, file path. seq_file-based logic has different methods to handle all three cases, but they are currently mixed in with extracting underlying sources of data. This patch splits this into data fetching and data formatting, so that data fetching can be reused later on. There should be no functional changes. Link: https://lkml.kernel.org/r/20240627170900.1672542-1-andrii@kernel.org Link: https://lkml.kernel.org/r/20240627170900.1672542-2-andrii@kernel.org Signed-off-by: Andrii Nakryiko Acked-by: Liam R. Howlett Cc: Alexey Dobriyan Cc: Al Viro Cc: Christian Brauner Cc: Greg Kroah-Hartman Cc: Mike Rapoport (IBM) Cc: Suren Baghdasaryan Cc: Andi Kleen Cc: Arnd Bergmann Cc: Stephen Rothwell Signed-off-by: Andrew Morton fs/proc/task_mmu.c | 125 ++++++++++++++++++++++++++++++----------------------- 1 file changed, 71 insertions(+), 54 deletions(-) commit 8d42e2a91dcf86b34461cd7f709797805afa9f43 Author: Vivek Kasireddy Date: Sun Jun 23 23:36:17 2024 -0700 selftests/udmabuf: add tests to verify data after page migration Since the memfd pages associated with a udmabuf may be migrated as part of udmabuf create, we need to verify the data coherency after successful migration. The new tests added in this patch try to do just that using 4k sized pages and also 2 MB sized huge pages for the memfd. Successful completion of the tests would mean that there is no disconnect between the memfd pages and the ones associated with a udmabuf. And, these tests can also be augmented in the future to test newer udmabuf features (such as handling memfd hole punch). The idea for these tests comes from a patch by Mike Kravetz here: https://lists.freedesktop.org/archives/dri-devel/2023-June/410623.html v1->v2: (suggestions from Shuah) - Use ksft_* functions to print and capture results of tests - Use appropriate KSFT_* status codes for exit() - Add Mike Kravetz's suggested-by tag Link: https://lkml.kernel.org/r/20240624063952.1572359-10-vivek.kasireddy@intel.com Signed-off-by: Vivek Kasireddy Suggested-by: Mike Kravetz Acked-by: Dave Airlie Acked-by: Gerd Hoffmann Cc: Shuah Khan Cc: David Hildenbrand Cc: Daniel Vetter Cc: Hugh Dickins Cc: Peter Xu Cc: Jason Gunthorpe Cc: Dongwon Kim Cc: Junxiao Chang Cc: Arnd Bergmann Cc: Christoph Hellwig Cc: Christoph Hellwig Cc: Matthew Wilcox (Oracle) Cc: Oscar Salvador Signed-off-by: Andrew Morton tools/testing/selftests/drivers/dma-buf/udmabuf.c | 214 ++++++++++++++++++---- 1 file changed, 183 insertions(+), 31 deletions(-) commit c6a3194c05e7e6fd0e8fbfb1720084ae2503c4ac Author: Vivek Kasireddy Date: Sun Jun 23 23:36:16 2024 -0700 udmabuf: pin the pages using memfd_pin_folios() API Using memfd_pin_folios() will ensure that the pages are pinned correctly using FOLL_PIN. And, this also ensures that we don't accidentally break features such as memory hotunplug as it would not allow pinning pages in the movable zone. Using this new API also simplifies the code as we no longer have to deal with extracting individual pages from their mappings or handle shmem and hugetlb cases separately. Link: https://lkml.kernel.org/r/20240624063952.1572359-9-vivek.kasireddy@intel.com Signed-off-by: Vivek Kasireddy Acked-by: Dave Airlie Acked-by: Gerd Hoffmann Cc: David Hildenbrand Cc: Matthew Wilcox Cc: Daniel Vetter Cc: Hugh Dickins Cc: Peter Xu Cc: Jason Gunthorpe Cc: Dongwon Kim Cc: Junxiao Chang Cc: Arnd Bergmann Cc: Christoph Hellwig Cc: Christoph Hellwig Cc: Mike Kravetz Cc: Oscar Salvador Cc: Shuah Khan Signed-off-by: Andrew Morton drivers/dma-buf/udmabuf.c | 155 ++++++++++++++++++++++++---------------------- 1 file changed, 80 insertions(+), 75 deletions(-) commit 5e72b2b41a21e596dcff489810ea760adeb2ef30 Author: Vivek Kasireddy Date: Sun Jun 23 23:36:15 2024 -0700 udmabuf: convert udmabuf driver to use folios This is mainly a preparatory patch to use memfd_pin_folios() API for pinning folios. Using folios instead of pages makes sense as the udmabuf driver needs to handle both shmem and hugetlb cases. And, using the memfd_pin_folios() API makes this easier as we no longer need to separately handle shmem vs hugetlb cases in the udmabuf driver. Note that, the function vmap_udmabuf() still needs a list of pages; so, we collect all the head pages into a local array in this case. Other changes in this patch include the addition of helpers for checking the memfd seals and exporting dmabuf. Moving code from udmabuf_create() into these helpers improves readability given that udmabuf_create() is a bit long. Link: https://lkml.kernel.org/r/20240624063952.1572359-8-vivek.kasireddy@intel.com Signed-off-by: Vivek Kasireddy Acked-by: Dave Airlie Acked-by: Gerd Hoffmann Cc: David Hildenbrand Cc: Matthew Wilcox Cc: Daniel Vetter Cc: Hugh Dickins Cc: Peter Xu Cc: Jason Gunthorpe Cc: Dongwon Kim Cc: Junxiao Chang Cc: Arnd Bergmann Cc: Christoph Hellwig Cc: Christoph Hellwig Cc: Mike Kravetz Cc: Oscar Salvador Cc: Shuah Khan Signed-off-by: Andrew Morton drivers/dma-buf/udmabuf.c | 139 +++++++++++++++++++++++++++------------------- 1 file changed, 83 insertions(+), 56 deletions(-) commit 0c8b91ef5100eaed3d64123ac91ac4739fccf15c Author: Vivek Kasireddy Date: Sun Jun 23 23:36:14 2024 -0700 udmabuf: add back support for mapping hugetlb pages A user or admin can configure a VMM (Qemu) Guest's memory to be backed by hugetlb pages for various reasons. However, a Guest OS would still allocate (and pin) buffers that are backed by regular 4k sized pages. In order to map these buffers and create dma-bufs for them on the Host, we first need to find the hugetlb pages where the buffer allocations are located and then determine the offsets of individual chunks (within those pages) and use this information to eventually populate a scatterlist. Testcase: default_hugepagesz=2M hugepagesz=2M hugepages=2500 options were passed to the Host kernel and Qemu was launched with these relevant options: qemu-system-x86_64 -m 4096m.... -device virtio-gpu-pci,max_outputs=1,blob=true,xres=1920,yres=1080 -display gtk,gl=on -object memory-backend-memfd,hugetlb=on,id=mem1,size=4096M -machine memory-backend=mem1 Replacing -display gtk,gl=on with -display gtk,gl=off above would exercise the mmap handler. Link: https://lkml.kernel.org/r/20240624063952.1572359-7-vivek.kasireddy@intel.com Signed-off-by: Vivek Kasireddy Acked-by: Mike Kravetz (v2) Acked-by: Dave Airlie Acked-by: Gerd Hoffmann Cc: David Hildenbrand Cc: Daniel Vetter Cc: Hugh Dickins Cc: Peter Xu Cc: Jason Gunthorpe Cc: Dongwon Kim Cc: Junxiao Chang Cc: Arnd Bergmann Cc: Christoph Hellwig Cc: Christoph Hellwig Cc: Matthew Wilcox (Oracle) Cc: Oscar Salvador Cc: Shuah Khan Signed-off-by: Andrew Morton drivers/dma-buf/udmabuf.c | 122 ++++++++++++++++++++++++++++++++++++++-------- 1 file changed, 101 insertions(+), 21 deletions(-) commit 7d79cd784470395539bda91bf0b3505ff5b2ab6d Author: Vivek Kasireddy Date: Sun Jun 23 23:36:13 2024 -0700 udmabuf: use vmf_insert_pfn and VM_PFNMAP for handling mmap Add VM_PFNMAP to vm_flags in the mmap handler to ensure that the mappings would be managed without using struct page. And, in the vm_fault handler, use vmf_insert_pfn to share the page's pfn to userspace instead of directly sharing the page (via struct page *). Link: https://lkml.kernel.org/r/20240624063952.1572359-6-vivek.kasireddy@intel.com Signed-off-by: Vivek Kasireddy Suggested-by: David Hildenbrand Acked-by: David Hildenbrand Acked-by: Dave Airlie Acked-by: Gerd Hoffmann Cc: Daniel Vetter Cc: Hugh Dickins Cc: Peter Xu Cc: Jason Gunthorpe Cc: Dongwon Kim Cc: Junxiao Chang Cc: Arnd Bergmann Cc: Christoph Hellwig Cc: Christoph Hellwig Cc: Matthew Wilcox (Oracle) Cc: Mike Kravetz Cc: Oscar Salvador Cc: Shuah Khan Signed-off-by: Andrew Morton drivers/dma-buf/udmabuf.c | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-) commit 725553d202dda60dc17a142c80fd96bdf6ca43db Author: Arnd Bergmann Date: Sun Jun 23 23:36:12 2024 -0700 udmabuf: add CONFIG_MMU dependency There is no !CONFIG_MMU version of vmf_insert_pfn(): arm-linux-gnueabi-ld: drivers/dma-buf/udmabuf.o: in function `udmabuf_vm_fault': udmabuf.c:(.text+0xaa): undefined reference to `vmf_insert_pfn' Link: https://lkml.kernel.org/r/20240624063952.1572359-5-vivek.kasireddy@intel.com Signed-off-by: Arnd Bergmann Acked-by: David Hildenbrand Acked-by: Vivek Kasireddy Cc: Christoph Hellwig Cc: Christoph Hellwig Cc: Daniel Vetter Cc: Dave Airlie Cc: Dongwon Kim Cc: Gerd Hoffmann Cc: Hugh Dickins Cc: Jason Gunthorpe Cc: Junxiao Chang Cc: Matthew Wilcox (Oracle) Cc: Mike Kravetz Cc: Oscar Salvador Cc: Peter Xu Cc: Shuah Khan Signed-off-by: Andrew Morton drivers/dma-buf/Kconfig | 1 + 1 file changed, 1 insertion(+) commit 89c1905d9c140372b7f50ef48f42378cf85d9bc5 Author: Vivek Kasireddy Date: Sun Jun 23 23:36:11 2024 -0700 mm/gup: introduce memfd_pin_folios() for pinning memfd folios For drivers that would like to longterm-pin the folios associated with a memfd, the memfd_pin_folios() API provides an option to not only pin the folios via FOLL_PIN but also to check and migrate them if they reside in movable zone or CMA block. This API currently works with memfds but it should work with any files that belong to either shmemfs or hugetlbfs. Files belonging to other filesystems are rejected for now. The folios need to be located first before pinning them via FOLL_PIN. If they are found in the page cache, they can be immediately pinned. Otherwise, they need to be allocated using the filesystem specific APIs and then pinned. [akpm@linux-foundation.org: improve the CONFIG_MMU=n situation, per SeongJae] [vivek.kasireddy@intel.com: return -EINVAL if the end offset is greater than the size of memfd] Link: https://lkml.kernel.org/r/IA0PR11MB71850525CBC7D541CAB45DF1F8DB2@IA0PR11MB7185.namprd11.prod.outlook.com Link: https://lkml.kernel.org/r/20240624063952.1572359-4-vivek.kasireddy@intel.com Signed-off-by: Vivek Kasireddy Suggested-by: Jason Gunthorpe Reviewed-by: Jason Gunthorpe (v2) Reviewed-by: David Hildenbrand (v3) Reviewed-by: Christoph Hellwig (v6) Acked-by: Dave Airlie Acked-by: Gerd Hoffmann Cc: Matthew Wilcox (Oracle) Cc: Daniel Vetter Cc: Hugh Dickins Cc: Peter Xu Cc: Dongwon Kim Cc: Junxiao Chang Cc: Arnd Bergmann Cc: Christoph Hellwig Cc: Mike Kravetz Cc: Oscar Salvador Cc: Shuah Khan Signed-off-by: Andrew Morton include/linux/memfd.h | 5 ++ include/linux/mm.h | 3 ++ mm/gup.c | 139 ++++++++++++++++++++++++++++++++++++++++++++++++++ mm/memfd.c | 45 ++++++++++++++++ 4 files changed, 192 insertions(+) commit 53ba78de064b6a45f5925947b3b45e9e833c2f8a Author: Vivek Kasireddy Date: Sun Jun 23 23:36:10 2024 -0700 mm/gup: introduce check_and_migrate_movable_folios() This helper is the folio equivalent of check_and_migrate_movable_pages(). Therefore, all the rules that apply to check_and_migrate_movable_pages() also apply to this one as well. Currently, this helper is only used by memfd_pin_folios(). This patch also includes changes to rename and convert the internal functions collect_longterm_unpinnable_pages() and migrate_longterm_unpinnable_pages() to work on folios. As a result, check_and_migrate_movable_pages() is now a wrapper around check_and_migrate_movable_folios(). Link: https://lkml.kernel.org/r/20240624063952.1572359-3-vivek.kasireddy@intel.com Signed-off-by: Vivek Kasireddy Suggested-by: David Hildenbrand Acked-by: David Hildenbrand Acked-by: Dave Airlie Acked-by: Gerd Hoffmann Cc: Matthew Wilcox Cc: Christoph Hellwig Cc: Jason Gunthorpe Cc: Peter Xu Cc: Arnd Bergmann Cc: Christoph Hellwig Cc: Daniel Vetter Cc: Dongwon Kim Cc: Hugh Dickins Cc: Junxiao Chang Cc: Mike Kravetz Cc: Oscar Salvador Cc: Shuah Khan Signed-off-by: Andrew Morton mm/gup.c | 124 +++++++++++++++++++++++++++++++++++++++------------------------ 1 file changed, 77 insertions(+), 47 deletions(-) commit 6cc040542ba7b2c60e5119cd04d841fcf048c872 Author: Vivek Kasireddy Date: Sun Jun 23 23:36:09 2024 -0700 mm/gup: introduce unpin_folio/unpin_folios helpers Patch series "mm/gup: Introduce memfd_pin_folios() for pinning memfd folios", v16. Currently, some drivers (e.g, Udmabuf) that want to longterm-pin the pages/folios associated with a memfd, do so by simply taking a reference on them. This is not desirable because the pages/folios may reside in Movable zone or CMA block. Therefore, having drivers use memfd_pin_folios() API ensures that the folios are appropriately pinned via FOLL_PIN for longterm DMA. This patchset also introduces a few helpers and converts the Udmabuf driver to use folios and memfd_pin_folios() API to longterm-pin the folios for DMA. Two new Udmabuf selftests are also included to test the driver and the new API. This patch (of 9): These helpers are the folio versions of unpin_user_page/unpin_user_pages. They are currently only useful for unpinning folios pinned by memfd_pin_folios() or other associated routines. However, they could find new uses in the future, when more and more folio-only helpers are added to GUP. We should probably sanity check the folio as part of unpin similar to how it is done in unpin_user_page/unpin_user_pages but we cannot cleanly do that at the moment without also checking the subpage. Therefore, sanity checking needs to be added to these routines once we have a way to determine if any given folio is anon-exclusive (via a per folio AnonExclusive flag). Link: https://lkml.kernel.org/r/20240624063952.1572359-1-vivek.kasireddy@intel.com Link: https://lkml.kernel.org/r/20240624063952.1572359-2-vivek.kasireddy@intel.com Signed-off-by: Vivek Kasireddy Suggested-by: David Hildenbrand Reviewed-by: David Hildenbrand Acked-by: Dave Airlie Acked-by: Gerd Hoffmann Cc: Matthew Wilcox Cc: Christoph Hellwig Cc: Jason Gunthorpe Cc: Peter Xu Cc: Christoph Hellwig Cc: Daniel Vetter Cc: Dongwon Kim Cc: Hugh Dickins Cc: Junxiao Chang Cc: Oscar Salvador Cc: Arnd Bergmann Cc: Christoph Hellwig Cc: Mike Kravetz Cc: Shuah Khan Signed-off-by: Andrew Morton include/linux/mm.h | 2 ++ mm/gup.c | 47 +++++++++++++++++++++++++++++++++++++++++++++++ 2 files changed, 49 insertions(+) commit 8edc9c4e72fe0cc9f7a258649827dafa9542c8ac Author: Chengming Zhou Date: Mon Jun 17 20:57:41 2024 +0800 mm/zswap: use only one pool in zswap Zswap uses 32 pools to workaround the locking scalability problem in zswap backends (mainly zsmalloc nowadays), which brings its own problems like memory waste and more memory fragmentation. Testing results show that we can have near performance with only one pool in zswap after changing zsmalloc to use per-size_class lock instead of pool spinlock. Testing kernel build (make bzImage -j32) on tmpfs with memory.max=1GB, and zswap shrinker enabled with 10GB swapfile on ext4. real user sys 6.10.0-rc3 138.18 1241.38 1452.73 6.10.0-rc3-onepool 149.45 1240.45 1844.69 6.10.0-rc3-onepool-perclass 138.23 1242.37 1469.71 And do the same testing using zbud, which shows a little worse performance as expected since we don't do any locking optimization for zbud. I think it's acceptable since zsmalloc became a lot more popular than other backends, and we may want to support only zsmalloc in the future. real user sys 6.10.0-rc3-zbud 138.23 1239.58 1430.09 6.10.0-rc3-onepool-zbud 139.64 1241.37 1516.59 [chengming.zhou@linux.dev: fix error handling in zswap_pool_create(), per Dan Carpenter] Link: https://lkml.kernel.org/r/20240621-zsmalloc-lock-mm-everything-v2-2-d30e9cd2b793@linux.dev [chengming.zhou@linux.dev: fix error handling again in zswap_pool_create(), per Yosry] Link: https://lkml.kernel.org/r/20240625-zsmalloc-lock-mm-everything-v3-2-ad941699cb61@linux.dev Link: https://lkml.kernel.org/r/20240617-zsmalloc-lock-mm-everything-v1-2-5e5081ea11b3@linux.dev Signed-off-by: Chengming Zhou Reviewed-by: Nhat Pham Acked-by: Yosry Ahmed Cc: Chengming Zhou Cc: Johannes Weiner Cc: Minchan Kim Cc: Sergey Senozhatsky Signed-off-by: Andrew Morton mm/zswap.c | 61 ++++++++++++++++++++----------------------------------------- 1 file changed, 20 insertions(+), 41 deletions(-) commit 64bd0197ae0c7d779e21410fe6d1782a3b59ee32 Author: Chengming Zhou Date: Mon Jun 17 20:57:40 2024 +0800 mm/zsmalloc: change back to per-size_class lock Patch series "mm/zsmalloc: change back to per-size_class lock, v2". Commit c0547d0b6a4b ("zsmalloc: consolidate zs_pool's migrate_lock and size_class's locks") changed per-size_class lock to pool spinlock to prepare reclaim support in zsmalloc. Then reclaim support in zsmalloc had been dropped in favor of LRU reclaim in zswap, but this locking change had been left there. Obviously, the scalability of pool spinlock is worse than per-size_class. And we have a workaround that using 32 pools in zswap to avoid this scalability problem, which brings its own problems like memory waste and more memory fragmentation. So this series changes back to use per-size_class lock and using testing data in much stressed situation to verify that we can use only one pool in zswap. Note we only test and care about the zsmalloc backend, which makes sense now since zsmalloc became a lot more popular than other backends. Testing kernel build (make bzImage -j32) on tmpfs with memory.max=1GB, and zswap shrinker enabled with 10GB swapfile on ext4. real user sys 6.10.0-rc3 138.18 1241.38 1452.73 6.10.0-rc3-onepool 149.45 1240.45 1844.69 6.10.0-rc3-onepool-perclass 138.23 1242.37 1469.71 We can see from "sys" column that per-size_class locking with only one pool in zswap can have near performance with the current 32 pools. This patch (of 2): This patch is almost the revert of the commit c0547d0b6a4b ("zsmalloc: consolidate zs_pool's migrate_lock and size_class's locks"), which changed to use a global pool->lock instead of per-size_class lock and pool->migrate_lock, was preparation for suppporting reclaim in zsmalloc. Then reclaim in zsmalloc had been dropped in favor of LRU reclaim in zswap. In theory, per-size_class is more fine-grained than the pool->lock, since a pool can have many size_classes. As for the additional pool->migrate_lock, only free() and map() need to grab it to access stable handle to get zspage, and only in read lock mode. Link: https://lkml.kernel.org/r/20240625-zsmalloc-lock-mm-everything-v3-0-ad941699cb61@linux.dev Link: https://lkml.kernel.org/r/20240621-zsmalloc-lock-mm-everything-v2-0-d30e9cd2b793@linux.dev Link: https://lkml.kernel.org/r/20240617-zsmalloc-lock-mm-everything-v1-0-5e5081ea11b3@linux.dev Link: https://lkml.kernel.org/r/20240617-zsmalloc-lock-mm-everything-v1-1-5e5081ea11b3@linux.dev Signed-off-by: Chengming Zhou Reviewed-by: Sergey Senozhatsky Cc: Chengming Zhou Cc: Johannes Weiner Cc: Minchan Kim Cc: Nhat Pham Cc: Yosry Ahmed Signed-off-by: Andrew Morton mm/zsmalloc.c | 85 +++++++++++++++++++++++++++++++++++------------------------ 1 file changed, 50 insertions(+), 35 deletions(-) commit 998d4e2c33be49297c780e0e59a333918b7c97e4 Author: Andrew Morton Date: Thu Jul 11 23:36:42 2024 -0700 mm/hugetlb.c: undo errant change During conflict resolution a line was unintentionally removed by a ksm.c patch. Link: https://lkml.kernel.org/r/85b0d694-d1ac-8e7a-2e50-1edc03eee21a@google.com Fixes: ac90c56bbd73 ("mm/ksm: refactor out try_to_merge_with_zero_page()") Reported-by: Hugh Dickins Cc: Aristeu Rozanski Cc: Chengming Zhou Signed-off-by: Andrew Morton mm/hugetlb.c | 1 + 1 file changed, 1 insertion(+) commit 47c8846a49baa8c0b7a6a3e7e7eacd6e8d119d25 Author: Vidya Sagar Date: Tue Jun 25 21:01:50 2024 +0530 PCI: Extend ACS configurability PCIe ACS settings control the level of isolation and the possible P2P paths between devices. With greater isolation the kernel will create smaller iommu_groups and with less isolation there is more HW that can achieve P2P transfers. From a virtualization perspective all devices in the same iommu_group must be assigned to the same VM as they lack security isolation. There is no way for the kernel to automatically know the correct ACS settings for any given system and workload. Existing command line options (e.g., disable_acs_redir) allow only for large scale change, disabling all isolation, but this is not sufficient for more complex cases. Add a kernel command-line option 'config_acs' to directly control all the ACS bits for specific devices, which allows the operator to setup the right level of isolation to achieve the desired P2P configuration. The definition is future proof; when new ACS bits are added to the spec the open syntax can be extended. ACS needs to be setup early in the kernel boot as the ACS settings affect how iommu_groups are formed. iommu_group formation is a one time event during initial device discovery, so changing ACS bits after kernel boot can result in an inaccurate view of the iommu_groups compared to the current isolation configuration. ACS applies to PCIe Downstream Ports and multi-function devices. The default ACS settings are strict and deny any direct traffic between two functions. This results in the smallest iommu_group the HW can support. Frequently these values result in slow or non-working P2PDMA. ACS offers a range of security choices controlling how traffic is allowed to go directly between two devices. Some popular choices: - Full prevention - Translated requests can be direct, with various options - Asymmetric direct traffic, A can reach B but not the reverse - All traffic can be direct Along with some other less common ones for special topologies. The intention is that this option would be used with expert knowledge of the HW capability and workload to achieve the desired configuration. Link: https://lore.kernel.org/r/20240625153150.159310-1-vidyas@nvidia.com Signed-off-by: Vidya Sagar [bhelgaas: add example, tidy printk formats] Signed-off-by: Bjorn Helgaas Documentation/admin-guide/kernel-parameters.txt | 32 +++++ drivers/pci/pci.c | 148 ++++++++++++++---------- 2 files changed, 122 insertions(+), 58 deletions(-) commit a4e772898f8bf2e7e1cf661a12c60a5612c4afab Author: Dan Williams Date: Thu May 30 18:04:35 2024 -0700 PCI: Add missing bridge lock to pci_bus_lock() One of the true positives that the cfg_access_lock lockdep effort identified is this sequence: WARNING: CPU: 14 PID: 1 at drivers/pci/pci.c:4886 pci_bridge_secondary_bus_reset+0x5d/0x70 RIP: 0010:pci_bridge_secondary_bus_reset+0x5d/0x70 Call Trace: ? __warn+0x8c/0x190 ? pci_bridge_secondary_bus_reset+0x5d/0x70 ? report_bug+0x1f8/0x200 ? handle_bug+0x3c/0x70 ? exc_invalid_op+0x18/0x70 ? asm_exc_invalid_op+0x1a/0x20 ? pci_bridge_secondary_bus_reset+0x5d/0x70 pci_reset_bus+0x1d8/0x270 vmd_probe+0x778/0xa10 pci_device_probe+0x95/0x120 Where pci_reset_bus() users are triggering unlocked secondary bus resets. Ironically pci_bus_reset(), several calls down from pci_reset_bus(), uses pci_bus_lock() before issuing the reset which locks everything *but* the bridge itself. For the same motivation as adding: bridge = pci_upstream_bridge(dev); if (bridge) pci_dev_lock(bridge); to pci_reset_function() for the "bus" and "cxl_bus" reset cases, add pci_dev_lock() for @bus->self to pci_bus_lock(). Link: https://lore.kernel.org/r/171711747501.1628941.15217746952476635316.stgit@dwillia2-xfh.jf.intel.com Reported-by: Imre Deak Closes: http://lore.kernel.org/r/6657833b3b5ae_14984b29437@dwillia2-xfh.jf.intel.com.notmuch Signed-off-by: Dan Williams Signed-off-by: Keith Busch [bhelgaas: squash in recursive locking deadlock fix from Keith Busch: https://lore.kernel.org/r/20240711193650.701834-1-kbusch@meta.com] Signed-off-by: Bjorn Helgaas Tested-by: Hans de Goede Tested-by: Kalle Valo Reviewed-by: Dave Jiang drivers/pci/pci.c | 35 +++++++++++++++++++++-------------- 1 file changed, 21 insertions(+), 14 deletions(-) commit 6739fad42af2e5eb87417283278a13a57f69c0de Author: Frank Li Date: Fri Jul 12 14:57:40 2024 -0400 dt-bindings: ata: ahci-fsl-qoriq: add fsl,ls1046a-ahci and fsl,ls1012a-ahci Add missing documented compatible strings 'fsl,ls1046a-ahci' and 'fsl,ls1012a-ahci'. Allow 'fsl,ls1012a-ahci' to fallback to 'fsl,ls1043a-ahci'. Fix below CHECK_DTB warnings arch/arm64/boot/dts/freescale/fsl-ls1012a-qds.dtb: sata@3200000: compatible:0: 'fsl,ls1012a-ahci' is not one of ['fsl,ls1021a-ahci', 'fsl,ls1043a-ahci', 'fsl,ls1028a-ahci', 'fsl,ls1088a-ahci', 'fsl,ls2080a-ahci', 'fsl,lx2160a-ahci'] arch/arm64/boot/dts/freescale/fsl-ls1012a-qds.dtb: sata@3200000: compatible: ['fsl,ls1012a-ahci', 'fsl,ls1043a-ahci'] is too long Fixes: e58e12c5c34c ("dt-bindings: ata: ahci-fsl-qoriq: convert to yaml format") Reviewed-by: Rob Herring Signed-off-by: Frank Li Link: https://lore.kernel.org/r/20240712185740.3819170-1-Frank.Li@nxp.com [cassel: rewrap commit log lines, capitalize SATA] Signed-off-by: Niklas Cassel Documentation/devicetree/bindings/ata/fsl,ahci.yaml | 20 +++++++++++++------- 1 file changed, 13 insertions(+), 7 deletions(-) commit bd5b61d8b16494c408eeb637ccacd3bf9f39114f Author: Eric Biggers Date: Thu Jul 11 13:04:21 2024 -0700 docs: driver-model: platform: update the definition of platform_driver Update the documented struct platform_driver to match the code. Signed-off-by: Eric Biggers Signed-off-by: Jonathan Corbet Link: https://lore.kernel.org/r/20240711200421.11428-1-ebiggers@kernel.org Documentation/driver-api/driver-model/platform.rst | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) commit e435b043d89a267bd6eb3d5650d2319805d7924a Author: Tengda Wu Date: Thu Jul 11 22:58:19 2024 +0800 selftests/bpf: Test for null-pointer-deref bugfix in resolve_prog_type() This test verifies that resolve_prog_type() works as expected when `attach_prog_fd` is not passed in. `prog->aux->dst_prog` in resolve_prog_type() is assigned by `attach_prog_fd`, and would be NULL if `attach_prog_fd` is not provided. Loading EXT prog with bpf_dynptr_from_skb() kfunc call in this way will lead to null-pointer-deref. Verify that the null-pointer-deref bug in resolve_prog_type() is fixed. Signed-off-by: Tengda Wu Signed-off-by: Daniel Borkmann Link: https://lore.kernel.org/bpf/20240711145819.254178-3-wutengda@huaweicloud.com tools/testing/selftests/bpf/verifier/calls.c | 13 +++++++++++++ 1 file changed, 13 insertions(+) commit f7866c35873377313ff94398f17d425b28b71de1 Author: Tengda Wu Date: Thu Jul 11 22:58:18 2024 +0800 bpf: Fix null pointer dereference in resolve_prog_type() for BPF_PROG_TYPE_EXT When loading a EXT program without specifying `attr->attach_prog_fd`, the `prog->aux->dst_prog` will be null. At this time, calling resolve_prog_type() anywhere will result in a null pointer dereference. Example stack trace: [ 8.107863] Unable to handle kernel NULL pointer dereference at virtual address 0000000000000004 [ 8.108262] Mem abort info: [ 8.108384] ESR = 0x0000000096000004 [ 8.108547] EC = 0x25: DABT (current EL), IL = 32 bits [ 8.108722] SET = 0, FnV = 0 [ 8.108827] EA = 0, S1PTW = 0 [ 8.108939] FSC = 0x04: level 0 translation fault [ 8.109102] Data abort info: [ 8.109203] ISV = 0, ISS = 0x00000004, ISS2 = 0x00000000 [ 8.109399] CM = 0, WnR = 0, TnD = 0, TagAccess = 0 [ 8.109614] GCS = 0, Overlay = 0, DirtyBit = 0, Xs = 0 [ 8.109836] user pgtable: 4k pages, 48-bit VAs, pgdp=0000000101354000 [ 8.110011] [0000000000000004] pgd=0000000000000000, p4d=0000000000000000 [ 8.112624] Internal error: Oops: 0000000096000004 [#1] PREEMPT SMP [ 8.112783] Modules linked in: [ 8.113120] CPU: 0 PID: 99 Comm: may_access_dire Not tainted 6.10.0-rc3-next-20240613-dirty #1 [ 8.113230] Hardware name: linux,dummy-virt (DT) [ 8.113390] pstate: 60000005 (nZCv daif -PAN -UAO -TCO -DIT -SSBS BTYPE=--) [ 8.113429] pc : may_access_direct_pkt_data+0x24/0xa0 [ 8.113746] lr : add_subprog_and_kfunc+0x634/0x8e8 [ 8.113798] sp : ffff80008283b9f0 [ 8.113813] x29: ffff80008283b9f0 x28: ffff800082795048 x27: 0000000000000001 [ 8.113881] x26: ffff0000c0bb2600 x25: 0000000000000000 x24: 0000000000000000 [ 8.113897] x23: ffff0000c1134000 x22: 000000000001864f x21: ffff0000c1138000 [ 8.113912] x20: 0000000000000001 x19: ffff0000c12b8000 x18: ffffffffffffffff [ 8.113929] x17: 0000000000000000 x16: 0000000000000000 x15: 0720072007200720 [ 8.113944] x14: 0720072007200720 x13: 0720072007200720 x12: 0720072007200720 [ 8.113958] x11: 0720072007200720 x10: 0000000000f9fca4 x9 : ffff80008021f4e4 [ 8.113991] x8 : 0101010101010101 x7 : 746f72705f6d656d x6 : 000000001e0e0f5f [ 8.114006] x5 : 000000000001864f x4 : ffff0000c12b8000 x3 : 000000000000001c [ 8.114020] x2 : 0000000000000002 x1 : 0000000000000000 x0 : 0000000000000000 [ 8.114126] Call trace: [ 8.114159] may_access_direct_pkt_data+0x24/0xa0 [ 8.114202] bpf_check+0x3bc/0x28c0 [ 8.114214] bpf_prog_load+0x658/0xa58 [ 8.114227] __sys_bpf+0xc50/0x2250 [ 8.114240] __arm64_sys_bpf+0x28/0x40 [ 8.114254] invoke_syscall.constprop.0+0x54/0xf0 [ 8.114273] do_el0_svc+0x4c/0xd8 [ 8.114289] el0_svc+0x3c/0x140 [ 8.114305] el0t_64_sync_handler+0x134/0x150 [ 8.114331] el0t_64_sync+0x168/0x170 [ 8.114477] Code: 7100707f 54000081 f9401c00 f9403800 (b9400403) [ 8.118672] ---[ end trace 0000000000000000 ]--- One way to fix it is by forcing `attach_prog_fd` non-empty when bpf_prog_load(). But this will lead to `libbpf_probe_bpf_prog_type` API broken which use verifier log to probe prog type and will log nothing if we reject invalid EXT prog before bpf_check(). Another way is by adding null check in resolve_prog_type(). The issue was introduced by commit 4a9c7bbe2ed4 ("bpf: Resolve to prog->aux->dst_prog->type only for BPF_PROG_TYPE_EXT") which wanted to correct type resolution for BPF_PROG_TYPE_TRACING programs. Before that, the type resolution of BPF_PROG_TYPE_EXT prog actually follows the logic below: prog->aux->dst_prog ? prog->aux->dst_prog->type : prog->type; It implies that when EXT program is not yet attached to `dst_prog`, the prog type should be EXT itself. This code worked fine in the past. So just keep using it. Fix this by returning `prog->type` for BPF_PROG_TYPE_EXT if `dst_prog` is not present in resolve_prog_type(). Fixes: 4a9c7bbe2ed4 ("bpf: Resolve to prog->aux->dst_prog->type only for BPF_PROG_TYPE_EXT") Signed-off-by: Tengda Wu Signed-off-by: Daniel Borkmann Acked-by: Daniel Borkmann Cc: Martin KaFai Lau Link: https://lore.kernel.org/bpf/20240711145819.254178-2-wutengda@huaweicloud.com include/linux/bpf_verifier.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 054fd15984454f031611d6c63675fc578aad0cb1 Author: Chen Ni Date: Thu Jun 20 16:19:26 2024 +0800 ubifs: add check for crypto_shash_tfm_digest Add check for the return value of crypto_shash_tfm_digest() and return the error if it fails in order to catch the error. Fixes: 817aa094842d ("ubifs: support offline signed images") Signed-off-by: Chen Ni Reviewed-by: Zhihao Cheng Signed-off-by: Richard Weinberger fs/ubifs/master.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) commit 25e79a7f2c9e54872fb2c8932bb582a500284505 Author: Zhihao Cheng Date: Tue Jun 4 19:32:07 2024 +0800 ubifs: Fix inconsistent inode size when powercut happens during appendant writing UBIFS always make sure that the data length won't beyond the inode size by writing inode before writing page(See ubifs_writepage.). After commit c35acef383f4a2f2cfc30("ubifs: Convert ubifs_writepage to use a folio"), the rule is broken in one case: Given a file with size 3, then write 4096 from the offset 0, following process will make inode size be smaller than file data length after powercut & recovery: P1 P2 ubifs_writepage len = folio_size(folio) // 4096 if (folio_pos(folio) + len <= i_size) // condition 1: 0 + 4096 <= 4096 //(i_size is updated as 4096 in ubifs_write_end) if (folio_pos(folio) >= synced_i_size) // condition 2: 0 >= 3, false write_inode // Skipped, because condition 2 is false do_writepage(folio, len) // write one page do_commit // data node won't be replayed in next mounting >> Powercut << So, inode size(4096) is not updated into disk, we will get following error messages in next mounting(chk_fs = 1): check_leaf [ubifs]: data node at LEB 14:2048 is not within inode size 3 dbg_walk_index [ubifs]: leaf checking function returned error -22, for leaf at LEB 14:2048 Fix it by modifying condition 2 as original comparison(Compare the page index of synced_i_size with current page index). Fixes: c35acef383f4 ("ubifs: Convert ubifs_writepage to use a folio") Link: https://bugzilla.kernel.org/show_bug.cgi?id=218934 Signed-off-by: Zhihao Cheng Signed-off-by: Richard Weinberger fs/ubifs/file.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 4f9d406c8c90dc17470cf63342c16f66ec2d978e Author: Li Nan Date: Thu May 23 01:10:35 2024 +0800 ubi: block: fix null-pointer-dereference in ubiblock_create() Similar to commit adbf4c4954e3 ("ubi: block: fix memleak in ubiblock_create()"), 'dev->gd' is not assigned but dereferenced if blk_mq_alloc_tag_set() fails, and leading to a null-pointer-dereference. Fix it by using pr_err() and variable 'dev' to print error log. Additionally, the log in the error handle path of idr_alloc() has been improved by using pr_err(), too. Before initializing device name, using dev_err() will print error log with 'null' instead of the actual device name, like this: block (null): ... ~~~~~~ It is unclear. Using pr_err() can print more details of the device. The improved log is: ubiblock0_0: ... Fixes: 77567b25ab9f ("ubi: use blk_mq_alloc_disk and blk_cleanup_disk") Reported-by: Dan Carpenter Signed-off-by: Li Nan Reviewed-by: Zhihao Cheng Reviewed-by: Daniel Golle Signed-off-by: Richard Weinberger drivers/mtd/ubi/block.c | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) commit 39986148bc2ab4436ec169c8f4db76f6cc83705d Author: Jeff Johnson Date: Thu May 2 13:16:55 2024 -0700 ubifs: fix kernel-doc warnings make C=1 reports the following kernel-doc warnings: fs/ubifs/compress.c:103: warning: Function parameter or struct member 'c' not described in 'ubifs_compress' fs/ubifs/compress.c:155: warning: Function parameter or struct member 'c' not described in 'ubifs_decompress' fs/ubifs/find.c:353: warning: Excess function parameter 'data' description in 'scan_for_free_cb' fs/ubifs/find.c:353: warning: Function parameter or struct member 'arg' not described in 'scan_for_free_cb' fs/ubifs/find.c:594: warning: Excess function parameter 'data' description in 'scan_for_idx_cb' fs/ubifs/find.c:594: warning: Function parameter or struct member 'arg' not described in 'scan_for_idx_cb' fs/ubifs/find.c:786: warning: Excess function parameter 'data' description in 'scan_dirty_idx_cb' fs/ubifs/find.c:786: warning: Function parameter or struct member 'arg' not described in 'scan_dirty_idx_cb' fs/ubifs/find.c:86: warning: Excess function parameter 'data' description in 'scan_for_dirty_cb' fs/ubifs/find.c:86: warning: Function parameter or struct member 'arg' not described in 'scan_for_dirty_cb' fs/ubifs/journal.c:369: warning: expecting prototype for wake_up_reservation(). Prototype was for add_or_start_queue() instead fs/ubifs/lprops.c:1018: warning: Excess function parameter 'lst' description in 'scan_check_cb' fs/ubifs/lprops.c:1018: warning: Function parameter or struct member 'arg' not described in 'scan_check_cb' fs/ubifs/lpt.c:1938: warning: Function parameter or struct member 'ptr' not described in 'lpt_scan_node' fs/ubifs/replay.c:60: warning: Function parameter or struct member 'hash' not described in 'replay_entry' Fix them. Signed-off-by: Jeff Johnson Reviewed-by: Zhihao Cheng Signed-off-by: Richard Weinberger fs/ubifs/compress.c | 2 ++ fs/ubifs/find.c | 8 ++++---- fs/ubifs/journal.c | 2 +- fs/ubifs/lprops.c | 2 +- fs/ubifs/lpt.c | 1 + fs/ubifs/replay.c | 1 + 6 files changed, 10 insertions(+), 6 deletions(-) commit 7037c96d8c42965eb93e6b96cf921399c283d431 Author: ZhaoLong Wang Date: Thu Apr 18 15:07:04 2024 +0800 ubifs: correct UBIFS_DFS_DIR_LEN macro definition and improve code clarity The UBIFS_DFS_DIR_LEN macro, which defines the maximum length of the UBIFS debugfs directory name, has an incorrect formula and misleading comments. The current formula is (3 + 1 + 2*2 + 1), which assumes that both UBI device number and volume ID are limited to 2 characters. However, UBI device number ranges from 0 to 31 (2 characters), and volume ID ranges from 0 to 127 (up to 3 characters). Although the current code works due to the cancellation of mathematical errors (9 + 1 = 10, which matches the correct UBIFS_DFS_DIR_LEN value), it can lead to confusion and potential issues in the future. This patch aims to improve the code clarity and maintainability by making the following changes: 1. Corrects the UBIFS_DFS_DIR_LEN macro definition to (3 + 1 + 2 + 3 + 1), accommodating the maximum lengths of both UBI device number and volume ID, plus the separators and null terminator. 2. Updates the snprintf calls to use UBIFS_DFS_DIR_LEN instead of UBIFS_DFS_DIR_LEN + 1, removing the unnecessary +1. 3. Modifies the error checks to compare against UBIFS_DFS_DIR_LEN using >= instead of >, aligning with the corrected macro definition. 4. Removes the redundant +1 in the dfs_dir_name array definitions in ubi.h and debug.h. While these changes do not affect the runtime behavior, they make the code more readable, maintainable, and less prone to future errors. v2->v3: - Removes the duplicated UBIFS_DFS_DIR_LEN and UBIFS_DFS_DIR_NAME macro definitions in ubifs.h, as they are already defined in debug.h. Signed-off-by: ZhaoLong Wang Reviewed-by: Zhihao Cheng Signed-off-by: Richard Weinberger drivers/mtd/ubi/debug.c | 4 ++-- drivers/mtd/ubi/ubi.h | 2 +- fs/ubifs/debug.c | 4 ++-- fs/ubifs/debug.h | 7 ++++--- fs/ubifs/sysfs.c | 6 +++--- fs/ubifs/ubifs.h | 7 ------- 6 files changed, 12 insertions(+), 18 deletions(-) commit 72f3d3daddd740f744a24cd7ef8c27bd0cd5489d Author: Ben Hutchings Date: Thu Apr 11 00:42:41 2024 +0200 mtd: ubi: Restore missing cleanup on ubi_init() failure path We need to clean-up debugfs and ubiblock if we fail after initialising them. Signed-off-by: Ben Hutchings Fixes: 927c145208b0 ("mtd: ubi: attach from device tree") Signed-off-by: Richard Weinberger drivers/mtd/ubi/build.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) commit 06776df740660e27c351d89f314d05b2720ba41f Author: Zhihao Cheng Date: Wed Apr 10 15:37:51 2024 +0800 ubifs: dbg_orphan_check: Fix missed key type checking When selinux/encryption is enabled, xattr entry node is added into TNC before host inode when creating new file. So it is possible to find xattr entry without host inode from TNC. Orphan debug checking is called by ubifs_orphan_end_commit(), at that time, the commit semaphore is already unlock, so the new creation won't be blocked. Fixes: d7f0b70d30ff ("UBIFS: Add security.* XATTR support for the UBIFS") Fixes: d475a507457b ("ubifs: Add skeleton for fscrypto") Signed-off-by: Zhihao Cheng Signed-off-by: Richard Weinberger fs/ubifs/orphan.c | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) commit 3af2d3a8c56fe7dc24f60c4df0ab85b7ac941902 Author: Zhihao Cheng Date: Wed Apr 10 15:37:50 2024 +0800 ubifs: Fix unattached inode when powercut happens in creating For selinux or encryption scenarios, UBIFS could become inconsistent while creating new files in powercut case. Encryption/selinux related xattrs will be created before creating file dentry, which makes creation process is not atomic, details are shown as: Encryption case: ubifs_create ubifs_new_inode fscrypt_set_context ubifs_xattr_set create_xattr ubifs_jnl_update // Disk: xentry xinode inode(LAST_OF_NODE_GROUP) >> power cut << ubifs_jnl_update // Disk: dentry inode parent_inode(LAST_OF_NODE_GROUP) Selinux case: ubifs_create ubifs_new_inode ubifs_init_security security_inode_init_security ubifs_xattr_set create_xattr ubifs_jnl_update // Disk: xentry xinode inode(LAST_OF_NODE_GROUP) >> power cut << ubifs_jnl_update // Disk: dentry inode parent_inode(LAST_OF_NODE_GROUP) Above process will make chk_fs failed in next mounting: UBIFS error (ubi0:0 pid 7995): dbg_check_filesystem [ubifs]: inode 66 nlink is 1, but calculated nlink is 0 Fix it by allocating orphan inode for each non-xattr file creation, then removing orphan list in journal writing process, which ensures that both xattr and dentry be effective in atomic when powercut happens. Fixes: d7f0b70d30ff ("UBIFS: Add security.* XATTR support for the UBIFS") Fixes: d475a507457b ("ubifs: Add skeleton for fscrypto") Link: https://bugzilla.kernel.org/show_bug.cgi?id=218309 Suggested-by: Zhang Yi Signed-off-by: Zhihao Cheng Signed-off-by: Richard Weinberger fs/ubifs/dir.c | 59 ++++++++++++++++++++++++++++++++++++------------------ fs/ubifs/journal.c | 14 ++++++++----- fs/ubifs/ubifs.h | 4 ++-- 3 files changed, 51 insertions(+), 26 deletions(-) commit b25e6a5f78e84598ec62552ef342a58a23b6f7c4 Author: Zhihao Cheng Date: Wed Apr 10 15:37:49 2024 +0800 ubifs: Fix space leak when powercut happens in linking tmpfile There is a potential space leak problem when powercut happens in linking tmpfile, in which case, inode node (with nlink=0) and its' data nodes can be found from tnc (on flash), but there are no dentries related to the inode, so the file is invisible but takes free space. Detailed process is shown as: ubifs_tmpfile ubifs_jnl_update // Add bud A into log area ubifs_add_orphan // Add inode into orphan list P1 P2 ubifs_link ubifs_delete_orphan // Delete inode from orphan list, then inode won't // be written into orphan area, there is no chance // to delete inode by replaying orphan. commit // bud A won't be replayed in next mounting >> powercut << ubifs_jnl_update // Link inode to dentry The root cause is that orphan entry deletion and journal writing(for link) are interrupted by commit, which makes the two operations are not atomic. Fix it by doing ubifs_delete_orphan under the protection of c->commit_sem within ubifs_jnl_update. This is also a preparation to support all creating new files by orphan inode. v1 is https://lore.kernel.org/linux-mtd/20200701093227.674945-1-chengzhihao1@huawei.com/ Fixes: 32fe905c17f0 ("ubifs: Fix O_TMPFILE corner case in ubifs_link()") Link: https://bugzilla.kernel.org/show_bug.cgi?id=208405 Signed-off-by: Zhihao Cheng Signed-off-by: Richard Weinberger fs/ubifs/dir.c | 22 ++++++++-------------- fs/ubifs/journal.c | 6 +++++- fs/ubifs/ubifs.h | 2 +- fs/ubifs/xattr.c | 2 +- 4 files changed, 15 insertions(+), 17 deletions(-) commit 9f5ecacfcee2bda21b100399a9130248d55c2a0c Author: Zhihao Cheng Date: Wed Apr 10 15:37:48 2024 +0800 ubifs: Move ui->data initialization after initializing security Host inode and its' xattr will be written on disk after initializing security when creating symlink or dev, then the host inode and its dentry will be written again in ubifs_jnl_update. There is no need to write inode data in the security initialization pass, just move the ui->data initialization after initializing security. Signed-off-by: Zhihao Cheng Signed-off-by: Richard Weinberger fs/ubifs/dir.c | 18 ++++++++++-------- 1 file changed, 10 insertions(+), 8 deletions(-) commit 7efc34b53b3950ad4fc98b5d25210bae80ab0fde Author: Zhihao Cheng Date: Wed Apr 10 15:37:47 2024 +0800 ubifs: Fix adding orphan entry twice for the same inode The tmpfile could be added into orphan list twice, first time is creation, the second time is removing after it is linked. The orphan entry could be added twice for tmpfile if following sequence is satisfied: ubifs_tmpfile ubifs_jnl_update ubifs_add_orphan // first time to add orphan entry P1 P2 ubifs_link do_commit ubifs_orphan_start_commit orphan->cmt = 1 ubifs_delete_orphan orphan_delete if (orph->cmt) orph->del = 1; // orphan entry is not deleted from tree return ubifs_unlink ubifs_jnl_update ubifs_add_orphan orphan_add // found old orphan entry, second time to add orphan entry ubifs_err(c, "orphaned twice") return -EINVAL // unlink failed! ubifs_orphan_end_commit erase_deleted // delete old orphan entry rb_erase(&orphan->rb, &c->orph_tree) Fix it by removing orphan entry from orphan tree in advance, rather than remove it from orphan tree in committing process. Fixes: 32fe905c17f0 ("ubifs: Fix O_TMPFILE corner case in ubifs_link()") Link: https://bugzilla.kernel.org/show_bug.cgi?id=218672 Signed-off-by: Zhihao Cheng Signed-off-by: Richard Weinberger fs/ubifs/orphan.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 6376d7503b02796cc6109198d555ddebfb4f5f81 Author: Zhihao Cheng Date: Wed Apr 10 15:37:46 2024 +0800 ubifs: Remove insert_dead_orphan from replaying orphan process UBIFS will do commit at the end of mounting process(rw mode), dead orphans(added by insert_dead_orphan in replaying orphan) are deleted by ubifs_orphan_end_commit(). The only reason why dead orphans are added into orphan list is that old orpans may be lost when powercut happens in ubifs_orphan_end_commit(): ubifs_orphan_end_commit // TNC(updated by orphans) is not written yet if (c->cmt_orphans != 0) commit_orphans consolidate // traverse orphan list write_orph_nodes // rewrite all orphans by ubifs_leb_change // If dead orphans are not in list, they will be lost when powercut // happens, then TNC won't be updated by old orphans in next mounting. Luckily, the condition 'c->cmt_orphans != 0' will never be true in mounting process, there can't be new orphans added into orphan list before mounting returned, but commit will be done at the end of mounting. Signed-off-by: Zhihao Cheng Signed-off-by: Richard Weinberger fs/ubifs/orphan.c | 49 ------------------------------------------------- 1 file changed, 49 deletions(-) commit 7bed61a1cf166b5c113047fc8f60ff22dcb04893 Author: Zhihao Cheng Date: Wed Apr 10 15:37:45 2024 +0800 Revert "ubifs: ubifs_symlink: Fix memleak of inode->i_link in error path" This reverts commit 6379b44cdcd67f5f5d986b73953e99700591edfa. Commit 1e022216dcd2 ("ubifs: ubifs_symlink: Fix memleak of inode->i_link in error path") is applied again in commit 6379b44cdcd6 ("ubifs: ubifs_symlink: Fix memleak of inode->i_link in error path"), which changed ubifs_mknod (It won't become a real problem). Just revert it. Signed-off-by: Zhihao Cheng Signed-off-by: Richard Weinberger fs/ubifs/dir.c | 2 -- 1 file changed, 2 deletions(-) commit 354c1796639a743b49bd13549ec0ec6ca121b85e Author: Zhihao Cheng Date: Wed Apr 10 15:37:44 2024 +0800 ubifs: Don't add xattr inode into orphan area Now, the entire inode with its' xattrs are removed while replaying orphan nodes. There is no need to add xattr inodes into orphan area, which is based on the fact that xattr entries won't be cleared from disk before deleting xattr inodes, in another words, current logic can make sure that xattr inode be deleted in any cases even UBIFS not record xattr inode into orphan area. Let's looking for possible paths that could clear xattr entries from disk but leave the xattr inode on TNC: 1. unlink/tmpfile -> ubifs_jnl_update: inode(nlink=0) is written into bud LEB and added into orphan list, then: a. powercut: ubifs_tnc_remove_ino(xattr entry/inode can be found from TNC and being deleted) is invoked in replaying journal. b. commit + powercut: inode is written into orphan area, and ubifs_tnc_remove_ino is invoked in replaying orphan nodes. c. evicting + powercut: xattr inode(nlink=0) is written on disk, xattr is removed from TNC, gc could clear xattr entries from disk. ubifs_tnc_remove_ino will apply on inode and xattr inode in replaying journal, so lost xattr entries will make no influence. d. evicting + commit + powercut: xattr inode/entry are removed from index tree(on disk) by ubifs_jnl_write_inode, xattr inode is cleared from orphan area by ubifs_jnl_write_inode + commit. e. commit + evicting + powercut: inode is written into orphan area, then equivalent to c. 2. remove xattr -> ubifs_jnl_delete_xattr: xattr entry(inum=0) and xattr inode(nlink=0) is written into bud LEB, xattr entry/inode are removed from TNC, then: a. powercut: gc could clear xattr entries from disk, which won't affect deleting xattr entry from TNC. ubifs_tnc_remove_ino will apply on xattr inode in replaying journal, ubifs_tnc_remove_nm will apply on xattr entry in replaying journal. b. commit + powercut: xattr entry/inode are removed from index tree (on disk). Tracking xattr inode in orphan list is imported by commit 988bec41318f3f ("ubifs: orphan: Handle xattrs like files"), it aims to fix the similar problem described in commit 7959cf3a7506d4a ("ubifs: journal: Handle xattrs like files"). Actually, the problem only exist in journal case but not the orphan case. So, we can remove the orphan tracking for xattr inodes. Signed-off-by: Zhihao Cheng Signed-off-by: Richard Weinberger fs/ubifs/orphan.c | 85 +++++++++---------------------------------------------- fs/ubifs/ubifs.h | 3 -- 2 files changed, 14 insertions(+), 74 deletions(-) commit 02eb1846b77d2896903e94b966ba632cf48d39e0 Author: Zhihao Cheng Date: Wed Apr 10 15:37:43 2024 +0800 ubifs: Fix unattached xattr inode if powercut happens after deleting When powercut happens after deleting file, the xattr inode could be alone existing in TNC but its' xattr entry cannot be found in TNC. File inode and xattr inode are added into orphan list after deleting file, file inode's nlink is 0 but xattr inode's nlink is not 0 (PS: zero nlink xattr inode is written on disk in evicting process by ubifs_jnl_write_inode). So, following process could happen: 1. touch file 2. setxattr(file) 3. unlink file // inode(nlink=0), xattr inode(nlink=1) are added into orphan list 4. commit // write inode inum and xattr inum into orphan area 5. powercut 6. mount do_kill_orphans // inode(nlink=0) is deleted from TNC by ubifs_tnc_remove_range, // xattr entry is deleted too. // xattr inode(nlink=1) is not deleted from TNC Finally we could see following error while debugging UBIFS: UBIFS error (ubi0:0 pid 1093): dbg_check_filesystem [ubifs]: inode 66 nlink is 1, but calculated nlink is 0 UBIFS (ubi0:0): dump of the inode 66 sitting in LEB 12:2128 node_type 0 (inode node) group_type 1 (in node group) len 197 key (66, inode) size 37 nlink 1 flags 0x20 xattr_cnt 0 xattr_size 0 xattr_names 0 data len 37 Fix it by removing entire inode with it's xattrs while replaying orphan, just replace function ubifs_tnc_remove_range by ubifs_tnc_remove_ino. Fixes: ee1438ce5dc4 ("ubifs: Check link count of inodes when killing orphans.") Link: https://bugzilla.kernel.org/show_bug.cgi?id=218661 Signed-off-by: Zhihao Cheng Signed-off-by: Richard Weinberger fs/ubifs/orphan.c | 11 ++++------- 1 file changed, 4 insertions(+), 7 deletions(-) commit ea9e315cccd5cfabdfd48bdd34ec774495f14201 Author: Krzysztof Kozlowski Date: Fri Jul 12 14:11:46 2024 +0200 dt-bindings: incomplete-devices: document devices without bindings There are devices in the wild with non-updatable firmware coming with ACPI tables with rejected compatibles, e.g. "ltr,ltrf216a". Linux kernel still supports this device via ACPI PRP0001, however the compatible was never accepted to bindings. There are also several early PowerPC or SPARC platforms using compatibles for their OpenFirmware, but without in-tree DTS. Often the legacy compatible is not correct in terms of current Devicetree specification, e.g. missing vendor prefix. Finally there are also Linux-specific tools and test code with compatibles. Add a schema covering above cases purely to satisfy the DT schema and scripts/checkpatch.pl checks for undocumented compatibles. For ltr,ltrf216a this also documents the consensus: compatible is allowed only via ACPI PRP0001, but not bindings. Link: https://lore.kernel.org/all/20240705095047.90558-1-marex@denx.de/ Link: https://lore.kernel.org/lkml/20220731173446.7400bfa8@jic23-huawei/T/#me55be502302d70424a85368c2645c89f860b7b40 Cc: Marek Vasut Cc: Jonathan Cameron Cc: Sebastian Reichel Signed-off-by: Krzysztof Kozlowski Link: https://lore.kernel.org/r/20240712121146.90942-1-krzysztof.kozlowski@linaro.org Signed-off-by: Rob Herring (Arm) .../devicetree/bindings/incomplete-devices.yaml | 137 +++++++++++++++++++++ 1 file changed, 137 insertions(+) commit 02096a0cf150fc8dc1cfe39afcd768d06b70e722 Author: Arnd Bergmann Date: Wed Mar 13 09:46:52 2024 +0100 mtd: ubi: avoid expensive do_div() on 32-bit machines The use of do_div() in ubi_nvmem_reg_read() makes calling it on 32-bit machines rather expensive. Since the 'from' variable is known to be a 32-bit quantity, it is clearly never needed and can be optimized into a regular division operation. Fixes: b8a77b9a5f9c ("mtd: ubi: fix NVMEM over UBI volumes on 32-bit systems") Fixes: 3ce485803da1 ("mtd: ubi: provide NVMEM layer over UBI volumes") Signed-off-by: Arnd Bergmann Reviewed-by: Zhihao Cheng Signed-off-by: Richard Weinberger drivers/mtd/ubi/nvmem.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) commit 299af26eb46374295a3289be990e536b75c9376a Author: Ricardo B. Marliere Date: Tue Mar 5 16:35:38 2024 -0300 mtd: ubi: make ubi_class constant Since commit 43a7206b0963 ("driver core: class: make class_register() take a const *"), the driver core allows for struct class to be in read-only memory, so move the ubi_class structure to be declared at build time placing it into read-only memory, instead of having to be dynamically allocated at boot time. Cc: Greg Kroah-Hartman Suggested-by: Greg Kroah-Hartman Signed-off-by: Ricardo B. Marliere Reviewed-by: Zhihao Cheng Reviewed-by: Miquel Raynal Signed-off-by: Richard Weinberger drivers/mtd/ubi/build.c | 2 +- drivers/mtd/ubi/ubi.h | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) commit 745d9f4a31defec731119ee8aad8ba9f2536dd9a Author: Fedor Pchelkin Date: Thu Feb 29 23:42:36 2024 +0300 ubi: eba: properly rollback inside self_check_eba In case of a memory allocation failure in the volumes loop we can only process the already allocated scan_eba and fm_eba array elements on the error path - others are still uninitialized. Found by Linux Verification Center (linuxtesting.org). Fixes: 00abf3041590 ("UBI: Add self_check_eba()") Cc: stable@vger.kernel.org Signed-off-by: Fedor Pchelkin Reviewed-by: Zhihao Cheng Signed-off-by: Richard Weinberger drivers/mtd/ubi/eba.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) commit 769d20028f45a4f442cfe558a32faba357a7f5e2 Author: Jeff Layton Date: Fri Jul 12 07:26:44 2024 -0400 nfsd: nfsd_file_lease_notifier_call gets a file_lease as an argument "data" actually refers to a file_lease and not a file_lock. Both structs have their file_lock_core as the first field though, so this bug should be harmless without struct randomization in play. Reported-by: Florian Evers Closes: https://bugzilla.kernel.org/show_bug.cgi?id=219008 Fixes: 05580bbfc6bc ("nfsd: adapt to breakup of struct file_lock") Signed-off-by: Jeff Layton Tested-by: Florian Evers Signed-off-by: Chuck Lever fs/nfsd/filecache.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 7a2fb5619cc1fb53cb8784154d5ef2bd99997436 Author: Howard Chu Date: Fri Jul 5 21:20:51 2024 +0800 perf trace: Fix iteration of syscall ids in syscalltbl->entries This is a bug found when implementing pretty-printing for the landlock_add_rule system call, I decided to send this patch separately because this is a serious bug that should be fixed fast. I wrote a test program to do landlock_add_rule syscall in a loop, yet perf trace -e landlock_add_rule freezes, giving no output. This bug is introduced by the false understanding of the variable "key" below: ``` for (key = 0; key < trace->sctbl->syscalls.nr_entries; ++key) { struct syscall *sc = trace__syscall_info(trace, NULL, key); ... } ``` The code above seems right at the beginning, but when looking at syscalltbl.c, I found these lines: ``` for (i = 0; i <= syscalltbl_native_max_id; ++i) if (syscalltbl_native[i]) ++nr_entries; entries = tbl->syscalls.entries = malloc(sizeof(struct syscall) * nr_entries); ... for (i = 0, j = 0; i <= syscalltbl_native_max_id; ++i) { if (syscalltbl_native[i]) { entries[j].name = syscalltbl_native[i]; entries[j].id = i; ++j; } } ``` meaning the key is merely an index to traverse the syscall table, instead of the actual syscall id for this particular syscall. So if one uses key to do trace__syscall_info(trace, NULL, key), because key only goes up to trace->sctbl->syscalls.nr_entries, for example, on my X86_64 machine, this number is 373, it will end up neglecting all the rest of the syscall, in my case, everything after `rseq`, because the traversal will stop at 373, and `rseq` is the last syscall whose id is lower than 373 in tools/perf/arch/x86/include/generated/asm/syscalls_64.c: ``` ... [334] = "rseq", [424] = "pidfd_send_signal", ... ``` The reason why the key is scrambled but perf trace works well is that key is used in trace__syscall_info(trace, NULL, key) to do trace->syscalls.table[id], this makes sure that the struct syscall returned actually has an id the same value as key, making the later bpf_prog matching all correct. After fixing this bug, I can do perf trace on 38 more syscalls, and because more syscalls are visible, we get 8 more syscalls that can be augmented. before: perf $ perf trace -vv --max-events=1 |& grep Reusing Reusing "open" BPF sys_enter augmenter for "stat" Reusing "open" BPF sys_enter augmenter for "lstat" Reusing "open" BPF sys_enter augmenter for "access" Reusing "connect" BPF sys_enter augmenter for "accept" Reusing "sendto" BPF sys_enter augmenter for "recvfrom" Reusing "connect" BPF sys_enter augmenter for "bind" Reusing "connect" BPF sys_enter augmenter for "getsockname" Reusing "connect" BPF sys_enter augmenter for "getpeername" Reusing "open" BPF sys_enter augmenter for "execve" Reusing "open" BPF sys_enter augmenter for "truncate" Reusing "open" BPF sys_enter augmenter for "chdir" Reusing "open" BPF sys_enter augmenter for "mkdir" Reusing "open" BPF sys_enter augmenter for "rmdir" Reusing "open" BPF sys_enter augmenter for "creat" Reusing "open" BPF sys_enter augmenter for "link" Reusing "open" BPF sys_enter augmenter for "unlink" Reusing "open" BPF sys_enter augmenter for "symlink" Reusing "open" BPF sys_enter augmenter for "readlink" Reusing "open" BPF sys_enter augmenter for "chmod" Reusing "open" BPF sys_enter augmenter for "chown" Reusing "open" BPF sys_enter augmenter for "lchown" Reusing "open" BPF sys_enter augmenter for "mknod" Reusing "open" BPF sys_enter augmenter for "statfs" Reusing "open" BPF sys_enter augmenter for "pivot_root" Reusing "open" BPF sys_enter augmenter for "chroot" Reusing "open" BPF sys_enter augmenter for "acct" Reusing "open" BPF sys_enter augmenter for "swapon" Reusing "open" BPF sys_enter augmenter for "swapoff" Reusing "open" BPF sys_enter augmenter for "delete_module" Reusing "open" BPF sys_enter augmenter for "setxattr" Reusing "open" BPF sys_enter augmenter for "lsetxattr" Reusing "openat" BPF sys_enter augmenter for "fsetxattr" Reusing "open" BPF sys_enter augmenter for "getxattr" Reusing "open" BPF sys_enter augmenter for "lgetxattr" Reusing "openat" BPF sys_enter augmenter for "fgetxattr" Reusing "open" BPF sys_enter augmenter for "listxattr" Reusing "open" BPF sys_enter augmenter for "llistxattr" Reusing "open" BPF sys_enter augmenter for "removexattr" Reusing "open" BPF sys_enter augmenter for "lremovexattr" Reusing "fsetxattr" BPF sys_enter augmenter for "fremovexattr" Reusing "open" BPF sys_enter augmenter for "mq_open" Reusing "open" BPF sys_enter augmenter for "mq_unlink" Reusing "fsetxattr" BPF sys_enter augmenter for "add_key" Reusing "fremovexattr" BPF sys_enter augmenter for "request_key" Reusing "fremovexattr" BPF sys_enter augmenter for "inotify_add_watch" Reusing "fremovexattr" BPF sys_enter augmenter for "mkdirat" Reusing "fremovexattr" BPF sys_enter augmenter for "mknodat" Reusing "fremovexattr" BPF sys_enter augmenter for "fchownat" Reusing "fremovexattr" BPF sys_enter augmenter for "futimesat" Reusing "fremovexattr" BPF sys_enter augmenter for "newfstatat" Reusing "fremovexattr" BPF sys_enter augmenter for "unlinkat" Reusing "fremovexattr" BPF sys_enter augmenter for "linkat" Reusing "open" BPF sys_enter augmenter for "symlinkat" Reusing "fremovexattr" BPF sys_enter augmenter for "readlinkat" Reusing "fremovexattr" BPF sys_enter augmenter for "fchmodat" Reusing "fremovexattr" BPF sys_enter augmenter for "faccessat" Reusing "fremovexattr" BPF sys_enter augmenter for "utimensat" Reusing "connect" BPF sys_enter augmenter for "accept4" Reusing "fremovexattr" BPF sys_enter augmenter for "name_to_handle_at" Reusing "fremovexattr" BPF sys_enter augmenter for "renameat2" Reusing "open" BPF sys_enter augmenter for "memfd_create" Reusing "fremovexattr" BPF sys_enter augmenter for "execveat" Reusing "fremovexattr" BPF sys_enter augmenter for "statx" after perf $ perf trace -vv --max-events=1 |& grep Reusing Reusing "open" BPF sys_enter augmenter for "stat" Reusing "open" BPF sys_enter augmenter for "lstat" Reusing "open" BPF sys_enter augmenter for "access" Reusing "connect" BPF sys_enter augmenter for "accept" Reusing "sendto" BPF sys_enter augmenter for "recvfrom" Reusing "connect" BPF sys_enter augmenter for "bind" Reusing "connect" BPF sys_enter augmenter for "getsockname" Reusing "connect" BPF sys_enter augmenter for "getpeername" Reusing "open" BPF sys_enter augmenter for "execve" Reusing "open" BPF sys_enter augmenter for "truncate" Reusing "open" BPF sys_enter augmenter for "chdir" Reusing "open" BPF sys_enter augmenter for "mkdir" Reusing "open" BPF sys_enter augmenter for "rmdir" Reusing "open" BPF sys_enter augmenter for "creat" Reusing "open" BPF sys_enter augmenter for "link" Reusing "open" BPF sys_enter augmenter for "unlink" Reusing "open" BPF sys_enter augmenter for "symlink" Reusing "open" BPF sys_enter augmenter for "readlink" Reusing "open" BPF sys_enter augmenter for "chmod" Reusing "open" BPF sys_enter augmenter for "chown" Reusing "open" BPF sys_enter augmenter for "lchown" Reusing "open" BPF sys_enter augmenter for "mknod" Reusing "open" BPF sys_enter augmenter for "statfs" Reusing "open" BPF sys_enter augmenter for "pivot_root" Reusing "open" BPF sys_enter augmenter for "chroot" Reusing "open" BPF sys_enter augmenter for "acct" Reusing "open" BPF sys_enter augmenter for "swapon" Reusing "open" BPF sys_enter augmenter for "swapoff" Reusing "open" BPF sys_enter augmenter for "delete_module" Reusing "open" BPF sys_enter augmenter for "setxattr" Reusing "open" BPF sys_enter augmenter for "lsetxattr" Reusing "openat" BPF sys_enter augmenter for "fsetxattr" Reusing "open" BPF sys_enter augmenter for "getxattr" Reusing "open" BPF sys_enter augmenter for "lgetxattr" Reusing "openat" BPF sys_enter augmenter for "fgetxattr" Reusing "open" BPF sys_enter augmenter for "listxattr" Reusing "open" BPF sys_enter augmenter for "llistxattr" Reusing "open" BPF sys_enter augmenter for "removexattr" Reusing "open" BPF sys_enter augmenter for "lremovexattr" Reusing "fsetxattr" BPF sys_enter augmenter for "fremovexattr" Reusing "open" BPF sys_enter augmenter for "mq_open" Reusing "open" BPF sys_enter augmenter for "mq_unlink" Reusing "fsetxattr" BPF sys_enter augmenter for "add_key" Reusing "fremovexattr" BPF sys_enter augmenter for "request_key" Reusing "fremovexattr" BPF sys_enter augmenter for "inotify_add_watch" Reusing "fremovexattr" BPF sys_enter augmenter for "mkdirat" Reusing "fremovexattr" BPF sys_enter augmenter for "mknodat" Reusing "fremovexattr" BPF sys_enter augmenter for "fchownat" Reusing "fremovexattr" BPF sys_enter augmenter for "futimesat" Reusing "fremovexattr" BPF sys_enter augmenter for "newfstatat" Reusing "fremovexattr" BPF sys_enter augmenter for "unlinkat" Reusing "fremovexattr" BPF sys_enter augmenter for "linkat" Reusing "open" BPF sys_enter augmenter for "symlinkat" Reusing "fremovexattr" BPF sys_enter augmenter for "readlinkat" Reusing "fremovexattr" BPF sys_enter augmenter for "fchmodat" Reusing "fremovexattr" BPF sys_enter augmenter for "faccessat" Reusing "fremovexattr" BPF sys_enter augmenter for "utimensat" Reusing "connect" BPF sys_enter augmenter for "accept4" Reusing "fremovexattr" BPF sys_enter augmenter for "name_to_handle_at" Reusing "fremovexattr" BPF sys_enter augmenter for "renameat2" Reusing "open" BPF sys_enter augmenter for "memfd_create" Reusing "fremovexattr" BPF sys_enter augmenter for "execveat" Reusing "fremovexattr" BPF sys_enter augmenter for "statx" TL;DR: These are the new syscalls that can be augmented Reusing "openat" BPF sys_enter augmenter for "open_tree" Reusing "openat" BPF sys_enter augmenter for "openat2" Reusing "openat" BPF sys_enter augmenter for "mount_setattr" Reusing "openat" BPF sys_enter augmenter for "move_mount" Reusing "open" BPF sys_enter augmenter for "fsopen" Reusing "openat" BPF sys_enter augmenter for "fspick" Reusing "openat" BPF sys_enter augmenter for "faccessat2" Reusing "openat" BPF sys_enter augmenter for "fchmodat2" as for the perf trace output: before perf $ perf trace -e faccessat2 --max-events=1 [no output] after perf $ ./perf trace -e faccessat2 --max-events=1 0.000 ( 0.037 ms): waybar/958 faccessat2(dfd: 40, filename: "uevent") = 0 P.S. The reason why this bug was not found in the past five years is probably because it only happens to the newer syscalls whose id is greater, for instance, faccessat2 of id 439, which not a lot of people care about when using perf trace. [Arnaldo]: notes That and the fact that the BPF code was hidden before having to use -e, that got changed kinda recently when we switched to using BPF skels for augmenting syscalls in 'perf trace': ⬢[acme@toolbox perf-tools-next]$ git log --oneline tools/perf/util/bpf_skel/augmented_raw_syscalls.bpf.c a9f4c6c999008c92 perf trace: Collect sys_nanosleep first argument 29d16de26df17e94 perf augmented_raw_syscalls.bpf: Move 'struct timespec64' to vmlinux.h 5069211e2f0b47e7 perf trace: Use the right bpf_probe_read(_str) variant for reading user data 33b725ce7b988756 perf trace: Avoid compile error wrt redefining bool 7d9642311b6d9d31 perf bpf augmented_raw_syscalls: Add an assert to make sure sizeof(augmented_arg->value) is a power of two. 262b54b6c9396823 perf bpf augmented_raw_syscalls: Add an assert to make sure sizeof(saddr) is a power of two. 1836480429d173c0 perf bpf_skel augmented_raw_syscalls: Cap the socklen parameter using &= sizeof(saddr) cd2cece61ac5f900 perf trace: Tidy comments related to BPF + syscall augmentation 5e6da6be3082f77b perf trace: Migrate BPF augmentation to use a skeleton ⬢[acme@toolbox perf-tools-next]$ ⬢[acme@toolbox perf-tools-next]$ git show --oneline --pretty=reference 5e6da6be3082f77b | head -1 5e6da6be3082f77b (perf trace: Migrate BPF augmentation to use a skeleton, 2023-08-10) ⬢[acme@toolbox perf-tools-next]$ I.e. from August, 2023. One had as well to ask for BUILD_BPF_SKEL=1, which now is default if all it needs is available on the system. I simplified the code to not expose the 'struct syscall' outside of tools/perf/util/syscalltbl.c, instead providing a function to go from the index to the syscall id: int syscalltbl__id_at_idx(struct syscalltbl *tbl, int idx); Signed-off-by: Howard Chu Tested-by: Arnaldo Carvalho de Melo Link: https://lore.kernel.org/lkml/ZmhlAxbVcAKoPTg8@x1 Link: https://lore.kernel.org/r/20240705132059.853205-2-howardchu95@gmail.com Signed-off-by: Namhyung Kim tools/perf/builtin-trace.c | 14 +++++++------- tools/perf/util/syscalltbl.c | 7 +++++++ tools/perf/util/syscalltbl.h | 1 + 3 files changed, 15 insertions(+), 7 deletions(-) commit 226c49446bccee1c2315bc88bbbca7e6542e98fc Author: Tejun Heo Date: Fri Jul 12 06:46:28 2024 -1000 cgroup: Add Michal Koutný as a maintainer Michal has been contributing and reviewing patches across cgroup for a while now. Add him as a maintainer. Signed-off-by: Tejun Heo Acked-by: Michal Koutný Acked-by: Johannes Weiner Cc: Zefan Li Cc: Linus Torvalds MAINTAINERS | 1 + 1 file changed, 1 insertion(+) commit 6a26f9c68901797261bc145975a02f85be0c1d8f Author: Xiu Jianfeng Date: Thu Jul 11 10:14:57 2024 +0000 cgroup/misc: Introduce misc.events.local Currently the event counting provided by misc.events is hierarchical, it's not practical if user is only concerned with events of a specified cgroup. Therefore, introduce misc.events.local collect events specific to the given cgroup. This is analogous to memory.events.local and pids.events.local. Signed-off-by: Xiu Jianfeng Signed-off-by: Tejun Heo Documentation/admin-guide/cgroup-v2.rst | 5 +++++ include/linux/misc_cgroup.h | 3 +++ kernel/cgroup/misc.c | 39 ++++++++++++++++++++++++++++----- 3 files changed, 41 insertions(+), 6 deletions(-) commit 617069741dfbb141bc4574531a5dbbbad8ddf197 Author: Mikulas Patocka Date: Wed Jul 10 20:53:12 2024 +0200 dm: introduce the target flag mempool_needs_integrity This commit introduces the dm target flag mempool_needs_integrity. When the flag is set, device mapper will call bioset_integrity_create on it's bio sets. The target can then call bio_integrity_alloc on the bios allocated from the table's mempool. Signed-off-by: Mikulas Patocka Signed-off-by: Mike Snitzer drivers/md/dm-table.c | 7 +++++-- include/linux/device-mapper.h | 6 ++++++ 2 files changed, 11 insertions(+), 2 deletions(-) commit 1553419c3c10cf386496e68b90b5d0ce966ac614 Author: Ian Rogers Date: Wed Jul 3 18:17:45 2024 -0700 perf dso: Fix address sanitizer build Various files had been missed from having accessor functions added for the sake of dso reference count checking. Add the function calls and missing dso accessor functions. Fixes: ee756ef7491e ("perf dso: Add reference count checking and accessor functions") Signed-off-by: Ian Rogers Cc: James Clark Cc: Suzuki K Poulose Cc: Yunseong Kim Cc: Will Deacon Cc: Mike Leach Cc: Leo Yan Cc: Athira Rajeev Cc: John Garry Link: https://lore.kernel.org/r/20240704011745.1021288-1-irogers@google.com Signed-off-by: Namhyung Kim tools/perf/arch/powerpc/util/skip-callchain-idx.c | 8 ++++---- tools/perf/ui/gtk/annotate.c | 5 +++-- tools/perf/util/cs-etm.c | 10 +++++----- tools/perf/util/disasm.c | 10 +++++----- tools/perf/util/dso.h | 10 ++++++++++ tools/perf/util/srcline.c | 12 ++++++------ tools/perf/util/symbol.c | 15 ++++++++------- tools/perf/util/unwind-libdw.c | 12 ++++++------ tools/perf/util/unwind-libunwind-local.c | 18 +++++++++--------- 9 files changed, 56 insertions(+), 44 deletions(-) commit 14b0fffa25ce4a9ef5d4448b20b80217b2caa0e8 Author: Leo Yan Date: Sat Jul 6 16:20:35 2024 +0100 perf mem: Warn if memory events are not supported on all CPUs It is possible that memory events are not supported on all CPUs. Prints a warning by dumping the enabled CPU maps in this case. Signed-off-by: Leo Yan Reviewed-by: James Clark Cc: Suzuki K Poulose Cc: Will Deacon Cc: Mike Leach Cc: Kajol Jain Cc: John Garry Cc: linux-arm-kernel@lists.infradead.org Cc: coresight@lists.linaro.org Link: https://lore.kernel.org/r/20240706152035.86983-3-leo.yan@arm.com Signed-off-by: Namhyung Kim tools/perf/util/mem-events.c | 14 ++++++++++++++ 1 file changed, 14 insertions(+) commit e6b4da6759334bfdead28f9ad32323cbdbf9f670 Author: Leo Yan Date: Sat Jul 6 16:20:34 2024 +0100 perf arm-spe: Support multiple Arm SPE PMUs A platform can have more than one Arm SPE PMU. For example, a system with multiple clusters may have each cluster enabled with its own Arm SPE instance. In such case, the PMU devices will be named 'arm_spe_0', 'arm_spe_1', and so on. Currently, the tool only supports 'arm_spe_0'. This commit extends support to multiple Arm SPE PMUs by detecting the substring 'arm_spe_'. Signed-off-by: Leo Yan Reviewed-by: James Clark Cc: Suzuki K Poulose Cc: Will Deacon Cc: Mike Leach Cc: Kajol Jain Cc: John Garry Cc: linux-arm-kernel@lists.infradead.org Cc: coresight@lists.linaro.org Link: https://lore.kernel.org/r/20240706152035.86983-2-leo.yan@arm.com Signed-off-by: Namhyung Kim tools/perf/arch/arm/util/pmu.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 759ce73cf74d666ca90d2860dc386fd839887e19 Author: Haoze Xie Date: Mon Jul 8 02:04:02 2024 +0800 perf build x86: Fix SC2034 error in syscalltbl.sh Change the unused var in 'arch/x86/entry/syscalls/syscalltbl.sh' to '_' when reading from '$sorted_table'. This change allows the script to pass tests of ShellCheck before and after version 0.7.2 at the same time. When building in arch x86, syscalltbl.sh got a ShellCheck warning, which makes compilation error: In arch/x86/entry/syscalls/syscalltbl.sh line 27: while read nr _abi name entry _compat; do ^-^ SC2034: abi appears unused. Verify use (or export if used externally). ^----^ SC2034: compat appears unused. Verify use (or export if used externally). The script reads unused param abi and compat. It uses format '_xxx' to indicate dummy vars, which won't work properly when ShellCheck <= 0.7.2. According to SC2034, the more general way of writing is to use directly '_' to indicate discarding vars. 'entry' is also replaced by '_' because it just happens to be defined in emit function, otherwise it will lead to some misunderstandings. Link: https://www.shellcheck.net/wiki/SC2034 Signed-off-by: Haoze Xie Signed-off-by: Yuan Tan Link: https://lore.kernel.org/r/2143cab4cd8468c88860f4e5e382d0e6b4d89ac9.1720372178.git.royenheart@gmail.com Signed-off-by: Namhyung Kim tools/perf/arch/x86/entry/syscalls/syscalltbl.sh | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) commit 6353abd32c8d2a3698115e03b71099858a38591d Author: Haoze Xie Date: Mon Jul 8 02:01:00 2024 +0800 perf record: Fix memset out-of-range error Modified the object of 'memset' from '&lost.lost' to '&lost' in record__read_lost_samples. This allows 'memset' to access memory properly without causing out-of-bounds problems. The problems got from builtin-record.c are: In file included from /usr/include/string.h:495, from util/parse-events.h:13, from builtin-record.c:14: In function 'memset', inlined from 'record__read_lost_samples' at builtin-record.c:1958:6, inlined from '__cmd_record.constprop' at builtin-record.c:2817:2: /usr/include/x86_64-linux-gnu/bits/string_fortified.h:71:10: error: '__builtin_memset' offset [17, 64] from the object at 'lost' is out of the bounds of referenced subobject 'lost' with type 'struct perf_record_lost_samples' at offset 0 [-Werror=array-bounds] 71|return __builtin___memset_chk (__dest,__ch,__len,__bos0 (__dest)); | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ The error arised when performing a memset operation on the 'lost' variable, the bytes of 'sizeof(lost)' exceeds that of '&lost.lost', which are 64 and 16. Fixes: 6c1785cd75ef ("perf record: Ensure space for lost samples") Signed-off-by: Haoze Xie Signed-off-by: Yuan Tan Link: https://lore.kernel.org/r/11e12f171b846577cac698cd3999db3d7f6c4d03.1720372317.git.royenheart@gmail.com Signed-off-by: Namhyung Kim tools/perf/builtin-record.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) commit 306f921e87fc647f1b65c9517d7c97cea854f4f3 Author: Madadi Vineeth Reddy Date: Sun Jul 7 23:57:16 2024 +0530 perf sched map: Add --fuzzy-name option for fuzzy matching in task names The --fuzzy-name option can be used if fuzzy name matching is required. For example, "taskname" can be matched to any string that contains "taskname" as its substring. Sample output for --task-name wdav --fuzzy-name ============= . *A0 . . . . - . 131040.641346 secs A0 => wdavdaemon:62509 . A0 *B0 . . . - . 131040.641378 secs B0 => wdavdaemon:62274 . *- B0 . . . - . 131040.641379 secs *C0 . B0 . . . . . 131040.641572 secs C0 => wdavdaemon:62283 C0 . B0 . *D0 . . . 131040.641572 secs D0 => wdavdaemon:62277 C0 . B0 . D0 . *E0 . 131040.641578 secs E0 => wdavdaemon:62270 *- . B0 . D0 . E0 . 131040.641581 secs Suggested-by: Chen Yu Reviewed-and-tested-by: Athira Rajeev Signed-off-by: Madadi Vineeth Reddy Link: https://lore.kernel.org/r/20240707182716.22054-4-vineethr@linux.ibm.com Signed-off-by: Namhyung Kim tools/perf/Documentation/perf-sched.txt | 3 +++ tools/perf/builtin-sched.c | 20 +++++++++++++------- 2 files changed, 16 insertions(+), 7 deletions(-) commit 9cc0afed6fdc46a96501baa49527fa00aaef37b1 Author: Madadi Vineeth Reddy Date: Sun Jul 7 23:57:15 2024 +0530 perf sched map: Add support for multiple task names using CSV To track the scheduling patterns of multiple tasks simultaneously, multiple task names can be specified using a comma separator without any whitespace. Sample output for --task-name perf,wdavdaemon ============= . *A0 . . . . - . 131040.641346 secs A0 => wdavdaemon:62509 . A0 *B0 . . . - . 131040.641378 secs B0 => wdavdaemon:62274 . *- B0 . . . - . 131040.641379 secs *C0 . B0 . . . . . 131040.641572 secs C0 => wdavdaemon:62283 ... . *- . . . . . . 131041.395649 secs . . . . . . . *X2 131041.403969 secs X2 => perf:70211 . . . . . . . *- 131041.404006 secs Suggested-by: Namhyung Kim Reviewed-and-tested-by: Athira Rajeev Signed-off-by: Madadi Vineeth Reddy Cc: Chen Yu Link: https://lore.kernel.org/r/20240707182716.22054-3-vineethr@linux.ibm.com Signed-off-by: Namhyung Kim tools/perf/Documentation/perf-sched.txt | 5 +++-- tools/perf/builtin-sched.c | 32 +++++++++++++++++++++++++++----- 2 files changed, 30 insertions(+), 7 deletions(-) commit 3116d6091081ad6038db6d68bca9d7b84ba0b7f0 Author: Madadi Vineeth Reddy Date: Sun Jul 7 23:57:14 2024 +0530 perf sched map: Add task-name option to filter the output map By default, perf sched map prints sched-in events for all the tasks which may not be required all the time as it prints lot of symbols and rows to the terminal. With --task-name option, one could specify the specific task name for which the map has to be shown. This would help in analyzing the CPU usage patterns easier for that specific task. Since multiple PID's might have the same task name, using task-name filter would be more useful for debugging. For other tasks, instead of printing the symbol, '-' is printed and the same '.' is used to represent idle. '-' is used instead of symbol for other tasks because it helps in clear visualization of task of interest and secondly the symbol itself doesn't mean anything because the sched-in of that symbol will not be printed(first sched-in contains pid and the corresponding symbol). When using the --task-name option, the sched-out time is represented by a '*-'. Since not all task sched-in events are printed, the sched-out time of the relevant task might be lost. This representation ensures that the sched-out time of the interested task is not overlooked. 6.10.0-rc1 ========== *A0 131040.639793 secs A0 => migration/0:19 *. 131040.639801 secs . => swapper:0 . *B0 131040.639830 secs B0 => migration/1:24 . *. 131040.639836 secs . . *C0 131040.640108 secs C0 => migration/2:30 . . *. 131040.640163 secs . . . *D0 131040.640386 secs D0 => migration/3:36 . . . *. 131040.640395 secs 6.10.0-rc1 + patch (--task-name wdavdaemon) ============= . *A0 . . . . - . 131040.641346 secs A0 => wdavdaemon:62509 . A0 *B0 . . . - . 131040.641378 secs B0 => wdavdaemon:62274 - *- B0 . . . - . 131040.641379 secs *C0 . B0 . . . . . 131040.641572 secs C0 => wdavdaemon:62283 C0 . B0 . *D0 . . . 131040.641572 secs D0 => wdavdaemon:62277 C0 . B0 . D0 . *E0 . 131040.641578 secs E0 => wdavdaemon:62270 *- . B0 . D0 . E0 . 131040.641581 secs . . B0 . D0 . *- . 131040.641583 secs Reviewed-and-tested-by: Athira Rajeev Signed-off-by: Madadi Vineeth Reddy Cc: Chen Yu Link: https://lore.kernel.org/r/20240707182716.22054-2-vineethr@linux.ibm.com Signed-off-by: Namhyung Kim tools/perf/Documentation/perf-sched.txt | 6 ++ tools/perf/builtin-sched.c | 147 ++++++++++++++++++++++++-------- 2 files changed, 117 insertions(+), 36 deletions(-) commit c51cba4755609ad97ba97713210c16f043c73224 Merge: 75ed63a5ab5d 216d04139a6d Author: Mark Brown Date: Fri Jul 12 17:38:18 2024 +0100 Fix the unbalanced pm_runtime_enable in wcd937x-sdw Merge series from Mohammad Rafi Shaik : This patch set change will fix the unbalanced pm_runtime_enable in wcd937x-sdw soundwire slave. And removed the string compare with widget name in MIC BIAS settings, instead of string compare use the MIC BIAS id's as value. Removed separate handling for vdd-buck regulator supply which is not required. The vdd-buck regulator supply enabled using bulk enable. Added the error handling in wcd937x_probe() and disable the regulators in error case. commit 8a25418ba65a5d2494b369f6178a284c449bc399 Author: Thorsten Blum Date: Fri Jul 5 06:54:59 2024 +0200 HID: hid-steam: Fix typo in goto label s/stream/steam/ Signed-off-by: Thorsten Blum Link: https://patch.msgid.link/20240705045458.65108-2-thorsten.blum@toblux.com Signed-off-by: Benjamin Tissoires drivers/hid/hid-steam.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) commit ad1ff1f250c966b945d40a6a2e548f7d701b96df Author: Chen Ni Date: Tue Jul 9 09:22:23 2024 +0800 HID: mcp2221: Remove unnecessary semicolon Remove unnecessary semicolon at the end of the switch statement. This is detected by coccinelle. Signed-off-by: Chen Ni Reviewed-by: Jonathan Cameron Link: https://patch.msgid.link/20240709012223.17393-1-nichen@iscas.ac.cn Signed-off-by: Benjamin Tissoires drivers/hid/hid-mcp2221.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 523e6f4f50fc7078be80434a98cc81b48a847923 Author: Colin Ian King Date: Thu Jul 11 09:35:13 2024 +0100 HID: Fix spelling mistakes "Kensigton" -> "Kensington" There are spelling mistakes in a comment and in the module description. Fix these. Signed-off-by: Colin Ian King Link: https://patch.msgid.link/20240711083513.282724-1-colin.i.king@gmail.com Signed-off-by: Benjamin Tissoires drivers/hid/hid-kensington.