aboutsummaryrefslogtreecommitdiffstatshomepage
AgeCommit message (Collapse)AuthorFilesLines
2025-05-30Merge tag 'acpi-6.16-rc1-2' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pmLinus Torvalds3-3/+5
Pull ACPI fixes from Rafael Wysocki: "These address issues introduced by recent ACPI changes merged previously: - Unbreak acpi_ut_safe_strncpy() by restoring its previous behavior changed incorrectly by a recent update (Ahmed Salem) - Make a new static checker warning in the recently introduced ACPI MRRM table parser go away (Dan Carpenter) - Fix ACPI table referece leak in error path of einj_probe() (Dan Carpenter)" * tag 'acpi-6.16-rc1-2' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm: ACPICA: Switch back to using strncpy() in acpi_ut_safe_strncpy() ACPI: MRRM: Silence error code static checker warning ACPI: APEI: EINJ: Clean up on error in einj_probe()
2025-05-30Merge tag 'pm-6.16-rc1-2' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pmLinus Torvalds20-22/+3624
Pull more power management updates from Rafael Wysocki: "These revert an x86 commit that introduced a nasty power regression on some systems, fix PSCI cpuidle driver and ACPI cpufreq driver regressions, add Rust abstractions for cpufreq, OPP, clk, and cpumasks, add a Rust-based cpufreq-dt driver, and do a minor SCMI cpufreq driver cleanup: - Revert an x86 commit that went into 6.15 and caused idle power, including power in suspend-to-idle, to rise rather dramatically on systems booting with "nosmt" in the kernel command line (Rafael Wysocki) - Prevent freeing an uninitialized pointer in error path of dt_idle_state_present() in the PSCI cpuidle driver (Dan Carpenter) - Use KHz as the nominal_freq units in get_max_boost_ratio() in the ACPI cpufreq driver (iGautham Shenoy) - Add Rust abstractions for CPUFreq framework (Viresh Kumar) - Add Rust abstractions for OPP framework (Viresh Kumar) - Add basic Rust abstractions for Clk and Cpumask frameworks (Viresh Kumar) - Clean up the SCMI cpufreq driver somewhat (Mike Tipton)" * tag 'pm-6.16-rc1-2' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm: (21 commits) Revert "x86/smp: Eliminate mwait_play_dead_cpuid_hint()" acpi-cpufreq: Fix nominal_freq units to KHz in get_max_boost_ratio() rust: opp: Move `cfg(CONFIG_OF)` attribute to the top of doc test cpuidle: psci: Fix uninitialized variable in dt_idle_state_present() rust: opp: Make the doctest example depend on CONFIG_OF cpufreq: scmi: Skip SCMI devices that aren't used by the CPUs cpufreq: Add Rust-based cpufreq-dt driver rust: opp: Extend OPP abstractions with cpufreq support rust: cpufreq: Extend abstractions for driver registration rust: cpufreq: Extend abstractions for policy and driver ops rust: cpufreq: Add initial abstractions for cpufreq framework rust: opp: Add abstractions for the configuration options rust: opp: Add abstractions for the OPP table rust: opp: Add initial abstractions for OPP framework rust: cpu: Add from_cpu() rust: macros: enable use of hyphens in module names rust: clk: Add initial abstractions rust: clk: Add helpers for Rust code MAINTAINERS: Add entry for Rust cpumask API rust: cpumask: Add initial abstractions ...
