Commit Graph

1396346 Commits

Author SHA1 Message Date
Jarkko Sakkinen
4bddf4587c tpm: Disable TPM2_TCG_HMAC by default
After reading all the feedback, right now disabling the TPM2_TCG_HMAC
is the right call.

Other views discussed:

A. Having a kernel command-line parameter or refining the feature
   otherwise. This goes to the area of improvements.  E.g., one
   example is my own idea where the null key specific code would be
   replaced with a persistent handle parameter (which can be
   *unambigously* defined as part of attestation process when
   done correctly).

B. Removing the code. I don't buy this because that is same as saying
   that HMAC encryption cannot work at all (if really nitpicking) in
   any form. Also I disagree on the view that the feature could not
   be refined to something more reasoable.

Also, both A and B are worst options in terms of backporting.

Thuss, this is the best possible choice.

Cc: stable@vger.kernel.or # v6.10+
Fixes: d2add27cf2 ("tpm: Add NULL primary creation")
Suggested-by: Chris Fenner <cfenn@google.com>
Signed-off-by: Jarkko Sakkinen <jarkko@kernel.org>
2025-10-10 08:21:45 +03:00
Linus Torvalds
5472d60c12 tracing clean up and fixes for v6.18:
- Have osnoise tracer use memdup_user_nul()
 
   The function osnoise_cpus_write() open codes a kmalloc() and then
   a copy_from_user() and then adds a nul byte at the end which is the
   same as simply using memdup_user_nul().
 
 - Fix wakeup and irq tracers when failing to acquire calltime
 
   When the wakeup and irq tracers use the function graph tracer for
   tracing function times, it saves a timestamp into the fgraph shadow
   stack. It is possible that this could fail to be stored. If that
   happens, it exits the routine early. These functions also disable
   nesting of the operations by incremeting the data "disable" counter.
   But if the calltime exits out early, it never increments the counter
   back to what it needs to be.
 
   Since there's only a couple of lines of code that does work after
   acquiring the calltime, instead of exiting out early, reverse the
   if statement to be true if calltime is acquired, and place the code
   that is to be done within that if block. The clean up will always
   be done after that.
 
 - Fix ring_buffer_map() return value on failure of __rb_map_vma()
 
   If __rb_map_vma() fails in ring_buffer_map(), it does not return
   an error. This means the caller will be working against a bad vma
   mapping. Have ring_buffer_map() return an error when __rb_map_vma()
   fails.
 
 - Fix regression of writing to the trace_marker file
 
   A bug fix was made to change __copy_from_user_inatomic() to
   copy_from_user_nofault() in the trace_marker write function.
   The trace_marker file is used by applications to write into
   it (usually with a file descriptor opened at the start of the
   program) to record into the tracing system. It's usually used
   in critical sections so the write to trace_marker is highly
   optimized.
 
   The reason for copying in an atomic section is that the write
   reserves space on the ring buffer and then writes directly into
   it. After it writes, it commits the event. The time between
   reserve and commit must have preemption disabled.
 
   The trace marker write does not have any locking nor can it
   allocate due to the nature of it being a critical path.
 
   Unfortunately, converting __copy_from_user_inatomic() to
   copy_from_user_nofault() caused a regression in Android.
   Now all the writes from its applications trigger the fault that
   is rejected by the _nofault() version that wasn't rejected by
   the _inatomic() version. Instead of getting data, it now just
   gets a trace buffer filled with:
 
     tracing_mark_write: <faulted>
 
   To fix this, on opening of the trace_marker file, allocate
   per CPU buffers that can be used by the write call. Then
   when entering the write call, do the following:
 
     preempt_disable();
     cpu = smp_processor_id();
     buffer = per_cpu_ptr(cpu_buffers, cpu);
     do {
 	cnt = nr_context_switches_cpu(cpu);
 	migrate_disable();
 	preempt_enable();
 	ret = copy_from_user(buffer, ptr, size);
 	preempt_disable();
 	migrate_enable();
     } while (!ret && cnt != nr_context_switches_cpu(cpu));
     if (!ret)
 	ring_buffer_write(buffer);
     preempt_enable();
 
   This works similarly to seqcount. As it must enabled preemption
   to do a copy_from_user() into a per CPU buffer, if it gets
   preempted, the buffer could be corrupted by another task.
   To handle this, read the number of context switches of the current
   CPU, disable migration, enable preemption, copy the data from
   user space, then immediately disable preemption again.
   If the number of context switches is the same, the buffer
   is still valid. Otherwise it must be assumed that the buffer may
   have been corrupted and it needs to try again.
 
   Now the trace_marker write can get the user data even if it has
   to fault it in, and still not grab any locks of its own.
 -----BEGIN PGP SIGNATURE-----
 
 iIoEABYKADIWIQRRSw7ePDh/lE+zeZMp5XQQmuv6qgUCaOfVOhQccm9zdGVkdEBn
 b29kbWlzLm9yZwAKCRAp5XQQmuv6qq6oAP9y+zxuouWjtXIz9/z++aykFgKCkeau
 XHSSdJdn4R+AQgEA4SE0UWKH0F6Bg7qwyocahMMQ1tIJRrpihfNrKBUmmQ4=
 =wDGp
 -----END PGP SIGNATURE-----

Merge tag 'trace-v6.18-2' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace

Pull tracing clean up and fixes from Steven Rostedt:

 - Have osnoise tracer use memdup_user_nul()

   The function osnoise_cpus_write() open codes a kmalloc() and then a
   copy_from_user() and then adds a nul byte at the end which is the
   same as simply using memdup_user_nul().

 - Fix wakeup and irq tracers when failing to acquire calltime

   When the wakeup and irq tracers use the function graph tracer for
   tracing function times, it saves a timestamp into the fgraph shadow
   stack. It is possible that this could fail to be stored. If that
   happens, it exits the routine early. These functions also disable
   nesting of the operations by incremeting the data "disable" counter.
   But if the calltime exits out early, it never increments the counter
   back to what it needs to be.

   Since there's only a couple of lines of code that does work after
   acquiring the calltime, instead of exiting out early, reverse the if
   statement to be true if calltime is acquired, and place the code that
   is to be done within that if block. The clean up will always be done
   after that.

 - Fix ring_buffer_map() return value on failure of __rb_map_vma()

   If __rb_map_vma() fails in ring_buffer_map(), it does not return an
   error. This means the caller will be working against a bad vma
   mapping. Have ring_buffer_map() return an error when __rb_map_vma()
   fails.

 - Fix regression of writing to the trace_marker file

   A bug fix was made to change __copy_from_user_inatomic() to
   copy_from_user_nofault() in the trace_marker write function. The
   trace_marker file is used by applications to write into it (usually
   with a file descriptor opened at the start of the program) to record
   into the tracing system. It's usually used in critical sections so
   the write to trace_marker is highly optimized.

   The reason for copying in an atomic section is that the write
   reserves space on the ring buffer and then writes directly into it.
   After it writes, it commits the event. The time between reserve and
   commit must have preemption disabled.

   The trace marker write does not have any locking nor can it allocate
   due to the nature of it being a critical path.

   Unfortunately, converting __copy_from_user_inatomic() to
   copy_from_user_nofault() caused a regression in Android. Now all the
   writes from its applications trigger the fault that is rejected by
   the _nofault() version that wasn't rejected by the _inatomic()
   version. Instead of getting data, it now just gets a trace buffer
   filled with:

     tracing_mark_write: <faulted>

   To fix this, on opening of the trace_marker file, allocate per CPU
   buffers that can be used by the write call. Then when entering the
   write call, do the following:

     preempt_disable();
     cpu = smp_processor_id();
     buffer = per_cpu_ptr(cpu_buffers, cpu);
     do {
 	cnt = nr_context_switches_cpu(cpu);
 	migrate_disable();
 	preempt_enable();
 	ret = copy_from_user(buffer, ptr, size);
 	preempt_disable();
 	migrate_enable();
     } while (!ret && cnt != nr_context_switches_cpu(cpu));
     if (!ret)
 	ring_buffer_write(buffer);
     preempt_enable();

   This works similarly to seqcount. As it must enabled preemption to do
   a copy_from_user() into a per CPU buffer, if it gets preempted, the
   buffer could be corrupted by another task.

   To handle this, read the number of context switches of the current
   CPU, disable migration, enable preemption, copy the data from user
   space, then immediately disable preemption again. If the number of
   context switches is the same, the buffer is still valid. Otherwise it
   must be assumed that the buffer may have been corrupted and it needs
   to try again.

   Now the trace_marker write can get the user data even if it has to
   fault it in, and still not grab any locks of its own.

* tag 'trace-v6.18-2' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace:
  tracing: Have trace_marker use per-cpu data to read user space
  ring buffer: Propagate __rb_map_vma return value to caller
  tracing: Fix irqoff tracers on failure of acquiring calltime
  tracing: Fix wakeup tracers on failure of acquiring calltime
  tracing/osnoise: Replace kmalloc + copy_from_user with memdup_user_nul
2025-10-09 12:18:22 -07:00
Linus Torvalds
80b7065ec1 Bunch of unrelated fixes
- polling fix for trans fd that ought to have been fixed otherwise back
 in March, but apparently came back somewhere else...
 - USB transport buffer overflow fix
 - Some dentry lifetime rework to handle metadata update for currently
 opened files in uncached mode, or inode type change in cached mode
 - a double-put on invalid flush found by syzbot
 - and finally /sys/fs/9p/caches not advancing buffer and overwriting
 itself for large contents
 
 Thanks to everyone involved!
 -----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCgAdFiEE/IPbcYBuWt0zoYhOq06b7GqY5nAFAmjns5cACgkQq06b7GqY
 5nDGLg/+Ltsiwj51CDwyJxFPX4ki1jM3j2iA8BNpdjjzCev6Jp1vuWBPiV+sTtgM
 zKmIw9joyvzaIXKzA3h7tMe7h7y8H4p7KZyD3YSDSNW5XIb5UYXeQwYVw39OxENk
 nVQkQ41H+bPepmz3R0t/F4la9myVLBtfdcPWJN+JfkOLgdeemCGf+TShJ6F+9Qaq
 PTd3UKfdv8JRlKQmeLH7pPlBoWYRoC2Tq3pZbyC3D1A50bWkTfxusW0k3MUzRyHO
 t/jNbhHt0ai+densQ6O5M+ALMI7KIIzR+obVaBHfzSUcwFeGhmW2x84Mo0qX6YMF
 0B/fY3mCXi8QO6my1hfwmbRtY5mEV967wM/uF7E/SuvyNVizOMBZn8FgWfVPVszr
 ix1iNBgQJdoOEMbHvDfCAtGNorFrMiybyLvoabL7YCwFo68LdYqj2br3/feajoYM
 5g46nUcidH4fVBLtiBGE8w0ko8aa3zLB4iu/fdATuEZ1r+gPt40SWo1mKahoCgY3
 BOtYxEZTnd4l4GPJDQIaYgVckgSiex0xcE9pRJ5LtBwdyw9g4jwfb39WHx4MT2sE
 u5xWDbadU/ZM6ppLJ/iBkotvU9D7ohKTviN1IfCwjqL7IMBNz5c+nBwLQZWK4YTR
 2ySKpv1VOMROglt1KvnHfdpmdJ+CjAJLLNE+XSz9AHXinK5v8aM=
 =bUN1
 -----END PGP SIGNATURE-----

Merge tag '9p-for-6.18-rc1' of https://github.com/martinetd/linux

Pull 9p updates from Dominique Martinet:
 "A bunch of unrelated fixes:

   - polling fix for trans fd that ought to have been fixed otherwise
     back in March, but apparently came back somewhere else...

   - USB transport buffer overflow fix

   - Some dentry lifetime rework to handle metadata update for currently
     opened files in uncached mode, or inode type change in cached mode

   - a double-put on invalid flush found by syzbot

   - and finally /sys/fs/9p/caches not advancing buffer and overwriting
     itself for large contents

  Thanks to everyone involved!"

* tag '9p-for-6.18-rc1' of https://github.com/martinetd/linux:
  9p: sysfs_init: don't hardcode error to ENOMEM
  9p: fix /sys/fs/9p/caches overwriting itself
  9p: clean up comment typos
  9p/trans_fd: p9_fd_request: kick rx thread if EPOLLIN
  net/9p: fix double req put in p9_fd_cancelled
  net/9p: Fix buffer overflow in USB transport layer
  fs/9p: Add p9_debug(VFS) in d_revalidate
  fs/9p: Invalidate dentry if inode type change detected in cached mode
  fs/9p: Refresh metadata in d_revalidate for uncached mode too
2025-10-09 11:56:59 -07:00
Linus Torvalds
18a7e218cf Including fixes from netfilter.
Current release - regressions:
 
   - mlx5: fix pre-2.40 binutils assembler error
 
 Current release - new code bugs:
 
   - net: psp: don't assume reply skbs will have a socket
 
   - eth: fbnic: fix missing programming of the default descriptor
 
 Previous releases - regressions:
 
   - page_pool: fix PP_MAGIC_MASK to avoid crashing on some 32-bit arches
 
   - tcp:
     - take care of zero tp->window_clamp in tcp_set_rcvlowat()
     - don't call reqsk_fastopen_remove() in tcp_conn_request().
 