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) commit 517125f6749402e579f715519147145944f12ad9 Author: Daniel Borkmann Date: Fri Jul 12 18:12:30 2024 +0200 selftests/bpf: DENYLIST.aarch64: Skip fexit_sleep again Revert commit 90dc946059b7 ("selftests/bpf: DENYLIST.aarch64: Remove fexit_sleep") again. The fix in 19d3c179a377 ("bpf, arm64: Fix trampoline for BPF_TRAMP_F_CALL_ORIG") does not address all of the issues and BPF CI is still hanging and timing out: https://github.com/kernel-patches/bpf/actions/runs/9905842936/job/27366435436 [...] #89/11 fexit_bpf2bpf/func_replace_global_func:OK #89/12 fexit_bpf2bpf/fentry_to_cgroup_bpf:OK #89/13 fexit_bpf2bpf/func_replace_progmap:OK #89 fexit_bpf2bpf:OK Error: The operation was canceled. Thus more investigation work & fixing is needed before the test can be put in place again. Signed-off-by: Daniel Borkmann Cc: Puranjay Mohan Link: https://lore.kernel.org/bpf/20240705145009.32340-1-puranjay@kernel.org tools/testing/selftests/bpf/DENYLIST.aarch64 | 1 + 1 file changed, 1 insertion(+) commit ebf51e460e488511d9ee60b07d00dac68883facf Author: Eric Chan Date: Thu Jul 11 19:39:45 2024 +0000 kunit: Introduce KUNIT_ASSERT_MEMEQ and KUNIT_ASSERT_MEMNEQ macros Introduces KUNIT_ASSERT_MEMEQ and KUNIT_ASSERT_MEMNEQ macros to provide assert-type equivalents for memory comparison. While KUNIT_EXPECT_MEMEQ and KUNIT_EXPECT_MEMNEQ are available for expectations, the addition of these new macros ensures that assertions can also be used for memory comparisons, enhancing the consistency and completeness of the kunit framework. Signed-off-by: Eric Chan Reviewed-by: David Gow Signed-off-by: Shuah Khan include/kunit/test.h | 54 ++++++++++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 54 insertions(+) commit 7d4087b013895524438f2522367c984f776e09e3 Author: Eric Chan Date: Thu Jul 11 19:39:31 2024 +0000 kunit: Rename KUNIT_ASSERT_FAILURE to KUNIT_FAIL_AND_ABORT for readability Both KUNIT_FAIL and KUNIT_ASSERT_FAILURE defined to KUNIT_FAIL_ASSERTION with different tpye of kunit_assert_type. The current naming of KUNIT_ASSERT_FAILURE and KUNIT_FAIL_ASSERTION is confusing due to their similarities. To improve readability and symmetry, renames KUNIT_ASSERT_FAILURE to KUNIT_FAIL_AND_ABORT. Makes the naming consistent, with KUNIT_FAIL and KUNIT_FAIL_AND_ABORT being symmetrical. Additionally, an explanation for KUNIT_FAIL_AND_ABORT has been added to clarify its usage. Signed-off-by: Eric Chan Reviewed-by: David Gow Signed-off-by: Shuah Khan drivers/input/tests/input_test.c | 2 +- include/kunit/assert.h | 2 +- include/kunit/test.h | 13 ++++++++++++- 3 files changed, 14 insertions(+), 3 deletions(-) commit 2be32bbe6989e071aea1767cb54c7528a0dac07f Author: Eric Chan Date: Thu Jul 11 19:39:17 2024 +0000 kunit: Fix the comment of KUNIT_ASSERT_STRNEQ as assertion The current comment for KUNIT_ASSERT_STRNEQ incorrectly describes it as an expectation. Since KUNIT_ASSERT_STRNEQ is an assertion, updates the comment to correctly refer to it as such. Signed-off-by: Eric Chan Reviewed-by: David Gow Signed-off-by: Shuah Khan include/kunit/test.h | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) commit 7554a7b96dc0dcc445d4af7077c96c6ab0988c79 Author: Kees Cook Date: Thu Jul 11 09:54:32 2024 -0700 kunit: executor: Simplify string allocation handling The alloc/copy code pattern is better consolidated to single kstrdup (and kstrndup) calls instead. This gets rid of deprecated[1] strncpy() uses as well. Replace one other strncpy() use with the more idiomatic strscpy(). Link: https://github.com/KSPP/linux/issues/90 [1] Reviewed-by: David Gow Signed-off-by: Kees Cook Signed-off-by: Shuah Khan lib/kunit/executor.c | 12 +++--------- lib/kunit/executor_test.c | 2 +- 2 files changed, 4 insertions(+), 10 deletions(-) commit 8b6c32e831ef4496b51a68ddc5be9bb9e8d2337d Merge: 74e54d532b59 3b10f25704be Author: Will Deacon Date: Fri Jul 12 16:57:47 2024 +0100 Merge branch 'iommu/iommufd/paging-domain-alloc' into iommu/next * iommu/iommufd/paging-domain-alloc: RDMA/usnic: Use iommu_paging_domain_alloc() wifi: ath11k: Use iommu_paging_domain_alloc() wifi: ath10k: Use iommu_paging_domain_alloc() drm/msm: Use iommu_paging_domain_alloc() vhost-vdpa: Use iommu_paging_domain_alloc() vfio/type1: Use iommu_paging_domain_alloc() iommufd: Use iommu_paging_domain_alloc() iommu: Add iommu_paging_domain_alloc() interface commit 74e54d532b59c7a4375205d498c68634e0cf43b2 Merge: 578cc98b66f5 8519e689834a Author: Will Deacon Date: Fri Jul 12 16:57:42 2024 +0100 Merge branch 'iommu/iommufd/attach-handles' into iommu/next * iommu/iommufd/attach-handles: iommu: Extend domain attach group with handle support iommu: Add attach handle to struct iopf_group iommu: Remove sva handle list iommu: Introduce domain attachment handle commit 578cc98b66f5a5c607d03b4191a314ec51d19e5f Merge: 342d3c1cbf6f 6bac3388889c Author: Will Deacon Date: Fri Jul 12 16:57:34 2024 +0100 Merge branch 'iommu/pci/ats' into iommu/next * iommu/pci/ats: arm64: dts: fvp: Enable PCIe ATS for Base RevC FVP iommu/of: Support ats-supported device-tree property dt-bindings: PCI: generic: Add ats-supported property commit 342d3c1cbf6f181e202c9984c5f9c68b808f4f61 Merge: c2b2e5c50330 3e36c15fc1cc Author: Will Deacon Date: Fri Jul 12 16:55:43 2024 +0100 Merge branch 'iommu/fwspec-ops-removal' into iommu/next * iommu/fwspec-ops-removal: iommu: Remove iommu_fwspec ops OF: Simplify of_iommu_configure() ACPI: Retire acpi_iommu_fwspec_ops() iommu: Resolve fwspec ops automatically iommu/mediatek-v1: Clean up redundant fwspec checks [will: Fixed conflict in drivers/iommu/tegra-smmu.c between fwspec ops removal and fwspec driver fix as per Robin and Jon] commit 6ad8735994b854b23c824dd6b1dd2126e893a3b4 Author: yang.zhang Date: Wed May 8 10:24:45 2024 +0800 riscv: set trap vector earlier The exception vector of the booting hart is not set before enabling the mmu and then still points to the value of the previous firmware, typically _start. That makes it hard to debug setup_vm() when bad things happen. So fix that by setting the exception vector earlier. Reviewed-by: Alexandre Ghiti Signed-off-by: yang.zhang Link: https://lore.kernel.org/r/20240508022445.6131-1-gaoshanliukou@163.com Signed-off-by: Palmer Dabbelt arch/riscv/kernel/head.S | 3 +++ 1 file changed, 3 insertions(+) commit 5ee121a39330e437cae0d64feeb459c7ec9e9500 Merge: c9b8cd139c1d f2c43c61160e Author: Palmer Dabbelt Date: Fri Jul 12 03:23:22 2024 -0700 Merge patch series "riscv: Apply Zawrs when available" Andrew Jones says: Zawrs provides two instructions (wrs.nto and wrs.sto), where both are meant to allow the hart to enter a low-power state while waiting on a store to a memory location. The instructions also both wait an implementation-defined "short" duration (unless the implementation terminates the stall for another reason). The difference is that while wrs.sto will terminate when the duration elapses, wrs.nto, depending on configuration, will either just keep waiting or an ILL exception will be raised. Linux will use wrs.nto, so if platforms have an implementation which falls in the "just keep waiting" category (which is not expected), then it should _not_ advertise Zawrs in the hardware description. Like wfi (and with the same {m,h}status bits to configure it), when wrs.nto is configured to raise exceptions it's expected that the higher privilege level will see the instruction was a wait instruction, do something, and then resume execution following the instruction. For example, KVM does configure exceptions for wfi (hstatus.VTW=1) and therefore also for wrs.nto. KVM does this for wfi since it's better to allow other tasks to be scheduled while a VCPU waits for an interrupt. For waits such as those where wrs.nto/sto would be used, which are typically locks, it is also a good idea for KVM to be involved, as it can attempt to schedule the lock holding VCPU. This series starts with Christoph's addition of the riscv smp_cond_load_relaxed function which applies wrs.sto when available. That patch has been reworked to use wrs.nto and to use the same approach as Arm for the wait loop, since we can't have arbitrary C code between the load-reserved and the wrs. Then, hwprobe support is added (since the instructions are also usable from usermode), and finally KVM is taught about wrs.nto, allowing guests to see and use the Zawrs extension. We still don't have test results from hardware, and it's not possible to prove that using Zawrs is a win when testing on QEMU, not even when oversubscribing VCPUs to guests. However, it is possible to use KVM selftests to force a scenario where we can prove Zawrs does its job and does it well. [4] is a test which does this and, on my machine, without Zawrs it takes 16 seconds to complete and with Zawrs it takes 0.25 seconds. This series is also available here [1]. In order to use QEMU for testing a build with [2] is needed. In order to enable guests to use Zawrs with KVM using kvmtool, the branch at [3] may be used. [1] https://github.com/jones-drew/linux/commits/riscv/zawrs-v3/ [2] https://lore.kernel.org/all/20240312152901.512001-2-ajones@ventanamicro.com/ [3] https://github.com/jones-drew/kvmtool/commits/riscv/zawrs/ [4] https://github.com/jones-drew/linux/commit/cb2beccebcece10881db842ed69bdd5715cfab5d Link: https://lore.kernel.org/r/20240426100820.14762-8-ajones@ventanamicro.com * b4-shazam-merge: KVM: riscv: selftests: Add Zawrs extension to get-reg-list test KVM: riscv: Support guest wrs.nto riscv: hwprobe: export Zawrs ISA extension riscv: Add Zawrs support for spinlocks dt-bindings: riscv: Add Zawrs ISA extension description riscv: Provide a definition for 'pause' Signed-off-by: Palmer Dabbelt commit f2c43c61160ecba15f073b79abf1ea351e41203d Author: Andrew Jones Date: Fri Apr 26 12:08:26 2024 +0200 KVM: riscv: selftests: Add Zawrs extension to get-reg-list test KVM RISC-V allows the Zawrs extension for the Guest/VM, so add it to the get-reg-list test. Signed-off-by: Andrew Jones Acked-by: Anup Patel Link: https://lore.kernel.org/r/20240426100820.14762-14-ajones@ventanamicro.com Signed-off-by: Palmer Dabbelt tools/testing/selftests/kvm/riscv/get-reg-list.c | 4 ++++ 1 file changed, 4 insertions(+) commit 86d6a86e59e3aa425d829a935c0d92388e4fe55b Author: Andrew Jones Date: Fri Apr 26 12:08:25 2024 +0200 KVM: riscv: Support guest wrs.nto When a guest traps on wrs.nto, call kvm_vcpu_on_spin() to attempt to yield to the lock holding VCPU. Also extend the KVM ISA extension ONE_REG interface to allow KVM userspace to detect and enable the Zawrs extension for the Guest/VM. Signed-off-by: Andrew Jones Acked-by: Anup Patel Link: https://lore.kernel.org/r/20240426100820.14762-13-ajones@ventanamicro.com Signed-off-by: Palmer Dabbelt arch/riscv/include/asm/kvm_host.h | 1 + arch/riscv/include/uapi/asm/kvm.h | 1 + arch/riscv/kvm/vcpu.c | 1 + arch/riscv/kvm/vcpu_insn.c | 15 +++++++++++++++ arch/riscv/kvm/vcpu_onereg.c | 2 ++ 5 files changed, 20 insertions(+) commit c2b2e5c50330b29804339df4e7adf70e9f19b793 Merge: 710f1071f161 228159802bce Author: Will Deacon Date: Fri Jul 12 16:54:34 2024 +0100 Merge branch 'iommu/core' into iommu/next * iommu/core: docs: iommu: Remove outdated Documentation/userspace-api/iommu.rst iommufd: Use atomic_long_try_cmpxchg() in incr_user_locked_vm() iommu/iova: Add missing MODULE_DESCRIPTION() macro iommu/dma: Prune redundant pgprot arguments iommu: Make iommu_sva_domain_alloc() static commit a1010fce1c0c2ce3b305aa6e8ff70e86f99e3226 Merge: 2454075f8e29 deac5871eb07 Author: Alexei Starovoitov Date: Fri Jul 12 08:54:08 2024 -0700 Merge branch 'use-overflow-h-helpers-to-check-for-overflows' Shung-Hsi Yu says: ==================== Use overflow.h helpers to check for overflows This patch set refactors kernel/bpf/verifier.c to use type-agnostic, generic overflow-check helpers defined in include/linux/overflow.h to check for addition and subtraction overflow, and drop the signed_*_overflows() helpers we currently have in kernel/bpf/verifier.c; with a fix for overflow check in adjust_jmp_off() in patch 1. There should be no functional change in how the verifier works and the main motivation is to make future refactoring[1] easier. While check_mul_overflow() also exists and could potentially replace what we have in scalar*_min_max_mul(), it does not help with refactoring and would either change how the verifier works (e.g. lifting restriction on umax<=U32_MAX and u32_max<=U16_MAX) or make the code slightly harder to read, so it is left for future endeavour. Changes from v2 - add fix for 5337ac4c9b80 ("bpf: Fix the corner case with may_goto and jump to the 1st insn.") to correct the overflow check for general jump instructions - adapt to changes in commit 5337ac4c9b80 ("bpf: Fix the corner case with may_goto and jump to the 1st insn.") - refactor in adjust_jmp_off() as well and remove signed_add16_overflow() Changes from v1 : - use pointers to values in dst_reg directly as the sum/diff pointer and remove the else branch (Jiri) - change local variables to be dst_reg pointers instead of src_reg values - include comparison of generated assembly before & after the change (Alexei) 1: https://github.com/kernel-patches/bpf/pull/7205/commits ==================== Link: https://lore.kernel.org/r/20240712080127.136608-1-shung-hsi.yu@suse.com Signed-off-by: Alexei Starovoitov commit 710f1071f1619657ff87d0d7c019fbcba1bcd97b Merge: 4295d785a7aa b577060ac7ba Author: Will Deacon Date: Fri Jul 12 16:54:10 2024 +0100 Merge branch 'iommu/qualcomm/msm' into iommu/next * iommu/qualcomm/msm: dt-bindings: iommu: Convert msm,iommu-v0 to yaml dt-bindings: iommu: qcom,iommu: Add MSM8953 GPU IOMMU to SMMUv2 compatibles commit deac5871eb0751454cb80b3ff6b69e42a6c1bab2 Author: Shung-Hsi Yu Date: Fri Jul 12 16:01:26 2024 +0800 bpf: use check_sub_overflow() to check for subtraction overflows Similar to previous patch that drops signed_add*_overflows() and uses (compiler) builtin-based check_add_overflow(), do the same for signed_sub*_overflows() and replace them with the generic check_sub_overflow() to make future refactoring easier and have the checks implemented more efficiently. Unsigned overflow check for subtraction does not use helpers and are simple enough already, so they're left untouched. After the change GCC 13.3.0 generates cleaner assembly on x86_64: if (check_sub_overflow(*dst_smin, src_reg->smax_value, dst_smin) || 139bf: mov 0x28(%r12),%rax 139c4: mov %edx,0x54(%r12) 139c9: sub %r11,%rax 139cc: mov %rax,0x28(%r12) 139d1: jo 14627 check_sub_overflow(*dst_smax, src_reg->smin_value, dst_smax)) { 139d7: mov 0x30(%r12),%rax 139dc: sub %r9,%rax 139df: mov %rax,0x30(%r12) if (check_sub_overflow(*dst_smin, src_reg->smax_value, dst_smin) || 139e4: jo 14627 ... *dst_smin = S64_MIN; 14627: movabs $0x8000000000000000,%rax 14631: mov %rax,0x28(%r12) *dst_smax = S64_MAX; 14636: sub $0x1,%rax 1463a: mov %rax,0x30(%r12) Before the change it gives: if (signed_sub_overflows(dst_reg->smin_value, smax_val) || 13a50: mov 0x28(%r12),%rdi 13a55: mov %edx,0x54(%r12) dst_reg->smax_value = S64_MAX; 13a5a: movabs $0x7fffffffffffffff,%rdx 13a64: mov %eax,0x50(%r12) dst_reg->smin_value = S64_MIN; 13a69: movabs $0x8000000000000000,%rax s64 res = (s64)((u64)a - (u64)b); 13a73: mov %rdi,%rsi 13a76: sub %rcx,%rsi if (b < 0) 13a79: test %rcx,%rcx 13a7c: js 145ea if (signed_sub_overflows(dst_reg->smin_value, smax_val) || 13a82: cmp %rsi,%rdi 13a85: jl 13ac7 signed_sub_overflows(dst_reg->smax_value, smin_val)) { 13a87: mov 0x30(%r12),%r8 s64 res = (s64)((u64)a - (u64)b); 13a8c: mov %r8,%rax 13a8f: sub %r9,%rax return res > a; 13a92: cmp %rax,%r8 13a95: setl %sil if (b < 0) 13a99: test %r9,%r9 13a9c: js 147d1 dst_reg->smax_value = S64_MAX; 13aa2: movabs $0x7fffffffffffffff,%rdx dst_reg->smin_value = S64_MIN; 13aac: movabs $0x8000000000000000,%rax if (signed_sub_overflows(dst_reg->smin_value, smax_val) || 13ab6: test %sil,%sil 13ab9: jne 13ac7 dst_reg->smin_value -= smax_val; 13abb: mov %rdi,%rax dst_reg->smax_value -= smin_val; 13abe: mov %r8,%rdx dst_reg->smin_value -= smax_val; 13ac1: sub %rcx,%rax dst_reg->smax_value -= smin_val; 13ac4: sub %r9,%rdx 13ac7: mov %rax,0x28(%r12) ... 13ad1: mov %rdx,0x30(%r12) ... if (signed_sub_overflows(dst_reg->smin_value, smax_val) || 145ea: cmp %rsi,%rdi 145ed: jg 13ac7 145f3: jmp 13a87 Suggested-by: Jiri Olsa Signed-off-by: Shung-Hsi Yu Acked-by: Jiri Olsa Link: https://lore.kernel.org/r/20240712080127.136608-4-shung-hsi.yu@suse.com Signed-off-by: Alexei Starovoitov kernel/bpf/verifier.c | 57 +++++++++++++-------------------------------------- 1 file changed, 14 insertions(+), 43 deletions(-) commit 28a4411076b254c67842348e3b25c2fb41a94cad Author: Shung-Hsi Yu Date: Fri Jul 12 16:01:25 2024 +0800 bpf: use check_add_overflow() to check for addition overflows signed_add*_overflows() was added back when there was no overflow-check helper. With the introduction of such helpers in commit f0907827a8a91 ("compiler.h: enable builtin overflow checkers and add fallback code"), we can drop signed_add*_overflows() in kernel/bpf/verifier.c and use the generic check_add_overflow() instead. This will make future refactoring easier, and takes advantage of compiler-emitted hardware instructions that efficiently implement these checks. After the change GCC 13.3.0 generates cleaner assembly on x86_64: err = adjust_scalar_min_max_vals(env, insn, dst_reg, *src_reg); 13625: mov 0x28(%rbx),%r9 /* r9 = src_reg->smin_value */ 13629: mov 0x30(%rbx),%rcx /* rcx = src_reg->smax_value */ ... if (check_add_overflow(*dst_smin, src_reg->smin_value, dst_smin) || 141c1: mov %r9,%rax 141c4: add 0x28(%r12),%rax 141c9: mov %rax,0x28(%r12) 141ce: jo 146e4 check_add_overflow(*dst_smax, src_reg->smax_value, dst_smax)) { 141d4: add 0x30(%r12),%rcx 141d9: mov %rcx,0x30(%r12) if (check_add_overflow(*dst_smin, src_reg->smin_value, dst_smin) || 141de: jo 146e4 ... *dst_smin = S64_MIN; 146e4: movabs $0x8000000000000000,%rax 146ee: mov %rax,0x28(%r12) *dst_smax = S64_MAX; 146f3: sub $0x1,%rax 146f7: mov %rax,0x30(%r12) Before the change it gives: s64 smin_val = src_reg->smin_value; 675: mov 0x28(%rsi),%r8 s64 smax_val = src_reg->smax_value; u64 umin_val = src_reg->umin_value; u64 umax_val = src_reg->umax_value; 679: mov %rdi,%rax /* rax = dst_reg */ if (signed_add_overflows(dst_reg->smin_value, smin_val) || 67c: mov 0x28(%rdi),%rdi /* rdi = dst_reg->smin_value */ u64 umin_val = src_reg->umin_value; 680: mov 0x38(%rsi),%rdx u64 umax_val = src_reg->umax_value; 684: mov 0x40(%rsi),%rcx s64 res = (s64)((u64)a + (u64)b); 688: lea (%r8,%rdi,1),%r9 /* r9 = dst_reg->smin_value + src_reg->smin_value */ return res < a; 68c: cmp %r9,%rdi 68f: setg %r10b /* r10b = (dst_reg->smin_value + src_reg->smin_value) > dst_reg->smin_value */ if (b < 0) 693: test %r8,%r8 696: js 72b signed_add_overflows(dst_reg->smax_value, smax_val)) { dst_reg->smin_value = S64_MIN; dst_reg->smax_value = S64_MAX; 69c: movabs $0x7fffffffffffffff,%rdi s64 smax_val = src_reg->smax_value; 6a6: mov 0x30(%rsi),%r8 dst_reg->smin_value = S64_MIN; 6aa: 00 00 00 movabs $0x8000000000000000,%rsi if (signed_add_overflows(dst_reg->smin_value, smin_val) || 6b4: test %r10b,%r10b /* (dst_reg->smin_value + src_reg->smin_value) > dst_reg->smin_value ? goto 6cb */ 6b7: jne 6cb signed_add_overflows(dst_reg->smax_value, smax_val)) { 6b9: mov 0x30(%rax),%r10 /* r10 = dst_reg->smax_value */ s64 res = (s64)((u64)a + (u64)b); 6bd: lea (%r10,%r8,1),%r11 /* r11 = dst_reg->smax_value + src_reg->smax_value */ if (b < 0) 6c1: test %r8,%r8 6c4: js 71e if (signed_add_overflows(dst_reg->smin_value, smin_val) || 6c6: cmp %r11,%r10 /* (dst_reg->smax_value + src_reg->smax_value) <= dst_reg->smax_value ? goto 723 */ 6c9: jle 723 } else { dst_reg->smin_value += smin_val; dst_reg->smax_value += smax_val; } 6cb: mov %rsi,0x28(%rax) ... 6d5: mov %rdi,0x30(%rax) ... if (signed_add_overflows(dst_reg->smin_value, smin_val) || 71e: cmp %r11,%r10 721: jl 6cb dst_reg->smin_value += smin_val; 723: mov %r9,%rsi dst_reg->smax_value += smax_val; 726: mov %r11,%rdi 729: jmp 6cb return res > a; 72b: cmp %r9,%rdi 72e: setl %r10b 732: jmp 69c 737: nopw 0x0(%rax,%rax,1) Note: unlike adjust_ptr_min_max_vals() and scalar*_min_max_add(), it is necessary to introduce intermediate variable in adjust_jmp_off() to keep the functional behavior unchanged. Without an intermediate variable imm/off will be altered even on overflow. Suggested-by: Jiri Olsa Signed-off-by: Shung-Hsi Yu Link: https://lore.kernel.org/r/20240712080127.136608-3-shung-hsi.yu@suse.com Signed-off-by: Alexei Starovoitov kernel/bpf/verifier.c | 114 +++++++++++++++----------------------------------- 1 file changed, 34 insertions(+), 80 deletions(-) commit 4a04b4f0de59dd5c621e78f15803ee0b0544eeb8 Author: Shung-Hsi Yu Date: Fri Jul 12 16:01:24 2024 +0800 bpf: fix overflow check in adjust_jmp_off() adjust_jmp_off() incorrectly used the insn->imm field for all overflow check, which is incorrect as that should only be done or the BPF_JMP32 | BPF_JA case, not the general jump instruction case. Fix it by using insn->off for overflow check in the general case. Fixes: 5337ac4c9b80 ("bpf: Fix the corner case with may_goto and jump to the 1st insn.") Signed-off-by: Shung-Hsi Yu Link: https://lore.kernel.org/r/20240712080127.136608-2-shung-hsi.yu@suse.com Signed-off-by: Alexei Starovoitov kernel/bpf/verifier.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 4295d785a7aa153942e76bdac0e24f0915e0cefb Merge: 906fe8b8263e eac93f4d4ec6 Author: Will Deacon Date: Fri Jul 12 16:54:06 2024 +0100 Merge branch 'iommu/nvidia/tegra' into iommu/next * iommu/nvidia/tegra: iommu/tegra-smmu: Pass correct fwnode to iommu_fwspec_init() commit 906fe8b8263ed5cb3902d0f2b554deafe5cae766 Merge: cbf9520823bd 31000732d56b Author: Will Deacon Date: Fri Jul 12 16:53:58 2024 +0100 Merge branch 'iommu/intel/vt-d' into iommu/next * iommu/intel/vt-d: iommu/vt-d: Fix identity map bounds in si_domain_init() iommu/vt-d: Fix aligned pages in calculate_psi_aligned_address() iommu/vt-d: Limit max address mask to MAX_AGAW_PFN_WIDTH iommu/vt-d: Refactor PCI PRI enabling/disabling callbacks iommu/vt-d: Add helper to flush caches for context change iommu/vt-d: Add helper to allocate paging domain iommu/vt-d: Downgrade warning for pre-enabled IR iommu/vt-d: Remove control over Execute-Requested requests iommu/vt-d: Remove comment for def_domain_type iommu/vt-d: Handle volatile descriptor status read iommu/vt-d: Use try_cmpxchg64() in intel_pasid_get_entry() commit 244c18fbf64a33d152645766a033b2935ab0acb5 Author: Andrew Jones Date: Fri Apr 26 12:08:24 2024 +0200 riscv: hwprobe: export Zawrs ISA extension Export Zawrs ISA extension through hwprobe. [Palmer: there's a gap in the numbers here as there will be a merge conflict when this is picked up. To avoid confusion I just set the hwprobe ID to match what it would be post-merge.] Signed-off-by: Andrew Jones Reviewed-by: Clément Léger Link: https://lore.kernel.org/r/20240426100820.14762-12-ajones@ventanamicro.com Signed-off-by: Palmer Dabbelt Documentation/arch/riscv/hwprobe.rst | 4 ++++ arch/riscv/include/uapi/asm/hwprobe.h | 1 + arch/riscv/kernel/sys_hwprobe.c | 1 + 3 files changed, 6 insertions(+) commit cbf9520823bdd4c44c94b5988e354ee12d57fa58 Merge: 5012650a15e4 9b2bc6b9a264 Author: Will Deacon Date: Fri Jul 12 16:53:45 2024 +0100 Merge branch 'iommu/arm/smmu' into iommu/next * iommu/arm/smmu: (32 commits) iommu: Move IOMMU_DIRTY_NO_CLEAR define iommu/arm-smmu-qcom: Register the TBU driver in qcom_smmu_impl_init iommu/arm-smmu-v3: Enable HTTU for stage1 with io-pgtable mapping iommu/arm-smmu-v3: Add support for dirty tracking in domain alloc iommu/io-pgtable-arm: Add read_and_clear_dirty() support iommu/arm-smmu-v3: Add feature detection for HTTU iommu/arm-smmu-v3: Add support for domain_alloc_user fn iommu/arm-smmu-qcom: record reason for deferring probe iommu/arm-smmu: Pretty-print context fault related regs iommu/arm-smmu-qcom-debug: Do not print for handled faults iommu/arm-smmu: Add CB prefix to register bitfields dt-bindings: arm-smmu: Add X1E80100 GPU SMMU iommu/arm-smmu-v3: add missing MODULE_DESCRIPTION() macro iommu/arm-smmu-v3: Shrink the strtab l1_desc array iommu/arm-smmu-v3: Do not zero the strtab twice iommu/arm-smmu-v3: Allow setting a S1 domain to a PASID iommu/arm-smmu-v3: Allow a PASID to be set when RID is IDENTITY/BLOCKED iommu/arm-smmu-v3: Test the STE S1DSS functionality iommu/arm-smmu-v3: Allow IDENTITY/BLOCKED to be set while PASID is used iommu/arm-smmu-v3: Put the SVA mmu notifier in the smmu_domain ... commit 5012650a15e4eea14bcd34be1feffb57ee91940d Merge: 91b3a24a2276 9a448e453151 Author: Will Deacon Date: Fri Jul 12 16:53:39 2024 +0100 Merge branch 'iommu/amd/amd-vi' into iommu/next * iommu/amd/amd-vi: iommu/amd: Use try_cmpxchg64() in v2_alloc_pte() commit 91b3a24a22760f7de16603773d81cfe374a11e51 Merge: 83a7eefedc9b 8db07ce532c0 Author: Will Deacon Date: Fri Jul 12 16:53:20 2024 +0100 Merge branch 'iommu/allwinner/sun50i' into iommu/next * iommu/allwinner/sun50i: iommu: sun50i: Add H616 compatible string dt-bindings: iommu: add new compatible strings iommu: sun50i: allocate page tables from below 4 GiB iommu: sun50i: clear bypass register commit 1cff1010bef6f325d895db0306b59dc7232ed9b7 Author: Alex Deucher Date: Mon Jul 8 17:40:14 2024 -0400 drm/amdgpu/mes12: add missing opcode string Fixes the indexing of the string array. Reviewed-by: Hawking Zhang Signed-off-by: Alex Deucher drivers/gpu/drm/amd/amdgpu/mes_v12_0.c | 1 + 1 file changed, 1 insertion(+) commit 478cb8badf1898f22e19e4d21f7d7b70cd44df9e Author: Alex Deucher Date: Mon Jul 8 17:39:15 2024 -0400 drm/amdgpu/mes11: update opcode strings Add new packet. Reviewed-by: Hawking Zhang Signed-off-by: Alex Deucher drivers/gpu/drm/amd/amdgpu/mes_v11_0.c | 3 +++ 1 file changed, 3 insertions(+) commit 7ed58b68ac5c3ff378656eb082c982a266bb658e Author: Leo Li Date: Thu Jul 11 10:31:09 2024 -0400 Revert "drm/amd/display: Reset freesync config before update new state" This change caused PSR SU panels to not read from their remote fb, preventing us from entering self-refresh. It is a regression. This reverts commit eb6dfbb7a9c67c7d9bcdb9f9b9131270e2144e3d. Signed-off-by: Leo Li Acked-by: Alex Deucher Signed-off-by: Alex Deucher (cherry picked from commit dc1000bf463d1d89f66d6b5369cf76603f32c4d3) drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c | 1 - 1 file changed, 1 deletion(-) commit eac93f4d4ec63423704657895ce9a4ddac7b023b Author: Will Deacon Date: Fri Jul 12 16:35:25 2024 +0100 iommu/tegra-smmu: Pass correct fwnode to iommu_fwspec_init() iommu_fwspec_init() expects to receive the fwnode corresponding to the IOMMU device, not the fwnode corresponding to the client device being probed. Fix arm_smmu_configure() to pass the correct fwnode to iommu_fwspec_init(). Reported-by: Jon Hunter Suggested-by: Robin Murphy Link: https://lore.kernel.org/r/0eec5f84-6b39-43ba-ab2f-914688a5cf45@nvidia.com Signed-off-by: Will Deacon drivers/iommu/tegra-smmu.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 39c910a430370fd25d5b5e4b2f4b24581a705499 Author: Christoph Hellwig Date: Fri Jul 5 07:42:51 2024 +0200 nfs: do not extend writes to the entire folio nfs_update_folio has code to extend a write to the entire page under certain conditions. With the support for large folios this now suddenly extents to the variable sized and potentially much larger folio. Add code to limit the extension to the page boundaries of the start and end of the write, which matches the historic expecation and the code comments. Fixes: b73fe2dd6cd5 ("nfs: add support for large folios") Signed-off-by: Christoph Hellwig Reviewed-by: Sagi Grimberg Reviewed-by: Benjamin Coddington Signed-off-by: Anna Schumaker fs/nfs/write.c | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) commit 3921ae0850a31f06791e3c5d8f628864b5ae088a Author: Christoph Hellwig Date: Fri Jul 5 18:51:41 2024 +0200 nfs/blocklayout: add support for NVMe Look for the udev generated persistent device name for NVMe devices in addition to the SCSI ones and the Redhat-specific device mapper name. This is the client side implementation of RFC 9561 "Using the Parallel NFS (pNFS) SCSI Layout to Access Non-Volatile Memory Express (NVMe) Storage Devices". Note that the udev rules for nvme are a bit of a mess and udev will only create a link for the uuid if the NVMe namespace has one, and not the NGUID. As the current RFCs don't support UUID based identifications this means the layout can't be used on such namespaces out of the box. A small tweak to the udev rules can work around it, and as the real fix I will submit a draft to the IETF NFSv4 working group to support UUID-based identifiers for SCSI and NVMe. Signed-off-by: Christoph Hellwig Reviewed-by: Sagi Grimberg Reviewed-by: Benjamin Coddington Signed-off-by: Anna Schumaker fs/nfs/blocklayout/dev.c | 2 ++ 1 file changed, 2 insertions(+) commit c8b8b8190a80b591aa73c27c70a668799f8db547 Merge: f0a23883fad4 492ac37fa38f Author: Paolo Bonzini Date: Fri Jul 12 11:24:12 2024 -0400 Merge tag 'loongarch-kvm-6.11' of git://git.kernel.org/pub/scm/linux/kernel/git/chenhuacai/linux-loongson into HEAD LoongArch KVM changes for v6.11 1. Add ParaVirt steal time support. 2. Add some VM migration enhancement. 3. Add perf kvm-stat support for loongarch. commit 31000732d56b43765d51e08cccb68818fbc0032c Author: Jon Pan-Doh Date: Tue Jul 9 16:49:13 2024 -0700 iommu/vt-d: Fix identity map bounds in si_domain_init() Intel IOMMU operates on inclusive bounds (both generally aas well as iommu_domain_identity_map()). Meanwhile, for_each_mem_pfn_range() uses exclusive bounds for end_pfn. This creates an off-by-one error when switching between the two. Fixes: c5395d5c4a82 ("intel-iommu: Clean up iommu_domain_identity_map()") Signed-off-by: Jon Pan-Doh Tested-by: Sudheer Dantuluri Suggested-by: Gary Zibrat Reviewed-by: Lu Baolu Reviewed-by: Kevin Tian Link: https://lore.kernel.org/r/20240709234913.2749386-1-pandoh@google.com Signed-off-by: Will Deacon drivers/iommu/intel/iommu.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit f0a23883fad4ec8a63faddb9639a92be2e007624 Merge: 60d2b2f3c474 7816e58967d0 Author: Paolo Bonzini Date: Fri Jul 12 11:22:39 2024 -0400 Merge tag 'kvm-s390-next-6.11-1' of https://git.kernel.org/pub/scm/linux/kernel/git/kvms390/linux into HEAD Assortment of tiny fixes which are not time critical: - Rejecting memory region operations for ucontrol mode VMs - Rewind the PSW on host intercepts for VSIE - Remove unneeded include commit 9b2bc6b9a264b863a2273c02db5ee9e214e0a526 Author: Shameer Kolothum Date: Fri Jul 12 12:31:32 2024 +0100 iommu: Move IOMMU_DIRTY_NO_CLEAR define Fixes the compile issue when CONFIG_IOMMU_API is not set. Fixes: 4fe88fd8b4ae ("iommu/io-pgtable-arm: Add read_and_clear_dirty() support") Reported-by: kernel test robot Closes: https://lore.kernel.org/oe-kbuild-all/202407121602.HL9ih1it-lkp@intel.com/ Signed-off-by: Shameer Kolothum Reviewed-by: Joao Martins Reviewed-by: Jason Gunthorpe Link: https://lore.kernel.org/r/20240712113132.45100-1-shameerali.kolothum.thodi@huawei.com Signed-off-by: Will Deacon include/linux/iommu.h | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) commit 60d2b2f3c474b46f35c8bb47598e04ae6e44063f Merge: f3996d4d7996 e325618349cd Author: Paolo Bonzini Date: Fri Jul 12 11:19:51 2024 -0400 Merge tag 'kvm-riscv-6.11-1' of https://github.com/kvm-riscv/linux into HEAD KVM/riscv changes for 6.11 - Redirect AMO load/store access fault traps to guest - Perf kvm stat support for RISC-V - Use guest files for IMSIC virtualization, when available ONE_REG support for the Zimop, Zcmop, Zca, Zcf, Zcd, Zcb and Zawrs ISA extensions is coming through the RISC-V tree. commit f3996d4d7996ef3ccddf6bd47edfba07f35cc425 Merge: eb162c941c0b 9ff0e37c6882 Author: Paolo Bonzini Date: Fri Jul 12 11:18:45 2024 -0400 Merge branch 'kvm-prefault' into HEAD Pre-population has been requested several times to mitigate KVM page faults during guest boot or after live migration. It is also required by TDX before filling in the initial guest memory with measured contents. Introduce it as a generic API. commit 9ff0e37c68821d1a6c482cb258ad3b4696f91254 Author: Isaku Yamahata Date: Wed Apr 10 15:07:36 2024 -0700 KVM: selftests: x86: Add test for KVM_PRE_FAULT_MEMORY Add a test case to exercise KVM_PRE_FAULT_MEMORY and run the guest to access the pre-populated area. It tests KVM_PRE_FAULT_MEMORY ioctl for KVM_X86_DEFAULT_VM and KVM_X86_SW_PROTECTED_VM. Signed-off-by: Isaku Yamahata Message-ID: <32427791ef42e5efaafb05d2ac37fa4372715f47.1712785629.git.isaku.yamahata@intel.com> Signed-off-by: Paolo Bonzini tools/include/uapi/linux/kvm.h | 14 +- tools/testing/selftests/kvm/Makefile | 1 + .../testing/selftests/kvm/pre_fault_memory_test.c | 146 +++++++++++++++++++++ 3 files changed, 159 insertions(+), 2 deletions(-) commit 6e01b7601dfed61bcccd8c386c5084fc0d53d20b Author: Paolo Bonzini Date: Tue Jun 11 03:57:58 2024 -0400 KVM: x86: Implement kvm_arch_vcpu_pre_fault_memory() Wire KVM_PRE_FAULT_MEMORY ioctl to kvm_mmu_do_page_fault() to populate guest memory. It can be called right after KVM_CREATE_VCPU creates a vCPU, since at that point kvm_mmu_create() and kvm_init_mmu() are called and the vCPU is ready to invoke the KVM page fault handler. The helper function kvm_tdp_map_page() takes care of the logic to process RET_PF_* return values and convert them to success or errno. Signed-off-by: Isaku Yamahata Message-ID: <9b866a0ae7147f96571c439e75429a03dcb659b6.1712785629.git.isaku.yamahata@intel.com> Signed-off-by: Paolo Bonzini arch/x86/kvm/Kconfig | 1 + arch/x86/kvm/mmu/mmu.c | 73 ++++++++++++++++++++++++++++++++++++++++++++++++++ arch/x86/kvm/x86.c | 3 +++ 3 files changed, 77 insertions(+) commit 58ef24699bcddfe3de0963c8f74ccf641ffe87f0 Author: Paolo Bonzini Date: Wed Jul 10 10:27:10 2024 -0400 KVM: x86/mmu: Make kvm_mmu_do_page_fault() return mapped level The guest memory population logic will need to know what page size or level (4K, 2M, ...) is mapped. Signed-off-by: Isaku Yamahata Message-ID: Signed-off-by: Paolo Bonzini arch/x86/kvm/mmu/mmu.c | 4 ++-- arch/x86/kvm/mmu/mmu_internal.h | 5 ++++- 2 files changed, 6 insertions(+), 3 deletions(-) commit f5e7f00cf1950c771987778444a6600b5f2d883a Author: Sean Christopherson Date: Wed Jun 12 12:59:06 2024 -0700 KVM: x86/mmu: Account pf_{fixed,emulate,spurious} in callers of "do page fault" Move the accounting of the result of kvm_mmu_do_page_fault() to its callers, as only pf_fixed is common to guest page faults and async #PFs, and upcoming support KVM_PRE_FAULT_MEMORY won't bump _any_ stats. Signed-off-by: Sean Christopherson Signed-off-by: Paolo Bonzini arch/x86/kvm/mmu/mmu.c | 19 ++++++++++++++++++- arch/x86/kvm/mmu/mmu_internal.h | 13 ------------- 2 files changed, 18 insertions(+), 14 deletions(-) commit 5186ec223b68cc5100035d605a730819f774932f Author: Sean Christopherson Date: Wed Jun 12 12:51:38 2024 -0700 KVM: x86/mmu: Bump pf_taken stat only in the "real" page fault handler Account stat.pf_taken in kvm_mmu_page_fault(), i.e. the actual page fault handler, instead of conditionally bumping it in kvm_mmu_do_page_fault(). The "real" page fault handler is the only path that should ever increment the number of taken page faults, as all other paths that "do page fault" are by definition not handling faults that occurred in the guest. Signed-off-by: Sean Christopherson Signed-off-by: Paolo Bonzini arch/x86/kvm/mmu/mmu.c | 2 ++ arch/x86/kvm/mmu/mmu_internal.h | 8 -------- 2 files changed, 2 insertions(+), 8 deletions(-) commit bc1a5cd002116552db4c3541e91f8a5b1b0cf65d Author: Isaku Yamahata Date: Wed Apr 10 15:07:28 2024 -0700 KVM: Add KVM_PRE_FAULT_MEMORY vcpu ioctl to pre-populate guest memory Add a new ioctl KVM_PRE_FAULT_MEMORY in the KVM common code. It iterates on the memory range and calls the arch-specific function. The implementation is optional and enabled by a Kconfig symbol. Suggested-by: Sean Christopherson Signed-off-by: Isaku Yamahata Reviewed-by: Rick Edgecombe Message-ID: <819322b8f25971f2b9933bfa4506e618508ad782.1712785629.git.isaku.yamahata@intel.com> Signed-off-by: Paolo Bonzini include/linux/kvm_host.h | 5 ++++ include/uapi/linux/kvm.h | 10 ++++++++ virt/kvm/Kconfig | 3 +++ virt/kvm/kvm_main.c | 60 ++++++++++++++++++++++++++++++++++++++++++++++++ 4 files changed, 78 insertions(+) commit 9aed7a6c0b591801177c90137df43f244e2af9bb Author: Isaku Yamahata Date: Wed Apr 10 15:07:27 2024 -0700 KVM: Document KVM_PRE_FAULT_MEMORY ioctl Adds documentation of KVM_PRE_FAULT_MEMORY ioctl. [1] It populates guest memory. It doesn't do extra operations on the underlying technology-specific initialization [2]. For example, CoCo-related operations won't be performed. Concretely for TDX, this API won't invoke TDH.MEM.PAGE.ADD() or TDH.MR.EXTEND(). Vendor-specific APIs are required for such operations. The key point is to adapt of vcpu ioctl instead of VM ioctl. First, populating guest memory requires vcpu. If it is VM ioctl, we need to pick one vcpu somehow. Secondly, vcpu ioctl allows each vcpu to invoke this ioctl in parallel. It helps to scale regarding guest memory size, e.g., hundreds of GB. [1] https://lore.kernel.org/kvm/Zbrj5WKVgMsUFDtb@google.com/ [2] https://lore.kernel.org/kvm/Ze-TJh0BBOWm9spT@google.com/ Suggested-by: Sean Christopherson Signed-off-by: Isaku Yamahata Message-ID: <9a060293c9ad9a78f1d8994cfe1311e818e99257.1712785629.git.isaku.yamahata@intel.com> Signed-off-by: Paolo Bonzini Documentation/virt/kvm/api.rst | 55 ++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 55 insertions(+) commit eb162c941c0bf49e2e764191dcacad53edc4cbe1 Merge: 27e6a24a4cf3 c2f38f75fc89 Author: Paolo Bonzini Date: Fri Jul 12 11:16:05 2024 -0400 Merge branch 'kvm-tdx-prep-1-truncated' into HEAD A rename and refactoring extracted from the preparatory series for Intel TDX support in KVM's MMU. commit 27e6a24a4cf3d25421c0f6ebb7c39f45fc14d20f Author: Paolo Bonzini Date: Thu Jul 11 13:56:54 2024 -0400 mm, virt: merge AS_UNMOVABLE and AS_INACCESSIBLE The flags AS_UNMOVABLE and AS_INACCESSIBLE were both added just for guest_memfd; AS_UNMOVABLE is already in existing versions of Linux, while AS_INACCESSIBLE was acked for inclusion in 6.11. But really, they are the same thing: only guest_memfd uses them, at least for now, and guest_memfd pages are unmovable because they should not be accessed by the CPU. So merge them into one; use the AS_INACCESSIBLE name which is more comprehensive. At the same time, this fixes an embarrassing bug where AS_INACCESSIBLE was used as a bit mask, despite it being just a bit index. The bug was mostly benign, because AS_INACCESSIBLE's bit representation (1010) corresponded to setting AS_UNEVICTABLE (which is already set) and AS_ENOSPC (except no async writes can happen on the guest_memfd). So the AS_INACCESSIBLE flag simply had no effect. Fixes: 1d23040caa8b ("KVM: guest_memfd: Use AS_INACCESSIBLE when creating guest_memfd inode") Fixes: c72ceafbd12c ("mm: Introduce AS_INACCESSIBLE for encrypted/confidential memory") Cc: linux-mm@kvack.org Acked-by: Vlastimil Babka Acked-by: David Hildenbrand Tested-by: Michael Roth Reviewed-by: Michael Roth Signed-off-by: Paolo Bonzini include/linux/pagemap.h | 14 +++++++------- mm/compaction.c | 12 ++++++------ mm/migrate.c | 2 +- mm/truncate.c | 2 +- virt/kvm/guest_memfd.c | 3 +-- 5 files changed, 16 insertions(+), 17 deletions(-) commit 2454075f8e2915cebbe52a1195631bc7efe2b7e1 Author: Alan Maguire Date: Fri Jul 12 10:28:59 2024 +0100 bpf: Eliminate remaining "make W=1" warnings in kernel/bpf/btf.o As reported by Mirsad [1] we still see format warnings in kernel/bpf/btf.o at W=1 warning level: CC kernel/bpf/btf.o ./kernel/bpf/btf.c: In function ‘btf_type_seq_show_flags’: ./kernel/bpf/btf.c:7553:21: warning: assignment left-hand side might be a candidate for a format attribute [-Wsuggest-attribute=format] 7553 | sseq.showfn = btf_seq_show; | ^ ./kernel/bpf/btf.c: In function ‘btf_type_snprintf_show’: ./kernel/bpf/btf.c:7604:31: warning: assignment left-hand side might be a candidate for a format attribute [-Wsuggest-attribute=format] 7604 | ssnprintf.show.showfn = btf_snprintf_show; | ^ Combined with CONFIG_WERROR=y these can halt the build. The fix (annotating the structure field with __printf()) suggested by Mirsad resolves these. Apologies I missed this last time. No other W=1 warnings were observed in kernel/bpf after this fix. [1] https://lore.kernel.org/bpf/92c9d047-f058-400c-9c7d-81d4dc1ef71b@gmail.com/ Fixes: b3470da314fd ("bpf: annotate BTF show functions with __printf") Reported-by: Mirsad Todorovac Suggested-by: Mirsad Todorovac Signed-off-by: Alan Maguire Signed-off-by: Daniel Borkmann Link: https://lore.kernel.org/bpf/20240712092859.1390960-1-alan.maguire@oracle.com kernel/bpf/btf.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit ff14bfb7bc0480c343356b82c126290a4774bcbe Author: Greg Kroah-Hartman Date: Fri Jul 12 16:41:47 2024 +0200 misc: delete Makefile.rej I accidentally added drivers/misc/Makefile.rej when applying the mrvl-cn10k-dpi by hand. Remove it as it's not needed. Reported-by: Stephen Rothwell Fixes: 5f67eef6dff3 ("misc: mrvl-cn10k-dpi: add Octeon CN10K DPI administrative driver") Signed-off-by: Greg Kroah-Hartman drivers/misc/Makefile.rej | 7 ------- 1 file changed, 7 deletions(-) commit 75ed63a5ab5d1d2872c735bc7edf8fef0e2fa2ea Author: Shenghao Ding Date: Wed Jul 10 14:42:37 2024 +0800 ASoC: tas2781: Add new Kontrol to set tas2563 digital Volume Requriment from customer to add new kcontrol to set tas2563 digital Volume Signed-off-by: Shenghao Ding Link: https://patch.msgid.link/20240710064238.1480-1-shenghao-ding@ti.com Signed-off-by: Mark Brown include/sound/tas2781-tlv.h | 262 ++++++++++++++++++++++++++++++++++++++++- include/sound/tas2781.h | 1 + sound/soc/codecs/tas2781-i2c.c | 129 ++++++++++++++++++-- 3 files changed, 382 insertions(+), 10 deletions(-) commit 4bdc3eaa102b6bedb0800f76f53eca516d5cf20c Author: Chris Packham Date: Wed Jul 10 16:35:21 2024 +1200 clocksource/drivers/realtek: Add timer driver for rtl-otto platforms The timer/counter block on the Realtek SoCs provides up to 5 timers. It also includes a watchdog timer which is handled by the realtek_otto_wdt.c driver. One timer will be used per CPU as a local clock event generator. An additional timer will be used as an overal stable clocksource. Signed-off-by: Markus Stockhausen Signed-off-by: Sander Vanheule Signed-off-by: Chris Packham Link: https://lore.kernel.org/r/20240710043524.1535151-8-chris.packham@alliedtelesis.co.nz Signed-off-by: Daniel Lezcano drivers/clocksource/Kconfig | 10 ++ drivers/clocksource/Makefile | 1 + drivers/clocksource/timer-rtl-otto.c | 291 +++++++++++++++++++++++++++++++++++ include/linux/cpuhotplug.h | 1 + 4 files changed, 303 insertions(+) commit 128f44f788cab8cab53edf9fa35eccbaa48fb4b2 Author: Chris Packham Date: Wed Jul 10 16:35:19 2024 +1200 dt-bindings: timer: Add schema for realtek,otto-timer Add the devicetree schema for the realtek,otto-timer present on a number of Realtek SoCs. Signed-off-by: Chris Packham Reviewed-by: Krzysztof Kozlowski Link: https://lore.kernel.org/r/20240710043524.1535151-6-chris.packham@alliedtelesis.co.nz Signed-off-by: Daniel Lezcano .../bindings/timer/realtek,otto-timer.yaml | 63 ++++++++++++++++++++++ 1 file changed, 63 insertions(+) commit f24c0d6a50ebcc154bded7f40c997edc2064043e Author: Thomas Bonnefille Date: Tue Jul 9 12:07:17 2024 +0200 dt-bindings: timer: Add SOPHGO SG2002 clint Add compatible string for SOPHGO SG2002 Core-Local Interrupt Controller. Signed-off-by: Thomas Bonnefille Acked-by: Conor Dooley Link: https://lore.kernel.org/r/20240709-sg2002-v3-2-af779c3d139d@bootlin.com Signed-off-by: Daniel Lezcano Documentation/devicetree/bindings/timer/sifive,clint.yaml | 1 + 1 file changed, 1 insertion(+) commit f124a52ab88986dc21c88bfbbcefbfb262ce47f9 Author: Geert Uytterhoeven Date: Wed May 29 14:22:06 2024 +0200 dt-bindings: timer: renesas,tmu: Add R-Car Gen2 support Document support for the Timer Unit (TMU) on R-Car Gen2 SoCs. Signed-off-by: Geert Uytterhoeven Acked-by: Conor Dooley Reviewed-by: Niklas Söderlund Reviewed-by: Wolfram Sang Link: https://lore.kernel.org/r/de215e00e180c266527b7bd7cff5f75df918da98.1716985096.git.geert+renesas@glider.be Signed-off-by: Daniel Lezcano Documentation/devicetree/bindings/timer/renesas,tmu.yaml | 5 +++++ 1 file changed, 5 insertions(+) commit c1028676dc859fbef9de21f0312df347cab515ba Author: Geert Uytterhoeven Date: Wed May 29 14:22:05 2024 +0200 dt-bindings: timer: renesas,tmu: Add RZ/G1 support Document support for the Timer Unit (TMU) on RZ/G1 SoCs. Signed-off-by: Geert Uytterhoeven Acked-by: Conor Dooley Reviewed-by: Niklas Söderlund Reviewed-by: Wolfram Sang Link: https://lore.kernel.org/r/bdc30850526f448b8480d9a5e65e35739f416771.1716985096.git.geert+renesas@glider.be Signed-off-by: Daniel Lezcano Documentation/devicetree/bindings/timer/renesas,tmu.yaml | 5 +++++ 1 file changed, 5 insertions(+) commit 17c103b59c3b995eb9d2944067593f2c9cc13652 Author: Geert Uytterhoeven Date: Wed May 29 14:22:04 2024 +0200 dt-bindings: timer: renesas,tmu: Add R-Mobile APE6 support Document support for the Timer Unit (TMU) on the R-Mobile APE6 (R8A73A4) Soc. Signed-off-by: Geert Uytterhoeven Acked-by: Conor Dooley Reviewed-by: Niklas Söderlund Reviewed-by: Wolfram Sang Link: https://lore.kernel.org/r/17e3fd5f27ab540c8611545ad3dc5a697ca66c58.1716985096.git.geert+renesas@glider.be Signed-off-by: Daniel Lezcano Documentation/devicetree/bindings/timer/renesas,tmu.yaml | 2 ++ 1 file changed, 2 insertions(+) commit 5e4bfd66eccaaab65b3d565cfe28483afeacaf1d Author: Jiaxun Yang Date: Wed Jun 12 09:54:34 2024 +0100 clocksource/drivers/mips-gic-timer: Correct sched_clock width Counter width of GIC is configurable and can be read from a register. Use width value from the register for sched_clock. Reviewed-by: Philippe Mathieu-Daudé Signed-off-by: Jiaxun Yang Link: https://lore.kernel.org/r/20240612-mips-clks-v2-7-a57e6f49f3db@flygoat.com Signed-off-by: Daniel Lezcano drivers/clocksource/mips-gic-timer.c | 14 +++++++------- 1 file changed, 7 insertions(+), 7 deletions(-) commit cc9b2c590ebacf656bb2063c2f6cbfb7ad7081f3 Author: Jiaxun Yang Date: Wed Jun 12 09:54:33 2024 +0100 clocksource/drivers/mips-gic-timer: Refine rating computation It is a good clocksource which usually go as fast as CPU core and have a low access latency, so raise the base of rating from Good to desired when we know that it has a stable frequency. Increase frequency addend dividend to 10000000 (10MHz) to reasonably accommodate multi GHz level clock, also cap rating within current level. Signed-off-by: Jiaxun Yang Link: https://lore.kernel.org/r/20240612-mips-clks-v2-6-a57e6f49f3db@flygoat.com Signed-off-by: Daniel Lezcano drivers/clocksource/mips-gic-timer.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) commit db19d3aa77612983a02bd223b3f273f896b243cf Author: Niklas Söderlund Date: Tue Jul 2 21:02:30 2024 +0200 clocksource/drivers/sh_cmt: Address race condition for clock events There is a race condition in the CMT interrupt handler. In the interrupt handler the driver sets a driver private flag, FLAG_IRQCONTEXT. This flag is used to indicate any call to set_next_event() should not be directly propagated to the device, but instead cached. This is done as the interrupt handler itself reprograms the device when needed before it completes and this avoids this operation to take place twice. It is unclear why this design was chosen, my suspicion is to allow the struct clock_event_device.event_handler callback, which is called while the FLAG_IRQCONTEXT is set, can update the next event without having to write to the device twice. Unfortunately there is a race between when the FLAG_IRQCONTEXT flag is set and later cleared where the interrupt handler have already started to write the next event to the device. If set_next_event() is called in this window the value is only cached in the driver but not written. This leads to the board to misbehave, or worse lockup and produce a splat. rcu: INFO: rcu_preempt detected stalls on CPUs/tasks: rcu: 0-...!: (0 ticks this GP) idle=f5e0/0/0x0 softirq=519/519 fqs=0 (false positive?) rcu: (detected by 1, t=6502 jiffies, g=-595, q=77 ncpus=2) Sending NMI from CPU 1 to CPUs 0: NMI backtrace for cpu 0 CPU: 0 PID: 0 Comm: swapper/0 Not tainted 6.10.0-rc5-arm64-renesas-00019-g74a6f86eaf1c-dirty #20 Hardware name: Renesas Salvator-X 2nd version board based on r8a77965 (DT) pstate: 60000005 (nZCv daif -PAN -UAO -TCO -DIT -SSBS BTYPE=--) pc : tick_check_broadcast_expired+0xc/0x40 lr : cpu_idle_poll.isra.0+0x8c/0x168 sp : ffff800081c63d70 x29: ffff800081c63d70 x28: 00000000580000c8 x27: 00000000bfee5610 x26: 0000000000000027 x25: 0000000000000000 x24: 0000000000000000 x23: ffff00007fbb9100 x22: ffff8000818f1008 x21: ffff8000800ef07c x20: ffff800081c79ec0 x19: ffff800081c70c28 x18: 0000000000000000 x17: 0000000000000000 x16: 0000000000000000 x15: 0000ffffc2c717d8 x14: 0000000000000000 x13: ffff000009c18080 x12: ffff8000825f7fc0 x11: 0000000000000000 x10: ffff8000818f3cd4 x9 : 0000000000000028 x8 : ffff800081c79ec0 x7 : ffff800081c73000 x6 : 0000000000000000 x5 : 0000000000000000 x4 : ffff7ffffe286000 x3 : 0000000000000000 x2 : ffff7ffffe286000 x1 : ffff800082972900 x0 : ffff8000818f1008 Call trace: tick_check_broadcast_expired+0xc/0x40 do_idle+0x9c/0x280 cpu_startup_entry+0x34/0x40 kernel_init+0x0/0x11c do_one_initcall+0x0/0x260 __primary_switched+0x80/0x88 rcu: rcu_preempt kthread timer wakeup didn't happen for 6501 jiffies! g-595 f0x0 RCU_GP_WAIT_FQS(5) ->state=0x402 rcu: Possible timer handling issue on cpu=0 timer-softirq=262 rcu: rcu_preempt kthread starved for 6502 jiffies! g-595 f0x0 RCU_GP_WAIT_FQS(5) ->state=0x402 ->cpu=0 rcu: Unless rcu_preempt kthread gets sufficient CPU time, OOM is now expected behavior. rcu: RCU grace-period kthread stack dump: task:rcu_preempt state:I stack:0 pid:15 tgid:15 ppid:2 flags:0x00000008 Call trace: __switch_to+0xbc/0x100 __schedule+0x358/0xbe0 schedule+0x48/0x148 schedule_timeout+0xc4/0x138 rcu_gp_fqs_loop+0x12c/0x764 rcu_gp_kthread+0x208/0x298 kthread+0x10c/0x110 ret_from_fork+0x10/0x20 The design have been part of the driver since it was first merged in early 2009. It becomes increasingly harder to trigger the issue the older kernel version one tries. It only takes a few boots on v6.10-rc5, while hundreds of boots are needed to trigger it on v5.10. Close the race condition by using the CMT channel lock for the two competing sections. The channel lock was added to the driver after its initial design. Signed-off-by: Niklas Söderlund Link: https://lore.kernel.org/r/20240702190230.3825292-1-niklas.soderlund+renesas@ragnatech.se Signed-off-by: Daniel Lezcano drivers/clocksource/sh_cmt.c | 13 ++++++++++++- 1 file changed, 12 insertions(+), 1 deletion(-) commit f3539a6a6998e1e662fdb30af435f239d5931c98 Author: Li kunyu Date: Fri Jul 5 13:21:59 2024 +0800 clocksource/driver/arm_global_timer: Remove unnecessary ‘0’ values from err The 'err' variable is initialized whatever the code path, it is pointless to initialize it when it is declared. Signed-off-by: Li kunyu Link: https://lore.kernel.org/r/20240705052159.22235-1-kunyu@nfschina.com Signed-off-by: Daniel Lezcano drivers/clocksource/arm_global_timer.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 7cbbcbd4b5bb68a6208b872612bb301683dc7114 Author: Li kunyu Date: Fri Jul 5 12:07:29 2024 +0800 clocksource/drivers/arm_arch_timer: Remove unnecessary ‘0’ values from irq The irq variable is initialized whatever the code path, it is poinless to initialize when declaring it. Signed-off-by: Li kunyu Link: https://lore.kernel.org/r/20240705040729.21961-1-kunyu@nfschina.com Signed-off-by: Daniel Lezcano drivers/clocksource/arm_arch_timer.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 216d04139a6d0ecaea9432178225b29d367da886 Author: Mohammad Rafi Shaik Date: Thu Jul 4 13:47:23 2024 +0530 ASoC: codecs: wcd937x: Remove separate handling for vdd-buck supply Remove separate handling for vdd-buck regulator supply which is not required. The vdd-buck regulator supply enabled using bulk enable. Add the error handling in wcd937x_probe() and disable the regulators in error case. Reported-by: Christophe JAILLET Closes: https://lore.kernel.org/linux-sound/834d31cc-f4bc-4db7-a25b-f9869e550eb6@wanadoo.fr/ Signed-off-by: Mohammad Rafi Shaik Link: https://patch.msgid.link/20240704081723.3394153-4-quic_mohs@quicinc.com Signed-off-by: Mark Brown sound/soc/codecs/wcd937x.c | 61 ++++++++++------------------------------------ sound/soc/codecs/wcd937x.h | 2 +- 2 files changed, 14 insertions(+), 49 deletions(-) commit a5f727f423101efd60a27bccd7680df429cef38a Author: Mohammad Rafi Shaik Date: Thu Jul 4 13:47:22 2024 +0530 ASoC: codecs: wcd937x: Remove the string compare in MIC BIAS widget settings Remove the string compare with widget name in MIC BIAS settings, instead of string compare use the MIC BIAS id's. Reported-by: Srinivas Kandagatla Closes: https://lore.kernel.org/linux-sound/ba911ebd-aef5-46af-ace1-84d13bee6876@linaro.org/ Signed-off-by: Mohammad Rafi Shaik Link: https://patch.msgid.link/20240704081723.3394153-3-quic_mohs@quicinc.com Signed-off-by: Mark Brown sound/soc/codecs/wcd937x.c | 34 ++++++++-------------------------- 1 file changed, 8 insertions(+), 26 deletions(-) commit 0ffc5a40ad21996c1c4b1d8a636c9051ea41a76e Author: Mohammad Rafi Shaik Date: Thu Jul 4 13:47:21 2024 +0530 ASoC: codecs: wcd937x-sdw: Fix Unbalanced pm_runtime_enable Fix the unbalanced pm_runtime_enable! in wcd937x-sdw soundwire slave. Fixes: c99a515ff153 ("ASoC: codecs: wcd937x-sdw: add SoundWire driver") Signed-off-by: Mohammad Rafi Shaik Link: https://patch.msgid.link/20240704081723.3394153-2-quic_mohs@quicinc.com Signed-off-by: Mark Brown sound/soc/codecs/wcd937x-sdw.c | 18 ++++++++---------- 1 file changed, 8 insertions(+), 10 deletions(-) commit 3669716401921c4c545ac2998d7c67f9727ee056 Author: Rafael J. Wysocki Date: Thu Jul 11 14:39:02 2024 +0200 thermal: core: Add sanity checks for polling_delay and passive_delay If polling_delay is nonzero and passive_delay is greater than polling_delay, the thermal zone temperature will be updated less often when tz->passive is nonzero, which is not as expected. Make the thermal zone registration fail with -EINVAL in that case as this is a clear thermal zone configuration mistake. If polling_delay is nonzero and passive_delay is 0, which is regarded as a valid thermal zone configuration, the thermal zone will use polling except when tz->passive is nonzero. However, the expected behavior in that case is to continue temperature polling with the same delay value regardless of tz->passive, so set passive_delay to the polling_delay value then. Signed-off-by: Rafael J. Wysocki Reviewed-by: Daniel Lezcano Link: https://patch.msgid.link/5802156.DvuYhMxLoT@rjwysocki.net drivers/thermal/thermal_core.c | 8 ++++++++ 1 file changed, 8 insertions(+) commit 5b674baa596e624fde8bf62b9a3d8a26eef399b2 Author: Rafael J. Wysocki Date: Tue Jul 2 16:44:27 2024 +0200 thermal: trip: Fold __thermal_zone_get_trip() into its caller Because __thermal_zone_get_trip() is only called by thermal_zone_get_trip() now, fold the former into the latter. Signed-off-by: Rafael J. Wysocki Link: https://patch.msgid.link/22339769.EfDdHjke4D@rjwysocki.net drivers/thermal/thermal_trip.c | 18 ++++-------------- include/linux/thermal.h | 2 -- 2 files changed, 4 insertions(+), 16 deletions(-) commit 0728c810873e1a94e8b767f9809af940c9307d60 Author: Rafael J. Wysocki Date: Tue Jul 2 16:42:33 2024 +0200 thermal: trip: Pass trip pointer to .set_trip_temp() thermal zone callback Out of several drivers implementing the .set_trip_temp() thermal zone operation, three don't actually use the trip ID argument passed to it, two call __thermal_zone_get_trip() to get a struct thermal_trip corresponding to the given trip ID, and the other use the trip ID as an index into their own data structures with the assumption that it will always match the ordering of entries in the trips table passed to the core during thermal zone registration, which is fragile and not really guaranteed. Even though the trip IDs used by the core are in fact their indices in the trips table passed to it by the thermal zone creator, that is purely a matter of convenience and should not be relied on for correctness. For this reason, modify trip_point_temp_store() to pass a (const) trip pointer to .set_trip_temp() and adjust the drivers implementing it accordingly. This helps to simplify the drivers invoking __thermal_zone_get_trip() from their .set_trip_temp() callback functions because they will not need to do it now and the other drivers can store their internal trip indices in the priv field in struct thermal_trip and their .set_trip_temp() callback functions can get those indices from there. The intel_quark_dts thermal driver can instead use the trip type to determine the requisite trip index. Signed-off-by: Rafael J. Wysocki Link: https://patch.msgid.link/8392906.T7Z3S40VBb@rjwysocki.net [ rjw: Add missing colon and 2 empty code lines ] [ rjw: Add missing change in imx_thermal.c and adjust the changelog ] [ rjw: Drop an unused local variable ] Signed-off-by: Rafael J. Wysocki drivers/net/wireless/intel/iwlwifi/mvm/tt.c | 2 +- drivers/thermal/imx_thermal.c | 4 ++-- .../intel/int340x_thermal/int340x_thermal_zone.c | 8 ++++--- .../int340x_thermal/processor_thermal_device_pci.c | 3 ++- drivers/thermal/intel/intel_quark_dts_thermal.c | 28 +++++++++++++++++----- drivers/thermal/intel/intel_soc_dts_iosf.c | 15 +++++++----- drivers/thermal/intel/x86_pkg_temp_thermal.c | 9 ++++--- drivers/thermal/qcom/qcom-spmi-temp-alarm.c | 10 +++----- drivers/thermal/tegra/soctherm.c | 15 ++++-------- drivers/thermal/thermal_sysfs.c | 2 +- include/linux/thermal.h | 3 ++- 11 files changed, 58 insertions(+), 41 deletions(-) commit 595572aae3d0c3bf295ea759b74b948e7493a9ff Author: Lu Baolu Date: Fri Jul 12 10:58:19 2024 +0800 iommufd: Fix error pointer checking Smatch static checker reported below warning: drivers/iommu/iommufd/fault.c:131 iommufd_device_get_attach_handle() warn: 'handle' is an error pointer or valid Fix it by checking 'handle' with IS_ERR(). Fixes: b7d8833677ba ("iommufd: Fault-capable hwpt attach/detach/replace") Link: https://lore.kernel.org/r/20240712025819.63147-1-baolu.lu@linux.intel.com Reported-by: Dan Carpenter Closes: https://lore.kernel.org/linux-iommu/8bb4f37a-4514-4dea-aabb-7380be303895@stanley.mountain/ Signed-off-by: Lu Baolu Signed-off-by: Jason Gunthorpe drivers/iommu/iommufd/fault.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 338a93cf4a18c2036b567e9f613367f7a52f2511 Author: Jeremy Kerr Date: Wed Jul 10 10:17:22 2024 +0800 net: mctp-i2c: invalidate flows immediately on TX errors If we encounter an error on i2c packet transmit, we won't have a valid flow anymore; since we didn't transmit a valid packet sequence, we'll have to wait for the key to timeout instead of dropping it on the reply. This causes the i2c lock to be held for longer than necessary. Instead, invalidate the flow on TX error, and release the i2c lock immediately. Cc: Bonnie Lo Tested-by: Jerry C Chen Signed-off-by: Jeremy Kerr Signed-off-by: David S. Miller drivers/net/mctp/mctp-i2c.c | 41 +++++++++++++++++++++++++++++++++++++++++ 1 file changed, 41 insertions(+) commit d73cf5ff743b5a8de6fa20651baba5bd56ba98a3 Author: Lu Baolu Date: Wed Jul 10 16:33:40 2024 +0800 iommufd: Add check on user response code The response code from user space is only allowed to be SUCCESS or INVALID. All other values are treated by the device as a response code of Response Failure according to PCI spec, section 10.4.2.1. This response disables the Page Request Interface for the Function. Add a check in iommufd_fault_fops_write() to avoid invalid response code. Fixes: 07838f7fd529 ("iommufd: Add iommufd fault object") Link: https://lore.kernel.org/r/20240710083341.44617-3-baolu.lu@linux.intel.com Signed-off-by: Lu Baolu Reviewed-by: Kevin Tian Signed-off-by: Jason Gunthorpe drivers/iommu/iommufd/fault.c | 10 ++++++++++ 1 file changed, 10 insertions(+) commit cc5049007d722364bca4a4eeb619d5629733a004 Author: Andrew Halaney Date: Wed Jul 10 10:36:14 2024 -0500 arm64: dts: ti: k3-j784s4-evm: Consolidate serdes0 references Subnodes were added to serdes0 in two different spots (due to independent development of their consumer usage). Let's go ahead and combine those into one reference for readability's sake. Signed-off-by: Andrew Halaney Reviewed-by: Siddharth Vadapalli Link: https://lore.kernel.org/r/20240710-k3-j784s4-evm-serdes0-cleanup-v1-2-03850fe33922@redhat.com Signed-off-by: Vignesh Raghavendra arch/arm64/boot/dts/ti/k3-j784s4-evm.dts | 24 ++++++++---------------- 1 file changed, 8 insertions(+), 16 deletions(-) commit 84f78178b6fe37b5eb8b90b5bb1239abce0b64d8 Author: Andrew Halaney Date: Wed Jul 10 10:36:13 2024 -0500 arm64: dts: ti: k3-j784s4-evm: Assign only lanes 0 and 1 to PCIe1 Currently PCIe1 is setup to use SERDES0 lanes 0 thru 3, and USB0 is setup to use SERDES0 lane 3 as well. This overlap in lanes causes the following reset related lane splat: [ 4.846266] WARNING: CPU: 4 PID: 308 at drivers/reset/core.c:792 __reset_control_get_internal+0x128/0x160 ... [ 4.846405] Call trace: [ 4.846407] __reset_control_get_internal+0x128/0x160 [ 4.846413] __of_reset_control_get+0x4e0/0x528 [ 4.846418] of_reset_control_array_get+0xa4/0x1f8 [ 4.846423] cdns_torrent_phy_probe+0xbc8/0x1068 [phy_cadence_torrent] [ 4.846445] platform_probe+0xb4/0xe8 ... [ 4.846577] cdns-torrent-phy 5060000.serdes: phy@0: failed to get reset Let's limit the PCIe1 SERDES0 lanes to 0 and 1 to avoid overlap here. This works since PCIe1 operates in x2 mode and doesn't need 4 SERDES0 lanes. Fixes: 27ce26fe52d4 ("arm64: dts: ti: k3-j784s4-evm: Enable PCIe0 and PCIe1 in RC Mode") Suggested-by: Siddharth Vadapalli Signed-off-by: Andrew Halaney Reviewed-by: Siddharth Vadapalli Link: https://lore.kernel.org/r/20240710-k3-j784s4-evm-serdes0-cleanup-v1-1-03850fe33922@redhat.com Signed-off-by: Vignesh Raghavendra arch/arm64/boot/dts/ti/k3-j784s4-evm.dts | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-) commit 74beefb5935a67f9fa60f8103e3f69d42d6a08d7 Author: Chris Packham Date: Wed Jul 10 16:35:24 2024 +1200 mips: dts: realtek: Add RTL9302C board Add support for the RTL9302 SoC and the RTL9302C_2xRTL8224_2XGE reference board. The RTL930x family of SoCs are Realtek switches with an embedded MIPS core (800MHz 34Kc). Most of the peripherals are similar to the RTL838x SoC and can make use of many existing drivers. Add in full DSA switch support is still a work in progress. Signed-off-by: Chris Packham Signed-off-by: Thomas Bogendoerfer arch/mips/boot/dts/realtek/Makefile | 1 + .../dts/realtek/cameo-rtl9302c-2x-rtl8224-2xge.dts | 73 ++++++++++++++++++++ arch/mips/boot/dts/realtek/rtl930x.dtsi | 79 ++++++++++++++++++++++ 3 files changed, 153 insertions(+) commit 662c0002ca2e1379d0e80be1a4e07ab47c9eee48 Author: Chris Packham Date: Wed Jul 10 16:35:23 2024 +1200 mips: generic: add fdt fixup for Realtek reference board The bootloader used on the Realtek RTL9302C boards is an ancient vendor fork of U-Boot that doesn't understand device trees. So to run a modern kernel it is necessary use one of the APPENDED_DTB options. When appending the DTB the inintrd information, if present, needs to be inserted into the /chosen device tree node. The bootloader provides the initrd start/size via the firmware environment. Add a fdt fixup that will update the device tree with the initrd information. Signed-off-by: Chris Packham Signed-off-by: Thomas Bogendoerfer arch/mips/generic/Makefile | 1 + arch/mips/generic/board-realtek.c | 79 +++++++++++++++++++++++++++++++++++++++ 2 files changed, 80 insertions(+) commit 62b8db3afe3e93dd14baeddf081fe1200d5610e3 Author: Chris Packham Date: Wed Jul 10 16:35:22 2024 +1200 mips: select REALTEK_OTTO_TIMER for Realtek platforms When MACH_REALTEK_RTL is selected automatically select the REALTEK_OTTO_TIMER option in order to support the Realtek platforms that require it. Signed-off-by: Chris Packham Signed-off-by: Thomas Bogendoerfer arch/mips/Kconfig | 1 + 1 file changed, 1 insertion(+) commit 371c358d523f3e6878587ddb16dd61a4a89bef9e Author: Chris Packham Date: Wed Jul 10 16:35:20 2024 +1200 dt-bindings: interrupt-controller: realtek,rtl-intc: Add rtl9300-intc Add a compatible string for the interrupt controller found on the rtl930x SoCs. The interrupt controller has registers for VPE1 so these are added as a second reg cell. Signed-off-by: Chris Packham Reviewed-by: Rob Herring (Arm) Signed-off-by: Thomas Bogendoerfer .../interrupt-controller/realtek,rtl-intc.yaml | 20 +++++++++++++++++++- 1 file changed, 19 insertions(+), 1 deletion(-) commit 93eed6356d9ed26011f979ceb613c8ef3963cd10 Author: Chris Packham Date: Wed Jul 10 16:35:18 2024 +1200 dt-bindings: mips: realtek: Add rtl930x-soc compatible Add the rtl9302 SoC and the Cameo RTL9302C_2xRTL8224_2XGE reference board to the list of Realtek compatible strings. Signed-off-by: Chris Packham Reviewed-by: Krzysztof Kozlowski Signed-off-by: Thomas Bogendoerfer Documentation/devicetree/bindings/mips/realtek-rtl.yaml | 4 ++++ 1 file changed, 4 insertions(+) commit a9b516f3e92688a3d0f84a4dbaffb2b73b652348 Author: Chris Packham Date: Wed Jul 10 16:35:17 2024 +1200 dt-bindings: vendor-prefixes: Add Cameo Communications Add entry for Cameo Communications (https://www.cameo.com.tw/) Signed-off-by: Chris Packham Acked-by: Krzysztof Kozlowski Signed-off-by: Thomas Bogendoerfer Documentation/devicetree/bindings/vendor-prefixes.yaml | 2 ++ 1 file changed, 2 insertions(+) commit 75eb0cbe6e2220feffc7c6219b7dc80c56068bb9 Author: Chris Packham Date: Wed Jul 10 16:35:16 2024 +1200 mips: dts: realtek: add device_type property to cpu node Add device_type = "cpu" to the cpu node for the rtl838x SoC. This resolves the following dtbs_check complaint: cpus: cpu@0: 'cache-level' is a required property Signed-off-by: Chris Packham Reviewed-by: Marek Behún Signed-off-by: Thomas Bogendoerfer arch/mips/boot/dts/realtek/rtl838x.dtsi | 1 + 1 file changed, 1 insertion(+) commit b1428c6860af10649cead288b8fc81efec6115c2 Author: Chris Packham Date: Wed Jul 10 16:35:15 2024 +1200 mips: dts: realtek: use "serial" instead of "uart" in node name Update the node name for the UARTs to resolve the following dtbs_check complaints: uart@2000: $nodename:0: 'uart@2000' does not match '^serial(@.*)?$' uart@2100: $nodename:0: 'uart@2100' does not match '^serial(@.*)?$' Signed-off-by: Chris Packham Reviewed-by: Marek Behún Signed-off-by: Thomas Bogendoerfer arch/mips/boot/dts/realtek/rtl83xx.dtsi | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) commit 59649de96f21dfb0518faa8feaa3d05c2d81b042 Author: Jiaxun Yang Date: Wed Jun 12 09:38:19 2024 +0100 MIPS: Implement ieee754 NAN2008 emulation mode Implement ieee754 NAN2008 emulation mode. When this mode is enabled, kernel will accept ELF file compiled for both NaN 2008 and NaN legacy, but if hardware does not have capability to match ELF's NaN mode, __own_fpu will fail for corresponding thread and fpuemu will then kick in. This mode trade performance for correctness, while maintaining support for both NaN mode regardless of hardware capability. It is useful for multilib installation that have both types of binary exist in system. Reviewed-by: Philippe Mathieu-Daudé Signed-off-by: Jiaxun Yang Signed-off-by: Thomas Bogendoerfer Documentation/admin-guide/kernel-parameters.txt | 4 +++- arch/mips/include/asm/fpu.h | 15 +++++++++++++++ arch/mips/kernel/elf.c | 4 ++++ arch/mips/kernel/fpu-probe.c | 9 ++++++++- 4 files changed, 30 insertions(+), 2 deletions(-) commit 9c7a86c935074525f24cc20e78a7d5150e4600e3 Author: Hauke Mehrtens Date: Tue Jul 9 00:23:04 2024 +0200 MIPS: lantiq: improve USB initialization This adds code to initialize the USB controller and PHY also on Danube, Amazon SE and AR10. This code is based on the Vendor driver from different UGW versions and compared to the hardware documentation. This patch is included in OpenWrt for many years. Signed-off-by: Hauke Mehrtens Signed-off-by: Thomas Bogendoerfer arch/mips/lantiq/xway/sysctrl.c | 20 ++++++++++++++++++++ 1 file changed, 20 insertions(+) commit b8ddb0df30f9f6e70422f1e705b7416da115bd24 Author: Christoph Müllner Date: Fri Apr 26 12:08:23 2024 +0200 riscv: Add Zawrs support for spinlocks RISC-V code uses the generic ticket lock implementation, which calls the macros smp_cond_load_relaxed() and smp_cond_load_acquire(). Introduce a RISC-V specific implementation of smp_cond_load_relaxed() which applies WRS.NTO of the Zawrs extension in order to reduce power consumption while waiting and allows hypervisors to enable guests to trap while waiting. smp_cond_load_acquire() doesn't need a RISC-V specific implementation as the generic implementation is based on smp_cond_load_relaxed() and smp_acquire__after_ctrl_dep() sufficiently provides the acquire semantics. This implementation is heavily based on Arm's approach which is the approach Andrea Parri also suggested. The Zawrs specification can be found here: https://github.com/riscv/riscv-zawrs/blob/main/zawrs.adoc Signed-off-by: Christoph Müllner Co-developed-by: Andrew Jones Signed-off-by: Andrew Jones Link: https://lore.kernel.org/r/20240426100820.14762-11-ajones@ventanamicro.com Signed-off-by: Palmer Dabbelt arch/riscv/Kconfig | 13 +++++++++ arch/riscv/include/asm/barrier.h | 45 ++++++++++++++++++++---------- arch/riscv/include/asm/cmpxchg.h | 58 +++++++++++++++++++++++++++++++++++++++ arch/riscv/include/asm/hwcap.h | 1 + arch/riscv/include/asm/insn-def.h | 2 ++ arch/riscv/kernel/cpufeature.c | 1 + 6 files changed, 105 insertions(+), 15 deletions(-) commit 6d5852811600086f0a227a4d646b2a20b4dfe533 Author: Andrew Jones Date: Fri Apr 26 12:08:22 2024 +0200 dt-bindings: riscv: Add Zawrs ISA extension description Add description for the Zawrs (Wait-on-Reservation-Set) ISA extension which was ratified in commit 98918c844281 of riscv-isa-manual. Signed-off-by: Andrew Jones Acked-by: Conor Dooley Link: https://lore.kernel.org/r/20240426100820.14762-10-ajones@ventanamicro.com Signed-off-by: Palmer Dabbelt Documentation/devicetree/bindings/riscv/extensions.yaml | 7 +++++++ 1 file changed, 7 insertions(+) commit 6da111574baffb3399a6bd03a98b269eac9713f2 Author: Andrew Jones Date: Fri Apr 26 12:08:21 2024 +0200 riscv: Provide a definition for 'pause' If we're going to provide the encoding for 'pause' in cpu_relax() anyway, then we can drop the toolchain checks and just always use it. The advantage of doing this is that other code that need pause don't need to also define it (yes, another use is coming). Add the definition to insn-def.h since it's an instruction definition and also because insn-def.h doesn't include much, so it's safe to include from asm/vdso/processor.h without concern for circular dependencies. Signed-off-by: Andrew Jones Link: https://lore.kernel.org/r/20240426100820.14762-9-ajones@ventanamicro.com Signed-off-by: Palmer Dabbelt arch/riscv/Kconfig | 7 ------- arch/riscv/Makefile | 3 --- arch/riscv/include/asm/insn-def.h | 2 ++ arch/riscv/include/asm/vdso/processor.h | 8 ++------ 4 files changed, 4 insertions(+), 16 deletions(-) commit 31643d84b8c3d9c846aa0e20bc033e46c68c7e7d Author: Carlos Llamas Date: Thu Jul 11 20:14:51 2024 +0000 binder: fix hang of unregistered readers With the introduction of binder_available_for_proc_work_ilocked() in commit 1b77e9dcc3da ("ANDROID: binder: remove proc waitqueue") a binder thread can only "wait_for_proc_work" after its thread->looper has been marked as BINDER_LOOPER_STATE_{ENTERED|REGISTERED}. This means an unregistered reader risks waiting indefinitely for work since it never gets added to the proc->waiting_threads. If there are no further references to its waitqueue either the task will hang. The same applies to readers using the (e)poll interface. I couldn't find the rationale behind this restriction. So this patch restores the previous behavior of allowing unregistered threads to "wait_for_proc_work". Note that an error message for this scenario, which had previously become unreachable, is now re-enabled. Fixes: 1b77e9dcc3da ("ANDROID: binder: remove proc waitqueue") Cc: stable@vger.kernel.org Cc: Martijn Coenen Cc: Arve Hjønnevåg Signed-off-by: Carlos Llamas Link: https://lore.kernel.org/r/20240711201452.2017543-1-cmllamas@google.com Signed-off-by: Greg Kroah-Hartman drivers/android/binder.c | 4 +--- 1 file changed, 1 insertion(+), 3 deletions(-) commit b85e021853976aaebd3788e7e721020570754199 Author: Ciprian Costea Date: Mon Jul 8 15:10:18 2024 +0300 MAINTAINERS: add 's32@nxp.com' as relevant mailing list for 'sdhci-esdhc-imx' driver Since NXP S32G2 and S32G3 SoCs share the SDHCI controller with I.MX platforms it would be valuable to add 's32@nxp.com' as a relevant mailing list in this area. Signed-off-by: Ciprian Costea Acked-by: Adrian Hunter Acked-by: Haibo Chen Link: https://lore.kernel.org/r/20240708121018.246476-4-ciprianmarian.costea@oss.nxp.com Signed-off-by: Ulf Hansson MAINTAINERS | 1 + 1 file changed, 1 insertion(+) commit 63e555d9bf76dc710842c13edb7d0986149f16a3 Author: Ciprian Costea Date: Mon Jul 8 15:10:17 2024 +0300 mmc: sdhci-esdhc-imx: obtain the 'per' clock rate after its enablement The I.MX SDHCI driver assumes that the frequency of the 'per' clock can be obtained even on disabled clocks, which is not always the case. According to 'clk_get_rate' documentation, it is only valid once the clock source has been enabled. Signed-off-by: Ciprian Costea Reviewed-by: Haibo Chen Acked-by: Adrian Hunter Link: https://lore.kernel.org/r/20240708121018.246476-3-ciprianmarian.costea@oss.nxp.com Signed-off-by: Ulf Hansson drivers/mmc/host/sdhci-esdhc-imx.c | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-) commit a52b67bdf44cc673e3232b8456b2d85c9988fcad Author: Ciprian Costea Date: Mon Jul 8 15:10:16 2024 +0300 mmc: sdhci-esdhc-imx: disable card detect wake for S32G based platforms In case of S32G based platforms, GPIO CD used for card detect wake mechanism is not available. For this scenario the newly introduced flag 'ESDHC_FLAG_SKIP_CD_WAKE' is used. Signed-off-by: Ciprian Costea Reviewed-by: Haibo Chen Acked-by: Adrian Hunter Link: https://lore.kernel.org/r/20240708121018.246476-2-ciprianmarian.costea@oss.nxp.com Signed-off-by: Ulf Hansson drivers/mmc/host/sdhci-esdhc-imx.c | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) commit e777798e67d9ba46cf56ad49919c1e86c5ee3213 Author: Petr Tesarik Date: Thu Jul 11 12:34:09 2024 +0200 sysfs/cpu: Make crash_hotplug attribute world-readable There is no reason to restrict access to this attribute, as it merely reports whether crash elfcorehdr is automatically updated on CPU hot plug/unplug and/or online/offline events. Note that since commit 79365026f8694 ("crash: add a new kexec flag for hotplug support"), this maps to the same flag which is world-accessible through /sys/devices/system/memory/crash_hotplug. Signed-off-by: Petr Tesarik Acked-by: Baoquan He Acked-by: Sourabh Jain Link: https://lore.kernel.org/r/20240711103409.319673-1-petr.tesarik@suse.com Signed-off-by: Greg Kroah-Hartman drivers/base/cpu.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 1e02e317470b1c68d5971e51e8c62967ec1bc828 Author: Geert Uytterhoeven Date: Thu Jul 11 16:32:35 2024 +0200 platform: arm64: EC_LENOVO_YOGA_C630 should depend on ARCH_QCOM The Lenovo Yoga C630 Embedded Controller is only present on the Qualcomm Snapdragon-based Lenovo Yoga C630 laptop. Hence add a dependency on ARCH_QCOM, to prevent asking the user about this driver when configuring a kernel without Qualcomm SoC support. Signed-off-by: Geert Uytterhoeven Reviewed-by: Hans de Goede Link: https://lore.kernel.org/r/0e4c9ffdc8a5caffcda2afb8d5480900f7adebf6.1720707932.git.geert+renesas@glider.be Reviewed-by: Ilpo Järvinen Signed-off-by: Ilpo Järvinen drivers/platform/arm64/Kconfig | 1 + 1 file changed, 1 insertion(+) commit b727493011123db329e2901e3abf81a8d146b6fe Author: Nícolas F. R. A. Prado Date: Fri Jul 5 19:29:56 2024 -0400 kselftest: devices: Add test to detect device error logs Log errors are the most widely used mechanism for reporting issues in the kernel. When an error is logged using the device helpers, eg dev_err(), it gets metadata attached that identifies the subsystem and device where the message is coming from. Introduce a new test that makes use of that metadata to report which devices logged errors (or more critical messages). Signed-off-by: Nícolas F. R. A. Prado Acked-by: Shuah Khan Acked-by: Greg Kroah-Hartman Link: https://lore.kernel.org/r/20240705-dev-err-log-selftest-v2-3-163b9cd7b3c1@collabora.com Signed-off-by: Greg Kroah-Hartman tools/testing/selftests/Makefile | 1 + .../testing/selftests/devices/error_logs/Makefile | 3 + .../devices/error_logs/test_device_error_logs.py | 85 ++++++++++++++++++++++ 3 files changed, 89 insertions(+) commit 0e7b7bde460304f44e8c6b212c3195ac2f69f6fe Author: Nícolas F. R. A. Prado Date: Fri Jul 5 19:29:55 2024 -0400 kselftest: Move ksft helper module to common directory Move the ksft python module, which provides generic helpers for kselftests, to a common directory so it can be more easily shared between different tests. Signed-off-by: Nícolas F. R. A. Prado Acked-by: Shuah Khan Acked-by: Greg Kroah-Hartman Link: https://lore.kernel.org/r/20240705-dev-err-log-selftest-v2-2-163b9cd7b3c1@collabora.com Signed-off-by: Greg Kroah-Hartman tools/testing/selftests/Makefile | 1 + tools/testing/selftests/devices/probe/Makefile | 2 +- tools/testing/selftests/devices/probe/test_discoverable_devices.py | 7 ++++++- tools/testing/selftests/{devices/probe => kselftest}/ksft.py | 0 4 files changed, 8 insertions(+), 2 deletions(-) commit 0debb20c5c812f8750c20c3406bc94a1e8ea4742 Author: Nícolas F. R. A. Prado Date: Fri Jul 5 19:29:54 2024 -0400 kselftest: devices: Move discoverable devices test to subdirectory Move the discoverable devices test to a subdirectory to allow other related tests to be added to the devices directory. Signed-off-by: Nícolas F. R. A. Prado Acked-by: Shuah Khan Acked-by: Greg Kroah-Hartman Link: https://lore.kernel.org/r/20240705-dev-err-log-selftest-v2-1-163b9cd7b3c1@collabora.com Signed-off-by: Greg Kroah-Hartman tools/testing/selftests/Makefile | 2 +- tools/testing/selftests/devices/{ => probe}/Makefile | 2 +- .../selftests/devices/{ => probe}/boards/Dell Inc.,XPS 13 9300.yaml | 0 tools/testing/selftests/devices/{ => probe}/boards/google,spherion.yaml | 0 tools/testing/selftests/devices/{ => probe}/ksft.py | 0 .../testing/selftests/devices/{ => probe}/test_discoverable_devices.py | 0 6 files changed, 2 insertions(+), 2 deletions(-) commit 03b927565057dae39da3e4b46e5ab65274b5dcdc Author: Geert Uytterhoeven Date: Thu Jul 11 16:30:36 2024 +0200 platform: arm64: EC_ACER_ASPIRE1 should depend on ARCH_QCOM The Acer Aspire 1 Embedded Controller is only present on the Qualcomm Snapdragon-based Acer Aspire 1 laptop. Hence add a dependency on ARCH_QCOM, to prevent asking the user about this driver when configuring a kernel without Qualcomm SoC support. Signed-off-by: Geert Uytterhoeven Reviewed-by: Hans de Goede Acked-by: Nikita Travkin Link: https://lore.kernel.org/r/f5f38709c01d369ed9e375ceb2a9a12986457a1a.1720707932.git.geert+renesas@glider.be Reviewed-by: Ilpo Järvinen Signed-off-by: Ilpo Järvinen drivers/platform/arm64/Kconfig | 1 + 1 file changed, 1 insertion(+) commit a5e43e2d202de39196de9fba689c34f8270782eb Author: Vamsi Attunuru Date: Thu Jul 11 05:01:15 2024 -0700 misc: Kconfig: add a new dependency for MARVELL_CN10K_DPI DPI hardware is an on-chip PCIe device on Marvell's arm64 SoC platforms. As Arnd suggested, CN10K belongs to ARCH_THUNDER lineage. Patch makes mrvl_cn10k_dpi driver dependent on CONFIG_ARCH_THUNDER. Signed-off-by: Vamsi Attunuru Link: https://lore.kernel.org/r/20240711120115.4069401-1-vattunuru@marvell.com Signed-off-by: Greg Kroah-Hartman drivers/misc/Kconfig | 1 + 1 file changed, 1 insertion(+) commit 89067019d7dbc65d86cf3a4d8f84ed2ad4bed12b Author: Jeff Johnson Date: Sun Jun 2 13:25:28 2024 -0700 virtio: add missing MODULE_DESCRIPTION() macro make allmodconfig && make W=1 C=1 reports: WARNING: modpost: missing MODULE_DESCRIPTION() in drivers/virtio/virtio_dma_buf.o Add the missing invocation of the MODULE_DESCRIPTION() macro. Signed-off-by: Jeff Johnson Link: https://lore.kernel.org/r/20240602-md-virtio_dma_buf-v1-1-ce602d47e257@quicinc.com Signed-off-by: Greg Kroah-Hartman drivers/virtio/virtio_dma_buf.c | 1 + 1 file changed, 1 insertion(+) commit 15eec4e1d07229fe570ad3a1344ad4a39d26106b Author: Jeff Johnson Date: Sat Jun 15 14:01:12 2024 -0700 agp: uninorth: add missing MODULE_DESCRIPTION() macro With ARCH=powerpc, make allmodconfig && make W=1 C=1 reports: WARNING: modpost: missing MODULE_DESCRIPTION() in drivers/char/agp/uninorth-agp.o Add the missing invocation of the MODULE_DESCRIPTION() macro. Signed-off-by: Jeff Johnson Reviewed-by: Jeffrey Hugo Link: https://lore.kernel.org/r/20240615-md-powerpc-drivers-char-agp-v1-1-b79bfd07da42@quicinc.com Signed-off-by: Greg Kroah-Hartman drivers/char/agp/uninorth-agp.c | 1 + 1 file changed, 1 insertion(+) commit 5919d93fbecea729e6c1cfe96ea6360a1f146297 Author: Jeff Johnson Date: Sun Jun 9 17:40:17 2024 -0700 spmi: add missing MODULE_DESCRIPTION() macros make allmodconfig && make W=1 C=1 reports: WARNING: modpost: missing MODULE_DESCRIPTION() in drivers/spmi/hisi-spmi-controller.o WARNING: modpost: missing MODULE_DESCRIPTION() in drivers/spmi/spmi-pmic-arb.o Add the missing invocations of the MODULE_DESCRIPTION() macro. Signed-off-by: Jeff Johnson Link: https://lore.kernel.org/r/20240609-md-drivers-spmi-v1-1-f1d5b24e7a66@quicinc.com Signed-off-by: Greg Kroah-Hartman drivers/spmi/hisi-spmi-controller.c | 1 + drivers/spmi/spmi-pmic-arb.c | 1 + 2 files changed, 2 insertions(+) commit 68a72104cbcf38ad16500216e213fa4eb21c4be2 Author: Stephen Rothwell Date: Tue Jul 9 16:37:15 2024 +1000 media: raspberrypi: Switch to remove_new The remove callback's return value is about to change from int to void, this is done by commit 0edb555a65d1 ("platform: Make platform_driver::remove() return void"). Prepare for merging the patch by switching the PiSP driver from remove to remove_new callback. Fixes: 12187bd5d4f8 ("media: raspberrypi: Add support for PiSP BE") Signed-off-by: Stephen Rothwell Acked-by: Naushir Patuck Acked-by: Jacopo Mondi Signed-off-by: Sakari Ailus Reviewed-by: Uwe Kleine-König Signed-off-by: Hans Verkuil drivers/media/platform/raspberrypi/pisp_be/pisp_be.c | 6 ++---- 1 file changed, 2 insertions(+), 4 deletions(-) commit 1c2c57bd439ecaffc728139a0a00701bee886d0a Author: Jacopo Mondi Date: Fri Jun 28 15:29:46 2024 +0200 media: uapi: pisp_be_config: Add extra config fields Complete the pisp_be_config strcture by adding fields that even if not written to the HW are relevant to complete the uAPI and put it in par with the BSP driver. Fixes: c6c49bac8770 ("media: uapi: Add Raspberry Pi PiSP Back End uAPI") Signed-off-by: Jacopo Mondi Signed-off-by: Sakari Ailus Signed-off-by: Hans Verkuil .../uapi/linux/media/raspberrypi/pisp_be_config.h | 41 ++++++++++++++++++++++ 1 file changed, 41 insertions(+) commit 639065c621df9bad9d94373084e1c568f81d34e0 Author: Jacopo Mondi Date: Fri Jun 28 15:29:45 2024 +0200 media: uapi: pisp_be_config: Re-sort pisp_be_tiles_config The order of the members of pisp_be_tiles_config is relevant as the driver logic assumes 'config' to be at offset 0. Re-sort the member to match the driver's expectations. Fixes: c6c49bac8770 ("media: uapi: Add Raspberry Pi PiSP Back End uAPI") Signed-off-by: Jacopo Mondi Acked-by: Naushir Patuck Signed-off-by: Sakari Ailus Signed-off-by: Hans Verkuil include/uapi/linux/media/raspberrypi/pisp_be_config.