2025-05-30Merge branch 'pm-cpuidle'Rafael J. Wysocki2-12/+51
Fix an issue in the PSCI cpuidle driver introduced recently and a nasty x86 power regression introduced in 6.15: - Prevent freeing an uninitialized pointer in error path of dt_idle_state_present() in the PSCI cpuidle driver (Dan Carpenter). - Revert an x86 commit that went into 6.15 and caused idle power, including power in suspend-to-idle, to rise rather dramatically on systems booting with "nosmt" in the kernel command line (Rafael Wysocki). * pm-cpuidle: Revert "x86/smp: Eliminate mwait_play_dead_cpuid_hint()" cpuidle: psci: Fix uninitialized variable in dt_idle_state_present()
2025-05-30Merge branch 'pm-cpufreq'Rafael J. Wysocki18-10/+3573
Merge Rust support for cpufreq and OPP, a new Rust-based cpufreq-dt driver, an SCMI cpufreq driver cleanup, and an ACPI cpufreq driver regression fix: - Add Rust abstractions for CPUFreq framework (Viresh Kumar). - Add Rust abstractions for OPP framework (Viresh Kumar). - Add basic Rust abstractions for Clk and Cpumask frameworks (Viresh Kumar). - Clean up the SCMI cpufreq driver somewhat (Mike Tipton). - Use KHz as the nominal_freq units in get_max_boost_ratio() in the ACPI cpufreq driver (iGautham Shenoy). * pm-cpufreq: acpi-cpufreq: Fix nominal_freq units to KHz in get_max_boost_ratio() rust: opp: Move `cfg(CONFIG_OF)` attribute to the top of doc test rust: opp: Make the doctest example depend on CONFIG_OF cpufreq: scmi: Skip SCMI devices that aren't used by the CPUs cpufreq: Add Rust-based cpufreq-dt driver rust: opp: Extend OPP abstractions with cpufreq support rust: cpufreq: Extend abstractions for driver registration rust: cpufreq: Extend abstractions for policy and driver ops rust: cpufreq: Add initial abstractions for cpufreq framework rust: opp: Add abstractions for the configuration options rust: opp: Add abstractions for the OPP table rust: opp: Add initial abstractions for OPP framework rust: cpu: Add from_cpu() rust: macros: enable use of hyphens in module names rust: clk: Add initial abstractions rust: clk: Add helpers for Rust code MAINTAINERS: Add entry for Rust cpumask API rust: cpumask: Add initial abstractions rust: cpumask: Add few more helpers
2025-05-30Merge branches 'acpica', 'acpi-tables' and 'acpi-apei'Rafael J. Wysocki3-3/+5
Merge fixes for issues introduced by recent ACPI changes merged previously: - Unbreak acpi_ut_safe_strncpy() by restoring its previous behavior changed incorrectly by a recent update (Ahmed Salem). - Make a new static checker warning in the recently introduced ACPI MRRM table parser go away (Dan Carpenter). - Fix ACPI table referece leak in error path of einj_probe() (Dan Carpenter). * acpica: ACPICA: Switch back to using strncpy() in acpi_ut_safe_strncpy() * acpi-tables: ACPI: MRRM: Silence error code static checker warning * acpi-apei: ACPI: APEI: EINJ: Clean up on error in einj_probe()
2025-05-30Merge tag 'iommu-updates-v6.16' of git://git.kernel.org/pub/scm/linux/kernel/git/iommu/linuxLinus Torvalds61-1356/+1856
Pull iommu updates from Joerg Roedel: "Core: - Introduction of iommu-pages infrastructure to consolitate page-table allocation code among hardware drivers. This is ground-work for more generalization in the future - Remove IOMMU_DEV_FEAT_SVA and IOMMU_DEV_FEAT_IOPF feature flags - Convert virtio-iommu to domain_alloc_paging() - KConfig cleanups - Some small fixes for possible overflows and race conditions Intel VT-d driver: - Restore WO permissions on second-level paging entries - Use ida to manage domain id - Miscellaneous cleanups AMD-Vi: - Make sure notifiers finish running before module unload - Add support for HTRangeIgnore feature - Allow matching ACPI HID devices without matching UIDs ARM-SMMU: - SMMUv2: - Recognise the compatible string for SAR2130P MDSS in the Qualcomm driver, as this device requires an identity domain - Fix Adreno stall handling so that GPU debugging is more robust and doesn't e.g. result in deadlock - SMMUv3: - Fix ->attach_dev() error reporting for unrecognised domains - IO-pgtable: - Allow clients (notably, drivers that process requests from userspace) to silence warnings when mapping an already-mapped IOVA S390: - Add support for additional table regions Mediatek: - Add support for MT6893 MM IOMMU And some smaller fixes and improvements in various other drivers" * tag 'iommu-updates-v6.16' of git://git.kernel.org/pub/scm/linux/kernel/git/iommu/linux: (75 commits) iommu/vt-d: Restore context entry setup order for aliased devices iommu/mediatek: Fix compatible typo for mediatek,mt6893-iommu-mm iommu/arm-smmu-qcom: Make set_stall work when the device is on iommu/arm-smmu: Move handing of RESUME to the context fault handler iommu/arm-smmu-qcom: Enable threaded IRQ for Adreno SMMUv2/MMU500 iommu/io-pgtable-arm: Add quirk to quiet WARN_ON() iommu: Clear the freelist after iommu_put_pages_list() iommu/vt-d: Change dmar_ats_supported() to return boolean iommu/vt-d: Eliminate pci_physfn() in dmar_find_matched_satc_unit() iommu/vt-d: Replace spin_lock with mutex to protect domain ida iommu/vt-d: Use ida to manage domain id iommu/vt-d: Restore WO permissions on second-level paging entries iommu/amd: Allow matching ACPI HID devices without matching UIDs iommu: make inclusion of arm/arm-smmu-v3 directory conditional iommu: make inclusion of riscv directory conditional iommu: make inclusion of amd directory conditional iommu: make inclusion of intel directory conditional iommu: remove duplicate selection of DMAR_TABLE iommu/fsl_pamu: remove trailing space after \n iommu/arm-smmu-qcom: Add SAR2130P MDSS compatible ...