   - eth: ice: release xa entry on adapter allocation failure
 
   - eth: usb: asix: hold PM usage ref to avoid PM/MDIO + RTNL deadlock
 
 Previous releases - always broken:
 
   - netfilter: validate objref and objrefmap expressions
 
   - sctp: fix a null dereference in sctp_disposition sctp_sf_do_5_1D_ce()
 
   - eth: mlx4: prevent potential use after free in mlx4_en_do_uc_filter()
 
   - eth: mlx5: prevent tunnel mode conflicts between FDB and NIC IPsec tables
 
   - eth: ocelot: fix use-after-free caused by cyclic delayed work
 
 Misc:
 
   -  add support for MediaTek PCIe 5G HP DRMR-H01
 
 Signed-off-by: Paolo Abeni <pabeni@redhat.com>
 -----BEGIN PGP SIGNATURE-----
 
 iQJGBAABCAAwFiEEg1AjqC77wbdLX2LbKSR5jcyPE6QFAmjnlD0SHHBhYmVuaUBy
 ZWRoYXQuY29tAAoJECkkeY3MjxOkQnYP/iQAwtLSyE2lqdP+OsfnwhdpeeMpy2B/
 rfN7hk4OS1Rs1WBEf+Y45Lm5yC2poRleEf3QrixcqAHrtr4SED1JgZynjzjtYJ6c
 mmCdzZPZMfBEVG7rcOusSMI+ebWCA1yvSzjqw6CctwzW6Sac4S3KRyYzUNuTJ+De
 3APf6NptD324veJuyP01opafaExBpu21DfaEXeu4kP030S74J5TMfjt7dNvVpYDt
 qwb7s6syJ9O+U3INmi6SVxJY9711Cj8tjUXzz94FWc/kC28D3UnIKUO1tL/qNthe
 do0OhNa1YlsmoGJuRthxQa9ubyScnP6hKcy8VlanvuDya0JVyzdod/RDO6A2L9bp
 bdJIM2wnLd4Sqe7QcGPBFj0KNahgqG1lzj0uHKhrWBetp+5wWySuk9Mohg8yZaGP
 w53X0+WhAeferpcdMPFbwBL9pcgmHo2FxDMaHKcIrIAFb+TIzSZA6CXWB2RFRSgH
 smgQ9EYUbfUtP6nZCs1lfOux7CdN94tuKA9jnUXFrlIda44akxVe/wVi9bRazrVx
 TcpF0BEeQTyM4wCoVsk/JzTNeK2VZtj8i1B7TrZvR68UkwGrXm8DB4xG42LxdRaw
 PEtu8mbUGiWtkojmUAVpYc/TfMdQOVyBUijd2uAe1pXV4yPDz5cWNkEPX8vvAiRu
 rIe8v1VAz+gg
 =LlXo
 -----END PGP SIGNATURE-----

Merge tag 'net-6.18-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net

Pull  networking fixes from Paolo Abeni:
 "Including fixes from netfilter.

  Current release - regressions:

   - mlx5: fix pre-2.40 binutils assembler error

  Current release - new code bugs:

   - net: psp: don't assume reply skbs will have a socket

   - eth: fbnic: fix missing programming of the default descriptor

  Previous releases - regressions:

   - page_pool: fix PP_MAGIC_MASK to avoid crashing on some 32-bit arches

   - tcp:
       - take care of zero tp->window_clamp in tcp_set_rcvlowat()
       - don't call reqsk_fastopen_remove() in tcp_conn_request()

   - eth:
       - ice: release xa entry on adapter allocation failure
       - usb: asix: hold PM usage ref to avoid PM/MDIO + RTNL deadlock

  Previous releases - always broken:

   - netfilter: validate objref and objrefmap expressions

   - sctp: fix a null dereference in sctp_disposition sctp_sf_do_5_1D_ce()

   - eth:
       - mlx4: prevent potential use after free in mlx4_en_do_uc_filter()
       - mlx5: prevent tunnel mode conflicts between FDB and NIC IPsec tables
       - ocelot: fix use-after-free caused by cyclic delayed work

  Misc:

   -  add support for MediaTek PCIe 5G HP DRMR-H01"

* tag 'net-6.18-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net: (38 commits)
  net: airoha: Fix loopback mode configuration for GDM2 port
  selftests: drv-net: pp_alloc_fail: add necessary optoins to config
  selftests: drv-net: pp_alloc_fail: lower traffic expectations
  selftests: drv-net: fix linter warnings in pp_alloc_fail
  eth: fbnic: fix reporting of alloc_failed qstats
  selftests: drv-net: xdp: add test for interface level qstats
  selftests: drv-net: xdp: rename netnl to ethnl
  eth: fbnic: fix saving stats from XDP_TX rings on close
  eth: fbnic: fix accounting of XDP packets
  eth: fbnic: fix missing programming of the default descriptor
  selftests: netfilter: query conntrack state to check for port clash resolution
  selftests: netfilter: nft_fib.sh: fix spurious test failures
  bridge: br_vlan_fill_forward_path_pvid: use br_vlan_group_rcu()
  netfilter: nft_objref: validate objref and objrefmap expressions
  net: pse-pd: tps23881: Fix current measurement scaling
  net/mlx5: fix pre-2.40 binutils assembler error
  net/mlx5e: Do not fail PSP init on missing caps
  net/mlx5e: Prevent tunnel reformat when tunnel mode not allowed
  net/mlx5: Prevent tunnel mode conflicts between FDB and NIC IPsec tables
  net: usb: asix: hold PM usage ref to avoid PM/MDIO + RTNL deadlock
  ...
2025-10-09 11:13:08 -07:00
Linus Torvalds
9361cace0d more s390 updates for 6.18 merge window
- Compile the decompressor with -Wno-pointer-sign flag to avoid
   a clang warning
 
 - Fix incomplete conversion to flag output macros in __xsch(),
   to avoid always zero return value instead of the expected
   condition code
 
 - Remove superfluous newlines from inline assemblies to improve
   compiler inlining decisions
 
 - Expose firmware provided UID Checking state in sysfs regardless
   of the device presence or state
 
 - CIO does not unregister subchannels when the attached device is
   invalid or unavailable. Update the purge function to remove I/O
   subchannels if the device number is found on cio_ignore list
 
 - Consolidate PAI crypto allocation and cleanup paths
 
 - The uv_get_secret_metadata() function has been removed some few
   months ago, remove also the function mention it in a comment
 -----BEGIN PGP SIGNATURE-----
 
 iI0EABYKADUWIQQrtrZiYVkVzKQcYivNdxKlNrRb8AUCaOZurhccYWdvcmRlZXZA
 bGludXguaWJtLmNvbQAKCRDNdxKlNrRb8A7aAPwJ4hgGHrZY513Kk90eAYGcW7mL
 k7L4Q5kJjQ9M1Y4eTgEAjr3BQLzshpYJVVDxuivZhYSPNOe7MJmolVfZroNv/AE=
 =A/vb
 -----END PGP SIGNATURE-----

Merge tag 's390-6.18-2' of git://git.kernel.org/pub/scm/linux/kernel/git/s390/linux

Pull more s390 updates from Alexander Gordeev:

 - Compile the decompressor with -Wno-pointer-sign flag to avoid a clang
   warning

 - Fix incomplete conversion to flag output macros in __xsch(), to avoid
   always zero return value instead of the expected condition code

 - Remove superfluous newlines from inline assemblies to improve
   compiler inlining decisions

 - Expose firmware provided UID Checking state in sysfs regardless of
   the device presence or state

 - CIO does not unregister subchannels when the attached device is
   invalid or unavailable. Update the purge function to remove I/O
   subchannels if the device number is found on cio_ignore list

 - Consolidate PAI crypto allocation and cleanup paths

 - The uv_get_secret_metadata() function has been removed some few
   months ago, remove also the function mention it in a comment

* tag 's390-6.18-2' of git://git.kernel.org/pub/scm/linux/kernel/git/s390/linux:
  s390/uv: Fix comment of uv_find_secret() function
  s390/pai_crypto: Consolidate PAI crypto allocation and cleanup paths
  s390/cio: Update purge function to unregister the unused subchannels
  s390/pci: Expose firmware provided UID Checking state in sysfs
  s390: Remove superfluous newlines from inline assemblies
  s390/cio/ioasm: Fix __xsch() condition code handling
  s390: Add -Wno-pointer-sign to KBUILD_CFLAGS_DECOMPRESSOR
2025-10-09 10:51:43 -07:00
Linus Torvalds
f6db358dea slab fixes for 6.18-rc1
-----BEGIN PGP SIGNATURE-----
 
 iQFPBAABCAA5FiEEe7vIQRWZI0iWSE3xu+CwddJFiJoFAmjngFEbFIAAAAAABAAO
 bWFudTIsMi41KzEuMTEsMiwyAAoJELvgsHXSRYia2DMH+wdy8KaYLVstuYYI3AuX
 7lilQCqEw7yKNrU2pS/yCOGRg2a+X5qFkMSRji9S1htALuyu8VS2X2MZrqgE0Q1y
 oUKtZZuEaX80SPd2XhwpmsvCIo4V+bLtokHl2SsMD9tEV1AxKnO8UO5zMvxeqz8a
 8XEfiGHU4oAm678hLhnQovA7akgn37uKhzFglevStwRVYELhxv5RNEoH6QsVKjr4
 H7oTXQoYL4T+H84VDPXd8c26g3rhJ7fP1t0AthsZypOMoiiHDW08J03Qw9UQT+Hc
 8NqgTgltczEvm0WExQ4xnCq6QZbwQLaPoulGFxP1iE4Ii0HLqU9SDkhv8i4fymBI
 Fbk=
 =1Zqd
 -----END PGP SIGNATURE-----

Merge tag 'slab-for-6.18-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/vbabka/slab

Pull slab fixes from Vlastimil Babka:

 - Fixes for several corner cases in error paths and debugging options,
   related to the new kmalloc_nolock() functionality (Kuniyuki Iwashima,
   Ran Xiaokai)

* tag 'slab-for-6.18-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/vbabka/slab:
  slub: Don't call lockdep_unregister_key() for immature kmem_cache.
  slab: Fix using this_cpu_ptr() in preemptible context
  slab: Add allow_spin check to eliminate kmemleak warnings
2025-10-09 10:33:50 -07:00
Lorenzo Bianconi
fea8cdf673 net: airoha: Fix loopback mode configuration for GDM2 port
Add missing configuration for loopback mode in airhoha_set_gdm2_loopback
routine.

Fixes: 9cd451d414 ("net: airoha: Add loopback support for GDM2")
Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org>
Reviewed-by: Jacob Keller <jacob.e.keller@intel.com>
Link: https://patch.msgid.link/20251008-airoha-loopback-mode-fix-v2-1-045694fe7f60@kernel.org
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
2025-10-09 11:48:17 +02:00
Paolo Abeni
e6cc7ac0d4 Merge branch 'eth-fbnic-fix-xdp_tx-and-xdp-vs-qstats'
Jakub Kicinski says:

====================
eth: fbnic: fix XDP_TX and XDP vs qstats

Fix XDP_TX hangs and adjust the XDP statistics to match the definition
of qstats. The three problems are somewhat distinct.

XDP_TX hangs is a simple coding bug (patch 1).

The accounting of XDP packets is all over the place. Fix it to obey
qstat rules (packets seen by XDP always counted as Rx packets).
Patch 2 fixes the basic accounting, patch 3 touches up saving
the stats when rings are freed.

Patch 6 corrects reporting of alloc_fail stats which prevented
the pp_alloc_fail test from passing.

Patches 4, 5, 7, 8, 9 add or fix related test cases.

v2:
 - [patch 2] remove now unnecessary byte adjustment
 - [patch 8] use seen_fails more
v1: https://lore.kernel.org/20251003233025.1157158-1-kuba@kernel.org

Testing on fbnic below:

 $ ./tools/testing/selftests/drivers/net/hw/pp_alloc_fail.py
 TAP version 13
 1..1
 fbnic-err: bad MMIO read address 0x80074
 fbnic-err: bad MMIO read address 0x80074
 # Seen: pkts:20605 fails:40 (pass thrs:12)
 # ethtool -G change retval: success
 ok 1 pp_alloc_fail.test_pp_alloc
 # Totals: pass:1 fail:0 xfail:0 xpass:0 skip:0 error:0

 $ ./tools/testing/selftests/drivers/net/xdp.py
 TAP version 13
 1..13
 ok 1 xdp.test_xdp_native_pass_sb
 ok 2 xdp.test_xdp_native_pass_mb
 ok 3 xdp.test_xdp_native_drop_sb
 ok 4 xdp.test_xdp_native_drop_mb
 ok 5 xdp.test_xdp_native_tx_sb
 ok 6 xdp.test_xdp_native_tx_mb
 # Failed run: pkt_sz 2048, offset 1. Last successful run: pkt_sz 1024, offset 256. Reason: Adjustment failed
 ok 7 xdp.test_xdp_native_adjst_tail_grow_data
 ok 8 xdp.test_xdp_native_adjst_tail_shrnk_data
 # Failed run: pkt_sz 512, offset -256. Last successful run: pkt_sz 512, offset -128. Reason: Adjustment failed
 ok 9 xdp.test_xdp_native_adjst_head_grow_data
 # Failed run: pkt_sz (2048) > HDS threshold (1536) and offset 64 > 48
 ok 10 xdp.test_xdp_native_adjst_head_shrnk_data
 ok 11 xdp.test_xdp_native_qstats_pass
 ok 12 xdp.test_xdp_native_qstats_drop
 ok 13 xdp.test_xdp_native_qstats_tx
 # Totals: pass:13 fail:0 xfail:0 xpass:0 skip:0 error:0
====================

Link: https://patch.msgid.link/20251007232653.2099376-1-kuba@kernel.org
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
2025-10-09 11:10:04 +02:00
Jakub Kicinski
5d683e5505 selftests: drv-net: pp_alloc_fail: add necessary optoins to config
Add kernel config for error injection as needed by pp_alloc_fail.py

Reviewed-by: Simon Horman <horms@kernel.org>
Fixes: 9da271f825 ("selftests: drv-net-hw: add test for memory allocation failures with page pool")
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Reviewed-by: Jacob Keller <jacob.e.keller@intel.com>
Link: https://patch.msgid.link/20251007232653.2099376-10-kuba@kernel.org
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
2025-10-09 11:10:02 +02:00
Jakub Kicinski
fbb467f0ed selftests: drv-net: pp_alloc_fail: lower traffic expectations
Lower the expected level of traffic in the pp_alloc_fail test
and calculate failure counter thresholds based on the traffic
rather than using a fixed constant.