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit f5cee94f2dfe5b7625452b831f7629369ce68a7b Author: Jacopo Mondi Date: Fri Jun 28 15:29:44 2024 +0200 media: uapi: pisp_common: Capitalize all macros The macro used to inspect an image format characteristic use a mixture of capitalized and non-capitalized letters, which is rather unusual for the Linux kernel style. Capitalize all identifiers. Fixes: c6c49bac8770 ("media: uapi: Add Raspberry Pi PiSP Back End uAPI") Signed-off-by: Jacopo Mondi Signed-off-by: Sakari Ailus Signed-off-by: Hans Verkuil include/uapi/linux/media/raspberrypi/pisp_common.h | 38 +++++++++++----------- 1 file changed, 19 insertions(+), 19 deletions(-) commit 1991a09e6d7c1dff5efea65b5b31082332f2e64e Author: Jacopo Mondi Date: Fri Jun 28 15:29:43 2024 +0200 media: uapi: pisp_common: Add 32 bpp format test Add definition and test for 32-bits image formats to the pisp_common.h uAPI header. Fixes: c6c49bac8770 ("media: uapi: Add Raspberry Pi PiSP Back End uAPI") Signed-off-by: Jacopo Mondi Acked-by: David Plowman Signed-off-by: Sakari Ailus Signed-off-by: Hans Verkuil include/uapi/linux/media/raspberrypi/pisp_common.h | 3 +++ 1 file changed, 3 insertions(+) commit 79cf9c6ee44e0af7e1383365d29c64eece6665bb Author: Jacopo Mondi Date: Fri Jun 28 15:29:42 2024 +0200 media: uapi: pisp_be_config: Drop BIT() from uAPI The pisp_be_config.h uAPI header file contains a bit-field definition that uses the BIT() helper macro. As the BIT() identifier is not defined in userspace, drop it from the uAPI header. Fixes: c6c49bac8770 ("media: uapi: Add Raspberry Pi PiSP Back End uAPI") Signed-off-by: Jacopo Mondi Reviewed-by: Tomi Valkeinen Signed-off-by: Sakari Ailus Signed-off-by: Hans Verkuil include/uapi/linux/media/raspberrypi/pisp_be_config.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 4a2ebb082297f41803742729642961532e54079e Author: Kees Cook Date: Thu Jul 11 10:11:13 2024 -0700 efi: Replace efi_memory_attributes_table_t 0-sized array with flexible array While efi_memory_attributes_table_t::entry isn't used directly as an array, it is used as a base for pointer arithmetic. The type is wrong as it's not technically an array of efi_memory_desc_t's; they could be larger. Regardless, leave the type unchanged and remove the old style "0" array size. Additionally replace the open-coded entry offset code with the existing efi_memdesc_ptr() helper. Signed-off-by: Kees Cook Signed-off-by: Ard Biesheuvel drivers/firmware/efi/memattr.c | 2 +- include/linux/efi.h | 6 +++++- 2 files changed, 6 insertions(+), 2 deletions(-) commit 887c4cf5594a073fd60c0df84150eb06d78c6406 Author: Kees Cook Date: Thu Jul 11 10:11:12 2024 -0700 efi: Rename efi_early_memdesc_ptr() to efi_memdesc_ptr() The "early" part of the helper's name isn't accurate[1]. Drop it in preparation for adding a new (not early) usage. Suggested-by: Ard Biesheuvel Link: https://lore.kernel.org/lkml/CAMj1kXEyDjH0uu3Z4eBesV3PEnKGi5ArXXMp7R-hn8HdRytiPg@mail.gmail.com [1] Signed-off-by: Kees Cook Signed-off-by: Ard Biesheuvel drivers/firmware/efi/libstub/relocate.c | 2 +- drivers/firmware/efi/libstub/unaccepted_memory.c | 2 +- drivers/firmware/efi/libstub/x86-stub.c | 2 +- include/linux/efi.h | 4 ++-- 4 files changed, 5 insertions(+), 5 deletions(-) commit b0eed397623f897d3ccac9bda2bd2f53331b571a Author: Christian Marangi Date: Fri Jul 12 02:45:54 2024 +0200 leds: leds-lp5569: Enable chip after chip configuration Documentation say that clock internal config needs to be set BEFORE chip is enabled. Align code to this and move the CHIP enable after the CHIP is configured. While at it also make use of STATUS reg and check when STARTUP is completed instead of sleep for 1-2 ms. Signed-off-by: Christian Marangi Link: https://lore.kernel.org/r/20240712004556.15601-3-ansuelsmth@gmail.com Signed-off-by: Lee Jones drivers/leds/leds-lp5569.c | 19 +++++++++++-------- 1 file changed, 11 insertions(+), 8 deletions(-) commit 2a498d626df7e8d97e798799ebbc30d0482d52e8 Author: Christian Marangi Date: Fri Jul 12 02:45:53 2024 +0200 leds: leds-lp5569: Better handle enabling clock internal setting Better handle enabling clock internal setting. In further testing it was notice that internal clock config MUST be set before clock output config or the LED CHIP might stop working. This wasn't documented and was actually found on devices that have 2 chip chained where one chip provide clock for the other. Signed-off-by: Christian Marangi Link: https://lore.kernel.org/r/20240712004556.15601-2-ansuelsmth@gmail.com Signed-off-by: Lee Jones drivers/leds/leds-lp5569.c | 15 ++++++++++----- 1 file changed, 10 insertions(+), 5 deletions(-) commit 9c5fd279255cacc5a759e77a7eb1824d708b21d2 Author: Christian Marangi Date: Fri Jul 12 02:45:52 2024 +0200 leds: leds-lp5569: Fix typo in driver name Remove extra x from driver name as this was a typo from copy-paste error. Signed-off-by: Christian Marangi Link: https://lore.kernel.org/r/20240712004556.15601-1-ansuelsmth@gmail.com Signed-off-by: Lee Jones drivers/leds/leds-lp5569.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 1a7b7326d587c9a5e8ff067e70d6aaf0333f4bb3 Author: Christophe Leroy Date: Fri Jul 12 07:51:58 2024 +0200 vmlinux.lds.h: catch .bss..L* sections into BSS") Commit 9a427556fb8e ("vmlinux.lds.h: catch compound literals into data and BSS") added catches for .data..L* and .rodata..L* but missed .bss..L* Since commit 5431fdd2c181 ("ptrace: Convert ptrace_attach() to use lock guards") the following appears at build: LD .tmp_vmlinux.kallsyms1 powerpc64-linux-ld: warning: orphan section `.bss..Lubsan_data33' from `kernel/ptrace.o' being placed in section `.bss..Lubsan_data33' NM .tmp_vmlinux.kallsyms1.syms KSYMS .tmp_vmlinux.kallsyms1.S AS .tmp_vmlinux.kallsyms1.S LD .tmp_vmlinux.kallsyms2 powerpc64-linux-ld: warning: orphan section `.bss..Lubsan_data33' from `kernel/ptrace.o' being placed in section `.bss..Lubsan_data33' NM .tmp_vmlinux.kallsyms2.syms KSYMS .tmp_vmlinux.kallsyms2.S AS .tmp_vmlinux.kallsyms2.S LD vmlinux powerpc64-linux-ld: warning: orphan section `.bss..Lubsan_data33' from `kernel/ptrace.o' being placed in section `.bss..Lubsan_data33' Lets add .bss..L* to BSS_MAIN macro to catch those sections into BSS. Fixes: 9a427556fb8e ("vmlinux.lds.h: catch compound literals into data and BSS") Signed-off-by: Christophe Leroy Reported-by: kernel test robot Closes: https://lore.kernel.org/oe-kbuild-all/202404031349.nmKhyuUG-lkp@intel.com/ Signed-off-by: Arnd Bergmann include/asm-generic/vmlinux.lds.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 447bc4b1906f100e65c662528b7ae4e1dc2e9b80 Author: Mike Yu Date: Fri Jul 12 10:51:25 2024 +0800 xfrm: Support crypto offload for outbound IPv4 UDP-encapsulated ESP packet esp_xmit() is already able to handle UDP encapsulation through the call to esp_output_head(). However, the ESP header and the outer IP header are not correct and need to be corrected. Test: Enabled both dir=in/out IPsec crypto offload, and verified IPv4 UDP-encapsulated ESP packets on both wifi/cellular network Signed-off-by: Mike Yu Signed-off-by: Steffen Klassert net/ipv4/esp4.c | 8 +++++++- net/ipv4/esp4_offload.c | 17 ++++++++++++++++- 2 files changed, 23 insertions(+), 2 deletions(-) commit 4ecbac84b5b8c4ad033b473782582568810baf61 Author: Mike Yu Date: Fri Jul 12 10:51:24 2024 +0800 xfrm: Support crypto offload for inbound IPv4 UDP-encapsulated ESP packet If xfrm_input() is called with UDP_ENCAP_ESPINUDP, the packet is already processed in UDP layer that removes the UDP header. Therefore, there should be no much difference to treat it as an ESP packet in the XFRM stack. Test: Enabled dir=in IPsec crypto offload, and verified IPv4 UDP-encapsulated ESP packets on both wifi/cellular network Signed-off-by: Mike Yu Signed-off-by: Steffen Klassert net/xfrm/xfrm_input.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) commit a10fb4a84a693891b2e205684456d0825363fc24 Author: Mike Yu Date: Fri Jul 12 10:51:23 2024 +0800 xfrm: Allow UDP encapsulation in crypto offload control path Unblock this limitation so that SAs with encapsulation specified can be passed to HW drivers. HW drivers can still reject the SA in their implementation of xdo_dev_state_add if the encapsulation is not supported. Test: Verified on Android device Signed-off-by: Mike Yu Signed-off-by: Steffen Klassert net/xfrm/xfrm_device.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) commit f7e8542d71e908706855a9f3e9e7844fea1feea0 Author: Mike Yu Date: Fri Jul 12 10:51:22 2024 +0800 xfrm: Support crypto offload for inbound IPv6 ESP packets not in GRO path IPsec crypt offload supports outbound IPv6 ESP packets, but it doesn't support inbound IPv6 ESP packets. This change enables the crypto offload for inbound IPv6 ESP packets that are not handled through GRO code path. If HW drivers add the offload information to the skb, the packet will be handled in the crypto offload rx code path. Apart from the change in crypto offload rx code path, the change in xfrm_policy_check is also needed. Exampe of RX data path: +-----------+ +-------+ | HW Driver |-->| wlan0 |--------+ +-----------+ +-------+ | v +---------------+ +------+ +------>| Network Stack |-->| Apps | | +---------------+ +------+ | | | v +--------+ +------------+ | ipsec1 |<--| XFRM Stack | +--------+ +------------+ Test: Enabled both in/out IPsec crypto offload, and verified IPv6 ESP packets on Android device on both wifi/cellular network Signed-off-by: Mike Yu Signed-off-by: Steffen Klassert net/xfrm/xfrm_input.c | 2 +- net/xfrm/xfrm_policy.c | 5 ++++- 2 files changed, 5 insertions(+), 2 deletions(-) commit 06dcc4c9baa9e92896f00d02ffa760c0988b4371 Author: Takashi Sakamoto Date: Fri Jul 12 09:30:10 2024 +0900 firewire: core: move copy_port_status() helper function to TP_fast_assign() block It would be possible to put any statement in TP_fast_assign(). This commit obsoletes the helper function and put its statements to TP_fast_assign() for the code simplicity. Link: https://lore.kernel.org/r/20240712003010.87341-1-o-takashi@sakamocchi.jp Signed-off-by: Takashi Sakamoto drivers/firewire/core-trace.c | 11 ----------- include/trace/events/firewire.h | 15 ++++++++++----- 2 files changed, 10 insertions(+), 16 deletions(-) commit 8b68788bebd3f697ae62aa9af3dac35ed112ebd7 Merge: 85e23c662074 dc1000bf463d Author: Dave Airlie Date: Fri Jul 12 13:25:17 2024 +1000 Merge tag 'amd-drm-fixes-6.10-2024-07-11' of https://gitlab.freedesktop.org/agd5f/linux into drm-fixes amd-drm-fixes-6.10-2024-07-11: amdgpu: - PSR-SU fix - Reseved VMID fix Signed-off-by: Dave Airlie From: Alex Deucher Link: https://patchwork.freedesktop.org/patch/msgid/20240712005534.803064-1-alexander.deucher@amd.com commit 85e23c6620745c6c0a764ded52f3d775ee767eb6 Merge: 94e068cf9c4a 609458abd5a1 Author: Dave Airlie Date: Fri Jul 12 13:16:25 2024 +1000 Merge tag 'drm-xe-fixes-2024-07-11' of https://gitlab.freedesktop.org/drm/xe/kernel into drm-fixes UAPI Changes: - Use write-back caching mode for system memory on DGFX (Thomas) Driver Changes: - Do not leak object when finalizing hdcp gsc (Nirmoy) Signed-off-by: Dave Airlie From: Lucas De Marchi Link: https://patchwork.freedesktop.org/patch/msgid/vgqz35btnxdddko3byrgww5ii36wig2tvondg2p3j3b3ourj4i@rqgolll3wwkh commit c58c39163a7e2c4c8885c57e4e74931c7b482e53 Author: Nathan Chancellor Date: Thu Jun 20 08:48:16 2024 -0700 drm/omap: Restrict compile testing to PAGE_SIZE less than 64KB Prior to commit dc6fcaaba5a5 ("drm/omap: Allow build with COMPILE_TEST=y"), it was only possible to build the omapdrm driver with a 4KB page size. After that change, when the PAGE_SIZE is 64KB or larger, clang points out that the driver has some assumptions around the page size implicitly by passing PAGE_SIZE to a parameter with a type of u16: drivers/gpu/drm/omapdrm/omap_gem.c:758:7: error: implicit conversion from 'unsigned long' to 'u16' (aka 'unsigned short') changes value from 65536 to 0 [-Werror,-Wconstant-conversion] 757 | block = tiler_reserve_2d(fmt, omap_obj->width, omap_obj->height, | ~~~~~~~~~~~~~~~~ 758 | PAGE_SIZE); | ^~~~~~~~~ arch/powerpc/include/asm/page.h:25:34: note: expanded from macro 'PAGE_SIZE' 25 | #define PAGE_SIZE (ASM_CONST(1) << PAGE_SHIFT) | ~~~~~~~~~~~~~^~~~~~~~~~~~~ drivers/gpu/drm/omapdrm/omap_gem.c:1504:44: error: implicit conversion from 'unsigned long' to 'u16' (aka 'unsigned short') changes value from 65536 to 0 [-Werror,-Wconstant-conversion] 1504 | block = tiler_reserve_2d(fmts[i], w, h, PAGE_SIZE); | ~~~~~~~~~~~~~~~~ ^~~~~~~~~ arch/powerpc/include/asm/page.h:25:34: note: expanded from macro 'PAGE_SIZE' 25 | #define PAGE_SIZE (ASM_CONST(1) << PAGE_SHIFT) | ~~~~~~~~~~~~~^~~~~~~~~~~~~ 2 errors generated. As there is a lot of use of a u16 type throughout this driver and it will only ever be run on hardware that has a 4KB page size, just restrict compile testing to when the page size is less than 64KB (as no other issues have been discussed and it keeps compile testing relatively more available). Signed-off-by: Nathan Chancellor Signed-off-by: Dave Airlie Link: https://patchwork.freedesktop.org/patch/msgid/20240620-omapdrm-restrict-compile-test-to-sub-64kb-page-size-v1-1-5e56de71ffca@kernel.org drivers/gpu/drm/omapdrm/Kconfig | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 2146b7dd354c2a1384381ca3cd5751bfff6137d6 Author: James Chapman Date: Tue Jul 9 17:28:39 2024 +0100 l2tp: fix l2tp_session_register with colliding l2tpv3 IDs When handling colliding L2TPv3 session IDs, we use the existing session IDR entry and link the new session on that using session->coll_list. However, when using an existing IDR entry, we must not do the idr_replace step. Fixes: aa5e17e1f5ec ("l2tp: store l2tpv3 sessions in per-net IDR") Signed-off-by: James Chapman Signed-off-by: Tom Parkin Signed-off-by: David S. Miller net/l2tp/l2tp_core.c | 18 ++++++++++-------- 1 file changed, 10 insertions(+), 8 deletions(-) commit 864204e467e40621bb8b8009d2931558146a3e9a Merge: 38e73004c2b5 26d289158e49 Author: Dave Airlie Date: Fri Jul 12 12:52:15 2024 +1000 Merge tag 'drm-xe-next-fixes-2024-07-11' of https://gitlab.freedesktop.org/drm/xe/kernel into drm-next UAPI Changes: - Rename xe perf layer as xe observation layer (Ashutosh) Driver Changes: - Drop trace_xe_hw_fence_free (Brost) Signed-off-by: Dave Airlie From: Rodrigo Vivi Link: https://patchwork.freedesktop.org/patch/msgid/Zo_3ustogPDVKZwu@intel.com commit 38e73004c2b537f79789347a8c381c8efc502480 Merge: 62a05f4ae9c1 c537fb4e3d36 Author: Dave Airlie Date: Fri Jul 12 10:42:16 2024 +1000 Merge tag 'drm-misc-next-fixes-2024-07-11' of https://gitlab.freedesktop.org/drm/misc/kernel into drm-next A fix for fbdev on big endian systems, a condition fix for a sharp panel at removal, and a fix for qxl to prevent unpinned buffer access under certain conditions. Signed-off-by: Dave Airlie From: Maxime Ripard Link: https://patchwork.freedesktop.org/patch/msgid/20240711-benign-rich-mouflon-2eeafe@houat commit b6c67967897e2e02482f7bbd26232090a6e30ae5 Author: Shigeru Yoshida Date: Tue Jul 9 23:36:32 2024 +0900 tipc: Consolidate redundant functions link_is_up() and tipc_link_is_up() have the same functionality. Consolidate these functions. Signed-off-by: Shigeru Yoshida Reviewed-by: Tung Nguyen Signed-off-by: David S. Miller net/tipc/link.c | 27 ++++++++++----------------- 1 file changed, 10 insertions(+), 17 deletions(-) commit 534ea0a95e2d7b31eb1e1248d04edaffed75e366 Author: Shigeru Yoshida Date: Tue Jul 9 23:34:10 2024 +0900 tipc: Remove unused struct declaration struct tipc_name_table in core.h is not used. Remove this declaration. Signed-off-by: Shigeru Yoshida Reviewed-by: Tung Nguyen Signed-off-by: David S. Miller net/tipc/core.h | 1 - 1 file changed, 1 deletion(-) commit 90e812ac40c4b813fdbafab22f426fe4cdf840a8 Author: Christophe Leroy Date: Thu Jul 11 12:50:21 2024 +0200 Documentation/powerpc: Mention 40x is removed Commit 732b32daef80 ("powerpc: Remove core support for 40x") removed 40x. Update documentation accordingly. Signed-off-by: Christophe Leroy Signed-off-by: Michael Ellerman Link: https://msgid.link/c2d64bebc514ca892a12e51a68821a6317048d3a.1720694954.git.christophe.leroy@csgroup.eu Documentation/arch/powerpc/cpu_families.rst | 18 ------------------ Documentation/arch/powerpc/elf_hwcaps.rst | 1 + 2 files changed, 1 insertion(+), 18 deletions(-) commit 3efe19a9b15411119d4a35ec5790ad49f0a0234c Author: Christophe Leroy Date: Thu Jul 11 12:49:01 2024 +0200 powerpc: Remove 40x leftovers Remove stale references to 40x. Fixes: e939da89d024 ("powerpc: Remove 40x from Kconfig and defconfig") Fixes: 548f5244f106 ("powerpc/40x: Remove EP405") Signed-off-by: Christophe Leroy Signed-off-by: Michael Ellerman Link: https://msgid.link/ab30ae302783d8617d407864b92db1b926ab5ab9.1720694914.git.christophe.leroy@csgroup.eu arch/powerpc/boot/wrapper | 2 +- arch/powerpc/platforms/Kconfig.cputype | 1 - 2 files changed, 1 insertion(+), 2 deletions(-) commit 2a4183f864dad50f84edb6b67a2807a438f944fd Merge: 5e724cb688a2 0066623d4008 Author: Jakub Kicinski Date: Thu Jul 11 18:32:52 2024 -0700 Merge branch 'netconsole-fix-potential-race-condition-and-improve-code-clarity' Breno Leitao says: ==================== netconsole: improve code clarity These changes aim to enhance the reliability of netconsole by eliminating the potential race condition and improve maintainability by making the code more straightforward to understand and modify. ==================== Link: https://patch.msgid.link/20240709144403.544099-1-leitao@debian.org Signed-off-by: Jakub Kicinski commit 0066623d40085bb5d0af8d645a3bba27fc5cfced Author: Breno Leitao Date: Tue Jul 9 07:44:00 2024 -0700 net: netconsole: Eliminate redundant setting of enabled field When disabling a netconsole target, enabled_store() is called with enabled=false. Currently, this results in updating the nt->enabled field twice: 1. Inside the if/else block, with the target_list_lock spinlock held 2. Later, without the target_list_lock This patch eliminates the redundancy by setting the field only once, improving efficiency and reducing potential race conditions. Signed-off-by: Breno Leitao Link: https://patch.msgid.link/20240709144403.544099-3-leitao@debian.org Signed-off-by: Jakub Kicinski drivers/net/netconsole.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) commit a9359e8b0065a76cc11791f668bce3e9c7bf4fef Author: Breno Leitao Date: Tue Jul 9 07:43:59 2024 -0700 net: netconsole: Remove unnecessary cast from bool The 'enabled' variable is already a bool, so casting it to its value is redundant. Remove the superfluous cast, improving code clarity without changing functionality. Signed-off-by: Breno Leitao Link: https://patch.msgid.link/20240709144403.544099-2-leitao@debian.org Signed-off-by: Jakub Kicinski drivers/net/netconsole.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 36a5c03f232719eb4e2d925f4d584e09cfaf372c Author: Mateusz Jończyk Date: Thu Jul 11 22:23:16 2024 +0200 md/raid1: set max_sectors during early return from choose_slow_rdev() Linux 6.9+ is unable to start a degraded RAID1 array with one drive, when that drive has a write-mostly flag set. During such an attempt, the following assertion in bio_split() is hit: BUG_ON(sectors <= 0); Call Trace: ? bio_split+0x96/0xb0 ? exc_invalid_op+0x53/0x70 ? bio_split+0x96/0xb0 ? asm_exc_invalid_op+0x1b/0x20 ? bio_split+0x96/0xb0 ? raid1_read_request+0x890/0xd20 ? __call_rcu_common.constprop.0+0x97/0x260 raid1_make_request+0x81/0xce0 ? __get_random_u32_below+0x17/0x70 ? new_slab+0x2b3/0x580 md_handle_request+0x77/0x210 md_submit_bio+0x62/0xa0 __submit_bio+0x17b/0x230 submit_bio_noacct_nocheck+0x18e/0x3c0 submit_bio_noacct+0x244/0x670 After investigation, it turned out that choose_slow_rdev() does not set the value of max_sectors in some cases and because of it, raid1_read_request calls bio_split with sectors == 0. Fix it by filling in this variable. This bug was introduced in commit dfa8ecd167c1 ("md/raid1: factor out choose_slow_rdev() from read_balance()") but apparently hidden until commit 0091c5a269ec ("md/raid1: factor out helpers to choose the best rdev from read_balance()") shortly thereafter. Cc: stable@vger.kernel.org # 6.9.x+ Signed-off-by: Mateusz Jończyk Fixes: dfa8ecd167c1 ("md/raid1: factor out choose_slow_rdev() from read_balance()") Cc: Song Liu Cc: Yu Kuai Cc: Paul Luse Cc: Xiao Ni Cc: Mariusz Tkaczyk Link: https://lore.kernel.org/linux-raid/20240706143038.7253-1-mat.jonczyk@o2.pl/ -- Tested on both Linux 6.10 and 6.9.8. Inside a VM, mdadm testsuite for RAID1 on 6.10 did not find any problems: ./test --dev=loop --no-error --raidtype=raid1 (on 6.9.8 there was one failure, caused by external bitmap support not compiled in). Notes: - I was reliably getting deadlocks when adding / removing devices on such an array - while the array was loaded with fsstress with 20 concurrent processes. When the array was idle or loaded with fsstress with 8 processes, no such deadlocks happened in my tests. This occurred also on unpatched Linux 6.8.0 though, but not on 6.1.97-rc1, so this is likely an independent regression (to be investigated). - I was also getting deadlocks when adding / removing the bitmap on the array in similar conditions - this happened on Linux 6.1.97-rc1 also though. fsstress with 8 concurrent processes did cause it only once during many tests. - in my testing, there was once a problem with hot adding an internal bitmap to the array: mdadm: Cannot add bitmap while array is resyncing or reshaping etc. mdadm: failed to set internal bitmap. even though no such reshaping was happening according to /proc/mdstat. This seems unrelated, though. Reviewed-by: Yu Kuai Signed-off-by: Song Liu Link: https://lore.kernel.org/r/20240711202316.10775-1-mat.jonczyk@o2.pl drivers/md/raid1.c | 1 + 1 file changed, 1 insertion(+) commit 35a0a409fa269c287c4378f1aefe84ae8b5211a1 Author: Heming Zhao Date: Tue Jul 9 18:41:20 2024 +0800 md-cluster: fix no recovery job when adding/re-adding a disk The commit db5e653d7c9f ("md: delay choosing sync action to md_start_sync()") delays the start of the sync action. In a clustered environment, this will cause another node to first activate the spare disk and skip recovery. As a result, no nodes will perform recovery when a disk is added or re-added. Before db5e653d7c9f: ``` node1 node2 ---------------------------------------------------------------- md_check_recovery + md_update_sb | sendmsg: METADATA_UPDATED + md_choose_sync_action process_metadata_update | remove_and_add_spares //node1 has not finished adding + call mddev->sync_work //the spare disk:do nothing md_start_sync starts md_do_sync md_do_sync + grabbed resync_lockres:DLM_LOCK_EX + do syncing job md_check_recovery sendmsg: METADATA_UPDATED process_metadata_update //activate spare disk ... ... md_do_sync waiting to grab resync_lockres:EX ``` After db5e653d7c9f: (note: if 'cmd:idle' sets MD_RECOVERY_INTR after md_check_recovery starts md_start_sync, setting the INTR action will exacerbate the delay in node1 calling the md_do_sync function.) ``` node1 node2 ---------------------------------------------------------------- md_check_recovery + md_update_sb | sendmsg: METADATA_UPDATED + calls mddev->sync_work process_metadata_update //node1 has not finished adding //the spare disk:do nothing md_start_sync + md_choose_sync_action | remove_and_add_spares + calls md_do_sync md_check_recovery md_update_sb sendmsg: METADATA_UPDATED process_metadata_update //activate spare disk ... ... ... ... md_do_sync + grabbed resync_lockres:EX + raid1_sync_request skip sync under conf->fullsync:0 md_do_sync 1. waiting to grab resync_lockres:EX 2. when node1 could grab EX lock, node1 will skip resync under recovery_offset:MaxSector ``` How to trigger: ```(commands @node1) # to easily watch the recovery status echo 2000 > /proc/sys/dev/raid/speed_limit_max ssh root@node2 "echo 2000 > /proc/sys/dev/raid/speed_limit_max" mdadm -CR /dev/md0 -l1 -b clustered -n 2 /dev/sda /dev/sdb --assume-clean ssh root@node2 mdadm -A /dev/md0 /dev/sda /dev/sdb mdadm --manage /dev/md0 --fail /dev/sda --remove /dev/sda mdadm --manage /dev/md0 --add /dev/sdc === "cat /proc/mdstat" on both node, there are no recovery action. === ``` How to fix: because md layer code logic is hard to restore for speeding up sync job on local node, we add new cluster msg to pending the another node to active disk. Signed-off-by: Heming Zhao Reviewed-by: Su Yue Acked-by: Yu Kuai Signed-off-by: Song Liu Link: https://lore.kernel.org/r/20240709104120.22243-2-heming.zhao@suse.com drivers/md/md-cluster.c | 27 +++++++++++++++++++++++++++ drivers/md/md-cluster.h | 2 ++ drivers/md/md.c | 17 ++++++++++++++--- 3 files changed, 43 insertions(+), 3 deletions(-) commit fff42f213824fa434a4b6cf906b4331fe6e9302b Author: Heming Zhao Date: Tue Jul 9 18:41:19 2024 +0800 md-cluster: fix hanging issue while a new disk adding The commit 1bbe254e4336 ("md-cluster: check for timeout while a new disk adding") is correct in terms of code syntax but not suite real clustered code logic. When a timeout occurs while adding a new disk, if recv_daemon() bypasses the unlock for ack_lockres:CR, another node will be waiting to grab EX lock. This will cause the cluster to hang indefinitely. How to fix: 1. In dlm_lock_sync(), change the wait behaviour from forever to a timeout, This could avoid the hanging issue when another node fails to handle cluster msg. Another result of this change is that if another node receives an unknown msg (e.g. a new msg_type), the old code will hang, whereas the new code will timeout and fail. This could help cluster_md handle new msg_type from different nodes with different kernel/module versions (e.g. The user only updates one leg's kernel and monitors the stability of the new kernel). 2. The old code for __sendmsg() always returns 0 (success) under the design (must successfully unlock ->message_lockres). This commit makes this function return an error number when an error occurs. Fixes: 1bbe254e4336 ("md-cluster: check for timeout while a new disk adding") Signed-off-by: Heming Zhao Reviewed-by: Su Yue Acked-by: Yu Kuai Signed-off-by: Song Liu Link: https://lore.kernel.org/r/20240709104120.22243-1-heming.zhao@suse.com drivers/md/md-cluster.c | 22 ++++++++++++---------- 1 file changed, 12 insertions(+), 10 deletions(-) commit 5e724cb688a207ae7a348d57f9ea77f475998883 Author: Adrian Moreno Date: Wed Jul 10 11:04:59 2024 +0200 selftests: openvswitch: retry instead of sleep There are a couple of places where the test script "sleep"s to wait for some external condition to be met. This is error prone, specially in slow systems (identified in CI by "KSFT_MACHINE_SLOW=yes"). To fix this, add a "ovs_wait" function that tries to execute a command a few times until it succeeds. The timeout used is set to 5s for "normal" systems and doubled if a slow CI machine is detected. This should make the following work: $ vng --build \ --config tools/testing/selftests/net/config \ --config kernel/configs/debug.config $ vng --run . --user root -- "make -C tools/testing/selftests/ \ KSFT_MACHINE_SLOW=yes TARGETS=net/openvswitch run_tests" Signed-off-by: Adrian Moreno Reviewed-by: Ilya Maximets Link: https://patch.msgid.link/20240710090500.1655212-1-amorenoz@redhat.com Signed-off-by: Jakub Kicinski .../selftests/net/openvswitch/openvswitch.sh | 45 ++++++++++++++++++---- .../testing/selftests/net/openvswitch/ovs-dpctl.py | 1 + 2 files changed, 38 insertions(+), 8 deletions(-) commit 13cabc47f8ae69d24653f32c28399d493fde0a56 Author: Alexander Lobakin Date: Wed Jul 10 04:30:28 2024 -0700 netdevice: define and allocate &net_device _properly_ In fact, this structure contains a flexible array at the end, but historically its size, alignment etc., is calculated manually. There are several instances of the structure embedded into other structures, but also there's ongoing effort to remove them and we could in the meantime declare &net_device properly. Declare the array explicitly, use struct_size() and store the array size inside the structure, so that __counted_by() can be applied. Don't use PTR_ALIGN(), as SLUB itself tries its best to ensure the allocated buffer is aligned to what the user expects. Also, change its alignment from %NETDEV_ALIGN to the cacheline size as per several suggestions on the netdev ML. bloat-o-meter for vmlinux: free_netdev 445 440 -5 netdev_freemem 24 - -24 alloc_netdev_mqs 1481 1450 -31 On x86_64 with several NICs of different vendors, I was never able to get a &net_device pointer not aligned to the cacheline size after the change. Signed-off-by: Alexander Lobakin Signed-off-by: Breno Leitao Reviewed-by: Przemek Kitszel Reviewed-by: Eric Dumazet Reviewed-by: Kees Cook Link: https://patch.msgid.link/20240710113036.2125584-1-leitao@debian.org Signed-off-by: Jakub Kicinski include/linux/netdevice.h | 15 +++++++++------ net/core/dev.c | 30 ++++++------------------------ net/core/net-sysfs.c | 2 +- 3 files changed, 16 insertions(+), 31 deletions(-) commit 8341eee81c794db0d8dd503c2b0ea2f55eba7334 Author: Adrian Moreno Date: Wed Jul 10 19:10:04 2024 +0200 net: psample: fix flag being set in wrong skb A typo makes PSAMPLE_ATTR_SAMPLE_RATE netlink flag be added to the wrong sk_buff. Fix the error and make the input sk_buff pointer "const" so that it doesn't happen again. Acked-by: Eelco Chaudron Fixes: 7b1b2b60c63f ("net: psample: allow using rate as probability") Signed-off-by: Adrian Moreno Reviewed-by: Ido Schimmel Reviewed-by: Antoine Tenart Link: https://patch.msgid.link/20240710171004.2164034-1-amorenoz@redhat.com Signed-off-by: Jakub Kicinski include/net/psample.h | 8 +++++--- net/psample/psample.c | 7 ++++--- 2 files changed, 9 insertions(+), 6 deletions(-) commit c9741a03dc8e491e57b95fba0058ab46b7e506da Author: Alexey Kodanev Date: Mon Jul 8 10:50:08 2024 +0000 bna: adjust 'name' buf size of bna_tcb and bna_ccb structures To have enough space to write all possible sprintf() args. Currently 'name' size is 16, but the first '%s' specifier may already need at least 16 characters, since 'bnad->netdev->name' is used there. For '%d' specifiers, assume that they require: * 1 char for 'tx_id + tx_info->tcb[i]->id' sum, BNAD_MAX_TXQ_PER_TX is 8 * 2 chars for 'rx_id + rx_info->rx_ctrl[i].ccb->id', BNAD_MAX_RXP_PER_RX is 16 And replace sprintf with snprintf. Detected using the static analysis tool - Svace. Fixes: 8b230ed8ec96 ("bna: Brocade 10Gb Ethernet device driver") Signed-off-by: Alexey Kodanev Reviewed-by: Simon Horman Signed-off-by: David S. Miller drivers/net/ethernet/brocade/bna/bna_types.h | 2 +- drivers/net/ethernet/brocade/bna/bnad.c | 11 ++++++----- 2 files changed, 7 insertions(+), 6 deletions(-) commit dc1000bf463d1d89f66d6b5369cf76603f32c4d3 Author: Leo Li Date: Thu Jul 11 10:31:09 2024 -0400 Revert "drm/amd/display: Reset freesync config before update new state" This change caused PSR SU panels to not read from their remote fb, preventing us from entering self-refresh. It is a regression. This reverts commit 6b8487cdf9fc7bae707519ac5b5daeca18d1e85b. Signed-off-by: Leo Li Acked-by: Alex Deucher Signed-off-by: Alex Deucher drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c | 1 - 1 file changed, 1 deletion(-) commit 80ab5445da623540ea6303740015dd0210a06dc8 Merge: cef4902b0fad dabcfd5e1168 Author: Jakub Kicinski Date: Thu Jul 11 17:22:04 2024 -0700 Merge tag 'wireless-next-2024-07-11' of git://git.kernel.org/pub/scm/linux/kernel/git/wireless/wireless-next Kalle Valo says: ==================== wireless-next patches for v6.11 Most likely the last "new features" pull request for v6.11 with changes both in stack and in drivers. The big thing is the multiple radios for wiphy feature which makes it possible to better advertise radio capabilities to user space. mt76 enabled MLO and iwlwifi re-enabled MLO, ath12k and rtw89 Wi-Fi 6 devices got WoWLAN support. Major changes: cfg80211/mac80211 * remove DEAUTH_NEED_MGD_TX_PREP flag * multiple radios per wiphy support mac80211_hwsim * multi-radio wiphy support ath12k * DebugFS support for datapath statistics * WCN7850: support for WoW (Wake on WLAN) * WCN7850: device-tree bindings ath11k * QCA6390: device-tree bindings iwlwifi * mvm: re-enable Multi-Link Operation (MLO) * aggregation (A-MSDU) optimisations rtw89 * preparation for RTL8852BE-VT support * WoWLAN support for WiFi 6 chips * 36-bit PCI DMA support mt76 * mt7925 Multi-Link Operation (MLO) support * tag 'wireless-next-2024-07-11' of git://git.kernel.org/pub/scm/linux/kernel/git/wireless/wireless-next: (204 commits) wifi: mac80211: fix AP chandef capturing in CSA wifi: iwlwifi: correctly reference TSO page information wifi: mt76: mt792x: fix scheduler interference in drv own process wifi: mt76: mt7925: enabling MLO when the firmware supports it wifi: mt76: mt7925: remove the unused mt7925_mcu_set_chan_info wifi: mt76: mt7925: update mt7925_mac_link_bss_add for MLO wifi: mt76: mt7925: update mt7925_mcu_bss_basic_tlv for MLO wifi: mt76: mt7925: update mt7925_mcu_set_timing for MLO wifi: mt76: mt7925: update mt7925_mcu_sta_phy_tlv for MLO wifi: mt76: mt7925: update mt7925_mcu_sta_rate_ctrl_tlv for MLO wifi: mt76: mt7925: add mt7925_mcu_sta_eht_mld_tlv for MLO wifi: mt76: mt7925: update mt7925_mcu_sta_update for MLO wifi: mt76: mt7925: update mt7925_mcu_add_bss_info for MLO wifi: mt76: mt7925: update mt7925_mcu_bss_mld_tlv for MLO wifi: mt76: mt7925: update mt7925_mcu_sta_mld_tlv for MLO wifi: mt76: mt7925: add mt7925_[assign,unassign]_vif_chanctx wifi: mt76: add def_wcid to struct mt76_wcid wifi: mt76: mt7925: report link information in rx status wifi: mt76: mt7925: update rate index according to link id wifi: mt76: mt7925: add link handling in the mt7925_ipv6_addr_change ... ==================== Link: https://patch.msgid.link/20240711102353.0C849C116B1@smtp.kernel.org Signed-off-by: Jakub Kicinski commit cef4902b0fadfc4181176ef5713f0b7cf2a40d8f Author: Eric Dumazet Date: Wed Jul 10 15:16:53 2024 +0000 net: reduce rtnetlink_rcv_msg() stack usage IFLA_MAX is increasing slowly but surely. Some compilers use more than 512 bytes of stack in rtnetlink_rcv_msg() because it calls rtnl_calcit() for RTM_GETLINK message. Use noinline_for_stack attribute to not inline rtnl_calcit(), and directly use nla_for_each_attr_type() (Jakub suggestion) because we only care about IFLA_EXT_MASK at this stage. Signed-off-by: Eric Dumazet Reviewed-by: Simon Horman Link: https://patch.msgid.link/20240710151653.3786604-1-edumazet@google.com Signed-off-by: Jakub Kicinski net/core/rtnetlink.c | 18 ++++++++++++------ 1 file changed, 12 insertions(+), 6 deletions(-) commit b07593edd2faf310f9b758896f4f1c6054515be4 Author: Chen Ni Date: Tue Jul 9 15:28:38 2024 +0800 net/sched: act_skbmod: convert comma to semicolon Replace a comma between expression statements by a semicolon. Signed-off-by: Chen Ni Reviewed-by: Simon Horman Link: https://patch.msgid.link/20240709072838.1152880-1-nichen@iscas.ac.cn Signed-off-by: Jakub Kicinski net/sched/act_skbmod.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit ab1c7ea48f6e225aa40eff3be45a47c7d93cb3b8 Author: George Stark Date: Thu Jul 11 01:32:12 2024 +0300 dt-bindings: i2c: amlogic,meson6-i2c: add optional power-domains On newer SoCs, the I2C hardware can require a power domain to operate. Since the same compatible is used for older and newer SoCs make power-domains property optional. Signed-off-by: George Stark Reviewed-by: Neil Armstrong Reviewed-by: Rob Herring (Arm) Signed-off-by: Andi Shyti Documentation/devicetree/bindings/i2c/amlogic,meson6-i2c.yaml | 3 +++ 1 file changed, 3 insertions(+) commit 0d9c0a67b14401344183cc0f8239f8d1851637fd Author: Thorsten Blum Date: Thu Jul 11 10:43:16 2024 +0200 bootconfig: Remove duplicate included header file linux/bootconfig.h The header file linux/bootconfig.h is included whether __KERNEL__ is defined or not. Include it only once before the #ifdef/#else/#endif preprocessor directives and remove the following make includecheck warning: linux/bootconfig.h is included more than once Move the comment to the top and delete the now empty #else block. Link: https://lore.kernel.org/all/20240711084315.1507-1-thorsten.blum@toblux.com/ Signed-off-by: Thorsten Blum Signed-off-by: Masami Hiramatsu (Google) lib/bootconfig.c | 20 +++++++++----------- 1 file changed, 9 insertions(+), 11 deletions(-) commit 56478475560bde71dd3ef944b5013900272db273 Merge: 3a8617c7df6e 8f55ada79656 Author: Dave Jiang Date: Thu Jul 11 16:30:18 2024 -0700 Merge branch 'for-6.11/xor_fixes' into cxl-for-next Series to fix XOR math for DPA to SPA translation - Refactor and fold cxl_trace_hpa() into cxl_dpa_to_hpa() - Complete DPA->HPA->SPA translation and correct XOR translation issue - Add new method to verify a CXL target position - Remove old method of CXL target position verifiation commit 861f96a785149a0062cce6578e0fa7cb95435a7e Author: Lu Baolu Date: Wed Jul 10 16:33:39 2024 +0800 iommufd: Remove IOMMUFD_PAGE_RESP_FAILURE The response code of IOMMUFD_PAGE_RESP_FAILURE was defined to be equivalent to the "Response Failure" in PCI spec, section 10.4.2.1. This response code indicates that one or more pages within the associated request group have encountered or caused an unrecoverable error. Therefore, this response disables the PRI at the function. Modern I/O virtualization technologies, like SR-IOV, share PRI among the assignable device units. Therefore, a response failure on one unit might cause I/O failure on other units. Remove this response code so that user space can only respond with SUCCESS or INVALID. The VMM is recommended to emulate a failure response as a PRI reset, or PRI disable and changing to a non-PRI domain. Fixes: c714f15860fc ("iommufd: Add fault and response message definitions") Link: https://lore.kernel.org/r/20240710083341.44617-2-baolu.lu@linux.intel.com Signed-off-by: Lu Baolu Reviewed-by: Kevin Tian Signed-off-by: Jason Gunthorpe include/uapi/linux/iommufd.h | 4 ---- 1 file changed, 4 deletions(-) commit 8f55ada796565ce801418bf579f31a6a522d0337 Author: Alison Schofield Date: Tue Jul 2 22:29:52 2024 -0700 cxl: Remove defunct code calculating host bridge target positions The CXL Spec 3.1 Table 9-22 requires that the BIOS populate the CFMWS target list in interleave target order. This means the calculations the CXL driver added to determine positions when XOR math is in use, along with the entire XOR vs Modulo call back setup is not needed. A prior patch added a common method to verify positions. Remove the now unused code related to the cxl_calc_hb_fn. Signed-off-by: Alison Schofield Reviewed-by: Dan Williams Reviewed-by: Jonathan Cameron Link: https://patch.msgid.link/2e2c32a2d0f1007e920b58712d15edad2e48d857.1719980933.git.alison.schofield@intel.com Signed-off-by: Dave Jiang drivers/cxl/acpi.c | 60 ++----------------------------------------------- drivers/cxl/core/port.c | 20 +---------------- drivers/cxl/cxl.h | 8 +------ 3 files changed, 4 insertions(+), 84 deletions(-) commit 82a3e3a235633aa0575fac9507d648dd80f3437f Author: Alison Schofield Date: Tue Jul 2 22:29:51 2024 -0700 cxl/region: Verify target positions using the ordered target list When a root decoder is configured the interleave target list is read from the BIOS populated CFMWS structure. Per the CXL spec 3.1 Table 9-22 the target list is in interleave order. The CXL driver populates its decoder target list in the same order and stores it in 'struct cxl_switch_decoder' field "@target: active ordered target list in current decoder configuration" Given the promise of an ordered list, the driver can stop duplicating the work of BIOS and simply check target positions against the ordered list during region configuration. The simplified check against the ordered list is presented here. A follow-on patch will remove the unused code. For Modulo arithmetic this is not a fix, only a simplification. For XOR arithmetic this is a fix for HB IW of 3,6,12. Fixes: f9db85bfec0d ("cxl/acpi: Support CXL XOR Interleave Math (CXIMS)") Signed-off-by: Alison Schofield Reviewed-by: Dan Williams Reviewed-by: Jonathan Cameron Link: https://patch.msgid.link/35d08d3aba08fee0f9b86ab1cef0c25116ca8a55.1719980933.git.alison.schofield@intel.com Signed-off-by: Dave Jiang drivers/cxl/core/region.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) commit 3b2fedcd75e3991e77c2a8c3ebcab0ea68b2d69d Author: Alison Schofield Date: Tue Jul 2 22:29:50 2024 -0700 cxl: Restore XOR'd position bits during address translation When a device reports a DPA in events like poison, general_media, and dram, the driver translates that DPA back to an HPA. Presently, the CXL driver translation only considers the Modulo position and will report the wrong HPA for XOR configured root decoders. Add a helper function that restores the XOR'd bits during DPA->HPA address translation. Plumb a root decoder callback to the new helper when XOR interleave arithmetic is in use. For Modulo arithmetic, just let the callback be NULL - as in no extra work required. Upon completion of a DPA->HPA translation a couple of checks are performed on the result. One simply confirms that the calculated HPA is within the address range of the region. That test is useful for both Modulo and XOR interleave arithmetic decodes. A second check confirms that the HPA is within an expected chunk based on the endpoints position in the region and the region granularity. An XOR decode disrupts the Modulo pattern making the chunk check useless. To align the checks with the proper decode, pull the region range check inline and use the helper to do the chunk check for Modulo decodes only. A cxl-test unit test is posted for upstream review here: https://lore.kernel.org/20240624210644.495563-1-alison.schofield@intel.com/ Fixes: 28a3ae4ff66c ("cxl/trace: Add an HPA to cxl_poison trace events") Signed-off-by: Alison Schofield Tested-by: Diego Garcia Rodriguez Reviewed-by: Dan Williams Link: https://patch.msgid.link/1a1ac880d9f889bd6384e657e810431b9a0a72e5.1719980933.git.alison.schofield@intel.com Signed-off-by: Dave Jiang drivers/cxl/acpi.c | 40 ++++++++++++++++++++++++++++++++++++++++ drivers/cxl/core/region.c | 23 ++++++++++++++--------- drivers/cxl/cxl.h | 3 +++ 3 files changed, 57 insertions(+), 9 deletions(-) commit 9aa5f6235e16ac6fceed789a30e72addf1abd7d8 Author: Alison Schofield Date: Tue Jul 2 22:29:49 2024 -0700 cxl/core: Fold cxl_trace_hpa() into cxl_dpa_to_hpa() Although cxl_trace_hpa() is used to populate TRACE EVENTs with HPA addresses the work it performs is a DPA to HPA translation not a trace. Tidy up this naming by moving the minimal work done in cxl_trace_hpa() into cxl_dpa_to_hpa() and use cxl_dpa_to_hpa() for trace event callbacks. Suggested-by: Dan Williams Signed-off-by: Alison Schofield Reviewed-by: Dan Williams Reviewed-by: Robert Richter Link: https://patch.msgid.link/452a9b0c525b774c72d9d5851515ffa928750132.1719980933.git.alison.schofield@intel.com Signed-off-by: Dave Jiang drivers/cxl/core/core.h | 8 ++++---- drivers/cxl/core/mbox.c | 2 +- drivers/cxl/core/region.c | 33 +++++++++++++-------------------- drivers/cxl/core/trace.h | 4 ++-- 4 files changed, 20 insertions(+), 27 deletions(-) commit 3048dc8ba46b7ba11581f2a7e06849af0df13136 Author: Nicolas Ferre Date: Thu Jul 11 18:54:02 2024 +0200 spi: dt-bindings: at91: Add sama7d65 compatible string Add compatible string for sama7d65. Like sam9x60 and sam9x7, it requires to bind to "atmel,at91rm9200-spi". Group these three under the same enum, sorted alphanumerically, and remove previously added item. Signed-off-by: Nicolas Ferre Acked-by: Rob Herring (Arm) Link: https://patch.msgid.link/20240711165402.373634-1-nicolas.ferre@microchip.com Signed-off-by: Mark Brown Documentation/devicetree/bindings/spi/atmel,at91rm9200-spi.yaml | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) commit e3fff693da9fa0337d98dab496db3a04c5227aae Author: Animesh Agarwal Date: Wed Jul 10 12:57:52 2024 +0530 ASoC: dt-bindings: cirrus,cs42xx8: Convert to dtschema Convert the Cirrus Logic CS42448/CS42888 audio CODEC bindings to DT schema format. Set power supply properties to required only for CS42888. Cc: Daniel Baluta Signed-off-by: Animesh Agarwal Reviewed-by: Rob Herring (Arm) Link: https://patch.msgid.link/20240710072756.99765-1-animeshagarwal28@gmail.com Signed-off-by: Mark Brown .../devicetree/bindings/sound/cirrus,cs42xx8.yaml | 81 ++++++++++++++++++++++ .../devicetree/bindings/sound/cs42xx8.txt | 34 --------- 2 files changed, 81 insertions(+), 34 deletions(-) commit b2b1f9338400de0fb65e2ff5fab1b5617dcb5a97 Author: Lai Jiangshan Date: Thu Jul 11 16:35:47 2024 +0800 workqueue: Rename wq_update_pod() to unbound_wq_update_pwq() What wq_update_pod() does is just to update the pwq of the specific cpu. Rename it and update the comments. Signed-off-by: Lai Jiangshan Signed-off-by: Tejun Heo kernel/workqueue.c | 32 +++++++++++++++----------------- 1 file changed, 15 insertions(+), 17 deletions(-) commit d160a58de59cd617d9648d0458d572d063d66b71 Author: Lai Jiangshan Date: Thu Jul 11 16:35:46 2024 +0800 workqueue: Remove the arguments @hotplug_cpu and @online from wq_update_pod() The arguments @hotplug_cpu and @online are not used in wq_update_pod() since the functions called by wq_update_pod() don't need them. Signed-off-by: Lai Jiangshan Signed-off-by: Tejun Heo kernel/workqueue.c | 13 +++++-------- 1 file changed, 5 insertions(+), 8 deletions(-) commit 88a41b185d3d6bb03733441c4e440c80dbd1866a Author: Lai Jiangshan Date: Thu Jul 11 16:35:45 2024 +0800 workqueue: Remove the argument @cpu_going_down from wq_calc_pod_cpumask() wq_calc_pod_cpumask() uses wq_online_cpumask, which excludes the cpu going down, so the argument cpu_going_down is unused and can be removed. Signed-off-by: Lai Jiangshan Signed-off-by: Tejun Heo kernel/workqueue.c | 12 ++++-------- 1 file changed, 4 insertions(+), 8 deletions(-) commit 2cb61f76be3b17d5ad42ba3b7b23c7bf98253a0b Author: Lai Jiangshan Date: Thu Jul 11 16:35:44 2024 +0800 workqueue: Remove the unneeded cpumask empty check in wq_calc_pod_cpumask() The cpumask empty check in wq_calc_pod_cpumask() has long been useless. It just works purely as documents which states that the cpumask is not possible empty after the function returns. Now the code above is even more explicit that the cpumask is not empty, so the document-only empty check can be removed. Signed-off-by: Lai Jiangshan Signed-off-by: Tejun Heo kernel/workqueue.c | 4 ---- 1 file changed, 4 deletions(-) commit 19af457573838785290d27dd09a59140f541d1d8 Author: Lai Jiangshan Date: Thu Jul 11 16:35:43 2024 +0800 workqueue: Remove cpus_read_lock() from apply_wqattrs_lock() 1726a1713590 ("workqueue: Put PWQ allocation and WQ enlistment in the same lock C.S.") led to the following possible deadlock: WARNING: possible recursive locking detected 6.10.0-rc5-00004-g1d4c6111406c #1 Not tainted -------------------------------------------- swapper/0/1 is trying to acquire lock: c27760f4 (cpu_hotplug_lock){++++}-{0:0}, at: alloc_workqueue (kernel/workqueue.c:5152 kernel/workqueue.c:5730) but task is already holding lock: c27760f4 (cpu_hotplug_lock){++++}-{0:0}, at: padata_alloc (kernel/padata.c:1007) ... stack backtrace: ... cpus_read_lock (include/linux/percpu-rwsem.h:53 kernel/cpu.c:488) alloc_workqueue (kernel/workqueue.c:5152 kernel/workqueue.c:5730) padata_alloc (kernel/padata.c:1007 (discriminator 1)) pcrypt_init_padata (crypto/pcrypt.c:327 (discriminator 1)) pcrypt_init (crypto/pcrypt.c:353) do_one_initcall (init/main.c:1267) do_initcalls (init/main.c:1328 (discriminator 1) init/main.c:1345 (discriminator 1)) kernel_init_freeable (init/main.c:1364) kernel_init (init/main.c:1469) ret_from_fork (arch/x86/kernel/process.c:153) ret_from_fork_asm (arch/x86/entry/entry_32.S:737) entry_INT80_32 (arch/x86/entry/entry_32.S:944) This is caused by pcrypt allocating a workqueue while holding cpus_read_lock(), so workqueue code can't do it again as that can lead to deadlocks if down_write starts after the first down_read. The pwq creations and installations have been reworked based on wq_online_cpumask rather than cpu_online_mask making cpus_read_lock() is unneeded during wqattrs changes. Fix the deadlock by removing cpus_read_lock() from apply_wqattrs_lock(). tj: Updated changelog. Signed-off-by: Lai Jiangshan Fixes: 1726a1713590 ("workqueue: Put PWQ allocation and WQ enlistment in the same lock C.S.") Link: http://lkml.kernel.org/r/202407081521.83b627c1-lkp@intel.com Signed-off-by: Tejun Heo kernel/workqueue.c | 3 --- 1 file changed, 3 deletions(-) commit fbb3d4c15dc0fe8a439de267db927a9ab2f44e98 Author: Lai Jiangshan Date: Thu Jul 11 16:35:42 2024 +0800 workqueue: Simplify wq_calc_pod_cpumask() with wq_online_cpumask Avoid relying on cpu_online_mask for wqattrs changes so that cpus_read_lock() can be removed from apply_wqattrs_lock(). And with wq_online_cpumask, attrs->__pod_cpumask doesn't need to be reused as a temporary storage to calculate if the pod have any online CPUs @attrs wants since @cpu_going_down is not in the wq_online_cpumask. Signed-off-by: Lai Jiangshan Signed-off-by: Tejun Heo kernel/workqueue.c | 12 +++--------- 1 file changed, 3 insertions(+), 9 deletions(-) commit 8d84baf76045f5b9567581cde17e9c3d256bb073 Author: Lai Jiangshan Date: Thu Jul 11 16:35:41 2024 +0800 workqueue: Add wq_online_cpumask The new wq_online_mask mirrors the cpu_online_mask except during hotplugging; specifically, it differs between the hotplugging stages of workqueue_offline_cpu() and workqueue_online_cpu(), during which the transitioning CPU is not represented in the mask. Signed-off-by: Lai Jiangshan Signed-off-by: Tejun Heo kernel/workqueue.c | 10 ++++++++++ 1 file changed, 10 insertions(+) commit 1d302f626c2a23e4fd05bb810eff300e8f2174fd Author: Guilherme Amadio Date: Fri Jun 28 22:34:27 2024 +0200 perf build: Conditionally add feature check flags for libtrace{event,fs} This avoids reported warnings when the packages are not installed. [namhyung]: Removed the dummy assignment and unnecessary ifeq checks. Fixes: 0f0e1f445690 ("perf build: Use pkg-config for feature check for libtrace{event,fs}") Signed-off-by: Guilherme Amadio Cc: Leo Yan Cc: Thorsten Leemhuis Link: https://lore.kernel.org/r/20240628203432.3273625-1-amadio@gentoo.org Signed-off-by: Namhyung Kim tools/perf/Makefile.config | 20 ++++++++++---------- 1 file changed, 10 insertions(+), 10 deletions(-) commit 6937693d752e216b54845cfe8d89ced82e6a4568 Merge: 7c8267275de6 24ac7e544081 Author: Jakub Kicinski Date: Thu Jul 11 14:41:49 2024 -0700 Merge branch 'ethtool-use-the-rss-context-xarray-in-ring-deactivation-safety-check' Jakub Kicinski says: ==================== ethtool: use the rss context XArray in ring deactivation safety-check Now that we have an XArray storing information about all extra RSS contexts - use it to extend checks already performed using ethtool_get_max_rxfh_channel(). ==================== Link: https://patch.msgid.link/20240710174043.754664-1-kuba@kernel.org Signed-off-by: Jakub Kicinski commit 24ac7e5440815bb03bdfa9bc7e43a412b050dbaa Author: Jakub Kicinski Date: Wed Jul 10 10:40:43 2024 -0700 ethtool: use the rss context XArray in ring deactivation safety-check ethtool_get_max_rxfh_channel() gets called when user requests deactivating Rx channels. Check the additional RSS contexts, too. While we do track whether RSS context has an indirection table explicitly set by the user, no driver looks at that bit. Assume drivers won't auto-regenerate the additional tables, to be safe. Reviewed-by: Jacob Keller Link: https://patch.msgid.link/20240710174043.754664-3-kuba@kernel.org Signed-off-by: Jakub Kicinski net/ethtool/common.c | 33 +++++++++++++++++++++++++++++---- 1 file changed, 29 insertions(+), 4 deletions(-) commit 2899d58462ba868287d6ff3acad3675e7adf934f Author: Jakub Kicinski Date: Wed Jul 10 10:40:42 2024 -0700 ethtool: fail closed if we can't get max channel used in indirection tables Commit 0d1b7d6c9274 ("bnxt: fix crashes when reducing ring count with active RSS contexts") proves that allowing indirection table to contain channels with out of bounds IDs may lead to crashes. Currently the max channel check in the core gets skipped if driver can't fetch the indirection table or when we can't allocate memory. Both of those conditions should be extremely rare but if they do happen we should try to be safe and fail the channel change. Reviewed-by: Jacob Keller Link: https://patch.msgid.link/20240710174043.754664-2-kuba@kernel.org Signed-off-by: Jakub Kicinski net/ethtool/channels.c | 6 ++---- net/ethtool/common.c | 26 +++++++++++++++----------- net/ethtool/common.h | 2 +- net/ethtool/ioctl.c | 4 +--- 4 files changed, 19 insertions(+), 19 deletions(-) commit f00059b4c1b068df108c70f86749b23f9080d2ba Author: Philipp Stanner Date: Thu Jun 13 13:50:26 2024 +0200 drm/vboxvideo: fix mapping leaks When the PCI devres API was introduced to this driver, it was wrongly assumed that initializing the device with pcim_enable_device() instead of pci_enable_device() will make all PCI functions managed. This is wrong and was caused by the quite confusing PCI devres API in which some, but not all, functions become managed that way. The function pci_iomap_range() is never managed. Replace pci_iomap_range() with the managed function pcim_iomap_range(). Fixes: 8558de401b5f ("drm/vboxvideo: use managed pci functions") Link: https://lore.kernel.org/r/20240613115032.29098-14-pstanner@redhat.com Signed-off-by: Philipp Stanner Signed-off-by: Krzysztof Wilczyński Signed-off-by: Bjorn Helgaas Reviewed-by: Hans de Goede drivers/gpu/drm/vboxvideo/vbox_main.c | 20 +++++++++----------- 1 file changed, 9 insertions(+), 11 deletions(-) commit ad78e05d654567e0a96f91d5db198469ddc2d4fb Author: Philipp Stanner Date: Thu Jun 13 13:50:25 2024 +0200 PCI: Add managed pcim_iomap_range() The only managed mapping function currently is pcim_iomap() which doesn't allow for mapping an area starting at a certain offset, which many drivers want. Add pcim_iomap_range() as an exported function. Link: https://lore.kernel.org/r/20240613115032.29098-13-pstanner@redhat.com Signed-off-by: Philipp Stanner Signed-off-by: Krzysztof Wilczyński Signed-off-by: Bjorn Helgaas drivers/pci/devres.c | 44 ++++++++++++++++++++++++++++++++++++++++++++ include/linux/pci.h | 2 ++ 2 files changed, 46 insertions(+) commit f748a07a0b6430b3ed638e5df7ae5007a28eaf11 Author: Philipp Stanner Date: Thu Jun 13 13:50:24 2024 +0200 PCI: Remove legacy pcim_release() Thanks to preceding cleanup steps, pcim_release() is now not needed anymore and can be replaced by pcim_disable_device(), which is the exact counterpart to pcim_enable_device(). This permits removing further parts of the old PCI devres implementation. Replace pcim_release() with pcim_disable_device(). Remove the now unused function get_pci_dr(). Remove the struct pci_devres from pci.h. Link: https://lore.kernel.org/r/20240613115032.29098-12-pstanner@redhat.com Signed-off-by: Philipp Stanner Signed-off-by: Krzysztof Wilczyński Signed-off-by: Bjorn Helgaas drivers/pci/devres.c | 53 +++++++++++++++++++++++++--------------------------- drivers/pci/pci.h | 16 ---------------- 2 files changed, 25 insertions(+), 44 deletions(-) commit 25216afc9db53d85dc648aba8fb7f6d31f2c8731 Author: Philipp Stanner Date: Thu Jun 13 13:50:23 2024 +0200 PCI: Add managed pcim_intx() pci_intx() is a "hybrid" function, i.e., it is managed if pcim_enable_device() has been called, but unmanaged otherwise. Add pcim_intx(), which is always managed, and implement pci_intx() using it. Remove the now-unused struct pci_devres.orig_intx and .restore_intx and find_pci_dr(). Link: https://lore.kernel.org/r/20240613115032.29098-11-pstanner@redhat.com Signed-off-by: Philipp Stanner [kwilczynski: squashed in https://lore.kernel.org/r/426645d40776198e0fcc942f4a6cac4433c7a9aa.camel@redhat.com to fix problem reported and tested by Ashish Kalra : https://lore.kernel.org/r/20240708214656.4721-1-Ashish.Kalra@amd.com https://lore.kernel.org/r/8c4634e9-4f02-4c54-9c89-d75e2f4bf026@amd.com/] Signed-off-by: Krzysztof Wilczyński [bhelgaas: commit log] Signed-off-by: Bjorn Helgaas drivers/pci/devres.c | 84 +++++++++++++++++++++++++++++++++++++++++++--------- drivers/pci/pci.c | 19 +++++------- drivers/pci/pci.h | 13 ++++---- 3 files changed, 85 insertions(+), 31 deletions(-) commit 0477d5168bbb8767275822830b47112519a8446d Author: Shay Drory Date: Sun Apr 14 11:26:07 2024 +0300 net/mlx5: Expose SFs IRQs Expose the sysfs files for the IRQs that the mlx5 PCI SFs are using. These entries are similar to PCI PFs and VFs in 'msi_irqs' directory. Reviewed-by: Parav Pandit Signed-off-by: Shay Drory Signed-off-by: Saeed Mahameed --- v8-v9: - add Przemek RB v6->v7: - remove not needed changes to mlx5 sfnum SF sysfs v5->v6: - fail IRQ creation in case auxiliary_device_sysfs_irq_add() failed (Parav and Przemek) v2->v3: - fix mlx5 sfnum SF sysfs drivers/net/ethernet/mellanox/mlx5/core/eq.c | 6 +++--- drivers/net/ethernet/mellanox/mlx5/core/irq_affinity.c | 18 +++++++++++++++++- drivers/net/ethernet/mellanox/mlx5/core/mlx5_core.h | 6 ++++++ drivers/net/ethernet/mellanox/mlx5/core/mlx5_irq.h | 12 ++++++++---- drivers/net/ethernet/mellanox/mlx5/core/pci_irq.c | 12 +++++++++--- 5 files changed, 43 insertions(+), 11 deletions(-) commit a808878308a8041ae10a151d69e2d22f94cae9f4 Author: Shay Drory Date: Sun Apr 14 11:05:25 2024 +0300 driver core: auxiliary bus: show auxiliary device IRQs PCI subfunctions (SF) are anchored on the auxiliary bus. PCI physical and virtual functions are anchored on the PCI bus. The irq information of each such function is visible to users via sysfs directory "msi_irqs" containing files for each irq entry. However, for PCI SFs such information is unavailable. Due to this users have no visibility on IRQs used by the SFs. Secondly, an SF can be multi function device supporting rdma, netdevice and more. Without irq information at the bus level, the user is unable to view or use the affinity of the SF IRQs. Hence to match to the equivalent PCI PFs and VFs, add "irqs" directory, for supporting auxiliary devices, containing file for each irq entry. For example: $ ls /sys/bus/auxiliary/devices/mlx5_core.sf.1/irqs/ 50 51 52 53 54 55 56 57 58 Cc: Simon Horman Reviewed-by: Przemek Kitszel Reviewed-by: Parav Pandit Reviewed-by: Greg Kroah-Hartman Signed-off-by: Shay Drory Signed-off-by: Saeed Mahameed --- v9-v10: - remove Przemek RB - add name field to auxiliary_irq_info (Greg and Przemek) - handle bogus IRQ in auxiliary_device_sysfs_irq_remove (Greg) v8-v9: - add Przemek RB - use guard() in auxiliary_irq_dir_prepare (Paolo) v7-v8: - use cleanup.h for info and name fields (Greg) - correct error flow in auxiliary_irq_dir_prepare (Przemek) - add documentation for new fields of auxiliary_device (Simon) v6-v7: - dynamically creating irqs directory when first irq file created (Greg) - removed irqs flag and simplified the dev_add() API (Greg) - move sysfs related new code to a new auxiliary_sysfs.c file (Greg) v5-v6: - removed concept of shared and exclusive and hence global xarray (Greg) v4-v5: - restore global mutex and replace refcount_t with simple integer (Greg) v3->4: - remove global mutex (Przemek) v2->v3: - fix function declaration in case SYSFS isn't defined v1->v2: - move #ifdefs from drivers/base/auxiliary.c to include/linux/auxiliary_bus.h (Greg) - use EXPORT_SYMBOL_GPL instead of EXPORT_SYMBOL (Greg) - Fix kzalloc(ref) to kzalloc(*ref) (Simon) - Add return description in auxiliary_device_sysfs_irq_add() kdoc (Simon) - Fix auxiliary_irq_mode_show doc (kernel test boot) Documentation/ABI/testing/sysfs-bus-auxiliary | 9 ++ drivers/base/Makefile | 1 + drivers/base/auxiliary.c | 1 + drivers/base/auxiliary_sysfs.c | 113 ++++++++++++++++++++++++++ include/linux/auxiliary_bus.h | 24 ++++++ 5 files changed, 148 insertions(+) commit 94e068cf9c4aedf381cfab1595d531d2ec381bb8 Merge: 256abd8e550c cb520c3f366c Author: Dave Airlie Date: Fri Jul 12 07:15:47 2024 +1000 Merge tag 'drm-misc-fixes-2024-07-11' of https://gitlab.freedesktop.org/drm/misc/kernel into drm-fixes drm-misc-fixes for v6.10: - EDID irq fix for bridge/adv7511. - gma500 null mode fixes. - Cleanup meson binding. Signed-off-by: Dave Airlie From: Maarten Lankhorst Link: https://patchwork.freedesktop.org/patch/msgid/8abff46f-eae6-4521-8434-7c6240f9091c@linux.intel.com commit b3470da314fd8018ee237e382000c4154a942420 Author: Alan Maguire Date: Thu Jul 11 19:23:21 2024 +0100 bpf: annotate BTF show functions with __printf -Werror=suggest-attribute=format warns about two functions in kernel/bpf/btf.c [1]; add __printf() annotations to silence these warnings since for CONFIG_WERROR=y they will trigger build failures. [1] https://lore.kernel.org/bpf/a8b20c72-6631-4404-9e1f-0410642d7d20@gmail.com/ Fixes: 31d0bc81637d ("bpf: Move to generic BTF show support, apply it to seq files/strings") Reported-by: Mirsad Todorovac Signed-off-by: Alan Maguire Tested-by: Mirsad Todorovac Link: https://lore.kernel.org/r/20240711182321.963667-1-alan.maguire@oracle.com Signed-off-by: Alexei Starovoitov kernel/bpf/btf.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) commit 7c8267275de6989a9b682a07d75e89395457ee01 Merge: a6a9fcb10836 51df8e0cbaef Author: Jakub Kicinski Date: Thu Jul 11 12:57:57 2024 -0700 Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net Cross-merge networking fixes after downstream PR. Conflicts: net/sched/act_ct.c 26488172b029 ("net/sched: Fix UAF when resolving a clash") 3abbd7ed8b76 ("act_ct: prepare for stolen verdict coming from conntrack and nat engine") No adjacent changes. Signed-off-by: Jakub Kicinski commit 4f3a6c4de7d932be94cde2c52ae58feeec9c9dbf Merge: 3346c5668577 080402007007 Author: Catalin Marinas Date: Thu Jul 11 19:10:02 2024 +0100 Merge branch 'for-next/vcpu-hotplug' into for-next/core * for-next/vcpu-hotplug: (21 commits) : arm64 support for virtual CPU hotplug (ACPI) irqchip/gic-v3: Fix 'broken_rdists' unused warning when !SMP and !ACPI arm64: Kconfig: Fix dependencies to enable ACPI_HOTPLUG_CPU cpumask: Add enabled cpumask for present CPUs that can be brought online arm64: document virtual CPU hotplug's expectations arm64: Kconfig: Enable hotplug CPU on arm64 if ACPI_PROCESSOR is enabled. arm64: arch_register_cpu() variant to check if an ACPI handle is now available. arm64: psci: Ignore DENIED CPUs irqchip/gic-v3: Add support for ACPI's disabled but 'online capable' CPUs irqchip/gic-v3: Don't return errors from gic_acpi_match_gicc() arm64: acpi: Harden get_cpu_for_acpi_id() against missing CPU entry arm64: acpi: Move get_cpu_for_acpi_id() to a header ACPI: Add post_eject to struct acpi_scan_handler for cpu hotplug ACPI: scan: switch to flags for acpi_scan_check_and_detach() ACPI: processor: Register deferred CPUs from acpi_processor_get_info() ACPI: processor: Add acpi_get_processor_handle() helper ACPI: processor: Move checks and availability of acpi_processor earlier ACPI: processor: Fix memory leaks in error paths of processor_add() ACPI: processor: Return an error if acpi_processor_get_info() fails in processor_add() ACPI: processor: Drop duplicated check on _STA (enabled + present) cpu: Do not warn on arch_register_cpu() returning -EPROBE_DEFER ... commit 3346c56685770e1865952a127f9e51edcc25b5a6 Merge: 42bebc7cca79 056600ff7330 916b93f4e865 6e3bc73be02b 26ca4423604f 75b3c43eab59 f5a4af3c7527 18fdb6348c48 5e30c16b58a4 Author: Catalin Marinas Date: Thu Jul 11 19:09:35 2024 +0100 Merge branches 'for-next/cpufeature', 'for-next/misc', 'for-next/kselftest', 'for-next/mte', 'for-next/errata', 'for-next/acpi', 'for-next/gic-v3-pmr' and 'for-next/doc', remote-tracking branch 'arm64/for-next/perf' into for-next/core * arm64/for-next/perf: perf: add missing MODULE_DESCRIPTION() macros perf: arm_pmuv3: Include asm/arm_pmuv3.h from linux/perf/arm_pmuv3.h perf: arm_v6/7_pmu: Drop non-DT probe support perf/arm: Move 32-bit PMU drivers to drivers/perf/ perf: arm_pmuv3: Drop unnecessary IS_ENABLED(CONFIG_ARM64) check perf: arm_pmuv3: Avoid assigning fixed cycle counter with threshold perf: imx_perf: add support for i.MX95 platform perf: imx_perf: fix counter start and config sequence perf: imx_perf: refactor driver for imx93 perf: imx_perf: let the driver manage the counter usage rather the user perf: imx_perf: add macro definitions for parsing config attr dt-bindings: perf: fsl-imx-ddr: Add i.MX95 compatible perf: pmuv3: Add new Cortex and Neoverse PMUs dt-bindings: arm: pmu: Add new Cortex and Neoverse cores perf/arm-cmn: Enable support for tertiary match group perf/arm-cmn: Decouple wp_config registers from filter group number * for-next/cpufeature: : Various cpufeature infrastructure patches arm64/cpufeature: Replace custom macros with fields from ID_AA64PFR0_EL1 KVM: arm64: Replace custom macros with fields from ID_AA64PFR0_EL1 arm64/cpufeatures/kvm: Add ARMv8.9 FEAT_ECBHB bits in ID_AA64MMFR1 register * for-next/misc: : Miscellaneous patches arm64: smp: Fix missing IPI statistics arm64: Cleanup __cpu_set_tcr_t0sz() arm64/mm: Stop using ESR_ELx_FSC_TYPE during fault arm64: Kconfig: fix typo in __builtin_return_adddress ARM64: reloc_test: add missing MODULE_DESCRIPTION() macro arm64: implement raw_smp_processor_id() using thread_info arm64/arch_timer: include * for-next/kselftest: : arm64 kselftest updates selftests: arm64: tags: remove the result script selftests: arm64: tags_test: conform test to TAP output kselftest/arm64: Fix a couple of spelling mistakes kselftest/arm64: Fix redundancy of a testcase kselftest/arm64: Include kernel mode NEON in fp-stress * for-next/mte: : MTE updates arm64: mte: Make mte_check_tfsr_*() conditional on KASAN instead of MTE * for-next/errata: : Arm CPU errata workarounds arm64: errata: Expand speculative SSBS workaround arm64: errata: Unify speculative SSBS errata logic arm64: cputype: Add Cortex-X925 definitions arm64: cputype: Add Cortex-A720 definitions arm64: cputype: Add Cortex-X3 definitions * for-next/acpi: : arm64 ACPI patches ACPI: Add acpi=nospcr to disable ACPI SPCR as default console on ARM64 ACPI / amba: Drop unnecessary check for registered amba_dummy_clk arm64: FFH: Move ACPI specific code into drivers/acpi/arm64/ arm64: cpuidle: Move ACPI specific code into drivers/acpi/arm64/ ACPI: arm64: Sort entries alphabetically * for-next/gic-v3-pmr: : arm64: irqchip/gic-v3: Use compiletime constant PMR values arm64: irqchip/gic-v3: Select priorities at boot time irqchip/gic-v3: Detect GICD_CTRL.DS and SCR_EL3.FIQ earlier irqchip/gic-v3: Make distributor priorities variables irqchip/gic-common: Remove sync_access callback wordpart.h: Add REPEAT_BYTE_U32() * for-next/doc: : arm64 documentation updates Documentation: arm64: Update memory.rst for TBI commit 6e3bc73be02ba604e5fd865008050a6dfc3d1232 Author: Muhammad Usama Anjum Date: Sun Jun 2 18:25:00 2024 +0500 selftests: arm64: tags: remove the result script The run_tags_test.sh script is used to run tags_test and print out if the test succeeded or failed. As tags_test has been TAP conformed, this script is unneeded and hence can be removed. Signed-off-by: Muhammad Usama Anjum Link: https://lore.kernel.org/r/20240602132502.4186771-2-usama.anjum@collabora.com Signed-off-by: Catalin Marinas tools/testing/selftests/arm64/tags/Makefile | 1 - tools/testing/selftests/arm64/tags/run_tags_test.sh | 12 ------------ 2 files changed, 13 deletions(-) commit 9de9c4cc03add590f99aa5fabbe8f5850e34837c Author: Muhammad Usama Anjum Date: Sun Jun 2 18:24:59 2024 +0500 selftests: arm64: tags_test: conform test to TAP output Conform the layout, informational and status messages to TAP. No functional change is intended other than the layout of output messages. Signed-off-by: Muhammad Usama Anjum Link: https://lore.kernel.org/r/20240602132502.4186771-1-usama.anjum@collabora.com Signed-off-by: Catalin Marinas tools/testing/selftests/arm64/tags/tags_test.c | 10 ++++++---- 1 file changed, 6 insertions(+), 4 deletions(-) commit 1712c9ee36d1f7b00e89bcd9743c18ba00a47f42 Author: Sasha Neftin Date: Thu Jun 13 08:17:49 2024 +0300 igc: Remove the internal 'eee_advert' field Since the kernel's 'ethtool_keee' structure is in use, the internal 'eee_advert' field becomes pointless and can be removed. This patch comes to clean up this redundant code. Signed-off-by: Sasha Neftin Tested-by: Mor Bar-Gabay (A Contingent Worker at Intel) Signed-off-by: Tony Nguyen drivers/net/ethernet/intel/igc/igc.h | 1 - drivers/net/ethernet/intel/igc/igc_ethtool.c | 6 ------ drivers/net/ethernet/intel/igc/igc_main.c | 3 --- 3 files changed, 10 deletions(-) commit aff6e32cc7ffb271b07b6390ef1580b7ec576a8f Author: Michal Swiatkowski Date: Mon Jun 24 10:05:10 2024 +0200 ice: remove eswitch rebuild Since the port representors are added one by one there is no need to do eswitch rebuild. Each port representor is detached and attached in VF reset path. Reviewed-by: Wojciech Drewek Signed-off-by: Michal Swiatkowski Reviewed-by: Simon Horman Tested-by: Sujai Buvaneswaran Signed-off-by: Tony Nguyen drivers/net/ethernet/intel/ice/ice_eswitch.c | 16 ---------------- drivers/net/ethernet/intel/ice/ice_eswitch.h | 6 ------ drivers/net/ethernet/intel/ice/ice_main.c | 2 -- 3 files changed, 24 deletions(-) commit a59618b98543248adae7e77d60f67974ca243319 Author: Pawel Kaminski Date: Fri Jun 7 12:43:49 2024 +0200 ice: Add support for devlink local_forwarding param Add support for driver-specific devlink local_forwarding param. Supported values are "enabled", "disabled" and "prioritized". Default configuration is set to "enabled". Add documentation in networking/devlink/ice.rst. In previous generations of Intel NICs the transmit scheduler was only limited by PCIe bandwidth when scheduling/assigning hairpin-bandwidth between VFs. Changes to E810 HW design introduced scheduler limitation, so that available hairpin-bandwidth is bound to external port speed. In order to address this limitation and enable NFV services such as "service chaining" a knob to adjust the scheduler config was created. Driver can send a configuration message to the FW over admin queue and internal FW logic will reconfigure HW to prioritize and add more BW to VF to VF traffic. An end result, for example, 10G port will no longer limit hairpin-bandwidth to 10G and much higher speeds can be achieved. Devlink local_forwarding param set to "prioritized" enables higher hairpin-bandwitdh on related PFs. Configuration is applicable only to 8x10G and 4x25G cards. Changing local_forwarding configuration will trigger CORER reset in order to take effect. Example command to change current value: devlink dev param set pci/0000:b2:00.3 name local_forwarding \ value prioritized \ cmode runtime Co-developed-by: Michal Wilczynski Signed-off-by: Michal Wilczynski Reviewed-by: Przemek Kitszel Signed-off-by: Pawel Kaminski Signed-off-by: Wojciech Drewek Tested-by: Rafal Romanowski Signed-off-by: Tony Nguyen Documentation/networking/devlink/ice.rst | 25 +++++ drivers/net/ethernet/intel/ice/devlink/devlink.c | 126 +++++++++++++++++++++++ drivers/net/ethernet/intel/ice/ice_adminq_cmd.h | 11 +- drivers/net/ethernet/intel/ice/ice_common.c | 4 + drivers/net/ethernet/intel/ice/ice_type.h | 1 + 5 files changed, 166 insertions(+), 1 deletion(-) commit bb408dae9e73803eab8a648115d6c4a1bca4dba3 Author: Pengfei Xu Date: Fri May 31 15:53:50 2024 +0800 selftests: ifs: verify IFS ARRAY BIST functionality There are two selftest scenarios for ARRAY BIST(Board Integrated System Test) tests: 1. Perform IFS ARRAY BIST tests once on each CPU. 2. Perform IFS ARRAY BIST tests on a random CPU with 3 rounds. These are not meant to be exhaustive, but are some minimal tests for for checking IFS ARRAY BIST. Reviewed-by: Jithu Joseph Reviewed-by: Kuppuswamy Sathyanarayanan Co-developed-by: Ashok Raj Signed-off-by: Ashok Raj Signed-off-by: Pengfei Xu Acked-by: Jithu Joseph Signed-off-by: Shuah Khan .../testing/selftests/drivers/platform/x86/intel/ifs/test_ifs.sh | 8 ++++++++ 1 file changed, 8 insertions(+) commit 3170f7acfba15895844dc2c0f2d2ff6fd77ad2e1 Author: Pengfei Xu Date: Fri May 31 15:53:49 2024 +0800 selftests: ifs: verify IFS scan test functionality Two selftests are added to verify IFS scan test feature: 1. Perform IFS scan test once on each CPU using all the available image files. 2. Perform IFS scan test with the default image on a random cpu for 3 rounds. Reviewed-by: Jithu Joseph Reviewed-by: Kuppuswamy Sathyanarayanan Co-developed-by: Ashok Raj Signed-off-by: Ashok Raj Signed-off-by: Pengfei Xu Acked-by: Jithu Joseph Signed-off-by: Shuah Khan .../drivers/platform/x86/intel/ifs/test_ifs.sh | 190 ++++++++++++++++++++- 1 file changed, 189 insertions(+), 1 deletion(-) commit 20cef3039dcd6930e1a08c948a360eac5c0fce88 Author: Pengfei Xu Date: Fri May 31 15:53:48 2024 +0800 selftests: ifs: verify test image loading functionality Scan test image files have to be loaded before starting IFS test. Verify that In Field scan driver is able to load valid test image files. Also check if loading an invalid test image file fails. Reviewed-by: Jithu Joseph Reviewed-by: Kuppuswamy Sathyanarayanan Co-developed-by: Ashok Raj Signed-off-by: Ashok Raj Signed-off-by: Pengfei Xu Acked-by: Jithu Joseph Signed-off-by: Shuah Khan .../drivers/platform/x86/intel/ifs/test_ifs.sh | 121 ++++++++++++++++++++- 1 file changed, 120 insertions(+), 1 deletion(-) commit 8e51106d02d32cd83807fa56c602020c2309ace0 Author: Pengfei Xu Date: Fri May 31 15:53:47 2024 +0800 selftests: ifs: verify test interfaces are created by the driver IFS (In Field Scan) driver exposes its functionality via sysfs interfaces. Applications prepare and exercise the tests by interacting with the aforementioned sysfs files. Verify that the necessary sysfs entries are created after loading the IFS driver. Initialize test variables needed for building subsequent kself-test cases. Reviewed-by: Jithu Joseph Reviewed-by: Kuppuswamy Sathyanarayanan Co-developed-by: Ashok Raj Signed-off-by: Ashok Raj Signed-off-by: Pengfei Xu Acked-by: Jithu Joseph Signed-off-by: Shuah Khan MAINTAINERS | 1 + tools/testing/selftests/Makefile | 1 + .../drivers/platform/x86/intel/ifs/Makefile | 6 + .../drivers/platform/x86/intel/ifs/test_ifs.sh | 179 +++++++++++++++++++++ 4 files changed, 187 insertions(+) commit df09b0bb09ea9775b66a5d24dc0fe0f86855efb5 Author: Zhu Jun Date: Tue Jul 9 23:57:59 2024 -0700 selftests/dma:remove unused variable The variable are never referenced in the code, just remove it that this problem was discovered by reading code Signed-off-by: Zhu Jun Signed-off-by: Shuah Khan tools/testing/selftests/dma/dma_map_benchmark.c | 1 - 1 file changed, 1 deletion(-) commit e23b1e6a2b9c88c2a69c43f5e525fafec6d6bba0 Author: Zhu Jun Date: Tue Jul 9 19:11:36 2024 -0700 selftests/breakpoints:Remove unused variable This variable is never referenced in the code, just remove them that this problem was discovered by reading the code Signed-off-by: Zhu Jun Signed-off-by: Shuah Khan tools/testing/selftests/breakpoints/step_after_suspend_test.c | 1 - 1 file changed, 1 deletion(-) commit b84111cda99845b2ff248bae37b34f57882d513c Author: John Hubbard Date: Thu Jul 4 00:24:31 2024 -0700 selftests/x86: fix printk warnings reported by clang These warnings are all of the form, "the format specified a short (signed or unsigned) int, but the value is a full length int". Acked-by: Muhammad Usama Anjum Signed-off-by: John Hubbard Signed-off-by: Shuah Khan tools/testing/selftests/x86/sigreturn.c | 2 +- tools/testing/selftests/x86/test_vsyscall.c | 10 +++++----- 2 files changed, 6 insertions(+), 6 deletions(-) commit 7d17b29b0e4b9a97426873f72e9cc6d35cfaf88f Author: John Hubbard Date: Thu Jul 4 00:24:30 2024 -0700 selftests/x86: remove (or use) unused variables and functions When building with clang, via: make LLVM=1 -C tools/testing/selftests ...quite a few functions are variables are generating "unused" warnings. Fix the warnings by deleting the unused items. One item, the "nerrs" variable in vsdo_restorer.c's main(), is unused but probably wants to be returned from main(), as a non-zero result. That result is also unused right now, so another option would be to delete it entirely, but this way, main() also gets fixed. It was missing a return value. Acked-by: Muhammad Usama Anjum Signed-off-by: John Hubbard Signed-off-by: Shuah Khan tools/testing/selftests/x86/amx.c | 16 ---------------- tools/testing/selftests/x86/fsgsbase.c | 6 ------ tools/testing/selftests/x86/syscall_arg_fault.c | 1 - tools/testing/selftests/x86/test_vsyscall.c | 5 ----- tools/testing/selftests/x86/vdso_restorer.c | 2 ++ 5 files changed, 2 insertions(+), 28 deletions(-) commit a89e589051d48f605c11662c35c56be65e1bca64 Author: John Hubbard Date: Thu Jul 4 00:24:29 2024 -0700 selftests/x86: avoid -no-pie warnings from clang during compilation When building with clang, via: make LLVM=1 -C tools/testing/selftests ...clang warns that -no-pie is "unused during compilation". This occurs because clang only wants to see -no-pie during linking. Here, we don't have a separate linking stage, so a compiler warning is unavoidable without (wastefully) restructuring the Makefile. Avoid the warning by simply disabling that warning, for clang builds. Acked-by: Muhammad Usama Anjum Signed-off-by: John Hubbard Signed-off-by: Shuah Khan tools/testing/selftests/x86/Makefile | 7 +++++++ 1 file changed, 7 insertions(+) commit 2ab9c93d6104e36110754d0778103f7f8719d969 Author: John Hubbard Date: Thu Jul 4 00:24:28 2024 -0700 selftests/x86: build sysret_rip.c with clang When building with clang, via: make LLVM=1 -C tools/testing/selftests ...the build fails because clang's inline asm doesn't support all of the features that are used in the asm() snippet in sysret_rip.c. Fix this by moving the asm code into the clang_helpers_64.S file, where it can be built with the assembler's full set of features. Acked-by: Muhammad Usama Anjum Signed-off-by: John Hubbard Signed-off-by: Shuah Khan tools/testing/selftests/x86/Makefile | 1 + tools/testing/selftests/x86/clang_helpers_64.S | 16 ++++++++++++++++ tools/testing/selftests/x86/sysret_rip.c | 20 ++++++-------------- 3 files changed, 23 insertions(+), 14 deletions(-) commit 1158655317b6b6e71980533939dce9ab91d9716b Author: John Hubbard Date: Thu Jul 4 00:24:27 2024 -0700 selftests/x86: build fsgsbase_restore.c with clang When building with clang, via: make LLVM=1 -C tools/testing/selftests Fix this by moving the inline asm to "pure" assembly, in two new files: clang_helpers_32.S, clang_helpers_64.S. As a bonus, the pure asm avoids the need for ifdefs, and is now very simple and easy on the eyes. Acked-by: Muhammad Usama Anjum Signed-off-by: John Hubbard Signed-off-by: Shuah Khan tools/testing/selftests/x86/Makefile | 2 ++ tools/testing/selftests/x86/clang_helpers_32.S | 11 +++++++++++ tools/testing/selftests/x86/clang_helpers_64.S | 12 ++++++++++++ tools/testing/selftests/x86/fsgsbase_restore.c | 11 +++++------ 4 files changed, 30 insertions(+), 6 deletions(-) commit bf967fb39e020f4426d13e634d21283758aea3c8 Author: Muhammad Usama Anjum Date: Thu Jul 4 00:24:26 2024 -0700 selftests: x86: test_FISTTP: use fisttps instead of ambiguous fisttp Use fisttps instead of fisttp to specify correctly that the output variable is of size short. test_FISTTP.c:28:3: error: ambiguous instructions require an explicit suffix (could be 'fisttps', or 'fisttpl') 28 | " fisttp res16""\n" | ^ :3:2: note: instantiated into assembly here 3 | fisttp res16 | ^ ...followed by three more cases of the same warning for other lines. [jh: removed a bit of duplication from the warnings report, above, and fixed a typo in the title] Signed-off-by: Muhammad Usama Anjum Signed-off-by: John Hubbard Signed-off-by: Shuah Khan tools/testing/selftests/x86/test_FISTTP.