We only have "QEMU HW" in NIPA right now, and the test (due to
debug dependencies) only works on debug kernels in the first place.
We need some place for it to pass otherwise it seems to be bit
rotting. So lower the traffic threshold so that it passes on QEMU
and with a debug kernel...

Reviewed-by: Simon Horman <horms@kernel.org>
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Reviewed-by: Jacob Keller <jacob.e.keller@intel.com>
Link: https://patch.msgid.link/20251007232653.2099376-9-kuba@kernel.org
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
2025-10-09 11:10:02 +02:00
Jakub Kicinski
0be740fb22 selftests: drv-net: fix linter warnings in pp_alloc_fail
Fix linter warnings, it's a bit hard to check for new ones otherwise.

  W0311: Bad indentation. Found 16 spaces, expected 12 (bad-indentation)
  C0114: Missing module docstring (missing-module-docstring)
  W1514: Using open without explicitly specifying an encoding (unspecified-encoding)
  C0116: Missing function or method docstring (missing-function-docstring)

Reviewed-by: Simon Horman <horms@kernel.org>
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Reviewed-by: Jacob Keller <jacob.e.keller@intel.com>
Link: https://patch.msgid.link/20251007232653.2099376-8-kuba@kernel.org
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
2025-10-09 11:10:02 +02:00
Jakub Kicinski
2eecd3a41e eth: fbnic: fix reporting of alloc_failed qstats
Rx processing under normal circumstances has 3 rings - 2 buffer
rings (heads, payloads) and a completion ring. All the rings
have a struct fbnic_ring. Make sure we expose alloc_failed
counter from the buffer rings, previously only the alloc_failed
from the completion ring was reported, even tho all ring types
may increment this counter (buffer rings in __fbnic_fill_bdq()).

This makes the pp_alloc_fail.py test pass, it expects the qstat
to be incrementing as page pool injections happen.

Reviewed-by: Simon Horman <horms@kernel.org>
Fixes: 67dc4eb5fc ("eth: fbnic: report software Rx queue stats")
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Reviewed-by: Jacob Keller <jacob.e.keller@intel.com>
Link: https://patch.msgid.link/20251007232653.2099376-7-kuba@kernel.org
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
2025-10-09 11:10:02 +02:00
Jakub Kicinski
27ba92560b selftests: drv-net: xdp: add test for interface level qstats
Send a non-trivial number of packets and make sure that they
are counted correctly in qstats. Per qstats specification
XDP is the first layer of the stack so we should see Rx and Tx
counters go up for packets which went thru XDP.

Reviewed-by: Simon Horman <horms@kernel.org>
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Reviewed-by: Jacob Keller <jacob.e.keller@intel.com>
Link: https://patch.msgid.link/20251007232653.2099376-6-kuba@kernel.org
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
2025-10-09 11:10:02 +02:00
Jakub Kicinski
1ad3f62089 selftests: drv-net: xdp: rename netnl to ethnl
Test uses "netnl" for the ethtool family which is quite confusing
(one would expect netdev family would use this name).

No functional changes.

Reviewed-by: Simon Horman <horms@kernel.org>
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Reviewed-by: Jacob Keller <jacob.e.keller@intel.com>
Link: https://patch.msgid.link/20251007232653.2099376-5-kuba@kernel.org
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
2025-10-09 11:10:02 +02:00
Jakub Kicinski
858b78b24a eth: fbnic: fix saving stats from XDP_TX rings on close
When rings are freed - stats get added to the device level stat
structs. Save the stats from the XDP_TX ring just as Tx stats.
Previously they would be saved to Rx and Tx stats. So we'd not
see XDP_TX packets as Rx during runtime but after an down/up cycle
the packets would appear in stats.

Correct the helper used by ethtool code which does a runtime
config switch.

Reviewed-by: Simon Horman <horms@kernel.org>
Fixes: 5213ff0863 ("eth: fbnic: Collect packet statistics for XDP")
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Reviewed-by: Jacob Keller <jacob.e.keller@intel.com>
Link: https://patch.msgid.link/20251007232653.2099376-4-kuba@kernel.org
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
2025-10-09 11:10:02 +02:00
Jakub Kicinski
613e9e8dcb eth: fbnic: fix accounting of XDP packets
Make XDP-handled packets appear in the Rx stats. The driver has been
counting XDP_TX packets on the Tx ring, but there wasn't much accounting
on the Rx side (the Rx bytes appear to be incremented on XDP_TX but
XDP_DROP / XDP_ABORT are only counted as Rx drops).

Counting XDP_TX packets (not just bytes) in Rx stats looks like
a simple bug of omission.

The XDP_DROP handling appears to be intentional. Whether XDP_DROP
packets should be counted in interface-level Rx stats is a bit
unclear historically. When we were defining qstats, however,
we clarified based on operational experience that in this context:

  name: rx-packets
  doc: |
    Number of wire packets successfully received and passed to the stack.
    For drivers supporting XDP, XDP is considered the first layer
    of the stack, so packets consumed by XDP are still counted here.

fbnic does not obey this requirement. Since XDP support has been added
in current release cycle, instead of splitting interface and qstat
handling - make them both follow the qstat definition.

Another small tweak here is that we count bytes as received on the wire
rather than post-XDP bytes (xdp_get_buff_len() vs skb->len).

Reviewed-by: Simon Horman <horms@kernel.org>
Fixes: 5213ff0863 ("eth: fbnic: Collect packet statistics for XDP")
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Reviewed-by: Jacob Keller <jacob.e.keller@intel.com>
Link: https://patch.msgid.link/20251007232653.2099376-3-kuba@kernel.org
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
2025-10-09 11:10:02 +02:00
Jakub Kicinski
7e617d57f2 eth: fbnic: fix missing programming of the default descriptor
XDP_TX typically uses no offloads. To optimize XDP we added a "default
descriptor" feature to the chip, which allows us to send XDP frames with
just the buffer descriptors (DMA address + length). All the metadata
descriptors are derived from the queue config.

Commit under Fixes missed adding setting the defaults up when transplanting
the code from the prototype driver. Importantly after reset the "request
completion" bit is not set. Packets still get sent but there's no
completion, so ring is not cleaned up. We can send one ring's worth
of packets and then will start dropping all frames that got the XDP_TX
action from the XDP prog.

Reviewed-by: Simon Horman <horms@kernel.org>
Fixes: 168deb7b31 ("eth: fbnic: Add support for XDP_TX action")
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Reviewed-by: Jacob Keller <jacob.e.keller@intel.com>
Link: https://patch.msgid.link/20251007232653.2099376-2-kuba@kernel.org
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
2025-10-09 11:10:01 +02:00
Paolo Abeni
2854378a00 netfilter pull request nf-25-10-08
-----BEGIN PGP SIGNATURE-----
 
 iQJBBAABCAArFiEEgKkgxbID4Gn1hq6fcJGo2a1f9gAFAmjmXroNHGZ3QHN0cmxl
 bi5kZQAKCRBwkajZrV/2AEPmD/wJVaVNhEgmqY0abipD7Sx59ygRIVn6JSLGtimS
 UO8G9S3cr3nT4i2wr1MYNiUQyjs18u4Q73kr8tKalXV99E05OVW1tWAeAztQDeZM
 UNDf44Of1XwwlthIuQa7vyt4aqxmGhQDXKcj1cx2ZHjYQbJ3GshoMAZq90iKKqXN
 Qlbpy216P71KzaN214bKDSgx8ffoWDRxcQwnbY4EWzMErKJqr5I6zLoJo9hMms0X
 JpEqkUaY4PdackQJmBEoOaMphiG9H0u16PtEycfu++YrM/Xf5CJpiCFkp9mjZs+E
 iNpLNF70phCA2ih3mwZFzfgPjYCXNSElOt0lGJFZVTVlGb8HLfBRNxKRMKsaCeZc
 THZSPo2KMPI+UZle5Cyj9WNLWoVeTNtc2BlmMbSiTRRV5BWp1z20zgfymS++t0F7
 hul2wWT7EH0cD87lJ/YUaGcM60nTZuNz7dKchTICwVyWpvCh0W/IhHM1JavfdPg2
 gGCyPPsy1NKwXLCBym/DpKfIIwjR3bqH4s9miZRHt1a2PVX+JWxK72D0RasWPISz
 cNs6bzQhfi6Q2l6gFJ8iGWWVr+L7J5+JmLdp8G4yQaJ+Fa7LggCIVMGOpl4QD7oA
 lILvaXdfi402Oqkcho02gbtC0iDgVA8Grs28r/6KBsVFseejClvh7LQe9YLoFNZT
 Fp7oAQ==
 =u19C
 -----END PGP SIGNATURE-----

Merge tag 'nf-25-10-08' of https://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf

Florian Westphal says:

====================
netfilter: updates for net

The following patchset contains Netfilter fixes for *net*:

1) Fix crash (call recursion) when nftables synproxy extension is used
   in an object map.  When this feature was added in v5.4 the required
   hook call validation was forgotten.
   Fix from Fernando Fernandez Mancera.
2) bridge br_vlan_fill_forward_path_pvid uses incorrect
   rcu_dereference_protected(); we only have rcu read lock but not
   RTNL.  Fix from Eric Woudstra.

Last two patches address flakes in two existing selftests.

netfilter pull request nf-25-10-08

* tag 'nf-25-10-08' of https://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf:
  selftests: netfilter: query conntrack state to check for port clash resolution
  selftests: netfilter: nft_fib.sh: fix spurious test failures
  bridge: br_vlan_fill_forward_path_pvid: use br_vlan_group_rcu()
  netfilter: nft_objref: validate objref and objrefmap expressions
====================

Link: https://patch.msgid.link/20251008125942.25056-1-fw@strlen.de
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
2025-10-09 10:07:45 +02:00
Linus Torvalds
ec714e371f perf tools improvements and fixes for Linux v6.18:
- Extended 'perf annotate' with DWARF type information (--code-with-type)
   integration in the TUI, including a 'T' hotkey to toggle it.
 
 - Enhanced 'perf bench mem' with new mmap() workloads and control over
   page/chunk sizes.
 
 - Fix 'perf stat' error handling to correctly display unsupported events.
 
 - Improved support for Clang cross-compilation.
 
 - Refactored LLVM and Capstone disasm for modularity.
 
 - Introduced the :X modifier to exclude an event from automatic regrouping.
 
 - Adjusted KVM sampling defaults to use the "cycles" event to prevent failures.
 
 - Added comprehensive support for decoding PowerPC Dispatch Trace Log (DTL).
 
 - Updated Arm SPE tracing logic for better analysis of memory and snoop
   details.
 
 - Synchronized Intel PMU events and metrics with TMA 5.1 across multiple
   processor generations.
 
 - Converted dependencies like libperl and libtracefs to be opt-in.
 
 - Handle more Rust symbols in kallsyms ('N', debugging).
 
 - Improve the python binding to allow for python based tools to use more
   of the libraries, add a 'ilist' utility to test those new bindings.
 
 - Various 'perf test' fixes.
 
 - Kan Liang no longer a perf tools reviewer.
 
 Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
 -----BEGIN PGP SIGNATURE-----
 
 iHUEABYKAB0WIQR2GiIUctdOfX2qHhGyPKLppCJ+JwUCaObIdAAKCRCyPKLppCJ+
 JyM+AQCWCqdMdiOrJfsqwBAthJmLA2j+haprucR9b2XAi0CLTAD8DGaax3XQbIxM
 3D6PUd6/qschIy0f77eYqCYjVQXJkQM=
 =ibgu
 -----END PGP SIGNATURE-----

Merge tag 'perf-tools-for-v6.18-1-2025-10-08' of git://git.kernel.org/pub/scm/linux/kernel/git/perf/perf-tools

Pull perf tools updates from Arnaldo Carvalho de Melo:

 - Extended 'perf annotate' with DWARF type information
   (--code-with-type) integration in the TUI, including a 'T'
   hotkey to toggle it

 - Enhanced 'perf bench mem' with new mmap() workloads and control
   over page/chunk sizes

 - Fix 'perf stat' error handling to correctly display unsupported
   events

 - Improved support for Clang cross-compilation

 - Refactored LLVM and Capstone disasm for modularity

 - Introduced the :X modifier to exclude an event from automatic
   regrouping

 - Adjusted KVM sampling defaults to use the "cycles" event to prevent
   failures

 - Added comprehensive support for decoding PowerPC Dispatch Trace Log
   (DTL)

 - Updated Arm SPE tracing logic for better analysis of memory and snoop
   details

 - Synchronized Intel PMU events and metrics with TMA 5.1 across
   multiple processor generations

 - Converted dependencies like libperl and libtracefs to be opt-in

 - Handle more Rust symbols in kallsyms ('N', debugging)

 - Improve the python binding to allow for python based tools to use
   more of the libraries, add a 'ilist' utility to test those new
   bindings

 - Various 'perf test' fixes

 - Kan Liang no longer a perf tools reviewer

* tag 'perf-tools-for-v6.18-1-2025-10-08' of git://git.kernel.org/pub/scm/linux/kernel/git/perf/perf-tools: (192 commits)
  perf tools: Fix arm64 libjvmti build by generating unistd_64.h
  perf tests: Don't retest sections in "Object code reading"
  perf docs: Document building with Clang
  perf build: Support build with clang
  perf test coresight: Dismiss clang warning for unroll loop thread
  perf test coresight: Dismiss clang warning for thread loop
  perf test coresight: Dismiss clang warning for memcpy thread
  perf build: Disable thread safety analysis for perl header
  perf build: Correct CROSS_ARCH for clang
  perf python: split Clang options when invoking Popen
  tools build: Align warning options with perf
  perf disasm: Remove unused evsel from 'struct annotate_args'
  perf srcline: Fallback between addr2line implementations
  perf disasm: Make ins__scnprintf() and ins__is_nop() static
  perf dso: Clean up read_symbol() error handling
  perf dso: Support BPF programs in dso__read_symbol()
  perf dso: Move read_symbol() from llvm/capstone to dso
  perf llvm: Reduce LLVM initialization
  perf check: Add libLLVM feature
  perf parse-events: Fix parsing of >30kb event strings
  ...
2025-10-08 19:24:24 -07:00
Linus Torvalds
37bfdbc11b pci-v6.18-fixes-1
-----BEGIN PGP SIGNATURE-----
 
 iQJIBAABCgAyFiEEgMe7l+5h9hnxdsnuWYigwDrT+vwFAmjm4P4UHGJoZWxnYWFz
 QGdvb2dsZS5jb20ACgkQWYigwDrT+vx2Zw//evX6Zw8CkUY0I10KSFZAtGMlQWH3
 1r7OS4RVvTQEbYClMw4MUpSTNyhj67pAkNq5Kzm1oovwwW+uQOa8q8DEA/aeVs4G
 HZQWVwRLUVZznoXSETarqRCj9vqoV0D9c66KjwAqGGZNiWBWSdJ6KJjWrysdk/oN
 HzuPlu5e9iSVZ8CGGU0lylgThSIgpJoSpc+esBBBzTMAfIpImUzDSIPn1+hZId/S
 7keKcn+DWHbXrRwguKz5PEvUXDMw36HQeECPpnCGjfBdd+S+qgzulNr0VK5ohcg7
 xCPwCRCscycAFjRB3Gm8r5KvuxDeQAwR7iBc2h+I1mdKvobVtT7ZJgGBHw1yNTY7
 O2ZcVkSVODW2AogwcHiE2YBa04R1smuqncRvh4W5JvXS6B6WVB/6nxVxZoqDzxTh
 xeU8wFt3BCUG1k6vjDxj3OilOHUUcoyq7Wjl4/PMOL6d0kixqH2sXPmlktl45XAB
 A/jGiHWpYA1Cn2arGkk4hgbdN4mLpGnV+8fP02aajsIdKcFKUQCCB9+aaUCMW80o
 cNONr8XMUzaEmzvNcMq27rUYjtAtHb4JmigPk69m7aLhyR069snzsuzkxRfGaMCk
 v8QNDdbUgn9TtzP+fqa2FgOceSZNPsZeQtBDSb4+SWYStzMaVF4mKRZ72mfMsF/e
 WDpVHF8s/t79rhA=
 =fd65
 -----END PGP SIGNATURE-----

Merge tag 'pci-v6.18-fixes-1' of git://git.kernel.org/pub/scm/linux/kernel/git/pci/pci

Pull pci fix from Bjorn Helgaas:

 - Fix a resource lookup regression that broke enumeration of hotplugged
   Thunderbolt devices on several platforms (Yangyu Chen)

* tag 'pci-v6.18-fixes-1' of git://git.kernel.org/pub/scm/linux/kernel/git/pci/pci:
  PCI: Fix regression in pci_bus_distribute_available_resources()
2025-10-08 18:51:00 -07:00
Steven Rostedt
64cf7d058a tracing: Have trace_marker use per-cpu data to read user space
It was reported that using __copy_from_user_inatomic() can actually
schedule. Which is bad when preemption is disabled. Even though there's
logic to check in_atomic() is set, but this is a nop when the kernel is
configured with PREEMPT_NONE. This is due to page faulting and the code
could schedule with preemption disabled.

Link: https://lore.kernel.org/all/20250819105152.2766363-1-luogengkun@huaweicloud.com/

The solution was to change the __copy_from_user_inatomic() to
copy_from_user_nofault(). But then it was reported that this caused a
regression in Android. There's several applications writing into
trace_marker() in Android, but now instead of showing the expected data,
it is showing:

  tracing_mark_write: <faulted>

After reverting the conversion to copy_from_user_nofault(), Android was
able to get the data again.

Writes to the trace_marker is a way to efficiently and quickly enter data
into the Linux tracing buffer. It takes no locks and was designed to be as
non-intrusive as possible. This means it cannot allocate memory, and must
use pre-allocated data.

A method that is actively being worked on to have faultable system call
tracepoints read user space data is to allocate per CPU buffers, and use
them in the callback. The method uses a technique similar to seqcount.
That is something like this:

	preempt_disable();
	cpu = smp_processor_id();
	buffer = this_cpu_ptr(&pre_allocated_cpu_buffers, cpu);
	do {
		cnt = nr_context_switches_cpu(cpu);
		migrate_disable();
		preempt_enable();
		ret = copy_from_user(buffer, ptr, size);
		preempt_disable();
		migrate_enable();
	} while (!ret && cnt != nr_context_switches_cpu(cpu));

	if (!ret)
		ring_buffer_write(buffer);
	preempt_enable();

It's a little more involved than that, but the above is the basic logic.
The idea is to acquire the current CPU buffer, disable migration, and then
enable preemption. At this moment, it can safely use copy_from_user().
After reading the data from user space, it disables preemption again. It
then checks to see if there was any new scheduling on this CPU. If there
was, it must assume that the buffer was corrupted by another task. If
there wasn't, then the buffer is still valid as only tasks in preemptable
context can write to this buffer and only those that are running on the
CPU.

By using this method, where trace_marker open allocates the per CPU
buffers, trace_marker writes can access user space and even fault it in,
without having to allocate or take any locks of its own.

Cc: stable@vger.kernel.org
Cc: Masami Hiramatsu <mhiramat@kernel.org>
Cc: Mathieu Desnoyers <mathieu.desnoyers@efficios.com>
Cc: Luo Gengkun <luogengkun@huaweicloud.com>
Cc: Wattson CI <wattson-external@google.com>
Cc: Linus Torvalds <torvalds@linux-foundation.org>
Link: https://lore.kernel.org/20251008124510.6dba541a@gandalf.local.home
Fixes: 3d62ab32df ("tracing: Fix tracing_marker may trigger page fault during preempt_disable")
Reported-by: Runping Lai <runpinglai@google.com>
Tested-by: Runping Lai <runpinglai@google.com>
Closes: https://lore.kernel.org/linux-trace-kernel/20251007003417.3470979-2-runpinglai@google.com/
Signed-off-by: Steven Rostedt (Google) <rostedt@goodmis.org>
2025-10-08 21:50:01 -04:00
Ankit Khushwaha
de4cbd7047 ring buffer: Propagate __rb_map_vma return value to caller
The return value from `__rb_map_vma()`, which rejects writable or
executable mappings (VM_WRITE, VM_EXEC, or !VM_MAYSHARE), was being
ignored. As a result the caller of `__rb_map_vma` always returned 0
even when the mapping had actually failed, allowing it to proceed
with an invalid VMA.

Cc: stable@vger.kernel.org
Cc: Masami Hiramatsu <mhiramat@kernel.org>
Cc: Mathieu Desnoyers <mathieu.desnoyers@efficios.com>
Link: https://lore.kernel.org/20251008172516.20697-1-ankitkhushwaha.linux@gmail.com
Fixes: 117c39200d ("ring-buffer: Introducing ring-buffer mapping functions")
Reported-by: syzbot+ddc001b92c083dbf2b97@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?id=194151be8eaebd826005329b2e123aecae714bdb
Signed-off-by: Ankit Khushwaha <ankitkhushwaha.linux@gmail.com>
Signed-off-by: Steven Rostedt (Google) <rostedt@goodmis.org>
2025-10-08 21:48:58 -04:00
Yangyu Chen
a154f14160 PCI: Fix regression in pci_bus_distribute_available_resources()
The refactoring in 4292a1e45f ("PCI: Refactor distributing available
memory to use loops") switched pci_bus_distribute_available_resources() to
operate on an array of bridge windows. That accidentally looked up bus
resources via pci_bus_resource_n() and then passed those pointers to helper
routines that expect the resource to belong to the device. As soon as we
execute that code, pci_resource_num() warned because the resource wasn't in
the bridge's resource array.

This happens on my AMD Strix Halo machine with Thunderbolt device; the
error message is shown below:

  WARNING: CPU: 6 PID: 272 at drivers/pci/pci.h:471 pci_bus_distribute_available_resources+0x6ad/0x6d0
  CPU: 6 UID: 0 PID: 272 Comm: irq/33-pciehp Not tainted 6.17.0+ #1 PREEMPT(voluntary)
  Hardware name: PELADN YO Series/YO1, BIOS 1.04 05/15/2025
  RIP: 0010:pci_bus_distribute_available_resources+0x6ad/0x6d0
  Call Trace:
   pci_bus_distribute_available_resources+0x590/0x6d0
   pci_bridge_distribute_available_resources+0x62/0xb0
   pci_assign_unassigned_bridge_resources+0x65/0x1b0
   pciehp_configure_device+0x92/0x160
   pciehp_handle_presence_or_link_change+0x1b5/0x350
   pciehp_ist+0x147/0x1c0

Fix the regression by always fetching the resource directly from the bridge
with pci_resource_n(bridge, PCI_BRIDGE_RESOURCES + i). This restores the
original behaviour while keeping the refactored structure.  Then we can
successfully assign resources to the Thunderbolt device.

Fixes: 4292a1e45f ("PCI: Refactor distributing available memory to use loops")
Reported-by: Kenneth R. Crudup <kenny@panix.com>
Closes: https://lore.kernel.org/r/dd551b81-9e81-480b-aab3-7cf8b8bbc1d0@panix.com
Signed-off-by: Yangyu Chen <cyy@cyyself.name>
[bhelgaas: trim timestamps, etc from commit log]
Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
Tested-By: Kenneth R. Crudup <kenny@panix.com>
Link: https://lore.kernel.org/r/F833CC81-7C60-48FC-A31C-B9999DCC6FA2@icloud.com
Link: https://patch.msgid.link/tencent_8C54420E1B0FF8D804C1B4651DF970716309@qq.com
2025-10-08 16:36:31 -05:00
Linus Torvalds
cd5a0afbdf qcom: add Glymur CPUCP mailbox binding
zynqmp-ipi: misc cleanup
 mtk: add new GPUEB mailbox driver
      cmdq - remove pm_runtime calls from send_data
      gce - make clock-names optional
 misc: change mailbox-altera maintainer
       remove redundant 'fast_io' in regmap_config
       mhuv3 - Remove no_free_ptr
 -----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCgAdFiEE6EwehDt/SOnwFyTyf9lkf8eYP5UFAmjml2sACgkQf9lkf8eY
 P5VS3g/+KwEqdNZOGsM5uWAZAUsyht0z/oDZAgArFTYf/nDS2xyMt34QcTh9WKkY
 6RU4W8XyI/vV1NG7MPp7cTusQJHDX3wzUNEz9s24nfjmxyhMsB8C1SHdylVuQZjL
 2lt7JgbQZpgp6vNvr9ci7LSxwv58KPbwCzAh3yci0pvQ0bG1XCC3MJbCwvXAvchE
 Ham9hdVGSY3Tf43Aj5cR22esx/l2DG6UMDqftaw4CXjtstO9grK+e0EABF16fP0r
 T61z67YLffQPKBo36smnEHwPgMxWiSIYmcBw81T0E+QrUwDE2kpUBiXTQ4HUuS6r
 QgcKLfZZ8nGnsfyYVTXdjQl4W6mCSoku5p1oQXjSJD/On3TogecuWMg8K2xCZRiR
 65jfROouT+HQKeQicpJ8iECFRsEywlLk+WbTKHA4gWBHpf9090BPcq7Q/I+FAUoi
 lOWJcXZQIyzveDDdczGMN2PQWq2mxGGqV0GDnQ3/tdnl1A7GF3YD05SVYida74aW
 JfdyjPhr/XVy28w8g9/cwmM5K8KZDEq02MNZTHGzVl0izb0qr1UZtxUe5u5vAJid
 vOt6Qhsl8ZEWoRrvEenCzRcCBsW/dZh6UH4014aNt9OBu1NU+sd634MsPLd10wVX
 UmQ6rZsrRusWfFYCrwr/5gfiAlpLBljb1AVbWwjKY3vuZ6WlH4I=
 =/pj4
 -----END PGP SIGNATURE-----

Merge tag 'mailbox-v6.18' of git://git.kernel.org/pub/scm/linux/kernel/git/jassibrar/mailbox

Pull mailbox updates from Jassi Brar:

 - Qualcomm: add Glymur CPUCP mailbox binding

 - Xilinx Zynq: misc cleanup

 - MediaTek:
     - add new GPUEB mailbox driver
     - cmdq: remove pm_runtime calls from send_data
     - gce: make clock-names optional

 - misc:
     - change mailbox-altera maintainer
     - remove redundant 'fast_io' in regmap_config
     - mhuv3: Remove no_free_ptr

* tag 'mailbox-v6.18' of git://git.kernel.org/pub/scm/linux/kernel/git/jassibrar/mailbox:
  mailbox: mtk-cmdq: Remove pm_runtime APIs from cmdq_mbox_send_data()
  mailbox: add MediaTek GPUEB IPI mailbox
  dt-bindings: mailbox: Add MT8196 GPUEB Mailbox
  mailbox: zynqmp-ipi: Fix SGI cleanup on unbind
  mailbox: zynqmp-ipi: Fix out-of-bounds access in mailbox cleanup loop
  mailbox: zynqmp-ipi: Remove dev.parent check in zynqmp_ipi_free_mboxes
  mailbox: zynqmp-ipi: Remove redundant mbox_controller_unregister() call
  mailbox: remove unneeded 'fast_io' parameter in regmap_config
  dt-bindings: mailbox: mediatek,gce-mailbox: Make clock-names optional
  dt-bindings: mailbox: qcom: Document Glymur CPUCP mailbox controller binding
  MAINTAINERS: Change mailbox-altera maintainer
  mailbox: arm_mhuv3: Remove no_free_ptr() to maintain the original form of the pointer
2025-10-08 11:44:21 -07:00
Linus Torvalds
ed4d6e9246 VFIO updates for v6.18-rc1 part 2
- Optimizations for DMA map and unmap opertions through the type1
    vfio IOMMU backend.  This uses various means of batching and hints
    from the mm structures to improve efficiency and therefore
    performance, resulting in a significant speedup for huge page
    use cases. (Li Zhe)
 