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) commit 825658b790330ed474547d2b1f87436879ca7da6 Author: John Hubbard Date: Thu Jul 4 00:24:25 2024 -0700 selftests/x86: fix Makefile dependencies to work with clang When building with clang, via: make LLVM=1 -C tools/testing/selftests ...the following build failure occurs in selftests/x86: clang: error: cannot specify -o when generating multiple output files This happens because, although gcc doesn't complain if you invoke it like this: gcc file1.c header2.h ...clang won't accept that form--it rejects the .h file(s). Also, the above approach is inaccurate anyway, because file.c includes header2.h in this case, and the inclusion of header2.h on the invocation is an artifact of the Makefile's desire to maintain dependencies. In Makefiles of this type, a better way to do it is to use Makefile dependencies to trigger the appropriate incremental rebuilds, and separately use file lists (see EXTRA_FILES in this commit) to track what to pass to the compiler. This commit splits those concepts up, by setting up both EXTRA_FILES and the Makefile dependencies with a single call to the new Makefile function extra-files. That fixes the build failure, while still providing the correct dependencies in all cases. Acked-by: Muhammad Usama Anjum Signed-off-by: John Hubbard Signed-off-by: Shuah Khan tools/testing/selftests/x86/Makefile | 21 +++++++++++++++------ 1 file changed, 15 insertions(+), 6 deletions(-) commit 4eddfafc902b28119c24189c5ba9469bd1607878 Author: John Hubbard Date: Wed Jul 3 19:42:02 2024 -0700 selftests/timers: remove unused irqcount variable When building with clang, via: make LLVM=1 -C tools/testing/selftest ...clang warns about an unused irqcount variable. clang is correct: the variable is incremented and then ignored. Fix this by deleting the irqcount variable. Signed-off-by: John Hubbard Acked-by: John Stultz Reviewed-by: Muhammad Usama Anjum Signed-off-by: Shuah Khan tools/testing/selftests/timers/rtcpie.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) commit b00db6fd2a301c5057d63c19d596818845c9a603 Author: Muhammad Usama Anjum Date: Wed Jun 12 12:27:23 2024 +0500 selftests: Add information about TAP conformance in tests Although "TAP" word is being used already in documentation, but it hasn't been defined in informative way for developers that how to write TAP conformant tests and what are the benefits. Write a short brief about it. Signed-off-by: Muhammad Usama Anjum Signed-off-by: Shuah Khan Documentation/dev-tools/kselftest.rst | 7 +++++++ 1 file changed, 7 insertions(+) commit 0d66ddb296cc46d7b72d67cfaef0de03da092fcd Author: Ilpo Järvinen Date: Mon Jun 10 18:14:57 2024 +0300 selftests/resctrl: Remove test name comparing from write_bm_pid_to_resctrl() write_bm_pid_to_resctrl() uses resctrl_val to check test name which is not a good interface generic resctrl FS functions should provide. Tests define mongrp when needed. Remove the test name check in write_bm_pid_to_resctrl() to only rely on the mongrp parameter being non-NULL. Remove write_bm_pid_to_resctrl() resctrl_val parameter and resctrl_val member from the struct resctrl_val_param that are not used anymore. Similarly, remove the test name constants that are no longer used. Signed-off-by: Ilpo Järvinen Tested-by: Babu Moger Reviewed-by: Reinette Chatre Signed-off-by: Shuah Khan tools/testing/selftests/resctrl/cat_test.c | 5 +--- tools/testing/selftests/resctrl/cmt_test.c | 1 - tools/testing/selftests/resctrl/mba_test.c | 1 - tools/testing/selftests/resctrl/mbm_test.c | 1 - tools/testing/selftests/resctrl/resctrl.h | 10 +------- tools/testing/selftests/resctrl/resctrl_val.c | 4 +--- tools/testing/selftests/resctrl/resctrlfs.c | 33 ++++++++++++--------------- 7 files changed, 17 insertions(+), 38 deletions(-) commit f58e66bed1b4563c8afd35d43dbd4fd361705789 Author: Ilpo Järvinen Date: Mon Jun 10 18:14:56 2024 +0300 selftests/resctrl: Remove mongrp from CMT test The CMT selftest instantiates a monitor group to read LLC occupancy. Since the test also creates a control group, it is unnecessary to create another one for monitoring because control groups already provide monitoring too. Remove the unnecessary monitor group from the CMT selftest. Suggested-by: Reinette Chatre Signed-off-by: Ilpo Järvinen Tested-by: Babu Moger Reviewed-by: Reinette Chatre Signed-off-by: Shuah Khan tools/testing/selftests/resctrl/cmt_test.c | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-) commit 64b0795192a8f7fa6baaeda2631a4134aa2c7e12 Author: Ilpo Järvinen Date: Mon Jun 10 18:14:55 2024 +0300 selftests/resctrl: Remove mongrp from MBA test Nothing during MBA test uses mongrp even if it has been defined ever since the introduction of the MBA test in the commit 01fee6b4d1f9 ("selftests/resctrl: Add MBA test"). Remove the mongrp from MBA test. Signed-off-by: Ilpo Järvinen Tested-by: Babu Moger Reviewed-by: Reinette Chatre Signed-off-by: Shuah Khan tools/testing/selftests/resctrl/mba_test.c | 1 - 1 file changed, 1 deletion(-) commit d14d94da0e3f1d7e598f88204cf37ee41a06f900 Author: Ilpo Järvinen Date: Mon Jun 10 18:14:54 2024 +0300 selftests/resctrl: Convert ctrlgrp & mongrp to pointers The struct resctrl_val_param has control and monitor groups as char arrays but they are not supposed to be mutated within resctrl_val(). Convert the ctrlgrp and mongrp char array within resctrl_val_param to plain const char pointers and adjust the strlen() based checks to check NULL instead. Signed-off-by: Ilpo Järvinen Tested-by: Babu Moger Reviewed-by: Reinette Chatre Signed-off-by: Shuah Khan tools/testing/selftests/resctrl/resctrl.h | 4 ++-- tools/testing/selftests/resctrl/resctrlfs.c | 16 +++++++--------- 2 files changed, 9 insertions(+), 11 deletions(-) commit 909592b5dafa3680994b1d5144b6d5781eb49ab8 Author: Ilpo Järvinen Date: Mon Jun 10 18:14:53 2024 +0300 selftests/resctrl: Make some strings passed to resctrlfs functions const Control group, monitor group and resctrl_val are not mutated and should not be mutated within resctrlfs.c functions. Mark this by using const char * for the arguments. Signed-off-by: Ilpo Järvinen Tested-by: Babu Moger Reviewed-by: Reinette Chatre Signed-off-by: Shuah Khan tools/testing/selftests/resctrl/resctrl.h | 7 ++++--- tools/testing/selftests/resctrl/resctrlfs.c | 7 ++++--- 2 files changed, 8 insertions(+), 6 deletions(-) commit fa1116d06ebc4673c4e8ca23d8e7ef73db544480 Author: Ilpo Järvinen Date: Mon Jun 10 18:14:52 2024 +0300 selftests/resctrl: Simplify bandwidth report type handling bw_report is only needed for selecting the correct value from the values IMC measured. It is a member in the resctrl_val_param struct and is always set to "reads". The value is then checked in resctrl_val() using validate_bw_report_request() that besides validating the input, assumes it can mutate the string which is questionable programming practice. Simplify handling bw_report: - Convert validate_bw_report_request() into get_bw_report_type() that inputs and returns const char *. Use NULL to indicate error. - Validate the report types inside measure_mem_bw(), not in resctrl_val(). - Pass bw_report to measure_mem_bw() from ->measure() hook because resctrl_val() no longer needs bw_report for anything. Signed-off-by: Ilpo Järvinen Tested-by: Babu Moger Reviewed-by: Reinette Chatre Signed-off-by: Shuah Khan tools/testing/selftests/resctrl/mba_test.c | 3 +-- tools/testing/selftests/resctrl/mbm_test.c | 3 +-- tools/testing/selftests/resctrl/resctrl.h | 7 +++---- tools/testing/selftests/resctrl/resctrl_val.c | 19 +++++++++---------- tools/testing/selftests/resctrl/resctrlfs.c | 13 ++++++------- 5 files changed, 20 insertions(+), 25 deletions(-) commit aef5efa64426396cac5b0126cbb6071e92d5da24 Author: Ilpo Järvinen Date: Mon Jun 10 18:14:51 2024 +0300 selftests/resctrl: Add ->init() callback into resctrl_val_param The struct resctrl_val_param is there to customize behavior inside resctrl_val() which is currently not used to full extent and there are number of strcmp()s for test name in resctrl_val done by resctrl_val(). Create ->init() hook into the struct resctrl_val_param to cleanly do per test initialization. Remove also unused branches to setup paths and the related #defines for CMT test. While touching kerneldoc, make the adjacent line consistent with the newly added form (callback vs call back). Signed-off-by: Ilpo Järvinen Tested-by: Babu Moger Reviewed-by: Reinette Chatre Signed-off-by: Shuah Khan tools/testing/selftests/resctrl/cmt_test.c | 12 +++++ tools/testing/selftests/resctrl/mba_test.c | 14 +++++ tools/testing/selftests/resctrl/mbm_test.c | 14 +++++ tools/testing/selftests/resctrl/resctrl.h | 8 ++- tools/testing/selftests/resctrl/resctrl_val.c | 75 +++++---------------------- 5 files changed, 60 insertions(+), 63 deletions(-) commit 0e251816995a1972062fc7ad32047c1aee9cd704 Author: Ilpo Järvinen Date: Mon Jun 10 18:14:50 2024 +0300 selftests/resctrl: Add ->measure() callback to resctrl_val_param The measurement done in resctrl_val() varies depending on test type. The decision for how to measure is decided based on the string compare to test name which is quite inflexible. Add ->measure() callback into the struct resctrl_val_param to allow each test to provide necessary code as a function which simplifies what resctrl_val() has to do. Signed-off-by: Ilpo Järvinen Tested-by: Babu Moger Reviewed-by: Reinette Chatre Signed-off-by: Shuah Khan tools/testing/selftests/resctrl/cmt_test.c | 8 ++++++++ tools/testing/selftests/resctrl/mba_test.c | 9 ++++++++- tools/testing/selftests/resctrl/mbm_test.c | 9 ++++++++- tools/testing/selftests/resctrl/resctrl.h | 6 ++++++ tools/testing/selftests/resctrl/resctrl_val.c | 18 +++++------------- 5 files changed, 35 insertions(+), 15 deletions(-) commit 711d27b05a97cd5c8e62c858c2c940d79f8445e1 Author: Ilpo Järvinen Date: Mon Jun 10 18:14:49 2024 +0300 selftests/resctrl: Simplify mem bandwidth file code for MBA & MBM tests initialize_mem_bw_resctrl() and set_mbm_path() contain complicated set of conditions, each yielding different file to be opened to measure memory bandwidth through resctrl FS. In practice, only two of them are used. For MBA test, ctrlgrp is always provided, and for MBM test both ctrlgrp and mongrp are set. The file used differ between MBA/MBM test, however, MBM test unnecessarily create monitor group because resctrl FS already provides monitoring interface underneath any ctrlgrp too, which is what the MBA selftest uses. Consolidate memory bandwidth file used to the one used by the MBA selftest. Remove all unused branches opening other files to simplify the code. Suggested-by: Reinette Chatre Signed-off-by: Ilpo Järvinen Tested-by: Babu Moger Reviewed-by: Reinette Chatre Signed-off-by: Shuah Khan tools/testing/selftests/resctrl/mbm_test.c | 1 - tools/testing/selftests/resctrl/resctrl_val.c | 45 +++------------------------ 2 files changed, 4 insertions(+), 42 deletions(-) commit bc074b6321d73295dcfe8c450c8f5245c530bb4e Author: Ilpo Järvinen Date: Mon Jun 10 18:14:48 2024 +0300 selftests/resctrl: Rename measure_vals() to measure_mem_bw_vals() & document measure_vals() is awfully generic name so rename it to measure_mem_bw() to describe better what it does and document the function parameters. Signed-off-by: Ilpo Järvinen Tested-by: Babu Moger Reviewed-by: Reinette Chatre Signed-off-by: Shuah Khan tools/testing/selftests/resctrl/resctrl_val.c | 11 ++++++++--- 1 file changed, 8 insertions(+), 3 deletions(-) commit b0bd742a1379dff238efcf67c2cb0c518ee0b691 Author: Ilpo Järvinen Date: Mon Jun 10 18:14:47 2024 +0300 selftests/resctrl: Cleanup bm_pid and ppid usage & limit scope 'bm_pid' and 'ppid' are global variables. As they are used by different processes and in signal handler, they cannot be entirely converted into local variables. The scope of those variables can still be reduced into resctrl_val.c only. As PARENT_EXIT() macro is using 'ppid', make it a function in resctrl_val.c and pass ppid to it as an argument because it is easier to understand than using the global variable directly. Pass 'bm_pid' into measure_vals() instead of relying on the global variable which helps to make the call signatures of measure_vals() and measure_llc_resctrl() more similar to each other. Signed-off-by: Ilpo Järvinen Tested-by: Babu Moger Reviewed-by: Reinette Chatre Signed-off-by: Shuah Khan tools/testing/selftests/resctrl/resctrl.h | 9 --------- tools/testing/selftests/resctrl/resctrl_val.c | 23 +++++++++++++++-------- 2 files changed, 15 insertions(+), 17 deletions(-) commit 8245a70edad18e5eba479c5ea91beb590590b237 Author: Ilpo Järvinen Date: Mon Jun 10 18:14:46 2024 +0300 selftests/resctrl: Use correct type for pids A few functions receive PIDs through int arguments. PIDs variables should be of type pid_t, not int. Convert pid arguments from int to pid_t. Before printing PID, match the type to %d by casting to int which is enough for Linux (standard would allow using a longer integer type but generalizing for that would complicate the code unnecessarily, the selftest code does not need to be portable). Signed-off-by: Ilpo Järvinen Tested-by: Babu Moger Reviewed-by: Reinette Chatre Signed-off-by: Shuah Khan tools/testing/selftests/resctrl/cache.c | 10 +++++----- tools/testing/selftests/resctrl/resctrl.h | 4 ++-- tools/testing/selftests/resctrl/resctrl_val.c | 8 ++++---- tools/testing/selftests/resctrl/resctrlfs.c | 2 +- 4 files changed, 12 insertions(+), 12 deletions(-) commit 9224db5180f244f169fb81a3c88c48bf612ba238 Author: Ilpo Järvinen Date: Mon Jun 10 18:14:45 2024 +0300 selftests/resctrl: Consolidate get_domain_id() into resctrl_val() Both initialize_mem_bw_resctrl() and initialize_llc_occu_resctrl() that are called from resctrl_val() need to determine domain ID to construct resctrl fs related paths. Both functions do it by taking CPU ID which neither needs for any other purpose than determining the domain ID. Consolidate determining the domain ID into resctrl_val() and pass the domain ID instead of CPU ID to initialize_mem_bw_resctrl() and initialize_llc_occu_resctrl(). Signed-off-by: Ilpo Järvinen Tested-by: Babu Moger Reviewed-by: Reinette Chatre Signed-off-by: Shuah Khan tools/testing/selftests/resctrl/resctrl_val.c | 33 +++++++++++---------------- 1 file changed, 13 insertions(+), 20 deletions(-) commit 2704b2d117c52cd156bcdcad1eefd9c2dad1794d Author: Ilpo Järvinen Date: Mon Jun 10 18:14:44 2024 +0300 selftests/resctrl: Make "bandwidth" consistent in comments & prints Resctrl selftests refer to "bandwidth" currently in two other forms in the code ("B/W" and "band width"). Use "bandwidth" consistently everywhere. While at it, fix also one "over flow" -> "overflow" on a line that is touched by the change. Suggested-by: Reinette Chatre Signed-off-by: Ilpo Järvinen Tested-by: Babu Moger Reviewed-by: Reinette Chatre Signed-off-by: Shuah Khan tools/testing/selftests/resctrl/resctrl_val.c | 14 +++++++------- tools/testing/selftests/resctrl/resctrlfs.c | 2 +- 2 files changed, 8 insertions(+), 8 deletions(-) commit da50de0a92f31605423e39e6ccf3ce7508e88a7a Author: Ilpo Järvinen Date: Mon Jun 10 18:14:43 2024 +0300 selftests/resctrl: Calculate resctrl FS derived mem bw over sleep(1) only For MBM/MBA tests, measure_vals() calls get_mem_bw_imc() that performs the measurement over a duration of sleep(1) call. The memory bandwidth numbers from IMC are derived over this duration. The resctrl FS derived memory bandwidth, however, is calculated inside measure_vals() and only takes delta between the previous value and the current one which besides the actual test, also samples inter-test noise. Rework the logic in measure_vals() and get_mem_bw_imc() such that the resctrl FS memory bandwidth section covers much shorter duration closely matching that of the IMC perf counters to improve measurement accuracy. For the second read after rewind() to return a fresh value, also newline has to be consumed by the fscanf(). Suggested-by: Reinette Chatre Signed-off-by: Ilpo Järvinen Tested-by: Babu Moger Reviewed-by: Reinette Chatre Signed-off-by: Shuah Khan tools/testing/selftests/resctrl/resctrl_val.c | 141 +++++++++++++++++--------- 1 file changed, 91 insertions(+), 50 deletions(-) commit c44000b6535dc9806b9128d1aed403862b2adab9 Author: Ilpo Järvinen Date: Mon Jun 10 18:14:42 2024 +0300 selftests/resctrl: Fix closing IMC fds on error and open-code R+W instead of loops The imc perf fd close() calls are missing from all error paths. In addition, get_mem_bw_imc() handles fds in a for loop but close() is based on two fixed indexes READ and WRITE. Open code inner for loops to READ+WRITE entries for clarity and add a function to close() IMC fds properly in all cases. Fixes: 7f4d257e3a2a ("selftests/resctrl: Add callback to start a benchmark") Suggested-by: Reinette Chatre Signed-off-by: Ilpo Järvinen Tested-by: Babu Moger Reviewed-by: Reinette Chatre Signed-off-by: Shuah Khan tools/testing/selftests/resctrl/resctrl_val.c | 54 ++++++++++++++++++--------- 1 file changed, 36 insertions(+), 18 deletions(-) commit b47619a3a3f79f75edf774275798aad1a37609ad Author: aigourensheng Date: Tue Jun 11 01:18:34 2024 -0400 selftests/sched: fix code format issues There are extra spaces in the middle of #define. It is recommended to delete the spaces to make the code look more comfortable. Signed-off-by: aigourensheng Signed-off-by: Shuah Khan tools/testing/selftests/sched/cs_prctl_test.c | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) commit a84a0c6a6d40b73f01033249ebe45c9484558539 Author: John Hubbard Date: Fri May 31 11:37:51 2024 -0700 selftests/lib.mk: silence some clang warnings that gcc already ignores gcc defaults to silence (off) for the following warnings, but clang defaults to the opposite. The warnings are not useful for the kernel itself, which is why they have remained disabled in gcc for the main kernel build. And it is only due to including kernel data structures in the selftests, that we get the warnings from clang. -Waddress-of-packed-member -Wgnu-variable-sized-type-not-at-end In other words, the warnings are not unique to the selftests: there is nothing that the selftests' code does that triggers these warnings, other than the act of including the kernel's data structures. Therefore, silence them for the clang builds as well. This eliminates warnings for the net/ and user_events/ kselftest subsystems, in these files: ./net/af_unix/scm_rights.c ./net/timestamping.c ./net/ipsec.c ./user_events/perf_test.c Cc: Nathan Chancellor Signed-off-by: John Hubbard Acked-by: Nathan Chancellor Signed-off-by: Shuah Khan tools/testing/selftests/lib.mk | 8 ++++++++ 1 file changed, 8 insertions(+) commit 7b1fdf2ba4bc1434bb4c0077d7c9079a5a45df27 Author: Suren Baghdasaryan Date: Thu Jul 11 10:02:16 2024 -0700 mm, slab: move prepare_slab_obj_exts_hook under CONFIG_MEM_ALLOC_PROFILING The only place prepare_slab_obj_exts_hook() is currently being used is from alloc_tagging_slab_alloc_hook() when CONFIG_MEM_ALLOC_PROFILING=y. Move its definition under CONFIG_MEM_ALLOC_PROFILING to prevent unused function warning for CONFIG_SLAB_OBJ_EXT=n case. Reported-by: kernel test robot Closes: https://lore.kernel.org/oe-kbuild-all/202407050845.zNONqauD-lkp@intel.com/ Signed-off-by: Suren Baghdasaryan Cc: Vlastimil Babka Reviewed-by: Xiongwei Song Signed-off-by: Vlastimil Babka mm/slub.c | 48 +++++++++++++++++++++--------------------------- 1 file changed, 21 insertions(+), 27 deletions(-) commit 4c8c36fe4e3b3f7d321f885b76afdf858962335b Author: Simon Horman Date: Fri Jul 5 14:15:40 2024 +0100 i40e: correct i40e_addr_to_hkey() name in kdoc Correct name of i40e_addr_to_hkey() in it's kdoc. kernel-doc -none reports: drivers/net/ethernet/intel/i40e/i40e.h:739: warning: expecting prototype for i40e_mac_to_hkey(). Prototype was for i40e_addr_to_hkey() instead Signed-off-by: Simon Horman Reviewed-by: Przemek Kitszel Signed-off-by: Tony Nguyen drivers/net/ethernet/intel/i40e/i40e.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit bf130ed3aaa37bbd9c7f4b305c42e02128187cd4 Author: Tony Nguyen Date: Tue Jul 2 14:38:46 2024 -0700 net: intel: Remove MODULE_AUTHORs We are moving away from the Sourceforge email address. Rather than removing or updating the email for the affected entries, remove the MODULE_AUTHOR altogether as its usage is incorrect [1]. Link: https://lore.kernel.org/netdev/20200626115236.7f36d379@kicinski-fedora-pc1c0hjn.dhcp.thefacebook.com/ [1] Reviewed-by: Jesse Brandeburg Acked-by: Alexander Lobakin # libeth, libie Reviewed-by: Simon Horman Signed-off-by: Tony Nguyen drivers/net/ethernet/intel/e100.c | 1 - drivers/net/ethernet/intel/e1000/e1000_main.c | 1 - drivers/net/ethernet/intel/e1000e/netdev.c | 1 - drivers/net/ethernet/intel/fm10k/fm10k_main.c | 1 - drivers/net/ethernet/intel/i40e/i40e_main.c | 1 - drivers/net/ethernet/intel/iavf/iavf_main.c | 1 - drivers/net/ethernet/intel/ice/ice_main.c | 1 - drivers/net/ethernet/intel/igb/igb_main.c | 1 - drivers/net/ethernet/intel/igbvf/netdev.c | 1 - drivers/net/ethernet/intel/igc/igc_main.c | 1 - drivers/net/ethernet/intel/ixgbe/ixgbe_main.c | 1 - drivers/net/ethernet/intel/ixgbevf/ixgbevf_main.c | 1 - drivers/net/ethernet/intel/libeth/rx.c | 1 - drivers/net/ethernet/intel/libie/rx.c | 1 - 14 files changed, 14 deletions(-) commit a6a9fcb10836105e525ccb8bc1a6af4b20a113be Author: Colin Ian King Date: Tue Jul 9 11:52:22 2024 +0100 net: pse-pd: pd692x0: Fix spelling mistake "availables" -> "available" There is a spelling mistake in a dev_err message. Fix it. Signed-off-by: Colin Ian King Acked-by: Kory Maincent Link: https://patch.msgid.link/20240709105222.168306-1-colin.i.king@gmail.com Signed-off-by: Jakub Kicinski drivers/net/pse-pd/pd692x0.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 8c98dddc233c233a35e56b49d5cd9e032d442300 Author: Philipp Zabel Date: Wed Jul 10 12:28:32 2024 +0200 Input: exc3000 - add EXC81W32 support Add support for EXC81W32 controllers. Tested with firmware reported as type "PCAP81X32 Series", model "Orion_0183_1019", fw_version "8001280G". Signed-off-by: Philipp Zabel Link: https://lore.kernel.org/r/20240710-input-exc3000-exc81w32-v3-2-4272183628b4@pengutronix.de Signed-off-by: Dmitry Torokhov drivers/input/touchscreen/exc3000.c | 7 +++++++ 1 file changed, 7 insertions(+) commit 87d9d1e3eb5daa45764ea5a5f387ab8b337fcf88 Author: Philipp Zabel Date: Wed Jul 10 12:28:31 2024 +0200 dt-bindings: input: touchscreen: exc3000: add EXC81W32 Add compatible for EXC81W32 touchscreen controllers. They use the same protocol and have the same resolution as EXC80H84. Signed-off-by: Philipp Zabel Acked-by: Conor Dooley Link: https://lore.kernel.org/r/20240710-input-exc3000-exc81w32-v3-1-4272183628b4@pengutronix.de Signed-off-by: Dmitry Torokhov .../devicetree/bindings/input/touchscreen/eeti,exc3000.yaml | 12 ++++++++---- 1 file changed, 8 insertions(+), 4 deletions(-) commit f48ecbd2ce1ca2b0c92843f67879b583b1f85cda Author: Dmitry Torokhov Date: Tue Jul 9 17:04:35 2024 -0700 Input: twl4030-pwrbutton - fix kernel-doc warning Do not use kernel-doc style for comment describing contents of the source file, as it trips the script: scripts/kernel-doc -none drivers/input/misc/twl4030-pwrbutton.c drivers/input/misc/twl4030-pwrbutton.c:2: info: Scanning doc for function twl4030 drivers/input/misc/twl4030-pwrbutton.c:33: warning: expecting prototype for twl4030(). Prototype was for PWR_PWRON_IRQ() instead 1 warnings Also remove file name from the same comment - it it not the best idea to have it as they tend to get stale when sources get moved or renamed. Reported-by: Mirsad Todorovac Tested-by: Mirsad Todorovac Link: https://lore.kernel.org/r/Zo3QE00GqCrA3M9b@google.com Signed-off-by: Dmitry Torokhov drivers/input/misc/twl4030-pwrbutton.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) commit e10989e56f5231934103d5a4c7c8926c783924ca Author: Marcin Szycik Date: Thu Jun 27 16:55:47 2024 +0200 ice: Add tracepoint for adding and removing switch rules Track the number of rules and recipes added to switch. Add a tracepoint to ice_aq_sw_rules(), which shows both rule and recipe count. This information can be helpful when designing a set of rules to program to the hardware, as it shows where the practical limit is. Actual limits are known (64 recipes, 32k rules), but it's hard to translate these values to how many rules the *user* can actually create, because of extra metadata being implicitly added, and recipe/rule chaining. Chaining combines several recipes/rules to create a larger recipe/rule, so one large rule added by the user might actually consume multiple rules from hardware perspective. Rule counter is simply incremented/decremented in ice_aq_sw_rules(), since all rules are added or removed via it. Counting recipes is harder, as recipes can't be removed (only overwritten). Recipes added via ice_aq_add_recipe() could end up being unused, when there is an error in later stages of rule creation. Instead, track the allocation and freeing of recipes, which should reflect the actual usage of recipes (if something fails after recipe(s) were created, caller should free them). Also, a number of recipes are loaded from NVM by default - initialize the recipe counter with the number of these recipes on switch initialization. Example configuration: cd /sys/kernel/tracing echo function > current_tracer echo ice_aq_sw_rules > set_ftrace_filter echo ice_aq_sw_rules > set_event echo 1 > tracing_on cat trace Example output: tc-4097 [069] ...1. 787.595536: ice_aq_sw_rules <-ice_rem_adv_rule tc-4097 [069] ..... 787.595705: ice_aq_sw_rules: rules=9 recipes=15 tc-4098 [057] ...1. 787.652033: ice_aq_sw_rules <-ice_add_adv_rule tc-4098 [057] ..... 787.652201: ice_aq_sw_rules: rules=10 recipes=16 Reviewed-by: Michal Swiatkowski Reviewed-by: Przemek Kitszel Signed-off-by: Marcin Szycik Reviewed-by: Simon Horman Tested-by: Sujai Buvaneswaran Signed-off-by: Tony Nguyen drivers/net/ethernet/intel/ice/ice_common.c | 3 +++ drivers/net/ethernet/intel/ice/ice_switch.c | 22 ++++++++++++++++++++-- drivers/net/ethernet/intel/ice/ice_trace.h | 18 ++++++++++++++++++ drivers/net/ethernet/intel/ice/ice_type.h | 2 ++ 4 files changed, 43 insertions(+), 2 deletions(-) commit 1d2ac128531e381dab5bb7fd21f95cf2d075bff5 Author: Marcin Szycik Date: Thu Jun 27 16:55:46 2024 +0200 ice: Remove unused members from switch API Remove several members of struct ice_sw_recipe and struct ice_prot_lkup_ext. Remove struct ice_recp_grp_entry and struct ice_pref_recipe_group, since they are now unused as well. All of the deleted members were only written to and never read, so it's pointless to keep them. Reviewed-by: Przemek Kitszel Signed-off-by: Marcin Szycik Tested-by: Sujai Buvaneswaran Signed-off-by: Tony Nguyen drivers/net/ethernet/intel/ice/ice_common.c | 7 --- drivers/net/ethernet/intel/ice/ice_protocol_type.h | 17 -------- drivers/net/ethernet/intel/ice/ice_switch.c | 51 +++++----------------- drivers/net/ethernet/intel/ice/ice_switch.h | 16 ------- 4 files changed, 10 insertions(+), 81 deletions(-) commit 2ecdd4ba47fc499ff610d49cb42df7ef27d0292e Author: Marcin Szycik Date: Thu Jun 27 16:55:45 2024 +0200 ice: Optimize switch recipe creation Currently when creating switch recipes, switch ID is always added as the first word in every recipe. There are only 5 words in a recipe, so one word is always wasted. This is also true for the last recipe, which stores result indexes (in case of chain recipes). Therefore the maximum usable length of a chain recipe is 4 * 4 = 16 words. 4 words in a recipe, 4 recipes that can be chained (using a 5th one for result indexes). Current max size chained recipe: 0: smmmm 1: smmmm 2: smmmm 3: smmmm 4: srrrr Where: s - switch ID m - regular match (e.g. ipv4 src addr, udp dst port, etc.) r - result index Switch ID does not actually need to be present in every recipe, only in one of them (in case of chained recipe). This frees up to 8 extra words: 3 from recipes in the middle (because first recipe still needs to have switch ID), and 5 from one extra recipe (because now the last recipe also does not have switch ID, so it can chain 1 more recipe). Max size chained recipe after changes: 0: smmmm 1: Mmmmm 2: Mmmmm 3: Mmmmm 4: MMMMM 5: Rrrrr Extra usable words available after this change are highlighted with capital letters. Changing how switch ID is added is not straightforward, because it's not a regular lookup. Its FV index and mask can't be determined based on protocol + offset pair read from package and instead need to be added manually. Additionally, change how result indexes are added. Currently they are always inserted in a new recipe at the end. Example for 13 words, (with above optimization, switch ID being one of the words): 0: smmmm 1: mmmmm 2: mmmxx 3: rrrxx Where: x - unused word In this and some other cases, the result indexes can be moved just after last matches because there are unused words, saving one recipe. Example for 13 words after both optimizations: 0: smmmm 1: mmmmm 2: mmmrr Note how one less result index is needed in this case, because the last recipe does not need to "link" to itself. There are cases when adding an additional recipe for result indexes cannot be avoided. In that cases result indexes are all put in the last recipe. Example for 14 words after both optimizations: 0: smmmm 1: mmmmm 2: mmmmx 3: rrrxx With these two changes, recipes/rules are more space efficient, allowing more to be created in total. Co-developed-by: Michal Swiatkowski Signed-off-by: Michal Swiatkowski Reviewed-by: Przemek Kitszel Signed-off-by: Marcin Szycik Tested-by: Sujai Buvaneswaran Signed-off-by: Tony Nguyen drivers/net/ethernet/intel/ice/ice_protocol_type.h | 22 +- drivers/net/ethernet/intel/ice/ice_switch.c | 525 ++++++++------------- drivers/net/ethernet/intel/ice/ice_switch.h | 2 + 3 files changed, 212 insertions(+), 337 deletions(-) commit f7d43dd206e7e18c182f200e67a8db8c209907fa Author: Yu Liao Date: Thu Jul 11 20:48:43 2024 +0800 tick/broadcast: Make takeover of broadcast hrtimer reliable Running the LTP hotplug stress test on a aarch64 machine results in rcu_sched stall warnings when the broadcast hrtimer was owned by the un-plugged CPU. The issue is the following: CPU1 (owns the broadcast hrtimer) CPU2 tick_broadcast_enter() // shutdown local timer device broadcast_shutdown_local() ... tick_broadcast_exit() clockevents_switch_state(dev, CLOCK_EVT_STATE_ONESHOT) // timer device is not programmed cpumask_set_cpu(cpu, tick_broadcast_force_mask) initiates offlining of CPU1 take_cpu_down() /* * CPU1 shuts down and does not * send broadcast IPI anymore */ takedown_cpu() hotplug_cpu__broadcast_tick_pull() // move broadcast hrtimer to this CPU clockevents_program_event() bc_set_next() hrtimer_start() /* * timer device is not programmed * because only the first expiring * timer will trigger clockevent * device reprogramming */ What happens is that CPU2 exits broadcast mode with force bit set, then the local timer device is not reprogrammed and CPU2 expects to receive the expired event by the broadcast IPI. But this does not happen because CPU1 is offlined by CPU2. CPU switches the clockevent device to ONESHOT state, but does not reprogram the device. The subsequent reprogramming of the hrtimer broadcast device does not program the clockevent device of CPU2 either because the pending expiry time is already in the past and the CPU expects the event to be delivered. As a consequence all CPUs which wait for a broadcast event to be delivered are stuck forever. Fix this issue by reprogramming the local timer device if the broadcast force bit of the CPU is set so that the broadcast hrtimer is delivered. [ tglx: Massage comment and change log. Add Fixes tag ] Fixes: 989dcb645ca7 ("tick: Handle broadcast wakeup of multiple cpus") Signed-off-by: Yu Liao Signed-off-by: Thomas Gleixner Cc: stable@vger.kernel.org Link: https://lore.kernel.org/r/20240711124843.64167-1-liaoyu15@huawei.com kernel/time/tick-broadcast.c | 23 +++++++++++++++++++++++ 1 file changed, 23 insertions(+) commit cb1f1c7d38b56b6289e4e6dde554321be2dd4530 Author: Stanislav Jakubek Date: Tue Jul 9 08:30:18 2024 +0200 dt-bindings: mmc: sdhci-sprd: convert to YAML Covert the Spreadtrum SDHCI controller bindings to DT schema. Rename the file to match compatible. Drop assigned-* properties as these should not be needed. Reviewed-by: Krzysztof Kozlowski Signed-off-by: Stanislav Jakubek Link: https://lore.kernel.org/r/ZozY+tOkzK9yfjbo@standask-GA-A55M-S2HP Signed-off-by: Ulf Hansson .../devicetree/bindings/mmc/sdhci-sprd.txt | 67 ------------ .../devicetree/bindings/mmc/sprd,sdhci-r11.yaml | 112 +++++++++++++++++++++ 2 files changed, 112 insertions(+), 67 deletions(-) commit ca04fff3886d449a6549929d487b4179214144fd Author: Bastien Curutchet Date: Thu Jul 11 10:18:38 2024 +0200 mmc: davinci_mmc: report all possible bus widths A dev_info() at probe's end() report the supported bus width. It never reports 8-bits width while the driver can handle it. Update the info message at then end of the probe to report the use of 8-bits data when needed. Signed-off-by: Bastien Curutchet Link: https://lore.kernel.org/r/20240711081838.47256-3-bastien.curutchet@bootlin.com Signed-off-by: Ulf Hansson drivers/mmc/host/davinci_mmc.c | 11 ++++++++--- 1 file changed, 8 insertions(+), 3 deletions(-) commit 796826bc61b60212570f6795b97bdef64bc16749 Merge: c17aecf85800 16198eef11c1 Author: Ulf Hansson Date: Thu Jul 11 17:58:04 2024 +0200 mmc: Merge branch fixes into next Merge the mmc fixes for v6.10-rc[n] into the next branch, to allow them to get tested together with the new mmc changes that are targeted for v6.11. Signed-off-by: Ulf Hansson commit 589dd7145a8ea6bcc6faa286205e467ba5403f79 Author: Michal Swiatkowski Date: Thu Jun 27 16:55:44 2024 +0200 ice: remove unused recipe bookkeeping data Remove root_buf from recipe struct. Its only usage was in ice_find_recp(), where if recipe had an inverse action, it was skipped, but actually the driver never adds inverse actions, so effectively it was pointless. Without root_buf, the recipe data element in ice_add_sw_recipe() does not need to be persistent and can also be automatically deallocated with __free, which nicely simplifies unroll. Signed-off-by: Michal Swiatkowski Reviewed-by: Przemek Kitszel Signed-off-by: Marcin Szycik Tested-by: Sujai Buvaneswaran Signed-off-by: Tony Nguyen drivers/net/ethernet/intel/ice/ice_common.c | 1 - drivers/net/ethernet/intel/ice/ice_switch.c | 55 ++++++++--------------------- drivers/net/ethernet/intel/ice/ice_switch.h | 2 -- 3 files changed, 15 insertions(+), 43 deletions(-) commit c9b8cd139c1dfb95eb86fd6a58cfe2089843d1d4 Author: Clément Léger Date: Wed Apr 10 16:45:57 2024 +0200 riscv: hwprobe: export highest virtual userspace address Some userspace applications (OpenJDK for instance) uses the free MSBs in pointers to insert additional information for their own logic and need to get this information from somewhere. Currently they rely on parsing /proc/cpuinfo "mmu=svxx" string to obtain the current value of virtual address usable bits [1]. Since this reflect the raw supported MMU mode, it might differ from the logical one used internally which is why arch_get_mmap_end() is used. Exporting the highest mmapable address through hwprobe will allow a more stable interface to be used. For that purpose, add a new hwprobe key named RISCV_HWPROBE_KEY_HIGHEST_VIRT_ADDRESS which will export the highest userspace virtual address. Link: https://github.com/openjdk/jdk/blob/master/src/hotspot/os_cpu/linux_riscv/vm_version_linux_riscv.cpp#L171 [1] Signed-off-by: Clément Léger Reviewed-by: Charlie Jenkins Link: https://lore.kernel.org/r/20240410144558.1104006-1-cleger@rivosinc.com Signed-off-by: Palmer Dabbelt Documentation/arch/riscv/hwprobe.rst | 3 +++ arch/riscv/include/asm/hwprobe.h | 2 +- arch/riscv/include/asm/processor.h | 6 ++++++ arch/riscv/include/uapi/asm/hwprobe.h | 1 + arch/riscv/kernel/sys_hwprobe.c | 4 ++++ 5 files changed, 15 insertions(+), 1 deletion(-) commit 19d3c179a37730caf600a97fed3794feac2b197b Author: Puranjay Mohan Date: Thu Jul 11 15:18:38 2024 +0000 bpf, arm64: Fix trampoline for BPF_TRAMP_F_CALL_ORIG When BPF_TRAMP_F_CALL_ORIG is set, the trampoline calls __bpf_tramp_enter() and __bpf_tramp_exit() functions, passing them the struct bpf_tramp_image *im pointer as an argument in R0. The trampoline generation code uses emit_addr_mov_i64() to emit instructions for moving the bpf_tramp_image address into R0, but emit_addr_mov_i64() assumes the address to be in the vmalloc() space and uses only 48 bits. Because bpf_tramp_image is allocated using kzalloc(), its address can use more than 48-bits, in this case the trampoline will pass an invalid address to __bpf_tramp_enter/exit() causing a kernel crash. Fix this by using emit_a64_mov_i64() in place of emit_addr_mov_i64() as it can work with addresses that are greater than 48-bits. Fixes: efc9909fdce0 ("bpf, arm64: Add bpf trampoline for arm64") Signed-off-by: Puranjay Mohan Signed-off-by: Daniel Borkmann Closes: https://lore.kernel.org/all/SJ0PR15MB461564D3F7E7A763498CA6A8CBDB2@SJ0PR15MB4615.namprd15.prod.outlook.com/ Link: https://lore.kernel.org/bpf/20240711151838.43469-1-puranjay@kernel.org arch/arm64/net/bpf_jit_comp.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) commit 3125eb5595904c41f93587e35712acffa51e14c8 Author: Michal Swiatkowski Date: Thu Jun 27 16:55:43 2024 +0200 ice: Simplify bitmap setting in adding recipe Remove unnecessary size checks when copying bitmaps in ice_add_sw_recipe() and replace them with compile time assert. Check if the bitmaps are equal size, as they are copied both ways. Signed-off-by: Michal Swiatkowski Reviewed-by: Przemek Kitszel Co-developed-by: Marcin Szycik Signed-off-by: Marcin Szycik Tested-by: Sujai Buvaneswaran Signed-off-by: Tony Nguyen drivers/net/ethernet/intel/ice/ice_switch.c | 24 +++++++++--------------- 1 file changed, 9 insertions(+), 15 deletions(-) commit c563908494e9578da70a11d49f6ad75c56fe8d48 Author: Michal Swiatkowski Date: Thu Jun 27 16:55:42 2024 +0200 ice: Remove reading all recipes before adding a new one The content of the first read recipe is used as a template when adding a recipe. It isn't needed - only prune index is directly set from there. Set it in the code instead. Also, now there's no need to set rid and lookup indexes to 0, as the whole recipe buffer is initialized to 0. Signed-off-by: Michal Swiatkowski Reviewed-by: Przemek Kitszel Signed-off-by: Marcin Szycik Tested-by: Sujai Buvaneswaran Signed-off-by: Tony Nguyen drivers/net/ethernet/intel/ice/ice_switch.c | 29 ++--------------------------- 1 file changed, 2 insertions(+), 27 deletions(-) commit e247267bbeaf0d904b95765b2721495f6581eb65 Author: Marcin Szycik Date: Thu Jun 27 16:55:41 2024 +0200 ice: Remove unused struct ice_prot_lkup_ext members Remove field_off as it's never used. Remove done bitmap, as its value is only checked and never assigned. Reusing sub-recipes while creating new root recipes is currently not supported in the driver. Reviewed-by: Przemek Kitszel Signed-off-by: Marcin Szycik Tested-by: Sujai Buvaneswaran Signed-off-by: Tony Nguyen drivers/net/ethernet/intel/ice/ice_protocol_type.h | 4 -- drivers/net/ethernet/intel/ice/ice_switch.c | 44 ++++++++++------------ 2 files changed, 19 insertions(+), 29 deletions(-) commit b4e891901ed5409f4c33d12fd92011be925ef5b3 Author: Steven Price Date: Wed Jun 12 17:00:38 2024 +0100 fixmap: Remove unused set_fixmap_offset_io() The macro set_fixmap_offset_io() was added in commit f774b7d10e21 ("arm64: fixmap: fix missing sub-page offset for earlyprintk") but then commit 8ef0ed95ee04 ("arm64: remove arch specific earlyprintk") removed the file causing the only user to be removed when the two commits were merged. Since this has never been used again since the v3.15 release remove it. Signed-off-by: Steven Price Signed-off-by: Arnd Bergmann include/asm-generic/fixmap.h | 3 --- 1 file changed, 3 deletions(-) commit c298391abf6505c4040632b310a14f6bd9b7afff Author: Dmitry Torokhov Date: Wed Jul 3 12:05:23 2024 -0700 mfd: timberdale: Attach device properties to TSC2007 board info Switch over to using software nodes/properties to describe the touchscreen instead of using the legacy platform data. This will allow to drop support for the platform data from TSC2007 driver and rely solely on the generic driver properties. Note: "model" is not part of defined device properties and is not used by the TSC2007 driver, so it can be safely dropped. Signed-off-by: Dmitry Torokhov Link: https://lore.kernel.org/r/ZoWg89A8C4gylTGX@google.com Signed-off-by: Lee Jones drivers/mfd/timberdale.c | 17 +++++++++++------ 1 file changed, 11 insertions(+), 6 deletions(-) commit 609458abd5a10180f513ca364d6c0ae30128c821 Author: Nirmoy Das Date: Mon Jul 8 14:59:18 2024 +0200 drm/xe/display/xe_hdcp_gsc: Free arbiter on driver removal Free arbiter allocated in intel_hdcp_gsc_init(). Fixes: 152f2df954d8 ("drm/xe/hdcp: Enable HDCP for XE") Cc: Suraj Kandpal Cc: Arun R Murthy Cc: Lucas De Marchi Cc: Rodrigo Vivi Reviewed-by: Rodrigo Vivi Link: https://patchwork.freedesktop.org/patch/msgid/20240708125918.23573-1-nirmoy.das@intel.com Signed-off-by: Nirmoy Das (cherry picked from commit 33891539f9d6f245e93a76e3fb5791338180374f) Signed-off-by: Lucas De Marchi drivers/gpu/drm/xe/display/xe_hdcp_gsc.c | 12 ++++++++---- 1 file changed, 8 insertions(+), 4 deletions(-) commit 5207c393d3e7dda9aff813d6b3e2264370d241be Author: Thomas Hellström Date: Fri Jul 5 15:28:28 2024 +0200 drm/xe: Use write-back caching mode for system memory on DGFX The caching mode for buffer objects with VRAM as a possible placement was forced to write-combined, regardless of placement. However, write-combined system memory is expensive to allocate and even though it is pooled, the pool is expensive to shrink, since it involves global CPU TLB flushes. Moreover write-combined system memory from TTM is only reliably available on x86 and DGFX doesn't have an x86 restriction. So regardless of the cpu caching mode selected for a bo, internally use write-back caching mode for system memory on DGFX. Coherency is maintained, but user-space clients may perceive a difference in cpu access speeds. v2: - Update RB- and Ack tags. - Rephrase wording in xe_drm.h (Matt Roper) v3: - Really rephrase wording. Signed-off-by: Thomas Hellström Fixes: 622f709ca629 ("drm/xe/uapi: Add support for CPU caching mode") Cc: Pallavi Mishra Cc: Matthew Auld Cc: dri-devel@lists.freedesktop.org Cc: Joonas Lahtinen Cc: Effie Yu Cc: Matthew Brost Cc: Maarten Lankhorst Cc: Jose Souza Cc: Michal Mrozek Cc: # v6.8+ Acked-by: Matthew Auld Acked-by: José Roberto de Souza Reviewed-by: Rodrigo Vivi Fixes: 622f709ca629 ("drm/xe/uapi: Add support for CPU caching mode") Acked-by: Michal Mrozek Acked-by: Effie Yu #On chat Link: https://patchwork.freedesktop.org/patch/msgid/20240705132828.27714-1-thomas.hellstrom@linux.intel.com (cherry picked from commit 01e0cfc994be484ddcb9e121e353e51d8bb837c0) Signed-off-by: Lucas De Marchi drivers/gpu/drm/xe/xe_bo.c | 47 ++++++++++++++++++++++++---------------- drivers/gpu/drm/xe/xe_bo_types.h | 3 ++- include/uapi/drm/xe_drm.h | 8 ++++++- 3 files changed, 37 insertions(+), 21 deletions(-) commit 11b1a666c16d29ee9c1ebc954cda3fc9a2575fe3 Author: Nicolas Ferre Date: Wed Jul 10 18:26:15 2024 +0200 dt-bindings: i2c: at91: Add sama7d65 compatible string Add compatible string for sama7d65. Like sama7g5, it currently binds to "microchip,sam9x60-i2c" compatible string for this driver. Signed-off-by: Nicolas Ferre Acked-by: Krzysztof Kozlowski Signed-off-by: Andi Shyti Documentation/devicetree/bindings/i2c/atmel,at91sam-i2c.yaml | 2 ++ 1 file changed, 2 insertions(+) commit 9fe6a8c5b247e182c1781556794324a8e26a7cd3 Author: Juergen Gross Date: Wed Jul 10 13:01:39 2024 +0200 x86/xen: remove deprecated xen_nopvspin boot parameter The xen_nopvspin boot parameter is deprecated since 2019. nopvspin can be used instead. Remove the xen_nopvspin boot parameter and replace the xen_pvspin variable use cases with nopvspin. This requires to move the nopvspin variable out of the .initdata section, as it needs to be accessed for cpuhotplug, too. Signed-off-by: Juergen Gross Reviewed-by: Boris Ostrovsky Message-ID: <20240710110139.22300-1-jgross@suse.com> Signed-off-by: Juergen Gross Documentation/admin-guide/kernel-parameters.txt | 5 ----- arch/x86/xen/spinlock.c | 20 +++++--------------- kernel/locking/qspinlock.c | 2 +- 3 files changed, 6 insertions(+), 21 deletions(-) commit 556bc13776a7e27d1b8f4bfc92340428846774f4 Author: Neil Armstrong Date: Wed Jul 10 19:02:52 2024 +0200 dt-bindings: trivial-devices: document the Sierra Wireless mangOH Green SPI IoT interface Document the Sierra Wireless mangOH Green SPI IoT interface as a trivial device. This fixes the following check: qcom-mdm9615-wp8548-mangoh-green.dtb: /soc/gsbi@16200000/spi@16280000/spi@0: failed to match any schema with compatible: ['swir,mangoh-iotport-spi'] Signed-off-by: Neil Armstrong Acked-by: Krzysztof Kozlowski Link: https://lore.kernel.org/r/20240710-topic-mdm9615-mangoh-iotport-spi-bindings-v1-1-3efe20cfea8a@linaro.org Signed-off-by: Rob Herring (Arm) Documentation/devicetree/bindings/trivial-devices.yaml | 2 ++ 1 file changed, 2 insertions(+) commit bcea31e2d1c7a34aeeae9458f38833d5a8409cf7 Author: Juergen Gross Date: Wed Jul 10 11:37:18 2024 +0200 x86/xen: eliminate some private header files Under arch/x86/xen there is one large private header file xen-ops.h containing most of the Xen-private x86 related declarations, and then there are several small headers with a handful of declarations each. Merge the small headers into xen-ops.h. While doing that, move the declaration of xen_fifo_events from xen-ops.h into include/xen/events.h where it should have been from the beginning. Signed-off-by: Juergen Gross Reviewed-by: Boris Ostrovsky Message-ID: <20240710093718.14552-3-jgross@suse.com> Signed-off-by: Juergen Gross arch/x86/xen/apic.c | 2 - arch/x86/xen/debugfs.c | 2 +- arch/x86/xen/debugfs.h | 7 --- arch/x86/xen/enlighten.c | 2 - arch/x86/xen/enlighten_hvm.c | 2 - arch/x86/xen/enlighten_pv.c | 4 -- arch/x86/xen/mmu.c | 3 +- arch/x86/xen/mmu.h | 24 ------- arch/x86/xen/mmu_hvm.c | 2 +- arch/x86/xen/mmu_pv.c | 4 +- arch/x86/xen/multicalls.c | 3 +- arch/x86/xen/multicalls.h | 69 -------------------- arch/x86/xen/p2m.c | 2 - arch/x86/xen/pmu.c | 1 - arch/x86/xen/pmu.h | 22 ------- arch/x86/xen/setup.c | 1 - arch/x86/xen/smp.c | 1 - arch/x86/xen/smp.h | 51 --------------- arch/x86/xen/smp_hvm.c | 2 - arch/x86/xen/smp_pv.c | 3 - arch/x86/xen/suspend.c | 2 - arch/x86/xen/xen-ops.h | 147 ++++++++++++++++++++++++++++++++++++++++++- include/xen/events.h | 2 + 23 files changed, 152 insertions(+), 206 deletions(-) commit 337c628ab74d1bbfe5377bbd8d31c858baf5fbc6 Author: Juergen Gross Date: Wed Jul 10 11:37:17 2024 +0200 x86/xen: make some functions static Some functions and variables in arch/x86/xen are used locally only, make them static. Signed-off-by: Juergen Gross Reviewed-by: Boris Ostrovsky Message-ID: <20240710093718.14552-2-jgross@suse.com> Signed-off-by: Juergen Gross arch/x86/xen/mmu.h | 4 ---- arch/x86/xen/mmu_pv.c | 11 ++++++----- arch/x86/xen/xen-ops.h | 1 - 3 files changed, 6 insertions(+), 10 deletions(-) commit 942d917cb92af2277db9e3be0d62345d770d5996 Author: Juergen Gross Date: Wed Jul 10 11:27:49 2024 +0200 xen: make multicall debug boot time selectable Today Xen multicall debugging needs to be enabled via modifying a define in a source file for getting debug data of multicall errors encountered by users. Switch multicall debugging to depend on a boot parameter "xen_mc_debug" instead, enabling affected users to boot with the new parameter set in order to get better diagnostics. With debugging enabled print the following information in case at least one of the batched calls failed: - all calls of the batch with operation, result and caller - all parameters of each call - all parameters stored in the multicall data for each call Signed-off-by: Juergen Gross Reviewed-by: Boris Ostrovsky Message-ID: <20240710092749.13595-1-jgross@suse.com> Signed-off-by: Juergen Gross Documentation/admin-guide/kernel-parameters.txt | 6 ++ arch/x86/xen/multicalls.c | 125 +++++++++++++++++++----- 2 files changed, 108 insertions(+), 23 deletions(-) commit 8e7860543a94784d744c7ce34b78a2e11beefa5c Author: Filipe Manana Date: Thu Jul 4 16:11:20 2024 +0100 btrfs: fix extent map use-after-free when adding pages to compressed bio At add_ra_bio_pages() we are accessing the extent map to calculate 'add_size' after we dropped our reference on the extent map, resulting in a use-after-free. Fix this by computing 'add_size' before dropping our extent map reference. Reported-by: syzbot+853d80cba98ce1157ae6@syzkaller.appspotmail.com Link: https://lore.kernel.org/linux-btrfs/000000000000038144061c6d18f2@google.com/ Fixes: 6a4049102055 ("btrfs: subpage: make add_ra_bio_pages() compatible") CC: stable@vger.kernel.org # 6.1+ Signed-off-by: Filipe Manana Reviewed-by: David Sterba Signed-off-by: David Sterba fs/btrfs/compression.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 0aef1d41c61b52b21e1750e7b53447126ff257de Author: Kees Cook Date: Wed Jul 10 15:57:34 2024 -0700 affs: struct slink_front: Replace 1-element array with flexible array Replace the deprecated[1] use of a 1-element array in struct slink_front with a modern flexible array. No binary differences are present after this conversion. Link: https://github.com/KSPP/linux/issues/79 [1] Reviewed-by: Gustavo A. R. Silva Signed-off-by: Kees Cook Reviewed-by: David Sterba Signed-off-by: David Sterba fs/affs/amigaffs.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit e5f5ee827cda0933b46dacb123a53a58c1c656e8 Author: Kees Cook Date: Wed Jul 10 15:57:25 2024 -0700 affs: struct affs_data_head: Replace 1-element array with flexible array Replace the deprecated[1] use of a 1-element array in struct affs_data_head with a modern flexible array. No binary differences are present after this conversion. Link: https://github.com/KSPP/linux/issues/79 [1] Reviewed-by: Gustavo A. R. Silva Signed-off-by: Kees Cook Reviewed-by: David Sterba Signed-off-by: David Sterba fs/affs/amigaffs.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 38a381a0bc57be2927c6744733ba274cefd13e9f Author: Kees Cook Date: Wed Jul 10 15:57:09 2024 -0700 affs: struct affs_head: Replace 1-element array with flexible array AFFS uses struct affs_head's "table" array as a flexible array. Switch this to a proper flexible array[1]. There are no sizeof() uses; struct affs_head is only ever uses via direct casts. No binary output differences were found after this change. Link: https://github.com/KSPP/linux/issues/79 [1] Reviewed-by: Gustavo A. R. Silva Signed-off-by: Kees Cook Reviewed-by: David Sterba Signed-off-by: David Sterba fs/affs/amigaffs.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit a3da15389112a28633e4c340e4841faab29df3b7 Author: Andreas Larsson Date: Wed Jul 10 11:41:55 2024 +0200 sparc64: Fix prototype warnings in hibernate.c Fix the following warnings: arch/sparc/power/hibernate.c:22:5: warning: no previous prototype for ‘pfn_is_nosave’ arch/sparc/power/hibernate.c:30:6: warning: no previous prototype for ‘save_processor_state’ arch/sparc/power/hibernate.c:35:6: warning: no previous prototype for ‘restore_processor_state’ The prototypes are available from linux/suspend.h so include that. Link: https://lore.kernel.org/r/20240710094155.458731-5-andreas@gaisler.com Signed-off-by: Andreas Larsson arch/sparc/power/hibernate.c | 1 + 1 file changed, 1 insertion(+) commit a9f52913ac60e7fc14306e7149e6c4e81e771f92 Author: Andreas Larsson Date: Wed Jul 10 11:41:54 2024 +0200 sparc64: Fix prototype warning for prom_get_mmu_ihandle arch/sparc/prom/misc_64.c:165:5: warning: no previous prototype for ‘prom_get_mmu_ihandle’ The function prom_get_mmu_ihandle has no users outside of misc_64.c so declare it static. Link: https://lore.kernel.org/r/20240710094155.458731-4-andreas@gaisler.com Signed-off-by: Andreas Larsson arch/sparc/prom/misc_64.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit a6c3ea1ec96307dbfbb2f16d96c674c5cc80f445 Author: Andreas Larsson Date: Wed Jul 10 11:41:53 2024 +0200 sparc64: Fix incorrect function signature and add prototype for prom_cif_init Remove the unused cif_stack argument and add a protype in oplib_64.h Commit ef3e035c3a9b ("sparc64: Fix register corruption in top-most kernel stack frame during boot.") removed the cif_stack argument to prom_cif init in the declaration at the caller site and the usage of it within prom_cif_init, but not in the function signature of the function itself. This also fixes the following warning: arch/sparc/prom/p1275.c:52:6: warning: no previous prototype for ‘prom_cif_init’ Fixes: ef3e035c3a9b ("sparc64: Fix register corruption in top-most kernel stack frame during boot.") Link: https://lore.kernel.org/r/20240710094155.458731-3-andreas@gaisler.com Signed-off-by: Andreas Larsson arch/sparc/include/asm/oplib_64.h | 1 + arch/sparc/prom/init_64.c | 3 --- arch/sparc/prom/p1275.c | 2 +- 3 files changed, 2 insertions(+), 4 deletions(-) commit 4c207db87d003c0dd1c59e41b355ab0a14f7a445 Author: Andreas Larsson Date: Wed Jul 10 11:41:52 2024 +0200 sparc64: Fix prototype warnings for floppy_64.h Fix the following warnings: arch/sparc/include/asm/floppy_64.h:200:13: warning: no previous prototype for ‘sparc_floppy_irq’ arch/sparc/include/asm/floppy_64.h:437:6: warning: no previous prototype for ‘sun_pci_fd_dma_callback’ Both sparc_floppy_irq and sun_pci_fd_dma_callback are only used within arch/sparc/include/asm/floppy_64.h that is included only by drivers/block/floppy.c, so declare them static. Link: https://lore.kernel.org/r/20240710094155.458731-2-andreas@gaisler.com Signed-off-by: Andreas Larsson arch/sparc/include/asm/floppy_64.h | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) commit a7ec177ebc447d541cf25171ba3f5c36e4acc206 Author: Andreas Larsson Date: Wed Jul 10 11:23:41 2024 +0200 sparc32: Fix truncated relocation errors when linking large kernels Use jumps instead of branches when jumping from one section to another to avoid branches to addresses further away than 22 bit offsets can handle that results in errors such as arch/sparc/kernel/signal_32.o:(.fixup+0x0): relocation truncated to fit: R_SPARC_WDISP22 against `.text' This is the same approach that was taken for sparc64 in commit 52eb053b7191 ("[SPARC64]: Fix linkage of enormous kernels.") Reported-by: kernel test robot Closes: https://lore.kernel.org/oe-kbuild-all/202405080936.tWaJdO3P-lkp@intel.com/ Closes: https://lore.kernel.org/oe-kbuild-all/202406240441.5zaoshVX-lkp@intel.com/ Link: https://lore.kernel.org/r/20240710092341.457591-1-andreas@gaisler.com Signed-off-by: Andreas Larsson arch/sparc/include/asm/uaccess_32.h | 6 ++++-- arch/sparc/kernel/head_32.S | 15 +++++++++++---- 2 files changed, 15 insertions(+), 6 deletions(-) commit 26d289158e491d5ae34b10eab40b093a40fab7d7 Author: Matthew Brost Date: Mon Jul 8 14:10:08 2024 -0700 drm/xe: Drop trace_xe_hw_fence_free fence->ctx may be stale memory when trace_xe_hw_fence_free is called resuling UAF bug when deriving the device name. This tracepoint is not all that useful, so just drop it. Fixes: 501c4255c409 ("drm/xe/trace: Print device_id in xe_trace events") Cc: Ville Syrjälä Cc: Lucas De Marchi Cc: Gustavo Sousa Cc: Radhakrishna Sripada Cc: Matt Roper Signed-off-by: Matthew Brost Reviewed-by: Rodrigo Vivi Link: https://patchwork.freedesktop.org/patch/msgid/20240708211008.956384-1-matthew.brost@intel.com (cherry picked from commit caaf1f44a6a27bae33eee189842c4d8fc21c3b02) Signed-off-by: Rodrigo Vivi drivers/gpu/drm/xe/xe_hw_fence.c | 1 - drivers/gpu/drm/xe/xe_trace.h | 5 ----- 2 files changed, 6 deletions(-) commit 63347fe031e3bd738a2a16aee8eba889376e49a8 Author: Ashutosh Dixit Date: Wed Jul 3 09:48:01 2024 -0700 drm/xe/uapi: Rename xe perf layer as xe observation layer In Xe, the perf layer allows capture of HW counter streams. These HW counters are generally performance related but don't have to be necessarily so. Also, the name "perf" is a carryover from i915 and is not preferred. Here we propose the name "observation" for this common layer which allows capture of different types of these counter streams. v2: Rename observability layer to observation layer (Lucas/Rodrigo) v3: Rename sysctl file to "observation_paranoid" (Jose) Fixes: 52c2e956dceb ("drm/xe/perf/uapi: "Perf" layer to support multiple perf counter stream types") Fixes: fe8929bdf835 ("drm/xe/perf/uapi: Add perf_stream_paranoid sysctl") Acked-by: Lucas De Marchi Acked-by: Rodrigo Vivi Signed-off-by: Ashutosh Dixit Reviewed-by: Umesh Nerlige Ramappa Acked-by: José Roberto de Souza Link: https://patchwork.freedesktop.org/patch/msgid/20240703164801.2561423-1-ashutosh.dixit@intel.com (cherry picked from commit 8169b2097d88d99d7e4a72e20e4b549efe9eb8d7) Signed-off-by: Rodrigo Vivi drivers/gpu/drm/xe/Makefile | 2 +- drivers/gpu/drm/xe/xe_device.c | 4 +- drivers/gpu/drm/xe/xe_device_types.h | 2 +- drivers/gpu/drm/xe/xe_gt_types.h | 2 +- drivers/gpu/drm/xe/xe_module.c | 6 +-- drivers/gpu/drm/xe/xe_oa.c | 34 ++++++------ drivers/gpu/drm/xe/xe_observation.c | 93 ++++++++++++++++++++++++++++++++ drivers/gpu/drm/xe/xe_observation.h | 20 +++++++ drivers/gpu/drm/xe/xe_perf.c | 92 ------------------------------- drivers/gpu/drm/xe/xe_perf.h | 20 ------- include/uapi/drm/xe_drm.h | 102 ++++++++++++++++++----------------- 11 files changed, 190 insertions(+), 187 deletions(-) commit 320d8dc612660da84c3b70a28658bb38069e5a9a Author: Filipe Manana Date: Wed Jul 3 15:40:59 2024 +0100 btrfs: fix bitmap leak when loading free space cache on duplicate entry If we failed to link a free space entry because there's already a conflicting entry for the same offset, we free the free space entry but we don't free the associated bitmap that we had just allocated before. Fix that by freeing the bitmap before freeing the entry. Reviewed-by: Johannes Thumshirn Signed-off-by: Filipe Manana Reviewed-by: David Sterba Signed-off-by: David Sterba fs/btrfs/free-space-cache.c | 1 + 1 file changed, 1 insertion(+) commit a39484371dd29ed9ba67bfd211e51d72b1a35c3d Author: Qu Wenruo Date: Thu May 23 10:49:38 2024 +0930 btrfs: remove the BUG_ON() inside extent_range_clear_dirty_for_io() Previously we had a BUG_ON() inside extent_range_clear_dirty_for_io(), as we expected all involved folios to be still locked, thus no folio should be missing. However for extent_range_clear_dirty_for_io() itself, we can skip the missing folio and handle the remaining ones, and return an error if there is anything wrong. Remove the BUG_ON() and let the caller to handle the error. In the caller we do not have a quick way to cleanup the error, but all the compression routines would handle the missing folio as an error and properly error out, so we only need to do an ASSERT() for developers, while for non-debug build the compression routine would handle the error correctly. Signed-off-by: Qu Wenruo Signed-off-by: David Sterba fs/btrfs/inode.c | 26 ++++++++++++++++++++------ 1 file changed, 20 insertions(+), 6 deletions(-) commit af61081fb522ab52bc7f7d8304b4a7cc4f606575 Author: Qu Wenruo Date: Thu May 23 10:49:37 2024 +0930 btrfs: move extent_range_clear_dirty_for_io() into inode.c The function is only used inside inode.c by compress_file_range(), so move it to inode.c and unexport it. Signed-off-by: Qu Wenruo Reviewed-by: David Sterba Signed-off-by: David Sterba fs/btrfs/extent_io.c | 15 --------------- fs/btrfs/extent_io.h | 1 - fs/btrfs/inode.c | 15 +++++++++++++++ 3 files changed, 15 insertions(+), 16 deletions(-) commit be9438f0774c21e4de7c4905226c44830cac075a Author: David Sterba Date: Fri May 3 13:42:30 2024 +0200 btrfs: enhance compression error messages Add more verbose and specific messages to all main error points in compression code for all algorithms. Currently there's no way to know which inode is affected or where in the data errors happened. The messages follow a common format: - what happened - error code if relevant - root and inode - additional data like offsets or lengths There's no helper for the messages as they differ in some details and that would be cumbersome to generalize to a single function. As all the errors are "almost never happens" there are the unlikely annotations done as compression is hot path. Signed-off-by: David Sterba fs/btrfs/lzo.c | 43 ++++++++++++++++++++++++----------- fs/btrfs/zlib.c | 56 ++++++++++++++++++++++++++++++++++----------- fs/btrfs/zstd.c | 70 ++++++++++++++++++++++++++++++++++++++++++--------------- 3 files changed, 125 insertions(+), 44 deletions(-) commit ca84529a842f3a15a5f17beac6252aa11955923f Author: Filipe Manana Date: Mon Jul 1 10:51:28 2024 +0100 btrfs: fix data race when accessing the last_trans field of a root KCSAN complains about a data race when accessing the last_trans field of a root: [ 199.553628] BUG: KCSAN: data-race in btrfs_record_root_in_trans [btrfs] / record_root_in_trans [btrfs] [ 199.555186] read to 0x000000008801e308 of 8 bytes by task 2812 on cpu 1: [ 199.555210] btrfs_record_root_in_trans+0x9a/0x128 [btrfs] [ 199.555999] start_transaction+0x154/0xcd8 [btrfs] [ 199.556780] btrfs_join_transaction+0x44/0x60 [btrfs] [ 199.557559] btrfs_dirty_inode+0x9c/0x140 [btrfs] [ 199.558339] btrfs_update_time+0x8c/0xb0 [btrfs] [ 199.559123] touch_atime+0x16c/0x1e0 [ 199.559151] pipe_read+0x6a8/0x7d0 [ 199.559179] vfs_read+0x466/0x498 [ 199.559204] ksys_read+0x108/0x150 [ 199.559230] __s390x_sys_read+0x68/0x88 [ 199.559257] do_syscall+0x1c6/0x210 [ 199.559286] __do_syscall+0xc8/0xf0 [ 199.559318] system_call+0x70/0x98 [ 199.559431] write to 0x000000008801e308 of 8 bytes by task 2808 on cpu 0: [ 199.559464] record_root_in_trans+0x196/0x228 [btrfs] [ 199.560236] btrfs_record_root_in_trans+0xfe/0x128 [btrfs] [ 199.561097] start_transaction+0x154/0xcd8 [btrfs] [ 199.561927] btrfs_join_transaction+0x44/0x60 [btrfs] [ 199.562700] btrfs_dirty_inode+0x9c/0x140 [btrfs] [ 199.563493] btrfs_update_time+0x8c/0xb0 [btrfs] [ 199.564277] file_update_time+0xb8/0xf0 [ 199.564301] pipe_write+0x8ac/0xab8 [ 199.564326] vfs_write+0x33c/0x588 [ 199.564349] ksys_write+0x108/0x150 [ 199.564372] __s390x_sys_write+0x68/0x88 [ 199.564397] do_syscall+0x1c6/0x210 [ 199.564424] __do_syscall+0xc8/0xf0 [ 199.564452] system_call+0x70/0x98 This is because we update and read last_trans concurrently without any type of synchronization. This should be generally harmless and in the worst case it can make us do extra locking (btrfs_record_root_in_trans()) trigger some warnings at ctree.c or do extra work during relocation - this would probably only happen in case of load or store tearing. So fix this by always reading and updating the field using READ_ONCE() and WRITE_ONCE(), this silences KCSAN and prevents load and store tearing. Reviewed-by: Josef Bacik Signed-off-by: Filipe Manana Signed-off-by: David Sterba fs/btrfs/ctree.c | 4 ++-- fs/btrfs/ctree.h | 10 ++++++++++ fs/btrfs/defrag.c | 2 +- fs/btrfs/disk-io.c | 4 ++-- fs/btrfs/relocation.c | 8 ++++---- fs/btrfs/transaction.c | 8 ++++---- 6 files changed, 23 insertions(+), 13 deletions(-) commit 240b129d597cb8a8880eb3a381ff10eb98ca0c07 Author: Trevor Gamblin Date: Thu Jul 11 08:57:42 2024 -0400 pwm: axi-pwmgen: add .max_register to regmap This was missed in the basic driver and is useful for debug, so add it. Example regmap output before the patch: |root@zed-tg:~# cat /sys/kernel/debug/regmap/44a60000.pwm/registers |0: 00020100 And with it: |root@zed-tg:~# cat /sys/kernel/debug/regmap/44a60000.pwm/registers |00: 00020100 |04: 00000000 |08: 00000000 |0c: 601a3471 |10: 00000000 |14: 00000002 |18: 00000001 |1c: 00000000 |... Signed-off-by: Trevor Gamblin Link: https://lore.kernel.org/r/20240711125743.3956935-1-tgamblin@baylibre.com Signed-off-by: Uwe Kleine-König drivers/pwm/pwm-axi-pwmgen.c | 1 + 1 file changed, 1 insertion(+) commit e51f125b10332914ea4440252abcb3688ca1af59 Author: Jeff Johnson Date: Wed Jun 19 07:07:26 2024 -0700 sbus: add missing MODULE_DESCRIPTION() macros With ARCH=sparc, make allmodconfig && make W=1 C=1 reports: WARNING: modpost: missing MODULE_DESCRIPTION() in drivers/sbus/char/envctrl.o WARNING: modpost: missing MODULE_DESCRIPTION() in drivers/sbus/char/flash.o WARNING: modpost: missing MODULE_DESCRIPTION() in drivers/sbus/char/uctrl.o WARNING: modpost: missing MODULE_DESCRIPTION() in drivers/sbus/char/bbc.o Add the missing invocations of the MODULE_DESCRIPTION() macro. Signed-off-by: Jeff Johnson Reviewed-by: Andreas Larsson Link: https://lore.kernel.org/r/20240619-md-sparc-drivers-sbus-char-v1-1-85acadb8f789@quicinc.com Signed-off-by: Andreas Larsson drivers/sbus/char/bbc_i2c.c | 1 + drivers/sbus/char/envctrl.c | 1 + drivers/sbus/char/flash.c | 1 + drivers/sbus/char/uctrl.c | 1 + 4 files changed, 4 insertions(+) commit 0fbf6cbd723dbf49d50bfe92d13baa338304c243 Author: Qu Wenruo Date: Thu Jun 27 13:22:16 2024 +0930 btrfs: rename the extra_gfp parameter of btrfs_alloc_page_array() There is only one caller utilizing the @extra_gfp parameter, alloc_eb_folio_array(). And in that case the extra_gfp is only assigned to __GFP_NOFAIL. Rename the @extra_gfp parameter to @nofail to indicate that. Reviewed-by: Filipe Manana Signed-off-by: Qu Wenruo Reviewed-by: David Sterba Signed-off-by: David Sterba fs/btrfs/extent_io.c | 20 ++++++++++---------- fs/btrfs/extent_io.h | 2 +- fs/btrfs/inode.c | 2 +- fs/btrfs/raid56.c | 6 +++--- fs/btrfs/scrub.c | 2 +- 5 files changed, 16 insertions(+), 16 deletions(-) commit fea91134c213d0671863e5461a3c3e94c5d053be Author: Qu Wenruo Date: Thu Jun 27 13:15:55 2024 +0930 btrfs: remove the extra_gfp parameter from btrfs_alloc_folio_array() The function btrfs_alloc_folio_array() is only utilized in btrfs_submit_compressed_read() and no other location, and the only caller is not utilizing the @extra_gfp parameter. Reviewed-by: Filipe Manana Signed-off-by: Qu Wenruo Reviewed-by: David Sterba Signed-off-by: David Sterba fs/btrfs/compression.c | 2 +- fs/btrfs/extent_io.c | 8 +++----- fs/btrfs/extent_io.h | 3 +-- 3 files changed, 5 insertions(+), 8 deletions(-) commit 32e6216512b4119c1bb317c7305708f725832ff7 Author: Qu Wenruo Date: Fri Jun 14 13:52:31 2024 +0930 btrfs: introduce new "rescue=ignoresuperflags" mount option This new mount option allows the kernel to skip the super flags check, it's mostly to allow the kernel to do a rescue mount of an interrupted checksum conversion. Reviewed-by: Josef Bacik Signed-off-by: Qu Wenruo Reviewed-by: David Sterba Signed-off-by: David Sterba fs/btrfs/disk-io.c | 16 ++++++++++++---- fs/btrfs/fs.h | 1 + fs/btrfs/super.c | 13 ++++++++++++- fs/btrfs/sysfs.c | 1 + 4 files changed, 26 insertions(+), 5 deletions(-) commit 169aaaf2e0be615ffd4a12adc02db5eb86e8eee1 Author: Qu Wenruo Date: Fri Jun 14 13:52:30 2024 +0930 btrfs: introduce new "rescue=ignoremetacsums" mount option Introduce "rescue=ignoremetacsums" to ignore metadata csums, all the other metadata sanity checks are still kept as is. This new mount option is mostly to allow the kernel to mount an interrupted checksum conversion (at the metadata csum overwrite stage). And since the main part of metadata sanity checks is inside tree-checker, we shouldn't lose much safety, and the new mount option is rescue mount option it requires full read-only mount. Reviewed-by: Josef Bacik Signed-off-by: Qu Wenruo Reviewed-by: David Sterba Signed-off-by: David Sterba fs/btrfs/bio.c | 2 +- fs/btrfs/disk-io.c | 18 ++++++++++++------ fs/btrfs/file-item.c | 2 +- fs/btrfs/fs.h | 5 ++++- fs/btrfs/messages.c | 3 ++- fs/btrfs/super.c | 13 ++++++++++++- fs/btrfs/sysfs.c | 1 + fs/btrfs/zoned.c | 2 +- 8 files changed, 34 insertions(+), 12 deletions(-) commit cf31b271e0a65fadb675a6cec433e08ab636f36d Author: Qu Wenruo Date: Fri Jun 14 13:52:29 2024 +0930 btrfs: output the unrecognized super block flags as hex Most of the extra super block flags are beyond 32bits (from CHANGING_FSID_V2 to CHANGING_*_CSUMS), thus using %llu is not only too long and pretty hard to read. Reviewed-by: Josef Bacik Signed-off-by: Qu Wenruo Reviewed-by: David Sterba Signed-off-by: David Sterba fs/btrfs/disk-io.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 14114c98a89cad71698c9c29a038fd871cf8078f Author: Qu Wenruo Date: Fri Jun 14 13:52:28 2024 +0930 btrfs: remove unused Opt enums The following three Opt_* enums haven't been utilized since the port to new mount API: - Opt_ignorebadroots - Opt_ignoredatacsums - Opt_rescue_all All those enums are from the old day where we have dedicated mount options, nowadays they have been moved to "rescue=" mount option groups, and no more global tokens for them. So we can safely remove them now. Reviewed-by: Josef Bacik Signed-off-by: Qu Wenruo Reviewed-by: David Sterba Signed-off-by: David Sterba fs/btrfs/super.c | 3 --- 1 file changed, 3 deletions(-) commit 5fc070a9246d8d7d5dbccecf211085be43e0e8e5 Author: Qu Wenruo Date: Mon Jun 24 08:17:58 2024 +0930 btrfs: tree-checker: add extra ram_bytes and disk_num_bytes check This is to ensure non-compressed file extents (both regular and prealloc) should have matching ram_bytes and disk_num_bytes. This is only for CONFIG_BTRFS_DEBUG and CONFIG_BTRFS_ASSERT case, furthermore this will not return error, but just a kernel warning to inform developers. Reviewed-by: Filipe Manana Signed-off-by: Qu Wenruo Signed-off-by: David Sterba fs/btrfs/tree-checker.c | 18 ++++++++++++++++++ 1 file changed, 18 insertions(+) commit 896c8b92dda6ca20c6a591db996039aa8931478b Author: Qu Wenruo Date: Tue Jun 25 13:40:49 2024 +0930 btrfs: fix the ram_bytes assignment for truncated ordered extents [HICCUP] After adding extra checks on btrfs_file_extent_item::ram_bytes to tree-checker, running fsstress leads to tree-checker warning at write time, as we created file extent items with an invalid ram_bytes. All those offending file extents have offset 0, and ram_bytes matching num_bytes, and smaller than disk_num_bytes. This would also trigger the recently enhanced btrfs-check, which catches such mismatches and report them as minor errors. [CAUSE] When a folio/page is invalidated and it is part of a submitted OE, we mark the OE truncated just to the beginning of the folio/page. And for truncated OE, we insert the file extent item with incorrect value for ram_bytes (using num_bytes instead of the usual value). This is not a big deal for end users, as we do not utilize the ram_bytes field for regular non-compressed extents. This mismatch is just a small violation against on-disk format. [FIX] Fix it by removing the override on btrfs_file_extent_item::ram_bytes. Reviewed-by: Filipe Manana Signed-off-by: Qu Wenruo Signed-off-by: David Sterba fs/btrfs/inode.c | 4 +--- 1 file changed, 1 insertion(+), 3 deletions(-) commit 1b87d26addd811ac7033720d21def3c4a3ef9fe3 Author: Qu Wenruo Date: Tue Jun 25 13:34:33 2024 +0930 btrfs: make validate_extent_map() catch ram_bytes mismatch Previously validate_extent_map() is only to catch bugs related to extent_map member cleanups. But with recent btrfs-check enhancement to catch ram_bytes mismatch with disk_num_bytes, it would be much better to catch such extent maps earlier. So this patch adds extra ram_bytes validation for extent maps. Please note that, older filesystems with such mismatch won't trigger this error: - extent_map::ram_bytes is already fixed Previous patch has already fixed the ram_bytes for affected file extents. So this enhanced sanity check should not affect end users. Reviewed-by: Filipe Manana Signed-off-by: Qu Wenruo Signed-off-by: David Sterba fs/btrfs/extent_map.c | 5 +++++ 1 file changed, 5 insertions(+) commit 88e2e6d72423912f62b3e44aeeb967d798a2c2f5 Author: Qu Wenruo Date: Wed Jun 26 09:34:40 2024 +0930 btrfs: ignore incorrect btrfs_file_extent_item::ram_bytes [HICCUP] Kernels can create file extent items with incorrect ram_bytes like this: item 6 key (257 EXTENT_DATA 0) itemoff 15816 itemsize 53 generation 7 type 1 (regular) extent data disk byte 13631488 nr 32768 extent data offset 0 nr 4096 ram 4096 extent compression 0 (none) Thankfully kernel can handle them properly, as in that case ram_bytes is not utilized at all. [ENHANCEMENT] Since the hiccup is not going to cause any data-loss and is only a minor violation of on-disk format, here we only need to ignore the incorrect ram_bytes value, and use the correct one from btrfs_file_extent_item::disk_num_bytes. Reviewed-by: Filipe Manana Signed-off-by: Qu Wenruo Signed-off-by: David Sterba fs/btrfs/file-item.c | 7 +++++++ 1 file changed, 7 insertions(+) commit 0edeb6ea46aac9fdd95c6b0990b0359cc7ca5cc1 Author: Qu Wenruo Date: Tue Jun 25 13:25:17 2024 +0930 btrfs: cleanup the bytenr usage inside btrfs_extent_item_to_extent_map() [HICCUP] Before commit 85de2be7129c ("btrfs: remove extent_map::block_start member"), we utilized @bytenr variable inside btrfs_extent_item_to_extent_map() to calculate block_start. But that commit removed block_start completely, we have no need to advance @bytenr at all. [ENHANCEMENT] - Rename @bytenr as @disk_bytenr - Only declare @disk_bytenr inside the if branch - Make @disk_bytenr const and remove the modification on it Reviewed-by: Filipe Manana Signed-off-by: Qu Wenruo Signed-off-by: David Sterba fs/btrfs/file-item.c | 9 ++++----- 1 file changed, 4 insertions(+), 5 deletions(-) commit 0102ab54e497c8dc6f9d9588aca16500207fdfce Author: Mark Harmstone Date: Thu Jun 20 16:04:51 2024 +0100 btrfs: fix typo in error message in btrfs_validate_super() There's a typo in an error message when checking the block group tree feature, it mentions fres-space-tree instead of free-space-tree. Fix that. Signed-off-by: Mark Harmstone Reviewed-by: David Sterba Signed-off-by: David Sterba fs/btrfs/disk-io.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 9aa29a20b70097213d10e03a452366ceea72fc02 Author: Filipe Manana Date: Tue Jun 25 15:52:28 2024 +0100 btrfs: move the direct IO code into its own file The direct IO code is over a thousand lines and it's currently spread between file.c and inode.c, which makes it not easy to locate some parts of it sometimes. Also inode.c is about 11 thousand lines and file.c about 4 thousand lines, both too big. So move all the direct IO code into a dedicated file, so that it's easy to locate all its code and reduce the sizes of inode.c and file.c. This is a pure move of code without any other changes except export a a couple functions from inode.c (get_extent_allocation_hint() and create_io_em()) because they are used in inode.c and the new direct-io.c file, and a couple functions from file.c (btrfs_buffered_write() and btrfs_write_check()) because they are used both in file.c and in the new direct-io.c file. Reviewed-by: Boris Burkov Reviewed-by: Qu Wenruo Signed-off-by: Filipe Manana Signed-off-by: David Sterba fs/btrfs/Makefile | 2 +- fs/btrfs/btrfs_inode.h | 9 +- fs/btrfs/direct-io.c | 1052 ++++++++++++++++++++++++++++++++++++++++++++++++ fs/btrfs/direct-io.h | 14 + fs/btrfs/file.c | 287 +------------ fs/btrfs/file.h | 2 + fs/btrfs/inode.c | 784 +----------------------------------- fs/btrfs/super.c | 4 + 8 files changed, 1095 insertions(+), 1059 deletions(-) commit 0d9b7e166aef9f6d6dc574155cce293a2b6bf190 Author: David Sterba Date: Mon Jan 31 19:16:41 2022 +0100 btrfs: pass a btrfs_inode to btrfs_set_prop() Pass a struct btrfs_inode to btrfs_set_prop() as it's an internal interface, allowing to remove some use of BTRFS_I. Reviewed-by: Boris Burkov Signed-off-by: David Sterba fs/btrfs/ioctl.c | 8 ++++---- fs/btrfs/props.c | 14 +++++++------- fs/btrfs/props.h | 2 +- fs/btrfs/xattr.c | 2 +- 4 files changed, 13 insertions(+), 13 deletions(-) commit e2877c2a032d821ca339dc333401e0c63bf67d5c Author: David Sterba Date: Mon Jan 31 19:16:41 2022 +0100 btrfs: pass a btrfs_inode to btrfs_compress_heuristic() Pass a struct btrfs_inode to btrfs_compress_heuristic() as it's an internal interface, allowing to remove some use of BTRFS_I. Reviewed-by: Boris Burkov Signed-off-by: David Sterba fs/btrfs/compression.c | 4 ++-- fs/btrfs/compression.h | 2 +- fs/btrfs/inode.c | 2 +- 3 files changed, 4 insertions(+), 4 deletions(-) commit a1f4e3d7bd3bfa01d8b4be9b55c2af180f733ff1 Author: David Sterba Date: Mon Jan 31 18:57:43 2022 +0100 btrfs: switch btrfs_ordered_extent::inode to struct btrfs_inode The structure is internal so we should use struct btrfs_inode for that, allowing to remove some use of BTRFS_I. Reviewed-by: Boris Burkov Signed-off-by: David Sterba fs/btrfs/compression.c | 2 +- fs/btrfs/inode.c | 6 +++--- fs/btrfs/ordered-data.c | 22 +++++++++++----------- fs/btrfs/ordered-data.h | 2 +- fs/btrfs/relocation.c | 2 +- fs/btrfs/zoned.c | 6 +++--- 6 files changed, 20 insertions(+), 20 deletions(-) commit c154a8446bb75d541a23d040bbfcb8664328d972 Author: David Sterba Date: Mon Jan 31 18:53:32 2022 +0100 btrfs: switch btrfs_pending_snapshot::dir to btrfs_inode The structure is internal so we should use struct btrfs_inode for that. Reviewed-by: Boris Burkov Signed-off-by: David Sterba fs/btrfs/ioctl.c | 2 +- fs/btrfs/transaction.c | 2 +- fs/btrfs/transaction.h | 2 +- 3 files changed, 3 insertions(+), 3 deletions(-) commit 24e74598495d69350fa9590934bc15814fe4c471 Author: David Sterba Date: Mon Jan 31 18:49:41 2022 +0100 btrfs: pass a btrfs_inode to btrfs_ioctl_send() Pass a struct btrfs_inode to btrfs_ioctl_send() and _btrfs_ioctl_send() as it's an internal interface, allowing to remove some use of BTRFS_I. Reviewed-by: Boris Burkov Signed-off-by: David Sterba fs/btrfs/ioctl.c | 6 +++--- fs/btrfs/send.c | 4 ++-- fs/btrfs/send.h | 4 ++-- 3 files changed, 7 insertions(+), 7 deletions(-) commit e108c86b109268bffe26245570653328011f7581 Author: David Sterba Date: Mon Jan 31 18:46:17 2022 +0100 btrfs: switch btrfs_block_group::inode to struct btrfs_inode The structure is internal so we should use struct btrfs_inode for that. Reviewed-by: Boris Burkov Signed-off-by: David Sterba fs/btrfs/block-group.c | 4 ++-- fs/btrfs/block-group.h | 2 +- fs/btrfs/free-space-cache.c | 4 ++-- 3 files changed, 5 insertions(+), 5 deletions(-) commit 8610ba7eab8f8dc7d75cfc66ff5b1237c57239e2 Author: David Sterba Date: Wed Jun 15 15:03:11 2022 +0200 btrfs: pass a btrfs_inode to is_data_inode() Pass a struct btrfs_inode to is_data_inode() as it's an internal interface, allowing to remove some use of BTRFS_I. Reviewed-by: Boris Burkov Signed-off-by: David Sterba fs/btrfs/bio.c | 2 +- fs/btrfs/btrfs_inode.h | 4 ++-- fs/btrfs/extent_io.c | 2 +- fs/btrfs/subpage.c | 4 ++-- fs/btrfs/zoned.c | 2 +- 5 files changed, 7 insertions(+), 7 deletions(-) commit a0d7e98ced3e4c45284b268bc0867b51f0e093d6 Author: David Sterba Date: Wed Jun 15 15:03:11 2022 +0200 btrfs: pass a btrfs_inode to btrfs_readdir_get_delayed_items() Pass a struct btrfs_inode to btrfs_readdir_get_delayed_items() as it's an internal interface, allowing to remove some use of BTRFS_I. Reviewed-by: Boris Burkov Signed-off-by: David Sterba fs/btrfs/delayed-inode.c | 8 ++++---- fs/btrfs/delayed-inode.h | 2 +- fs/btrfs/inode.c | 2 +- 3 files changed, 6 insertions(+), 6 deletions(-) commit 849c01ae90efcf273a9c26e305d5d42862f8f3e8 Author: David Sterba Date: Wed Jun 15 15:11:38 2022 +0200 btrfs: pass a btrfs_inode to btrfs_readdir_put_delayed_items() Pass a struct btrfs_inode to btrfs_readdir_put_delayed_items() as it's an internal interface, allowing to remove some use of BTRFS_I. Reviewed-by: Boris Burkov Signed-off-by: David Sterba fs/btrfs/delayed-inode.c | 4 ++-- fs/btrfs/delayed-inode.h | 2 +- fs/btrfs/inode.c | 2 +- 3 files changed, 4 insertions(+), 4 deletions(-) commit 2422547e99f99f952d1a37f26b63289f749d5fcd Author: Johannes Thumshirn Date: Mon May 13 18:01:43 2024 +0200 btrfs: remove raid-stripe-tree encoding field from stripe_extent Remove the encoding field from 'struct btrfs_stripe_extent'. It was originally intended to encode the RAID type as well as if we're a data or a parity stripe. But the RAID type can be inferred form the block-group and the data vs. parity differentiation can be done easier with adding a new key type for parity stripes in the RAID stripe tree. Signed-off-by: Johannes Thumshirn Signed-off-by: David Sterba fs/btrfs/accessors.h | 3 --- fs/btrfs/print-tree.c | 5 ----- fs/btrfs/raid-stripe-tree.c | 13 ------------- fs/btrfs/raid-stripe-tree.h | 3 +-- fs/btrfs/tree-checker.c | 19 ------------------- include/uapi/linux/btrfs_tree.h | 14 +------------- 6 files changed, 2 insertions(+), 55 deletions(-) commit e2c1887329086148625fef5205719112ceb4a829 Author: Qu Wenruo Date: Mon Jun 24 14:28:54 2024 +0930 btrfs: print-tree: add generation and type dump for EXTENT_DATA_KEY When debugging the recent ram_bytes mismatch bug, I can hit it with enhanced tree-checker for file extent items at write time. But the bug is not that easy to trigger (mostly triggered with btrfs/06*, which uses 20 threads fsstress), and when I hit it, the only info is the kernel leaf dump, but it doesn't include things like the file extent type (REGULAR or PREALLOC). Add the dump for generation and type (although only numeric output) to make debugging a little easier. Signed-off-by: Qu Wenruo Reviewed-by: David Sterba Signed-off-by: David Sterba fs/btrfs/print-tree.c | 3 +++ 1 file changed, 3 insertions(+) commit 0e962e755b2684185ec37c75d91df56e076782ec Author: Boris Burkov Date: Wed Feb 14 11:29:50 2024 -0800 btrfs: urgent periodic reclaim pass Periodic reclaim attempts to avoid block_groups seeing active use with a sweep mark that gets cleared on allocation and set on a sweep. In urgent conditions where we have very little unallocated space (less than one chunk used by the threshold calculation for the unallocated target), we want to be able to override this mechanism. Introduce a second pass that only happens if we fail to find a reclaim candidate and reclaim is urgent. In that case, do a second pass where all block groups are eligible. Reviewed-by: Josef Bacik Signed-off-by: Boris Burkov Signed-off-by: David Sterba fs/btrfs/space-info.c | 35 ++++++++++++++++++++++++++++++++++- 1 file changed, 34 insertions(+), 1 deletion(-) commit 813d4c642251649352e9680e6278a1c02c0ebf95 Author: Boris Burkov Date: Wed Feb 14 11:25:50 2024 -0800 btrfs: prevent pathological periodic reclaim loops Periodic reclaim runs the risk of getting stuck in a state where it keeps reclaiming the same block group over and over. This can happen if 1. reclaiming that block_group fails 2. reclaiming that block_group fails to move any extents into existing block_groups and just allocates a fresh chunk and moves everything. Currently, 1. is a very tight loop inside the reclaim worker. That is critical for edge triggered reclaim or else we risk forgetting about a reclaimable group. On the other hand, with level triggered reclaim we can break out of that loop and get it later. With that fixed, 2. applies to both failures and "successes" with no progress. If we have done a periodic reclaim on a space_info and nothing has changed in that space_info, there is not much point to trying again, so don't, until enough space gets free, which we capture with a heuristic of needing to net free 1 chunk. Reviewed-by: Josef Bacik Signed-off-by: Boris Burkov Signed-off-by: David Sterba fs/btrfs/block-group.c | 12 ++++++++--- fs/btrfs/space-info.c | 56 ++++++++++++++++++++++++++++++++++++++++++-------- fs/btrfs/space-info.h | 14 +++++++++++++ 3 files changed, 71 insertions(+), 11 deletions(-) commit e4ca3932ae90a61c5d0252535f0bc15ce031a457 Author: Boris Burkov Date: Fri Feb 2 11:54:33 2024 -0800 btrfs: periodic block_group reclaim We currently employ a edge-triggered block group reclaim strategy which marks block groups for reclaim as they free down past a threshold. With a dynamic threshold, this is worse than doing it in a level-triggered fashion periodically. That is because the reclaim itself happens periodically, so the threshold at that point in time is what really matters, not the threshold at freeing time. If we mark the reclaim in a big pass, then sort by usage and do reclaim, we also benefit from a negative feedback loop preventing unnecessary reclaims as we crunch through the "best" candidates. Since this is quite a different model, it requires some additional support. The edge triggered reclaim has a good heuristic for not reclaiming fresh block groups, so we need to replace that with a typical GC sweep mark which skips block groups that have seen an allocation since the last sweep. Reviewed-by: Josef Bacik Signed-off-by: Boris Burkov Signed-off-by: David Sterba fs/btrfs/block-group.c | 2 ++ fs/btrfs/block-group.h | 1 + fs/btrfs/space-info.c | 51 ++++++++++++++++++++++++++++++++++++++++++++++++++ fs/btrfs/space-info.h | 7 +++++++ fs/btrfs/sysfs.c | 34 +++++++++++++++++++++++++++++++++ 5 files changed, 95 insertions(+) commit f5ff64ccf7bb7274ed66b0d835b2f6ae10af5d7a Author: Boris Burkov Date: Fri Feb 2 11:52:16 2024 -0800 btrfs: dynamic block_group reclaim threshold We can currently recover allocated block_groups by: - explicitly starting balance operations - "auto reclaim" via bg_reclaim_threshold The latter works by checking against a fixed threshold on frees. If we pass from above the threshold to below, relocation triggers and the block group will get reclaimed by the cleaner thread (assuming it is still eligible) Picking a threshold is challenging. Too high, and you end up trying to reclaim very full block_groups which is quite costly, and you don't do reclaim on block_groups that don't get quite THAT full, but could still be quite fragmented and stranding a lot of space. Too low, and you similarly miss out on reclaim even if you badly need it to avoid running out of unallocated space, if you have heavily fragmented block groups living above the threshold. No matter the threshold, it suffers from a workload that happens to bounce around that threshold, which can introduce arbitrary amounts of reclaim waste. To improve this situation, introduce a dynamic threshold. The basic idea behind this threshold is that it should be very lax when there is plenty of unallocated space, and increasingly aggressive as we approach zero unallocated space. To that end, it sets a target for unallocated space (10 chunks) and then linearly increases the threshold as the amount of space short of the target we are increases. The formula is: (target - unalloc) / target I tested this by running it on three interesting workloads: 1. bounce allocations around X% full. 2. fill up all the way and introduce full fragmentation. 