  - Expose supported device migration features through debugfs.
    (Cédric Le Goater)
 -----BEGIN PGP SIGNATURE-----
 
 iQJPBAABCAA5FiEEQvbATlQL0amee4qQI5ubbjuwiyIFAmjmgowbHGFsZXgud2ls
 bGlhbXNvbkByZWRoYXQuY29tAAoJECObm247sIsiUUAQAJyY7ykBiqbCJjflw3/P
 ZdE8hZZDx3vyuq7OY/JLjM0BQllSiBuJbOsB2EM5j8qr5K4Al9SrXBZ7crSyfqjN
 +/d/WI7/ndNapUT0+Q4zcb1W6bu/o1YnaklTpl+UV6zeX5ZjvgdVmKY0Ox+GKgqB
 oGcfMCK6+dSBUP7I27dpRBBcNs8NLA9lPNtqB8YC7GhXbfmhioXb//Ucpb570M40
 P20KnCnZywq/7AcEE2TcLWkMgUEMsPpPVH1IK0K+XtP2awrpxJ4/HY4G86UOMvPS
 DlH+yqqQSCze5etvvTS8Sao6G1SeuQL+wgUE0PYxgnZOO1nQ3L2Pw868gfFXKTrb
 N6uFKY2Gz6WMJWygDjv4RthKnQ7ChZmL7JjcL9W7/0mVZChVCVEGpZn2EiLUSk8Q
 gvNO2paKZeWO9jzLIqOE9/suNagDytV0Lu/AkHg7XZdiu86aI+lkmLgfj48e4ZXK
 KspNnUOJzRlJrHsHtIOhptBVjGd6Qn2dDW+HFtdEdSaDMvbA76QQQL+lQ8IwwvNy
 KVaknhqHrtXGo5yiIefDNV3333mfy65jIoFaLWozAjeX4U+FmuHPdD+uwgvB84T6
 3MkIPy27wuQtIO96r/UGR87smm3scFErK2IjHTGxFU2r9Mh42oVt9ahIJN34he1b
 x5UCfKCtx59o7fZRJgGPlFUT
 =nPnW
 -----END PGP SIGNATURE-----

Merge tag 'vfio-v6.18-rc1-pt2' of https://github.com/awilliam/linux-vfio

Pull more VFIO updates from Alex Williamson:

 - Optimizations for DMA map and unmap opertions through the type1 vfio
   IOMMU backend.

   This uses various means of batching and hints from the mm structures
   to improve efficiency and therefore performance, resulting in a
   significant speedup for huge page use cases (Li Zhe)

 - Expose supported device migration features through debugfs (Cédric Le
   Goater)

* tag 'vfio-v6.18-rc1-pt2' of https://github.com/awilliam/linux-vfio:
  vfio: Dump migration features under debugfs
  vfio/type1: optimize vfio_unpin_pages_remote()
  vfio/type1: introduce a new member has_rsvd for struct vfio_dma
  vfio/type1: batch vfio_find_vpfn() in function vfio_unpin_pages_remote()
  vfio/type1: optimize vfio_pin_pages_remote()
  mm: introduce num_pages_contiguous()
2025-10-08 11:22:27 -07:00
Linus Torvalds
99cedb6b8f Input updates for v6.18-rc0
- a number of conversions to yaml/json schema and fixes for
   input-related device tree bindings
 
 - a new driver for Awinic AW86927 haptic chip
 
 - a new driver for Hynitron CST816x series controller
 
 - a new driver for add Himax HX852x(ES) touchscreen controller
 
 - a fix to uinput to not leak kernel memory via a gap in
   uinput_ff_upload_compat structure
 
 - a fix to prevent overflow in pressure calculation in tsc2007 driver
   causing phantom touches
 
 - a change to Atmel maxTouch driver to support generic touchscreen
   configuration (flip, rotate, etc.)
 
 - support for platform data was dropped in tca8418_keypad,
   pxa27x-keypad, spear-keyboard and twl4030_keypad drivers, they all
   now rely on generic device properties for configuration
 
 - other assorted changes and fixes.
 -----BEGIN PGP SIGNATURE-----
 
 iHUEABYKAB0WIQST2eWILY88ieB2DOtAj56VGEWXnAUCaOX1HQAKCRBAj56VGEWX
 nC29AQCsDm6HBKXJZl6nAI8WHQiSvASFvyFlF6scVnfueX54mQEA6eE428+Cr1Sn
 mDiwL38Es+PlZbdsi0J2q0vYzpr4yQU=
 =JZIn
 -----END PGP SIGNATURE-----

Merge tag 'input-for-v6.18-rc0' of git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input

Pull input updates from Dmitry Torokhov:

 - Conversions to yaml/json schema and fixes for input-related device
   tree bindings

 - New drivers:
     - Awinic AW86927 haptic chip
     - Hynitron CST816x series controller
     - Himax HX852x(ES) touchscreen controller

 - Fix uinput to not leak kernel memory via a gap in
   uinput_ff_upload_compat structure

 - Prevent overflow in pressure calculation in tsc2007 driver causing
   phantom touches

 - Make the Atmel maxTouch driver support generic touchscreen
   configuration (flip, rotate, etc)

 - Drop support for platform data in tca8418_keypad, pxa27x-keypad,
   spear-keyboard and twl4030_keypad drivers, they all now rely on
   generic device properties for configuration

 - Other assorted changes and fixes

* tag 'input-for-v6.18-rc0' of git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input: (50 commits)
  Input: atmel_mxt_ts - allow reset GPIO to sleep
  Input: aw86927 - fix error code in probe()
  Input: psxpad-spi - add a check for the return value of spi_setup()
  Input: uinput - zero-initialize uinput_ff_upload_compat to avoid info leak
  Input: aw86927 - add driver for Awinic AW86927
  dt-bindings: input: Add Awinic AW86927
  dt-bindings: touchscreen: remove touchscreen.txt
  dt-bindings: arm: bcm: raspberrypi,bcm2835-firmware: Add touchscreen child node
  dt-bindings: touchscreen: convert eeti bindings to json schema
  Input: pm8941-pwrkey - disable wakeup for resin by default
  dt-bindings: input: pm8941-pwrkey: Document wakeup-source property
  Input: add driver for Hynitron CST816x series
  dt-bindings: input: touchscreen: add hynitron cst816x series
  Input: imx6ul_tsc - set glitch threshold by DTS property
  dt-bindings: touchscreen: fsl,imx6ul-tsc: support glitch thresold
  dt-bindings: touchscreen: add debounce-delay-us property
  Input: ps2-gpio - fix typo
  Input: atmel_mxt_ts - add support for generic touchscreen configurations
  dt-bindings: input: maxtouch: add common touchscreen properties
  dt-bindings: touchscreen: convert zet6223 bindings to json schema
  ...
2025-10-08 09:44:38 -07:00
Linus Torvalds
7c8dcac8d7 This push contains the following changes:
- Fix zstd regression.
 - Ensure ti driver algorithm are set as async.
 - Revert patch disabling SHA1 in FIPS mode.
 - Fix RNG set_ent null-pointer dereference.
 -----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCgAdFiEEn51F/lCuNhUwmDeSxycdCkmxi6cFAmjjJ2oACgkQxycdCkmx
 i6fU6g//Ytvo52VNiaQneYadbikIh6NrqeA4ykjic4LllcqaWdH4hOLeBWS0srR3
 SgjgCnmuchTzlzDMvAlYZn3o7owpe0GvS2Mil7orS00N58gU6h/TqiE2V6UUqjKN
 MNdNEtHD7QhHAamunXMG7NRGyT/mLeSA6fmiW5jrlBeQpw2D+Aso54clxHeKHDkZ
 Rrx4qbmhjZQyahp2CmO+rmTA9W/xpnsGrWDmbLvRk6eTrSonRu43IbKngyYdnOZr
 mAeWvABi2Izq/VyVoEpLPTzEiHvF9dX1yMm2njFe0Q09OkVGNeTd0zuevH0kayb6
 KmevkHJ8mxLs8Q5R8tSUzR265DLzQ0SrghDNB3gDPLBcO5tsg2CBLMOMup0LjY7E
 uvglFKFc0VQYximaz41aWW3+luikAwW0LJr1bchKaVes41hcHLu/77FJ9A3ANObe
 x/dZ46CQ2w2B8DIavQcKAM/uKpkL8bk50QRuLQq20ZElbv4RYjmA3GE2QZyZ6alm
 kJ5a7RNnujKAsxhp/xg3nBWVtgCeE8hEec4Piwue23+qpAS5KW7WMK8GW6EW9FMs
 xxmAQFvXk4rfmKlQX1EMt601QZx0TA3yBDu/aTneL+mS4+dlB3H9JqFw4LuhKjGS
 RcpXv2wz/baBxeKE/knSe+RUCEtgTYrTSSlv2ZP+3toOwMNKgO0=
 =IFdl
 -----END PGP SIGNATURE-----

Merge tag 'v6.18-p2' of git://git.kernel.org/pub/scm/linux/kernel/git/herbert/crypto-2.6

Pull crypto fixes from Herbert Xu:

 - Fix zstd regression

 - Ensure ti driver algorithm are set as async

 - Revert patch disabling SHA1 in FIPS mode

 - Fix RNG set_ent null-pointer dereference

* tag 'v6.18-p2' of git://git.kernel.org/pub/scm/linux/kernel/git/herbert/crypto-2.6:
  crypto: rng - Ensure set_ent is always present
  Revert "crypto: testmgr - desupport SHA-1 for FIPS 140"
  crypto: ti - Add CRYPTO_ALG_ASYNC flag to DTHEv2 AES algos
  crypto: zstd - Fix compression bug caused by truncation
2025-10-08 09:38:31 -07:00
Steven Rostedt
c834a97962 tracing: Fix irqoff tracers on failure of acquiring calltime
The functions irqsoff_graph_entry() and irqsoff_graph_return() both call
func_prolog_dec() that will test if the data->disable is already set and
if not, increment it and return. If it was set, it returns false and the
caller exits.

The caller of this function must decrement the disable counter, but misses
doing so if the calltime fails to be acquired.

Instead of exiting out when calltime is NULL, change the logic to do the
work if it is not NULL and still do the clean up at the end of the
function if it is NULL.

Cc: stable@vger.kernel.org
Cc: Masami Hiramatsu <mhiramat@kernel.org>
Cc: Mathieu Desnoyers <mathieu.desnoyers@efficios.com>
Link: https://lore.kernel.org/20251008114943.6f60f30f@gandalf.local.home
Fixes: a485ea9e3e ("tracing: Fix irqsoff and wakeup latency tracers when using function graph")
Reported-by: Sasha Levin <sashal@kernel.org>
Closes: https://lore.kernel.org/linux-trace-kernel/20251006175848.1906912-2-sashal@kernel.org/
Signed-off-by: Steven Rostedt (Google) <rostedt@goodmis.org>
2025-10-08 12:10:44 -04:00
Steven Rostedt
4f7bf54b07 tracing: Fix wakeup tracers on failure of acquiring calltime
The functions wakeup_graph_entry() and wakeup_graph_return() both call
func_prolog_preempt_disable() that will test if the data->disable is
already set and if not, increment it and disable preemption. If it was
set, it returns false and the caller exits.

The caller of this function must decrement the disable counter, but misses
doing so if the calltime fails to be acquired.

Instead of exiting out when calltime is NULL, change the logic to do the
work if it is not NULL and still do the clean up at the end of the
function if it is NULL.

Cc: stable@vger.kernel.org
Cc: Masami Hiramatsu <mhiramat@kernel.org>
Cc: Mathieu Desnoyers <mathieu.desnoyers@efficios.com>
Link: https://lore.kernel.org/20251008114835.027b878a@gandalf.local.home
Fixes: a485ea9e3e ("tracing: Fix irqsoff and wakeup latency tracers when using function graph")
Reported-by: Sasha Levin <sashal@kernel.org>
Closes: https://lore.kernel.org/linux-trace-kernel/20251006175848.1906912-1-sashal@kernel.org/
Signed-off-by: Steven Rostedt (Google) <rostedt@goodmis.org>
2025-10-08 12:10:26 -04:00
Thorsten Blum
f0c029d2ff tracing/osnoise: Replace kmalloc + copy_from_user with memdup_user_nul
Replace kmalloc() followed by copy_from_user() with memdup_user_nul() to
simplify and improve osnoise_cpus_write(). Remove the manual
NUL-termination.

No functional changes intended.

Cc: Masami Hiramatsu <mhiramat@kernel.org>
Cc: Mathieu Desnoyers <mathieu.desnoyers@efficios.com>
Link: https://lore.kernel.org/20251001130907.364673-2-thorsten.blum@linux.dev
Signed-off-by: Thorsten Blum <thorsten.blum@linux.dev>
Signed-off-by: Steven Rostedt (Google) <rostedt@goodmis.org>
2025-10-08 12:05:46 -04:00
Thomas Huth
deabb34b66 s390/uv: Fix comment of uv_find_secret() function
The uv_get_secret_metadata() function has been removed some
months ago, so we should not mention it in the comment anymore.

Fixes: a42831f0b7 ("s390/uv: Remove uv_get_secret_metadata function")
Signed-off-by: Thomas Huth <thuth@redhat.com>
Acked-by: Claudio Imbrenda <imbrenda@linux.ibm.com>
Signed-off-by: Heiko Carstens <hca@linux.ibm.com>
Signed-off-by: Alexander Gordeev <agordeev@linux.ibm.com>
2025-10-08 13:58:37 +02:00
Florian Westphal
e84945bdc6 selftests: netfilter: query conntrack state to check for port clash resolution
Jakub reported this self test flaking occasionally (fails, but passes on
re-run) on debug kernels.

This is because the test checks for elapsed time to determine if both
connections were established in parallel.

Rework this to no longer depend on timing.
Use busywait helper to check that both sockets have moved to established
state and then query the conntrack engine for the two entries.