3. write in a fragmented way until the filesystem is just about full. 1. and 2. attack the weaknesses of a fixed threshold; fixed either works perfectly or fully falls apart, depending on the threshold. Dynamic always handles these cases well. 3. attacks dynamic by checking whether it is too zealous to reclaim in conditions with low unallocated and low unused. It tends to claw back 1GiB of unallocated fairly aggressively, but not much more. Early versions of dynamic threshold struggled on this test. Additional work could be done to intelligently ratchet up the urgency of reclaim in very low unallocated conditions. Existing mechanisms are already useless in that case anyway. Reviewed-by: Josef Bacik Signed-off-by: Boris Burkov Signed-off-by: David Sterba fs/btrfs/block-group.c | 18 +++---- fs/btrfs/space-info.c | 127 ++++++++++++++++++++++++++++++++++++++++++------- fs/btrfs/space-info.h | 8 ++++ fs/btrfs/sysfs.c | 43 ++++++++++++++++- 4 files changed, 169 insertions(+), 27 deletions(-) commit 42f620aec182f62ee72e3fce41cb3353951b3508 Author: Boris Burkov Date: Fri Feb 2 11:52:57 2024 -0800 btrfs: store fs_info in space_info This is handy when computing space_info dynamic reclaim thresholds where we do not have access to a block group. We could add it to the various functions as a parameter, but it seems reasonable for space_info to have an fs_info pointer. Reviewed-by: Josef Bacik Reviewed-by: Johannes Thumshirn Signed-off-by: Boris Burkov Reviewed-by: David Sterba Signed-off-by: David Sterba fs/btrfs/space-info.c | 1 + fs/btrfs/space-info.h | 1 + 2 files changed, 2 insertions(+) commit 243192b6764990e7fa0e22ea65b4d12f3294471c Author: Boris Burkov Date: Thu Jan 25 14:10:30 2024 -0800 btrfs: report reclaim stats in sysfs When evaluating various reclaim strategies/thresholds against each other, it is useful to collect data about the amount of reclaim happening. Expose a count, error count, and byte count via sysfs per space_info. Note that this is only for automatic reclaim, not manually invoked balances or other codepaths that use "relocate_block_group" Reviewed-by: Josef Bacik Reviewed-by: Johannes Thumshirn Signed-off-by: Boris Burkov Reviewed-by: David Sterba Signed-off-by: David Sterba fs/btrfs/block-group.c | 10 ++++++++++ fs/btrfs/space-info.h | 18 ++++++++++++++++++ fs/btrfs/sysfs.c | 6 ++++++ 3 files changed, 34 insertions(+) commit a5b3abb18c380177d3a994d30a2ab890f27b8df8 Author: David Sterba Date: Wed May 22 18:26:18 2024 +0200 btrfs: qgroup: warn about inconsistent qgroups when relation update fails Calling btrfs_handle_fs_error() after btrfs_run_qgroups() fails to update the qgroup status is probably not necessary, this would turn the filesystem to read-only. For the same reason aborting the transaction is also not a good option. The state is left inconsistent and can be fixed by rescan, printing a warning should be sufficient. Return code reflects the status of adding/deleting the relation and if the transaction was ended properly. Reviewed-by: Qu Wenruo Signed-off-by: David Sterba fs/btrfs/ioctl.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) commit 4addc1ffd67ad34394674dc91379dc04cfdd2537 Author: David Sterba Date: Wed May 22 18:17:05 2024 +0200 btrfs: qgroup: preallocate memory before adding a relation There's a transaction joined in the qgroup relation add/remove ioctl and any error will lead to abort/error. We could lift the allocation from btrfs_add_qgroup_relation() and move it outside of the transaction context. The relation deletion does not need that. The ownership of the structure is moved to the add relation handler. Reviewed-by: Qu Wenruo Signed-off-by: David Sterba fs/btrfs/ioctl.c | 17 ++++++++++++++++- fs/btrfs/qgroup.c | 25 ++++++++----------------- fs/btrfs/qgroup.h | 11 ++++++++++- 3 files changed, 34 insertions(+), 19 deletions(-) commit 7733b8dd189a9e525c2d53bdd4efb26e04a8d737 Author: David Sterba Date: Wed May 22 17:52:38 2024 +0200 btrfs: abort transaction on errors in btrfs_free_chunk() The errors during removing a chunk item are fatal, we expect to have a matching item in the chunk map from which the chunk_offset is taken. Handle that by transaction abort. Reviewed-by: Qu Wenruo Signed-off-by: David Sterba fs/btrfs/volumes.c | 15 +++++++++------ 1 file changed, 9 insertions(+), 6 deletions(-) commit b9878a89e93322931c3fd0b5e3e09645c899b619 Author: David Sterba Date: Wed May 22 17:35:41 2024 +0200 btrfs: only print error message when checking item size in print_extent_item() The extent item used to have a v0 that was removed in 6.6. There's a check for minimum expected size that could lead to btrfs_handle_fs_error() that would make the filesystem read-only. As we don't have v0 anymore (and haven't seen any reports in the deprecation period), handle this in a less intrusive way. Reviewed-by: Qu Wenruo Signed-off-by: David Sterba fs/btrfs/print-tree.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit f4f89477322295e0f0ea10aa3e617afe2a827fc5 Author: David Sterba Date: Wed May 22 17:28:10 2024 +0200 btrfs: abort transaction if we don't find extref in btrfs_del_inode_extref() When an extended ref is deleted we do a sanity check right before removing the item, if we can't find it then handle the error. This is done by btrfs_handle_fs_error() but this is from the time before we had the transaction abort infrastructure, so switch to that. The end result is the same, the error is reported and switched to read-only. We newly return the -ENOENT error code as this better represents what happened. Reviewed-by: Qu Wenruo Signed-off-by: David Sterba fs/btrfs/inode-item.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) commit eba1469f8f6a4c98d9cfdba2477fac82a2347c6c Author: Filipe Manana Date: Thu Jun 20 19:51:32 2024 +0100 btrfs: avoid allocating and running pointless delayed extent operations We always allocate a delayed extent op structure when allocating a tree block (except for log trees), but most of the time we don't need it as we only need to set the BTRFS_BLOCK_FLAG_FULL_BACKREF if we're dealing with a relocation tree and we only need to set the key of a tree block in a btrfs_tree_block_info structure if we are not using skinny metadata (feature enabled by default since btrfs-progs 3.18 and available as of kernel 3.10). In these cases, where we don't need neither to update flags nor to set the key, we only use the delayed extent op structure to set the tree block's level. This is a waste of memory and besides that, the memory allocation can fail and can add additional latency. Instead of using a delayed extent op structure to store the level of the tree block, use the delayed ref head to store it. This doesn't change the size of neither structure and helps us avoid allocating delayed extent ops structures when using the skinny metadata feature and there's no relocation going on. This also gets rid of a BUG_ON(). For example, for a fs_mark run, with 5 iterations, 8 threads and 100K files per iteration, before this patch there were 118109 allocations of delayed extent op structures and after it there were none. Reviewed-by: Boris Burkov Signed-off-by: Filipe Manana Signed-off-by: David Sterba fs/btrfs/delayed-ref.c | 9 +++++++- fs/btrfs/delayed-ref.h | 6 +++-- fs/btrfs/extent-tree.c | 63 ++++++++++++++++++++++---------------------------- 3 files changed, 39 insertions(+), 39 deletions(-) commit 33336c1805d3a03240afda0bfb8c8d20395fb1d3 Author: Boris Burkov Date: Thu Jun 20 10:33:10 2024 -0700 btrfs: preallocate ulist memory for qgroup rsv When qgroups are enabled, during data reservation, we allocate the ulist_nodes that track the exact reserved extents with GFP_ATOMIC unconditionally. This is unnecessary, and we can follow the model already employed by the struct extent_state we preallocate in the non qgroups case, which should reduce the risk of allocation failures with GFP_ATOMIC. Add a prealloc node to struct ulist which ulist_add will grab when it is present, and try to allocate it before taking the tree lock while we can still take advantage of a less strict gfp mask. The lifetime of that node belongs to the new prealloc field, until it is used, at which point it belongs to the ulist linked list. Reviewed-by: Qu Wenruo Reviewed-by: Filipe Manana Signed-off-by: Boris Burkov Reviewed-by: David Sterba Signed-off-by: David Sterba fs/btrfs/extent-io-tree.c | 4 ++++ fs/btrfs/extent_io.h | 5 +++++ fs/btrfs/ulist.c | 21 ++++++++++++++++++--- fs/btrfs/ulist.h | 2 ++ 4 files changed, 29 insertions(+), 3 deletions(-) commit 28cb13f29faf6290597b24b728dc3100c019356f Author: Filipe Manana Date: Tue Jun 18 12:15:01 2024 +0100 btrfs: don't BUG_ON() when 0 reference count at btrfs_lookup_extent_info() Instead of doing a BUG_ON() handle the error by returning -EUCLEAN, aborting the transaction and logging an error message. Reviewed-by: Qu Wenruo Signed-off-by: Filipe Manana Signed-off-by: David Sterba fs/btrfs/extent-tree.c | 24 ++++++++++++++++++++---- 1 file changed, 20 insertions(+), 4 deletions(-) commit 5c83b3beaee06aa88d4015408ac2d8bb35380b06 Author: Filipe Manana Date: Tue Jun 18 11:52:19 2024 +0100 btrfs: reduce nesting for extent processing at btrfs_lookup_extent_info() Instead of using an if-else statement when processing the extent item at btrfs_lookup_extent_info(), use a single if statement for the error case since it does a goto at the end and leave the success (expected) case following the if statement, reducing indentation and making the logic a bit easier to follow. Also make the if statement's condition as unlikely since it's not expected to ever happen, as it signals some corruption, making it clear and hint the compiler to generate more efficient code. Reviewed-by: Qu Wenruo Signed-off-by: Filipe Manana Signed-off-by: David Sterba fs/btrfs/extent-tree.c | 22 +++++++++------------- 1 file changed, 9 insertions(+), 13 deletions(-) commit c65967ac4d1668dfcb903215c8af128fa15f05d6 Author: Filipe Manana Date: Tue Jun 18 13:09:39 2024 +0100 btrfs: remove superfluous metadata check at btrfs_lookup_extent_info() If we didn't found an extent item with the initial btrfs_search_slot() call, it's pointless to test if the "metadata" variable is "true", because right after we check if the key type is BTRFS_METADATA_ITEM_KEY and that is the case only when "metadata" is set to "true". So remove the redundant check. Reviewed-by: Qu Wenruo Signed-off-by: Filipe Manana Signed-off-by: David Sterba fs/btrfs/extent-tree.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit b56329a782314fde5b61058e2a25097af7ccb675 Author: Filipe Manana Date: Tue Jun 18 15:55:16 2024 +0100 btrfs: replace BUG_ON() with error handling at update_ref_for_cow() Instead of a BUG_ON() just return an error, log an error message and abort the transaction in case we find an extent buffer belonging to the relocation tree that doesn't have the full backref flag set. This is unexpected and should never happen (save for bugs or a potential bad memory). Reviewed-by: Qu Wenruo Signed-off-by: Filipe Manana Reviewed-by: David Sterba Signed-off-by: David Sterba fs/btrfs/ctree.c | 12 ++++++++++-- 1 file changed, 10 insertions(+), 2 deletions(-) commit 716404e59a17f917b32c649a733c9a23e5d15ad4 Author: Filipe Manana Date: Tue Jun 18 15:21:50 2024 +0100 btrfs: simplify setting the full backref flag at update_ref_for_cow() We keep a "new_flags" variable only to keep track if we need to update the metadata extent's flags, and when we set BTRFS_BLOCK_FLAG_FULL_BACKREF in the variable, we do it in an inner scope. Then check in an outer scope if the variable is not 0 and if so call btrfs_set_disk_extent_flags(). The variable isn't used for anything else. This is somewhat confusing, so to make it more straightforward update the extent's flags where we are currently updating "new_flags" and remove the variable. Reviewed-by: Qu Wenruo Signed-off-by: Filipe Manana Signed-off-by: David Sterba fs/btrfs/ctree.c | 11 ++++------- 1 file changed, 4 insertions(+), 7 deletions(-) commit 119474bdbac0858053cf367c8c932dd5c4bb4e85 Author: Filipe Manana Date: Tue Jun 18 08:28:30 2024 +0100 btrfs: remove NULL transaction support for btrfs_lookup_extent_info() There are no callers of btrfs_lookup_extent_info() that pass a NULL value for the transaction handle argument, so there's no point in having special logic to deal with the NULL. The last caller that passed a NULL value was removed in commit 19b546d7a1b2 ("btrfs: relocation: Use btrfs_find_all_leafs to locate data extent parent tree leaves"). So remove the NULL handling from btrfs_lookup_extent_info(). Reviewed-by: Qu Wenruo Signed-off-by: Filipe Manana Reviewed-by: David Sterba Signed-off-by: David Sterba fs/btrfs/extent-tree.c | 16 ++-------------- 1 file changed, 2 insertions(+), 14 deletions(-) commit d12765dc0242c94105e64eb54c30155dce46d873 Author: Filipe Manana Date: Mon Jun 17 12:09:59 2024 +0100 btrfs: use label to deduplicate error path at btrfs_force_cow_block() At btrfs_force_cow_block() we have several error paths that need to unlock the "cow" extent buffer, drop the reference on it and then return an error. This is a bit verbose so add a label where we perform these tasks and make the error paths jump to that label. Signed-off-by: Filipe Manana Reviewed-by: David Sterba Signed-off-by: David Sterba fs/btrfs/ctree.c | 33 ++++++++++++--------------------- 1 file changed, 12 insertions(+), 21 deletions(-) commit bb3868033a4cccff7be57e9145f2117cbdc91c11 Author: Filipe Manana Date: Fri Jun 14 14:50:47 2024 +0100 btrfs: do not BUG_ON() when freeing tree block after error When freeing a tree block, at btrfs_free_tree_block(), if we fail to create a delayed reference we don't deal with the error and just do a BUG_ON(). The error most likely to happen is -ENOMEM, and we have a comment mentioning that only -ENOMEM can happen, but that is not true, because in case qgroups are enabled any error returned from btrfs_qgroup_trace_extent_post() (can be -EUCLEAN or anything returned from btrfs_search_slot() for example) can be propagated back to btrfs_free_tree_block(). So stop doing a BUG_ON() and return the error to the callers and make them abort the transaction to prevent leaking space. Syzbot was triggering this, likely due to memory allocation failure injection. Reported-by: syzbot+a306f914b4d01b3958fe@syzkaller.appspotmail.com Link: https://lore.kernel.org/linux-btrfs/000000000000fcba1e05e998263c@google.com/ Reviewed-by: Qu Wenruo Signed-off-by: Filipe Manana Reviewed-by: David Sterba Signed-off-by: David Sterba fs/btrfs/ctree.c | 53 ++++++++++++++++++++++++++++++++++++---------- fs/btrfs/extent-tree.c | 24 ++++++++++++--------- fs/btrfs/extent-tree.h | 8 +++---- fs/btrfs/free-space-tree.c | 10 ++++++--- fs/btrfs/ioctl.c | 6 +++++- fs/btrfs/qgroup.c | 6 ++++-- 6 files changed, 76 insertions(+), 31 deletions(-) commit b7519157655bba3f885a856c1ec8b6560b51e214 Author: Filipe Manana Date: Thu Jun 13 11:43:43 2024 +0100 btrfs: remove super block argument from btrfs_iget_locked() It's pointless to pass a super block argument to btrfs_iget_locked() because we always pass a root and from it we can get the super block through: root->fs_info->sb So remove the super block argument. Reviewed-by: Johannes Thumshirn Reviewed-by: Josef Bacik Reviewed-by: Qu Wenruo Signed-off-by: Filipe Manana Reviewed-by: David Sterba Signed-off-by: David Sterba fs/btrfs/inode.c | 7 +++---- 1 file changed, 3 insertions(+), 4 deletions(-) commit d383eb69eb239ebf2f219e32742081d03fd9ac56 Author: Filipe Manana Date: Thu Jun 13 11:41:38 2024 +0100 btrfs: remove super block argument from btrfs_iget_path() It's pointless to pass a super block argument to btrfs_iget_path() because we always pass a root and from it we can get the super block through: root->fs_info->sb So remove the super block argument. Reviewed-by: Johannes Thumshirn Reviewed-by: Josef Bacik Reviewed-by: Qu Wenruo Signed-off-by: Filipe Manana Reviewed-by: David Sterba Signed-off-by: David Sterba fs/btrfs/btrfs_inode.h | 4 ++-- fs/btrfs/free-space-cache.c | 3 +-- fs/btrfs/inode.c | 8 ++++---- 3 files changed, 7 insertions(+), 8 deletions(-) commit d13240dd0a2d13bce6039cc51990613b30d47bc4 Author: Filipe Manana Date: Thu Jun 13 11:36:26 2024 +0100 btrfs: remove super block argument from btrfs_iget() It's pointless to pass a super block argument to btrfs_iget() because we always pass a root and from it we can get the super block through: root->fs_info->sb So remove the super block argument. Reviewed-by: Johannes Thumshirn Reviewed-by: Josef Bacik Reviewed-by: Qu Wenruo Signed-off-by: Filipe Manana Reviewed-by: David Sterba Signed-off-by: David Sterba fs/btrfs/btrfs_inode.h | 2 +- fs/btrfs/defrag.c | 2 +- fs/btrfs/export.c | 4 ++-- fs/btrfs/inode.c | 13 ++++++------- fs/btrfs/ioctl.c | 3 +-- fs/btrfs/relocation.c | 4 ++-- fs/btrfs/send.c | 9 ++++----- fs/btrfs/super.c | 2 +- fs/btrfs/tree-log.c | 2 +- 9 files changed, 19 insertions(+), 22 deletions(-) commit 90df2c10a47eeed31efe62fb77ba61fef82956cb Author: Qu Wenruo Date: Mon Jun 10 06:32:07 2024 +0930 btrfs: subpage: remove the unused error bitmap dumping Since commit 2b2553f12355 ("btrfs: stop setting PageError in the data I/O path") btrfs no longer utilizes subpage error bitmaps anymore, but the commit forgot to remove the error bitmap in btrfs_subpage_dump_bitmap(), resulting in possible meaningless result for the error bitmap. Fix it by just removing the error bitmap dumping. Signed-off-by: Qu Wenruo Reviewed-by: David Sterba Signed-off-by: David Sterba fs/btrfs/subpage.c | 4 +--- 1 file changed, 1 insertion(+), 3 deletions(-) commit 87128f520a6b7573f8086f2c89b9381ee7e85e51 Author: Qu Wenruo Date: Mon Jun 10 06:22:56 2024 +0930 btrfs: uapi: record temporary super flags used by btrfstune [BUG] There is a bug report that a canceled checksum conversion (still experimental feature) results in unexpected super block flags: csum_type 0 (crc32c) csum_size 4 csum 0x14973811 [match] bytenr 65536 flags 0x1000000001 ( WRITTEN | CHANGING_FSID_V2 ) magic _BHRfS_M [match] While for a filesystem with ongoing checksum conversion it should have either CHANGING_DATA_CSUM or CHANGING_META_CSUM. [CAUSE] It turns out that, due to btrfs-progs keeps its own extra flags inside its own ctree.h headers, not the shared uapi headers, we have conflicting super flags: kernel-shared/uapi/btrfs_tree.h:#define BTRFS_SUPER_FLAG_METADUMP_V2 (1ULL << 34) kernel-shared/uapi/btrfs_tree.h:#define BTRFS_SUPER_FLAG_CHANGING_FSID (1ULL << 35) kernel-shared/uapi/btrfs_tree.h:#define BTRFS_SUPER_FLAG_CHANGING_FSID_V2 (1ULL << 36) kernel-shared/ctree.h:#define BTRFS_SUPER_FLAG_CHANGING_DATA_CSUM (1ULL << 36) kernel-shared/ctree.h:#define BTRFS_SUPER_FLAG_CHANGING_META_CSUM (1ULL << 37) Note that CHANGING_FSID_V2 is conflicting with CHANGING_DATA_CSUM. [FIX] The proper fix would be done inside btrfs-progs, but to keep everything properly recorded, we should have everything inside the same uapi header. Copy all the new flags into uapi header, and change the value for CHANGING_DATA_CSUM and CHANGING_META_CSUM, while keep the value of CHANGING_BG_TREE untouched. Thankfully checksum change is still only experimental and all those CHANGING_* flags are transient (only for btrfs-progs to resume the conversion, and kernel will reject them all), the damage is still minor. Signed-off-by: Qu Wenruo Reviewed-by: David Sterba Signed-off-by: David Sterba include/uapi/linux/btrfs_tree.h | 8 ++++++++ 1 file changed, 8 insertions(+) commit 33b804fae7ad0d8890e6df827c287fadc9542f3f Author: Josef Bacik Date: Tue May 7 14:12:16 2024 -0400 btrfs: add documentation around snapshot delete Snapshot delete has some complicated looking code that is weirdly subtle at times. I've cleaned it up the best I can without re-writing it, but there are still a lot of details that are non-obvious. Add a bunch of comments to the main parts of the code to help future developers better understand the mechanics of snapshot deletion. Signed-off-by: Josef Bacik Reviewed-by: David Sterba Signed-off-by: David Sterba fs/btrfs/extent-tree.c | 51 ++++++++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 51 insertions(+) commit 5eb178f373b4f16f3b42d55ff88fc94dd95b93b1 Author: Josef Bacik Date: Tue May 7 14:12:15 2024 -0400 btrfs: handle errors from btrfs_dec_ref() properly In walk_up_proc() we BUG_ON(ret) from btrfs_dec_ref(). This is incorrect, we have proper error handling here, return the error. Signed-off-by: Josef Bacik Reviewed-by: David Sterba Signed-off-by: David Sterba fs/btrfs/extent-tree.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) commit f9c5b70c99ab6db06236d5ce337cf427aed32e49 Author: Josef Bacik Date: Tue May 7 14:12:14 2024 -0400 btrfs: convert correctness BUG_ON()'s to ASSERT()'s in walk_up_proc() In walk_up_proc() we have several sanity checks that should only trip if the programmer made a mistake. Convert these to ASSERT()'s instead of BUG_ON()'s. Signed-off-by: Josef Bacik Reviewed-by: David Sterba Signed-off-by: David Sterba fs/btrfs/extent-tree.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) commit b8ccef048354074a548f108e51d0557d6adfd3a3 Author: Josef Bacik Date: Tue May 7 14:12:13 2024 -0400 btrfs: clean up our handling of refs == 0 in snapshot delete In reada we BUG_ON(refs == 0), which could be unkind since we aren't holding a lock on the extent leaf and thus could get a transient incorrect answer. In walk_down_proc we also BUG_ON(refs == 0), which could happen if we have extent tree corruption. Change that to return -EUCLEAN. In do_walk_down() we catch this case and handle it correctly, however we return -EIO, which -EUCLEAN is a more appropriate error code. Finally in walk_up_proc we have the same BUG_ON(refs == 0), so convert that to proper error handling. Also adjust the error message so we can actually do something with the information. Signed-off-by: Josef Bacik Reviewed-by: David Sterba Signed-off-by: David Sterba fs/btrfs/extent-tree.c | 28 +++++++++++++++++++++++----- 1 file changed, 23 insertions(+), 5 deletions(-) commit 1f9d44c0a12730a24f8bb75c5e1102207413cc9b Author: Josef Bacik Date: Tue May 7 14:12:12 2024 -0400 btrfs: replace BUG_ON with ASSERT in walk_down_proc() We have a couple of areas where we check to make sure the tree block is locked before looking up or messing with references. This is old code so it has this as BUG_ON(). Convert this to ASSERT() for developers. Signed-off-by: Josef Bacik Reviewed-by: David Sterba Signed-off-by: David Sterba fs/btrfs/extent-tree.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) commit b4236703eb50d03db867ce080823f43c18257d80 Author: Josef Bacik Date: Tue May 7 14:12:11 2024 -0400 btrfs: handle errors from ref mods during UPDATE_BACKREF in walk_down_proc() We have blanket BUG_ON(ret) after every one of these reference mod attempts, which is just incorrect. If we encounter any errors during walk_down_tree() we will abort, so abort on any one of these failures. Signed-off-by: Josef Bacik Reviewed-by: David Sterba Signed-off-by: David Sterba fs/btrfs/extent-tree.c | 15 ++++++++++++--- 1 file changed, 12 insertions(+), 3 deletions(-) commit a580fb2c3479d993556e1c31b237c9e5be4944a3 Author: Josef Bacik Date: Tue May 7 14:12:10 2024 -0400 btrfs: don't BUG_ON on ENOMEM from btrfs_lookup_extent_info() in walk_down_proc() We handle errors here properly, ENOMEM isn't fatal, return the error. Signed-off-by: Josef Bacik Reviewed-by: David Sterba Signed-off-by: David Sterba fs/btrfs/extent-tree.c | 1 - 1 file changed, 1 deletion(-) commit acb9b4766cb2da41274189261810627149166d61 Author: Josef Bacik Date: Tue May 7 14:12:09 2024 -0400 btrfs: extract the reference dropping code into it's own helper This is a big chunk of code in do_walk_down() that will conditionally remove the reference for the child block we're currently evaluating. Extract it out into it's own helper and call that from do_walk_down() instead. Signed-off-by: Josef Bacik Reviewed-by: David Sterba Signed-off-by: David Sterba fs/btrfs/extent-tree.c | 157 +++++++++++++++++++++++++++---------------------- 1 file changed, 87 insertions(+), 70 deletions(-) commit 2b73c7e761c4912209bbd2baf6cf774a9cab8123 Author: Josef Bacik Date: Tue May 7 14:12:08 2024 -0400 btrfs: unify logic to decide if we need to walk down into a node during snapshot delete We currently duplicate the logic for walking into a node during snapshot delete. In one case it is during the actual delete, and in the other we use it for deciding if we should reada the block or not. Factor this code into it's own helper and comment fully what we're doing, and then update the two users to use the new helper. Signed-off-by: Josef Bacik Reviewed-by: David Sterba Signed-off-by: David Sterba fs/btrfs/extent-tree.c | 133 +++++++++++++++++++++++++++++++++---------------- 1 file changed, 89 insertions(+), 44 deletions(-) commit 4c4686d19dbaaaf46c5ac295e6e27580d514c4f5 Author: Josef Bacik Date: Tue May 7 14:12:07 2024 -0400 btrfs: remove local variable need_account in do_walk_down() We only set this if wc->refs[level - 1] > 1, and we check this way up above where we need it because the first thing we do before dropping our refs is reset wc->refs[level - 1] to 0. Reorder resetting of wc->refs to after our drop logic, and then remove the need_account variable and simply check wc->refs[level - 1] directly instead of using a variable. Signed-off-by: Josef Bacik Reviewed-by: David Sterba Signed-off-by: David Sterba fs/btrfs/extent-tree.c | 9 ++++----- 1 file changed, 4 insertions(+), 5 deletions(-) commit 562d425454e8b8ee628fafb15e88b0ef7ec371e6 Author: Josef Bacik Date: Tue May 7 14:12:06 2024 -0400 btrfs: factor out eb uptodate check from do_walk_down() do_walk_down() already has a bunch of things going on, and there's a bit of code related to reading in the next eb if we decide we need it. Move this code off into it's own helper to clean up do_walk_down() a little bit. Signed-off-by: Josef Bacik Reviewed-by: David Sterba Signed-off-by: David Sterba fs/btrfs/extent-tree.c | 65 ++++++++++++++++++++++++++++++++++---------------- 1 file changed, 45 insertions(+), 20 deletions(-) commit 7fcee18da46b51ca71a1ef82e1f2bc4bf7665870 Author: Josef Bacik Date: Tue May 7 14:12:05 2024 -0400 btrfs: push lookup_info into struct walk_control Instead of using a flag we're passing around everywhere, add a field to walk_control that we're already passing around everywhere and use that instead. Signed-off-by: Josef Bacik Reviewed-by: David Sterba Signed-off-by: David Sterba fs/btrfs/extent-tree.c | 22 ++++++++++++---------- 1 file changed, 12 insertions(+), 10 deletions(-) commit 3fdf5798fa379c36d068090d026d18dd6dfc5b6c Author: Josef Bacik Date: Tue May 7 14:12:04 2024 -0400 btrfs: use btrfs_read_extent_buffer() in do_walk_down() Currently if our extent buffer isn't uptodate we will drop the lock, free it, and then call read_tree_block() for the bytenr. This is inefficient, we already have the extent buffer, we can simply call btrfs_read_extent_buffer(). Merge these two cases down into one if statement, if we are not uptodate we can drop the lock, trigger readahead, and do the read using btrfs_read_extent_buffer(), and carry on. Signed-off-by: Josef Bacik Reviewed-by: David Sterba Signed-off-by: David Sterba fs/btrfs/extent-tree.c | 15 ++++----------- 1 file changed, 4 insertions(+), 11 deletions(-) commit 133b3da83539bd04e97e24cbc8693a1cdca4b5ec Author: Josef Bacik Date: Tue May 7 14:12:03 2024 -0400 btrfs: remove all extra btrfs_check_eb_owner() calls Currently we have a handful of btrfs_check_eb_owner() calls in various places and helpers that read extent buffers. However we call this in the endio handler for every metadata block, so these extra checks are unnecessary, simply remove them from everywhere except the endio handler. Reviewed-by: Qu Wenruo Signed-off-by: Josef Bacik Reviewed-by: David Sterba Signed-off-by: David Sterba fs/btrfs/ctree.c | 7 +------ fs/btrfs/disk-io.c | 4 ---- 2 files changed, 1 insertion(+), 10 deletions(-) commit 58147d5a7072dbf5f392ad8b2d5328b105e0e48d Author: Josef Bacik Date: Tue May 7 14:12:02 2024 -0400 btrfs: don't do extra find_extent_buffer() in do_walk_down() We do find_extent_buffer(), and then if we don't find the eb in cache we call btrfs_find_create_tree_block(), which calls find_extent_buffer() first and then allocates the extent buffer. The reason we're doing this is because if we don't find the extent buffer in cache we set reada = 1. However this doesn't matter, because lower down we only trigger reada if !btrfs_buffer_uptodate(eb), which is what the case would be if we didn't find the extent buffer in cache and had to allocate it. Clean this up to simply call btrfs_find_create_tree_block(), and then use the fact that we're having to read the extent buffer off of disk to go ahead and kick off readahead. Reviewed-by: Qu Wenruo Signed-off-by: Josef Bacik Reviewed-by: David Sterba Signed-off-by: David Sterba fs/btrfs/extent-tree.c | 16 ++++++---------- 1 file changed, 6 insertions(+), 10 deletions(-) commit 45c4102f0d827e00ce6ca107a7cb158265d706da Author: Filipe Manana Date: Tue Jun 11 11:44:33 2024 +0100 btrfs: avoid transaction commit on any fsync after subvolume creation As of commit 1b53e51a4a8f ("btrfs: don't commit transaction for every subvol create") we started to make any fsync after creating a subvolume to fallback to a transaction commit if the fsync is performed in the same transaction that was used to create the subvolume. This happens with the following at ioctl.c:create_subvol(): $ cat fs/btrfs/ioctl.c (...) /* Tree log can't currently deal with an inode which is a new root. */ btrfs_set_log_full_commit(trans); (...) Note that the comment is misleading as the problem is not that fsync can not deal with the root inode of a new root, but that we can not log any inode that belongs to a root that was not yet persisted because that would make log replay fail since the root doesn't exist at log replay time. The above simply makes any fsync fallback to a full transaction commit if it happens in the same transaction used to create the subvolume - even if it's an inode that belongs to any other subvolume. This is a brute force solution and it doesn't necessarily improve performance for every workload out there - it just moves a full transaction commit from one place, the subvolume creation, to another - an fsync for any inode. Just improve on this by making the fallback to a transaction commit only for an fsync against an inode of the new subvolume, or for the directory that contains the dentry that points to the new subvolume (in case anyone attempts to fsync the directory in the same transaction). Reviewed-by: Josef Bacik Signed-off-by: Filipe Manana Signed-off-by: David Sterba fs/btrfs/ioctl.c | 4 ++-- fs/btrfs/tree-log.c | 27 +++++++++++++++++++++++++++ fs/btrfs/tree-log.h | 2 ++ 3 files changed, 31 insertions(+), 2 deletions(-) commit ebc7c7678eb04b739544d9caaa0a4797adb24392 Author: Filipe Manana Date: Thu Jun 6 09:20:18 2024 +0100 btrfs: remove pointless code when creating and deleting a subvolume When creating and deleting a subvolume, after starting a transaction we are explicitly calling btrfs_record_root_in_trans() for the root which we passed to btrfs_start_transaction(). This is pointless because at transaction.c:start_transaction() we end up doing that call, regardless of whether we actually start a new transaction or join an existing one, and if we were not it would mean the root item of that root would not be updated in the root tree when committing the transaction, leading to problems easy to spot with fstests for example. Remove these redundant calls. They were introduced with commit 74e97958121a ("btrfs: qgroup: fix qgroup prealloc rsv leak in subvolume operations"). Reviewed-by: Boris Burkov Signed-off-by: Filipe Manana Signed-off-by: David Sterba fs/btrfs/inode.c | 5 ----- fs/btrfs/ioctl.c | 3 --- 2 files changed, 8 deletions(-) commit 6d81df75af5a5cfb8bfc0a17cd3e43cb927216ab Author: Johannes Thumshirn Date: Wed Jun 5 16:45:48 2024 +0200 btrfs: pass reloc_control to setup_relocation_extent_mapping() All parameters passed into setup_relocation_extent_mapping() can be derived from 'struct reloc_control', so only pass in a 'struct reloc_control'. Reviewed-by: Josef Bacik Signed-off-by: Johannes Thumshirn Reviewed-by: David Sterba Signed-off-by: David Sterba fs/btrfs/relocation.c | 18 ++++++++++-------- 1 file changed, 10 insertions(+), 8 deletions(-) commit 60f3dabdbc07ec831175b3296b601ea9c46d13a4 Author: Johannes Thumshirn Date: Wed Jun 5 16:15:21 2024 +0200 btrfs: pass a struct reloc_control to prealloc_file_extent_cluster() Pass a 'struct reloc_control' to prealloc_file_extent_cluster() instead of passing its members 'data_inode' and 'cluster' on their own. Reviewed-by: Josef Bacik Signed-off-by: Johannes Thumshirn Reviewed-by: David Sterba Signed-off-by: David Sterba fs/btrfs/relocation.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) commit 17a21d79149b2421120e2f2f8fd7e32f789ae6c7 Author: Johannes Thumshirn Date: Wed Jun 5 14:55:54 2024 +0200 btrfs: don't pass fs_info to describe_relocation() In describe_relocation() the fs_info is only needed for printing information via btrfs_info() and can easily be accessed via the passed in 'struct btrfs_block_group'. So we can safely remove the fs_info parameter. Reviewed-by: Josef Bacik Signed-off-by: Johannes Thumshirn Reviewed-by: David Sterba Signed-off-by: David Sterba fs/btrfs/relocation.c | 8 +++----- 1 file changed, 3 insertions(+), 5 deletions(-) commit 912eea7e24543661e77df1f1ccc05ea35c6ea029 Author: Johannes Thumshirn Date: Tue Jun 4 17:32:37 2024 +0200 btrfs: pass a reloc_control to relocate_one_folio() Pass a struct reloc_control to relocate_one_folio, instead of passing it's members data_inode and cluster as separate arguments to the function. Reviewed-by: Josef Bacik Signed-off-by: Johannes Thumshirn Reviewed-by: David Sterba Signed-off-by: David Sterba fs/btrfs/relocation.c | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-) commit 2e9e8dcdd5649690bf03dbbe8e652061f5512b8f Author: Johannes Thumshirn Date: Tue Jun 4 13:28:25 2024 +0200 btrfs: pass a reloc_control to relocate_file_extent_cluster() Instead of passing in a reloc_control's data_inode and file_extent_cluster members, pass in the whole reloc_control structure. Reviewed-by: Josef Bacik Signed-off-by: Johannes Thumshirn Reviewed-by: David Sterba Signed-off-by: David Sterba fs/btrfs/relocation.c | 14 +++++++------- 1 file changed, 7 insertions(+), 7 deletions(-) commit fa4adfc786891b4bfc28b44521585f3eb52bf72c Author: Johannes Thumshirn Date: Tue Jun 4 13:15:34 2024 +0200 btrfs: pass reloc_control to relocate_data_extent() Pass a 'struct reloc_control' to relocate_data_extent() instead of it's data_inode and file_extent_cluster separately. Reviewed-by: Josef Bacik Signed-off-by: Johannes Thumshirn Reviewed-by: David Sterba Signed-off-by: David Sterba fs/btrfs/relocation.c | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) commit 8b62f14d990213de8fb3b15d7fab18816314aab3 Author: Filipe Manana Date: Mon Jun 3 17:54:36 2024 +0100 btrfs: update panic message when splitting ordered extent During ordered extent splitting if we find a duplicated ordered extent when attempting to insert the new ordered extent we panic but with a message that has the "zoned:" prefix. This is because the splitting used to be exclusive for zoned filesystems, but as of commit b73a6fd1b1ef ("btrfs: split partial dio bios before submit") it can also be done for non zoned filesystems during direct IO writes. So remove the "zoned:" prefix from the message and mention the split to make it more specific and different from the panic message at insert_ordered_extent(). Reviewed-by: Josef Bacik Reviewed-by: Qu Wenruo Reviewed-by: Johannes Thumshirn Signed-off-by: Filipe Manana Reviewed-by: David Sterba Signed-off-by: David Sterba fs/btrfs/ordered-data.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit b7ac1acbdd1f3e84d566bdccfb0cf2d887ef55ce Author: Filipe Manana Date: Mon Jun 3 17:20:30 2024 +0100 btrfs: mark ordered extent insertion failure checks as unlikely We never expect an ordered extent insertion to fail due to already having another ordered extent in the tree for the same file offset, since we always wait for existing ordered extents in a range to complete before writing into the range again. So mark the failure checks for the results of tree_insert() as unlikely, to make it clear it's never expected (save exceptional causes like bugs or memory corruptions) and to serve as a hint for the compiler to possibly generate better code. Reviewed-by: Josef Bacik Reviewed-by: Qu Wenruo Reviewed-by: Johannes Thumshirn Signed-off-by: Filipe Manana Reviewed-by: David Sterba Signed-off-by: David Sterba fs/btrfs/ordered-data.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) commit cb3cd62454eab7ebf833aeb04ca7458c656d30cf Author: Filipe Manana Date: Mon Jun 3 17:02:26 2024 +0100 btrfs: avoid removal and re-insertion of split ordered extent At btrfs_split_ordered_extent(), we are removing and re-inserting the ordered extent that we are trimming, but we don't need to since the trimming doesn't change its position in the red black tree because we don't have overlapping ordered extents (that would imply double allocation of extents) and we know the split length is smaller than the ordered extent's num_bytes field (we checked that early in the function). So drop the remove and re-insert code for the slit ordered extent. Reviewed-by: Josef Bacik Reviewed-by: Qu Wenruo Reviewed-by: Johannes Thumshirn Signed-off-by: Filipe Manana Signed-off-by: David Sterba fs/btrfs/ordered-data.c | 20 ++++++-------------- 1 file changed, 6 insertions(+), 14 deletions(-) commit c18ca3c960171e0fb22e498dbf233e0cc521a31c Author: Filipe Manana Date: Mon Jun 3 16:50:31 2024 +0100 btrfs: add comment about locking to btrfs_split_ordered_extent() There are subtle details about why the root's ordered_extent_lock is held, so add a comment mentioning them. Reviewed-by: Josef Bacik Reviewed-by: Qu Wenruo Reviewed-by: Johannes Thumshirn Signed-off-by: Filipe Manana Reviewed-by: David Sterba Signed-off-by: David Sterba fs/btrfs/ordered-data.c | 17 +++++++++++++++++ 1 file changed, 17 insertions(+) commit ac1f580c10f31063ce9dae840d3499d41e3854ce Author: Filipe Manana Date: Mon Jun 3 13:30:35 2024 +0100 btrfs: reduce critical section at btrfs_wait_ordered_extents() At btrfs_wait_ordered_extents(), there's no point in updating the counters after locking the root's ordered extent lock, as the counters are local. So change this to update the counters before taking the lock. Reviewed-by: Josef Bacik Reviewed-by: Qu Wenruo Reviewed-by: Johannes Thumshirn Signed-off-by: Filipe Manana Reviewed-by: David Sterba Signed-off-by: David Sterba fs/btrfs/ordered-data.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 03103ecf5ec95743615113e5d2d8feb8d1a42859 Author: Filipe Manana Date: Mon Jun 3 13:25:00 2024 +0100 btrfs: reduce critical section at btrfs_wait_ordered_roots() At btrfs_wait_ordered_roots(), there's no point in decrementing the counter after locking fs_info->ordered_root_lock as the counter is local. So change this to decrement the counter before taking the lock. Reviewed-by: Josef Bacik Reviewed-by: Qu Wenruo Reviewed-by: Johannes Thumshirn Signed-off-by: Filipe Manana Reviewed-by: David Sterba Signed-off-by: David Sterba fs/btrfs/ordered-data.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) commit 2917f74102cf23afe770c1293aabce005f956b4f Author: David Sterba Date: Thu May 30 19:14:12 2024 +0200 btrfs: constify pointer parameters where applicable We can add const to many parameters, this is for clarity and minor addition to safety. There are some minor effects, in the assembly code and .ko measured on release config. This patch does not cover all possible conversions. Signed-off-by: David Sterba fs/btrfs/btrfs_inode.h | 4 ++-- fs/btrfs/delalloc-space.c | 2 +- fs/btrfs/delalloc-space.h | 2 +- fs/btrfs/delayed-inode.c | 6 +++--- fs/btrfs/delayed-inode.h | 6 +++--- fs/btrfs/dir-item.c | 8 ++++---- fs/btrfs/dir-item.h | 6 +++--- fs/btrfs/disk-io.c | 18 +++++++++--------- fs/btrfs/disk-io.h | 17 ++++++++--------- fs/btrfs/extent_io.c | 26 +++++++++++++------------- fs/btrfs/extent_io.h | 6 +++--- fs/btrfs/fs.h | 10 +++++----- fs/btrfs/ioctl.c | 2 +- fs/btrfs/ioctl.h | 2 +- fs/btrfs/misc.h | 4 ++-- fs/btrfs/props.c | 6 +++--- fs/btrfs/props.h | 2 +- fs/btrfs/qgroup.c | 22 +++++++++++----------- fs/btrfs/qgroup.h | 12 ++++++------ fs/btrfs/send.c | 2 +- fs/btrfs/send.h | 2 +- fs/btrfs/super.c | 4 ++-- fs/btrfs/super.h | 2 +- fs/btrfs/uuid-tree.c | 10 +++++----- fs/btrfs/uuid-tree.h | 4 ++-- fs/btrfs/volumes.c | 2 +- fs/btrfs/volumes.h | 2 +- fs/btrfs/xattr.c | 2 +- fs/btrfs/xattr.h | 2 +- fs/btrfs/zoned.c | 2 +- fs/btrfs/zoned.h | 4 ++-- 31 files changed, 99 insertions(+), 100 deletions(-) commit c27b1dbb713ad0d81f3bbd5ede92caaaedfd8947 Author: Qu Wenruo Date: Tue May 28 14:57:32 2024 +0930 btrfs: do not directly include rwlock_types.h There is already an error inside that header: #if !defined(__LINUX_SPINLOCK_TYPES_H) # error "Do not include directly, include spinlock_types.h" #endif Thankfully it never get triggered as some other headers have already included spinlock_types.h. However clangd would still do a proper warning on that if only extent_map.h is opened. Fix it by using spinlock_types.h instead. Reviewed-by: Filipe Manana Signed-off-by: Qu Wenruo Reviewed-by: David Sterba Signed-off-by: David Sterba fs/btrfs/extent_map.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 3b8dbf3425cfe3dcfdc026fcd7f8e1c0dd95b248 Author: Qu Wenruo Date: Tue May 28 14:56:13 2024 +0930 btrfs: cleanup recursive include of the same header We have several headers that are including themselves, triggering clangd warnings. Such includes are caused by commit 602035d7fecf ("btrfs: add forward declarations and headers, part 2"). Just remove such unnecessary include. Reviewed-by: Filipe Manana Signed-off-by: Qu Wenruo Reviewed-by: David Sterba Signed-off-by: David Sterba fs/btrfs/btrfs_inode.h | 1 - fs/btrfs/extent_map.h | 1 - fs/btrfs/fs.h | 1 - fs/btrfs/locking.h | 1 - fs/btrfs/lru_cache.h | 1 - 5 files changed, 5 deletions(-) commit a56b79523483c04862d478687d888038720a1bb4 Author: Junchao Sun Date: Tue May 28 14:23:43 2024 +0800 btrfs: qgroup: delete a TODO about using kmem cache to allocate structures Generic slab works fine allocating btrfs_qgroup_extent_record structures. It's not necessary to create a dedicated kmem cache that would be created but unused if quotas were not enabled. Let's delete the TODO line. Reviewed-by: Qu Wenruo Signed-off-by: Junchao Sun Reviewed-by: David Sterba Signed-off-by: David Sterba fs/btrfs/qgroup.h | 1 - 1 file changed, 1 deletion(-) commit a185373e53c6d22134c89be8508cfb5a491103c8 Author: Qu Wenruo Date: Tue Mar 5 17:27:58 2024 +1030 btrfs: make extent_write_locked_range() handle subpage writeback correctly When extent_write_locked_range() generated an inline extent, it would set and finish the writeback for the whole page. Although currently it's safe since subpage disables inline creation, for the sake of consistency, let it go with subpage helpers to set and clear the writeback flags. Reviewed-by: Josef Bacik Reviewed-by: Johannes Thumshirn Reviewed-by: Naohiro Aota Signed-off-by: Qu Wenruo Signed-off-by: David Sterba fs/btrfs/extent_io.c | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) commit 97713b1a2ced1e4a2a6c40045903797ebd44d7e0 Author: Qu Wenruo Date: Wed Mar 6 08:21:54 2024 +1030 btrfs: do not clear page dirty inside extent_write_locked_range() [BUG] For subpage + zoned case, the following workload can lead to rsv data leak at unmount time: # mkfs.btrfs -f -s 4k $dev # mount $dev $mnt # fsstress -w -n 8 -d $mnt -s 1709539240 0/0: fiemap - no filename 0/1: copyrange read - no filename 0/2: write - no filename 0/3: rename - no source filename 0/4: creat f0 x:0 0 0 0/4: creat add id=0,parent=-1 0/5: writev f0[259 1 0 0 0 0] [778052,113,965] 0 0/6: ioctl(FIEMAP) f0[259 1 0 0 224 887097] [1294220,2291618343991484791,0x10000] -1 0/7: dwrite - xfsctl(XFS_IOC_DIOINFO) f0[259 1 0 0 224 887097] return 25, fallback to stat() 0/7: dwrite f0[259 1 0 0 224 887097] [696320,102400] 0 # umount $mnt The dmesg includes the following rsv leak detection warning (all call trace skipped): ------------[ cut here ]------------ WARNING: CPU: 2 PID: 4528 at fs/btrfs/inode.c:8653 btrfs_destroy_inode+0x1e0/0x200 [btrfs] ---[ end trace 0000000000000000 ]--- ------------[ cut here ]------------ WARNING: CPU: 2 PID: 4528 at fs/btrfs/inode.c:8654 btrfs_destroy_inode+0x1a8/0x200 [btrfs] ---[ end trace 0000000000000000 ]--- ------------[ cut here ]------------ WARNING: CPU: 2 PID: 4528 at fs/btrfs/inode.c:8660 btrfs_destroy_inode+0x1a0/0x200 [btrfs] ---[ end trace 0000000000000000 ]--- BTRFS info (device sda): last unmount of filesystem 1b4abba9-de34-4f07-9e7f-157cf12a18d6 ------------[ cut here ]------------ WARNING: CPU: 3 PID: 4528 at fs/btrfs/block-group.c:4434 btrfs_free_block_groups+0x338/0x500 [btrfs] ---[ end trace 0000000000000000 ]--- BTRFS info (device sda): space_info DATA has 268218368 free, is not full BTRFS info (device sda): space_info total=268435456, used=204800, pinned=0, reserved=0, may_use=12288, readonly=0 zone_unusable=0 BTRFS info (device sda): global_block_rsv: size 0 reserved 0 BTRFS info (device sda): trans_block_rsv: size 0 reserved 0 BTRFS info (device sda): chunk_block_rsv: size 0 reserved 0 BTRFS info (device sda): delayed_block_rsv: size 0 reserved 0 BTRFS info (device sda): delayed_refs_rsv: size 0 reserved 0 ------------[ cut here ]------------ WARNING: CPU: 3 PID: 4528 at fs/btrfs/block-group.c:4434 btrfs_free_block_groups+0x338/0x500 [btrfs] ---[ end trace 0000000000000000 ]--- BTRFS info (device sda): space_info METADATA has 267796480 free, is not full BTRFS info (device sda): space_info total=268435456, used=131072, pinned=0, reserved=0, may_use=262144, readonly=0 zone_unusable=245760 BTRFS info (device sda): global_block_rsv: size 0 reserved 0 BTRFS info (device sda): trans_block_rsv: size 0 reserved 0 BTRFS info (device sda): chunk_block_rsv: size 0 reserved 0 BTRFS info (device sda): delayed_block_rsv: size 0 reserved 0 BTRFS info (device sda): delayed_refs_rsv: size 0 reserved 0 Above $dev is a tcmu-runner emulated zoned HDD, which has a max zone append size of 64K, and the system has 64K page size. [CAUSE] I have added several trace_printk() to show the events (header skipped): > btrfs_dirty_pages: r/i=5/259 dirty start=774144 len=114688 > btrfs_dirty_pages: r/i=5/259 dirty part of page=720896 off_in_page=53248 len_in_page=12288 > btrfs_dirty_pages: r/i=5/259 dirty part of page=786432 off_in_page=0 len_in_page=65536 > btrfs_dirty_pages: r/i=5/259 dirty part of page=851968 off_in_page=0 len_in_page=36864 The above lines show our buffered write has dirtied 3 pages of inode 259 of root 5: 704K 768K 832K 896K I |////I/////////////////I///////////| I 756K 868K |///| is the dirtied range using subpage bitmaps. and 'I' is the page boundary. Meanwhile all three pages (704K, 768K, 832K) have their PageDirty flag set. > btrfs_direct_write: r/i=5/259 start dio filepos=696320 len=102400 Then direct IO write starts, since the range [680K, 780K) covers the beginning part of the above dirty range, we need to writeback the two pages at 704K and 768K. > cow_file_range: r/i=5/259 add ordered extent filepos=774144 len=65536 > extent_write_locked_range: r/i=5/259 locked page=720896 start=774144 len=65536 Now the above 2 lines show that we're writing back for dirty range [756K, 756K + 64K). We only writeback 64K because the zoned device has max zone append size as 64K. > extent_write_locked_range: r/i=5/259 clear dirty for page=786432 !!! The above line shows the root cause. !!! We're calling clear_page_dirty_for_io() inside extent_write_locked_range(), for the page 768K. This is because extent_write_locked_range() can go beyond the current locked page, here we hit the page at 768K and clear its page dirt. In fact this would lead to the desync between subpage dirty and page dirty flags. We have the page dirty flag cleared, but the subpage range [820K, 832K) is still dirty. After the writeback of range [756K, 820K), the dirty flags look like this, as page 768K no longer has dirty flag set. 704K 768K 832K 896K I I | I/////////////| I 820K 868K This means we will no longer writeback range [820K, 832K), thus the reserved data/metadata space would never be properly released. > extent_write_cache_pages: r/i=5/259 skip non-dirty folio=786432 Now even though we try to start writeback for page 768K, since the page is not dirty, we completely skip it at extent_write_cache_pages() time. > btrfs_direct_write: r/i=5/259 dio done filepos=696320 len=0 Now the direct IO finished. > cow_file_range: r/i=5/259 add ordered extent filepos=851968 len=36864 > extent_write_locked_range: r/i=5/259 locked page=851968 start=851968 len=36864 Now we writeback the remaining dirty range, which is [832K, 868K). Causing the range [820K, 832K) never to be submitted, thus leaking the reserved space. This bug only affects subpage and zoned case. For non-subpage and zoned case, we have exactly one sector for each page, thus no such partial dirty cases. For subpage and non-zoned case, we never go into run_delalloc_cow(), and normally all the dirty subpage ranges would be properly submitted inside __extent_writepage_io(). [FIX] Just do not clear the page dirty at all inside extent_write_locked_range(). As __extent_writepage_io() would do a more accurate, subpage compatible clear for page and subpage dirty flags anyway. Now the correct trace would look like this: > btrfs_dirty_pages: r/i=5/259 dirty start=774144 len=114688 > btrfs_dirty_pages: r/i=5/259 dirty part of page=720896 off_in_page=53248 len_in_page=12288 > btrfs_dirty_pages: r/i=5/259 dirty part of page=786432 off_in_page=0 len_in_page=65536 > btrfs_dirty_pages: r/i=5/259 dirty part of page=851968 off_in_page=0 len_in_page=36864 The page dirty part is still the same 3 pages. > btrfs_direct_write: r/i=5/259 start dio filepos=696320 len=102400 > cow_file_range: r/i=5/259 add ordered extent filepos=774144 len=65536 > extent_write_locked_range: r/i=5/259 locked page=720896 start=774144 len=65536 And the writeback for the first 64K is still correct. > cow_file_range: r/i=5/259 add ordered extent filepos=839680 len=49152 > extent_write_locked_range: r/i=5/259 locked page=786432 start=839680 len=49152 Now with the fix, we can properly writeback the range [820K, 832K), and properly release the reserved data/metadata space. Reviewed-by: Johannes Thumshirn Signed-off-by: Qu Wenruo Signed-off-by: David Sterba fs/btrfs/extent_io.c | 4 +--- 1 file changed, 1 insertion(+), 3 deletions(-) commit d034cdb4cc8aea42f3c633dd514181c3fed2e7ec Author: Qu Wenruo Date: Sun Feb 18 17:09:32 2024 +1030 btrfs: lock subpage ranges in one go for writepage_delalloc() If we have a subpage range like this for a 16K page with 4K sectorsize: 0 4K 8K 12K 16K |/////| |//////| | |/////| = dirty range Currently writepage_delalloc() would go through the following steps: - lock range [0, 4K) - run delalloc range for [0, 4K) - lock range [8K, 12K) - run delalloc range for [8K 12K) So far it's fine for regular subpage writeback, as btrfs_run_delalloc_range() can only go into one of run_delalloc_nocow(), cow_file_range() and run_delalloc_compressed(). But there is a special case for zoned subpage, where we will go through run_delalloc_cow(), which would create the ordered extent for the range and immediately submit the range. This would unlock the whole page range, causing all kinds of different ASSERT()s related to locked page. Address the page unlocking problem of run_delalloc_cow(), by changing the workflow to the following one: - lock range [0, 4K) - lock range [8K, 12K) - run delalloc range for [0, 4K) - run delalloc range for [8K, 12K) So that run_delalloc_cow() can only unlock the full page until the last lock user released. To do that: - Utilize subpage locked bitmap So for every delalloc range we found, call btrfs_folio_set_writer_lock() to populate the subpage locked bitmap, and later btrfs_folio_end_all_writers() if the page is fully unlocked. So we know there is a delalloc range that needs to be run later. - Save the @delalloc_end as @last_delalloc_end inside writepage_delalloc() Since subpage locked bitmap is only for ranges inside the page, meanwhile we can have delalloc range ends beyond our page boundary, we have to save the @last_delalloc_end just in case it's beyond our page boundary. Although there is one extra point to notice: - We need to handle errors in previous iteration Since we can have multiple locked delalloc ranges we have to call run_delalloc_ranges() multiple times. If we hit an error half way, we still need to unlock the remaining ranges. Signed-off-by: Qu Wenruo Signed-off-by: David Sterba fs/btrfs/extent_io.c | 105 +++++++++++++++++++++++++++++++++++++++++++++++---- fs/btrfs/subpage.c | 6 +++ 2 files changed, 104 insertions(+), 7 deletions(-) commit bca707e54276de828a8cad82b723192374e73e00 Author: Qu Wenruo Date: Mon Feb 19 13:13:24 2024 +1030 btrfs: subpage: introduce helpers to handle subpage delalloc locking Three new helpers are introduced for the incoming subpage delalloc locking change. - btrfs_folio_set_writer_lock() This is to mark specified range with subpage specific writer lock. After calling this, the subpage range can be proper unlocked by btrfs_folio_end_writer_lock() - btrfs_subpage_find_writer_locked() This is to find the writer locked subpage range in a page. With the help of btrfs_folio_set_writer_lock(), it can allow us to record and find previously locked subpage range without extra memory allocation. - btrfs_folio_end_all_writers() This is for the locked_page of __extent_writepage(), as there may be multiple subpage delalloc ranges locked. Reviewed-by: Johannes Thumshirn Reviewed-by: Naohiro Aota Signed-off-by: Qu Wenruo Signed-off-by: David Sterba fs/btrfs/subpage.c | 118 +++++++++++++++++++++++++++++++++++++++++++++++++++++ fs/btrfs/subpage.h | 6 +++ 2 files changed, 124 insertions(+) commit 21b5bef20ef89795882f0b1bf5517fb283c16461 Author: Qu Wenruo Date: Fri Feb 16 14:33:41 2024 +1030 btrfs: make __extent_writepage_io() to write specified range only Function __extent_writepage_io() is designed to find all dirty ranges of a page, and add the dirty ranges to the bio_ctrl for submission. It requires all the dirtied ranges to be covered by an ordered extent. It gets called in two locations, but one call site is not subpage aware: - __extent_writepage() It gets called when writepage_delalloc() returned 0, which means writepage_delalloc() has handled delalloc for all subpage sectors inside the page. So this call site is OK. - extent_write_locked_range() This call site is utilized by zoned support, and in this case, we may only run delalloc range for a subset of the page, like this: (64K page size) 0 16K 32K 48K 64K |/////| |///////| | In the above case, if extent_write_locked_range() is only triggered for range [0, 16K), __extent_writepage_io() would still try to submit the dirty range of [32K, 48K), then it would not find any ordered extent for it and triggers various ASSERT()s. Fix this problem by: - Introducing @start and @len parameters to specify the range For the first call site, we just pass the whole page, and the behavior is not touched, since run_delalloc_range() for the page should have created all ordered extents for the page. For the second call site, we avoid touching anything beyond the range, thus avoiding the dirty range which is not yet covered by any delalloc range. - Making btrfs_folio_assert_not_dirty() subpage aware The only caller is inside __extent_writepage_io(), and since that caller now accepts a subpage range, we should also check the subpage range other than the whole page. Reviewed-by: Johannes Thumshirn Reviewed-by: Naohiro Aota Signed-off-by: Qu Wenruo Signed-off-by: David Sterba fs/btrfs/extent_io.c | 18 +++++++++++------- fs/btrfs/subpage.c | 22 ++++++++++++++++------ fs/btrfs/subpage.h | 3 ++- 3 files changed, 29 insertions(+), 14 deletions(-) commit 95359f63223c432bd0ed1f1d9180a823f19f0712 Author: Jeff Johnson Date: Mon May 27 10:56:59 2024 -0700 btrfs: add MODULE_DESCRIPTION() Fix the 'make W=1' warning: WARNING: modpost: missing MODULE_DESCRIPTION() in fs/btrfs/btrfs.o Signed-off-by: Jeff Johnson Reviewed-by: David Sterba Signed-off-by: David Sterba fs/btrfs/super.c | 1 + 1 file changed, 1 insertion(+) commit ca8ba2ccdcdec7ecdfd5f87e90a57055eb7685f7 Author: Anand Jain Date: Tue Mar 19 20:25:32 2024 +0530 btrfs: rename err to ret in btrfs_drop_snapshot() Drop the variable 'err', reuse the variable 'ret' by reinitializing it to zero where necessary. Signed-off-by: Anand Jain Reviewed-by: David Sterba Signed-off-by: David Sterba fs/btrfs/extent-tree.c | 51 +++++++++++++++++++++++++------------------------- 1 file changed, 26 insertions(+), 25 deletions(-) commit ced1b1bd214fab463f35438c63d9bc6b1a743cae Author: Anand Jain Date: Fri May 10 15:21:08 2024 +0800 btrfs: rename err to ret in btrfs_recover_relocation() Fix coding style: rename the return variable to 'ret' in the function btrfs_recover_relocation instead of 'err'. Signed-off-by: Anand Jain Reviewed-by: David Sterba Signed-off-by: David Sterba fs/btrfs/relocation.c | 56 +++++++++++++++++++++++++-------------------------- 1 file changed, 28 insertions(+), 28 deletions(-) commit bd0d9a619a870f8c6745d2b4f57508bc5106e282 Author: Anand Jain Date: Fri May 10 15:17:23 2024 +0800 btrfs: rename ret to ret2 in btrfs_recover_relocation() A preparatory patch to rename 'err' to 'ret', but ret is already used as an intermediary return value, so first rename 'ret' to 'ret2'. Signed-off-by: Anand Jain Reviewed-by: David Sterba Signed-off-by: David Sterba fs/btrfs/relocation.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) commit ba69f42af2a568f30904a11dc257eb892c5e8c0e Author: Anand Jain Date: Fri May 10 15:10:50 2024 +0800 btrfs: rename ret to err in btrfs_recover_relocation() In the function btrfs_recover_relocation(), currently the variable 'err' carries the return value and 'ret' holds the intermediary return value. However, in some lines, we don't need this two-step approach; we can directly use 'err'. So, optimize them, which requires reinitializing 'err' to zero at two locations. This is a preparatory patch to fix the code style by renaming 'err' to 'ret'. Signed-off-by: Anand Jain Reviewed-by: David Sterba Signed-off-by: David Sterba fs/btrfs/relocation.c | 28 +++++++++++----------------- 1 file changed, 11 insertions(+), 17 deletions(-) commit 53d6c0da0a6bb9f945e5b4bc88701e51e172a087 Author: Anand Jain Date: Tue Mar 19 20:25:09 2024 +0530 btrfs: rename err to ret in btrfs_cleanup_fs_roots() Since err represents the function return value, rename it as ret, and rename the original ret, which serves as a helper return value, to found. Also, optimize the code to continue call btrfs_put_root() for the rest of the root if even after btrfs_orphan_cleanup() returns error. Signed-off-by: Anand Jain Reviewed-by: David Sterba Signed-off-by: David Sterba fs/btrfs/disk-io.c | 37 +++++++++++++++++++------------------ 1 file changed, 19 insertions(+), 18 deletions(-) commit 04ef7631bfa5247dfce8f1858be6f0f76ff0e299 Author: Qu Wenruo Date: Fri May 3 13:07:26 2024 +0930 btrfs: cleanup duplicated parameters related to btrfs_create_dio_extent() The following 3 parameters can be cleaned up using btrfs_file_extent structure: - len btrfs_file_extent::num_bytes - orig_block_len btrfs_file_extent::disk_num_bytes - ram_bytes btrfs_file_extent::ram_bytes Reviewed-by: Johannes Thumshirn Reviewed-by: Filipe Manana Signed-off-by: Qu Wenruo Reviewed-by: David Sterba Signed-off-by: David Sterba fs/btrfs/inode.c | 21 +++++++-------------- 1 file changed, 7 insertions(+), 14 deletions(-) commit 9fec848b3a3343a1c680e26155aec26ae4866849 Author: Qu Wenruo Date: Fri May 3 13:02:00 2024 +0930 btrfs: cleanup duplicated parameters related to create_io_em() Most parameters of create_io_em() can be replaced by the members with the same name inside btrfs_file_extent. Do a direct parameters cleanup here. Reviewed-by: Johannes Thumshirn Reviewed-by: Filipe Manana Signed-off-by: Qu Wenruo Reviewed-by: David Sterba Signed-off-by: David Sterba fs/btrfs/inode.c | 55 +++++++++++++------------------------------------ fs/btrfs/ordered-data.c | 2 +- fs/btrfs/ordered-data.h | 2 +- 3 files changed, 16 insertions(+), 43 deletions(-) commit e9ea31fb5c1f90a006dccb6972664086447f4911 Author: Qu Wenruo Date: Fri May 3 12:49:57 2024 +0930 btrfs: cleanup duplicated parameters related to btrfs_alloc_ordered_extent All parameters after @filepos of btrfs_alloc_ordered_extent() can be replaced with btrfs_file_extent structure. This patch does the cleanup, meanwhile some points to note: - Move btrfs_file_extent structure to ordered-data.h The structure is needed by both btrfs_alloc_ordered_extent() and can_nocow_extent(), but since btrfs_inode.h includes ordered-data.h, so we need to move the structure to ordered-data.h. - Move the special handling of NOCOW/PREALLOC into btrfs_alloc_ordered_extent() This is to allow btrfs_split_ordered_extent() to properly split them for DIO. For now just move the handling into btrfs_alloc_ordered_extent() to simplify the callers. Reviewed-by: Johannes Thumshirn Reviewed-by: Filipe Manana Signed-off-by: Qu Wenruo Reviewed-by: David Sterba Signed-off-by: David Sterba fs/btrfs/btrfs_inode.h | 13 ------------ fs/btrfs/inode.c | 54 +++++++++---------------------------------------- fs/btrfs/ordered-data.c | 34 +++++++++++++++++++++++++------ fs/btrfs/ordered-data.h | 17 +++++++++++++--- 4 files changed, 52 insertions(+), 66 deletions(-) commit cdc627e65c7eb8d105f0b9e9695106e54eea1a6e Author: Qu Wenruo Date: Fri May 3 09:35:21 2024 +0930 btrfs: cleanup duplicated parameters related to can_nocow_file_extent_args The following functions and structures can be simplified using the btrfs_file_extent structure: - can_nocow_extent() No need to return ram_bytes/orig_block_len through the parameter list, the @file_extent parameter contains all the needed info. - can_nocow_file_extent_args The following members are no longer needed: * disk_bytenr This one is confusing as it's not really the btrfs_file_extent_item::disk_bytenr, but where the IO would be, thus it's file_extent::disk_bytenr + file_extent::offset now. * num_bytes Now file_extent::num_bytes. * extent_offset Now file_extent::offset. * disk_num_bytes Now file_extent::disk_num_bytes. Reviewed-by: Johannes Thumshirn Reviewed-by: Filipe Manana Signed-off-by: Qu Wenruo Reviewed-by: David Sterba Signed-off-by: David Sterba fs/btrfs/btrfs_inode.h | 3 +- fs/btrfs/file.c | 2 +- fs/btrfs/inode.c | 85 ++++++++++++++++++++++---------------------------- 3 files changed, 39 insertions(+), 51 deletions(-) commit c77a8c61002e91d859e118008fd495efbe1d9373 Author: Qu Wenruo Date: Tue Apr 30 07:53:06 2024 +0930 btrfs: remove extent_map::block_start member The member extent_map::block_start can be calculated from extent_map::disk_bytenr + extent_map::offset for regular extents. And otherwise just extent_map::disk_bytenr. And this is already validated by the validate_extent_map(). Now we can remove the member. However there is a special case in btrfs_create_dio_extent() where we for NOCOW/PREALLOC ordered extents cannot directly use the resulting btrfs_file_extent, as btrfs_split_ordered_extent() cannot handle them yet. So for that call site, we pass file_extent->disk_bytenr + file_extent->num_bytes as disk_bytenr for the ordered extent, and 0 for offset. Reviewed-by: Johannes Thumshirn Reviewed-by: Filipe Manana Signed-off-by: Qu Wenruo Reviewed-by: David Sterba Signed-off-by: David Sterba fs/btrfs/compression.c | 3 +- fs/btrfs/defrag.c | 9 ++-- fs/btrfs/extent_io.c | 10 ++-- fs/btrfs/extent_map.c | 53 ++++++--------------- fs/btrfs/extent_map.h | 22 ++++----- fs/btrfs/file-item.c | 4 -- fs/btrfs/file.c | 11 ++--- fs/btrfs/inode.c | 79 +++++++++++++++++-------------- fs/btrfs/relocation.c | 1 - fs/btrfs/tests/extent-map-tests.c | 48 +++++++------------ fs/btrfs/tests/inode-tests.c | 98 +++++++++++++++++++-------------------- fs/btrfs/tree-log.c | 20 ++++---- fs/btrfs/zoned.c | 4 +- include/trace/events/btrfs.h | 12 +---- 14 files changed, 165 insertions(+), 209 deletions(-) commit e28b851ed9b232c3b84cb8d0fedbdfa8ca881386 Author: Qu Wenruo Date: Tue Apr 30 07:53:05 2024 +0930 btrfs: remove extent_map::block_len member The extent_map::block_len is either extent_map::len (non-compressed extent) or extent_map::disk_num_bytes (compressed extent). Since we already have sanity checks to do the cross-checks between the new and old members, we can drop the old extent_map::block_len now. For most call sites, they can manually select extent_map::len or extent_map::disk_num_bytes, since most if not all of them have checked if the extent is compressed. Reviewed-by: Johannes Thumshirn Reviewed-by: Filipe Manana Signed-off-by: Qu Wenruo Reviewed-by: David Sterba Signed-off-by: David Sterba fs/btrfs/compression.c | 2 +- fs/btrfs/extent_map.c | 41 +++++++++++++-------------------------- fs/btrfs/extent_map.h | 9 --------- fs/btrfs/file-item.c | 7 ------- fs/btrfs/file.c | 1 - fs/btrfs/inode.c | 36 +++++++++++----------------------- fs/btrfs/relocation.c | 1 - fs/btrfs/tests/extent-map-tests.c | 41 +++++++++++++-------------------------- fs/btrfs/tree-log.c | 4 ++-- include/trace/events/btrfs.h | 5 +---- 10 files changed, 42 insertions(+), 105 deletions(-) commit 4aa7b5d1784f510c0f42afc1d74efb41947221d7 Author: Qu Wenruo Date: Tue Apr 30 07:53:04 2024 +0930 btrfs: remove extent_map::orig_start member Since we have extent_map::offset, the old extent_map::orig_start is just extent_map::start - extent_map::offset for non-hole/inline extents. And since the new extent_map::offset is already verified by validate_extent_map() while the old orig_start is not, let's just remove the old member from all call sites. Reviewed-by: Johannes Thumshirn Reviewed-by: Filipe Manana Signed-off-by: Qu Wenruo Reviewed-by: David Sterba Signed-off-by: David Sterba fs/btrfs/btrfs_inode.h | 2 +- fs/btrfs/compression.c | 2 +- fs/btrfs/defrag.c | 1 - fs/btrfs/extent_map.c | 21 +--------- fs/btrfs/extent_map.h | 9 ----- fs/btrfs/file-item.c | 5 +-- fs/btrfs/file.c | 3 +- fs/btrfs/inode.c | 37 ++++++----------- fs/btrfs/relocation.c | 1 - fs/btrfs/tests/extent-map-tests.c | 9 ----- fs/btrfs/tests/inode-tests.c | 84 +++++++++++++++++---------------------- fs/btrfs/tree-log.c | 2 +- include/trace/events/btrfs.h | 8 +--- 13 files changed, 57 insertions(+), 127 deletions(-) commit 3f255ece2f1e68d10f42050050b39b04d0376fb1 Author: Qu Wenruo Date: Tue Apr 30 07:53:03 2024 +0930 btrfs: introduce extra sanity checks for extent maps Since extent_map structure has the all the needed members to represent a file extent directly, we can apply all the file extent sanity checks to an extent map. The new sanity checks will cross check both the old members (block_start/block_len/orig_start) and the new members (disk_bytenr/disk_num_bytes/offset). There is a special case for offset/orig_start/start cross check, we only do such sanity check for compressed extent, as only compressed read/encoded write really utilize orig_start. This can be proved by the cleanup patch of orig_start. The checks happens at the following times: - add_extent_mapping() This is for newly added extent map - replace_extent_mapping() This is for btrfs_drop_extent_map_range() and split_extent_map() - try_merge_map() For a lot of call sites we have to properly populate all the members to pass the sanity check, meanwhile the following code needs extra modification: - setup_file_extents() from inode-tests The file extents layout of setup_file_extents() is already too invalid that tree-checker would reject most of them in real world. However there is just a special unaligned regular extent which has mismatched disk_num_bytes (4096) and ram_bytes (4096 - 1). So instead of dropping the whole test case, here we just unify disk_num_bytes and ram_bytes to 4096 - 1. - test_case_7() from extent-map-tests An extent is inserted with 16K length, but on-disk extent size is only 4K. This means it must be a compressed extent, so set the compressed flag for it. Reviewed-by: Johannes Thumshirn Reviewed-by: Filipe Manana Signed-off-by: Qu Wenruo Reviewed-by: David Sterba Signed-off-by: David Sterba fs/btrfs/extent_map.c | 59 +++++++++++++++++++++++++++++++++++++++ fs/btrfs/relocation.c | 4 +++ fs/btrfs/tests/extent-map-tests.c | 56 ++++++++++++++++++++++++++++++++++++- fs/btrfs/tests/inode-tests.c | 2 +- 4 files changed, 119 insertions(+), 2 deletions(-) commit 3d2ac9922465be5e8c9662eead70867159bf567d Author: Qu Wenruo Date: Tue Apr 30 07:53:02 2024 +0930 btrfs: introduce new members for extent_map Introduce two new members for extent_map: - disk_bytenr - offset Both are matching the members with the same name inside btrfs_file_extent_items. For now this patch only touches those members when: - Reading btrfs_file_extent_items from disk - Inserting new holes - Merging two extent maps With the new disk_bytenr and disk_num_bytes, doing merging would be a little more complex, as we have 3 different cases: * Both extent maps are referring to the same data extents |<----- data extent A ----->| |<- em 1 ->|<- em 2 ->| * Both extent maps are referring to different data extents |<-- data extent A -->|<-- data extent B -->| |<- em 1 ->|<- em 2 ->| * One of the extent maps is referring to a merged and larger data extent that covers both extent maps This is not really valid case other than some selftests. So this test case would be removed. A new helper merge_ondisk_extents() is introduced to handle the above valid cases. To properly assign values for those new members, a new btrfs_file_extent parameter is introduced to all the involved call sites. - For NOCOW writes the btrfs_file_extent would be exposed from can_nocow_file_extent(). - For other writes, the members can be easily calculated As most of them have 0 offset and utilizing the whole on-disk data extent. The exception is encoded write, but thankfully that interface provided offset directly and all other needed info. For now, both the old members (block_start/block_len/orig_start) are co-existing with the new members (disk_bytenr/offset), meanwhile all the critical code is still using the old members only. The cleanup will happen later after all the old and new members are properly validated. There would be some re-ordering for the assignment of the extent_map members, now we follow the new ordering: - start and len Or file_pos and num_bytes for other structures. - disk_bytenr and disk_num_bytes - offset and ram_bytes - compression So expect some seemingly unrelated line movement. Reviewed-by: Johannes Thumshirn Reviewed-by: Filipe Manana Signed-off-by: Qu Wenruo Reviewed-by: David Sterba Signed-off-by: David Sterba fs/btrfs/defrag.c | 4 +++ fs/btrfs/extent_map.c | 79 ++++++++++++++++++++++++++++++++++++++++++++++++--- fs/btrfs/extent_map.h | 17 +++++++++++ fs/btrfs/file-item.c | 9 +++++- fs/btrfs/file.c | 1 + fs/btrfs/inode.c | 57 +++++++++++++++++++++++++++++++++---- 6 files changed, 156 insertions(+), 11 deletions(-) commit 87a6962f73b1e5892d06987904e8f3827bf3ceec Author: Qu Wenruo Date: Tue Apr 30 07:53:01 2024 +0930 btrfs: export the expected file extent through can_nocow_extent() Currently function can_nocow_extent() only returns members needed for extent_map. However since we will soon change the extent_map structure to be more like btrfs_file_extent_item, we want to expose the expected file extent caused by the NOCOW write for future usage. This introduces a new structure, btrfs_file_extent, to be a more memory access friendly representation of btrfs_file_extent_item. And use that structure to expose the expected file extent caused by the NOCOW write. For now there is no user of the new structure yet. Reviewed-by: Johannes Thumshirn Reviewed-by: Filipe Manana Signed-off-by: Qu Wenruo Reviewed-by: David Sterba Signed-off-by: David Sterba fs/btrfs/btrfs_inode.h | 16 +++++++++++++++- fs/btrfs/file.c | 2 +- fs/btrfs/inode.c | 21 ++++++++++++++++++--- 3 files changed, 34 insertions(+), 5 deletions(-) commit e8fe524da027708793672e05fd4f17806855b0d8 Author: Qu Wenruo Date: Tue Apr 30 07:53:00 2024 +0930 btrfs: rename extent_map::orig_block_len to disk_num_bytes This would make it very obvious that the member just matches btrfs_file_extent_item::disk_num_bytes. Reviewed-by: Johannes Thumshirn Reviewed-by: Filipe Manana Signed-off-by: Qu Wenruo Reviewed-by: David Sterba Signed-off-by: David Sterba fs/btrfs/extent_map.c | 16 ++++++++-------- fs/btrfs/extent_map.h | 2 +- fs/btrfs/file-item.c | 4 ++-- fs/btrfs/file.c | 2 +- fs/btrfs/inode.c | 12 ++++++------ fs/btrfs/tree-log.c | 4 ++-- 6 files changed, 20 insertions(+), 20 deletions(-) commit 8996f61ab9ff06a1433a58dd67ea0bf6f91ba499 Author: Filipe Manana Date: Wed May 22 15:29:05 2024 +0100 btrfs: move fiemap code into its own file Currently the core of the fiemap code lives in extent_io.c, which does not make any sense because it's not related to extent IO at all (and it was not as well before the big rewrite of fiemap I did some time ago). The entry point for fiemap, btrfs_fiemap(), lives in inode.c since it's an inode operation. Since there's a significant amount of fiemap code, move all of it into a dedicated file, including its entry point inode.c:btrfs_fiemap(). Reviewed-by: Johannes Thumshirn Signed-off-by: Filipe Manana Reviewed-by: David Sterba Signed-off-by: David Sterba fs/btrfs/Makefile | 2 +- fs/btrfs/extent_io.c | 871 ----------------------------------------------- fs/btrfs/extent_io.h | 2 - fs/btrfs/fiemap.c | 930 +++++++++++++++++++++++++++++++++++++++++++++++++++ fs/btrfs/fiemap.h | 11 + fs/btrfs/inode.c | 52 +-- 6 files changed, 943 insertions(+), 925 deletions(-) commit f9763e4d150f22b18e79f1ef7ad2bee0059d02ff Author: Filipe Manana Date: Wed May 22 09:33:32 2024 +0100 btrfs: send: get rid of the label and gotos at ensure_commit_roots_uptodate() Now that there is a helper to commit the current transaction and we are using it, there's no need for the label and goto statements at ensure_commit_roots_uptodate(). So replace them with direct return statements that call btrfs_commit_current_transaction(). Reviewed-by: Josef Bacik Reviewed-by: Qu Wenruo Signed-off-by: Filipe Manana Reviewed-by: David Sterba Signed-off-by: David Sterba fs/btrfs/send.c | 12 ++---------- 1 file changed, 2 insertions(+), 10 deletions(-) commit ded980eb3fadd79f73a1254e6b26551c4d6c8ab9 Author: Filipe Manana Date: Wed May 22 09:26:44 2024 +0100 btrfs: add and use helper to commit the current transaction We have several places that attach to the current transaction with btrfs_attach_transaction_barrier() and then commit the transaction if there is one. Add a helper and use it to deduplicate this pattern. Reviewed-by: Josef Bacik Reviewed-by: Qu Wenruo Signed-off-by: Filipe Manana Reviewed-by: David Sterba Signed-off-by: David Sterba fs/btrfs/disk-io.c | 12 +----------- fs/btrfs/qgroup.c | 33 +++++---------------------------- fs/btrfs/scrub.c | 10 +--------- fs/btrfs/send.c | 10 +--------- fs/btrfs/space-info.c | 9 +-------- fs/btrfs/super.c | 11 +---------- fs/btrfs/transaction.c | 19 +++++++++++++++++++ fs/btrfs/transaction.h | 1 + 8 files changed, 30 insertions(+), 75 deletions(-) commit 1f8aee298908611e62a6b86241c7451ff19684a4 Author: Filipe Manana Date: Tue May 21 17:08:06 2024 +0100 btrfs: scrub: avoid create/commit empty transaction at finish_extent_writes_for_zoned() At finish_extent_writes_for_zoned() we use btrfs_join_transaction() to catch any running transaction and then commit it. This will however create a new and empty transaction in case there's no running transaction anymore (got committed by the transaction kthread or other task for example) or there's a running transaction finishing its commit and with a state >= TRANS_STATE_UNBLOCKED. In the former case we don't need to do anything while in the second case we just need to wait for the transaction to complete its commit. So improve this by using btrfs_attach_transaction_barrier() instead, which does not create a new transaction if there's none running, and if there's a current transaction that is committing, it will wait for it to fully commit and not create a new transaction. This helps avoiding creating and committing empty transactions, saving IO, time and unnecessary rotation of the backup roots in the super block. Reviewed-by: Josef Bacik Reviewed-by: Qu Wenruo Signed-off-by: Filipe Manana Reviewed-by: David Sterba Signed-off-by: David Sterba fs/btrfs/scrub.c | 10 +++++++--- 1 file changed, 7 insertions(+), 3 deletions(-) commit 0557feab7004b0366ac849b30eee6b589d8ccac6 Author: Filipe Manana Date: Tue May 21 11:57:37 2024 +0100 btrfs: send: avoid create/commit empty transaction at ensure_commit_roots_uptodate() At ensure_commit_roots_uptodate() we use btrfs_join_transaction() to catch any running transaction and then commit it. This will however create a new and empty transaction in case there's no running transaction anymore (got committed by the transaction kthread or other task for example) or there's a running transaction finishing its commit and with a state >= TRANS_STATE_UNBLOCKED. In the former case we don't need to do anything while in the second case we just need to wait for the transaction to complete its commit. So improve this by using btrfs_attach_transaction_barrier() instead, which does not create a new transaction if there's none running, and if there's a current transaction that is committing, it will wait for it to fully commit and not create a new transaction. This helps avoiding creating and committing empty transactions, saving IO, time and unnecessary rotation of the backup roots in the super block. Reviewed-by: Josef Bacik Reviewed-by: Qu Wenruo Signed-off-by: Filipe Manana Reviewed-by: David Sterba Signed-off-by: David Sterba fs/btrfs/send.c | 9 ++++++--- 1 file changed, 6 insertions(+), 3 deletions(-) commit 9e79c497f8a91c186fc4f4083640179df40446d2 Author: Filipe Manana Date: Tue May 21 11:20:54 2024 +0100 btrfs: send: make ensure_commit_roots_uptodate() simpler and more efficient Before starting a send operation we have to make sure that every root has its commit root matching the regular root, to that send doesn't find stale inodes in the commit root (inodes that were deleted in the regular root) and fails the inode lookups with -ESTALE. Currently we keep looking for roots used by the send operation and as soon as we find one we commit the current transaction (or a new one since btrfs_join_transaction() creates one if there isn't any running or the running one is in a state >= TRANS_STATE_UNBLOCKED). It's pointless to keep looking until we don't find any, because after the first transaction commit all the other roots are updated too, as they were already tagged in the fs_info->fs_roots_radix radix tree when they were modified in order to have a commit root different from the regular root. Currently we are also always passing the main send root into btrfs_join_transaction(), which despite not having any functional issue, it is not optimal because in case the root wasn't modified we end up adding it to fs_info->fs_roots_radix and then update its root item in the root tree when committing the transaction, causing unnecessary work. So simplify and make this more efficient by removing the looping and by passing the first root we found that is modified as the argument to btrfs_join_transaction(). Reviewed-by: Josef Bacik Reviewed-by: Qu Wenruo Signed-off-by: Filipe Manana Reviewed-by: David Sterba Signed-off-by: David Sterba fs/btrfs/send.c | 33 +++++++++++++++------------------ 1 file changed, 15 insertions(+), 18 deletions(-) commit cab0d8623fb4bd568531875e1511430958382b04 Author: Filipe Manana Date: Tue May 21 10:45:27 2024 +0100 btrfs: avoid create and commit empty transaction when committing super At btrfs_commit_super(), called in a few contexts such as when unmounting a filesystem, we use btrfs_join_transaction() to catch any running transaction and then commit it. This will however create a new and empty transaction in case there's no running transaction or there's a running transaction with a state >= TRANS_STATE_UNBLOCKED. As we just want to be sure that any existing transaction is fully committed, we can use btrfs_attach_transaction_barrier() instead of btrfs_join_transaction(), therefore avoiding the creation and commit of empty transactions, which only waste IO and causes rotation of the precious backup roots. Example where we create and commit a pointless empty transaction: $ mkfs.btrfs -f /dev/sdj $ btrfs inspect-internal dump-super /dev/sdj | grep -e '^generation' generation 6 $ mount /dev/sdj /mnt/sdj $ touch /mnt/sdj/foo # Commit the currently open transaction. Just 'sync' or wait ~30 # seconds for the transaction kthread to commit it. $ sync $ btrfs inspect-internal dump-super /dev/sdj | grep -e '^generation' generation 7 $ umount /mnt/sdj $ btrfs inspect-internal dump-super /dev/sdj | grep -e '^generation' generation 8 The transaction with id 8 was pointless, an empty transaction that did not achieve anything. Reviewed-by: Josef Bacik Reviewed-by: Qu Wenruo Signed-off-by: Filipe Manana Reviewed-by: David Sterba Signed-off-by: David Sterba fs/btrfs/disk-io.c | 10 +++++++--- 1 file changed, 7 insertions(+), 3 deletions(-) commit de18fba807c6b594d6ed13edf16726eb77237d32 Author: Filipe Manana Date: Mon May 20 13:21:12 2024 +0100 btrfs: qgroup: avoid start/commit empty transaction when flushing reservations When flushing reservations we are using btrfs_join_transaction() to get a handle for the current transaction and then commit it to try to release space. However btrfs_join_transaction() has some undesirable consequences: 1) If there's no running transaction, it will create one, and we will commit it right after. This is unnecessary because it will not release any space, and it will result in unnecessary IO and rotation of backup roots in the superblock; 2) If there's a current transaction and that transaction is committing (its state is >= TRANS_STATE_COMMIT_DOING), it will wait for that transaction to almost finish its commit (for its state to be >= TRANS_STATE_UNBLOCKED) and then start and return a new transaction. We will then commit that new transaction, which is pointless because all we wanted was to wait for the current (previous) transaction to fully finish its commit (state == TRANS_STATE_COMPLETED), and by starting and committing a new transaction we are wasting IO too and causing unnecessary rotation of backup roots in the superblock. So improve this by using btrfs_attach_transaction_barrier() instead, which does not create a new transaction if there's none running, and if there's a current transaction that is committing, it will wait for it to fully commit and not create a new transaction. Reviewed-by: Josef Bacik Reviewed-by: Qu Wenruo Signed-off-by: Filipe Manana Reviewed-by: David Sterba Signed-off-by: David Sterba fs/btrfs/qgroup.c | 12 +++++++----- 1 file changed, 7 insertions(+), 5 deletions(-) commit 42317ab440c110618b511290284c6d6c10bcffc7 Author: David Sterba Date: Tue May 14 16:48:12 2024 +0200 btrfs: simplify range parameters of btrfs_wait_ordered_roots() The range is specified only in two ways, we can simplify the case for the whole filesystem range as a NULL block group parameter. Signed-off-by: David Sterba fs/btrfs/dev-replace.c | 4 ++-- fs/btrfs/disk-io.c | 2 +- fs/btrfs/ioctl.c | 2 +- fs/btrfs/ordered-data.c | 28 +++++++++++++++++++++------- fs/btrfs/ordered-data.h | 4 ++-- fs/btrfs/qgroup.c | 4 ++-- fs/btrfs/relocation.c | 4 +--- fs/btrfs/scrub.c | 5 ++--- fs/btrfs/send.c | 4 ++-- fs/btrfs/space-info.c | 2 +- fs/btrfs/super.c | 2 +- fs/btrfs/transaction.c | 2 +- fs/btrfs/zoned.c | 3 +-- 13 files changed, 38 insertions(+), 28 deletions(-) commit 839d6ea4f86de1d2e36a1b02561b4ccd597643b9 Author: Qu Wenruo Date: Fri Apr 19 14:57:24 2024 +0930 btrfs: automatically remove the subvolume qgroup Currently if we fully clean a subvolume (not only delete its directory, but fully clean all it's related data and root item), the associated qgroup would not be removed. We have "btrfs qgroup clear-stale" to handle such 0 level qgroups. Change the behavior to automatically removie the qgroup of a fully cleaned subvolume when possible: - Full qgroup but still consistent We can and should remove the qgroup. The qgroup numbers should be 0, without any rsv. - Full qgroup but inconsistent Can happen with drop_subtree_threshold feature (skip accounting and mark qgroup inconsistent). We can and should remove the qgroup. Higher level qgroup numbers will be incorrect, but since qgroup is already inconsistent, it should not be a problem. - Squota mode This is the special case, we can only drop the qgroup if its numbers are all 0. This would be handled by can_delete_qgroup(), so we only need to check the return value and ignore the -EBUSY error. Link: https://bugzilla.suse.com/show_bug.cgi?id=1222847 Reviewed-by: Boris Burkov Signed-off-by: Qu Wenruo Reviewed-by: David Sterba Signed-off-by: David Sterba fs/btrfs/extent-tree.c | 8 ++++++++ fs/btrfs/qgroup.c | 35 +++++++++++++++++++++++++++++++++++ fs/btrfs/qgroup.h | 1 + 3 files changed, 44 insertions(+) commit a776bf5f3c2300cfdf8a195663460b1793ac9847 Author: Qu Wenruo Date: Fri Apr 19 14:29:32 2024 +0930 btrfs: slightly loosen the requirement for qgroup removal [BUG] Currently if one is utilizing "qgroups/drop_subtree_threshold" sysfs, and a snapshot with level higher than that value is dropped, we will not be able to delete the qgroup until next qgroup rescan: uuid=ffffffff-eeee-dddd-cccc-000000000000 wipefs -fa $dev mkfs.btrfs -f $dev -O quota -s 4k -n 4k -U $uuid mount $dev $mnt btrfs subvolume create $mnt/subv1/ for (( i = 0; i < 1024; i++ )); do xfs_io -f -c "pwrite 0 2k" $mnt/subv1/file_$i > /dev/null done sync btrfs subvolume snapshot $mnt/subv1 $mnt/snapshot btrfs quota enable $mnt btrfs quota rescan -w $mnt sync echo 1 > /sys/fs/btrfs/$uuid/qgroups/drop_subtree_threshold btrfs subvolume delete $mnt/snapshot btrfs subvolume sync $mnt btrfs qgroup show -prce --sync $mnt btrfs qgroup destroy 0/257 $mnt umount $mnt The final qgroup removal would fail with the following error: ERROR: unable to destroy quota group: Device or resource busy [CAUSE] The above script would generate a subvolume of level 2, then snapshot it, enable qgroup, set the drop_subtree_threshold, then drop the snapshot. Since the subvolume drop would meet the threshold, qgroup would be marked inconsistent and skip accounting to avoid hanging the system at transaction commit. But currently we do not allow a qgroup with any rfer/excl numbers to be dropped, and this is not really compatible with the new drop_subtree_threshold behavior. [FIX] Only require the strict zero rfer/excl/rfer_cmpr/excl_cmpr for squota mode. This is due to the fact that squota can never go inconsistent, and it can have dropped subvolume but with non-zero qgroup numbers for future accounting. For full qgroup mode, we only check if there is a subvolume for it. Reviewed-by: Boris Burkov Signed-off-by: Qu Wenruo Reviewed-by: David Sterba Signed-off-by: David Sterba fs/btrfs/qgroup.c | 87 ++++++++++++++++++++++++++++++++++++++++++++++++++----- 1 file changed, 80 insertions(+), 7 deletions(-) commit 56e6f2687521390bead4e4ea279ca4eec15579ef Author: David Sterba Date: Mon May 20 20:49:18 2024 +0200 btrfs: constify parameters of write_eb_member() and its users Reported by 'gcc -Wcast-qual', the argument from which write_extent_buffer() reads data to write to the eb should be const. In addition the const needs to be also added to __write_extent_buffer() local buffers. All callers of write_eb_member() can now be updated to use const for the input buffer structure or type. Reviewed-by: Boris Burkov Reviewed-by: Anand Jain Reviewed-by: Naohiro Aota Signed-off-by: David Sterba fs/btrfs/accessors.h | 10 +++++----- fs/btrfs/extent_io.c | 2 +- 2 files changed, 6 insertions(+), 6 deletions(-) commit 840a97bdef1e5d7bd8bf147812df416cca15afc7 Author: David Sterba Date: Mon May 20 20:48:06 2024 +0200 btrfs: keep const when returning value from get_unaligned_le8() This was reported by 'gcc -Wcast-qual', the get_unaligned_le8() simply returns the argument and there's no reason to drop the cast. Reviewed-by: Boris Burkov Reviewed-by: Anand Jain Reviewed-by: Naohiro Aota Signed-off-by: David Sterba fs/btrfs/accessors.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 5100c4eb527ebe175d3dbaeb0b8cc04f312183d7 Author: David Sterba Date: Mon May 20 20:19:53 2024 +0200 btrfs: remove unused define EXTENT_SIZE_PER_ITEM This was added in c61a16a701a126 ("Btrfs: fix the confusion between delalloc bytes and metadata bytes") and removed in 03fe78cc2942c5 ("btrfs: use delalloc_bytes to determine flush amount for shrink_delalloc") where the calculation was reworked to use a non-constant numbers. This was found by 'make W=2'. Reviewed-by: Boris Burkov Reviewed-by: Anand Jain Reviewed-by: Naohiro Aota Signed-off-by: David Sterba fs/btrfs/space-info.c | 2 -- 1 file changed, 2 deletions(-) commit d2715d1db455e5e1099c48408aeae15551b67e02 Author: David Sterba Date: Mon May 20 19:46:44 2024 +0200 btrfs: use for-local variables that shadow function variables We've started to use for-loop local variables and in a few places this shadows a function variable. Convert a few cases reported by 'make W=2'. If applicable also change the style to post-increment, that's the preferred one. Reviewed-by: Boris Burkov Reviewed-by: Anand Jain Reviewed-by: Naohiro Aota Signed-off-by: David Sterba fs/btrfs/qgroup.c | 11 +++++------ fs/btrfs/volumes.c | 9 +++------ fs/btrfs/zoned.c | 8 +++----- 3 files changed, 11 insertions(+), 17 deletions(-) commit 91629e6dea437c6e7f01431e423a90ed1bab5db3 Author: David Sterba Date: Mon May 20 19:49:17 2024 +0200 btrfs: rename macro local variables that clash with other variables Fix variable names in two macros where there's a local function variable of the same name. In subpage_calc_start_bit() it's in several callers, in btrfs_abort_transaction() it's only in replace_file_extents(). Found by 'make W=2'. Reviewed-by: Boris Burkov Reviewed-by: Anand Jain Reviewed-by: Naohiro Aota Signed-off-by: David Sterba fs/btrfs/subpage.c | 8 ++++---- fs/btrfs/transaction.h | 6 +++--- 2 files changed, 7 insertions(+), 7 deletions(-) commit 9c5e1fb024df2675eeb6a2f43770687602a0ffdc Author: David Sterba Date: Mon May 20 19:40:26 2024 +0200 btrfs: remove duplicate name variable declarations When running 'make W=2' there are a few reports where a variable of the same name is declared in a nested block. In all the cases we can use the one declared in the parent block, no problematic cases were found. Reviewed-by: Boris Burkov Reviewed-by: Anand Jain Reviewed-by: Naohiro Aota Signed-off-by: David Sterba fs/btrfs/extent_io.c | 4 +--- fs/btrfs/inode.c | 2 -- 2 files changed, 1 insertion(+), 5 deletions(-) commit 56b7169f691cd4d015aca8436acd27f37a6b6a62 Author: Filipe Manana Date: Sat May 18 18:22:03 2024 +0100 btrfs: use a btrfs_inode local variable at btrfs_sync_file() Instead of using a VFS inode local pointer and then doing many BTRFS_I() calls inside btrfs_sync_file(), use a btrfs_inode pointer instead. This makes everything a bit easier to read and less confusing, allowing to make some statements shorter. Reviewed-by: Qu Wenruo Signed-off-by: Filipe Manana Reviewed-by: David Sterba Signed-off-by: David Sterba fs/btrfs/file.c | 44 ++++++++++++++++++++------------------------ 1 file changed, 20 insertions(+), 24 deletions(-) commit e641e323abb3ceff6477a3936c4f5173126b7890 Author: Filipe Manana Date: Sat May 18 18:14:06 2024 +0100 btrfs: pass a btrfs_inode to btrfs_wait_ordered_range() Instead of passing a (VFS) inode pointer argument, pass a btrfs_inode instead, as this is generally what we do for internal APIs, making it more consistent with most of the code base. This will later allow to help to remove a lot of BTRFS_I() calls in btrfs_sync_file(). Reviewed-by: Qu Wenruo Signed-off-by: Filipe Manana Reviewed-by: David Sterba Signed-off-by: David Sterba fs/btrfs/file.c | 10 +++++----- fs/btrfs/free-space-cache.c | 2 +- fs/btrfs/inode.c | 16 ++++++++-------- fs/btrfs/ordered-data.c | 8 ++++---- fs/btrfs/ordered-data.h | 2 +- fs/btrfs/reflink.c | 8 ++++---- fs/btrfs/relocation.c | 2 +- 7 files changed, 24 insertions(+), 24 deletions(-) commit cef2daba42682764be4083f8d333a2477034e7c9 Author: Filipe Manana Date: Sat May 18 18:01:47 2024 +0100 btrfs: pass a btrfs_inode to btrfs_fdatawrite_range() Instead of passing a (VFS) inode pointer argument, pass a btrfs_inode instead, as this is generally what we do for internal APIs, making it more consistent with most of the code base. This will later allow to help to remove a lot of BTRFS_I() calls in btrfs_sync_file(). Reviewed-by: Qu Wenruo Signed-off-by: Filipe Manana Reviewed-by: David Sterba Signed-off-by: David Sterba fs/btrfs/file.c | 18 +++++++++--------- fs/btrfs/file.h | 2 +- fs/btrfs/free-space-cache.c | 2 +- fs/btrfs/ordered-data.c | 2 +- 4 files changed, 12 insertions(+), 12 deletions(-) commit 4d0120a519357c817414adaa0f1b3e04fa424478 Author: Filipe Manana Date: Sat May 18 14:09:41 2024 +0100 btrfs: use a btrfs_inode in the log context (struct btrfs_log_ctx) Instead of using a inode pointer, use a btrfs_inode pointer in the log context structure, as this is generally what we need and allows for some internal APIs to take a btrfs_inode instead, making them more consistent with most of the code base. This will later allow to help to remove a lot of BTRFS_I() calls in btrfs_sync_file(). Reviewed-by: Qu Wenruo Signed-off-by: Filipe Manana Reviewed-by: David Sterba Signed-off-by: David Sterba fs/btrfs/file.c | 4 ++-- fs/btrfs/tree-log.c | 10 +++++----- fs/btrfs/tree-log.h | 4 ++-- 3 files changed, 9 insertions(+), 9 deletions(-) commit c41881ae07c828ee5da8ed1d44204911fdae3bcf Author: Filipe Manana Date: Wed May 15 13:54:14 2024 +0100 btrfs: make btrfs_finish_ordered_extent() return void Currently btrfs_finish_ordered_extent() returns a boolean indicating if the ordered extent was added to the work queue for completion, but none of its callers cares about it, so make it return void. Reviewed-by: Qu Wenruo Signed-off-by: Filipe Manana Reviewed-by: David Sterba Signed-off-by: David Sterba fs/btrfs/ordered-data.c | 3 +-- fs/btrfs/ordered-data.h | 2 +- 2 files changed, 2 insertions(+), 3 deletions(-) commit 83937fb612efa2f070536d94a8d6cfcbb1c589af Author: Anand Jain Date: Sun May 19 08:14:56 2024 +0800 btrfs: move btrfs_block_group_root() to block-group.c The function btrfs_block_group_root() is declared in disk-io.c; however, all its callers are in block-group.c. Move it to the latter file and declare it static. Reviewed-by: Naohiro Aota Reviewed-by: Qu Wenruo Signed-off-by: Anand Jain Reviewed-by: David Sterba Signed-off-by: David Sterba fs/btrfs/block-group.c | 7 +++++++ fs/btrfs/disk-io.c | 7 ------- fs/btrfs/disk-io.h | 1 - 3 files changed, 7 insertions(+), 8 deletions(-) commit 70559abf6241c9ffe23e526a66960ac76d258e0e Author: Anand Jain Date: Thu May 16 11:10:23 2024 +0800 btrfs: drop bytenr_orig and fix comment in btrfs_scan_one_device() Drop the single-use variable bytenr_orig and instead use btrfs_sb_offset() in the function argument passing. Fix a stale comment about not automatically fixing a bad primary superblock from the backup mirror copies. Also, move the comment closer to where the primary superblock read occurs. Signed-off-by: Anand Jain Reviewed-by: David Sterba Signed-off-by: David Sterba fs/btrfs/volumes.c | 18 ++++++++---------- 1 file changed, 8 insertions(+), 10 deletions(-) commit 4e660ca3a98d93180973426239e69ee44f4d7941 Author: Filipe Manana Date: Fri May 10 17:41:04 2024 +0100 btrfs: use a regular rb_root instead of cached rb_root for extent_map_tree We are currently using a cached rb_root (struct rb_root_cached) for the rb root of struct extent_map_tree. This doesn't offer much of an advantage here because: 1) It's only advantage over the regular rb_root is that it caches a pointer to the left most node (first node), so a call to rb_first_cached() doesn't have to chase pointers until it reaches the left most node; 2) We only have two scenarios that access left most node with rb_first_cached(): When dropping all extent maps from an inode, during inode eviction; When iterating over extent maps during the extent map shrinker; 3) In both cases we keep removing extent maps, which causes deletion of the left most node so rb_erase_cached() has to call rb_next() to find out what's the next left most node and assign it to struct rb_root_cached::rb_leftmost; 4) We can do that ourselves in those two uses cases and stop using a rb_root_cached rb tree and use instead a regular rb_root rb tree. This reduces the size of struct extent_map_tree by 8 bytes and, since this structure is embedded in struct btrfs_inode, it also reduces the size of that structure by 8 bytes. So on a 64 bits platform the size of btrfs_inode is reduced from 1032 bytes down to 1024 bytes. This means we will be able to have 4 inodes per 4K page instead of 3. Signed-off-by: Filipe Manana Reviewed-by: David Sterba Signed-off-by: David Sterba fs/btrfs/extent_map.c | 48 +++++++++++++++++++++------------------ fs/btrfs/extent_map.h | 2 +- fs/btrfs/tests/extent-map-tests.c | 6 ++--- 3 files changed, 30 insertions(+), 26 deletions(-) commit 7f5830bc964dbe761af27c9a9f788bd8c7397d3d Author: Filipe Manana Date: Fri May 10 17:11:31 2024 +0100 btrfs: rename rb_root member of extent_map_tree from map to root Currently we name the rb_root member of struct extent_map_tree as 'map', which is odd and confusing. Since it's a root node, rename it to 'root'. Signed-off-by: Filipe Manana Reviewed-by: David Sterba Signed-off-by: David Sterba fs/btrfs/extent_map.c | 22 +++++++++++----------- fs/btrfs/extent_map.h | 2 +- fs/btrfs/tests/extent-map-tests.c | 6 +++--- 3 files changed, 15 insertions(+), 15 deletions(-) commit 7a7bc21449bb185884cd6b0c2b52c2a27b0184c2 Author: Filipe Manana Date: Sun May 5 13:47:02 2024 +0100 btrfs: remove objectid from struct btrfs_inode on 64 bits platforms On 64 bits platforms we don't really need to have a dedicated member (the objectid field) for the inode's number since we store in the VFS inode's i_ino member, which is an unsigned long and this type is 64 bits wide on 64 bits platforms. We only need that field in case we are on a 32 bits platform because the unsigned long type is 32 bits wide on such platforms See commit 33345d01522f ("Btrfs: Always use 64bit inode number") regarding this 64/32 bits detail. The objectid field of struct btrfs_inode is also used to store the ID of a root for directories that are stubs for unreferenced roots. In such cases the inode is a directory and has the BTRFS_INODE_ROOT_STUB runtime flag set. So in order to reduce the size of btrfs_inode structure on 64 bits platforms we can remove the objectid member and use the VFS inode's i_ino member instead whenever we need to get the inode number. In case the inode is a root stub (BTRFS_INODE_ROOT_STUB set) we can use the member last_reflink_trans to store the ID of the unreferenced root, since such inode is a directory and reflinks can't be done against directories. So remove the objectid fields for 64 bits platforms and alias the last_reflink_trans field with a name of ref_root_id in a union. On a release kernel config, this reduces the size of struct btrfs_inode from 1040 bytes down to 1032 bytes. Signed-off-by: Filipe Manana Reviewed-by: David Sterba Signed-off-by: David Sterba fs/btrfs/btrfs_inode.h | 50 +++++++++++++++++++++++++++++--------------- fs/btrfs/disk-io.c | 3 +-- fs/btrfs/export.c | 2 +- fs/btrfs/inode.c | 17 +++++++-------- fs/btrfs/ioctl.c | 4 ++-- fs/btrfs/tests/btrfs-tests.c | 3 +-- 6 files changed, 45 insertions(+), 34 deletions(-) commit 068fc8f9141f503d2e7744208bb6d68a739ee53d Author: Filipe Manana Date: Fri May 3 18:10:06 2024 +0100 btrfs: remove location key from struct btrfs_inode Currently struct btrfs_inode has a key member, named "location", that is either: 1) The key of the inode's item. In this case the objectid is the number of the inode; 2) A key stored in a dir entry with a type of BTRFS_ROOT_ITEM_KEY, for the case where we have a root that is a snapshot of a subvolume that points to other subvolumes. In this case the objectid is the ID of a subvolume inside the snapshotted parent subvolume. The key is only used to lookup the inode item for the first case, while for the second it's never used since it corresponds to directory stubs created with new_simple_dir() and which are marked as dummy, so there's no actual inode item to ever update. In the second case we only check the key type at btrfs_ino() for 32 bits platforms and its objectid is only needed for unlink. Instead of using a key we can do fine with just the objectid, since we can generate the key whenever we need it having only the objectid, as in all use cases the type is always BTRFS_INODE_ITEM_KEY and the offset is always 0. So use only an objectid instead of a full key. This reduces the size of struct btrfs_inode from 1048 bytes down to 1040 bytes on a release kernel. Signed-off-by: Filipe Manana Reviewed-by: David Sterba Signed-off-by: David Sterba fs/btrfs/btrfs_inode.h | 47 ++++++++++++++++++++++++++++++++++++++------ fs/btrfs/disk-io.c | 4 +--- fs/btrfs/export.c | 2 +- fs/btrfs/inode.c | 25 +++++++++++------------ fs/btrfs/ioctl.c | 8 ++++---- fs/btrfs/tests/btrfs-tests.c | 4 +--- fs/btrfs/tree-log.c | 6 ++++-- 7 files changed, 63 insertions(+), 33 deletions(-) commit 3d7db6e8bd22e692e0b7073eb7d12c9c1bbaeb2d Author: Filipe Manana Date: Tue Apr 30 16:52:27 2024 +0100 btrfs: don't allocate file extent tree for non regular files When not using the NO_HOLES feature we always allocate an io tree for an inode's file_extent_tree. This is wasteful because that io tree is only used for regular files, so we allocate more memory than needed for inodes that represent directories or symlinks for example, or for inodes that correspond to free space inodes. So improve on this by allocating the io tree only for inodes of regular files that are not free space inodes. Reviewed-by: Qu Wenruo Signed-off-by: Filipe Manana Reviewed-by: David Sterba Signed-off-by: David Sterba fs/btrfs/file-item.c | 13 +++++++------ fs/btrfs/inode.c | 53 ++++++++++++++++++++++++++++++++++------------------ 2 files changed, 42 insertions(+), 24 deletions(-) commit d9891ae28b0d3d3a188c502d33f04c1fb3ffd950 Author: Filipe Manana Date: Tue Apr 30 10:55:05 2024 +0100 btrfs: unify index_cnt and csum_bytes from struct btrfs_inode The index_cnt field of struct btrfs_inode is used only for two purposes: 1) To store the index for the next entry added to a directory; 2) For the data relocation inode to track the logical start address of the block group currently being relocated. For the relocation case we use index_cnt because it's not used for anything else in the relocation use case - we could have used other fields that are not used by relocation such as defrag_bytes, last_unlink_trans or last_reflink_trans for example (among others). Since the csum_bytes field is not used for directories, do the following changes: 1) Put index_cnt and csum_bytes in a union, and index_cnt is only initialized when the inode is a directory. The csum_bytes is only accessed in IO paths for regular files, so we're fine here; 2) Use the defrag_bytes field for relocation, since the data relocation inode is never used for defrag purposes. And to make the naming better, alias it to reloc_block_group_start by using a union. This reduces the size of struct btrfs_inode by 8 bytes in a release kernel, from 1056 bytes down to 1048 bytes. Reviewed-by: Qu Wenruo Signed-off-by: Filipe Manana Reviewed-by: David Sterba Signed-off-by: David Sterba fs/btrfs/btrfs_inode.h | 46 +++++++++++++++++++++++++++++----------------- fs/btrfs/delayed-inode.c | 3 ++- fs/btrfs/inode.c | 21 +++++++++++++++------ fs/btrfs/relocation.c | 12 ++++++------ fs/btrfs/tree-log.c | 3 ++- 5 files changed, 54 insertions(+), 31 deletions(-) commit e2844cce75c9e61a27dcc29f0773afe970cde296 Author: Filipe Manana Date: Mon May 6 13:27:29 2024 +0100 btrfs: remove inode_lock from struct btrfs_root and use xarray locks Currently we use the spinlock inode_lock from struct btrfs_root to serialize access to two different data structures: 1) The delayed inodes xarray (struct btrfs_root::delayed_nodes); 2) The inodes xarray (struct btrfs_root::inodes). Instead of using our own lock, we can use the spinlock that is part of the xarray implementation, by using the xa_lock() and xa_unlock() APIs and using the xarray APIs with the double underscore prefix that don't take the xarray locks and assume the caller is using xa_lock() and xa_unlock(). So remove the spinlock inode_lock from struct btrfs_root and use the corresponding xarray locks. This brings 2 benefits: 1) We reduce the size of struct btrfs_root, from 1336 bytes down to 1328 bytes on a 64 bits release kernel config; 2) We reduce lock contention by not using anymore the same lock for changing two different and unrelated xarrays. Reviewed-by: Qu Wenruo Signed-off-by: Filipe Manana Reviewed-by: David Sterba Signed-off-by: David Sterba fs/btrfs/ctree.h | 1 - fs/btrfs/delayed-inode.c | 26 ++++++++++++-------------- fs/btrfs/disk-io.c | 1 - fs/btrfs/inode.c | 18 ++++++++---------- 4 files changed, 20 insertions(+), 26 deletions(-) commit d25f4ec17624b1b18ff2e0a3e9c2baa71c8a86f2 Author: Filipe Manana Date: Mon Apr 29 14:01:09 2024 +0100 btrfs: reduce nesting and deduplicate error handling at btrfs_iget_path() Make btrfs_iget_path() simpler and easier to read by avoiding nesting of if-then-else statements and having an error label to do all the error handling instead of repeating it a couple times. Reviewed-by: Qu Wenruo Signed-off-by: Filipe Manana Reviewed-by: David Sterba Signed-off-by: David Sterba fs/btrfs/inode.c | 44 +++++++++++++++++++++----------------------- 1 file changed, 21 insertions(+), 23 deletions(-) commit 061ea8581b2e0ade913c8f5cd845e801976a577b Author: Filipe Manana Date: Mon Apr 29 13:08:12 2024 +0100 btrfs: preallocate inodes xarray entry to avoid transaction abort When creating a new inode, at btrfs_create_new_inode(), one of the very last steps is to add the inode to the root's inodes xarray. This often requires allocating memory which may fail (even though xarrays have a dedicated kmem_cache which make it less likely to fail), and at that point we are forced to abort the current transaction (as some, but not all, of the inode metadata was added to its subvolume btree). To avoid a transaction abort, preallocate memory for the xarray early at btrfs_create_new_inode(), so that if we fail we don't need to abort the transaction and the insertion into the xarray is guaranteed to succeed. Reviewed-by: Qu Wenruo Signed-off-by: Filipe Manana Reviewed-by: David Sterba Signed-off-by: David Sterba fs/btrfs/inode.c | 26 +++++++++++++++++++------- 1 file changed, 19 insertions(+), 7 deletions(-) commit 310b2f5d5a9451b708ab1d3385c3b0998084904c Author: Filipe Manana Date: Wed Apr 24 16:58:01 2024 +0100 btrfs: use an xarray to track open inodes in a root Currently we use a red black tree (rb-tree) to track the currently open inodes of a root (in struct btrfs_root::inode_tree). This however is not very efficient when the number of inodes is large since rb-trees are binary trees. For example for 100K open inodes, the tree has a depth of 17. Besides that, inserting into the tree requires navigating through it and pulling useless cache lines in the process since the red black tree nodes are embedded within the btrfs inode - on the other hand, by being embedded, it requires no extra memory allocations. We can improve this by using an xarray instead, which is efficient when indices are densely clustered (such as inode numbers), is more cache friendly and behaves like a resizable array, with a much better search and insertion complexity than a red black tree. This only has one small disadvantage which is that insertion will sometimes require allocating memory for the xarray - which may fail (not that often since it uses a kmem_cache) - but on the other hand we can reduce the btrfs inode structure size by 24 bytes (from 1080 down to 1056 bytes) after removing the embedded red black tree node, which after the next patches will allow to reduce the size of the structure to 1024 bytes, meaning we will be able to store 4 inodes per 4K page instead of 3 inodes. This change does a straightforward change to use an xarray, and results in a transaction abort if we can't allocate memory for the xarray when creating an inode - but the next patch changes things so that we don't need to abort. Running the following fs_mark test showed some improvements: $ cat test.sh #!/bin/bash DEV=/dev/nullb0 MNT=/mnt/nullb0 MOUNT_OPTIONS="-o ssd" FILES=100000 THREADS=$(nproc --all) echo "performance" | \ tee /sys/devices/system/cpu/cpu*/cpufreq/scaling_governor mkfs.btrfs -f $DEV mount $MOUNT_OPTIONS $DEV $MNT OPTS="-S 0 -L 5 -n $FILES -s 0 -t $THREADS -k" for ((i = 1; i <= $THREADS; i++)); do OPTS="$OPTS -d $MNT/d$i" done fs_mark $OPTS umount $MNT Before this patch: FSUse% Count Size Files/sec App Overhead 10 1200000 0 92081.6 12505547 16 2400000 0 138222.6 13067072 23 3600000 0 148833.1 13290336 43 4800000 0 97864.7 13931248 53 6000000 0 85597.3 14384313 After this patch: FSUse% Count Size Files/sec App Overhead 10 1200000 0 93225.1 12571078 16 2400000 0 146720.3 12805007 23 3600000 0 160626.4 13073835 46 4800000 0 116286.2 13802927 53 6000000 0 90087.9 14754892 The test was run with a release kernel config (Debian's default config). Also capturing the insertion times into the rb tree and into the xarray, that is measuring the duration of the old function inode_tree_add() and the duration of the new btrfs_add_inode_to_root() function, gave the following results (in nanoseconds): Before this patch, inode_tree_add() execution times: Count: 5000000 Range: 0.000 - 5536887.000; Mean: 775.674; Median: 729.000; Stddev: 4820.961 Percentiles: 90th: 1015.000; 95th: 1139.000; 99th: 1397.000 0.000 - 7.816: 40 | 7.816 - 37.858: 209 | 37.858 - 170.278: 6059 | 170.278 - 753.961: 2754890 ##################################################### 753.961 - 3326.728: 2232312 ########################################### 3326.728 - 14667.018: 4366 | 14667.018 - 64652.943: 852 | 64652.943 - 284981.761: 550 | 284981.761 - 1256150.914: 221 | 1256150.914 - 5536887.000: 7 | After this patch, btrfs_add_inode_to_root() execution times: Count: 5000000 Range: 0.000 - 2900652.000; Mean: 272.148; Median: 241.000; Stddev: 2873.369 Percentiles: 90th: 342.000; 95th: 432.000; 99th: 572.000 0.000 - 7.264: 104 | 7.264 - 33.145: 352 | 33.145 - 140.081: 109606 # 140.081 - 581.930: 4840090 ##################################################### 581.930 - 2407.590: 43532 | 2407.590 - 9950.979: 2245 | 9950.979 - 41119.278: 514 | 41119.278 - 169902.616: 155 | 169902.616 - 702018.539: 47 | 702018.539 - 2900652.000: 9 | Average, percentiles, standard deviation, etc, are all much better. Reviewed-by: Qu Wenruo Signed-off-by: Filipe Manana Reviewed-by: David Sterba Signed-off-by: David Sterba fs/btrfs/btrfs_inode.h | 3 -- fs/btrfs/ctree.h | 7 ++- fs/btrfs/disk-io.c | 6 +-- fs/btrfs/inode.c | 128 +++++++++++++++++++------------------------------ 4 files changed, 58 insertions(+), 86 deletions(-) commit bbbee460aaaabe5bea6665dd4ce18677f2d154cc Author: Qu Wenruo Date: Tue May 14 18:32:13 2024 +0930 btrfs: raid56: do extra dumping for CONFIG_BTRFS_ASSERT There are several hard-to-hit ASSERT()s hit inside raid56. Unfortunately the ASSERT() expression is a little complex, and except the ASSERT(), there is nothing to provide any clue. Considering if race is involved, it's pretty hard to reproduce. Meanwhile sometimes the dump of the rbio structure can provide some pretty good clues, it's worth to do the extra multi-line dump for btrfs raid56 related code. The dump looks like this: BTRFS critical (device dm-3): bioc logical=4598530048 full_stripe=4598530048 size=0 map_type=0x81 mirror=0 replace_nr_stripes=0 replace_stripe_src=-1 num_stripes=5 BTRFS critical (device dm-3): nr=0 devid=1 physical=1166147584 BTRFS critical (device dm-3): nr=1 devid=2 physical=1145176064 BTRFS critical (device dm-3): nr=2 devid=4 physical=1145176064 BTRFS critical (device dm-3): nr=3 devid=5 physical=1145176064 BTRFS critical (device dm-3): nr=4 devid=3 physical=1145176064 BTRFS critical (device dm-3): rbio flags=0x0 nr_sectors=80 nr_data=4 real_stripes=5 stripe_nsectors=16 scrubp=0 dbitmap=0x0 BTRFS critical (device dm-3): logical=4598530048 assertion failed: orig_logical >= full_stripe_start && orig_logical + orig_len <= full_stripe_start + rbio->nr_data * BTRFS_STRIPE_LEN, in fs/btrfs/raid56.c:1702 Reviewed-by: Filipe Manana Signed-off-by: Qu Wenruo Reviewed-by: David Sterba Signed-off-by: David Sterba fs/btrfs/raid56.c | 112 +++++++++++++++++++++++++++++++++++++++++++++++------- 1 file changed, 98 insertions(+), 14 deletions(-) commit 3441b070f82b721473547cba9e4cd7914006b67c Author: Filipe Manana Date: Tue May 14 13:19:12 2024 +0100 btrfs: fix function name in comment for btrfs_remove_ordered_extent() Due to a refactoring introduced by commit 53d9981ca20e ("btrfs: split btrfs_alloc_ordered_extent to allocation and insertion helpers"), the function btrfs_alloc_ordered_extent() was renamed to alloc_ordered_extent(), so the comment at btrfs_remove_ordered_extent() is no longer very accurate. Update the comment to refer to the new name "alloc_ordered_extent()". Reviewed-by: Qu Wenruo Signed-off-by: Filipe Manana Reviewed-by: David Sterba Signed-off-by: David Sterba fs/btrfs/ordered-data.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 416d6ab49d43570a52484677a864bda52e27db6c Author: Filipe Manana Date: Mon May 13 18:12:35 2024 +0100 btrfs: fix misspelled end IO compression callbacks Fix typo in the end IO compression callbacks, from "comprssed" to "compressed". Reviewed-by: Qu Wenruo Signed-off-by: Filipe Manana Reviewed-by: David Sterba Signed-off-by: David Sterba fs/btrfs/compression.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) commit d153fc5573e9684f7082baa66a7f3f6371a4d04d Author: Filipe Manana Date: Mon May 13 18:05:47 2024 +0100 btrfs: remove no longer used btrfs_migrate_to_delayed_refs_rsv() The function btrfs_migrate_to_delayed_refs_rsv() is no longer used. Its last use was removed in commit 2f6397e448e6 ("btrfs: don't refill whole delayed refs block reserve when starting transaction"). So remove the function. Reviewed-by: Qu Wenruo Signed-off-by: Filipe Manana Reviewed-by: David Sterba Signed-off-by: David Sterba fs/btrfs/delayed-ref.c | 42 ------------------------------------------ fs/btrfs/delayed-ref.h | 2 -- 2 files changed, 44 deletions(-) commit 55a2f3887078cd3797a2553b9f8f095dc8e4e73a Author: Filipe Manana Date: Tue May 7 23:50:16 2024 +0100 btrfs: zoned: make btrfs_get_dev_zone() static It's not used outside zoned.c, so make it static. Reviewed-by: Johannes Thumshirn Signed-off-by: Filipe Manana Reviewed-by: David Sterba Signed-off-by: David Sterba fs/btrfs/zoned.c | 3 +-- fs/btrfs/zoned.h | 7 ------- 2 files changed, 1 insertion(+), 9 deletions(-) commit 3ef6adef12bccdf9dd7fcb50deb930dee4b52bc9 Author: Johannes Thumshirn Date: Wed May 8 13:14:47 2024 +0200 btrfs: pass struct btrfs_io_geometry into handle_ops_on_dev_replace() Passing in a 'struct btrfs_io_geometry into handle_ops_on_dev_replace can reduce the number of arguments by two. No functional changes otherwise. Reviewed-by: Filipe Manana Signed-off-by: Johannes Thumshirn Reviewed-by: David Sterba Signed-off-by: David Sterba fs/btrfs/volumes.c | 18 ++++++++---------- 1 file changed, 8 insertions(+), 10 deletions(-) commit 34064fc3c9b557789a33214de0af6d6e09e4a0c8 Author: David Sterba Date: Thu May 2 23:11:33 2024 +0200 btrfs: qgroup: do quick checks if quotas are enabled before starting ioctls The ioctls that add relations, create qgroups or set limits start/join transaction. When quotas are not enabled this is not necessary, there will be errors reported back anyway but this could be also misleading and we should really report that quotas are not enabled. For that use -ENOTCONN. The helper is meant to do a quick check before any other standard ioctl checks are done. If quota is disabled meanwhile we still rely on proper locking inside any active operation changing the qgroup structures. Reviewed-by: Anand Jain Signed-off-by: David Sterba fs/btrfs/ioctl.c | 28 ++++++++++++++++++++++++++++ 1 file changed, 28 insertions(+) commit 3900cf8b3a7c9a925a5cda18430ba4c874037800 Author: Wolfram Sang Date: Sat Jul 6 13:21:00 2024 +0200 i2c: st: reword according to newest specification Change the wording of this driver wrt. the newest I2C v7 and SMBus 3.2 specifications and replace "master/slave" with more appropriate terms. Signed-off-by: Wolfram Sang Reviewed-by: Alain Volmat Reviewed-by: Andi Shyti Signed-off-by: Andi Shyti drivers/i2c/busses/i2c-st.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) commit 79e9df7dc5da07e5efc744a145cc55c9cd0866cd Author: Wolfram Sang Date: Sat Jul 6 13:20:59 2024 +0200 i2c: cpm: reword according to newest specification Change the wording of this driver wrt. the newest I2C v7 and SMBus 3.2 specifications and replace "master/slave" with more appropriate terms. Signed-off-by: Wolfram Sang Reviewed-by: Andi Shyti Acked-by: Jochen Friedrich Signed-off-by: Andi Shyti drivers/i2c/busses/i2c-cpm.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) commit 532cc2176ab6a54cbcffaff0a28d31f3cc7263a2 Author: Wolfram Sang Date: Sat Jul 6 13:20:58 2024 +0200 i2c: virtio: reword according to newest specification Change the wording of this driver wrt. the newest I2C v7 and SMBus 3.2 specifications and replace "master/slave" with more appropriate terms. Signed-off-by: Wolfram Sang Acked-by: Viresh Kumar Reviewed-by: Andi Shyti Signed-off-by: Andi Shyti drivers/i2c/busses/i2c-virtio.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit a0e74ddb38afc613ef831556166cd96901630bc2 Author: Wolfram Sang Date: Sat Jul 6 13:20:57 2024 +0200 i2c: nvidia-gpu: reword according to newest specification Change the wording of this driver wrt. the newest I2C v7 and SMBus 3.2 specifications and replace "master/slave" with more appropriate terms. Signed-off-by: Wolfram Sang Reviewed-by: Andi Shyti Signed-off-by: Andi Shyti drivers/i2c/busses/i2c-nvidia-gpu.c | 7 +++---- 1 file changed, 3 insertions(+), 4 deletions(-) commit d919298781d60f53560b4847323cb2436c914765 Author: Wolfram Sang Date: Sat Jul 6 13:20:56 2024 +0200 i2c: viai2c: reword according to newest specification Change the wording of this driver wrt. the newest I2C v7 and SMBus 3.2 specifications and replace "master/slave" with more appropriate terms. Signed-off-by: Wolfram Sang Reviewed-by: Andi Shyti Signed-off-by: Andi Shyti drivers/i2c/busses/i2c-viai2c-common.c | 2 +- drivers/i2c/busses/i2c-viai2c-wmt.c | 8 ++++---- drivers/i2c/busses/i2c-viai2c-zhaoxin.c | 12 ++++++------ 3 files changed, 11 insertions(+), 11 deletions(-) commit f2005ced20eedbfe4d6f2313088936994f13b7ca Author: Wolfram Sang Date: Sat Jul 6 13:20:55 2024 +0200 i2c: viperboard: reword according to newest specification Change the wording of this driver wrt. the newest I2C v7 and SMBus 3.2 specifications and replace "master/slave" with more appropriate terms. Remove a superfluous debug output which is already available via tracing. Signed-off-by: Wolfram Sang Reviewed-by: Andi Shyti Signed-off-by: Andi Shyti drivers/i2c/busses/i2c-viperboard.c | 10 ++++------ 1 file changed, 4 insertions(+), 6 deletions(-) commit e02ec4e15a3c5d55c26f660aab2b4c2b492a166e Author: Wolfram Sang Date: Sat Jul 6 13:20:54 2024 +0200 i2c: uniphier: reword according to newest specification Change the wording of this driver wrt. the newest I2C v7 and SMBus 3.2 specifications and replace "master/slave" with more appropriate terms. Signed-off-by: Wolfram Sang Reviewed-by: Andi Shyti Signed-off-by: Andi Shyti drivers/i2c/busses/i2c-uniphier.c | 15 +++++++-------- 1 file changed, 7 insertions(+), 8 deletions(-) commit f872d28500bd42353495c0c4076f20aa832c36d6 Author: Wolfram Sang Date: Sat Jul 6 13:20:53 2024 +0200 i2c: uniphier-f: reword according to newest specification Change the wording of this driver wrt. the newest I2C v7 and SMBus 3.2 specifications and replace "master/slave" with more appropriate terms. Signed-off-by: Wolfram Sang Reviewed-by: Andi Shyti Signed-off-by: Andi Shyti drivers/i2c/busses/i2c-uniphier-f.c | 26 ++++++++++++-------------- 1 file changed, 12 insertions(+), 14 deletions(-) commit 664e69d2e511b3fef2b856916f942c626d0314ed Author: Wolfram Sang Date: Sat Jul 6 13:20:52 2024 +0200 i2c: tiny-usb: reword according to newest specification Change the wording of this driver wrt. the newest I2C v7 and SMBus 3.2 specifications and replace "master/slave" with more appropriate terms. Remove a superfluous debug output which is already available via tracing. Signed-off-by: Wolfram Sang Reviewed-by: Andi Shyti Signed-off-by: Andi Shyti drivers/i2c/busses/i2c-tiny-usb.c | 6 ++---- 1 file changed, 2 insertions(+), 4 deletions(-) commit 44981dc3bacc51535bfc891d84530656d5bd8e3a Author: Wolfram Sang Date: Sat Jul 6 13:20:51 2024 +0200 i2c: thunderx-pcidrv: reword according to newest specification Change the wording of this driver wrt. the newest I2C v7 and SMBus 3.2 specifications and replace "master/slave" with more appropriate terms. Signed-off-by: Wolfram Sang Reviewed-by: Andi Shyti Signed-off-by: Andi Shyti drivers/i2c/busses/i2c-thunderx-pcidrv.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit b00f427a07a3ccc56ed2b1140b47474ae948efd5 Author: Wolfram Sang Date: Sat Jul 6 13:20:50 2024 +0200 i2c: tegra-bpmp: reword according to newest specification Change the wording of this driver wrt. the newest I2C v7 and SMBus 3.2 specifications and replace "master/slave" with more appropriate terms. Signed-off-by: Wolfram Sang Reviewed-by: Andi Shyti Signed-off-by: Andi Shyti drivers/i2c/busses/i2c-tegra-bpmp.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) commit 3c06105d06064f139dac8a7d01f84d89bf3775a3 Author: Wolfram Sang Date: Sat Jul 6 13:20:49 2024 +0200 i2c: taos-evm: reword according to newest specification Change the wording of this driver wrt. the newest I2C v7 and SMBus 3.2 specifications and replace "master/slave" with more appropriate terms. Signed-off-by: Wolfram Sang Reviewed-by: Andi Shyti Signed-off-by: Andi Shyti drivers/i2c/busses/i2c-taos-evm.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit c2cac347ef59e01c34cae69996fc6c47043f657f Author: Wolfram Sang Date: Sat Jul 6 13:20:48 2024 +0200 i2c: sun6i-p2wi: reword according to newest specification Change the wording of this driver wrt. the newest I2C v7 and SMBus 3.2 specifications and replace "master/slave" with more appropriate terms. Signed-off-by: Wolfram Sang Acked-by: Chen-Yu Tsai Reviewed-by: Andi Shyti Signed-off-by: Andi Shyti drivers/i2c/busses/i2c-sun6i-p2wi.c | 20 ++++++++++---------- 1 file changed, 10 insertions(+), 10 deletions(-) commit 830f70cf1874df102128d498d5ba009d90529cdf Author: Wolfram Sang Date: Sat Jul 6 13:20:47 2024 +0200 i2c: stm32f4: reword according to newest specification Change the wording of this driver wrt. the newest I2C v7 and SMBus 3.2 specifications and replace "master/slave" with more appropriate terms. Signed-off-by: Wolfram Sang Acked-by: Alain Volmat Acked-by: Pierre-Yves MORDRET Reviewed-by: Andi Shyti Signed-off-by: Andi Shyti drivers/i2c/busses/i2c-stm32f4.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) commit 5627f15847cd92d57e34896674b8471d255969e1 Author: Wolfram Sang Date: Sat Jul 6 13:20:46 2024 +0200 i2c: sprd: reword according to newest specification Change the wording of this driver wrt. the newest I2C v7 and SMBus 3.2 specifications and replace "master/slave" with more appropriate terms. Signed-off-by: Wolfram Sang Reviewed-by: Baolin Wang Reviewed-by: Andi Shyti Signed-off-by: Andi Shyti drivers/i2c/busses/i2c-sprd.c | 16 ++++++++-------- 1 file changed, 8 insertions(+), 8 deletions(-) commit c405861c605c6e4323b3470c7d1229fb179532cf Author: Wolfram Sang Date: Sat Jul 6 13:20:45 2024 +0200 i2c: sis5595: reword according to newest specification Change the wording of this driver wrt. the newest I2C v7 and SMBus 3.2 specifications and replace "master/slave" with more appropriate terms. Signed-off-by: Wolfram Sang Reviewed-by: Andi Shyti Signed-off-by: Andi Shyti drivers/i2c/busses/i2c-sis5595.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 39a6695f0e791f01f8879f1f15a700d7a8afb573 Author: Wolfram Sang Date: Sat Jul 6 13:20:44 2024 +0200 i2c: rzv2m: reword according to newest specification Change the wording of this driver wrt. the newest I2C v7 and SMBus 3.2 specifications and replace "master/slave" with more appropriate terms. Signed-off-by: Wolfram Sang Reviewed-by: Andi Shyti Signed-off-by: Andi Shyti drivers/i2c/busses/i2c-rzv2m.c | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-) commit fd4b7e03d65e4a2e135924a8c21cc79288f1ba96 Author: Wolfram Sang Date: Sat Jul 6 13:20:43 2024 +0200 i2c: robotfuzz-osif: reword according to newest specification Change the wording of this driver wrt. the newest I2C v7 and SMBus 3.2 specifications and replace "master/slave" with more appropriate terms. Signed-off-by: Wolfram Sang Reviewed-by: Andi Shyti Signed-off-by: Andi Shyti drivers/i2c/busses/i2c-robotfuzz-osif.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) commit b340db73513e95aed95d00157afa4dc7479903ed Author: Wolfram Sang Date: Sat Jul 6 13:20:42 2024 +0200 i2c: rk3x: reword according to newest specification Change the wording of this driver wrt. the newest I2C v7 and SMBus 3.2 specifications and replace "master/slave" with more appropriate terms. Signed-off-by: Wolfram Sang Reviewed-by: Heiko Stuebner Reviewed-by: Andi Shyti Signed-off-by: Andi Shyti drivers/i2c/busses/i2c-rk3x.c | 20 ++++++++++---------- 1 file changed, 10 insertions(+), 10 deletions(-) commit e1571b1fb4ff9118315b627cc6dae524709899cd Author: Wolfram Sang Date: Sat Jul 6 13:20:41 2024 +0200 i2c: riic: reword according to newest specification Change the wording of this driver wrt. the newest I2C v7 and SMBus 3.2 specifications and replace "master/slave" with more appropriate terms. Signed-off-by: Wolfram Sang Reviewed-by: Andi Shyti Signed-off-by: Andi Shyti drivers/i2c/busses/i2c-riic.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) commit 0fddb5713bc88851202e852437df1e47e7c9463e Author: Wolfram Sang Date: Sat Jul 6 13:20:40 2024 +0200 i2c: pxa-pci: reword according to newest specification Change the wording of this driver wrt. the newest I2C v7 and SMBus 3.2 specifications and replace "master/slave" with more appropriate terms. Signed-off-by: Wolfram Sang Reviewed-by: Andi Shyti Signed-off-by: Andi Shyti drivers/i2c/busses/i2c-pxa-pci.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 06b81a64c0f9a06932eeba7a76f62be8535551b7 Author: Wolfram Sang Date: Sat Jul 6 13:20:39 2024 +0200 i2c: powermac: reword according to newest specification Change the wording of this driver wrt. the newest I2C v7 and SMBus 3.2 specifications and replace "master/slave" with more appropriate terms. Signed-off-by: Wolfram Sang Reviewed-by: Andi Shyti Signed-off-by: Andi Shyti drivers/i2c/busses/i2c-powermac.c | 14 +++++++------- 1 file changed, 7 insertions(+), 7 deletions(-) commit a0ea3050082a595a3537ace01ff1efc5ff091def Author: Wolfram Sang Date: Sat Jul 6 13:20:38 2024 +0200 i2c: piix4: reword according to newest specification Change the wording of this driver wrt. the newest I2C v7 and SMBus 3.2 specifications and replace "master/slave" with more appropriate terms. Signed-off-by: Wolfram Sang Reviewed-by: Andi Shyti Signed-off-by: Andi Shyti drivers/i2c/busses/i2c-piix4.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 7d4cbda7c7ebbdf97e0c28d7640898549f6a3d0a Author: Wolfram Sang Date: Sat Jul 6 13:20:37 2024 +0200 i2c: pasemi: reword according to newest specification Change the wording of this driver wrt. the newest I2C v7 and SMBus 3.2 specifications and replace "master/slave" with more appropriate terms. Signed-off-by: Wolfram Sang Acked-by: Sven Peter Reviewed-by: Andi Shyti Signed-off-by: Andi Shyti drivers/i2c/busses/i2c-pasemi-core.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) commit b4a0ca13024319545286d7aa9ce79288261e6f4b Author: Wolfram Sang Date: Sat Jul 6 13:20:36 2024 +0200 i2c: owl: reword according to newest specification Change the wording of this driver wrt. the newest I2C v7 and SMBus 3.2 specifications and replace "master/slave" with more appropriate terms. Signed-off-by: Wolfram Sang Reviewed-by: Andi Shyti Signed-off-by: Andi Shyti drivers/i2c/busses/i2c-owl.c | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-) commit 7947d187a6ea4d42ad93c59f75c5d1a71618a522 Author: Wolfram Sang Date: Sat Jul 6 13:20:35 2024 +0200 i2c: opal: reword according to newest specification Change the wording of this driver wrt. the newest I2C v7 and SMBus 3.2 specifications and replace "master/slave" with more appropriate terms. Signed-off-by: Wolfram Sang Reviewed-by: Andi Shyti Signed-off-by: Andi Shyti drivers/i2c/busses/i2c-opal.c | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) commit 9881aac5aa11d1c7ace343ce44090b7cb2abf4e6 Author: Wolfram Sang Date: Sat Jul 6 13:20:34 2024 +0200 i2c: octeon: reword according to newest specification Change the wording of this driver wrt. the newest I2C v7 and SMBus 3.2 specifications and replace "master/slave" with more appropriate terms. Signed-off-by: Wolfram Sang Reviewed-by: Andi Shyti Signed-off-by: Andi Shyti drivers/i2c/busses/i2c-octeon-core.c | 6 +++--- drivers/i2c/busses/i2c-octeon-core.h | 4 ++-- drivers/i2c/busses/i2c-octeon-platdrv.c | 2 +- 3 files changed, 6 insertions(+), 6 deletions(-) commit 5a078b4f1f51743cb529693c29884a6b58dc02ad Author: Wolfram Sang Date: Sat Jul 6 13:20:33 2024 +0200 i2c: ocores: reword according to newest specification Change the wording of this driver wrt. the newest I2C v7 and SMBus 3.2 specifications and replace "master/slave" with more appropriate terms. Signed-off-by: Wolfram Sang Reviewed-by: Andi Shyti Signed-off-by: Andi Shyti drivers/i2c/busses/i2c-ocores.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) commit 3fdf6335231edb2deb4fd2037d5b42ec38546b86 Author: Wolfram Sang Date: Sat Jul 6 13:20:32 2024 +0200 i2c: mv64xxx: reword according to newest specification Change the wording of this driver wrt. the newest I2C v7 and SMBus 3.2 specifications and replace "master/slave" with more appropriate terms. Signed-off-by: Wolfram Sang Reviewed-by: Andi Shyti Signed-off-by: Andi Shyti drivers/i2c/busses/i2c-mv64xxx.c | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-) commit 839052d1d3a2bf82122945fdeec559f9e6187831 Author: Wolfram Sang Date: Sat Jul 6 13:20:31 2024 +0200 i2c: mt7621: reword according to newest specification Change the wording of this driver wrt. the newest I2C v7 and SMBus 3.2 specifications and replace "master/slave" with more appropriate terms. Signed-off-by: Wolfram Sang Reviewed-by: AngeloGioacchino Del Regno Reviewed-by: Stefan Roese Reviewed-by: Andi Shyti Signed-off-by: Andi Shyti drivers/i2c/busses/i2c-mt7621.c | 26 +++++++++++++------------- 1 file changed, 13 insertions(+), 13 deletions(-) commit 234b336f012807d58d71b484ea2c287f857a6e34 Author: Wolfram Sang Date: Sat Jul 6 13:20:30 2024 +0200 i2c: mpc: reword according to newest specification Change the wording of this driver wrt. the newest I2C v7 and SMBus 3.2 specifications and replace "master/slave" with more appropriate terms. Signed-off-by: Wolfram Sang Reviewed-by: Chris Packham Reviewed-by: Andi Shyti Signed-off-by: Andi Shyti drivers/i2c/busses/i2c-mpc.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) commit 84187df6aea2ae79a880c69f14198e42dedc3902 Author: Wolfram Sang Date: Sat Jul 6 13:20:29 2024 +0200 i2c: mlxcpld: reword according to newest specification Change the wording of this driver wrt. the newest I2C v7 and SMBus 3.2 specifications and replace "master/slave" with more appropriate terms. Signed-off-by: Wolfram Sang Acked-by: Vadim Pasternak Reviewed-by: Andi Shyti Signed-off-by: Andi Shyti drivers/i2c/busses/i2c-mlxcpld.c | 14 +++++++------- 1 file changed, 7 insertions(+), 7 deletions(-) commit d670ca5cf81ee73c014fb41c5f2e7fae2eb231fc Author: Wolfram Sang Date: Sat Jul 6 13:20:28 2024 +0200 i2c: ls2x: reword according to newest specification Change the wording of this driver wrt. the newest I2C v7 and SMBus 3.2 specifications and replace "master/slave" with more appropriate terms. Signed-off-by: Wolfram Sang Reviewed-by: Andi Shyti Signed-off-by: Andi Shyti drivers/i2c/busses/i2c-ls2x.c | 11 +++++------ 1 file changed, 5 insertions(+), 6 deletions(-) commit 8c6890726be6e12efaa1635916eef20cf12aea0f Author: Wolfram Sang Date: Sat Jul 6 13:20:27 2024 +0200 i2c: lpc2k: reword according to newest specification Change the wording of this driver wrt. the newest I2C v7 and SMBus 3.2 specifications and replace "master/slave" with more appropriate terms. Signed-off-by: Wolfram Sang Reviewed-by: Andi Shyti Signed-off-by: Andi Shyti drivers/i2c/busses/i2c-lpc2k.c | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) commit fe5df00856464ae55c46b6f2ddc4080a25773699 Author: Wolfram Sang Date: Sat Jul 6 13:20:26 2024 +0200 i2c: ljca: reword according to newest specification Change the wording of this driver wrt. the newest I2C v7 and SMBus 3.2 specifications and replace "master/slave" with more appropriate terms. Signed-off-by: Wolfram Sang Reviewed-by: Andi Shyti Signed-off-by: Andi Shyti drivers/i2c/busses/i2c-ljca.c | 20 ++++++++++---------- 1 file changed, 10 insertions(+), 10 deletions(-) commit 3724934a3c4475b9ed22a8cc79c6b1b227abc3c8 Author: Wolfram Sang Date: Sat Jul 6 13:20:25 2024 +0200 i2c: kempld: reword according to newest specification Change the wording of this driver wrt. the newest I2C v7 and SMBus 3.2 specifications and replace "master/slave" with more appropriate terms. Signed-off-by: Wolfram Sang Reviewed-by: Andi Shyti Signed-off-by: Andi Shyti drivers/i2c/busses/i2c-kempld.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) commit 057377dc0b9f1f1b43721b2c92cfd2df18236df0 Author: Wolfram Sang Date: Sat Jul 6 13:20:24 2024 +0200 i2c: jz4780: reword according to newest specification Change the wording of this driver wrt. the newest I2C v7 and SMBus 3.2 specifications and replace "master/slave" with more appropriate terms. Signed-off-by: Wolfram Sang Acked-by: Paul Cercueil Reviewed-by: Andi Shyti Signed-off-by: Andi Shyti drivers/i2c/busses/i2c-jz4780.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) commit 7d06f94e2c05940a32cd6d65e780a9fec4654233 Author: Wolfram Sang Date: Sat Jul 6 13:20:23 2024 +0200 i2c: isch: reword according to newest specification Change the wording of this driver wrt. the newest I2C v7 and SMBus 3.2 specifications and replace "master/slave" with more appropriate terms. Signed-off-by: Wolfram Sang Reviewed-by: Andi Shyti Signed-off-by: Andi Shyti drivers/i2c/busses/i2c-isch.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 5e705f93fbf752b614c2c8c1d55522e777d77335 Author: Wolfram Sang Date: Sat Jul 6 13:20:22 2024 +0200 i2c: iop3xx: reword according to newest specification Change the wording of this driver wrt. the newest I2C v7 and SMBus 3.2 specifications and replace "master/slave" with more appropriate terms. Remove a useless comment while here. Signed-off-by: Wolfram Sang Reviewed-by: Andi Shyti Signed-off-by: Andi Shyti drivers/i2c/busses/i2c-iop3xx.c | 15 ++++++--------- 1 file changed, 6 insertions(+), 9 deletions(-) commit 8946eb1048b6f4b7ce44e3478760ec44945e560d Author: Wolfram Sang Date: Sat Jul 6 13:20:21 2024 +0200 i2c: ibm_iic: reword according to newest specification Change the wording of this driver wrt. the newest I2C v7 and SMBus 3.2 specifications and replace "master/slave" with more appropriate terms. Remove a useless comment while here. Signed-off-by: Wolfram Sang Reviewed-by: Andi Shyti Signed-off-by: Andi Shyti drivers/i2c/busses/i2c-ibm_iic.c | 27 +++++++++++---------------- 1 file changed, 11 insertions(+), 16 deletions(-) commit d08cac0a6378c310ba0ab17e798d9be87db77c3e Author: Wolfram Sang Date: Sat Jul 6 13:20:20 2024 +0200 i2c: i801: reword according to newest specification Change the wording of this driver wrt. the newest I2C v7 and SMBus 3.2 specifications and replace "master/slave" with more appropriate terms. Signed-off-by: Wolfram Sang Reviewed-by: Andi Shyti Signed-off-by: Andi Shyti drivers/i2c/busses/i2c-i801.c | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-) commit 7c9e67055ac3d2d03850f0d92d194ebd661aa26b Author: Wolfram Sang Date: Sat Jul 6 13:20:19 2024 +0200 i2c: hix5hd2: reword according to newest specification Change the wording of this driver wrt. the newest I2C v7 and SMBus 3.2 specifications and replace "master/slave" with more appropriate terms. Signed-off-by: Wolfram Sang Reviewed-by: Andi Shyti Signed-off-by: Andi Shyti drivers/i2c/busses/i2c-hix5hd2.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) commit 3fd5894f7d23fd51ab43d1aecb55e2451aa15182 Author: Wolfram Sang Date: Sat Jul 6 13:20:18 2024 +0200 i2c: hisi: reword according to newest specification Change the wording of this driver wrt. the newest I2C v7 and SMBus 3.2 specifications and replace "master/slave" with more appropriate terms. Signed-off-by: Wolfram Sang Reviewed-by: Andi Shyti Signed-off-by: Andi Shyti drivers/i2c/busses/i2c-hisi.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) commit 5c9c9bff687ba6e1ec5ed6ce5fcf101eaaab8bc7 Author: Wolfram Sang Date: Sat Jul 6 13:20:17 2024 +0200 i2c: highlander: reword according to newest specification Change the wording of this driver wrt. the newest I2C v7 and SMBus 3.2 specifications and replace "master/slave" with more appropriate terms. Signed-off-by: Wolfram Sang Reviewed-by: Andi Shyti Signed-off-by: Andi Shyti drivers/i2c/busses/i2c-highlander.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 9557d1264de3fed328c7e10e2c463506c6533fdf Author: Wolfram Sang Date: Sat Jul 6 13:20:16 2024 +0200 i2c: gpio: reword according to newest specification Change the wording of this driver wrt. the newest I2C v7 and SMBus 3.2 specifications and replace "master/slave" with more appropriate terms. Signed-off-by: Wolfram Sang Reviewed-by: Andi Shyti Signed-off-by: Andi Shyti drivers/i2c/busses/i2c-gpio.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) commit 57deeb98d5f228f2ab9712d6233760c6be645453 Author: Wolfram Sang Date: Sat Jul 6 13:20:15 2024 +0200 i2c: fsi: reword according to newest specification Change the wording of this driver wrt. the newest I2C v7 and SMBus 3.2 specifications and replace "master/slave" with more appropriate terms. Signed-off-by: Wolfram Sang Reviewed-by: Eddie James Reviewed-by: Andi Shyti Signed-off-by: Andi Shyti drivers/i2c/busses/i2c-fsi.c | 56 ++++++++++++++++++++++---------------------- 1 file changed, 28 insertions(+), 28 deletions(-) commit 37ce300ed6d9dc730994e4e753912a5c4d773acf Author: Wolfram Sang Date: Sat Jul 6 13:20:14 2024 +0200 i2c: dln2: reword according to newest specification Change the wording of this driver wrt. the newest I2C v7 and SMBus 3.2 specifications and replace "master/slave" with more appropriate terms. Signed-off-by: Wolfram Sang Reviewed-by: Andi Shyti Signed-off-by: Andi Shyti drivers/i2c/busses/i2c-dln2.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) commit 3f1ca8a5396eb8785061015d42aa30d9506863ad Author: Wolfram Sang Date: Sat Jul 6 13:20:13 2024 +0200 i2c: diolan-u2c: reword according to newest specification Change the wording of this driver wrt. the newest I2C v7 and SMBus 3.2 specifications and replace "master/slave" with more appropriate terms. Signed-off-by: Wolfram Sang Acked-by: Guenter Roeck Reviewed-by: Andi Shyti Signed-off-by: Andi Shyti drivers/i2c/busses/i2c-diolan-u2c.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 4c77db838892f07f5e1601afaad569972fc17b76 Author: Wolfram Sang Date: Sat Jul 6 13:20:12 2024 +0200 i2c: digicolor: reword according to newest specification Change the wording of this driver wrt. the newest I2C v7 and SMBus 3.2 specifications and replace "master/slave" with more appropriate terms. Signed-off-by: Wolfram Sang Reviewed-by: Andi Shyti Signed-off-by: Andi Shyti drivers/i2c/busses/i2c-digicolor.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) commit 68e4c181719f8dd9bb2bbbb075501c4888023eb5 Author: Wolfram Sang Date: Sat Jul 6 13:20:11 2024 +0200 i2c: davinci: reword according to newest specification Change the wording of this driver wrt. the newest I2C v7 and SMBus 3.2 specifications and replace "master/slave" with more appropriate terms. Remove and reword comments while here. Signed-off-by: Wolfram Sang Acked-by: Bartosz Golaszewski Reviewed-by: Andi Shyti Signed-off-by: Andi Shyti drivers/i2c/busses/i2c-davinci.c | 17 ++++++++--------- 1 file changed, 8 insertions(+), 9 deletions(-) commit 828434af3d9850d4cf85ee20890fbb043448e856 Author: Wolfram Sang Date: Sat Jul 6 13:20:10 2024 +0200 i2c: cros-ec-tunnel: reword according to newest specification Change the wording of this driver wrt. the newest I2C v7 and SMBus 3.2 specifications and replace "master/slave" with more appropriate terms. Signed-off-by: Wolfram Sang Reviewed-by: Andi Shyti Signed-off-by: Andi Shyti drivers/i2c/busses/i2c-cros-ec-tunnel.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) commit 71ab90129a21f6be337170b6f834a05c4c6b7656 Author: Wolfram Sang Date: Wed Jul 10 08:41:23 2024 +0200 i2c: cp2615: reword according to newest specification Change the wording of this driver wrt. the newest I2C v7 and SMBus 3.2 specifications and replace "master/slave" with more appropriate terms. Signed-off-by: Wolfram Sang Acked-by: Bence Csókás Signed-off-by: Andi Shyti drivers/i2c/busses/i2c-cp2615.c | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) commit 124ac28619efa9e0afa8deb8c32f211806a5ec62 Author: Wolfram Sang Date: Sat Jul 6 13:20:08 2024 +0200 i2c: cht-wc: reword according to newest specification Change the wording of this driver wrt. the newest I2C v7 and SMBus 3.2 specifications and replace "master/slave" with more appropriate terms. Signed-off-by: Wolfram Sang Reviewed-by: Andi Shyti Reviewed-by: Hans de Goede Signed-off-by: Andi Shyti drivers/i2c/busses/i2c-cht-wc.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) commit 91d1f6c5c7c4e91770216eec93b60aa9e535604e Author: Wolfram Sang Date: Sat Jul 6 13:20:07 2024 +0200 i2c: brcmstb: reword according to newest specification Change the wording of this driver wrt. the newest I2C v7 and SMBus 3.2 specifications and replace "master/slave" with more appropriate terms. Remove a useless comment while here. Signed-off-by: Wolfram Sang Reviewed-by: Andi Shyti Reviewed-by: Florian Fainelli Signed-off-by: Andi Shyti drivers/i2c/busses/i2c-brcmstb.c | 11 +++++------ 1 file changed, 5 insertions(+), 6 deletions(-) commit efaa4dca48e7d654bc33a2ba09e42d6e3b08a3f1 Author: Wolfram Sang Date: Sat Jul 6 13:20:06 2024 +0200 i2c: bcm2835: reword according to newest specification Change the wording of this driver wrt. the newest I2C v7 and SMBus 3.2 specifications and replace "master/slave" with more appropriate terms. Signed-off-by: Wolfram Sang Reviewed-by: Florian Fainelli Reviewed-by: Andi Shyti Signed-off-by: Andi Shyti drivers/i2c/busses/i2c-bcm2835.c | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) commit 045f96ed93876d02bc8c853deab41267f5840901 Author: Wolfram Sang Date: Sat Jul 6 13:20:05 2024 +0200 i2c: bcm-kona: reword according to newest specification Change the wording of this driver wrt. the newest I2C v7 and SMBus 3.2 specifications and replace "master/slave" with more appropriate terms. Remove a useless comment while here. Signed-off-by: Wolfram Sang Reviewed-by: Andi Shyti Reviewed-by: Florian Fainelli Signed-off-by: Andi Shyti drivers/i2c/busses/i2c-bcm-kona.c | 13 ++++++------- 1 file changed, 6 insertions(+), 7 deletions(-) commit a4c98e4adacd6d16f8d2e7ca9da75a43da1dcfd0 Author: Wolfram Sang Date: Sat Jul 6 13:20:04 2024 +0200 i2c: au1550: reword according to newest specification Change the wording of this driver wrt. the newest I2C v7 and SMBus 3.2 specifications and replace "master/slave" with more appropriate terms. Remove a useless comment while here. Signed-off-by: Wolfram Sang Reviewed-by: Andi Shyti Signed-off-by: Andi Shyti drivers/i2c/busses/i2c-au1550.c | 15 +++++++-------- 1 file changed, 7 insertions(+), 8 deletions(-) commit d7f365fc379c68eebbf3096f51db59b4ff48f67d Author: Wolfram Sang Date: Sat Jul 6 13:20:03 2024 +0200 i2c: altera: reword according to newest specification Change the wording of this driver wrt. the newest I2C v7 and SMBus 3.2 specifications and replace "master/slave" with more appropriate terms. Signed-off-by: Wolfram Sang Reviewed-by: Andi Shyti Signed-off-by: Andi Shyti drivers/i2c/busses/i2c-altera.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) commit 4954abc402cc6d352bfcb51a091f046f5c31766d Author: Wolfram Sang Date: Sat Jul 6 13:20:02 2024 +0200 i2c: ali15x3: reword according to newest specification Change the wording of this driver wrt. the newest I2C v7 and SMBus 3.2 specifications and replace "master/slave" with more appropriate terms. Signed-off-by: Wolfram Sang Reviewed-by: Andi Shyti Signed-off-by: Andi Shyti drivers/i2c/busses/i2c-ali15x3.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit a93c2e5fe766825d6264823fd1dca9aae747cf5d Author: Wolfram Sang Date: Sat Jul 6 13:20:01 2024 +0200 i2c: reword i2c_algorithm according to newest specification Start changing the wording of the I2C main header wrt. the newest I2C v7 and SMBus 3.2 specifications and replace "master/slave" with more appropriate terms. The first step renames the members of struct i2c_algorithm. Once all in-tree users are converted, the anonymous union will go away again. All this work will also pave the way for finally seperating the monolithic header into more fine-grained headers like "i2c/clients.h" etc. Signed-off-by: Wolfram Sang Reviewed-by: Andi Shyti Signed-off-by: Andi Shyti include/linux/i2c.h | 24 +++++++++++++++++++----- 1 file changed, 19 insertions(+), 5 deletions(-) commit 87e552ad654554be73e62dd43c923bcee215287d Author: Dan Carpenter Date: Thu Jul 4 10:19:32 2024 -0500 leds: flash: leds-qcom-flash: Test the correct variable in init This code was passing the incorrect pointer to PTR_ERR_OR_ZERO() so it always returned success. It should have been checking the array element instead of the array itself. Fixes: 96a2e242a5dc ("leds: flash: Add driver to support flash LED module in QCOM PMICs") Signed-off-by: Dan Carpenter Link: https://lore.kernel.org/r/ZoWJS_epjIMCYITg@stanley.mountain Signed-off-by: Lee Jones drivers/leds/flash/leds-qcom-flash.c | 10 +++++++--- 1 file changed, 7 insertions(+), 3 deletions(-) commit 4137d94fd8726431b8bf3ab329311c59e80f5530 Author: Christian Marangi Date: Thu Jun 27 00:15:13 2024 +0200 leds: leds-lp55xx: Convert mutex lock/unlock to guard API Convert any entry of mutex lock/unlock to guard API and simplify code. With the use of guard API, handling for selttest functions can be greatly simplified. Suggested-by: Markus Elfring Signed-off-by: Christian Marangi Link: https://lore.kernel.org/r/20240626221520.2846-3-ansuelsmth@gmail.com Signed-off-by: Lee Jones drivers/leds/leds-lp5521.c | 5 ++- drivers/leds/leds-lp5523.c | 25 ++++------- drivers/leds/leds-lp5562.c | 13 +++--- drivers/leds/leds-lp5569.c | 18 +++----- drivers/leds/leds-lp55xx-common.c | 95 +++++++++++++++++---------------------- 5 files changed, 64 insertions(+), 92 deletions(-) commit c2bb8198fee88a428513f8d023c627ecd13aa694 Author: Guenter Roeck Date: Wed Jul 10 22:53:52 2024 -0700 regmap: kunit: Add test cases for regmap_multi_reg_(read,write}() Add test cases for regmap_multi_reg_read() and regmap_multi_reg_write(). Signed-off-by: Guenter Roeck Link: https://patch.msgid.link/20240711055352.3411807-1-linux@roeck-us.net Signed-off-by: Mark Brown drivers/base/regmap/regmap-kunit.c | 73 ++++++++++++++++++++++++++++++++++++++ 1 file changed, 73 insertions(+) commit 833cd3e9ad8360785b6c23c82dd3856df00732d9 Author: Qiuxu Zhuo Date: Wed Jul 3 22:17:37 2024 +0800 drm/fb-helper: Don't schedule_work() to flush frame buffer during panic() Sometimes the system [1] hangs on x86 I/O machine checks. However, the expected behavior is to reboot the system, as the machine check handler ultimately triggers a panic(), initiating a reboot in the last step. The root cause is that sometimes the panic() is blocked when drm_fb_helper_damage() invoking schedule_work() to flush the frame buffer. This occurs during the process of flushing all messages to the frame buffer driver as shown in the following call trace: Machine check occurs [2]: panic() console_flush_on_panic() console_flush_all() console_emit_next_record() con->write() vt_console_print() hide_cursor() vc->vc_sw->con_cursor() fbcon_cursor() ops->cursor() bit_cursor() soft_cursor() info->fbops->fb_imageblit() drm_fbdev_generic_defio_imageblit() drm_fb_helper_damage_area() drm_fb_helper_damage() schedule_work() // <--- blocked here ... emergency_restart() // wasn't invoked, so no reboot. During panic(), except the panic CPU, all the other CPUs are stopped. In schedule_work(), the panic CPU requires the lock of worker_pool to queue the work on that pool, while the lock may have been token by some other stopped CPU. So schedule_work() is blocked. Additionally, during a panic(), since there is no opportunity to execute any scheduled work, it's safe to fix this issue by skipping schedule_work() on 'oops_in_progress' in drm_fb_helper_damage(). [1] Enable the kernel option CONFIG_FRAMEBUFFER_CONSOLE, CONFIG_DRM_FBDEV_EMULATION, and boot with the 'console=tty0' kernel command line parameter. [2] Set 'panic_timeout' to a non-zero value before calling panic(). Acked-by: Thomas Zimmermann Reported-by: Yudong Wang Tested-by: Yudong Wang Signed-off-by: Qiuxu Zhuo Link: https://patchwork.freedesktop.org/patch/msgid/20240703141737.75378-1-qiuxu.zhuo@intel.com Signed-off-by: Maarten Lankhorst,,, drivers/gpu/drm/drm_fb_helper.c | 11 +++++++++++ 1 file changed, 11 insertions(+) commit bbddfa2255dd0800209697fd12378e02ed05f833 Author: Chengchang Tang Date: Wed Jul 10 21:37:05 2024 +0800 RDMA/hns: Fix mbx timing out before CMD execution is completed When a large number of tasks are issued, the speed of HW processing mbx will slow down. The standard for judging mbx timeout in the current firmware is 30ms, and the current timeout standard for the driver is also 30ms. Considering that firmware scheduling in multi-function scenarios takes a certain amount of time, this will cause the driver to time out too early and report a failure before mbx execution times out. This patch introduces a new mechanism that can set different timeouts for different cmds and extends the timeout of mbx to 35ms. Fixes: a04ff739f2a9 ("RDMA/hns: Add command queue support for hip08 RoCE driver") Signed-off-by: Chengchang Tang Signed-off-by: Junxian Huang Link: https://lore.kernel.org/r/20240710133705.896445-9-huangjunxian6@hisilicon.com Signed-off-by: Leon Romanovsky drivers/infiniband/hw/hns/hns_roce_hw_v2.c | 35 ++++++++++++++++++++++++------ drivers/infiniband/hw/hns/hns_roce_hw_v2.h | 6 +++++ 2 files changed, 34 insertions(+), 7 deletions(-) commit 0b8e658f70ffd5dc7cda3872fd524d657d4796b7 Author: Chengchang Tang Date: Wed Jul 10 21:37:04 2024 +0800 RDMA/hns: Fix insufficient extend DB for VFs. VFs and its PF will share the memory of the extend DB. Currently, the number of extend DB allocated by driver is only enough for PF. This leads to a probability of DB loss and some other problems in scenarios where both PF and VFs use a large number of QPs. Fixes: 6b63597d3540 ("RDMA/hns: Add TSQ link table support") Signed-off-by: Chengchang Tang Signed-off-by: Junxian Huang Link: https://lore.kernel.org/r/20240710133705.896445-8-huangjunxian6@hisilicon.com Signed-off-by: Leon Romanovsky drivers/infiniband/hw/hns/hns_roce_hw_v2.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) commit 36397b907355e2fdb5a25a02a7921a937fd8ef4c Author: Chengchang Tang Date: Wed Jul 10 21:37:03 2024 +0800 RDMA/hns: Fix undifined behavior caused by invalid max_sge If max_sge has been set to 0, roundup_pow_of_two() in set_srq_basic_param() may have undefined behavior. Fixes: 9dd052474a26 ("RDMA/hns: Allocate one more recv SGE for HIP08") Signed-off-by: Chengchang Tang Signed-off-by: Junxian Huang Link: https://lore.kernel.org/r/20240710133705.896445-7-huangjunxian6@hisilicon.com Signed-off-by: Leon Romanovsky drivers/infiniband/hw/hns/hns_roce_srq.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 24c6291346d98c7ece4f4bfeb5733bec1d6c7b4f Author: Chengchang Tang Date: Wed Jul 10 21:37:02 2024 +0800 RDMA/hns: Fix shift-out-bounds when max_inline_data is 0 A shift-out-bounds may occur, if the max_inline_data has not been set. The related log: UBSAN: shift-out-of-bounds in kernel/include/linux/log2.h:57:13 shift exponent 64 is too large for 64-bit type 'long unsigned int' Call trace: dump_backtrace+0xb0/0x118 show_stack+0x20/0x38 dump_stack_lvl+0xbc/0x120 dump_stack+0x1c/0x28 __ubsan_handle_shift_out_of_bounds+0x104/0x240 set_ext_sge_param+0x40c/0x420 [hns_roce_hw_v2] hns_roce_create_qp+0xf48/0x1c40 [hns_roce_hw_v2] create_qp.part.0+0x294/0x3c0 ib_create_qp_kernel+0x7c/0x150 create_mad_qp+0x11c/0x1e0 ib_mad_init_device+0x834/0xc88 add_client_context+0x248/0x318 enable_device_and_get+0x158/0x280 ib_register_device+0x4ac/0x610 hns_roce_init+0x890/0xf98 [hns_roce_hw_v2] __hns_roce_hw_v2_init_instance+0x398/0x720 [hns_roce_hw_v2] hns_roce_hw_v2_init_instance+0x108/0x1e0 [hns_roce_hw_v2] hclge_init_roce_client_instance+0x1a0/0x358 [hclge] hclge_init_client_instance+0xa0/0x508 [hclge] hnae3_register_client+0x18c/0x210 [hnae3] hns_roce_hw_v2_init+0x28/0xff8 [hns_roce_hw_v2] do_one_initcall+0xe0/0x510 do_init_module+0x110/0x370 load_module+0x2c6c/0x2f20 init_module_from_file+0xe0/0x140 idempotent_init_module+0x24c/0x350 __arm64_sys_finit_module+0x88/0xf8 invoke_syscall+0x68/0x1a0 el0_svc_common.constprop.0+0x11c/0x150 do_el0_svc+0x38/0x50 el0_svc+0x50/0xa0 el0t_64_sync_handler+0xc0/0xc8 el0t_64_sync+0x1a4/0x1a8 Fixes: 0c5e259b06a8 ("RDMA/hns: Fix incorrect sge nums calculation") Signed-off-by: Chengchang Tang Signed-off-by: Junxian Huang Link: https://lore.kernel.org/r/20240710133705.896445-6-huangjunxian6@hisilicon.com Signed-off-by: Leon Romanovsky drivers/infiniband/hw/hns/hns_roce_qp.