Reported-by: Jakub Kicinski <kuba@kernel.org>
Closes: https://lore.kernel.org/netfilter-devel/20250926163318.40d1a502@kernel.org/
Fixes: 117e149e26 ("selftests: netfilter: test nat source port clash resolution interaction with tcp early demux")
Signed-off-by: Florian Westphal <fw@strlen.de>
2025-10-08 13:17:31 +02:00
Florian Westphal
a126ab6b26 selftests: netfilter: nft_fib.sh: fix spurious test failures
Jakub reports spurious failure of nft_fib.sh test.
This is caused by a subtle bug inherited when i moved faulty ping
from one test case to another.

nft_fib.sh not only checks that the fib expression matched, it also
records the number of matches and then validates we have the expected
count.  When I did this it was under the assumption that we would
have 0 to n matching packets.  In case of the failure, the entry has
n+1 matching packets.

This happens because ping_unreachable helper uses "ping -c 1 -w 1",
instead of the intended "-W".  -w alters the meaning of -c (count),
namely, its then treated as number of wanted *replies* instead of
"number of packets to send".

So, in some cases, ping -c 1 -w 1 ends up sending two packets which then
makes the test fail due to the higher-than-expected packet count.

Fix the actual bug (s/-w/-W) and also change the error handling:
1. Show the number of expected packets in the error message
2. Always try to delete the key from the set.
   Else, later test that makes sure we don't have unexpected keys
   in there will always fail as well.

Reported-by: Jakub Kicinski <kuba@kernel.org>
Closes: https://lore.kernel.org/netfilter-devel/20250927090709.0b3cd783@kernel.org/
Fixes: 98287045c9 ("selftests: netfilter: move fib vrf test to nft_fib.sh")
Signed-off-by: Florian Westphal <fw@strlen.de>
2025-10-08 13:17:31 +02:00
Eric Woudstra
bbf0c98b3a bridge: br_vlan_fill_forward_path_pvid: use br_vlan_group_rcu()
net/bridge/br_private.h:1627 suspicious rcu_dereference_protected() usage!
other info that might help us debug this:

rcu_scheduler_active = 2, debug_locks = 1
7 locks held by socat/410:
 #0: ffff88800d7a9c90 (sk_lock-AF_INET){+.+.}-{0:0}, at: inet_stream_connect+0x43/0xa0
 #1: ffffffff9a779900 (rcu_read_lock){....}-{1:3}, at: __ip_queue_xmit+0x62/0x1830
 [..]
 #6: ffffffff9a779900 (rcu_read_lock){....}-{1:3}, at: nf_hook.constprop.0+0x8a/0x440

Call Trace:
 lockdep_rcu_suspicious.cold+0x4f/0xb1
 br_vlan_fill_forward_path_pvid+0x32c/0x410 [bridge]
 br_fill_forward_path+0x7a/0x4d0 [bridge]

Use to correct helper, non _rcu variant requires RTNL mutex.

Fixes: bcf2766b13 ("net: bridge: resolve forwarding path for VLAN tag actions in bridge devices")
Signed-off-by: Eric Woudstra <ericwouds@gmail.com>
Signed-off-by: Florian Westphal <fw@strlen.de>
2025-10-08 13:17:31 +02:00
Fernando Fernandez Mancera
f359b809d5 netfilter: nft_objref: validate objref and objrefmap expressions
Referencing a synproxy stateful object from OUTPUT hook causes kernel
crash due to infinite recursive calls:

BUG: TASK stack guard page was hit at 000000008bda5b8c (stack is 000000003ab1c4a5..00000000494d8b12)
[...]
Call Trace:
 __find_rr_leaf+0x99/0x230
 fib6_table_lookup+0x13b/0x2d0
 ip6_pol_route+0xa4/0x400
 fib6_rule_lookup+0x156/0x240
 ip6_route_output_flags+0xc6/0x150
 __nf_ip6_route+0x23/0x50
 synproxy_send_tcp_ipv6+0x106/0x200
 synproxy_send_client_synack_ipv6+0x1aa/0x1f0
 nft_synproxy_do_eval+0x263/0x310
 nft_do_chain+0x5a8/0x5f0 [nf_tables
 nft_do_chain_inet+0x98/0x110
 nf_hook_slow+0x43/0xc0
 __ip6_local_out+0xf0/0x170
 ip6_local_out+0x17/0x70
 synproxy_send_tcp_ipv6+0x1a2/0x200
 synproxy_send_client_synack_ipv6+0x1aa/0x1f0
[...]

Implement objref and objrefmap expression validate functions.

Currently, only NFT_OBJECT_SYNPROXY object type requires validation.
This will also handle a jump to a chain using a synproxy object from the
OUTPUT hook.

Now when trying to reference a synproxy object in the OUTPUT hook, nft
will produce the following error:

synproxy_crash.nft: Error: Could not process rule: Operation not supported
  synproxy name mysynproxy
  ^^^^^^^^^^^^^^^^^^^^^^^^

Fixes: ee394f96ad ("netfilter: nft_synproxy: add synproxy stateful object support")
Reported-by: Georg Pfuetzenreuter <georg.pfuetzenreuter@suse.com>
Closes: https://bugzilla.suse.com/1250237
Signed-off-by: Fernando Fernandez Mancera <fmancera@suse.de>
Reviewed-by: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: Florian Westphal <fw@strlen.de>
2025-10-08 13:17:25 +02:00
Dmitry Torokhov
8b87f67b4c Merge branch 'next' into for-linus
Prepare input updates for 6.18 merge window.
2025-10-07 21:53:13 -07:00
Marek Vasut
c7866ee0a9 Input: atmel_mxt_ts - allow reset GPIO to sleep
The reset GPIO is not toggled in any critical section where it couldn't
sleep, allow the reset GPIO to sleep. This allows the driver to operate
reset GPIOs connected to I2C GPIO expanders.

Signed-off-by: Marek Vasut <marek.vasut@mailbox.org>
Link: https://lore.kernel.org/r/20251005023335.166483-1-marek.vasut@mailbox.org
Cc: stable@vger.kernel.org
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
2025-10-07 21:51:31 -07:00
Thomas Wismer
2c95a756e0 net: pse-pd: tps23881: Fix current measurement scaling
The TPS23881 improves on the TPS23880 with current sense resistors reduced
from 255 mOhm to 200 mOhm. This has a direct impact on the scaling of the
current measurement. However, the latest TPS23881 data sheet from May 2023
still shows the scaling of the TPS23880 model.

Fixes: 7f076ce3f1 ("net: pse-pd: tps23881: Add support for power limit and measurement features")
Signed-off-by: Thomas Wismer <thomas.wismer@scs.ch>
Acked-by: Kory Maincent <kory.maincent@bootlin.com>
Link: https://patch.msgid.link/20251006204029.7169-2-thomas@wismer.xyz
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2025-10-07 18:30:53 -07:00
Arnd Bergmann
e475fa420e net/mlx5: fix pre-2.40 binutils assembler error
Old binutils versions require a slightly stricter syntax for the .arch_extension
directive and fail with the extra semicolon:

/tmp/cclfMnj9.s:656: Error: unknown architectural extension `simd;'

Drop the semicolon to make it work with all supported toolchain version.

Link: https://lore.kernel.org/all/20251001163655.GA370262@ax162/
Reported-by: Paolo Abeni <pabeni@redhat.com>
Reported-by: Naresh Kamboju <naresh.kamboju@linaro.org>
Suggested-by: Nathan Chancellor <nathan@kernel.org>
Fixes: fd8c821664 ("net/mlx5: Improve write-combining test reliability for ARM64 Grace CPUs")
Signed-off-by: Arnd Bergmann <arnd@arndb.de>
Reviewed-by: Nathan Chancellor <nathan@kernel.org>
Reviewed-by: Patrisious Haddad <phaddad@nvidia.com>
Link: https://patch.msgid.link/20251006115640.497169-1-arnd@kernel.org
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2025-10-07 18:29:22 -07:00
Linus Torvalds
0d97f2067c ARM development for 6.18-rc1
ARM Development changes for 6.18-rc1:
 - Use string choices helpers
 - Add support for HAVE_FUNCTION_GRAPH_FREGS
 -----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCgAdFiEEuNNh8scc2k/wOAE+9OeQG+StrGQFAmjlInoACgkQ9OeQG+St
 rGRrIg/+Iy2o/dCMV5mj++6KE5ZAxLGqbqFzbQqMhSXk57kQM0A+AGVz4rcxv3bf
 ygharyVkx0Po2VP5ghKwhfgskrNmkhPjIKgm3jdO1yLHRwYuyXgCThXu8djNPtwY
 6b3A+tFDxBW14CUmTsAXJnwlCMTpToW7fl/jwsYZFb8qYtAZRygd+k9Pr2EcSj8f
 H/IMUfsmZqoqGTvZCQUy9Em6WDcSZrqz6kIzOToYibhEZdAXHITpOyNofkBqGsSG
 hMG4yCfWSJ1+dI4p3RjQfNlTvZmQxhVb0HGT63CbWw2+DZux1uj7HGezIDib7J6M
 jTTzx0ajtdTGbp4ep9XVCvr2L1qHGoFggN0yZ/UpQJCmCL28HHvZ2bE55CofEP59
 0YbVTWxR74KlmmTZO/RGY+vZEjoXZ0+nNjLAUYiSy9xWPExX2i/KcnjI+eYUfAOj
 ISLWP7+gQ9cH86Uvj+RED57+ZT8Y1xYuY6srSvbUMIAaLVFk1ir7vELY8waKtegk
 zRXhebMK+1n6CikwWRvxFdC6+1jMEh3OyZvOmoaumkYLNJqU+EYXj2nwC80DZI4Q
 RxAiWFL3fS23N/4YDDZsOTZ8WibrmuEHlnoc3sh7qDDZEOxccTU6d1vSxFCas9La
 R6onhAAjXTeRAavNf+4S8SHg6KMHFuAplSpDsjxi+8t0kqRwFT4=
 =cy0V
 -----END PGP SIGNATURE-----

Merge tag 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/rmk/linux

Pull ARM development updates from Russell King:

 - Use string choices helpers

 - Add support for HAVE_FUNCTION_GRAPH_FREGS

* tag 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/rmk/linux:
  ARM: 9457/1: ftrace: Implement HAVE_FUNCTION_GRAPH_FREGS
  ARM: 9456/1: mm: fault: use string choices helper
  ARM: 9454/1: kernel: bios32: use string choices helper
  ARM: 9451/1: mm: l2x0: use string choices helper
2025-10-07 16:20:19 -07:00
Linus Torvalds
a8cdf51cda hardening fixes for v6.18-rc1
- tools headers: rename missed CONFIG_CFI_CLANG in merge (Carlos Llamas)
 
 - kconfig: Avoid prompting for transitional symbols
 -----BEGIN PGP SIGNATURE-----
 
 iHUEABYKAB0WIQRSPkdeREjth1dHnSE2KwveOeQkuwUCaOUxqwAKCRA2KwveOeQk
 u3f1AQCwnl+MlNljx6xBcwI6J8HtCE6blNpzdWkP5fypN9gLFQEAh6eQHCq4U+LN
 ZVmiHJoZmYpkpaaWFerg4kLWdpWVTgc=
 =APBT
 -----END PGP SIGNATURE-----

Merge tag 'hardening-fix1-v6.18-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/kees/linux

Pull hardening fixes from Kees Cook:

 - tools headers: rename missed CONFIG_CFI_CLANG in merge (Carlos
   Llamas)

 - kconfig: Avoid prompting for transitional symbols

* tag 'hardening-fix1-v6.18-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/kees/linux:
  tools headers: kcfi: rename missed CONFIG_CFI_CLANG
  kconfig: Avoid prompting for transitional symbols
2025-10-07 13:04:44 -07:00
Linus Torvalds
16d1ba7c96 dma-mapping fixes for Linux 6.18:
- two small fixes for the recently performed code refactoring (Shigeru
 Yoshida) and missing handling of direction parameter in DMA debug code
 (Petr Tesarik)
 -----BEGIN PGP SIGNATURE-----
 
 iHUEABYIAB0WIQSrngzkoBtlA8uaaJ+Jp1EFxbsSRAUCaOTg+QAKCRCJp1EFxbsS
 RDFkAQCxV0khAeYDuiPdub+9d5XGVGTjBxG1ErYsvDbbsZ3QpAEAhheuAdbMBYU1
 kOwmGuBUY32d0cMz0/4BfKbIzuQs9wE=
 =aE76
 -----END PGP SIGNATURE-----

Merge tag 'dma-mapping-6.18-2025-10-07' of git://git.kernel.org/pub/scm/linux/kernel/git/mszyprowski/linux

Pull dma-mapping fixes from Marek Szyprowski:
 "Two small fixes for the recently performed code refactoring (Shigeru
  Yoshida) and missing handling of direction parameter in DMA debug code
  (Petr Tesarik)"

* tag 'dma-mapping-6.18-2025-10-07' of git://git.kernel.org/pub/scm/linux/kernel/git/mszyprowski/linux:
  dma-mapping: fix direction in dma_alloc direction traces
  kmsan: fix kmsan_handle_dma() to avoid false positives
2025-10-07 12:48:06 -07:00
Linus Torvalds
fdb8d00af9 Char/Misc fixes for 6.18-rc1
Here are some small nvmem and fastrpc fixes for 6.18-rc1.  They missed
 the cut-off to get into 6.17-final, due to me being slow in getting them
 out, my fault, not the maintainers of these subsystems :(
 
 Anyway, better late than never.  Changes included in here are:
   - nvmem fix for automatic module loading
   - fastrpc driver fixes for reported issues
 
 All of these have been in linux-next for weeks (4?) with no reported
 issues.
 
 Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
 -----BEGIN PGP SIGNATURE-----
 
 iG0EABECAC0WIQT0tgzFv3jCIUoxPcsxR9QN2y37KQUCaOUMwg8cZ3JlZ0Brcm9h
 aC5jb20ACgkQMUfUDdst+yletACgvGqfpfSAd3c08ex6F9eDNsQ1aAcAn2p+h0nL
 Xu/ja1YO8z+PBS6ji2Cz
 =ILvk
 -----END PGP SIGNATURE-----

Merge tag 'char-misc-6.18-rc1-2' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc

Pull char/misc fixes from Greg KH:
 "Here are some small nvmem and fastrpc fixes that missed the cut-off to
  get into 6.17-final, due to me being slow in getting them out, my
  fault, not the maintainers of these subsystems :(

  Anyway, better late than never.  Changes included in here are:

   - nvmem fix for automatic module loading

   - fastrpc driver fixes for reported issues

  All of these have been in linux-next for weeks (4?) with no reported
  issues"

* tag 'char-misc-6.18-rc1-2' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc:
  misc: fastrpc: Skip reference for DMA handles
  misc: fastrpc: fix possible map leak in fastrpc_put_args
  misc: fastrpc: Fix fastrpc_map_lookup operation
  misc: fastrpc: Save actual DMA size in fastrpc_map structure
  nvmem: layouts: fix automatic module loading
2025-10-07 12:13:26 -07:00
Linus Torvalds
fbd2e22716 Staging driver fixes for 6.18-rc1
Here are some staging driver fixes that missed 6.17-final due to my
 travel schedule.  They fix a number of reported issues in the axis-fifo
 driver, one of which was just independently discovered by someone else
 today so someone is looking at this code.
 
 All of these fixes have been in linux-next for many weeks with no
 reported issues.
 
 Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
 -----BEGIN PGP SIGNATURE-----
 
 iG0EABECAC0WIQT0tgzFv3jCIUoxPcsxR9QN2y37KQUCaOUPzw8cZ3JlZ0Brcm9h
 aC5jb20ACgkQMUfUDdst+ynK1wCgq1Nsc+QSYFnReib162tPcezuTBkAoL2Gnuik
 9cLFKT3Dj/5kEF0jiSjh
 =BUdt
 -----END PGP SIGNATURE-----

Merge tag 'staging-6.18-rc1-2' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/staging

Pull staging driver fixes from Greg KH:
 "Here are some staging driver fixes that missed 6.17-final due to my
  travel schedule. They fix a number of reported issues in the axis-fifo
  driver, one of which was just independently discovered by someone else
  today so someone is looking at this code.

  All of these fixes have been in linux-next for many weeks with no
  reported issues"

* tag 'staging-6.18-rc1-2' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/staging:
  staging: axis-fifo: flush RX FIFO on read errors
  staging: axis-fifo: fix TX handling on copy_from_user() failure
  staging: axis-fifo: fix maximum TX packet length check
2025-10-07 11:41:06 -07:00
Linus Torvalds
3d15d6c1b3 TTY driver fix for 6.18-rc1
Here is a single driver fix for the qcom_geni_serial driver for
 6.18-rc1.  It has been in my tree for weeks, but missed being sent to
 you for 6.17-final due to travel on my side.
 
 This fixes a reported regression for this driver that prevents 6.17 from
 working properly on this platform.
 
 It has been in linux-next for many weeks with no reported issues.
 
 Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
 -----BEGIN PGP SIGNATURE-----
 
 iG0EABECAC0WIQT0tgzFv3jCIUoxPcsxR9QN2y37KQUCaOUQrA8cZ3JlZ0Brcm9h
 aC5jb20ACgkQMUfUDdst+ymmXwCgj5hLg2MHRlvZ+aCD0K/S2Qt4eqEAn32POqfZ
 UntJ9O23oHW1+RmAvBB7
 =zKb3
 -----END PGP SIGNATURE-----

Merge tag 'tty-6.18-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/tty

Pull tty driver fix from Greg KH:
 "Here is a single driver fix for the qcom_geni_serial driver. It has
  been in my tree for weeks, but missed being sent to you for 6.17-final
  due to travel on my side.

  This fixes a reported regression for this driver that prevents 6.17
  from working properly on this platform.

  It has been in linux-next for many weeks with no reported issues"

* tag 'tty-6.18-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/tty:
  serial: qcom-geni: Fix blocked task
2025-10-07 11:36:01 -07:00
Linus Torvalds
56019d4ff8 More thermal control updates for 6.18-rc1
Fix RZ/G3E driver introduction fall-out (Geert Uytterhoeven) and
 improve the compilation and installation of the thermal library
 for user space (Emil Dahl Juhl and Sascha Hauer)
 -----BEGIN PGP SIGNATURE-----
 
 iQFGBAABCAAwFiEEcM8Aw/RY0dgsiRUR7l+9nS/U47UFAmjk+BUSHHJqd0Byand5
 c29ja2kubmV0AAoJEO5fvZ0v1OO16oEH/jAflHmItnOpFOQ59LTODD29OsUYffiN
 pEqd/qveu7Hs9Rud5UPEVqvItNfPtCB2mxmD1dYtb0VpB1cTtAEwm1AiO1B35cw0
 ycBP4BibEDBg97eHFj4maeKUAa+0xa4IlNVJRdf9b0RdZUkilTq17Iof0RhYFJqC
 0Kq838KEUz9WuEFUZCoVKXLkCSexPekjZXDvVeCP9nrlD1b9R656dPcQ6fHBwxrI
 5m2jGUkSVkwl/wz2zU1XDNeGALQNGMbM1zZGPXIJbl2fRCFEzsakQALbKelobTQ8
 KUnftp4pTfkgjVAMyDwXcmTbJ3Gc0WOfbSDCDTR6jpHC1PW2pcNpBdA=
 =NfCR
 -----END PGP SIGNATURE-----

Merge tag 'thermal-6.18-rc1-2' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm

Pull more thermal control updates from Rafael Wysocki:
 "Fix RZ/G3E driver introduction fall-out (Geert Uytterhoeven) and
  improve the compilation and installation of the thermal library for
  user space (Emil Dahl Juhl and Sascha Hauer)"

* tag 'thermal-6.18-rc1-2' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm:
  tools: lib: thermal: expose thermal_exit symbols
  tools: lib: thermal: don't preserve owner in install
  tools: lib: thermal: use pkg-config to locate libnl3
  thermal: renesas: Fix RZ/G3E fall-out
2025-10-07 11:18:54 -07:00
Kuniyuki Iwashima
f7dfa0f31b slub: Don't call lockdep_unregister_key() for immature kmem_cache.
syzbot reported the lockdep splat below in __kmem_cache_release(). [0]

The problem is that __kmem_cache_release() could be called from
do_kmem_cache_create() before init_kmem_cache_cpus() registers
the lockdep key.

Let's perform lockdep_unregister_key() only when init_kmem_cache_cpus()
has been done, which we can determine by checking s->cpu_slab

[0]:
WARNING: CPU: 1 PID: 6128 at kernel/locking/lockdep.c:6606 lockdep_unregister_key+0x2ca/0x310 kernel/locking/lockdep.c:6606
Modules linked in:
CPU: 1 UID: 0 PID: 6128 Comm: syz.4.21 Not tainted syzkaller #0 PREEMPT_{RT,(full)}
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/18/2025
RIP: 0010:lockdep_unregister_key+0x2ca/0x310 kernel/locking/lockdep.c:6606
Code: 50 e4 0f 48 3b 44 24 10 0f 84 26 fe ff ff e8 bd cd 17 09 e8 e8 ce 17 09 41 f7 c7 00 02 00 00 74 bd fb 40 84 ed 75 bc eb cd 90 <0f> 0b 90 e9 19 ff ff ff 90 0f 0b 90 e9 2a ff ff ff 48 c7 c7 d0 ac
RSP: 0018:ffffc90003e870d0 EFLAGS: 00010002
RAX: eb1525397f5bdf00 RBX: ffff88803c121148 RCX: 1ffff920007d0dfc
RDX: 0000000000000000 RSI: ffffffff8acb1500 RDI: ffffffff8b1dd0e0
RBP: 00000000ffffffea R08: ffffffff8eb5aa37 R09: 1ffffffff1d6b546
R10: dffffc0000000000 R11: fffffbfff1d6b547 R12: 0000000000000000
R13: ffff88814d1b8900 R14: 0000000000000000 R15: 0000000000000203
FS:  00007f773f75e6c0(0000) GS:ffff88812712f000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007ffdaea3af52 CR3: 000000003a5ca000 CR4: 00000000003526f0
Call Trace:
 <TASK>
 __kmem_cache_release+0xe3/0x1e0 mm/slub.c:7696
 do_kmem_cache_create+0x74e/0x790 mm/slub.c:8575
 create_cache mm/slab_common.c:242 [inline]
 __kmem_cache_create_args+0x1ce/0x330 mm/slab_common.c:340
 nfsd_file_cache_init+0x1d6/0x530 fs/nfsd/filecache.c:816
 nfsd_startup_generic fs/nfsd/nfssvc.c:282 [inline]
 nfsd_startup_net fs/nfsd/nfssvc.c:377 [inline]
 nfsd_svc+0x393/0x900 fs/nfsd/nfssvc.c:786
 nfsd_nl_threads_set_doit+0x84a/0x960 fs/nfsd/nfsctl.c:1639
 genl_family_rcv_msg_doit+0x212/0x300 net/netlink/genetlink.c:1115
 genl_family_rcv_msg net/netlink/genetlink.c:1195 [inline]
 genl_rcv_msg+0x60e/0x790 net/netlink/genetlink.c:1210
 netlink_rcv_skb+0x208/0x470 net/netlink/af_netlink.c:2552
 genl_rcv+0x28/0x40 net/netlink/genetlink.c:1219
 netlink_unicast_kernel net/netlink/af_netlink.c:1320 [inline]
 netlink_unicast+0x846/0xa10 net/netlink/af_netlink.c:1346
 netlink_sendmsg+0x805/0xb30 net/netlink/af_netlink.c:1896
 sock_sendmsg_nosec net/socket.c:727 [inline]
 __sock_sendmsg+0x219/0x270 net/socket.c:742
 ____sys_sendmsg+0x508/0x820 net/socket.c:2630
 ___sys_sendmsg+0x21f/0x2a0 net/socket.c:2684
 __sys_sendmsg net/socket.c:2716 [inline]
 __do_sys_sendmsg net/socket.c:2721 [inline]
 __se_sys_sendmsg net/socket.c:2719 [inline]
 __x64_sys_sendmsg+0x1a1/0x260 net/socket.c:2719
 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
 do_syscall_64+0xfa/0x3b0 arch/x86/entry/syscall_64.c:94
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f77400eeec9
Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007f773f75e038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e
RAX: ffffffffffffffda RBX: 00007f7740345fa0 RCX: 00007f77400eeec9
RDX: 0000000000008004 RSI: 0000200000000180 RDI: 0000000000000006
RBP: 00007f7740171f91 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007f7740346038 R14: 00007f7740345fa0 R15: 00007ffce616f8d8
 </TASK>

[alexei.starovoitov@gmail.com: simplify the fix]
Link: https://lore.kernel.org/all/20251007052534.2776661-1-kuniyu@google.com/
Fixes: 83382af9dd ("slab: Make slub local_(try)lock more precise for LOCKDEP")
Reported-by: syzbot+a6f4d69b9b23404bbabf@syzkaller.appspotmail.com
Closes: https://lore.kernel.org/all/68e4a3d1.a00a0220.298cc0.0471.GAE@google.com/
Signed-off-by: Kuniyuki Iwashima <kuniyu@google.com>
Signed-off-by: Vlastimil Babka <vbabka@suse.cz>
2025-10-07 20:06:02 +02:00
Linus Torvalds
89b59f0979 More ACPI support updates for 6.18-rc1
- Add missing synchronization between interface updates in the ACPI
    battery driver (Rafael Wysocki)
 
  - Remove open coded check for cpu_feature_enabled() from
    acpi_processor_power_init_bm_check() (Mario Limonciello)
 
  - Remove redundant rcu_read_lock/unlock() under spinlock from
    ghes_notify_hed() in the ACPI APEI support code (pengdonglin)
 
  - Make the .get_next_child_node() callback in the ACPI fwnode backend
    skip ACPI devices that are not present for consistency with the
    analogous callback in the OF fwnode backend (Sakari Ailus)
 -----BEGIN PGP SIGNATURE-----
 
 iQFGBAABCAAwFiEEcM8Aw/RY0dgsiRUR7l+9nS/U47UFAmjk9loSHHJqd0Byand5
 c29ja2kubmV0AAoJEO5fvZ0v1OO1zEwH/1b6+0ZA4EAG+TtPylVA5FptHUq9AUHW
 rkk/bCjCaTfDsI2jffs3Ui1k4Gmwtr370EfwoXKx8dc8/4AQJZioqVIhbozXMDTx
 0Hviylc8eTe6peeUJKl6RD/HrE38cOemlfX2M5t/2rENfBFp9ZI9KMrVpvermvX7
 Nba+r0+mK75At90EsI25JzqxUuyW12A5wYORfXcznugEL69ovupqK3U01E/TEWWb
 pqZgHbdMgtnP4F0hh2gDMDbWwxgEcm0lGkLoZ/w1UxKcw+wgeT0NaEP+c2+XiGrw
 iXsXF8ZcfrZcq22rNR0SQ7kS0F2b9q6lqjkIfSKbHqqqaY8pXEBmEys=
 =BQsI
 -----END PGP SIGNATURE-----

Merge tag 'acpi-6.18-rc1-2' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm

Pull more ACPI updates from Rafael Wysocki:
 "These fix a driver bug, clean up two pieces of code and improve the
  fwnode API consistency:

   - Add missing synchronization between interface updates in the ACPI
     battery driver (Rafael Wysocki)

   - Remove open coded check for cpu_feature_enabled() from
     acpi_processor_power_init_bm_check() (Mario Limonciello)

   - Remove redundant rcu_read_lock/unlock() under spinlock from
     ghes_notify_hed() in the ACPI APEI support code (pengdonglin)