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) commit d387d4b54eb84208bd4ca13572e106851d0a0819 Author: Chengchang Tang Date: Wed Jul 10 21:37:01 2024 +0800 RDMA/hns: Fix missing pagesize and alignment check in FRMR The offset requires 128B alignment and the page size ranges from 4K to 128M. Fixes: 68a997c5d28c ("RDMA/hns: Add FRMR support for hip08") Signed-off-by: Chengchang Tang Signed-off-by: Junxian Huang Link: https://lore.kernel.org/r/20240710133705.896445-5-huangjunxian6@hisilicon.com Signed-off-by: Leon Romanovsky drivers/infiniband/hw/hns/hns_roce_device.h | 4 ++++ drivers/infiniband/hw/hns/hns_roce_mr.c | 5 +++++ 2 files changed, 9 insertions(+) commit 543fb987bd63ed27409b5dea3d3eec27b9c1eac9 Author: Junxian Huang Date: Wed Jul 10 21:37:00 2024 +0800 RDMA/hns: Fix unmatch exception handling when init eq table fails The hw ctx should be destroyed when init eq table fails. Fixes: a5073d6054f7 ("RDMA/hns: Add eq support of hip08") Signed-off-by: Junxian Huang Link: https://lore.kernel.org/r/20240710133705.896445-4-huangjunxian6@hisilicon.com Signed-off-by: Leon Romanovsky drivers/infiniband/hw/hns/hns_roce_hw_v2.c | 25 +++++++++++++------------ 1 file changed, 13 insertions(+), 12 deletions(-) commit 2fdf34038369c0a27811e7b4680662a14ada1d6b Author: Junxian Huang Date: Wed Jul 10 21:36:59 2024 +0800 RDMA/hns: Fix soft lockup under heavy CEQE load CEQEs are handled in interrupt handler currently. This may cause the CPU core staying in interrupt context too long and lead to soft lockup under heavy load. Handle CEQEs in BH workqueue and set an upper limit for the number of CEQE handled by a single call of work handler. Fixes: a5073d6054f7 ("RDMA/hns: Add eq support of hip08") Signed-off-by: Junxian Huang Link: https://lore.kernel.org/r/20240710133705.896445-3-huangjunxian6@hisilicon.com Signed-off-by: Leon Romanovsky drivers/infiniband/hw/hns/hns_roce_device.h | 1 + drivers/infiniband/hw/hns/hns_roce_hw_v2.c | 89 +++++++++++++++++------------ 2 files changed, 54 insertions(+), 36 deletions(-) commit 6afa2c0bfb8ef69f65715ae059e5bd5f9bbaf03b Author: Junxian Huang Date: Wed Jul 10 21:36:58 2024 +0800 RDMA/hns: Check atomic wr length 8 bytes is the only supported length of atomic. Add this check in set_rc_wqe(). Besides, stop processing WQEs and return from set_rc_wqe() if there is any error. Fixes: 384f88185112 ("RDMA/hns: Add atomic support") Signed-off-by: Junxian Huang Link: https://lore.kernel.org/r/20240710133705.896445-2-huangjunxian6@hisilicon.com Signed-off-by: Leon Romanovsky drivers/infiniband/hw/hns/hns_roce_device.h | 2 ++ drivers/infiniband/hw/hns/hns_roce_hw_v2.c | 9 +++++++-- 2 files changed, 9 insertions(+), 2 deletions(-) commit b851268018f0d63cb2069b5589bf4dbee1c74287 Author: Peng Hao Date: Wed Jul 10 17:16:57 2024 +0800 RDMA/ocrdma: Don't inline statistics functions Fix the problem of KASAN causing the stack frame size to increase drivers/infiniband/hw/ocrdma/ocrdma_stats.c:686:16: error: stack frame size (20664) exceeds limit (8192) in 'ocrdma_dbgfs_ops_read' [-Werror,-Wframe-larger-than] static ssize_t ocrdma_dbgfs_ops_read(struct file *filp, char __user *buffer, ^ Some functions called by ocrdma_dbgfs_ops_read occupy a lot of stack space. Mark these functions as noinline_for_stack to prevent them from accumulating in ocrdma_dbgfs_ops_read. Signed-off-by: Peng Hao Link: https://lore.kernel.org/r/20240710091657.26291-1-flyingpeng@tencent.com Signed-off-by: Leon Romanovsky drivers/infiniband/hw/ocrdma/ocrdma_stats.c | 22 +++++++++++----------- 1 file changed, 11 insertions(+), 11 deletions(-) commit 8b5ea9029b03efda74292c57e0377a98ed0b7434 Author: Easwar Hariharan Date: Thu Jul 11 05:27:34 2024 +0000 fbdev: viafb: Make I2C terminology more inclusive I2C v7, SMBus 3.2, and I3C 1.1.1 specifications have replaced "master/slave" with more appropriate terms. Inspired by Wolfram's series to fix drivers/i2c/, fix the terminology for users of I2C_ALGOBIT bitbanging interface, now that the approved verbiage exists in the specification. Acked-by: Thomas Zimmermann Signed-off-by: Easwar Hariharan Signed-off-by: Helge Deller drivers/video/fbdev/via/chip.h | 8 ++++---- drivers/video/fbdev/via/dvi.c | 24 ++++++++++++------------ drivers/video/fbdev/via/lcd.c | 6 +++--- drivers/video/fbdev/via/via_aux.h | 2 +- drivers/video/fbdev/via/via_i2c.c | 12 ++++++------ drivers/video/fbdev/via/vt1636.c | 6 +++--- 6 files changed, 29 insertions(+), 29 deletions(-) commit 3cf12cabc3be2855466e1433d943455b1032fd86 Author: Easwar Hariharan Date: Thu Jul 11 05:27:33 2024 +0000 fbdev: smscufx: Make I2C terminology more inclusive I2C v7, SMBus 3.2, and I3C 1.1.1 specifications have replaced "master/slave" with more appropriate terms. Inspired by Wolfram's series to fix drivers/i2c/, fix the terminology for users of I2C_ALGOBIT bitbanging interface, now that the approved verbiage exists in the specification. Acked-by: Thomas Zimmermann Signed-off-by: Easwar Hariharan Signed-off-by: Helge Deller drivers/video/fbdev/smscufx.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) commit 5fa96c7ab3dc666c2904a35895635156c17a8f05 Author: Borislav Petkov (AMD) Date: Mon Jul 1 12:34:51 2024 +0200 Documentation/ABI/configfs-tsm: Fix an unexpected indentation silly Fix: Documentation/ABI/testing/configfs-tsm:97: ERROR: Unexpected indentation when building htmldocs with sphinx. I can't say I'm loving those rigid sphinx rules but whatever, make it shut up. Fixes: 627dc671518b ("x86/sev: Extend the config-fs attestation support for an SVSM") Reported-by: Stephen Rothwell Signed-off-by: Borislav Petkov (AMD) Reviewed-by: Bagas Sanjaya Link: https://lore.kernel.org/r/20240701184557.4735ca3d@canb.auug.org.au Documentation/ABI/testing/configfs-tsm | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) commit 0440feb090790c6243bca85d6a794824e71ff26c Author: Tom Lendacky Date: Fri Jun 21 10:42:05 2024 -0500 x86/sev: Do RMP memory coverage check after max_pfn has been set The RMP table is probed early in the boot process before max_pfn has been set, so the logic to check if the RMP covers all of system memory is not valid. Move the RMP memory coverage check from snp_probe_rmptable_info() into snp_rmptable_init(), which is well after max_pfn has been set. Also, fix the calculation to use PFN_UP instead of PHYS_PFN, in order to compute the required RMP size properly. Fixes: 216d106c7ff7 ("x86/sev: Add SEV-SNP host initialization support") Signed-off-by: Tom Lendacky Signed-off-by: Borislav Petkov (AMD) Link: https://lore.kernel.org/r/bec4364c7e34358cc576f01bb197a7796a109169.1718984524.git.thomas.lendacky@amd.com arch/x86/virt/svm/sev.c | 44 ++++++++++++++++++++++---------------------- 1 file changed, 22 insertions(+), 22 deletions(-) commit 38918e0bb2c51c21ea464b071a254b27ff9aa71d Author: Borislav Petkov (AMD) Date: Wed Jun 19 11:03:16 2024 +0200 x86/sev: Move SEV compilation units A long time ago it was agreed upon that the coco stuff needs to go where it belongs: https://lore.kernel.org/all/Yg5nh1RknPRwIrb8@zn.tnic and not keep it in arch/x86/kernel. TDX did that and SEV can't find time to do so. So lemme do it. If people have trouble converting their ongoing featuritis patches, ask me for a sed script. No functional changes. Move the instrumentation exclusion bits too, as helpfully caught and reported by the 0day folks. Closes: https://lore.kernel.org/oe-kbuild-all/202406220748.hG3qlmDx-lkp@intel.com Reported-by: kernel test robot Closes: https://lore.kernel.org/oe-lkp/202407091342.46d7dbb-oliver.sang@intel.com Reported-by: kernel test robot Signed-off-by: Borislav Petkov (AMD) Reviewed-by: Nikunj A Dadhania Reviewed-by: Ashish Kalra Tested-by: kernel test robot Link: https://lore.kernel.org/r/20240619093014.17962-1-bp@kernel.org arch/x86/boot/compressed/sev.c | 2 +- arch/x86/coco/Makefile | 1 + arch/x86/coco/sev/Makefile | 15 +++++++++++++++ arch/x86/{kernel/sev.c => coco/sev/core.c} | 2 +- arch/x86/{kernel/sev-shared.c => coco/sev/shared.c} | 0 arch/x86/kernel/Makefile | 6 ------ 6 files changed, 18 insertions(+), 8 deletions(-) commit 911daf695a740d9a58daef65dabfb5f69f18190f Author: Konstantin Komarov Date: Wed Jun 26 15:26:18 2024 +0300 fs/ntfs3: Fix formatting, change comments, renaming Huacai Chen: The label end_reply is obviously a typo. It should be "replay" in this context. So rename end_reply to end_replay. Suggested-by: Huacai Chen Signed-off-by: Konstantin Komarov fs/ntfs3/attrib.c | 6 +++--- fs/ntfs3/file.c | 14 +++++++++----- fs/ntfs3/fslog.c | 8 ++++---- fs/ntfs3/inode.c | 7 ++++--- fs/ntfs3/namei.c | 4 +--- 5 files changed, 21 insertions(+), 18 deletions(-) commit 2fef55d8f78383c8e6d6d4c014b9597375132696 Author: Huacai Chen Date: Wed May 29 14:40:52 2024 +0800 fs/ntfs3: Update log->page_{mask,bits} if log->page_size changed If an NTFS file system is mounted to another system with different PAGE_SIZE from the original system, log->page_size will change in log_replay(), but log->page_{mask,bits} don't change correspondingly. This will cause a panic because "u32 bytes = log->page_size - page_off" will get a negative value in the later read_log_page(). Cc: stable@vger.kernel.org Fixes: b46acd6a6a627d876898e ("fs/ntfs3: Add NTFS journal") Signed-off-by: Huacai Chen Signed-off-by: Konstantin Komarov fs/ntfs3/fslog.c | 3 +++ 1 file changed, 3 insertions(+) commit 5bfb91c71207ef3f0058701eeca86d96c0a39447 Author: Konstantin Komarov Date: Tue Jun 18 17:31:21 2024 +0300 fs/ntfs3: Implement simple fileattr fileattr added to support chattr. Supported attributes: compressed and immutable. Signed-off-by: Konstantin Komarov fs/ntfs3/file.c | 76 ++++++++++++++++++++++++++++++++++++++++++++++++++---- fs/ntfs3/namei.c | 2 ++ fs/ntfs3/ntfs_fs.h | 3 +++ 3 files changed, 76 insertions(+), 5 deletions(-) commit 1ff2e956608c12a069faded7a01799d3206e8b1e Author: Konstantin Komarov Date: Mon Jun 17 15:03:21 2024 +0300 fs/ntfs3: Redesign legacy ntfs support 1) Make is_legacy_ntfs static inline. 2) Put legacy file_operations under #if IS_ENABLED(CONFIG_NTFS_FS). Cc: Matthew Wilcox (Oracle) Cc: Christian Brauner Signed-off-by: Konstantin Komarov fs/ntfs3/dir.c | 2 ++ fs/ntfs3/file.c | 2 ++ fs/ntfs3/inode.c | 28 ++++++++++++---------------- fs/ntfs3/ntfs_fs.h | 7 +++++++ fs/ntfs3/super.c | 2 -- 5 files changed, 23 insertions(+), 18 deletions(-) commit b9906f8162478c778c5212720efb19633a458ade Author: Konstantin Komarov Date: Mon Jun 17 14:56:03 2024 +0300 fs/ntfs3: Use function file_inode to get inode from file Signed-off-by: Konstantin Komarov fs/ntfs3/file.c | 12 +++++------- 1 file changed, 5 insertions(+), 7 deletions(-) commit 791e5620c143232a5db8ff47686869bd3815457f Author: Konstantin Komarov Date: Mon Jun 17 14:47:20 2024 +0300 fs/ntfs3: Minor ntfs_list_ea refactoring For easy internal debugging. Signed-off-by: Konstantin Komarov fs/ntfs3/xattr.c | 25 +++++++++++++------------ 1 file changed, 13 insertions(+), 12 deletions(-) commit 744375343662058cbfda96d871786e5a5cbe1947 Author: Konstantin Komarov Date: Mon Jun 17 14:53:57 2024 +0300 fs/ntfs3: Check more cases when directory is corrupted Mark ntfs dirty in this case. Rename ntfs_filldir to ntfs_dir_emit. Signed-off-by: Konstantin Komarov fs/ntfs3/dir.c | 52 ++++++++++++++++++++++++++++++++-------------------- 1 file changed, 32 insertions(+), 20 deletions(-) commit d57431c6f511bf020e474026d9f3123d7bfbea8c Author: Konstantin Komarov Date: Mon Jun 17 15:14:07 2024 +0300 fs/ntfs3: Do copy_to_user out of run_lock In order not to call copy_to_user (from fiemap_fill_next_extent) we allocate memory in the kernel, fill it and copy it to user memory after up_read(run_lock). Reported-by: syzbot+36bb70085ef6edc2ebb9@syzkaller.appspotmail.com Signed-off-by: Konstantin Komarov fs/ntfs3/frecord.c | 75 +++++++++++++++++++++++++++++++++++++++++++++++++++--- 1 file changed, 72 insertions(+), 3 deletions(-) commit eb95678ee930d67d79fc83f0a700245ae7230455 Author: Konstantin Komarov Date: Tue Jun 18 17:11:37 2024 +0300 fs/ntfs3: Keep runs for $MFT::$ATTR_DATA and $MFT::$ATTR_BITMAP We skip the run_truncate_head call also for $MFT::$ATTR_BITMAP. Otherwise wnd_map()/run_lookup_entry will not find the disk position for the bitmap parts. Fixes: 0e5b044cbf3a ("fs/ntfs3: Refactoring attr_set_size to restore after errors") Signed-off-by: Konstantin Komarov fs/ntfs3/attrib.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) commit 2cbbd96820255fff4f0ad1533197370c9ccc570b Author: Konstantin Komarov Date: Mon Jun 17 13:43:09 2024 +0300 fs/ntfs3: Missed error return Fixes: 3f3b442b5ad2 ("fs/ntfs3: Add bitmap") Signed-off-by: Konstantin Komarov fs/ntfs3/bitmap.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit d392e85fd1e8d58e460c17ca7d0d5c157848d9c1 Author: Konstantin Komarov Date: Tue Jun 25 09:57:33 2024 +0300 fs/ntfs3: Fix the format of the "nocase" mount option The 'nocase' option was mistakenly added as fsparam_flag_no with the 'no' prefix, causing the case-insensitive mode to require the 'nonocase' option to be enabled. Fixes: a3a956c78efa ("fs/ntfs3: Add option "nocase"") Signed-off-by: Konstantin Komarov fs/ntfs3/super.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit db43a609d01e8bf9b812d45dc2945c65b57dd793 Author: Peter Zijlstra Date: Mon Jul 8 09:57:52 2024 +0200 sched: Update MAINTAINERS and CREDITS Thank you Daniel for having been our friend! Signed-off-by: Peter Zijlstra (Intel) Signed-off-by: Ingo Molnar Acked-by: Vincent Guittot Acked-by: Juri Lelli Reviewed-by: Steven Rostedt Link: https://lore.kernel.org/r/20240708075752.GF11386@noisy.programming.kicks-ass.net CREDITS | 3 +++ MAINTAINERS | 1 - 2 files changed, 3 insertions(+), 1 deletion(-) commit 011b1134b82c2750d83a299a1369c678845de45a Merge: d32960528702 ddae0ca2a8fe Author: Ingo Molnar Date: Thu Jul 11 10:42:33 2024 +0200 Merge branch 'sched/urgent' into sched/core, to pick up fixes and refresh the branch Signed-off-by: Ingo Molnar commit 943ad0b62e3c21f324c4884caa6cb4a871bca05c Author: Pavel Begunkov Date: Wed Jul 10 18:58:18 2024 +0100 kernel: rerun task_work while freezing in get_signal() io_uring can asynchronously add a task_work while the task is getting freezed. TIF_NOTIFY_SIGNAL will prevent the task from sleeping in do_freezer_trap(), and since the get_signal()'s relock loop doesn't retry task_work, the task will spin there not being able to sleep until the freezing is cancelled / the task is killed / etc. Run task_works in the freezer path. Keep the patch small and simple so it can be easily back ported, but we might need to do some cleaning after and look if there are other places with similar problems. Cc: stable@vger.kernel.org Link: https://github.com/systemd/systemd/issues/33626 Fixes: 12db8b690010c ("entry: Add support for TIF_NOTIFY_SIGNAL") Reported-by: Julian Orth Acked-by: Oleg Nesterov Acked-by: Tejun Heo Signed-off-by: Pavel Begunkov Link: https://lore.kernel.org/r/89ed3a52933370deaaf61a0a620a6ac91f1e754d.1720634146.git.asml.silence@gmail.com Signed-off-by: Jens Axboe kernel/signal.c | 8 ++++++++ 1 file changed, 8 insertions(+) commit 0453aad676ff99787124b9b3af4a5f59fbe808e2 Author: Pavel Begunkov Date: Wed Jul 10 18:58:17 2024 +0100 io_uring/io-wq: limit retrying worker initialisation If io-wq worker creation fails, we retry it by queueing up a task_work. tasK_work is needed because it should be done from the user process context. The problem is that retries are not limited, and if queueing a task_work is the reason for the failure, we might get into an infinite loop. It doesn't seem to happen now but it would with the following patch executing task_work in the freezer's loop. For now, arbitrarily limit the number of attempts to create a worker. Cc: stable@vger.kernel.org Fixes: 3146cba99aa28 ("io-wq: make worker creation resilient against signals") Reported-by: Julian Orth Signed-off-by: Pavel Begunkov Link: https://lore.kernel.org/r/8280436925db88448c7c85c6656edee1a43029ea.1720634146.git.asml.silence@gmail.com Signed-off-by: Jens Axboe io_uring/io-wq.c | 10 +++++++--- 1 file changed, 7 insertions(+), 3 deletions(-) commit 2fd66f7d3b0de2aa986d82ede81d7b85740713c4 Author: Shyam Sundar S K Date: Thu Jul 11 10:50:47 2024 +0530 platform/x86/amd/pmf: Remove update system state document This commit removes the "pmf.rst" document, which was associated with the PMF driver that enabled system state updates based on TA output actions. The driver now uses existing input events (KEY_SCREENLOCK, KEY_SLEEP, and KEY_SUSPEND) instead of defining new udev rules in the "/etc/udev/rules.d/" directory. Consequently, the pmf.rst document is no longer necessary. Therefore, the pmf.rst documentation is being removed. Co-developed-by: Patil Rajesh Reddy Signed-off-by: Patil Rajesh Reddy Signed-off-by: Shyam Sundar S K Link: https://lore.kernel.org/r/20240711052047.1531957-2-Shyam-sundar.S-k@amd.com Reviewed-by: Ilpo Järvinen Signed-off-by: Ilpo Järvinen Documentation/admin-guide/pmf.rst | 24 ------------------------ 1 file changed, 24 deletions(-) commit 4c92d448e3e61d46111c29276ee959e3e4ec412b Author: Shyam Sundar S K Date: Thu Jul 11 10:50:46 2024 +0530 platform/x86/amd/pmf: Use existing input event codes to update system states At present, the PMF driver employs custom system state codes to update system states. It is recommended to replace these with existing input event codes (KEY_SLEEP, KEY_SUSPEND, and KEY_SCREENLOCK) to align system updates with the PMF-TA output actions. Co-developed-by: Patil Rajesh Reddy Signed-off-by: Patil Rajesh Reddy Signed-off-by: Shyam Sundar S K Link: https://lore.kernel.org/r/20240711052047.1531957-1-Shyam-sundar.S-k@amd.com Reviewed-by: Ilpo Järvinen Signed-off-by: Ilpo Järvinen drivers/platform/x86/amd/pmf/pmf.h | 2 ++ drivers/platform/x86/amd/pmf/tee-if.c | 62 ++++++++++++++++++++++++++++------- 2 files changed, 52 insertions(+), 12 deletions(-) commit fd748e177194ebcbbaf98df75152a30e08230cc6 Author: Nick Bowler Date: Wed Jul 10 23:54:17 2024 -0400 macintosh/therm_windtunnel: fix module unload. The of_device_unregister call in therm_windtunnel's module_exit procedure does not fully reverse the effects of of_platform_device_create in the module_init prodedure. Once you unload this module, it is impossible to load it ever again since only the first of_platform_device_create call on the fan node succeeds. This driver predates first git commit, and it turns out back then of_platform_device_create worked differently than it does today. So this is actually an old regression. The appropriate function to undo of_platform_device_create now appears to be of_platform_device_destroy, and switching to use this makes it possible to unload and load the module as expected. Signed-off-by: Nick Bowler Fixes: c6e126de43e7 ("of: Keep track of populated platform devices") Signed-off-by: Michael Ellerman Link: https://msgid.link/20240711035428.16696-1-nbowler@draconx.ca drivers/macintosh/therm_windtunnel.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit db25a9625dbc3aa6613c0347f574689c248a3d0b Author: Michael Ellerman Date: Thu May 9 22:12:48 2024 +1000 powerpc: Check only single values are passed to CPU/MMU feature checks cpu_has_feature()/mmu_has_feature() are only able to check a single feature at a time, but there is no enforcement of that. In fact, as fixed in the previous commit, there was code that was passing multiple values to cpu_has_feature(). So add a check that only a single feature is passed using popcount. Note that the test allows 0 or 1 bits to be set, because some code relies on cpu_has_feature(0) being false, the check with CPU_FTRS_POSSIBLE ensures that. See for example CPU_FTR_PPC_LE. Signed-off-by: Michael Ellerman Link: https://msgid.link/20240509121248.270878-3-mpe@ellerman.id.au arch/powerpc/include/asm/cpu_has_feature.h | 1 + arch/powerpc/include/asm/mmu.h | 1 + 2 files changed, 2 insertions(+) commit 14196e47c5ffe32af7ed5a51c9e421c5ea5bccce Author: Michael Ellerman Date: Thu May 9 22:12:47 2024 +1000 powerpc/xmon: Fix disassembly CPU feature checks In the xmon disassembly code there are several CPU feature checks to determine what dialects should be passed to the disassembler. The dialect controls which instructions the disassembler will recognise. Unfortunately the checks are incorrect, because instead of passing a single CPU feature they are passing a mask of feature bits. For example the code: if (cpu_has_feature(CPU_FTRS_POWER5)) dialect |= PPC_OPCODE_POWER5; Is trying to check if the system is running on a Power5 CPU. But CPU_FTRS_POWER5 is a mask of *all* the feature bits that are enabled on a Power5. In practice the test will always return true for any 64-bit CPU, because at least one bit in the mask will be present in the CPU_FTRS_ALWAYS mask. Similarly for all the other checks against CPU_FTRS_xx masks. Rather than trying to match the disassembly behaviour exactly to the current CPU, just differentiate between 32-bit and 64-bit, and Altivec, VSX and HTM. That will cause some instructions to be shown in disassembly even on a CPU that doesn't support them, but that's OK, objdump -d output has the same behaviour, and if anything it's less confusing than some instructions not being disassembled. Fixes: 897f112bb42e ("[POWERPC] Import updated version of ppc disassembly code for xmon") Signed-off-by: Michael Ellerman Link: https://msgid.link/20240509121248.270878-2-mpe@ellerman.id.au arch/powerpc/xmon/ppc-dis.c | 33 +++++++++++---------------------- 1 file changed, 11 insertions(+), 22 deletions(-) commit 489116d784bebec7e441f400715fbfe6edbce66c Author: Michael Ellerman Date: Thu May 9 22:12:46 2024 +1000 powerpc: Drop clang workaround for builtin constant checks The CPU/MMU feature code has build-time checks that the feature value is a builtin constant. Back when the code was added clang wasn't able to compile the checks, so an ifdef was added to avoid the checks for clang builds. See commit b5fa0f7f88ed ("powerpc: Fix build failure with clang due to BUILD_BUG_ON()") These days clang 13 and later are able to build the checks successfully, so drop the workaround. Signed-off-by: Michael Ellerman Link: https://msgid.link/20240509121248.270878-1-mpe@ellerman.id.au arch/powerpc/include/asm/cpu_has_feature.h | 2 -- arch/powerpc/include/asm/mmu.h | 2 -- 2 files changed, 4 deletions(-) commit 20c0455f3cffc93ef2712f33a7d118d4e5483ef3 Author: Nicolas Ferre Date: Wed Jul 10 18:36:51 2024 +0200 dt-bindings: pwm: at91: Add sama7d65 compatible string Add compatible string for sama7d65. Like sama7g5, it currently binds to "atmel,sama5d2-pwm" compatibility string for this driver, so add an "enum" to reflect that. Signed-off-by: Nicolas Ferre Acked-by: Krzysztof Kozlowski Link: https://lore.kernel.org/r/20240710163651.343751-1-nicolas.ferre@microchip.com Signed-off-by: Uwe Kleine-König Documentation/devicetree/bindings/pwm/atmel,at91sam-pwm.yaml | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) commit 1001042e54ef324c0c665b60a012519be05ae022 Author: Gao Xiang Date: Thu Jul 11 13:36:59 2024 +0800 erofs: avoid refcounting short-lived pages LZ4 always reuses the decompressed buffer as its LZ77 sliding window (dynamic dictionary) for optimal performance. However, in specific cases, the output buffer may not fully contain valid page cache pages, resulting in the use of short-lived pages for temporary purposes. Due to the limited sliding window size, LZ4 shortlived bounce pages can also be reused in a sliding manner, so each bounce page can be vmapped multiple times in different relative positions by design. In order to avoiding double frees, currently, reuse counts are recorded via page refcount, but it will no longer be used as-is in the future world of Memdescs. Just maintain a lookup table to check if a shortlived page is reused. Signed-off-by: Gao Xiang Link: https://lore.kernel.org/r/20240711053659.1364989-1-hsiangkao@linux.alibaba.com fs/erofs/compress.h | 22 ++++++---------------- fs/erofs/decompressor.c | 1 - fs/erofs/zdata.c | 27 ++++++++++++++++++--------- 3 files changed, 24 insertions(+), 26 deletions(-) commit fab451d1582cde6073c271f0520c2348a4f1398e Author: Chen Ni Date: Wed Jul 10 09:42:08 2024 +0800 xen/arm: Convert comma to semicolon Replace a comma between expression statements by a semicolon. Signed-off-by: Chen Ni Reviewed-by: Stefano Stabellini Message-ID: <20240710014208.1719662-1-nichen@iscas.ac.cn> Signed-off-by: Juergen Gross arch/arm/xen/p2m.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit fde318326daa48a4bb3ca8ee229bac4d14b5bc2a Author: Artem Savkov Date: Fri May 17 09:56:50 2024 +0200 powerpc64/bpf: jit support for signed division and modulo Add jit support for sign division and modulo. Tested using test_bpf module. Signed-off-by: Artem Savkov Signed-off-by: Michael Ellerman Link: https://msgid.link/20240517075650.248801-6-asavkov@redhat.com arch/powerpc/include/asm/ppc-opcode.h | 1 + arch/powerpc/net/bpf_jit_comp64.c | 41 ++++++++++++++++++++++++++++------- 2 files changed, 34 insertions(+), 8 deletions(-) commit 597b1710982d10b8629697e4a548b30d0d93eeed Author: Artem Savkov Date: Fri May 17 09:56:49 2024 +0200 powerpc64/bpf: jit support for sign extended mov Add jit support for sign extended mov. Tested using test_bpf module. Signed-off-by: Artem Savkov Signed-off-by: Michael Ellerman Link: https://msgid.link/20240517075650.248801-5-asavkov@redhat.com arch/powerpc/net/bpf_jit_comp64.c | 10 ++++++++-- 1 file changed, 8 insertions(+), 2 deletions(-) commit 717756c9c8ddad9f28389185bfb161d4d88e01a4 Author: Artem Savkov Date: Fri May 17 09:56:48 2024 +0200 powerpc64/bpf: jit support for sign extended load Add jit support for sign extended load. Tested using test_bpf module. Signed-off-by: Artem Savkov Signed-off-by: Michael Ellerman Link: https://msgid.link/20240517075650.248801-4-asavkov@redhat.com arch/powerpc/include/asm/ppc-opcode.h | 1 + arch/powerpc/net/bpf_jit_comp64.c | 61 ++++++++++++++++++++++++----------- 2 files changed, 43 insertions(+), 19 deletions(-) commit a71c0b09a14db72d59c48a8cda7a73032f4d418b Author: Artem Savkov Date: Fri May 17 09:56:47 2024 +0200 powerpc64/bpf: jit support for unconditional byte swap Add jit support for unconditional byte swap. Tested using BSWAP tests from test_bpf module. Signed-off-by: Artem Savkov Reviewed-by: Hari Bathini Signed-off-by: Michael Ellerman Link: https://msgid.link/20240517075650.248801-3-asavkov@redhat.com arch/powerpc/net/bpf_jit_comp64.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) commit 3c086ce222cefcf16d412faa10d456161d076796 Author: Artem Savkov Date: Fri May 17 09:56:46 2024 +0200 powerpc64/bpf: jit support for 32bit offset jmp instruction Add jit support for JMP32_JA instruction. Tested using test_bpf module. Signed-off-by: Artem Savkov Signed-off-by: Michael Ellerman Link: https://msgid.link/20240517075650.248801-2-asavkov@redhat.com arch/powerpc/net/bpf_jit_comp64.c | 3 +++ 1 file changed, 3 insertions(+) commit f9ca51596bbfd0f9c386dd1c613c394c78d9e5e6 Author: Baokun Li Date: Tue Jul 2 21:23:49 2024 +0800 ext4: make sure the first directory block is not a hole The syzbot constructs a directory that has no dirblock but is non-inline, i.e. the first directory block is a hole. And no errors are reported when creating files in this directory in the following flow. ext4_mknod ... ext4_add_entry // Read block 0 ext4_read_dirblock(dir, block, DIRENT) bh = ext4_bread(NULL, inode, block, 0) if (!bh && (type == INDEX || type == DIRENT_HTREE)) // The first directory block is a hole // But type == DIRENT, so no error is reported. After that, we get a directory block without '.' and '..' but with a valid dentry. This may cause some code that relies on dot or dotdot (such as make_indexed_dir()) to crash. Therefore when ext4_read_dirblock() finds that the first directory block is a hole report that the filesystem is corrupted and return an error to avoid loading corrupted data from disk causing something bad. Reported-by: syzbot+ae688d469e36fb5138d0@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=ae688d469e36fb5138d0 Fixes: 4e19d6b65fb4 ("ext4: allow directory holes") Cc: stable@kernel.org Signed-off-by: Baokun Li Reviewed-by: Jan Kara Link: https://patch.msgid.link/20240702132349.2600605-3-libaokun@huaweicloud.com Signed-off-by: Theodore Ts'o fs/ext4/namei.c | 17 ++++++----------- 1 file changed, 6 insertions(+), 11 deletions(-) commit 50ea741def587a64e08879ce6c6a30131f7111e7 Author: Baokun Li Date: Tue Jul 2 21:23:48 2024 +0800 ext4: check dot and dotdot of dx_root before making dir indexed Syzbot reports a issue as follows: ============================================ BUG: unable to handle page fault for address: ffffed11022e24fe PGD 23ffee067 P4D 23ffee067 PUD 0 Oops: Oops: 0000 [#1] PREEMPT SMP KASAN PTI CPU: 0 PID: 5079 Comm: syz-executor306 Not tainted 6.10.0-rc5-g55027e689933 #0 Call Trace: make_indexed_dir+0xdaf/0x13c0 fs/ext4/namei.c:2341 ext4_add_entry+0x222a/0x25d0 fs/ext4/namei.c:2451 ext4_rename fs/ext4/namei.c:3936 [inline] ext4_rename2+0x26e5/0x4370 fs/ext4/namei.c:4214 [...] ============================================ The immediate cause of this problem is that there is only one valid dentry for the block to be split during do_split, so split==0 results in out of bounds accesses to the map triggering the issue. do_split unsigned split dx_make_map count = 1 split = count/2 = 0; continued = hash2 == map[split - 1].hash; ---> map[4294967295] The maximum length of a filename is 255 and the minimum block size is 1024, so it is always guaranteed that the number of entries is greater than or equal to 2 when do_split() is called. But syzbot's crafted image has no dot and dotdot in dir, and the dentry distribution in dirblock is as follows: bus dentry1 hole dentry2 free |xx--|xx-------------|...............|xx-------------|...............| 0 12 (8+248)=256 268 256 524 (8+256)=264 788 236 1024 So when renaming dentry1 increases its name_len length by 1, neither hole nor free is sufficient to hold the new dentry, and make_indexed_dir() is called. In make_indexed_dir() it is assumed that the first two entries of the dirblock must be dot and dotdot, so bus and dentry1 are left in dx_root because they are treated as dot and dotdot, and only dentry2 is moved to the new leaf block. That's why count is equal to 1. Therefore add the ext4_check_dx_root() helper function to add more sanity checks to dot and dotdot before starting the conversion to avoid the above issue. Reported-by: syzbot+ae688d469e36fb5138d0@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=ae688d469e36fb5138d0 Fixes: ac27a0ec112a ("[PATCH] ext4: initial copy of files from ext3") Cc: stable@kernel.org Signed-off-by: Baokun Li Reviewed-by: Jan Kara Link: https://patch.msgid.link/20240702132349.2600605-2-libaokun@huaweicloud.com Signed-off-by: Theodore Ts'o fs/ext4/namei.c | 56 +++++++++++++++++++++++++++++++++++++++++++++++++++----- 1 file changed, 51 insertions(+), 5 deletions(-) commit 23cef42d17413d099f44ea42b622fbf23b04646f Author: Zhongqiu Han Date: Fri Jul 5 18:36:14 2024 +0800 scsi: aha152x: Use DECLARE_COMPLETION_ONSTACK for non-constant completion The _ONSTACK variant should be used for on-stack completion, otherwise it will break lockdep. See also commit 6e9a4738c9fa ("[PATCH] completions: lockdep annotate on stack completions"). Signed-off-by: Zhongqiu Han Link: https://lore.kernel.org/r/20240705103614.3650637-1-quic_zhonhan@quicinc.com Signed-off-by: Martin K. Petersen drivers/scsi/aha152x.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 6ca9fede7c73b3c83f4cc8ecb3c29e1d501107c6 Author: Chen Ni Date: Thu Jul 11 08:57:24 2024 +0800 scsi: qla2xxx: Convert comma to semicolon Replace a comma between expression statements by a semicolon. Fixes: d4523bd6fd5d ("scsi: qla2xxx: Refactor asynchronous command initialization") Signed-off-by: Chen Ni Link: https://lore.kernel.org/r/20240711005724.2358446-1-nichen@iscas.ac.cn Reviewed-by: Himanshu Madhani Signed-off-by: Martin K. Petersen drivers/scsi/qla2xxx/qla_init.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 22b8d89b9d8d84dcf161e583715e9501fd026ec1 Merge: af8e69efd785 a1392b19ca59 Author: Martin K. Petersen Date: Wed Jul 10 22:45:08 2024 -0400 Merge patch series "qla2xxx misc. bug fixes" Nilesh Javali says: Martin, Please apply the qla2xxx driver miscellaneous bug fixes to the scsi tree at your earliest convenience. Link: https://lore.kernel.org/r/20240710171057.35066-1-njavali@marvell.com Signed-off-by: Martin K. Petersen commit a1392b19ca59256cda627b0ed04657e8e84702b4 Author: Nilesh Javali Date: Wed Jul 10 22:40:57 2024 +0530 scsi: qla2xxx: Update version to 10.02.09.300-k Signed-off-by: Nilesh Javali Link: https://lore.kernel.org/r/20240710171057.35066-12-njavali@marvell.com Reviewed-by: Himanshu Madhani Signed-off-by: Martin K. Petersen drivers/scsi/qla2xxx/qla_version.h | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) commit c449b4198701d828e40d60a2abd30970b74a1d75 Author: Quinn Tran Date: Wed Jul 10 22:40:56 2024 +0530 scsi: qla2xxx: Use QP lock to search for bsg On bsg timeout, hardware_lock is used as part of search for the srb. Instead, qpair lock should be used to iterate through different qpair. Cc: stable@vger.kernel.org Signed-off-by: Quinn Tran Signed-off-by: Nilesh Javali Link: https://lore.kernel.org/r/20240710171057.35066-11-njavali@marvell.com Reviewed-by: Himanshu Madhani Signed-off-by: Martin K. Petersen drivers/scsi/qla2xxx/qla_bsg.c | 96 +++++++++++++++++++++++++----------------- 1 file changed, 57 insertions(+), 39 deletions(-) commit beafd692461443e0fb1d61aa56886bf85ef6f5e4 Author: Quinn Tran Date: Wed Jul 10 22:40:55 2024 +0530 scsi: qla2xxx: Reduce fabric scan duplicate code For fabric scan, current code uses switch scan opcode and flags as the method to iterate through different commands to carry out the process. This makes it hard to read. This patch convert those opcode and flags into steps. In addition, this help reduce some duplicate code. Consolidate routines that handle GPNFT & GNNFT. Cc: stable@vger.kernel.org Signed-off-by: Quinn Tran Signed-off-by: Nilesh Javali Link: https://lore.kernel.org/r/20240710171057.35066-10-njavali@marvell.com Reviewed-by: Himanshu Madhani Signed-off-by: Martin K. Petersen drivers/scsi/qla2xxx/qla_def.h | 14 +- drivers/scsi/qla2xxx/qla_gbl.h | 6 +- drivers/scsi/qla2xxx/qla_gs.c | 432 +++++++++++++++++----------------------- drivers/scsi/qla2xxx/qla_init.c | 5 +- drivers/scsi/qla2xxx/qla_os.c | 12 +- 5 files changed, 200 insertions(+), 269 deletions(-) commit 348744f27a35e087acc9378bf53537fbfb072775 Author: Shreyas Deodhar Date: Wed Jul 10 22:40:54 2024 +0530 scsi: qla2xxx: Fix optrom version displayed in FDMI Bios version was popluated for FDMI response. Systems with EFI would show optrom version as 0. EFI version is populated here and BIOS version is already displayed under FDMI_HBA_BOOT_BIOS_NAME. Cc: stable@vger.kernel.org Signed-off-by: Shreyas Deodhar Signed-off-by: Nilesh Javali Link: https://lore.kernel.org/r/20240710171057.35066-9-njavali@marvell.com Reviewed-by: Himanshu Madhani Signed-off-by: Martin K. Petersen drivers/scsi/qla2xxx/qla_gs.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 76f480d7c717368f29a3870f7d64471ce0ff8fb2 Author: Manish Rangankar Date: Wed Jul 10 22:40:53 2024 +0530 scsi: qla2xxx: During vport delete send async logout explicitly During vport delete, it is observed that during unload we hit a crash because of stale entries in outstanding command array. For all these stale I/O entries, eh_abort was issued and aborted (fast_fail_io = 2009h) but I/Os could not complete while vport delete is in process of deleting. BUG: kernel NULL pointer dereference, address: 000000000000001c #PF: supervisor read access in kernel mode #PF: error_code(0x0000) - not-present page PGD 0 P4D 0 Oops: 0000 [#1] PREEMPT SMP NOPTI Workqueue: qla2xxx_wq qla_do_work [qla2xxx] RIP: 0010:dma_direct_unmap_sg+0x51/0x1e0 RSP: 0018:ffffa1e1e150fc68 EFLAGS: 00010046 RAX: 0000000000000000 RBX: 0000000000000021 RCX: 0000000000000001 RDX: 0000000000000021 RSI: 0000000000000000 RDI: ffff8ce208a7a0d0 RBP: ffff8ce208a7a0d0 R08: 0000000000000000 R09: ffff8ce378aac9c8 R10: ffff8ce378aac8a0 R11: ffffa1e1e150f9d8 R12: 0000000000000000 R13: 0000000000000000 R14: ffff8ce378aac9c8 R15: 0000000000000000 FS: 0000000000000000(0000) GS:ffff8d217f000000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 000000000000001c CR3: 0000002089acc000 CR4: 0000000000350ee0 Call Trace: qla2xxx_qpair_sp_free_dma+0x417/0x4e0 ? qla2xxx_qpair_sp_compl+0x10d/0x1a0 ? qla2x00_status_entry+0x768/0x2830 ? newidle_balance+0x2f0/0x430 ? dequeue_entity+0x100/0x3c0 ? qla24xx_process_response_queue+0x6a1/0x19e0 ? __schedule+0x2d5/0x1140 ? qla_do_work+0x47/0x60 ? process_one_work+0x267/0x440 ? process_one_work+0x440/0x440 ? worker_thread+0x2d/0x3d0 ? process_one_work+0x440/0x440 ? kthread+0x156/0x180 ? set_kthread_struct+0x50/0x50 ? ret_from_fork+0x22/0x30 Send out async logout explicitly for all the ports during vport delete. Cc: stable@vger.kernel.org Signed-off-by: Manish Rangankar Signed-off-by: Nilesh Javali Link: https://lore.kernel.org/r/20240710171057.35066-8-njavali@marvell.com Reviewed-by: Himanshu Madhani Signed-off-by: Martin K. Petersen drivers/scsi/qla2xxx/qla_mid.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 4475afa2646d3fec176fc4d011d3879b26cb26e3 Author: Shreyas Deodhar Date: Wed Jul 10 22:40:52 2024 +0530 scsi: qla2xxx: Complete command early within lock A crash was observed while performing NPIV and FW reset, BUG: kernel NULL pointer dereference, address: 000000000000001c #PF: supervisor read access in kernel mode #PF: error_code(0x0000) - not-present page PGD 0 P4D 0 Oops: 0000 1 PREEMPT_RT SMP NOPTI RIP: 0010:dma_direct_unmap_sg+0x51/0x1e0 RSP: 0018:ffffc90026f47b88 EFLAGS: 00010246 RAX: 0000000000000000 RBX: 0000000000000021 RCX: 0000000000000002 RDX: 0000000000000021 RSI: 0000000000000000 RDI: ffff8881041130d0 RBP: ffff8881041130d0 R08: 0000000000000000 R09: 0000000000000034 R10: ffffc90026f47c48 R11: 0000000000000031 R12: 0000000000000000 R13: 0000000000000000 R14: ffff8881565e4a20 R15: 0000000000000000 FS: 00007f4c69ed3d00(0000) GS:ffff889faac80000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 000000000000001c CR3: 0000000288a50002 CR4: 00000000007706e0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 PKRU: 55555554 Call Trace: ? __die_body+0x1a/0x60 ? page_fault_oops+0x16f/0x4a0 ? do_user_addr_fault+0x174/0x7f0 ? exc_page_fault+0x69/0x1a0 ? asm_exc_page_fault+0x22/0x30 ? dma_direct_unmap_sg+0x51/0x1e0 ? preempt_count_sub+0x96/0xe0 qla2xxx_qpair_sp_free_dma+0x29f/0x3b0 [qla2xxx] qla2xxx_qpair_sp_compl+0x60/0x80 [qla2xxx] __qla2x00_abort_all_cmds+0xa2/0x450 [qla2xxx] The command completion was done early while aborting the commands in driver unload path but outside lock to avoid the WARN_ON condition of performing dma_free_attr within the lock. However this caused race condition while command completion via multiple paths causing system crash. Hence complete the command early in unload path but within the lock to avoid race condition. Fixes: 0367076b0817 ("scsi: qla2xxx: Perform lockless command completion in abort path") Cc: stable@vger.kernel.org Signed-off-by: Shreyas Deodhar Signed-off-by: Nilesh Javali Link: https://lore.kernel.org/r/20240710171057.35066-7-njavali@marvell.com Reviewed-by: Himanshu Madhani Signed-off-by: Martin K. Petersen drivers/scsi/qla2xxx/qla_os.c | 5 ----- 1 file changed, 5 deletions(-) commit 29e222085d8907ccff18ecd931bdd4c6b1f11b92 Author: Quinn Tran Date: Wed Jul 10 22:40:51 2024 +0530 scsi: qla2xxx: Fix flash read failure Link up failure is observed as a result of flash read failure. Current code does not check flash read return code where it relies on FW checksum to detect the problem. Add check of flash read failure to detect the problem sooner. Reported-by: kernel test robot Reported-by: Dan Carpenter Closes: https://lore.kernel.org/all/202406210815.rPDRDMBi-lkp@intel.com/ Cc: stable@vger.kernel.org Signed-off-by: Quinn Tran Signed-off-by: Nilesh Javali Link: https://lore.kernel.org/r/20240710171057.35066-6-njavali@marvell.com Reviewed-by: Himanshu Madhani Signed-off-by: Martin K. Petersen drivers/scsi/qla2xxx/qla_init.c | 63 ++++++++++++++++++----- drivers/scsi/qla2xxx/qla_sup.c | 108 ++++++++++++++++++++++++++++------------ 2 files changed, 125 insertions(+), 46 deletions(-) commit ce2065c4cc4f05635413f63f6dc038d7d4842e31 Author: Saurav Kashyap Date: Wed Jul 10 22:40:50 2024 +0530 scsi: qla2xxx: Return ENOBUFS if sg_cnt is more than one for ELS cmds Firmware only supports single DSDs in ELS Pass-through IOCB (0x53h), sg cnt is decided by the SCSI ML. User is not aware of the cause of an acutal error. Return the appropriate return code that will be decoded by API and application and proper error message will be displayed to user. Fixes: 6e98016ca077 ("[SCSI] qla2xxx: Re-organized BSG interface specific code.") Cc: stable@vger.kernel.org Signed-off-by: Saurav Kashyap Signed-off-by: Nilesh Javali Link: https://lore.kernel.org/r/20240710171057.35066-5-njavali@marvell.com Reviewed-by: Himanshu Madhani Signed-off-by: Martin K. Petersen drivers/scsi/qla2xxx/qla_bsg.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit c03d740152f78e86945a75b2ad541bf972fab92a Author: Shreyas Deodhar Date: Wed Jul 10 22:40:49 2024 +0530 scsi: qla2xxx: Fix for possible memory corruption Init Control Block is dereferenced incorrectly. Correctly dereference ICB Cc: stable@vger.kernel.org Signed-off-by: Shreyas Deodhar Signed-off-by: Nilesh Javali Link: https://lore.kernel.org/r/20240710171057.35066-4-njavali@marvell.com Reviewed-by: Himanshu Madhani Signed-off-by: Martin K. Petersen drivers/scsi/qla2xxx/qla_os.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit eb1d4ce2609584eeb7694866f34d4b213caa3af9 Author: Nilesh Javali Date: Wed Jul 10 22:40:48 2024 +0530 scsi: qla2xxx: validate nvme_local_port correctly The driver load failed with error message, qla2xxx [0000:04:00.0]-ffff:0: register_localport failed: ret=ffffffef and with a kernel crash, BUG: unable to handle kernel NULL pointer dereference at 0000000000000070 Workqueue: events_unbound qla_register_fcport_fn [qla2xxx] RIP: 0010:nvme_fc_register_remoteport+0x16/0x430 [nvme_fc] RSP: 0018:ffffaaa040eb3d98 EFLAGS: 00010282 RAX: 0000000000000000 RBX: ffff9dfb46b78c00 RCX: 0000000000000000 RDX: ffff9dfb46b78da8 RSI: ffffaaa040eb3e08 RDI: 0000000000000000 RBP: ffff9dfb612a0a58 R08: ffffffffaf1d6270 R09: 3a34303a30303030 R10: 34303a303030305b R11: 2078787832616c71 R12: ffff9dfb46b78dd4 R13: ffff9dfb46b78c24 R14: ffff9dfb41525300 R15: ffff9dfb46b78da8 FS: 0000000000000000(0000) GS:ffff9dfc67c00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000000000000070 CR3: 000000018da10004 CR4: 00000000000206f0 Call Trace: qla_nvme_register_remote+0xeb/0x1f0 [qla2xxx] ? qla2x00_dfs_create_rport+0x231/0x270 [qla2xxx] qla2x00_update_fcport+0x2a1/0x3c0 [qla2xxx] qla_register_fcport_fn+0x54/0xc0 [qla2xxx] Exit the qla_nvme_register_remote() function when qla_nvme_register_hba() fails and correctly validate nvme_local_port. Cc: stable@vger.kernel.org Signed-off-by: Nilesh Javali Link: https://lore.kernel.org/r/20240710171057.35066-3-njavali@marvell.com Reviewed-by: Himanshu Madhani Signed-off-by: Martin K. Petersen drivers/scsi/qla2xxx/qla_nvme.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) commit c3d98b12eef8db436e32f1a8c5478be57dc15621 Author: Quinn Tran Date: Wed Jul 10 22:40:47 2024 +0530 scsi: qla2xxx: Unable to act on RSCN for port online The device does not come online when the target port is online. There were multiple RSCNs indicating multiple devices were affected. Driver is in the process of finishing a fabric scan. A new RSCN (device up) arrived at the tail end of the last fabric scan. Driver mistakenly thinks the new RSCN is being taken care of by the previous fabric scan, where this notification is cleared and not acted on. The laser needs to be blinked again to get the device to show up. To prevent driver from accidentally clearing the RSCN notification, each RSCN is given a generation value. A fabric scan will scan for that generation(s). Any new RSCN arrive after the scan start will have a new generation value. This will trigger another scan to get latest data. The RSCN notification flag will be cleared when the scan is associate to that generation. Reported-by: kernel test robot Closes: https://lore.kernel.org/oe-kbuild-all/202406210538.w875N70K-lkp@intel.com/ Fixes: bb2ca6b3f09a ("scsi: qla2xxx: Relogin during fabric disturbance") Cc: stable@vger.kernel.org Signed-off-by: Quinn Tran Signed-off-by: Nilesh Javali Link: https://lore.kernel.org/r/20240710171057.35066-2-njavali@marvell.com Reviewed-by: Himanshu Madhani Signed-off-by: Martin K. Petersen drivers/scsi/qla2xxx/qla_def.h | 3 +++ drivers/scsi/qla2xxx/qla_gs.c | 33 ++++++++++++++++++++++++++++++--- drivers/scsi/qla2xxx/qla_init.c | 24 +++++++++++++++++++----- drivers/scsi/qla2xxx/qla_inline.h | 8 ++++++++ 4 files changed, 60 insertions(+), 8 deletions(-) commit af8e69efd78561496cdd736bb1b4f7edd89b2f6b Merge: e30618a480cb c96499fcb403 Author: Martin K. Petersen Date: Wed Jul 10 22:33:34 2024 -0400 Merge patch series "Basic inline encryption support for ufs-exynos" Eric Biggers says: Add support for Flash Memory Protector (FMP), which is the inline encryption hardware on Exynos and Exynos-based SoCs. Specifically, add support for the "traditional FMP mode" that works on many Exynos-based SoCs including gs101. This is the mode that uses "software keys" and is compatible with the upstream kernel's existing inline encryption framework in the block and filesystem layers. I plan to add support for the wrapped key support on gs101 at a later time. Tested on gs101 (specifically Pixel 6) by running the 'encrypt' group of xfstests on a filesystem mounted with the 'inlinecrypt' mount option. This patchset applies to v6.10-rc6, and it has no prerequisites that aren't already upstream. Link: https://lore.kernel.org/r/20240708235330.103590-1-ebiggers@kernel.org Signed-off-by: Martin K. Petersen commit c96499fcb403b18b0ae0bf2e19a39f24e62dd3ac Author: Eric Biggers Date: Mon Jul 8 16:53:30 2024 -0700 scsi: ufs: exynos: Add support for Flash Memory Protector (FMP) Add support for Flash Memory Protector (FMP), which is the inline encryption hardware on Exynos and Exynos-based SoCs. Specifically, add support for the "traditional FMP mode" that works on many Exynos-based SoCs including gs101. This is the mode that uses "software keys" and is compatible with the upstream kernel's existing inline encryption framework in the block and filesystem layers. I plan to add support for the wrapped key support on gs101 at a later time. Tested on gs101 (specifically Pixel 6) by running the 'encrypt' group of xfstests on a filesystem mounted with the 'inlinecrypt' mount option. Signed-off-by: Eric Biggers Link: https://lore.kernel.org/r/20240708235330.103590-7-ebiggers@kernel.org Reviewed-by: Peter Griffin Tested-by: Peter Griffin Reviewed-by: Alim Akhtar Signed-off-by: Martin K. Petersen drivers/ufs/host/ufs-exynos.c | 240 ++++++++++++++++++++++++++++++++++++++++-- 1 file changed, 234 insertions(+), 6 deletions(-) commit 4c45dba50a3750a0834353c4187e7896b158bc0c Author: Eric Biggers Date: Mon Jul 8 16:53:29 2024 -0700 scsi: ufs: core: Add UFSHCD_QUIRK_KEYS_IN_PRDT Since the nonstandard inline encryption support on Exynos SoCs requires that raw cryptographic keys be copied into the PRDT, it is desirable to zeroize those keys after each request to keep them from being left in memory. Therefore, add a quirk bit that enables the zeroization. We could instead do the zeroization unconditionally. However, using a quirk bit avoids adding the zeroization overhead to standard devices. Reviewed-by: Bart Van Assche Reviewed-by: Peter Griffin Signed-off-by: Eric Biggers Link: https://lore.kernel.org/r/20240708235330.103590-6-ebiggers@kernel.org Reviewed-by: Alim Akhtar Signed-off-by: Martin K. Petersen drivers/ufs/core/ufshcd-crypto.h | 17 +++++++++++++++++ drivers/ufs/core/ufshcd.c | 1 + include/ufs/ufshcd.h | 8 ++++++++ 3 files changed, 26 insertions(+) commit 8ecea3da1567e0648b5d37a6faec73fc9c8571ba Author: Eric Biggers Date: Mon Jul 8 16:53:28 2024 -0700 scsi: ufs: core: Add fill_crypto_prdt variant op Add a variant op to allow host drivers to initialize nonstandard crypto-related fields in the PRDT. This is needed to support inline encryption on the "Exynos" UFS controller. Note that this will be used together with the support for overriding the PRDT entry size that was already added by commit ada1e653a5ea ("scsi: ufs: core: Allow UFS host drivers to override the sg entry size"). Reviewed-by: Bart Van Assche Reviewed-by: Peter Griffin Signed-off-by: Eric Biggers Link: https://lore.kernel.org/r/20240708235330.103590-5-ebiggers@kernel.org Reviewed-by: Alim Akhtar Signed-off-by: Martin K. Petersen drivers/ufs/core/ufshcd-crypto.h | 19 +++++++++++++++++++ drivers/ufs/core/ufshcd.c | 2 +- include/ufs/ufshcd.h | 4 ++++ 3 files changed, 24 insertions(+), 1 deletion(-) commit e95881e0081a30e132b5ca087f1e07fc08608a7e Author: Eric Biggers Date: Mon Jul 8 16:53:27 2024 -0700 scsi: ufs: core: Add UFSHCD_QUIRK_BROKEN_CRYPTO_ENABLE Add UFSHCD_QUIRK_BROKEN_CRYPTO_ENABLE which tells the UFS core to not use the crypto enable bit defined by the UFS specification. This is needed to support inline encryption on the "Exynos" UFS controller. Reviewed-by: Bart Van Assche Reviewed-by: Peter Griffin Signed-off-by: Eric Biggers Link: https://lore.kernel.org/r/20240708235330.103590-4-ebiggers@kernel.org Reviewed-by: Alim Akhtar Signed-off-by: Martin K. Petersen drivers/ufs/core/ufshcd-crypto.c | 8 ++++++++ include/ufs/ufshcd.h | 7 +++++++ 2 files changed, 15 insertions(+) commit ec99818afb03b1ebeb0b6ed0d5fd42143be79586 Author: Eric Biggers Date: Mon Jul 8 16:53:26 2024 -0700 scsi: ufs: core: fold ufshcd_clear_keyslot() into its caller Fold ufshcd_clear_keyslot() into its only remaining caller. Reviewed-by: Bart Van Assche Reviewed-by: Peter Griffin Signed-off-by: Eric Biggers Link: https://lore.kernel.org/r/20240708235330.103590-3-ebiggers@kernel.org Reviewed-by: Alim Akhtar Signed-off-by: Martin K. Petersen drivers/ufs/core/ufshcd-crypto.c | 16 +++++----------- 1 file changed, 5 insertions(+), 11 deletions(-) commit c2a90eee29f41630225c9a64d26c425e1d50b401 Author: Eric Biggers Date: Mon Jul 8 16:53:25 2024 -0700 scsi: ufs: core: Add UFSHCD_QUIRK_CUSTOM_CRYPTO_PROFILE Add UFSHCD_QUIRK_CUSTOM_CRYPTO_PROFILE which lets UFS host drivers initialize the blk_crypto_profile themselves rather than have it be initialized by ufshcd-core according to the UFSHCI standard. This is needed to support inline encryption on the "Exynos" UFS controller which has a nonstandard interface. Reviewed-by: Bart Van Assche Reviewed-by: Peter Griffin Signed-off-by: Eric Biggers Link: https://lore.kernel.org/r/20240708235330.103590-2-ebiggers@kernel.org Reviewed-by: Alim Akhtar Signed-off-by: Martin K. Petersen drivers/ufs/core/ufshcd-crypto.c | 10 +++++++--- include/ufs/ufshcd.h | 9 +++++++++ 2 files changed, 16 insertions(+), 3 deletions(-) commit e30618a480cbbfc1f49ec65fea86766141b7a1df Merge: 5e9a522b0779 af568c7e8292 Author: Martin K. Petersen Date: Wed Jul 10 22:26:08 2024 -0400 Merge patch series "UFS patches for kernel 6.11" Bart Van Assche says: Hi Martin, Please consider this series of UFS driver patches for the next merge window. Thank you, Bart. Link: https://lore.kernel.org/r/20240708211716.2827751-1-bvanassche@acm.org Signed-off-by: Martin K. Petersen commit 5e9a522b0779fa67928b7726374e60461e8aa5c5 Merge: 6cd48c8f62ad 7a6bbc2829d4 Author: Martin K. Petersen Date: Wed Jul 10 22:23:30 2024 -0400 Merge branch '6.10/scsi-fixes' into 6.11/scsi-staging Pull in my fixes branch to resolve an mpi3mr merge conflict reported by sfr. Signed-off-by: Martin K. Petersen commit af568c7e8292bd96f5a4f3d81dcc099bcfe7cb73 Author: Bart Van Assche Date: Mon Jul 8 14:16:05 2024 -0700 scsi: ufs: mcq: Make .get_hba_mac() optional UFSHCI controllers that are compliant with the UFSHCI 4.0 standard report the maximum number of supported commands in the controller capabilities register. Use that value if .get_hba_mac == NULL. Reviewed-by: Peter Wang Signed-off-by: Bart Van Assche Link: https://lore.kernel.org/r/20240708211716.2827751-11-bvanassche@acm.org Reviewed-by: Manivannan Sadhasivam Signed-off-by: Martin K. Petersen drivers/ufs/core/ufs-mcq.c | 26 ++++++++++++++++++++------ drivers/ufs/core/ufshcd-priv.h | 1 + drivers/ufs/core/ufshcd.c | 3 ++- include/ufs/ufshcd.h | 4 +++- include/ufs/ufshci.h | 1 + 5 files changed, 27 insertions(+), 8 deletions(-) commit 5e2053a41984f6086460a6b377a53af46ebe2b0f Author: Bart Van Assche Date: Mon Jul 8 14:16:04 2024 -0700 scsi: ufs: mcq: Inline ufshcd_mcq_vops_get_hba_mac() Make ufshcd_mcq_decide_queue_depth() easier to read by inlining ufshcd_mcq_vops_get_hba_mac(). Reviewed-by: Peter Wang Signed-off-by: Bart Van Assche Link: https://lore.kernel.org/r/20240708211716.2827751-10-bvanassche@acm.org Reviewed-by: Manivannan Sadhasivam Signed-off-by: Martin K. Petersen drivers/ufs/core/ufs-mcq.c | 18 +++++++++++------- drivers/ufs/core/ufshcd-priv.h | 8 -------- 2 files changed, 11 insertions(+), 15 deletions(-) commit 7e2c268dc3069b3d51a6dcd035d9b2ed3e6b1676 Author: Bart Van Assche Date: Mon Jul 8 14:16:03 2024 -0700 scsi: ufs: mcq: Move the ufshcd_mcq_enable() call Move the ufshcd_mcq_enable() call from inside ufshcd_config_mcq() to the callers of this function. No functionality is changed by this patch. This patch makes a later patch easier to read ("scsi: ufs: Make .get_hba_mac() optional"). Cc: Peter Wang Cc: Manivannan Sadhasivam Signed-off-by: Bart Van Assche Link: https://lore.kernel.org/r/20240708211716.2827751-9-bvanassche@acm.org Reviewed-by: Manivannan Sadhasivam Signed-off-by: Martin K. Petersen drivers/ufs/core/ufshcd.c | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-) commit 4a8c859b44da0040a02fb12aec3384f6279c17d7 Author: Bart Van Assche Date: Mon Jul 8 14:16:02 2024 -0700 scsi: ufs: mcq: Move the "hba->mcq_enabled = true" assignment Move the "hba->mcq_enabled = true" assignment to prevent that it gets duplicated by a later patch that will introduce more ufshcd_mcq_enable() calls. No functionality is changed by this patch. Signed-off-by: Bart Van Assche Link: https://lore.kernel.org/r/20240708211716.2827751-8-bvanassche@acm.org Reviewed-by: Manivannan Sadhasivam Signed-off-by: Martin K. Petersen drivers/ufs/core/ufs-mcq.c | 1 + drivers/ufs/core/ufshcd.c | 1 - 2 files changed, 1 insertion(+), 1 deletion(-) commit 0fca3318e550d48e9a6c844763bf9eab91c30f07 Author: Bart Van Assche Date: Mon Jul 8 14:16:01 2024 -0700 scsi: ufs: core: Inline is_mcq_enabled() Improve code readability by inlining is_mcq_enabled(). Cc: Peter Wang Cc: Manivannan Sadhasivam Signed-off-by: Bart Van Assche Link: https://lore.kernel.org/r/20240708211716.2827751-7-bvanassche@acm.org Reviewed-by: Manivannan Sadhasivam Signed-off-by: Martin K. Petersen drivers/ufs/core/ufshcd.c | 28 ++++++++++++++-------------- drivers/ufs/host/ufs-mediatek.c | 6 +++--- include/ufs/ufshcd.h | 5 ----- 3 files changed, 17 insertions(+), 22 deletions(-) commit f4750af7081d0466c187f5b72272d07148d75e67 Author: Bart Van Assche Date: Mon Jul 8 14:16:00 2024 -0700 scsi: ufs: core: Initialize hba->reserved_slot earlier Move the hba->reserved_slot and the host->can_queue assignments from ufshcd_config_mcq() into ufshcd_alloc_mcq(). The advantages of this change are as follows: - It becomes easier to verify that these two parameters are updated if hba->nutrs is updated. - It prevents unnecessary assignments to these two parameters. While ufshcd_config_mcq() is called during host reset, ufshcd_alloc_mcq() is not. Cc: Can Guo Reviewed-by: Peter Wang Reviewed-by: Manivannan Sadhasivam Signed-off-by: Bart Van Assche Link: https://lore.kernel.org/r/20240708211716.2827751-6-bvanassche@acm.org Signed-off-by: Martin K. Petersen drivers/ufs/core/ufshcd.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) commit b53eb9a050d76fc695258e04384e71b3fbb1e7d5 Author: Bart Van Assche Date: Mon Jul 8 14:15:59 2024 -0700 scsi: ufs: core: Rename the MASK_TRANSFER_REQUESTS_SLOTS constant Rename this constant to prepare for the introduction of the MASK_TRANSFER_REQUESTS_SLOTS_MCQ constant. The acronym "SDB" stands for "single doorbell" (mode). Reviewed-by: Peter Wang Reviewed-by: Manivannan Sadhasivam Signed-off-by: Bart Van Assche Link: https://lore.kernel.org/r/20240708211716.2827751-5-bvanassche@acm.org Signed-off-by: Martin K. Petersen drivers/ufs/core/ufshcd.c | 2 +- include/ufs/ufshci.h | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) commit 92c0b10fefe2cdae4e57ad5ff023345ea4a7134d Author: Bart Van Assche Date: Mon Jul 8 14:15:58 2024 -0700 scsi: ufs: core: Remove two constants The SCSI host template members .cmd_per_lun and .can_queue are copied into the SCSI host data structure. Before these are used, these are overwritten by ufshcd_init(). Hence, this patch does not change any functionality. Reviewed-by: Manivannan Sadhasivam Reviewed-by: Keoseong Park Reviewed-by: Peter Wang Signed-off-by: Bart Van Assche Link: https://lore.kernel.org/r/20240708211716.2827751-4-bvanassche@acm.org Signed-off-by: Martin K. Petersen drivers/ufs/core/ufshcd.c | 4 ---- 1 file changed, 4 deletions(-) commit 93ef12d92f65facf8e02ad6578a898a190aa6cf4 Author: Bart Van Assche Date: Mon Jul 8 14:15:57 2024 -0700 scsi: ufs: core: Initialize struct uic_command once Instead of first zero-initializing struct uic_command and next initializing it memberwise, initialize all members at once. Reviewed-by: Daejun Park Reviewed-by: Avri Altman Reviewed-by: Manivannan Sadhasivam Reviewed-by: Peter Wang Signed-off-by: Bart Van Assche Link: https://lore.kernel.org/r/20240708211716.2827751-3-bvanassche@acm.org Signed-off-by: Martin K. Petersen drivers/ufs/core/ufshcd.c | 61 ++++++++++++++++++++++++----------------------- include/ufs/ufshcd.h | 4 ++-- 2 files changed, 33 insertions(+), 32 deletions(-) commit d502dac69ac0a81231bb41f0e4e2845d7414191b Author: Bart Van Assche Date: Mon Jul 8 14:15:56 2024 -0700 scsi: ufs: core: Declare functions once Several functions are declared in include/ufs/ufshcd.h and also in drivers/ufs/core/ufshcd-priv.h. Remove the duplicate declarations. Reviewed-by: Peter Wang Signed-off-by: Bart Van Assche Link: https://lore.kernel.org/r/20240708211716.2827751-2-bvanassche@acm.org Reviewed-by: Manivannan Sadhasivam Reviewed-by: Keoseong Park Signed-off-by: Martin K. Petersen drivers/ufs/core/ufshcd-priv.h | 6 ------ 1 file changed, 6 deletions(-) commit 58f9416d413aa2c20b2515233ce450a1607ef843 Merge: d00ba1d734f7 70838938e89c Author: Jakub Kicinski Date: Wed Jul 10 19:09:54 2024 -0700 Merge branch 'ice-support-to-dump-phy-config-fec' Tony Nguyen says: ==================== ice: Support to dump PHY config, FEC Anil Samal says: Implementation to dump PHY configuration and FEC statistics to facilitate link level debugging of customer issues. Implementation has two parts a. Serdes equalization # ethtool -d eth0 Output: Offset Values ------ ------ 0x0000: 00 00 00 00 03 00 00 00 05 00 00 00 01 08 00 40 0x0010: 01 00 00 40 00 00 39 3c 01 00 00 00 00 00 00 00 0x0020: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ... 0x01f0: 01 00 00 00 ef be ad de 8f 00 00 00 00 00 00 00 0x0200: 00 00 00 00 ef be ad de 00 00 00 00 00 00 00 00 0x0210: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0x0220: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0x0230: 00 00 00 00 00 00 00 00 00 00 00 00 fa ff 00 00 0x0240: 06 00 00 00 03 00 00 00 00 00 00 00 00 00 00 00 0x0250: 0f b0 0f b0 00 00 00 00 00 00 00 00 00 00 00 00 0x0260: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0x0270: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0x0280: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0x0290: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0x02a0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0x02b0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0x02c0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0x02d0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0x02e0: 00 00 00 00 00 00 00 00 00 00 00 00 Current implementation appends 176 bytes i.e. 44 bytes * 4 serdes lane. For port with 2 serdes lane, first 88 bytes are valid values and remaining 88 bytes are filled with zero. Similarly for port with 1 serdes lane, first 44 bytes are valid and remaining 132 bytes are marked zero. Each set of serdes equalizer parameter (i.e. set of 44 bytes) follows below order a. rx_equalization_pre2 b. rx_equalization_pre1 c. rx_equalization_post1 d. rx_equalization_bflf e. rx_equalization_bfhf f. rx_equalization_drate g. tx_equalization_pre1 h. tx_equalization_pre3 i. tx_equalization_atten j. tx_equalization_post1 k. tx_equalization_pre2 Where each individual equalizer parameter is of 4 bytes. As ethtool prints values as individual bytes, for little endian machine these values will be in reverse byte order. b. FEC block counts # ethtool -I --show-fec eth0 Output: FEC parameters for eth0: Supported/Configured FEC encodings: Auto RS BaseR Active FEC encoding: RS Statistics: corrected_blocks: 0 uncorrectable_blocks: 0 This series do following: Patch 1 - Implementation to support user provided flag for side band queue command. Patch 2 - Currently driver does not have a way to derive serdes lane number, pcs quad , pcs port from port number. So we introduced a mechanism to derive above info. Ethtool interface extension to include FEC statistics counter. Patch 3 - Ethtool interface extension to include serdes equalizer output. v1: https://lore.kernel.org/netdev/20240702180710.2606969-1-anthony.l.nguyen@intel.com/ ==================== Link: https://patch.msgid.link/20240709202951.2103115-1-anthony.l.nguyen@intel.com Signed-off-by: Jakub Kicinski commit 70838938e89c759586eb4f3b5ce29ca252c8240d Author: Anil Samal Date: Tue Jul 9 13:29:49 2024 -0700 ice: Implement driver functionality to dump serdes equalizer values To debug link issues in the field, serdes Tx/Rx equalizer values help to determine the health of serdes lane. Extend 'ethtool -d' option to dump serdes Tx/Rx equalizer. The following list of equalizer param is supported a. rx_equalization_pre2 b. rx_equalization_pre1 c. rx_equalization_post1 d. rx_equalization_bflf e. rx_equalization_bfhf f. rx_equalization_drate g. tx_equalization_pre1 h. tx_equalization_pre3 i. tx_equalization_atten j. tx_equalization_post1 k. tx_equalization_pre2 Reviewed-by: Simon Horman Reviewed-by: Jesse Brandeburg Signed-off-by: Anil Samal Tested-by: Pucha Himasekhar Reddy (A Contingent worker at Intel) Signed-off-by: Tony Nguyen Link: https://patch.msgid.link/20240709202951.2103115-4-anthony.l.nguyen@intel.com Signed-off-by: Jakub Kicinski drivers/net/ethernet/intel/ice/ice_adminq_cmd.h | 51 +++++++++ drivers/net/ethernet/intel/ice/ice_common.c | 37 +++++++ drivers/net/ethernet/intel/ice/ice_common.h | 2 + drivers/net/ethernet/intel/ice/ice_ethtool.c | 138 +++++++++++++++++++++++- drivers/net/ethernet/intel/ice/ice_ethtool.h | 19 ++++ 5 files changed, 245 insertions(+), 2 deletions(-) commit ac21add2540e1a6ed27abea47fd2234ab05c71eb Author: Anil Samal Date: Tue Jul 9 13:29:48 2024 -0700 ice: Implement driver functionality to dump fec statistics To debug link issues in the field, it is paramount to dump fec corrected/uncorrected block counts from firmware. Firmware requires PCS quad number and PCS port number to read FEC statistics. Current driver implementation does not maintain above physical properties of a port. Add new driver API to derive physical properties of an input port.These properties include PCS quad number, PCS port number, serdes lane count, primary serdes lane number. Extend ethtool option '--show-fec' to support fec statistics. The IEEE standard mandates two sets of counters: - 30.5.1.1.17 aFECCorrectedBlocks - 30.5.1.1.18 aFECUncorrectableBlocks Standard defines above statistics per lane but current implementation supports total FEC statistics per port i.e. sum of all lane per port. Find sample output below FEC parameters for ens21f0np0: Supported/Configured FEC encodings: Auto RS BaseR Active FEC encoding: RS Statistics: corrected_blocks: 0 uncorrectable_blocks: 0 Reviewed-by: Simon Horman Reviewed-by: Jesse Brandeburg Signed-off-by: Anil Samal Tested-by: Pucha Himasekhar Reddy (A Contingent worker at Intel) Signed-off-by: Tony Nguyen Link: https://patch.msgid.link/20240709202951.2103115-3-anthony.l.nguyen@intel.com Signed-off-by: Jakub Kicinski drivers/net/ethernet/intel/ice/ice_common.c | 57 +++++ drivers/net/ethernet/intel/ice/ice_common.h | 24 +++ drivers/net/ethernet/intel/ice/ice_ethtool.c | 304 +++++++++++++++++++++++++++ drivers/net/ethernet/intel/ice/ice_ethtool.h | 10 + drivers/net/ethernet/intel/ice/ice_type.h | 8 + 5 files changed, 403 insertions(+) commit a317f873ea85e1e3abf7963670e88fd6f23f8c68 Author: Anil Samal Date: Tue Jul 9 13:29:47 2024 -0700 ice: Extend Sideband Queue command to support flags Current driver implementation for Sideband Queue supports a fixed flag (ICE_AQ_FLAG_RD). To retrieve FEC statistics from firmware, Sideband Queue command is used with a different flag. Extend API for Sideband Queue command to use 'flags' as input argument. Reviewed-by: Simon Horman Reviewed-by: Jesse Brandeburg Signed-off-by: Anil Samal Tested-by: Pucha Himasekhar Reddy (A Contingent worker at Intel) Signed-off-by: Tony Nguyen Link: https://patch.msgid.link/20240709202951.2103115-2-anthony.l.nguyen@intel.com Signed-off-by: Jakub Kicinski drivers/net/ethernet/intel/ice/ice_common.c | 5 +++-- drivers/net/ethernet/intel/ice/ice_common.h | 2 +- drivers/net/ethernet/intel/ice/ice_ptp_hw.c | 20 ++++++++++---------- 3 files changed, 14 insertions(+), 13 deletions(-) commit d00ba1d734f78c8f0a4826acd1f19ec42bbcb9be Author: Frank Li Date: Tue Jul 9 17:48:41 2024 -0400 dt-bindings: net: convert enetc to yaml Convert enetc device binding file to yaml. Split to 3 yaml files, 'fsl,enetc.yaml', 'fsl,enetc-mdio.yaml', 'fsl,enetc-ierb.yaml'. Additional Changes: - Add pci, in compatible string. - Ref to common ethernet-controller.yaml and mdio.yaml. - Add Wei fang, Vladimir and Claudiu as maintainer. - Update ENETC description. - Remove fixed-link part. Signed-off-by: Frank Li Reviewed-by: Rob Herring (Arm) Link: https://patch.msgid.link/20240709214841.570154-1-Frank.Li@nxp.com Signed-off-by: Jakub Kicinski .../devicetree/bindings/net/fsl,enetc-ierb.yaml | 38 +++++++ .../devicetree/bindings/net/fsl,enetc-mdio.yaml | 57 ++++++++++ .../devicetree/bindings/net/fsl,enetc.yaml | 66 ++++++++++++ .../devicetree/bindings/net/fsl-enetc.txt | 119 --------------------- 4 files changed, 161 insertions(+), 119 deletions(-) commit ab896aa62e309b3ceaa35b82dc99b64da7ce6bfa Author: Marek Vasut Date: Mon Jul 8 23:16:29 2024 +0200 dt-bindings: net: realtek,rtl82xx: Document RTL8211F LED support The RTL8211F PHY does support LED configuration, document support for LEDs in the binding document. Signed-off-by: Marek Vasut Reviewed-by: Rob Herring (Arm) Link: https://patch.msgid.link/20240708211649.165793-1-marex@denx.de Signed-off-by: Jakub Kicinski .../devicetree/bindings/net/realtek,rtl82xx.yaml | 17 ++++++++++++++--- 1 file changed, 14 insertions(+), 3 deletions(-) commit 3a8617c7df6eb351227aad9b0df647f34a7ef423 Author: Alison Schofield Date: Sat Jul 6 18:53:44 2024 -0700 cxl/test: Replace ENXIO with EBUSY for inject poison limit reached The CXL driver was recently updated to return EBUSY rather than ENXIO when the device reports that an injection request exceeds the device's limit. That change to EBUSY allows debug users to differentiate between limit reached and inject failures for any other reason. Change cxl-test to also return EBUSY and tidy up the dev_dbg() messaging to emit the correct limit. Reminder: the cxl-test per device injection limit is a configurable attribute: /sys/bus/platform/drivers/cxl_mock_mem/poison_inject_max Signed-off-by: Alison Schofield Tested-by: Xingtao Yao Reviewed-by: Dan Williams Reviewed-by: Davidlohr Bueso Link: https://patch.msgid.link/ba1b80e1658b644d85d0d5e2287112d00a48b9cf.1720316188.git.alison.schofield@intel.com Signed-off-by: Dave Jiang tools/testing/cxl/test/mem.c | 15 +++++++-------- 1 file changed, 7 insertions(+), 8 deletions(-) commit 591209c79844c1ecbee79e6b5a019e5b61eab8d3 Author: Alison Schofield Date: Sat Jul 6 18:53:43 2024 -0700 cxl/memdev: Replace ENXIO with EBUSY for inject poison limit reached The CXL driver provides a debugfs interface offering users the ability to inject and clear poison to a memdev. Once a user has injected up to the devices limit further injection requests fail with ENXIO until a clear poison is issued. Users may not have device specs in hand or may want to intentionally hit the limit and then clear. Replace the usual ENXIO return status with EBUSY so users can recognize this failure. Signed-off-by: Alison Schofield Tested-by: Xingtao Yao Reviewed-by: Dan Williams Reviewed-by: Davidlohr Bueso Link: https://patch.msgid.link/825bd4c67fb55a4373c4182d999ad49d4e6b4fe7.1720316188.git.alison.schofield@intel.com Signed-off-by: Dave Jiang Documentation/ABI/testing/debugfs-cxl | 7 ++++--- drivers/cxl/cxlmem.h | 2 +- 2 files changed, 5 insertions(+), 4 deletions(-) commit bebfbbaffccfb69126c5a6a1d41cd868b6419370 Author: Fabio M. De Francesco Date: Fri Jun 28 19:48:07 2024 +0200 cxl/acpi: Warn on mixed CXL VH and RCH/RCD Hierarchy Each Host Bridge instance has a corresponding CXL Host Bridge Structure (CHBS) ACPI table that identifies its capabilities. CHBS tables can be two types (CXL 3.1 Table 9-21): The PCIe Root Complex Register Block (RCRB) and CXL Host Bridge Component Registers (CHBCR). If a Host Bridge is attached to a device that is operating in Restricted CXL Device Mode (RCD), BIOS publishes an RCRB with the base address of registers that describe its capabilities (CXL 3.1 sec. 9.11). Instead, the new (CXL 2.0+) Component registers can only be accessed by means of a base address published with a CHBCR (CXL 3.1 sec. 9.12). If an eRCD (a device that forces the host-bridge into CXL 1.1 Restricted CXL Host mode) is attached to a CXL 2.0+ Host-Bridge, the current CXL specification does not define a mechanism for finding CXL-2.0-only root-port component registers like HDM decoders and Extended Security capability. An algorithm to locate a CHBCR associated with an RCRB, would be too invasive to land without some concrete motivation. Therefore, just print a message to inform of unsupported config. Count how many different CHBS "Version" types are detected by cxl_get_chbs_iter(). Then make cxl_get_chbs() print a warning if that sum is greater than 1. Tested-by: Alison Schofield Signed-off-by: Fabio M. De Francesco Reviewed-by: Davidlohr Bueso Reviewed-by: Alison Schofield Link: https://patch.msgid.link/20240628175535.272472-1-fabio.m.de.francesco@linux.intel.com Signed-off-by: Dave Jiang drivers/cxl/acpi.c | 34 +++++++++++++++++++++++++++------- 1 file changed, 27 insertions(+), 7 deletions(-) commit ee3f77a37646ed3c9b60e747737fb2c5c3a4c261 Merge: 1ee45e649ebf 3cbda25e2db2 Author: Mark Brown Date: Thu Jul 11 00:26:30 2024 +0100 ASoC: dt-bindings: convert qcom sound bindings to Merge series from Rayyan Ansari : These patches convert the remaining plain text bindings for Qualcomm sound drivers to dt schema, so device trees can be validated against them. commit 1ee45e649ebf07f1438a464fc3bafd14becea797 Merge: 0d1ebba74fad dc0e5ca8856d Author: Mark Brown Date: Thu Jul 11 00:26:23 2024 +0100 firmware: cs_dsp: Some small coding improvements Merge series from Richard Fitzgerald : Commit series that makes some small improvements to code and the kernel log messages. commit 1037885b309cfca5b770137209e9b51d1b50cc27 Author: Drew Fustini Date: Sun Jun 23 19:12:31 2024 -0700 dt-bindings: clock: Document T-Head TH1520 AP_SUBSYS controller Document bindings for the T-Head TH1520 AP sub-system clock controller. Link: https://openbeagle.org/beaglev-ahead/beaglev-ahead/-/blob/main/docs/TH1520%20System%20User%20Manual.pdf Co-developed-by: Yangtao Li Signed-off-by: Yangtao Li Reviewed-by: Conor Dooley Signed-off-by: Drew Fustini Link: https://lore.kernel.org/r/20240623-th1520-clk-v2-1-ad8d6432d9fb@tenstorrent.com Signed-off-by: Stephen Boyd .../bindings/clock/thead,th1520-clk-ap.yaml | 53 ++++++++++++ MAINTAINERS | 2 + include/dt-bindings/clock/thead,th1520-clk-ap.h | 96 ++++++++++++++++++++++ 3 files changed, 151 insertions(+) commit bed6b0317441d82c32506750ccd868d83850e6f4 Author: Chao Yu Date: Tue Jun 25 11:16:03 2024 +0800 f2fs: clean up addrs_per_{inode,block}() Introduce a new help addrs_per_page() to wrap common code from addrs_per_inode() and addrs_per_block() for cleanup. Signed-off-by: Chao Yu Signed-off-by: Jaegeuk Kim fs/f2fs/f2fs.h | 20 +++++++------------- include/linux/f2fs_fs.h | 7 +++---- 2 files changed, 10 insertions(+), 17 deletions(-) commit 7309871c03be22bee843f6961dcce183f04d48a9 Author: Chao Yu Date: Tue Jun 25 11:16:02 2024 +0800 f2fs: clean up F2FS_I() Use temporary variable instead of F2FS_I() for cleanup. Signed-off-by: Chao Yu Signed-off-by: Jaegeuk Kim fs/f2fs/f2fs.h | 32 ++++++++++++--------------- fs/f2fs/file.c | 64 +++++++++++++++++++++++++++++------------------------- fs/f2fs/inode.c | 54 ++++++++++++++++++++------------------------- fs/f2fs/namei.c | 20 +++++++++-------- fs/f2fs/recovery.c | 11 +++++----- 5 files changed, 88 insertions(+), 93 deletions(-) commit 8ecef8e01a08c7e3e4ffc8f08d9f9663984f334b Author: peng guo Date: Wed Jul 10 10:31:12 2024 +0800 cxl/core: Fix incorrect vendor debug UUID define When user send a mbox command whose opcode is CXL_MBOX_OP_CLEAR_LOG and the in_payload is normal vendor debug log UUID according to the CXL specification cxl_payload_from_user_allowed() will return false unexpectedly, Sending mbox cmd operation fails and the kernel log will print: Clear Log: input payload not allowed. All CXL devices that support a debug log shall support the Vendor Debug Log to allow the log to be accessed through a common host driver, for any device, all versions of the CXL specification define the same value with Log Identifier of: 5e1819d9-11a9-400c-811f-d60719403d86 Refer to CXL spec r3.1 Table 8-71 Fix the definition value of DEFINE_CXL_VENDOR_DEBUG_UUID to match the CXL specification. Fixes: 472b1ce6e9d6 ("cxl/mem: Enable commands via CEL") Signed-off-by: peng guo Reviewed-by: Alison Schofield Link: https://patch.msgid.link/20240710023112.8063-1-engguopeng@buaa.edu.cn Signed-off-by: Dave Jiang drivers/cxl/cxlmem.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit f18d0076933689775fe7faeeb10ee93ff01be6ab Author: Sunmin Jeong Date: Wed Jul 10 20:51:43 2024 +0900 f2fs: use meta inode for GC of COW file In case of the COW file, new updates and GC writes are already separated to page caches of the atomic file and COW file. As some cases that use the meta inode for GC, there are some race issues between a foreground thread and GC thread. To handle them, we need to take care when to invalidate and wait writeback of GC pages in COW files as the case of using the meta inode. Also, a pointer from the COW inode to the original inode is required to check the state of original pages. For the former, we can solve the problem by using the meta inode for GC of COW files. Then let's get a page from the original inode in move_data_block when GCing the COW file to avoid race condition. Fixes: 3db1de0e582c ("f2fs: change the current atomic write way") Cc: stable@vger.kernel.org #v5.19+ Reviewed-by: Sungjong Seo Reviewed-by: Yeongjin Gil Signed-off-by: Sunmin Jeong Reviewed-by: Chao Yu Signed-off-by: Jaegeuk Kim fs/f2fs/data.c | 2 +- fs/f2fs/f2fs.h | 13 +++++++++++-- fs/f2fs/file.c | 3 +++ fs/f2fs/gc.c | 7 +++++-- fs/f2fs/inline.c | 2 +- fs/f2fs/inode.c | 3 ++- 6 files changed, 23 insertions(+), 7 deletions(-) commit b40a2b00370931b0c50148681dd7364573e52e6b Author: Sunmin Jeong Date: Wed Jul 10 20:51:17 2024 +0900 f2fs: use meta inode for GC of atomic file The page cache of the atomic file keeps new data pages which will be stored in the COW file. It can also keep old data pages when GCing the atomic file. In this case, new data can be overwritten by old data if a GC thread sets the old data page as dirty after new data page was evicted. Also, since all writes to the atomic file are redirected to COW inodes, GC for the atomic file is not working well as below. f2fs_gc(gc_type=FG_GC) - select A as a victim segment do_garbage_collect - iget atomic file's inode for block B move_data_page f2fs_do_write_data_page - use dn of cow inode - set fio->old_blkaddr from cow inode - seg_freed is 0 since block B is still valid - goto gc_more and A is selected as victim again To solve the problem, let's separate GC writes and updates in the atomic file by using the meta inode for GC writes. Fixes: 3db1de0e582c ("f2fs: change the current atomic write way") Cc: stable@vger.kernel.org #v5.19+ Reviewed-by: Sungjong Seo Reviewed-by: Yeongjin Gil Signed-off-by: Sunmin Jeong Reviewed-by: Chao Yu Signed-off-by: Jaegeuk Kim fs/f2fs/data.c | 4 ++-- fs/f2fs/f2fs.h | 7 ++++++- fs/f2fs/gc.c | 6 +++--- fs/f2fs/segment.c | 6 +++--- 4 files changed, 14 insertions(+), 9 deletions(-) commit e3a19972a49f61775e5e11ac43a663f28cdfb8b2 Author: Sheng Yong Date: Wed Jul 10 09:26:59 2024 +0800 f2fs: only fragment segment in the same section When new_curseg() is allocating a new segment, if mode=fragment:xxx is switched on in large section scenario, __get_next_segno() will select the next segno randomly in the range of [0, maxsegno] in order to fragment segments. If the candidate segno is free, get_new_segment() will use it directly as the new segment. However, if the section of the candidate is not empty, and some other segments have already been used, and have a different type (e.g NODE) with the candidate (e.g DATA), GC will complain inconsistent segment type later. This could be reproduced by the following steps: dd if=/dev/zero of=test.img bs=1M count=10240 mkfs.f2fs -s 128 test.img mount -t f2fs test.img /mnt -o mode=fragment:block echo 1 > /sys/fs/f2fs/loop0/max_fragment_chunk echo 512 > /sys/fs/f2fs/loop0/max_fragment_hole dd if=/dev/zero of=/mnt/testfile bs=4K count=100 umount /mnt F2FS-fs (loop0): Inconsistent segment (4377) type [0, 1] in SSA and SIT In order to allow simulating segment fragmentation in large section scenario, this patch reduces the candidate range: * if curseg is the last segment in the section, return curseg->segno to make get_new_segment() itself find the next free segment. * if curseg is in the middle of the section, select candicate randomly in the range of [curseg + 1, last_seg_in_the_same_section] to keep type consistent. Reviewed-by: Chao Yu Signed-off-by: Sheng Yong Signed-off-by: Jaegeuk Kim fs/f2fs/segment.c | 14 +++++++++++--- 1 file changed, 11 insertions(+), 3 deletions(-) commit f06c0f82e38bbda7264d6ef3c90045ad2810e0f3 Author: Chao Yu Date: Tue Jun 25 10:32:39 2024 +0800 f2fs: fix to update user block counts in block_operations() Commit 59c9081bc86e ("f2fs: allow write page cache when writting cp") allows write() to write data to page cache during checkpoint, so block count fields like .total_valid_block_count, .alloc_valid_block_count and .rf_node_block_count may encounter race condition as below: CP Thread A - write_checkpoint - block_operations - f2fs_down_write(&sbi->node_change) - __prepare_cp_block : ckpt->valid_block_count = .total_valid_block_count - f2fs_up_write(&sbi->node_change) - write - f2fs_preallocate_blocks - f2fs_map_blocks(,F2FS_GET_BLOCK_PRE_AIO) - f2fs_map_lock - f2fs_down_read(&sbi->node_change) - f2fs_reserve_new_blocks - inc_valid_block_count : percpu_counter_add(&sbi->alloc_valid_block_count, count) : sbi->total_valid_block_count += count - f2fs_up_read(&sbi->node_change) - do_checkpoint : sbi->last_valid_block_count = sbi->total_valid_block_count : percpu_counter_set(&sbi->alloc_valid_block_count, 0) : percpu_counter_set(&sbi->rf_node_block_count, 0) - fsync - need_do_checkpoint - f2fs_space_for_roll_forward : alloc_valid_block_count was reset to zero, so, it may missed last data during checkpoint Let's change to update .total_valid_block_count, .alloc_valid_block_count and .rf_node_block_count in block_operations(), then their access can be protected by .node_change and .cp_rwsem lock, so that it can avoid above race condition. Fixes: 59c9081bc86e ("f2fs: allow write page cache when writting cp") Cc: Yunlei He Signed-off-by: Chao Yu Signed-off-by: Jaegeuk Kim fs/f2fs/checkpoint.c | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) commit 54f43a10fa257ad4af02a1d157fefef6ebcfa7dc Author: Eric Sandeen Date: Fri Jun 28 23:38:17 2024 -0500 f2fs: remove unreachable lazytime mount option parsing The lazytime/nolazytime options are now handled in the VFS, and are never seen in filesystem parsers, so remove handling of these options from f2fs. Note: when lazytime support was added in 6d94c74ab85f it made lazytime the default in default_options() - as a result, lazytime cannot be disabled (because Opt_nolazytime is never seen in f2fs parsing). If lazytime is desired to be configurable, and default off is OK, default_options() could be updated to stop setting it by default and allow mount option control. Signed-off-by: Eric Sandeen Reviewed-by: Chao Yu Signed-off-by: Jaegeuk Kim fs/f2fs/super.c | 10 ---------- 1 file changed, 10 deletions(-) commit c82bc1ab2a8a5e73d9728e80c4c2ed87e8921a38 Author: Daejun Park Date: Thu Jul 4 10:01:21 2024 +0900 f2fs: fix null reference error when checking end of zone This patch fixes a potentially null pointer being accessed by is_end_zone_blkaddr() that checks the last block of a zone when f2fs is mounted as a single device. Fixes: e067dc3c6b9c ("f2fs: maintain six open zones for zoned devices") Signed-off-by: Daejun Park Reviewed-by: Chao Yu Reviewed-by: Daeho Jeong Signed-off-by: Jaegeuk Kim fs/f2fs/data.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) commit 450a60ef607900bb9affb0e822fea9726679c512 Merge: f21711bbdbf0 3c1ff93b4dee Author: Mark Brown Date: Wed Jul 10 23:05:45 2024 +0100 regmap: Implement regmap_multi_reg_read() Merge series from Guenter Roeck : regmap_multi_reg_read() is similar to regmap_bilk_read() but reads from an array of non-sequential registers. It is helpful if multiple non- sequential registers need to be read in a single operation which would otherwise have to be mutex protected. The name of the new function was chosen to match the existing function regmap_multi_reg_write(). commit f24c9bfcd423e2b2bb0d198456412f614ec2030a Author: Jiwei Sun Date: Wed Jun 5 20:48:44 2024 +0800 PCI: vmd: Create domain symlink before pci_bus_add_devices() The vmd driver creates a "domain" symlink in sysfs for each VMD bridge. Previously this symlink was created after pci_bus_add_devices() added devices below the VMD bridge and emitted udev events to announce them to userspace. This led to a race between userspace consumers of the udev events and the kernel creation of the symlink. One such consumer is mdadm, which assembles block devices into a RAID array, and for devices below a VMD bridge, mdadm depends on the "domain" symlink. If mdadm loses the race, it may be unable to assemble a RAID array, which may cause a boot failure or other issues, with complaints like this: (udev-worker)[2149]: nvme1n1: '/sbin/mdadm -I /dev/nvme1n1'(err) 'mdadm: Unable to get real path for '/sys/bus/pci/drivers/vmd/0000:c7:00.5/domain/device'' (udev-worker)[2149]: nvme1n1: '/sbin/mdadm -I /dev/nvme1n1'(err) 'mdadm: /dev/nvme1n1 is not attached to Intel(R) RAID controller.' (udev-worker)[2149]: nvme1n1: '/sbin/mdadm -I /dev/nvme1n1'(err) 'mdadm: No OROM/EFI properties for /dev/nvme1n1' (udev-worker)[2149]: nvme1n1: '/sbin/mdadm -I /dev/nvme1n1'(err) 'mdadm: no RAID superblock on /dev/nvme1n1.' (udev-worker)[2149]: nvme1n1: Process '/sbin/mdadm -I /dev/nvme1n1' failed with exit code 1. This symptom prevents the OS from booting successfully. After a NVMe disk is probed/added by the nvme driver, udevd invokes mdadm to detect if there is a mdraid associated with this NVMe disk, and mdadm determines if a NVMe device is connected to a particular VMD domain by checking the "domain" symlink. For example: Thread A Thread B Thread mdadm vmd_enable_domain pci_bus_add_devices __driver_probe_device ... work_on_cpu schedule_work_on : wakeup Thread B nvme_probe : wakeup scan_work to scan nvme disk and add nvme disk then wakeup udevd : udevd executes mdadm command flush_work main : wait for nvme_probe done ... __driver_probe_device find_driver_devices : probe next nvme device : 1) Detect domain symlink ... 2) Find domain symlink ... from vmd sysfs ... 3) Domain symlink not ... created yet; failed sysfs_create_link : create domain symlink Create the VMD "domain" symlink before invoking pci_bus_add_devices() to avoid this race. Suggested-by: Adrian Huang Link: https://lore.kernel.org/linux-pci/20240605124844.24293-1-sjiwei@163.com Signed-off-by: Jiwei Sun Signed-off-by: Krzysztof Wilczyński [bhelgaas: commit log] Signed-off-by: Bjorn Helgaas Reviewed-by: Nirmal Patel drivers/pci/controller/vmd.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) commit fb9086e95ad84f14e4f4db97ed96422c74407830 Author: Thorsten Blum Date: Wed Jul 10 22:24:18 2024 +0200 riscv: Remove unnecessary int cast in variable_fls() __builtin_clz() returns an int and casting the whole expression to int is unnecessary. Remove it. Signed-off-by: Thorsten Blum Signed-off-by: Yury Norov arch/riscv/include/asm/bitops.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 692a68ee9c3c4ab984ae45a74a7569f14222d5aa Author: Wei Yang Date: Wed Jul 10 17:27:01 2024 +0000 radix tree test suite: put definition of bitmap_clear() into lib/bitmap.c In tools/ directory, function bitmap_clear() is currently only used in object file tools/testing/radix-tree/xarray.o. But instead of keeping a bitmap.c with only bitmap_clear() definition in radix-tree's own directory, it would be more proper to put it in common directory lib/. Sync the kernel definition and link some related libs, no functional change is expected. Signed-off-by: Wei Yang CC: Matthew Wilcox CC: Yury Norov Signed-off-by: Yury Norov tools/include/linux/bitmap.h | 17 ++++++++++++++++- tools/lib/bitmap.c | 20 ++++++++++++++++++++ tools/testing/radix-tree/Makefile | 4 ++-- tools/testing/radix-tree/bitmap.c | 23 ----------------------- 4 files changed, 38 insertions(+), 26 deletions(-) commit 00c7ded68012c5a6adb0b14635a9aae573eb81c6 Author: Nathan Chancellor Date: Wed Jul 10 10:07:52 2024 -0700 clk: sophgo: Avoid -Wsometimes-uninitialized in sg2042_clk_pll_set_rate() Clang warns (or errors with CONFIG_WERROR=y): drivers/clk/sophgo/clk-sg2042-pll.c:396:6: error: variable 'ret' is used uninitialized whenever 'if' condition is true [-Werror,-Wsometimes-uninitialized] 396 | if (sg2042_pll_enable(pll, 0)) { | ^~~~~~~~~~~~~~~~~~~~~~~~~ drivers/clk/sophgo/clk-sg2042-pll.c:418:9: note: uninitialized use occurs here 418 | return ret; | ^~~ drivers/clk/sophgo/clk-sg2042-pll.c:396:2: note: remove the 'if' if its condition is always false 396 | if (sg2042_pll_enable(pll, 0)) { | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ 397 | pr_warn("Can't disable pll(%s), status error\n", pll->hw.init->name); | ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ 398 | goto out; | ~~~~~~~~~ 399 | } | ~ drivers/clk/sophgo/clk-sg2042-pll.c:393:9: note: initialize the variable 'ret' to silence this warning 393 | int ret; | ^ | = 0 1 error generated. sg2042_pll_enable() only ever returns zero, so this situation cannot happen, but clang does not perform interprocedural analysis, so it cannot know this to avoid the warning. Make it clearer to the compiler by making sg2042_pll_enable() void and eliminate the error handling in sg2042_clk_pll_set_rate(), which clears up the warning, as ret will always be initialized. Fixes: 48cf7e01386e ("clk: sophgo: Add SG2042 clock driver") Signed-off-by: Nathan Chancellor Link: https://lore.kernel.org/r/20240710-clk-sg2042-fix-sometimes-uninitialized-pll_set_rate-v1-1-538fa82dd539@kernel.org Signed-off-by: Stephen Boyd drivers/clk/sophgo/clk-sg2042-pll.c | 17 +++++++---------- 1 file changed, 7 insertions(+), 10 deletions(-) commit 1f7a04a0e673c19cc10bf4039047e11367ac5735 Author: Li Qiang Date: Tue Jul 9 14:36:38 2024 +0800 clk/sophgo: Using BUG() instead of unreachable() in mmux_get_parent_id() In general it's a good idea to avoid using bare unreachable() because it introduces undefined behavior in compiled code. but it caused a compilation warning, Using BUG() instead of unreachable() to resolve compilation warnings. Fixes the following warnings: drivers/clk/sophgo/clk-cv18xx-ip.o: warning: objtool: mmux_round_rate() falls through to next function bypass_div_round_rate() Fixes: 80fd61ec46124 ("clk: sophgo: Add clock support for CV1800 SoC") Signed-off-by: Li Qiang Link: https://lore.kernel.org/r/c8e66d51f880127549e2a3e623be6787f62b310d.1720506143.git.liqiang01@kylinos.cn Signed-off-by: Stephen Boyd drivers/clk/sophgo/clk-cv18xx-ip.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 77aeb1b685f9db73d276bad4bb30d48505a6fd23 Author: Zqiang Date: Thu Jul 4 14:52:13 2024 +0800 smp: Add missing destroy_work_on_stack() call in smp_call_on_cpu() For CONFIG_DEBUG_OBJECTS_WORK=y kernels sscs.work defined by INIT_WORK_ONSTACK() is initialized by debug_object_init_on_stack() for the debug check in __init_work() to work correctly. But this lacks the counterpart to remove the tracked object from debug objects again, which will cause a debug object warning once the stack is freed. Add the missing destroy_work_on_stack() invocation to cure that. [ tglx: Massaged changelog ] Signed-off-by: Zqiang Signed-off-by: Thomas Gleixner Tested-by: Paul E. McKenney Link: https://lore.kernel.org/r/20240704065213.13559-1-qiang.zhang1211@gmail.com kernel/smp.c | 1 + 1 file changed, 1 insertion(+) commit 16badacd8af48980c546839626d0329bab32b4c3 Author: Alexandre Ghiti Date: Fri Mar 22 12:26:29 2024 +0100 riscv: Improve sbi_ecall() code generation by reordering arguments The sbi_ecall() function arguments are not in the same order as the ecall arguments, so we end up re-ordering the registers before the ecall which is useless and costly. So simply reorder the arguments in the same way as expected by ecall. Instead of reordering directly the arguments of sbi_ecall(), use a proxy macro since the current ordering is more natural. Before: Dump of assembler code for function sbi_ecall: 0xffffffff800085e0 <+0>: add sp,sp,-32 0xffffffff800085e2 <+2>: sd s0,24(sp) 0xffffffff800085e4 <+4>: mv t1,a0 0xffffffff800085e6 <+6>: add s0,sp,32 0xffffffff800085e8 <+8>: mv t3,a1 0xffffffff800085ea <+10>: mv a0,a2 0xffffffff800085ec <+12>: mv a1,a3 0xffffffff800085ee <+14>: mv a2,a4 0xffffffff800085f0 <+16>: mv a3,a5 0xffffffff800085f2 <+18>: mv a4,a6 0xffffffff800085f4 <+20>: mv a5,a7 0xffffffff800085f6 <+22>: mv a6,t3 0xffffffff800085f8 <+24>: mv a7,t1 0xffffffff800085fa <+26>: ecall 0xffffffff800085fe <+30>: ld s0,24(sp) 0xffffffff80008600 <+32>: add sp,sp,32 0xffffffff80008602 <+34>: ret After: Dump of assembler code for function __sbi_ecall: 0xffffffff8000b6b2 <+0>: add sp,sp,-32 0xffffffff8000b6b4 <+2>: sd s0,24(sp) 0xffffffff8000b6b6 <+4>: add s0,sp,32 0xffffffff8000b6b8 <+6>: ecall 0xffffffff8000b6bc <+10>: ld s0,24(sp) 0xffffffff8000b6be <+12>: add sp,sp,32 0xffffffff8000b6c0 <+14>: ret Signed-off-by: Alexandre Ghiti Reviewed-by: Atish Patra Reviewed-by: Yunhui Cui Link: https://lore.kernel.org/r/20240322112629.68170-1-alexghiti@rivosinc.com Signed-off-by: Palmer Dabbelt arch/riscv/include/asm/sbi.h | 10 ++++++---- arch/riscv/kernel/sbi.c | 10 +++++----- 2 files changed, 11 insertions(+), 9 deletions(-) commit 56c1c1a09ab93c7b7c957860f01f8600d6c03143 Author: Samuel Holland Date: Thu Mar 21 16:01:25 2024 -0700 riscv: Add tracepoints for SBI calls and returns These are useful for measuring the latency of SBI calls. The SBI HSM extension is excluded because those functions are called from contexts such as cpuidle where instrumentation is not allowed. Reviewed-by: Andrew Jones Signed-off-by: Samuel Holland Link: https://lore.kernel.org/r/20240321230131.1838105-1-samuel.holland@sifive.com Signed-off-by: Palmer Dabbelt arch/riscv/include/asm/trace.h | 54 ++++++++++++++++++++++++++++++++++++++++++ arch/riscv/kernel/sbi.c | 7 ++++++ 2 files changed, 61 insertions(+) commit 48d2245586452b8279a854970ce82f43477669d3 Merge: 28323a756166 6ed9a85f1c44 Author: Arnd Bergmann Date: Wed Jul 10 22:23:01 2024 +0200 Merge tag 'sunxi-dt-for-6.11-2' of https://git.kernel.org/pub/scm/linux/kernel/git/sunxi/linux into soc/dt Allwinner SoC device tree changes for 6.11 part 2 One additional peripheral enabled for the H616. - H616 crypto engine added * tag 'sunxi-dt-for-6.11-2' of https://git.kernel.org/pub/scm/linux/kernel/git/sunxi/linux: arm64: dts: allwinner: h616: add crypto engine node Link: https://lore.kernel.org/r/Zo7O73Afx7lZcBRi@wens.tw Signed-off-by: Arnd Bergmann commit 77dc111f6da2f4ed5b7d50c6cb5157b6bf4edd63 Merge: 8cfda4059fe1 e4b5a39c2fca Author: Arnd Bergmann Date: Wed Jul 10 22:22:32 2024 +0200 Merge tag 'sunxi-drivers-for-6.11-2' of https://git.kernel.org/pub/scm/linux/kernel/git/sunxi/linux into soc/drivers Allwinner SoC driver changes for 6.11 part 2 One additional minor cleanup - Const-ify |struct regmap_config| in SRAM driver - Const-ify |struct regmap_bus| in Allwinner RSB bus driver * tag 'sunxi-drivers-for-6.11-2' of https://git.kernel.org/pub/scm/linux/kernel/git/sunxi/linux: bus: sunxi-rsb: Constify struct regmap_bus soc: sunxi: sram: Constify struct regmap_config Link: https://lore.kernel.org/r/Zo7T4YsfamN0PbYK@wens.tw Signed-off-by: Arnd Bergmann commit a43fe27d650375cd9e5ea915c538f6f9eabd185e Author: Xiao Wang Date: Fri Jun 21 13:47:07 2024 +0800 riscv: Optimize crc32 with Zbc extension As suggested by the B-ext spec, the Zbc (carry-less multiplication) instructions can be used to accelerate CRC calculations. Currently, the crc32 is the most widely used crc function inside kernel, so this patch focuses on the optimization of just the crc32 APIs. Compared with the current table-lookup based optimization, Zbc based optimization can also achieve large stride during CRC calculation loop, meantime, it avoids the memory access latency of the table-lookup based implementation and it reduces memory footprint. If Zbc feature is not supported in a runtime environment, then the table-lookup based implementation would serve as fallback via alternative mechanism. By inspecting the vmlinux built by gcc v12.2.0 with default optimization level (-O2), we can see below instruction count change for each 8-byte stride in the CRC32 loop: rv64: crc32_be (54->31), crc32_le (54->13), __crc32c_le (54->13) rv32: crc32_be (50->32), crc32_le (50->16), __crc32c_le (50->16) The compile target CPU is little endian, extra effort is needed for byte swapping for the crc32_be API, thus, the instruction count change is not as significant as that in the *_le cases. This patch is tested on QEMU VM with the kernel CRC32 selftest for both rv64 and rv32. Running the CRC32 selftest on a real hardware (SpacemiT K1) with Zbc extension shows 65% and 125% performance improvement respectively on crc32_test() and crc32c_test(). Signed-off-by: Xiao Wang Reviewed-by: Charlie Jenkins Link: https://lore.kernel.org/r/20240621054707.1847548-1-xiao.w.wang@intel.com Signed-off-by: Palmer Dabbelt arch/riscv/Kconfig | 23 ++++ arch/riscv/lib/Makefile | 1 + arch/riscv/lib/crc32.c | 294 ++++++++++++++++++++++++++++++++++++++++++++++++ include/linux/crc32.h | 3 + 4 files changed, 321 insertions(+) commit 99194e6db5d89c00ea8acd1eb3ff260e1c440f55 Author: Christian König Date: Fri Jan 19 14:57:29 2024 +0100 drm/amdgpu: reject gang submit on reserved VMIDs A gang submit won't work if the VMID is reserved and we can't flush out VM changes from multiple engines at the same time. Signed-off-by: Christian König Reviewed-by: Alex Deucher Signed-off-by: Alex Deucher (cherry picked from commit 320debca1ba3a81c87247eac84eff976ead09ee0) drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c | 15 +++++++++++++++ drivers/gpu/drm/amd/amdgpu/amdgpu_ids.c | 15 ++++++++++++++- drivers/gpu/drm/amd/amdgpu/amdgpu_ids.h | 1 + 3 files changed, 30 insertions(+), 1 deletion(-) commit 12b02b6359598ed126c089e66b5766c461d3420e Author: Thorsten Blum Date: Wed Jul 10 16:33:10 2024 +0200 clk: mxs: Use clamp() in clk_ref_round_rate() and clk_ref_set_rate() Use clamp() instead of duplicating its implementation. Signed-off-by: Thorsten Blum Link: https://lore.kernel.org/r/20240710143309.706135-2-thorsten.blum@toblux.com Signed-off-by: Stephen Boyd drivers/clk/mxs/clk-ref.c | 14 ++------------ 1 file changed, 2 insertions(+), 12 deletions(-) commit 38bded815463f40bc36f28c5a60998f78c8259e6 Author: Javier Carrasco Date: Wed Jul 3 11:50:22 2024 +0200 clk: sunxi-ng r40: Constify struct regmap_config `sun8i_r40_ccu_regmap_config` is not modified and can be declared as const to move its data to a read-only section. Signed-off-by: Javier Carrasco Link: https://lore.kernel.org/r/20240703-clk-const-regmap-v1-9-7d15a0671d6f@gmail.com Reviewed-by: Andre Przywara Acked-by: Chen-Yu Tsai Signed-off-by: Stephen Boyd drivers/clk/sunxi-ng/ccu-sun8i-r40.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 18a8a4c88fb4c261f72a29b769c9463362d9687a Merge: ec5b8c76ab1c 52b49ec1b2c7 Author: Martin KaFai Lau Date: Wed Jul 10 12:23:32 2024 -0700 Merge branch 'BPF selftests misc fixes' Geliang Tang says: ==================== v2: - only check the first "link" (link_nl) in test_mixed_links(). - Drop patch 2 in v1. This patchset fixes a segfault and a bpf object leak in test_progs. It is a resend patch 1 out of "skip ENOTSUPP BPF selftests" set as Eduard suggested. Together with another fix for xdp_adjust_tail. ==================== Signed-off-by: Martin KaFai Lau commit 52b49ec1b2c78deb258596c3b231201445ef5380 Author: Geliang Tang Date: Wed Jul 10 21:10:17 2024 +0800 selftests/bpf: Close obj in error path in xdp_adjust_tail If bpf_object__load() fails in test_xdp_adjust_frags_tail_grow(), "obj" opened before this should be closed. So use "goto out" to close it instead of using "return" here. Fixes: 110221081aac ("bpf: selftests: update xdp_adjust_tail selftest to include xdp frags") Signed-off-by: Geliang Tang Link: https://lore.kernel.org/r/f282a1ed2d0e3fb38cceefec8e81cabb69cab260.1720615848.git.tanggeliang@kylinos.cn Signed-off-by: Martin KaFai Lau tools/testing/selftests/bpf/prog_tests/xdp_adjust_tail.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit eef0532e900c20a6760da829e82dac3ee18688c5 Author: Geliang Tang Date: Wed Jul 10 21:10:16 2024 +0800 selftests/bpf: Null checks for links in bpf_tcp_ca Run bpf_tcp_ca selftests (./test_progs -t bpf_tcp_ca) on a Loongarch platform, some "Segmentation fault" errors occur: ''' test_dctcp:PASS:bpf_dctcp__open_and_load 0 nsec test_dctcp:FAIL:bpf_map__attach_struct_ops unexpected error: -524 #29/1 bpf_tcp_ca/dctcp:FAIL test_cubic:PASS:bpf_cubic__open_and_load 0 nsec test_cubic:FAIL:bpf_map__attach_struct_ops unexpected error: -524 #29/2 bpf_tcp_ca/cubic:FAIL test_dctcp_fallback:PASS:dctcp_skel 0 nsec test_dctcp_fallback:PASS:bpf_dctcp__load 0 nsec test_dctcp_fallback:FAIL:dctcp link unexpected error: -524 #29/4 bpf_tcp_ca/dctcp_fallback:FAIL test_write_sk_pacing:PASS:open_and_load 0 nsec test_write_sk_pacing:FAIL:attach_struct_ops unexpected error: -524 #29/6 bpf_tcp_ca/write_sk_pacing:FAIL test_update_ca:PASS:open 0 nsec test_update_ca:FAIL:attach_struct_ops unexpected error: -524 settcpca:FAIL:setsockopt unexpected setsockopt: \ actual -1 == expected -1 (network_helpers.c:99: errno: No such file or directory) \ Failed to call post_socket_cb start_test:FAIL:start_server_str unexpected start_server_str: \ actual -1 == expected -1 test_update_ca:FAIL:ca1_ca1_cnt unexpected ca1_ca1_cnt: \ actual 0 <= expected 0 #29/9 bpf_tcp_ca/update_ca:FAIL #29 bpf_tcp_ca:FAIL Caught signal #11! Stack trace: ./test_progs(crash_handler+0x28)[0x5555567ed91c] linux-vdso.so.1(__vdso_rt_sigreturn+0x0)[0x7ffffee408b0] ./test_progs(bpf_link__update_map+0x80)[0x555556824a78] ./test_progs(+0x94d68)[0x5555564c4d68] ./test_progs(test_bpf_tcp_ca+0xe8)[0x5555564c6a88] ./test_progs(+0x3bde54)[0x5555567ede54] ./test_progs(main+0x61c)[0x5555567efd54] /usr/lib64/libc.so.6(+0x22208)[0x7ffff2aaa208] /usr/lib64/libc.so.6(__libc_start_main+0xac)[0x7ffff2aaa30c] ./test_progs(_start+0x48)[0x55555646bca8] Segmentation fault ''' This is because BPF trampoline is not implemented on Loongarch yet, "link" returned by bpf_map__attach_struct_ops() is NULL. test_progs crashs when this NULL link passes to bpf_link__update_map(). This patch adds NULL checks for all links in bpf_tcp_ca to fix these errors. If "link" is NULL, goto the newly added label "out" to destroy the skel. v2: - use "goto out" instead of "return" as Eduard suggested. Fixes: 06da9f3bd641 ("selftests/bpf: Test switching TCP Congestion Control algorithms.") Signed-off-by: Geliang Tang Reviewed-by: Alan Maguire Link: https://lore.kernel.org/r/b4c841492bd4ed97964e4e61e92827ce51bf1dc9.1720615848.git.tanggeliang@kylinos.cn Signed-off-by: Martin KaFai Lau tools/testing/selftests/bpf/prog_tests/bpf_tcp_ca.c | 16 ++++++++++++---- 1 file changed, 12 insertions(+), 4 deletions(-) commit 259043e3b730e0aa6408bff27af7edf7a5c9101c Author: Barry Song Date: Sun Jun 30 11:22:31 2024 +1200 mm: zswap: fix zswap_never_enabled() for CONFIG_ZSWAP==N If CONFIG_ZSWAP is set to N, it means zswap cannot be enabled. zswap_never_enabled() should return true. The only effect of this issue is that with Barry's latest large folio swapin patches for zram ("mm: support mTHP swap-in for zRAM-like swapfile"), we will always fallback to order-0 swapin, even mistakenly when !CONFIG_ZSWAP. Basically this bug makes Barry's in progress patches not work at all. The API was created to inform the mm core that zswap has never been enabled, allowing the mm core to perform mTHP swap-in. This is a transitional solution until zswap supports mTHP. If zswap has been enabled, performing mTHP swap-in will result in corrupted data. You may find the answer in the mTHP swap-in series: https://lore.kernel.org/linux-mm/CAJD7tkZ4FQr6HZpduOdvmqgg_-whuZYE-Bz5O2t6yzw6Yg+v1A@mail.gmail.com/ Link: https://lkml.kernel.org/r/20240629232231.42394-1-21cnbao@gmail.com Fixes: 0300e17d67c3 ("mm: zswap: add zswap_never_enabled()") Signed-off-by: Barry Song Reviewed-by: Chengming Zhou Acked-by: Yosry Ahmed Acked-by: Chris Li Acked-by: David Hildenbrand Reviewed-by: Nhat Pham Cc: Johannes Weiner Cc: Matthew Wilcox (Oracle) Signed-off-by: Andrew Morton include/linux/zswap.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit e5a119c4a6835a53f93fcfba6c177daef58467e3 Author: Barry Song Date: Sun Jun 30 11:41:55 2024 +1200 mm/vmscan: drop checking if _deferred_list is empty before using TTU_SYNC The optimization of list_empty(&folio->_deferred_list) aimed to prevent increasing the PTL duration when a large folio is partially unmapped, for example, from subpage 0 to subpage (nr - 2). But Ryan's commit 5ed890ce5147 ("mm: vmscan: avoid split during shrink_folio_list()") actually splits this kind of large folios. This makes the "optimization" useless. Additionally, the list_empty() technically required a data_race() annotation. Link: https://lkml.kernel.org/r/20240629234155.53524-1-21cnbao@gmail.com Signed-off-by: Barry Song Reviewed-by: Ryan Roberts Reviewed-by: David Hildenbrand Signed-off-by: Andrew Morton mm/vmscan.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 689d92cc81ac57ca6b674be8728b9c5ea5c725fd Author: Wei Yang Date: Tue Jul 2 02:09:31 2024 +0000 mm/page_alloc: remove prefetchw() on freeing page to buddy system The prefetchw() is introduced from an ancient patch[1]. The change log says: The basic idea is to free higher order pages instead of going through every single one. Also, some unnecessary atomic operations are done away with and replaced with non-atomic equivalents, and prefetching is done where it helps the most. For a more in-depth discusion of this patch, please see the linux-ia64 archives (topic is "free bootmem feedback patch"). So there are several changes improve the bootmem freeing, in which the most basic idea is freeing higher order pages. And as Matthew says, "Itanium CPUs of this era had no prefetchers." I did 10 round bootup tests before and after this change, the data doesn't prove prefetchw() help speeding up bootmem freeing. The sum of the 10 round bootmem freeing time after prefetchw() removal even 5.2% faster than before. [1]: https://lore.kernel.org/linux-ia64/40F46962.4090604@sgi.com/ Link: https://lkml.kernel.org/r/20240702020931.7061-1-richard.weiyang@gmail.com Signed-off-by: Wei Yang Suggested-by: Matthew Wilcox Reviewed-by: Matthew Wilcox Reviewed-by: David Hildenbrand Signed-off-by: Andrew Morton mm/page_alloc.c | 13 ++----------- 1 file changed, 2 insertions(+), 11 deletions(-) commit 9325585288f2742b4b6effd5246154c374b9100f Author: Wei Yang Date: Mon Jul 1 01:34:10 2024 +0000 kernel/fork.c: put set_max_threads()/task_struct_whitelist() in __init section The functions set_max_threads() and task_struct_whitelist() are only used by fork_init() during bootup. Let's add __init tag to them. Link: https://lkml.kernel.org/r/20240701013410.17260-2-richard.weiyang@gmail.com Signed-off-by: Wei Yang Suggested-by: Oleg Nesterov Cc: David Hildenbrand Cc: Mike Rapoport (IBM) Signed-off-by: Andrew Morton kernel/fork.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) commit 66b4aaf7335c9e7f59ba93a45379ba2bbfe1b913 Author: Wei Yang Date: Mon Jul 1 01:34:09 2024 +0000 kernel/fork.c: get totalram_pages from memblock to calculate max_threads Since we plan to move the accounting into __free_pages_core(), totalram_pages may not represent the total usable pages on system at this point when defer_init is enabled. Instead we can get the total usable pages from memblock directly. Link: https://lkml.kernel.org/r/20240701013410.17260-1-richard.weiyang@gmail.com Signed-off-by: Wei Yang Cc: Mike Rapoport (IBM) Cc: David Hildenbrand Cc: Oleg Nesterov Signed-off-by: Andrew Morton kernel/fork.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) commit 3a3b7fec3974f954600844e41d773c00857ef48a Author: Johannes Weiner Date: Mon Jul 1 11:31:15 2024 -0400 mm: remove CONFIG_MEMCG_KMEM CONFIG_MEMCG_KMEM used to be a user-visible option for whether slab tracking is enabled. It has been default-enabled and equivalent to CONFIG_MEMCG for almost a decade. We've only grown more kernel memory accounting sites since, and there is no imaginable cgroup usecase going forward that wants to track user pages but not the multitude of user-drivable kernel allocations. Link: https://lkml.kernel.org/r/20240701153148.452230-1-hannes@cmpxchg.org Signed-off-by: Johannes Weiner Acked-by: Roman Gushchin Acked-by: Michal Hocko Acked-by: Shakeel Butt Acked-by: David Hildenbrand Cc: Muchun Song Signed-off-by: Andrew Morton include/linux/bpf.h | 4 +-- include/linux/list_lru.h | 2 +- include/linux/memcontrol.h | 22 +++---------- include/linux/sched.h | 3 +- include/linux/slab.h | 12 +++---- include/trace/events/kmem.h | 4 +-- init/Kconfig | 5 --- kernel/bpf/memalloc.c | 9 ++---- kernel/bpf/syscall.c | 6 ++-- mm/kfence/core.c | 6 ++-- mm/kfence/kfence.h | 2 +- mm/list_lru.c | 14 ++++---- mm/memcontrol-v1.c | 6 ++-- mm/memcontrol.c | 60 ++++------------------------------- mm/percpu-internal.h | 6 ++-- mm/percpu.c | 6 ++-- mm/slab.h | 2 +- mm/slab_common.c | 10 +++--- mm/slub.c | 10 +++--- tools/testing/selftests/cgroup/config | 1 - 20 files changed, 59 insertions(+), 131 deletions(-) commit 6df13230b612af81ce04f20bb37a02e58ef71925 Author: Roman Gushchin Date: Mon Jul 1 18:59:32 2024 +0000 mm: memcg: add cache line padding to mem_cgroup_per_node Memcg v1-specific fields serve a buffer function between read-mostly and update often parts of the mem_cgroup_per_node structure. If CONFIG_MEMCG_V1 is not set and these fields are not present, an explicit cacheline padding is needed. Link: https://lkml.kernel.org/r/20240701185932.704807-2-roman.gushchin@linux.dev Signed-off-by: Roman Gushchin Suggested-by: Shakeel Butt Acked-by: Shakeel Butt Cc: Johannes Weiner Cc: Michal Hocko Cc: Muchun Song Signed-off-by: Andrew Morton include/linux/memcontrol.h | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) commit 9fa001cf3bb0598aad09d15b2896f7db9ef87637 Author: Roman Gushchin Date: Mon Jul 1 18:59:31 2024 +0000 mm: memcg: drop obsolete cache line padding in struct mem_cgroup After the grouping of the cgroup v1-related fields and the corresponding reorganization of the struct mem_cgroup, the existing cache line padding doesn't make much sense anymore. Let's drop it for now and put back to new places, if necessary. Link: https://lkml.kernel.org/r/20240701185932.704807-1-roman.gushchin@linux.dev Signed-off-by: Roman Gushchin Suggested-by: Shakeel Butt Acked-by: Shakeel Butt Cc: Johannes Weiner Cc: Michal Hocko Cc: Muchun Song Signed-off-by: Andrew Morton include/linux/memcontrol.h | 4 ---- 1 file changed, 4 deletions(-) commit f6a6de245fdb1dfb4307b0a80ce7fa35ba2c35a6 Author: SeongJae Park Date: Mon Jul 1 12:27:06 2024 -0700 Docs/mm/damon/index: add links to admin-guide doc Readers of DAMON subsystem documents index would want to further learn how they can use DAMON from the user-space. Add the link to the admin guide. Link: https://lkml.kernel.org/r/20240701192706.51415-10-sj@kernel.org Signed-off-by: SeongJae Park Cc: Jonathan Corbet Signed-off-by: Andrew Morton Documentation/mm/damon/index.rst | 17 ++++++++++------- 1 file changed, 10 insertions(+), 7 deletions(-) commit 5fb9f0448fd9888e276fa5872fc37f27ae3f8acc Author: SeongJae Park Date: Mon Jul 1 12:27:05 2024 -0700 Docs/mm/damon/index: add links to design DAMON subsystem documents index page provides a short intro of DAMON core concepts. Add links to sections of the design document to let users easily browse to the details. Link: https://lkml.kernel.org/r/20240701192706.51415-9-sj@kernel.org Signed-off-by: SeongJae Park Cc: Jonathan Corbet Signed-off-by: Andrew Morton Documentation/mm/damon/design.rst | 1 + Documentation/mm/damon/index.rst | 11 ++++++----- 2 files changed, 7 insertions(+), 5 deletions(-) commit d31f5626a0e11eea6f12c72970d550d4837bbdfe Author: SeongJae Park Date: Mon Jul 1 12:27:04 2024 -0700 Docs/mm/damon/design: add links to sections of DAMON sysfs interface usage doc Readers of the design document would wonder how they can configure and use specific DAMON features. Add links to sections of DAMON sysfs interface usage document that provides the answers for easier browsing. Link: https://lkml.kernel.org/r/20240701192706.51415-8-sj@kernel.org Signed-off-by: SeongJae Park Cc: Jonathan Corbet Signed-off-by: Andrew Morton Documentation/mm/damon/design.rst | 48 +++++++++++++++++++++++++++++++++++++++ 1 file changed, 48 insertions(+) commit ce15e8fe054cc5977ccb192d508e50ca4583cd1b Author: SeongJae Park Date: Mon Jul 1 12:27:03 2024 -0700 Docs/mm/damon/design: remove 'Programmable Modules' section in favor of 'Modules' section 'Programmable Modules' section provides high level descriptions of the DAMON API-based kernel modules layer. But 'Modules' section, which is at the end of the document, provides every detail about the layer including that of 'Programmable Modules' section. Since the brief summary of the layers at the beginning of the document has a link to the 'Modules' section, browsing to the section is not that difficult. Remove 'Programmable Modules' section in favor of 'Modules' section and reducing duplicates. Link: https://lkml.kernel.org/r/20240701192706.51415-7-sj@kernel.org Signed-off-by: SeongJae Park Cc: Jonathan Corbet Signed-off-by: Andrew Morton Documentation/mm/damon/design.rst | 10 ---------- 1 file changed, 10 deletions(-) commit 92117a6e05f25cd87a01b20c841946d4b368e528 Author: SeongJae Park Date: Mon Jul 1 12:27:02 2024 -0700 Docs/mm/damon/design: move 'Configurable Operations Set' section into 'Operations Set Layer' section 'Configurable Operations Set' section is for providing a description of the pluggability of the operations set layer. Just after that, 'Operations Set Layer' section, which is dedicated for the entire things of the layer, follows. The layout is odd, and some descriptions are duplicated. Move 'Configurable Operations Set' section into 'Operations Set Layer' and re-write some of the detailed descriptions. Link: https://lkml.kernel.org/r/20240701192706.51415-6-sj@kernel.org Signed-off-by: SeongJae Park Cc: Jonathan Corbet Signed-off-by: Andrew Morton Documentation/mm/damon/design.rst | 47 ++++++++++++++++++--------------------- 1 file changed, 22 insertions(+), 25 deletions(-) commit 316df988caf8cbb18a96ad7a02c9e65815acb059 Author: SeongJae Park Date: Mon Jul 1 12:27:01 2024 -0700 Docs/mm/damon/design: add links from overall architecture to sections of details DAMON design document briefly explains the overall layers architecture first, and then provides detailed explanations of each layer with dedicated sections. Letting readers go directly to the detailed sections for specific layers could help easy browsing of the not-very-short document. Add links from the overall summary to the sections of details. Link: https://lkml.kernel.org/r/20240701192706.51415-5-sj@kernel.org Signed-off-by: SeongJae Park Cc: Jonathan Corbet Signed-off-by: Andrew Morton Documentation/mm/damon/design.rst | 20 +++++++++++++------- 1 file changed, 13 insertions(+), 7 deletions(-) commit 752f18b9d9c23791b0e9fc70054b972eb176796b Author: SeongJae Park Date: Mon Jul 1 12:27:00 2024 -0700 Docs/admin-guide/mm/damon/start: add access pattern snapshot example DAMON user-space tool (damo) provides access pattern snapshot feature, which is expected to be frequently used for real time access pattern analysis. The snapshot output is also showing what DAMON provides on its own, including the 'age' information. In contrast, the recorded access patterns, which is shown as an example usage on the quick start section, shows what users can make from what DAMON provided. It includes information that generated outside of DAMON and makes the 'age' concept bit unclear. Hence snapshot output is easier at understanding the raw realtime output of DAMON. Add the snapshot usage example on the quick start section. Link: https://lkml.kernel.org/r/20240701192706.51415-4-sj@kernel.org Signed-off-by: SeongJae Park Cc: Jonathan Corbet Signed-off-by: Andrew Morton Documentation/admin-guide/mm/damon/start.rst | 46 +++++++++++++++++++++++++--- 1 file changed, 42 insertions(+), 4 deletions(-) commit 2081610d98abefdfbbcfd710d65309bccd2e2dfe Author: SeongJae Park Date: Mon Jul 1 12:26:59 2024 -0700 Docs/mm/damon/design: clarify regions merging operation DAMON design document is not explaining how min_nr_regions limit is kept, and what happens if the number of regions exceeds max_nr_regions. Add more clarification for those. Link: https://lkml.kernel.org/r/20240701192706.51415-3-sj@kernel.org Signed-off-by: SeongJae Park Cc: Jonathan Corbet Signed-off-by: Andrew Morton Documentation/mm/damon/design.rst | 17 ++++++++++++----- 1 file changed, 12 insertions(+), 5 deletions(-) commit efeacc2cb6b7a0f44757d7d50069189d592c2d5c Author: SeongJae Park Date: Mon Jul 1 12:26:58 2024 -0700 Docs/mm/damon/design: fix two typos Patch series "Docs/damon: minor fixups and improvements". Fixup typos, clarify regions merging operation design with recent change, add access pattern snapshot example use case, and improve readability of the design document and subsystem documents index by reorganizing/wordsmithing and adding links to other sections and/or documents for easy browsing. This patch (of 9): Fix two typos. The first one is just a simple typo: s/accurach/accuracy/ The second one is made by the author being out of their mind. 'Region Based Sampling' section of the doc is mistakenly calling the access frequency counter of region as 'nr_regions'. Fix it with the correct name, 'nr_accesses'. Link: https://lkml.kernel.org/r/20240701192706.51415-1-sj@kernel.org Link: https://lkml.kernel.org/r/20240701192706.51415-2-sj@kernel.org Signed-off-by: SeongJae Park Cc: Jonathan Corbet Signed-off-by: Andrew Morton Documentation/mm/damon/design.rst | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) commit 843a2e24c24c5311831860c6b78ceacdd4627000 Author: Bang Li Date: Fri Jun 28 11:23:27 2024 +0800 mm/shmem: fix input and output inconsistencies Commit 19eaf44954df ("mm: thp: support allocation of anonymous multi-size THP") added mTHP support for anonymous shmem. We can configure different policies through the multi-size THP sysfs interface for anonymous shmem. But when we configure the "advise" policy of /sys/kernel/mm/transparent_hugepage/hugepages-xxxkB/shmem_enabled, we cannot write the "advise", but write the "madvise", which is unreasonable. We should keep the output and input values consistent, which is more convenient for users. Link: https://lkml.kernel.org/r/20240628032327.16987-1-libang.li@antgroup.com Fixes: 61a57f1b1da9 ("mm: shmem: add multi-size THP sysfs interface for anonymous shmem") Signed-off-by: Bang Li Reviewed-by: Baolin Wang Cc: Bang Li Cc: David Hildenbrand Cc: Hugh Dickins Cc: Ryan Roberts Signed-off-by: Andrew Morton mm/shmem.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit cc937dad85aea4ab9e4f9827d7ea55932c86906b Author: Edward Liaw Date: Tue Jun 25 22:34:45 2024 +0000 selftests: centralize -D_GNU_SOURCE= to CFLAGS in lib.mk Centralize the _GNU_SOURCE definition to CFLAGS in lib.mk. Remove redundant defines from Makefiles that import lib.mk. Convert any usage of "#define _GNU_SOURCE 1" to "#define _GNU_SOURCE". This uses the form "-D_GNU_SOURCE=", which is equivalent to "#define _GNU_SOURCE". Otherwise using "-D_GNU_SOURCE" is equivalent to "-D_GNU_SOURCE=1" and "#define _GNU_SOURCE 1", which is less commonly seen in source code and would require many changes in selftests to avoid redefinition warnings. Link: https://lkml.kernel.org/r/20240625223454.1586259-2-edliaw@google.com Signed-off-by: Edward Liaw Suggested-by: John Hubbard Acked-by: Shuah Khan Reviewed-by: Muhammad Usama Anjum Cc: Albert Ou Cc: André Almeida Cc: Darren Hart Cc: Dave Hansen Cc: Davidlohr Bueso Cc: David S. Miller Cc: Eric Dumazet Cc: Eric W. Biederman Cc: Fenghua Yu Cc: Ingo Molnar Cc: Jakub Kicinski Cc: Jarkko Sakkinen Cc: Jason Gunthorpe Cc: Kees Cook Cc: Kevin Tian Cc: Palmer Dabbelt Cc: Paolo Abeni Cc: Paolo Bonzini Cc: Paul Walmsley Cc: Peter Zijlstra Cc: Reinette Chatre Cc: Sean Christopherson Cc: Thomas Gleixner Signed-off-by: Andrew Morton tools/testing/selftests/exec/Makefile | 1 - tools/testing/selftests/futex/functional/Makefile | 2 +- tools/testing/selftests/intel_pstate/Makefile | 2 +- tools/testing/selftests/iommu/Makefile | 2 -- tools/testing/selftests/kvm/Makefile | 2 +- tools/testing/selftests/lib.mk | 3 +++ tools/testing/selftests/mm/thuge-gen.c | 2 +- tools/testing/selftests/net/Makefile | 2 +- tools/testing/selftests/net/tcp_ao/Makefile | 2 +- tools/testing/selftests/proc/Makefile | 1 - tools/testing/selftests/resctrl/Makefile | 2 +- tools/testing/selftests/ring-buffer/Makefile | 1 - tools/testing/selftests/riscv/mm/Makefile | 2 +- tools/testing/selftests/sgx/Makefile | 2 +- tools/testing/selftests/tmpfs/Makefile | 1 - 15 files changed, 12 insertions(+), 15 deletions(-) commit 95139d9408453df05dc4dfde37a0eb70afae0f81 Author: Barry Song Date: Sat Jun 22 19:12:31 2024 +1200 tools/mm: introduce a tool to assess swap entry allocation for thp_swapout Both Ryan and Chris have been utilizing the small test program to aid in debugging and identifying issues with swap entry allocation. While a real or intricate workload might be more suitable for assessing the correctness and effectiveness of the swap allocation policy, a small test program presents a simpler means of understanding the problem and initially verifying the improvements being made. Let's endeavor to integrate it into tools/mm. Although it presently only accommodates 64KB and 4KB, I'm optimistic that we can expand its capabilities to support multiple sizes and simulate more complex systems in the future as required. Basically, we have 1. Use MADV_PAGEPUT for rapid swap-out, putting the swap allocation code under high exercise in a short time. 2. Use MADV_DONTNEED to simulate the behavior of libc and Java heap in freeing memory, as well as for munmap, app exits, or OOM killer scenarios. This ensures new mTHP is always generated, released or swapped out, similar to the behavior on a PC or Android phone where many applications are frequently started and terminated. 3. Swap in with or without the "-a" option to observe how fragments due to swap-in and the incoming swap-in of large folios will impact swap-out fallback. Due to 2, we ensure a certain proportion of mTHP. Similarly, because of 3, we maintain a certain proportion of small folios, as we don't support large folios swap-in, meaning any swap-in will immediately result in small folios. Therefore, with both 2 and 3, we automatically achieve a system containing both mTHP and small folios. Additionally, 1 provides the ability to continuously swap them out. We can also use "-s" to add a dedicated small folios memory area. [akpm@linux-foundation.org: thp_swap_allocator_test.c needs mman.h, per Kairui Song] Link: https://lkml.kernel.org/r/20240622071231.576056-2-21cnbao@gmail.com Signed-off-by: Barry Song Acked-by: Chris Li Tested-by: Chris Li Reviewed-by: Ryan Roberts Tested-by: Ryan Roberts Cc: David Hildenbrand Cc: "Huang, Ying" Cc: Hugh Dickins Cc: Kairui Song Cc: Kalesh Singh Signed-off-by: Andrew Morton tools/mm/Makefile | 2 +- tools/mm/thp_swap_allocator_test.c | 234 +++++++++++++++++++++++++++++++++++++ 2 files changed, 235 insertions(+), 1 deletion(-) commit ec5b8c76ab1c6d163762d60cfbedcd27e7527144 Merge: eeb23b54e447 9004054b1629 Author: Martin KaFai Lau Date: Wed Jul 10 10:24:12 2024 -0700 Merge branch 'use network helpers, part 8' Geliang Tang says: ==================== v11: - new patches 2, 4, 6. - drop expect_errno from network_helper_opts as Eduard and Martin suggested. - drop sockmap_ktls patches from this set. v10: - a new patch 10 is added. - patches 1-6, 8-9 unchanged, only commit logs updated. - "err = -errno" is used in patches 7, 11, 12 to get the real error number before checking value of "err". v9: - new patches 5-7, new struct member expect_errno for network_helper_opts. - patches 1-4, 8-9 unchanged. - update patches 10-11 to make sure all tests pass. v8: - only patch 8 updated, to fix errors reported by CI. v7: - address Martin's comments in v6. (thanks) - use MAX(opts->backlog, 0) instead of opts->backlog. - use connect_to_fd_opts instead connect_to_fd. - more ASSERT_* to check errors. v6: - update patch 6 as Daniel suggested. (thanks) v5: - keep make_server and make_client as Eduard suggested. v4: - a new patch to use make_sockaddr in sockmap_ktls. - a new patch to close fd in error path in drop_on_reuseport. - drop make_server() in patch 7. - drop make_client() too in patch 9. v3: - a new patch to add backlog for network_helper_opts. - use start_server_str in sockmap_ktls now, not start_server. v2: - address Eduard's comments in v1. (thanks) - fix errors reported by CI. This patch set uses network helpers in sk_lookup, and drop the local helpers inetaddr_len() and make_socket(). ==================== Signed-off-by: Martin KaFai Lau commit 9004054b1629d481fedea2d92b880f79fc6fa81b Author: Geliang Tang Date: Tue Jul 9 17:16:22 2024 +0800 selftests/bpf: Use connect_fd_to_fd in sk_lookup This patch uses public helper connect_fd_to_fd() exported in network_helpers.h instead of using getsockname() + connect() in run_lookup_prog() in prog_tests/sk_lookup.c. This can simplify the code. Signed-off-by: Geliang Tang Link: https://lore.kernel.org/r/7077c277cde5a1864cdc244727162fb75c8bb9c5.1720515893.git.tanggeliang@kylinos.cn Signed-off-by: Martin KaFai Lau tools/testing/selftests/bpf/prog_tests/sk_lookup.c | 12 +++--------- 1 file changed, 3 insertions(+), 9 deletions(-) commit d9810c43f660fd502c5003244a5e9c181aa7df99 Author: Geliang Tang Date: Tue Jul 9 17:16:21 2024 +0800 selftests/bpf: Use start_server_addr in sk_lookup This patch uses public helper start_server_addr() in udp_recv_send() in prog_tests/sk_lookup.c to simplify the code. And use ASSERT_OK_FD() to check fd returned by start_server_addr(). Acked-by: Eduard Zingerman Signed-off-by: Geliang Tang Link: https://lore.kernel.org/r/f11cabfef4a2170ecb66a1e8e2e72116d8f621b3.1720515893.git.tanggeliang@kylinos.cn Signed-off-by: Martin KaFai Lau tools/testing/selftests/bpf/prog_tests/sk_lookup.c | 10 ++-------- 1 file changed, 2 insertions(+), 8 deletions(-) commit 14fc6fcd35e7dde6d1de062b6711476b3050b22e Author: Geliang Tang Date: Tue Jul 9 17:16:20 2024 +0800 selftests/bpf: Use start_server_str in sk_lookup This patch uses public helper start_server_str() to simplify make_server() in prog_tests/sk_lookup.c. Add a callback setsockopts() to do all sockopts, set it to post_socket_cb pointer of struct network_helper_opts. And add a new struct cb_opts to save the data needed to pass to the callback. Then pass this network_helper_opts to start_server_str(). Also use ASSERT_OK_FD() to check fd returned by start_server_str(). Acked-by: Eduard Zingerman Signed-off-by: Geliang Tang Link: https://lore.kernel.org/r/5981539f5591d2c4998c962ef2bf45f34c940548.1720515893.git.tanggeliang@kylinos.cn Signed-off-by: Martin KaFai Lau tools/testing/selftests/bpf/prog_tests/sk_lookup.c | 58 +++++++++++++--------- 1 file changed, 34 insertions(+), 24 deletions(-) commit adae187ebedcd95d02f045bc37dfecfd5b29434b Author: Geliang Tang Date: Tue Jul 9 17:16:19 2024 +0800 selftests/bpf: Close fd in error path in drop_on_reuseport In the error path when update_lookup_map() fails in drop_on_reuseport in prog_tests/sk_lookup.c, "server1", the fd of server 1, should be closed. This patch fixes this by using "goto close_srv1" lable instead of "detach" to close "server1" in this case. Fixes: 0ab5539f8584 ("selftests/bpf: Tests for BPF_SK_LOOKUP attach point") Acked-by: Eduard Zingerman Signed-off-by: Geliang Tang Link: https://lore.kernel.org/r/86aed33b4b0ea3f04497c757845cff7e8e621a2d.1720515893.git.tanggeliang@kylinos.cn Signed-off-by: Martin KaFai Lau tools/testing/selftests/bpf/prog_tests/sk_lookup.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 7046345d48adcc3f519e7b6192184f6049908bdb Author: Geliang Tang Date: Tue Jul 9 17:16:18 2024 +0800 selftests/bpf: Add ASSERT_OK_FD macro Add a new dedicated ASSERT macro ASSERT_OK_FD to test whether a socket FD is valid or not. It can be used to replace macros ASSERT_GT(fd, 0, ""), ASSERT_NEQ(fd, -1, "") or statements (fd < 0), (fd != -1). Suggested-by: Martin KaFai Lau Signed-off-by: Geliang Tang Link: https://lore.kernel.org/r/ded75be86ac630a3a5099739431854c1ec33f0ea.1720515893.git.tanggeliang@kylinos.cn Signed-off-by: Martin KaFai Lau tools/testing/selftests/bpf/test_progs.h | 9 +++++++++ 1 file changed, 9 insertions(+) commit a3016a27cea8e6d10b200b9e19c19961c402d106 Author: Geliang Tang Date: Tue Jul 9 17:16:17 2024 +0800 selftests/bpf: Add backlog for network_helper_opts Some callers expect __start_server() helper to pass their own "backlog" value to listen() instead of the default of 1. So this patch adds struct member "backlog" for network_helper_opts to allow callers to set "backlog" value via start_server_str() helper. listen(fd, 0 /* backlog */) can be used to enforce syncookie. Meaning backlog 0 is a legit value. Using 0 as a default and changing it to 1 here is fine. It makes the test program easier to write for the common case. Enforcing syncookie mode by using backlog 0 is a niche use case but it should at least have a way for the caller to do that. Thus, -ve backlog value is used here for the syncookie use case. Please see the comment in network_helpers.h for the details. Signed-off-by: Geliang Tang Link: https://lore.kernel.org/r/1660229659b66eaad07aa2126e9c9fe217eba0dd.1720515893.git.tanggeliang@kylinos.cn Signed-off-by: Martin KaFai Lau tools/testing/selftests/bpf/network_helpers.c | 2 +- tools/testing/selftests/bpf/network_helpers.h | 10 ++++++++++ 2 files changed, 11 insertions(+), 1 deletion(-) commit eeb23b54e447ea62b247d89681f0140abab00d7f Author: Alan Maguire Date: Wed Jul 10 16:00:51 2024 +0100 selftests/bpf: fix compilation failure when CONFIG_NF_FLOW_TABLE=m In many cases, kernel netfilter functionality is built as modules. If CONFIG_NF_FLOW_TABLE=m in particular, progs/xdp_flowtable.c (and hence selftests) will fail to compile, so add a ___local version of "struct flow_ports". Fixes: c77e572d3a8c ("selftests/bpf: Add selftest for bpf_xdp_flow_lookup kfunc") Signed-off-by: Alan Maguire Link: https://lore.kernel.org/r/20240710150051.192598-1-alan.maguire@oracle.com Signed-off-by: Alexei Starovoitov tools/testing/selftests/bpf/progs/xdp_flowtable.c | 10 +++++++--- 1 file changed, 7 insertions(+), 3 deletions(-) commit 0e2a9a03106cd5fa0dbc9047675e7645c55e2669 Author: Sibi Sankar Date: Wed Jun 12 18:10:53 2024 +0530 mailbox: Add support for QTI CPUCP mailbox controller Add support for CPUSS Control Processor (CPUCP) mailbox controller, this driver enables communication between AP and CPUCP by acting as a doorbell between them. Reviewed-by: Dmitry Baryshkov Signed-off-by: Sibi Sankar Reviewed-by: Bjorn Andersson Reviewed-by: Konrad Dybcio Signed-off-by: Jassi Brar MAINTAINERS | 7 ++ drivers/mailbox/Kconfig | 8 ++ drivers/mailbox/Makefile | 2 + drivers/mailbox/qcom-cpucp-mbox.c | 187 ++++++++++++++++++++++++++++++++++++++ 4 files changed, 204 insertions(+) commit 6e7c4cc55dbc461c08e00f0ef16867fe6bf014aa Author: Sibi Sankar Date: Wed Jun 12 18:10:52 2024 +0530 dt-bindings: mailbox: qcom: Add CPUCP mailbox controller bindings Add devicetree binding for CPUSS Control Processor (CPUCP) mailbox controller. Reviewed-by: Rob Herring Signed-off-by: Sibi Sankar Signed-off-by: Jassi Brar .../bindings/mailbox/qcom,cpucp-mbox.yaml | 49 ++++++++++++++++++++++ 1 file changed, 49 insertions(+) commit af5da7b0944c3616fa6add186043637092d94200 Author: Bartosz Golaszewski Date: Wed Jun 5 18:56:51 2024 +0200 dt-bindings: remoteproc: qcom,sa8775p-pas: Document the SA8775p ADSP, CDSP and GPDSP Document the components used to boot the ADSP, CDSP0, CDSP1, GPDSP0 and GPDSP1 on the SA8775p SoC. Signed-off-by: Bartosz Golaszewski Reviewed-by: Krzysztof Kozlowski Signed-off-by: Jassi Brar .../bindings/remoteproc/qcom,sa8775p-pas.yaml | 160 +++++++++++++++++++++ 1 file changed, 160 insertions(+) commit 203e038d23c43e37f43e675e6cc7ac0e38ef939d Author: Jeff Johnson Date: Mon Jun 24 09:09:48 2024 -0700 mailbox: mtk-cmdq: add missing MODULE_DESCRIPTION() macro make allmodconfig && make W=1 C=1 reports: WARNING: modpost: missing MODULE_DESCRIPTION() in drivers/mailbox/mtk-cmdq-mailbox.o Add the missing invocation of the MODULE_DESCRIPTION() macro. Reviewed-by: AngeloGioacchino Del Regno Signed-off-by: Jeff Johnson Signed-off-by: Jassi Brar drivers/mailbox/mtk-cmdq-mailbox.c | 1 + 1 file changed, 1 insertion(+) commit 63c31d4a9169fd4eebf08c259ba8688d15668ae5 Author: Dr. David Alan Gilbert Date: Thu May 23 21:37:41 2024 +0100 mailbox: bcm-pdc: remove unused struct 'pdc_dma_map' 'pdf_dma_map' has been unused since the original commit a24532f8d17b ("mailbox: Add Broadcom PDC mailbox driver"). Remove it. Signed-off-by: Dr. David Alan Gilbert Signed-off-by: Jassi Brar drivers/mailbox/bcm-pdc-mailbox.c | 4 ---- 1 file changed, 4 deletions(-) commit b5ef17917f3a797a7b12d1edd51f676554e44a07 Author: Peng Fan Date: Fri May 24 15:56:32 2024 +0800 mailbox: imx: fix TXDB_V2 channel race condition Two TXDB_V2 channels are used between Linux and System Manager(SM). Channel0 for normal TX, Channel 1 for notification completion. The TXDB_V2 trigger logic is using imx_mu_xcr_rmw which uses read/modify/update logic. Note: clear MUB GSR BITs, the MUA side GCR BITs will also got cleared per hardware design. Channel0 Linux read GCR->modify GCR->write GCR->M33 SM->read GSR----->clear GSR |-(1)-| Channel1 Linux start in time slot(1) read GCR->modify GCR->write GCR->M33 SM->read GSR->clear GSR So Channel1 read GCR will read back the GCR that Channel0 wrote, because M33 has not finish clear GSR, this means Channel1 GCR writing will trigger Channel1 and Channel0 interrupt both which is wrong. Channel0 will be freed(SCMI channel status set to FREE) in M33 SM when processing the 1st Channel0 interrupt. So when 2nd interrupt trigger (channel 0/1 trigger together), SM will see a freed Channel0, and report protocol error. To address the issue, not using read/modify/update logic, just use write, because write 0 to GCR will be ignored. And after write MUA GCR, wait the SM to clear MUB GSR by looping MUA GCR value. Fixes: 5bfe4067d350 ("mailbox: imx: support channel type tx doorbell v2") Reviewed-by: Ranjani Vaidyanathan Signed-off-by: Peng Fan Signed-off-by: Jassi Brar drivers/mailbox/imx-mailbox.c | 10 +++++++++- 1 file changed, 9 insertions(+), 1 deletion(-) commit 0a02bc0a34cd53c7fe5bf4bae6efb56ad47677fa Author: Andrew Davis Date: Tue Jun 11 12:04:56 2024 -0500 mailbox: omap: Fix mailbox interrupt sharing Multiple mailbox users can share one interrupt line. This flag was mistakenly dropped as part of the FIFO removal. Mark the IRQ as shared. Reported-by: Beleswar Padhi Fixes: 3f58c1f4206f ("mailbox: omap: Remove kernel FIFO message queuing") Signed-off-by: Andrew Davis Tested-by: Beleswar Padhi Signed-off-by: Jassi Brar drivers/mailbox/omap-mailbox.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) commit aa1609f571caba0db102c611829d48adf226bb70 Author: AngeloGioacchino Del Regno Date: Thu Jun 20 12:07:49 2024 +0200 mailbox: mtk-cmdq: Dynamically allocate clk_bulk_data structure Now that the clock probing code uses devm_kasprintf(), there is no more restriction on the number of GCEs: dynamically allocate the clk_bulk_data clocks array to improve flexibility and also to get a slight memory saving on platforms featuring only one CMDQ mailbox (and consequently only one Global Command Engine). Signed-off-by: AngeloGioacchino Del Regno Signed-off-by: Jassi Brar drivers/mailbox/mtk-cmdq-mailbox.c | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) commit 0af932c5fc44d2709c9f87a15bcd6cd376901e23 Author: AngeloGioacchino Del Regno Date: Thu Jun 20 12:07:48 2024 +0200 mailbox: mtk-cmdq: Move and partially refactor clocks probe Move the clocks probe to a new cmdq_get_clocks() function; while at it, partially refactor the code: Drop the clk_names[] array and assign clock names to the array of clk_bulk_data with devm_kasprintf() instead, slightly reduce the indentation for the multi-gce clock probe path and add a comment describing the reason why we get clocks of other GCE instance instead of just the clock from the one that it is getting probed. Signed-off-by: AngeloGioacchino Del Regno Signed-off-by: Jassi Brar drivers/mailbox/mtk-cmdq-mailbox.c | 79 ++++++++++++++++++++++++-------------- 1 file changed, 51 insertions(+), 28 deletions(-) commit db9344804cfa7ceca17aab71a3130736a7a2ac9d Author: AngeloGioacchino Del Regno Date: Thu Jun 20 12:07:47 2024 +0200 mailbox: mtk-cmdq: Stop requiring name for GCE clock The Global Command Engine mailbox has only one clock hence requiring clock-names is useless. Get the first (and only) clock instead, without name checks. Signed-off-by: AngeloGioacchino Del Regno Signed-off-by: Jassi Brar drivers/mailbox/mtk-cmdq-mailbox.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit d1368f62a8dca89ce55ca1a7568ca273f50d60e4 Author: Jason-JH.Lin Date: Wed Jan 24 09:14:57 2024 +0800 dt-bindings: mailbox: Add mediatek,gce-props.yaml Add mediatek,gce-props.yaml for common GCE properties that is used for both mailbox providers and consumers. We place the common property "mediatek,gce-events" in this binding currently. The property "mediatek,gce-events" is used for GCE event ID corresponding to a hardware event signal sent by the hardware or a software driver. If the mailbox providers or consumers want to manipulate the value of the event ID, they need to know the specific event ID. Signed-off-by: Jason-JH.Lin Reviewed-by: Conor Dooley Reviewed-by: AngeloGioacchino Del Regno Signed-off-by: Jassi Brar .../bindings/mailbox/mediatek,gce-props.yaml | 52 ++++++++++++++++++++++ 1 file changed, 52 insertions(+) commit e4b5a39c2fca597f10f1aa4c12f8f90dcd9431bd Author: Javier Carrasco Date: Fri Jul 5 08:05:18 2024 +0200 bus: sunxi-rsb: Constify struct regmap_bus `regmap_sunxi_rsb` is not modified and can be declared as const to move its data to a read-only section. Signed-off-by: Javier Carrasco Link: https://lore.kernel.org/r/20240705-sunxi-rsb-bus-const-regmap_bus-v1-1-129094960ce9@gmail.com Signed-off-by: Chen-Yu Tsai drivers/bus/sunxi-rsb.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 022ec3b59c01a2bb6949fe61a5ef340c88b905bf Author: Claudiu Beznea Date: Fri May 31 09:57:23 2024 +0300 dt-bindings: watchdog: renesas,wdt: Document RZ/G3S support Document the support for the watchdog IP available on RZ/G3S SoC. The watchdog IP available on RZ/G3S SoC is identical to the one found on RZ/G2L SoC. Signed-off-by: Claudiu Beznea Acked-by: Conor Dooley Reviewed-by: Geert Uytterhoeven Reviewed-by: Guenter Roeck Link: https://lore.kernel.org/r/20240531065723.1085423-10-claudiu.beznea.uj@bp.renesas.com Signed-off-by: Guenter Roeck Signed-off-by: Wim Van Sebroeck Documentation/devicetree/bindings/watchdog/renesas,wdt.yaml | 1 + 1 file changed, 1 insertion(+) commit 0aad7c4438b2e87359cd7b42c3e11b17f477ab8f Author: Claudiu Beznea Date: Fri May 31 09:57:22 2024 +0300 watchdog: rzg2l_wdt: Add suspend/resume support The RZ/G3S supports deep sleep states where power to most of the IP blocks is cut off. To ensure proper working of the watchdog when resuming from such states, the suspend function is stopping the watchdog and the resume function is starting it. There is no need to configure the watchdog in case the watchdog was stopped prior to starting suspend. Signed-off-by: Claudiu Beznea Reviewed-by: Guenter Roeck Link: https://lore.kernel.org/r/20240531065723.1085423-9-claudiu.beznea.uj@bp.renesas.com Signed-off-by: Guenter Roeck Signed-off-by: Wim Van Sebroeck drivers/watchdog/rzg2l_wdt.c | 26 ++++++++++++++++++++++++++ 1 file changed, 26 insertions(+) commit d8997ed79ed7c7c32b2ae571e0d99a58bbfd01fe Author: Claudiu Beznea Date: Fri May 31 09:57:21 2024 +0300 watchdog: rzg2l_wdt: Rely on the reset driver for doing proper reset The reset driver has been adapted in commit da235d2fac21 ("clk: renesas: rzg2l: Check reset monitor registers") to check the reset monitor bits before declaring reset asserts/de-asserts as successful/failure operations. With that, there is no need to keep the reset workaround for RZ/V2M in place in the watchdog driver. Signed-off-by: Claudiu Beznea Reviewed-by: Philipp Zabel Reviewed-by: Guenter Roeck Link: https://lore.kernel.org/r/20240531065723.1085423-8-claudiu.beznea.uj@bp.renesas.com Signed-off-by: Guenter Roeck Signed-off-by: Wim Van Sebroeck drivers/watchdog/rzg2l_wdt.c | 39 ++++----------------------------------- 1 file changed, 4 insertions(+), 35 deletions(-) commit 900b938335f7fbd401dcba14c8069dbf38ed1f28 Author: Claudiu Beznea Date: Fri May 31 09:57:20 2024 +0300 watchdog: rzg2l_wdt: Remove comparison with zero devm_add_action_or_reset() could return -ENOMEM or zero. Thus, remove comparison with zero of the returning value to make code simpler. Signed-off-by: Claudiu Beznea Reviewed-by: Guenter Roeck Link: https://lore.kernel.org/r/20240531065723.1085423-7-claudiu.beznea.uj@bp.renesas.com Signed-off-by: Guenter Roeck Signed-off-by: Wim Van Sebroeck drivers/watchdog/rzg2l_wdt.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 064319c3fac88e04f53f3460cd24ae90de2d9fb6 Author: Claudiu Beznea Date: Fri May 31 09:57:19 2024 +0300 watchdog: rzg2l_wdt: Remove reset de-assert from probe There is no need to de-assert the reset signal on probe as the watchdog is not used prior executing start. Also, the clocks are not enabled in probe (pm_runtime_enable() doesn't do that), thus this is another indicator that the watchdog wasn't used previously like this. Instead, keep the watchdog hardware in its previous state at probe (by default it is in reset state), enable it when it is started and move it to reset state when it is stopped. This saves some extra power when the watchdog is unused. Signed-off-by: Claudiu Beznea Reviewed-by: Guenter Roeck Link: https://lore.kernel.org/r/20240531065723.1085423-6-claudiu.beznea.uj@bp.renesas.com Signed-off-by: Guenter Roeck Signed-off-by: Wim Van Sebroeck drivers/watchdog/rzg2l_wdt.c | 28 +++++++++++++++++----------- 1 file changed, 17 insertions(+), 11 deletions(-) commit 471e45a33302852bf79bc140fe418782f50734f6 Author: Claudiu Beznea Date: Fri May 31 09:57:18 2024 +0300 watchdog: rzg2l_wdt: Check return status of pm_runtime_put() pm_runtime_put() may return an error code. Check its return status. Along with it the rzg2l_wdt_set_timeout() function was updated to propagate the result of rzg2l_wdt_stop() to its caller. Fixes: 2cbc5cd0b55f ("watchdog: Add Watchdog Timer driver for RZ/G2L") Signed-off-by: Claudiu Beznea Reviewed-by: Guenter Roeck Link: https://lore.kernel.org/r/20240531065723.1085423-5-claudiu.beznea.uj@bp.renesas.com Signed-off-by: Guenter Roeck Signed-off-by: Wim Van Sebroeck drivers/watchdog/rzg2l_wdt.c | 11 +++++++++-- 1 file changed, 9 insertions(+), 2 deletions(-) commit f0ba0fcdd19943809b1a7f760f77f6673c6aa7f7 Author: Claudiu Beznea Date: Fri May 31 09:57:17 2024 +0300 watchdog: rzg2l_wdt: Use pm_runtime_resume_and_get() pm_runtime_get_sync() may return with error. In case it returns with error dev->power.usage_count needs to be decremented. pm_runtime_resume_and_get() takes care of this. Thus use it. Along with it the rzg2l_wdt_set_timeout() function was updated to propagate the result of rzg2l_wdt_start() to its caller. Fixes: 2cbc5cd0b55f ("watchdog: Add Watchdog Timer driver for RZ/G2L") Signed-off-by: Claudiu Beznea Reviewed-by: Guenter Roeck Link: https://lore.kernel.org/r/20240531065723.1085423-4-claudiu.beznea.uj@bp.renesas.com Signed-off-by: Guenter Roeck Signed-off-by: Wim Van Sebroeck drivers/watchdog/rzg2l_wdt.c | 11 ++++++++--- 1 file changed, 8 insertions(+), 3 deletions(-) commit 9e69846c68f5489e9a3d7375215beb1842ef89e1 Author: Claudiu Beznea Date: Fri May 31 09:57:16 2024 +0300 watchdog: rzg2l_wdt: Make the driver depend on PM The rzg2l_wdt watchdog driver cannot work w/o CONFIG_PM=y (e.g. the clocks are enabled though pm_runtime_* specific APIs). To avoid building a driver that doesn't work make explicit the dependency on CONFIG_PM. Suggested-by: Guenter Roeck Signed-off-by: Claudiu Beznea Reviewed-by: Geert Uytterhoeven Reviewed-by: Guenter Roeck Link: https://lore.kernel.org/r/20240531065723.1085423-3-claudiu.beznea.uj@bp.renesas.com Signed-off-by: Guenter Roeck Signed-off-by: Wim Van Sebroeck drivers/watchdog/Kconfig | 1 + 1 file changed, 1 insertion(+) commit 5e7069f296fb681111388bc69b9950afb552e722 Author: Claudiu Beznea Date: Fri May 31 09:57:15 2024 +0300 watchdog: rzg2l_wdt: Restrict the driver to ARCH_RZG2L and ARCH_R9A09G011 The rzg2l_wdt driver is used only by ARCH_RZG2L and ARCH_R9A09G011 micro-architectures of Renesas. Thus, limit it's usage only to these. Suggested-by: Biju Das Signed-off-by: Claudiu Beznea Reviewed-by: Guenter Roeck Link: https://lore.kernel.org/r/20240531065723.1085423-2-claudiu.beznea.uj@bp.renesas.com Signed-off-by: Guenter Roeck Signed-off-by: Wim Van Sebroeck drivers/watchdog/Kconfig | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit b771d14f417e9d8030ab000b3341cf71266be90e Author: Sascha Hauer Date: Wed Jul 3 13:16:03 2024 +0200 watchdog: imx7ulp_wdt: keep already running watchdog enabled When the bootloader enabled the watchdog before Kernel started then keep it enabled during initialization. Otherwise the time between the watchdog probing and the userspace taking over the watchdog won't be covered by the watchdog. When keeping the watchdog enabled inform the Kernel about this by setting the WDOG_HW_RUNNING so that the periodic watchdog feeder is started when desired. Signed-off-by: Sascha Hauer Reviewed-by: Guenter Roeck Link: https://lore.kernel.org/r/20240703111603.1096424-1-s.hauer@pengutronix.de Signed-off-by: Guenter Roeck Signed-off-by: Wim Van Sebroeck drivers/watchdog/imx7ulp_wdt.c | 5 +++++ 1 file changed, 5 insertions(+) commit 9dca7a0ae50c9cff5c510aeb6587f92e530fd1fe Author: Chen Ni Date: Fri Jun 28 11:35:08 2024 +0800 watchdog: starfive: Add missing clk_disable_unprepare() Add the missing clk_disable_unprepare() before return in starfive_wdt_enable_clock(). Signed-off-by: Chen Ni Reviewed-by: Xingyu Wu Reviewed-by: Guenter Roeck Link: https://lore.kernel.org/r/20240628033508.281058-1-nichen@iscas.ac.cn Signed-off-by: Guenter Roeck Signed-off-by: Wim Van Sebroeck drivers/watchdog/starfive-wdt.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) commit d794a7410177f05b05232fc8cac46db196eafb00 Author: Thomas Weißschuh Date: Fri Jun 14 00:57:22 2024 +0200 watchdog: Make watchdog_class const Now that the driver core allows for struct class to be in read-only memory, mark watchdog_class as const. Signed-off-by: Thomas Weißschuh Reviewed-by: Guenter Roeck Link: https://lore.kernel.org/r/20240614-class-const-wdt-v1-1-f9a4e2b1ba76@weissschuh.net Signed-off-by: Guenter Roeck Signed-off-by: Wim Van Sebroeck drivers/watchdog/watchdog_dev.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 275d05ce0680949085622bf38a365efcdd34fe11 Author: Claudio Imbrenda Date: Wed Jul 3 17:59:00 2024 +0200 s390/kvm: Move bitfields for dat tables Move and improve the struct definitions for DAT tables from gaccess.c to a new header. Once in a separate header, the structs become available everywhere. One possible usecase is to merge them in the s390 pte_t and p?d_t definitions, which is left as an exercise for the reader. Signed-off-by: Claudio Imbrenda Reviewed-by: Nico Boehr Link: https://lore.kernel.org/r/20240703155900.103783-3-imbrenda@linux.ibm.com Signed-off-by: Heiko Carstens Signed-off-by: Vasily Gorbik arch/s390/include/asm/dat-bits.h | 170 +++++++++++++++++++++++++++++++++++++++ arch/s390/kvm/gaccess.c | 163 +------------------------------------ 2 files changed, 173 insertions(+), 160 deletions(-) commit 723ac2d6ba77be712b165b710c60adda6e657c9e Author: Claudio Imbrenda Date: Wed Jul 3 17:58:59 2024 +0200 s390/entry: Pass the asce as parameter to sie64a() Pass the guest ASCE explicitly as parameter, instead of having sie64a() take it from lowcore. This removes hidden state from lowcore, and makes things look cleaner. Signed-off-by: Claudio Imbrenda Reviewed-by: Nico Boehr Link: https://lore.kernel.org/r/20240703155900.103783-2-imbrenda@linux.ibm.com Signed-off-by: Heiko Carstens Signed-off-by: Vasily Gorbik arch/s390/include/asm/kvm_host.h | 7 ++++--- arch/s390/include/asm/stacktrace.h | 1 + arch/s390/kernel/asm-offsets.c | 1 + arch/s390/kernel/entry.S | 8 +++----- arch/s390/kvm/kvm-s390.c | 3 ++- arch/s390/kvm/vsie.c | 2 +- 6 files changed, 12 insertions(+), 10 deletions(-) commit b7a5e5dfbd68050e8582e901f397dc75451bb877 Author: Mete Durlu Date: Thu Jul 4 14:10:10 2024 +0200 s390/sthyi: Use cached data when diag is busy When sthyi is being emulated, data from diag204 is used. If diag204 returns busy, previously cached sthyi info block is returned to the caller and cache expiry is set to expired. Acked-by: Heiko Carstens Reviewed-by: Tobias Huschle Signed-off-by: Tobias Huschle Signed-off-by: Mete Durlu Signed-off-by: Vasily Gorbik arch/s390/kernel/sthyi.c | 55 +++++++++++++++++++++++++++++++++--------------- 1 file changed, 38 insertions(+), 17 deletions(-) commit 6fdf72c9a9f614115ac7f2889c1018bbff1af9b3 Author: Mete Durlu Date: Thu Jul 4 14:10:09 2024 +0200 s390/sthyi: Move diag operations Move diag204 related operations to their own functions for better error handling and better readability. Acked-by: Heiko Carstens Reviewed-by: Tobias Huschle Signed-off-by: Mete Durlu Signed-off-by: Vasily Gorbik arch/s390/kernel/sthyi.c | 46 +++++++++++++++++++++++++++++++--------------- 1 file changed, 31 insertions(+), 15 deletions(-) commit f4493954215ceb8b22aca3ee6b10c6172f20a9fc Author: Mete Durlu Date: Thu Jul 4 14:10:08 2024 +0200 s390/hypfs_diag: Diag204 busy loop When diag204 busy-indiciation facility is installed and diag204 is returning busy, hypfs diag204 handler now does an interruptable busy wait until diag204 is no longer busy. If there is a signal pending, call would be restarted with -ERESTARTSYSCALL, except for fatal signals. Acked-by: Heiko Carstens Reviewed-by: Tobias Huschle Signed-off-by: Mete Durlu Signed-off-by: Vasily Gorbik arch/s390/hypfs/hypfs_dbfs.c | 4 +++- arch/s390/hypfs/hypfs_diag.c | 17 ++++++++++++++--- arch/s390/include/asm/diag.h | 1 + 3 files changed, 18 insertions(+), 4 deletions(-) commit 97999f8c62a43cf2af5d725b045b82f9b47d83ea Author: Mete Durlu Date: Thu Jul 4 14:10:07 2024 +0200 s390/diag: Add busy-indication-facility requirements To verify if busy indication facility is installed or not sclp bits has to be checked. Add a function that checks sclp to improve readability. Add busy-indication-request bit mask for diag204 subcodes. Acked-by: Heiko Carstens Reviewed-by: Tobias Huschle Signed-off-by: Mete Durlu Signed-off-by: Vasily Gorbik arch/s390/include/asm/diag.h | 7 +++++++ 1 file changed, 7 insertions(+) commit df7e714d6d6ca7921be2e5c7d599d9b4aa96d682 Author: Mete Durlu Date: Thu Jul 4 14:10:06 2024 +0200 s390/diag: Diag204 add busy return errno When diag204-busy-indication facility is installed, diag204 can return '8' which means device is busy and no operation is done. Add check for return codes of diag204 call. Return error codes according to diag204 return codes. Acked-by: Heiko Carstens Reviewed-by: Tobias Huschle Signed-off-by: Mete Durlu Signed-off-by: Vasily Gorbik arch/s390/kernel/diag.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) commit bb9be93acb7e6a0fa78919d30e68410c401fe690 Author: Mete Durlu Date: Thu Jul 4 14:10:05 2024 +0200 s390/diag: Return errno's from diag204 Return different errno's from diag204 to allow users to handle them accordingly. Instead of returning -1 regardless of the failing condition, return -EINVAL on invalid memory address and -EOPNOTSUPP when diag instruction fails. Acked-by: Heiko Carstens Reviewed-by: Tobias Huschle Signed-off-by: Mete Durlu Signed-off-by: Vasily Gorbik arch/s390/kernel/diag.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) commit 7455a33179e65267cd7c8910050b6f0be3ff6b83 Author: Mete Durlu Date: Thu Jul 4 14:10:04 2024 +0200 s390/sclp: Diag204 busy indication facility detection Detect diag204 busy indication facility. Acked-by: Heiko Carstens Reviewed-by: Tobias Huschle Signed-off-by: Mete Durlu Signed-off-by: Vasily Gorbik arch/s390/include/asm/sclp.h | 1 + drivers/s390/char/sclp_early.c | 1 + 2 files changed, 2 insertions(+) commit 279a0164e001a87aa7b9852969ed333c3c69b3aa Author: Heiko Carstens Date: Mon Jul 1 17:04:58 2024 +0200 s390/atomic_ops: Make use of flag output constraint With gcc 14.1.0 support for flag output constraint was added for s390. Use this for __atomic_cmpxchg_bool(). This allows for slightly better code, since the compiler can generate code depending on the condition code which is the result of an inline assembly. The size of the kernel image is reduced by ~12kb. Reviewed-by: Juergen Christ Signed-off-by: Heiko Carstens Signed-off-by: Vasily Gorbik arch/s390/include/asm/atomic_ops.h | 44 ++++++++++++++++++++++++++++++++------ 1 file changed, 37 insertions(+), 7 deletions(-) commit ee19370c92f6db4e92e060b5e0c2aa99e4f85408 Author: Heiko Carstens Date: Mon Jul 1 17:04:57 2024 +0200 s390/atomic_ops: Improve __atomic_set() for small values Use mvhi/mvghi for small constant values within the __atomic_set() inline assemblies. This avoids loading the specified value into a register. The size of the kernel image is reduced by ~1.2kb. Reviewed-by: Juergen Christ Signed-off-by: Heiko Carstens Signed-off-by: Vasily Gorbik arch/s390/include/asm/atomic_ops.h | 26 ++++++++++++++++++++------ 1 file changed, 20 insertions(+), 6 deletions(-) commit f2ed8367bfa55a2ad3adfe7a59b79b82905df740 Author: Heiko Carstens Date: Mon Jul 1 17:04:56 2024 +0200 s390/atomic_ops: Use symbolic names Consistently use symbolic names in all atomic ops inline assemblies. Reviewed-by: Juergen Christ Signed-off-by: Heiko Carstens Signed-off-by: Vasily Gorbik arch/s390/include/asm/atomic_ops.h | 16 ++++++++-------- 1 file changed, 8 insertions(+), 8 deletions(-) commit 4a39f12e753d35682a473b2edb4581b65b958d92 Author: Sven Schnelle Date: Wed Jul 3 10:11:59 2024 +0200 s390/smp: Switch to GENERIC_CPU_DEVICES Instead of setting up non-boot CPUs early in architecture code, only setup the cpu present mask and let the generic code handle cpu bringup. Signed-off-by: Sven Schnelle Signed-off-by: Vasily Gorbik arch/s390/Kconfig | 1 + arch/s390/include/asm/smp.h | 2 +- arch/s390/kernel/smp.c | 55 +++++++++++++++-------------------------- drivers/s390/char/sclp_config.c | 2 +- 4 files changed, 23 insertions(+), 37 deletions(-) commit 74d1412ac8f3719bc8dd08b5775276dd1cbc3997 Author: Alexander Lobakin Date: Thu Jun 20 15:53:47 2024 +0200 idpf: use libeth Rx buffer management for payload buffer idpf uses Page Pool for data buffers with hardcoded buffer lengths of 4k for "classic" buffers and 2k for "short" ones. This is not flexible and does not ensure optimal memory usage. Why would you need 4k buffers when the MTU is 1500? Use libeth for the data buffers and don't hardcode any buffer sizes. Let them be calculated from the MTU for "classics" and then divide the truesize by 2 for "short" ones. The memory usage is now greatly reduced and 2 buffer queues starts make sense: on frames <= 1024, you'll recycle (and resync) a page only after 4 HW writes rather than two. Signed-off-by: Alexander Lobakin Signed-off-by: Tony Nguyen drivers/net/ethernet/intel/idpf/Kconfig | 1 - drivers/net/ethernet/intel/idpf/idpf.h | 2 - .../net/ethernet/intel/idpf/idpf_singleq_txrx.c | 27 +-- drivers/net/ethernet/intel/idpf/idpf_txrx.c | 242 ++++++++------------- drivers/net/ethernet/intel/idpf/idpf_txrx.h | 86 ++------ drivers/net/ethernet/intel/idpf/idpf_virtchnl.c | 8 +- 6 files changed, 120 insertions(+), 246 deletions(-) commit 90912f9f4f2d159e93cf9a4c732506342489a1d5 Author: Alexander Lobakin Date: Thu Jun 20 15:53:46 2024 +0200 idpf: convert header split mode to libeth + napi_build_skb() Currently, idpf uses the following model for the header buffers: * buffers are allocated via dma_alloc_coherent(); * when receiving, napi_alloc_skb() is called and then the header is copied to the newly allocated linear part. This is far from optimal as DMA coherent zone is slow on many systems and memcpy() neutralizes the idea and benefits of the header split. Not speaking of that XDP can't be run on DMA coherent buffers, but at the same time the idea of allocating an skb to run XDP program is ill. Instead, use libeth to create page_pools for the header buffers, allocate them dynamically and then build an skb via napi_build_skb() around them with no memory copy. With one exception... When you enable header split, you expect you'll always have a separate header buffer, so that you could reserve headroom and tailroom only there and then use full buffers for the data. For example, this is how TCP zerocopy works -- you have to have the payload aligned to PAGE_SIZE. The current hardware running idpf does *not* guarantee that you'll always have headers placed separately. For example, on my setup, even ICMP packets are written as one piece to the data buffers. You can't build a valid skb around a data buffer in this case. To not complicate things and not lose TCP zerocopy etc., when such thing happens, use the empty header buffer and pull either full frame (if it's short) or the Ethernet header there and build an skb around it. GRO layer will pull more from the data buffer later. This W/A will hopefully be removed one day. Signed-off-by: Alexander Lobakin Signed-off-by: Tony Nguyen .../net/ethernet/intel/idpf/idpf_singleq_txrx.c | 1 + drivers/net/ethernet/intel/idpf/idpf_txrx.c | 253 ++++++++++++++------- drivers/net/ethernet/intel/idpf/idpf_txrx.h | 52 +++-- drivers/net/ethernet/intel/idpf/idpf_virtchnl.c | 14 +- 4 files changed, 204 insertions(+), 116 deletions(-) commit 5aaac1aece4e4db9d620791a33f7a4173c660e65 Author: Alexander Lobakin Date: Thu Jun 20 15:53:45 2024 +0200 libeth: support different types of buffers for Rx Unlike previous generations, idpf requires more buffer types for optimal performance. This includes: header buffers, short buffers, and no-overhead buffers (w/o headroom and tailroom, for TCP zerocopy when the header split is enabled). Introduce libeth Rx buffer type and calculate page_pool params accordingly. All the HW-related details like buffer alignment are still accounted. For the header buffers, pick 256 bytes as in most places in the kernel (have you ever seen frames with bigger headers?). Reviewed-by: Przemek Kitszel Signed-off-by: Alexander Lobakin Signed-off-by: Tony Nguyen drivers/net/ethernet/intel/libeth/rx.c | 132 ++++++++++++++++++++++++++++++--- include/net/libeth/rx.h | 19 +++++ 2 files changed, 140 insertions(+), 11 deletions(-) commit 8030f6533ef0a40a81ab6113aa6a0ab6a8e981c4 Author: Alex Deucher Date: Mon Apr 29 18:11:11 2024 -0400 drm/amdgpu: remove exp hw support check for gfx12 Enable it by default. Reviewed-by: Hawking Zhang Signed-off-by: Alex Deucher drivers/gpu/drm/amd/amdgpu/amdgpu_discovery.c | 2 -- 1 file changed, 2 deletions(-) commit 3c1ff93b4deea502cd8b0869839557cab2a28b71 Author: Guenter Roeck Date: Tue Jul 9 18:56:20 2024 -0700 regmap: Implement regmap_multi_reg_read() regmap_multi_reg_read() is similar to regmap_bilk_read() but reads from an array of non-sequential registers. Signed-off-by: Guenter Roeck Link: https://lore.kernel.org/r/20240710015622.1960522-2-linux@roeck-us.net Signed-off-by: Mark Brown drivers/base/regmap/regmap.c | 103 ++++++++++++++++++++++++++++--------------- include/linux/regmap.h | 2 + 2 files changed, 70 insertions(+), 35 deletions(-) commit 0d1ebba74fad7b6b3eb0e2bc08d649d20c7aa7c9 Author: Paul Handrigan Date: Wed Jul 10 11:04:16 2024 -0500 ASoC: cs530x: Remove bclk from private structure Remove the bclk int from the private structure and pass it into the set_bclk function. Signed-off-by: Paul Handrigan Link: https://lore.kernel.org/r/20240710160416.2617173-2-paulha@opensource.cirrus.com Signed-off-by: Mark Brown sound/soc/codecs/cs530x.c | 24 ++++++++++++------------ sound/soc/codecs/cs530x.h | 1 - 2 files changed, 12 insertions(+), 13 deletions(-) commit c62bec0fe36873ab6c87c9ae84a6b661d09244c4 Author: Paul Handrigan Date: Wed Jul 10 11:04:15 2024 -0500 ASoC: cs530x: Calculate proper bclk rate using TDM Calculate the proper bclk rate using the number of tdm slots and the width of the tdm data. Fixes: 2884c29152c0 ("ASoC: cs530x: Support for cs530x ADCs") Signed-off-by: Paul Handrigan Link: https://lore.kernel.org/r/20240710160416.2617173-1-paulha@opensource.cirrus.com Signed-off-by: Mark Brown sound/soc/codecs/cs530x.c | 15 ++++++++++----- sound/soc/codecs/cs530x.h | 1 + 2 files changed, 11 insertions(+), 5 deletions(-) commit e021e0eecba99d7ec68f6e7972a72175f54ff6e3 Author: Animesh Agarwal Date: Wed Jul 10 00:12:25 2024 +0530 ASoC: dt-bindings: cirrus,cs4270: Convert to dtschema Convert the Cirrus Logic CS4270 audio CODEC bindings to DT schema. Add missing va-supply, vd-supply and vlc-supply properties, because they are already being used in the DTS and the driver for this device. Cc: Daniel Baluta Signed-off-by: Animesh Agarwal Reviewed-by: Krzysztof Kozlowski Link: https://lore.kernel.org/r/20240709184231.125207-1-animeshagarwal28@gmail.com Signed-off-by: Mark Brown .../devicetree/bindings/sound/cirrus,cs4270.yaml | 59 ++++++++++++++++++++++ Documentation/devicetree/bindings/sound/cs4270.txt | 21 -------- 2 files changed, 59 insertions(+), 21 deletions(-) commit dc0e5ca8856dc6a97e3b117879dfb2b52bda06b6 Author: Richard Fitzgerald Date: Wed Jul 10 11:36:40 2024 +0100 firmware: cs_dsp: Rename fw_ver to wmfw_ver Rename the confusingly named struct member fw_ver to wmfw_ver. It contains the wmfw format version of the loaded wmfw file. This commit also contains an update to wm_adsp for the new name. Signed-off-by: Richard Fitzgerald Reviewed-by: Charles Keepax Link: https://lore.kernel.org/r/20240710103640.78197-5-rf@opensource.cirrus.com Signed-off-by: Mark Brown drivers/firmware/cirrus/cs_dsp.c | 20 ++++++++++---------- include/linux/firmware/cirrus/cs_dsp.h | 2 +- sound/soc/codecs/wm_adsp.c | 2 +- 3 files changed, 12 insertions(+), 12 deletions(-) commit a4939119055d5c97aff2cea040f1af8c4606bfa1 Author: Richard Fitzgerald Date: Wed Jul 10 11:36:39 2024 +0100 firmware: cs_dsp: Clarify wmfw format version log message Change the log message of the wmfw format version to include the file name, and change the message to say "format" instead of "Firmware version". Merge this with the message that logs the timestamp. The wmfw format version is information that is useful to have logged because the behaviour of firmware controls depends on the wmfw format. So "unexpected" behaviour could be caused by having expectations based on one format of wmfw when a different format has been loaded. But the original message was confusing. It reported the file format version but didn't actually log the name of the file it referred to. It also called it "Firmware version", which is confusing when a later message also logs a firmware version that is the version of the actual firmware within the wmfw. The logging of the firmware timestamp has been merged into this. That was originally a dbg-only message, but as we are already logging a line of info, we might as well add a few extra characters to log the timestamp. The timestamp is now logged in hexadecimal - it's not particularly useful as a decimal value. Signed-off-by: Richard Fitzgerald Reviewed-by: Charles Keepax Link: https://lore.kernel.org/r/20240710103640.78197-4-rf@opensource.cirrus.com Signed-off-by: Mark Brown drivers/firmware/cirrus/cs_dsp.c | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-) commit 584e86e14c59d36688633002613792923620d8c0 Author: Richard Fitzgerald Date: Wed Jul 10 11:36:38 2024 +0100 firmware: cs_dsp: Make wmfw and bin filename arguments const char * The wmfw_filename and bin_filename strings passed into cs_dsp_power_up() and cs_dsp_adsp1_power_up() should be const char *. Signed-off-by: Richard Fitzgerald Reviewed-by: Charles Keepax Link: https://lore.kernel.org/r/20240710103640.78197-3-rf@opensource.cirrus.com Signed-off-by: Mark Brown drivers/firmware/cirrus/cs_dsp.c | 8 ++++---- include/linux/firmware/cirrus/cs_dsp.h | 8 ++++---- 2 files changed, 8 insertions(+), 8 deletions(-) commit bff92858dfb9897e4c06c11aab0322e1aab822f7 Author: Richard Fitzgerald Date: Wed Jul 10 11:36:37 2024 +0100 firmware: cs_dsp: Don't allocate temporary buffer for info text Don't allocate a temporary buffer to hold a NUL-terminated copy of the NAME/INFO string from the wmfw/bin. It can be printed directly to the log. Also limit the maximum number of characters that will be logged from this string. The NAME/INFO blocks in the firmware files are an array of characters with a length, not a NUL-terminated C string. The original code allocated a temporary buffer to make a NUL-terminated copy of the string and then passed that to dev_info(). There's no need for this: printf formatting can use "%.*s" to print a character array of a given length. Signed-off-by: Richard Fitzgerald Reviewed-by: Charles Keepax Link: https://lore.kernel.org/r/20240710103640.78197-2-rf@opensource.cirrus.com Signed-off-by: Mark Brown drivers/firmware/cirrus/cs_dsp.c | 35 +++++++---------------------------- 1 file changed, 7 insertions(+), 28 deletions(-) commit 4309363f19598999b25a1e55fccf688daa4cc220 Author: Alexander Lobakin Date: Thu Jun 20 15:53:44 2024 +0200 idpf: remove legacy Page Pool Ethtool stats Page Pool Ethtool stats are deprecated since the Netlink Page Pool interface introduction. idpf receives big changes in Rx buffer management, including &page_pool layout, so keeping these deprecated stats does only harm, not speaking of that CONFIG_IDPF selects CONFIG_PAGE_POOL_STATS unconditionally,