   - Make the .get_next_child_node() callback in the ACPI fwnode backend
     skip ACPI devices that are not present for consistency with the
     analogous callback in the OF fwnode backend (Sakari Ailus)"

* tag 'acpi-6.18-rc1-2' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm:
  ACPI: property: Return present device nodes only on fwnode interface
  ACPI: APEI: Remove redundant rcu_read_lock/unlock() under spinlock
  ACPI: battery: Add synchronization between interface updates
  x86/acpi/cstate: Remove open coded check for cpu_feature_enabled()
2025-10-07 09:45:07 -07:00
Linus Torvalds
abdf766d14 More power management updates for 6.18-rc1
- Make cpufreq drivers setting the default CPU transition latency to
    CPUFREQ_ETERNAL specify a proper default transition latency value
    instead which addresses a regression introduced during the 6.6 cycle
    that broke CPUFREQ_ETERNAL handling (Rafael Wysocki)
 
  - Make the cpufreq CPPC driver use a proper transition delay value
    when CPUFREQ_ETERNAL is returned by cppc_get_transition_latency() to
    indicate an error condition (Rafael Wysocki)
 
  - Make cppc_get_transition_latency() return a negative error code to
    indicate error conditions instead of using CPUFREQ_ETERNAL for this
    purpose and drop CPUFREQ_ETERNAL that has no other users (Rafael
    Wysocki, Gopi Krishna Menon)
 
  - Fix device leak in the mediatek cpufreq driver (Johan Hovold)
 
  - Set target frequency on all CPUs sharing a policy during frequency
    updates in the tegra186 cpufreq driver and make it initialize all
    cores to max frequencies (Aaron Kling)
 
  - Rust cpufreq helper cleanup (Thorsten Blum)
 
  - Make pm_runtime_put*() family of functions return 1 when the
    given device is already suspended which is consistent with the
    documentation (Brian Norris)
 
  - Add basic kunit tests for runtime PM API contracts and update return
    values in kerneldoc comments for the runtime PM API (Brian Norris,
    Dan Carpenter)
 
  - Add auto-cleanup macros for runtime PM "resume and get" and "get
    without resume" operations, use one of them in the PCI core and
    drop the existing "free" macro introduced for similar purpose, but
    somewhat cumbersome to use (Rafael Wysocki)
 
  - Make the core power management code avoid waiting on device links
    marked as SYNC_STATE_ONLY which is consistent with the handling of
    those device links elsewhere (Pin-yen Lin)
 -----BEGIN PGP SIGNATURE-----
 
 iQFGBAABCAAwFiEEcM8Aw/RY0dgsiRUR7l+9nS/U47UFAmjk8hUSHHJqd0Byand5
 c29ja2kubmV0AAoJEO5fvZ0v1OO1PtgH/0AwdSCX8uI44n/EnyjLlQFWOdNSpXI4
 zAIReNLPP0skWrNwf5ivHYKPEWSeo0o0OjHiCjdTCC3uT8FxCLmjjlPS43zhhHem
 41YQFRJb6GpwD86Vog25q5GSPOQORvRGYV+ZGlMesah0cE4qh4LxgVSNtftm9z7b
 CjMFOeFEAAHFNGEEX4U2/GE+PFdbBGMjSDSfyLazKAKjZS436SOGvpP7NUTt0m9C
 kxO2JLJuQXph5lqyzDRAUu1yOseEwM/f6Y5wWs1z/T5GeIacub/KypZlxhsjWALf
 VxdXfvvLehidS747pxOzXPFhP8sXw1a4XdBNqlVGi/YjF7S9OuAxRMg=
 =RfuO
 -----END PGP SIGNATURE-----

Merge tag 'pm-6.18-rc1-2' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm

Pull more power management updates from Rafael Wysocki:
 "These are cpufreq fixes and cleanups on top of the material merged
  previously, a power management core code fix and updates of the
  runtime PM framework including unit tests, documentation updates and
  introduction of auto-cleanup macros for runtime PM "resume and get"
  and "get without resuming" operations.

  Specifics:

   - Make cpufreq drivers setting the default CPU transition latency to
     CPUFREQ_ETERNAL specify a proper default transition latency value
     instead which addresses a regression introduced during the 6.6
     cycle that broke CPUFREQ_ETERNAL handling (Rafael Wysocki)

   - Make the cpufreq CPPC driver use a proper transition delay value
     when CPUFREQ_ETERNAL is returned by cppc_get_transition_latency()
     to indicate an error condition (Rafael Wysocki)

   - Make cppc_get_transition_latency() return a negative error code to
     indicate error conditions instead of using CPUFREQ_ETERNAL for this
     purpose and drop CPUFREQ_ETERNAL that has no other users (Rafael
     Wysocki, Gopi Krishna Menon)

   - Fix device leak in the mediatek cpufreq driver (Johan Hovold)

   - Set target frequency on all CPUs sharing a policy during frequency
     updates in the tegra186 cpufreq driver and make it initialize all
     cores to max frequencies (Aaron Kling)

   - Rust cpufreq helper cleanup (Thorsten Blum)

   - Make pm_runtime_put*() family of functions return 1 when the given
     device is already suspended which is consistent with the
     documentation (Brian Norris)

   - Add basic kunit tests for runtime PM API contracts and update
     return values in kerneldoc comments for the runtime PM API (Brian
     Norris, Dan Carpenter)

   - Add auto-cleanup macros for runtime PM "resume and get" and "get
     without resume" operations, use one of them in the PCI core and
     drop the existing "free" macro introduced for similar purpose, but
     somewhat cumbersome to use (Rafael Wysocki)

   - Make the core power management code avoid waiting on device links
     marked as SYNC_STATE_ONLY which is consistent with the handling of
     those device links elsewhere (Pin-yen Lin)"

* tag 'pm-6.18-rc1-2' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm:
  docs/zh_CN: Fix malformed table
  docs/zh_TW: Fix malformed table
  PM: runtime: Fix error checking for kunit_device_register()
  PM: runtime: Introduce one more usage counter guard
  cpufreq: Drop unused symbol CPUFREQ_ETERNAL
  ACPI: CPPC: Do not use CPUFREQ_ETERNAL as an error value
  cpufreq: CPPC: Avoid using CPUFREQ_ETERNAL as transition delay
  cpufreq: Make drivers using CPUFREQ_ETERNAL specify transition latency
  PM: runtime: Drop DEFINE_FREE() for pm_runtime_put()
  PCI/sysfs: Use runtime PM guard macro for auto-cleanup
  PM: runtime: Add auto-cleanup macros for "resume and get" operations
  cpufreq: tegra186: Initialize all cores to max frequencies
  cpufreq: tegra186: Set target frequency for all cpus in policy
  rust: cpufreq: streamline find_supply_names
  cpufreq: mediatek: fix device leak on probe failure
  PM: sleep: Do not wait on SYNC_STATE_ONLY device links
  PM: runtime: Update kerneldoc return codes
  PM: runtime: Make put{,_sync}() return 1 when already suspended
  PM: runtime: Add basic kunit tests for API contracts
2025-10-07 09:39:51 -07:00
Linus Torvalds
522ba450b5 There's a bunch of patches here across drivers/clk/ to migrate drivers to use
struct clk_ops::determine_rate() instead of the round_rate() one so that we can
 remove the round_rate clk_op entirely. Brian has taken up that task which
 nobody else has wanted to do for close to a decade. Thanks Brian! This is all
 prerequisite work to get to the real task of improving the clk rate setting
 process. Once we have determine_rate() used everywhere, we'll be able to do
 things like chain the rate request structs in linked lists to order the rate
 setting operations or add more parameters without having to change every clk
 driver in existence. It's also nice to not have multiple ways to do something
 which just causes confusion for clk driver authors. Overall I'm glad this is
 getting done.
 
 Beyond this change we also have a tweak to the clk_lookup() function in the
 core framework to use hashing on the clk name instead of a clk tree walk with
 string comparisons. We _still_ rely on the clk name to be unique, because
 historically we've used globally unique strings to describe the clk tree
 topology. This tree walk becomes increasingly slow as more clks are added to
 the system. Searching from the roots for a duplicate is simple but pretty dumb
 and it wastes boot time so we're using a hash table as an improvement. Ideally
 we wouldn't rely on the strings to be unique at all, relegating them to simply
 debug information, but that is future work that will likely require some sort
 of Kconfig knob indicating strings aren't used for topology description.
 
 Outside of the core framework changes we have the usual new SoC support and
 fixes to clk drivers for things that were discovered once the clks were used by
 consumer drivers. Nothing in particular is jumping out at me in the "misc"
 pile, except maybe the Amlogic driver that has gone through a refactoring. That
 series got a fix from testing in -next though so it seems likely that things
 have been getting good test coverage for a couple weeks already.
 -----BEGIN PGP SIGNATURE-----
 
 iQJIBAABCAAyFiEE9L57QeeUxqYDyoaDrQKIl8bklSUFAmjkoQAUHHN3Ym95ZEBj
 aHJvbWl1bS5vcmcACgkQrQKIl8bklSWfWBAA3cjpOX/qOBDPmYPvV+WgiTPcmnw+
 PaMiGNqIWctnJiuYYUNVCfBIvTk9i1vYSgEosHAOqjXQV+7Ee31420xn5RYr6Zen
 cfeD58SJwZ1JVidvxwWclC5pnfTVXBC3wlHILCFHhckaGOT2k3d0ryN2io2TYuRx
 t9JsoW73YW+bmOWoFDHPMp4ow5Q87aa8k3/srhIP67tw2mzJp8Wp+EG0t0PVFF7Z
 aboz+QPwyT2YOLFKJxm6nTLb9FRVq3QLSO3Ek0+0TYXfRqkfegvGR+M82P4Jq2Y3
 osmTsumWeI170iAETmx2Py+uUV8MmnvPFQ6mxrGoXYyOx9SclN+SC86cOsi+RsgD
 830CHupZ/TrN3+DGyX6WVx1j7XKCplKhFXrXiFbkPnj4nJwi5UgiJrjAjPy78+iX
 LyvKfeT9ooAAVBVRMyZIWGF3kuQf5qHFMps5fwJk/j3R9yMiI10SVhruhYij1qAi
 EEisj955xqdyZV2gq85E7zHbjySA0nvNABn3NVUQOKPYQqtpglqXKGJuXZ1//9pa
 fZM2a3fH7w4fwH1x06FKut9zf1AZUgyasJPtgyCT9dpN+pcoNmJfoH3T42MCItbm
 XKEYgnv/kQT+M+GokBUfg8bJY5uPnPLa/f6aAAIAKGZV0HXAqz2q73SDlW7KUQmr
 vhgA4MRH4Vqviic=
 =fjY4
 -----END PGP SIGNATURE-----

Merge tag 'clk-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/clk/linux

Pull clk updates from Stephen Boyd:
 "There's a bunch of patches here across drivers/clk/ to migrate drivers
  to use struct clk_ops::determine_rate() instead of the round_rate()
  one so that we can remove the round_rate clk_op entirely. Brian has
  taken up that task which nobody else has wanted to do for close to a
  decade. Thanks Brian!

  This is all prerequisite work to get to the real task of improving the
  clk rate setting process. Once we have determine_rate() used
  everywhere, we'll be able to do things like chain the rate request
  structs in linked lists to order the rate setting operations or add
  more parameters without having to change every clk driver in
  existence. It's also nice to not have multiple ways to do something
  which just causes confusion for clk driver authors. Overall I'm glad
  this is getting done.

  Beyond this change we also have a tweak to the clk_lookup() function
  in the core framework to use hashing on the clk name instead of a clk
  tree walk with string comparisons. We _still_ rely on the clk name to
  be unique, because historically we've used globally unique strings to
  describe the clk tree topology. This tree walk becomes increasingly
  slow as more clks are added to the system. Searching from the roots
  for a duplicate is simple but pretty dumb and it wastes boot time so
  we're using a hash table as an improvement. Ideally we wouldn't rely
  on the strings to be unique at all, relegating them to simply debug
  information, but that is future work that will likely require some
  sort of Kconfig knob indicating strings aren't used for topology
  description.

  Outside of the core framework changes we have the usual new SoC
  support and fixes to clk drivers for things that were discovered once
  the clks were used by consumer drivers. Nothing in particular is
  jumping out at me in the "misc" pile, except maybe the Amlogic driver
  that has gone through a refactoring. That series got a fix from
  testing in -next though so it seems likely that things have been
  getting good test coverage for a couple weeks already"

* tag 'clk-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/clk/linux: (299 commits)
  clk: microchip: core: remove duplicate roclk_determine_rate()
  reset: aspeed: register AST2700 reset auxiliary bus device
  dt-bindings: clock: ast2700: modify soc0/1 clock define
  clk: tegra: do not overallocate memory for bpmp clocks
  clk: ep93xx: Use int type to store negative error codes
  clk: nxp: Fix pll0 rate check condition in LPC18xx CGU driver
  clk: loongson2: Add clock definitions for Loongson-2K0300 SoC
  clk: loongson2: Avoid hardcoding firmware name of the reference clock
  clk: loongson2: Allow zero divisors for dividers
  clk: loongson2: Support scale clocks with an alternative mode
  clk: loongson2: Allow specifying clock flags for gate clock
  dt-bindings: clock: loongson2: Add Loongson-2K0300 compatible
  clk: clocking-wizard: Fix output clock register offset for Versal platforms
  clk: xilinx: Optimize divisor search in clk_wzrd_get_divisors_ver()
  clk: mmp: pxa1908: Instantiate power driver through auxiliary bus
  clk: s2mps11: add support for S2MPG10 PMIC clock
  dt-bindings: clock: samsung,s2mps11: add s2mpg10
  dt-bindings: stm32: cosmetic fixes for STM32MP25 clock and reset bindings
  clk: stm32: introduce clocks for STM32MP21 platform
  dt-bindings: stm32: add STM32MP21 clocks and reset bindings
  ...
2025-10-07 09:28:37 -07:00