2025-05-30Bluetooth: L2CAP: Fix not responding with L2CAP_CR_LE_ENCRYPTIONLuiz Augusto von Dentz1-1/+2
Depending on the security set the response to L2CAP_LE_CONN_REQ shall be just L2CAP_CR_LE_ENCRYPTION if only encryption when BT_SECURITY_MEDIUM is selected since that means security mode 2 which doesn't require authentication which is something that is covered in the qualification test L2CAP/LE/CFC/BV-25-C. Link: https://github.com/bluez/bluez/issues/1270 Fixes: 27e2d4c8d28b ("Bluetooth: Add basic LE L2CAP connect request receiving support") Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
2025-05-30Bluetooth: hci_qca: move the SoC type check to the right placeBartosz Golaszewski1-7/+7
Commit 3d05fc82237a ("Bluetooth: qca: set power_ctrl_enabled on NULL returned by gpiod_get_optional()") accidentally changed the prevous behavior where power control would be disabled without the BT_EN GPIO only on QCA_WCN6750 and QCA_WCN6855 while also getting the error check wrong. We should treat every IS_ERR() return value from devm_gpiod_get_optional() as a reason to bail-out while we should only set power_ctrl_enabled to false on the two models mentioned above. While at it: use dev_err_probe() to save a LOC. Cc: stable@vger.kernel.org Fixes: 3d05fc82237a ("Bluetooth: qca: set power_ctrl_enabled on NULL returned by gpiod_get_optional()") Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski@linaro.org> Reviewed-by: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org> Tested-by: Hsin-chen Chuang <chharry@chromium.org> Reviewed-by: Hsin-chen Chuang <chharry@chromium.org> Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
2025-05-30Bluetooth: btnxpuart: Fix missing devm_request_irq() return value checkKrzysztof Kozlowski1-0/+2
Return value of devm_request_irq() must be checked (function is even annotated) and without it clang W=1 complains: btnxpuart.c:494:6: error: unused variable 'ret' [-Werror,-Wunused-variable] Setting up wakeup IRQ handler is not really critical, because the handler is empty, so just log the informational message so user could submit proper bug report and silences the clang warning. Fixes: c50b56664e48 ("Bluetooth: btnxpuart: Implement host-wakeup feature") Signed-off-by: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org> Reviewed-by: Neeraj Sanjay Kale <neeraj.sanjaykale@nxp.com> Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
2025-05-30Bluetooth: MGMT: reject malformed HCI_CMD_SYNC commandsDmitry Antipov1-1/+2
In 'mgmt_hci_cmd_sync()', check whether the size of parameters passed in 'struct mgmt_cp_hci_cmd_sync' matches the total size of the data (i.e. 'sizeof(struct mgmt_cp_hci_cmd_sync)' plus trailing bytes). Otherwise, large invalid 'params_len' will cause 'hci_cmd_sync_alloc()' to do 'skb_put_data()' from an area beyond the one actually passed to 'mgmt_hci_cmd_sync()'. Reported-by: syzbot+5fe2d5bfbfbec0b675a0@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=5fe2d5bfbfbec0b675a0 Fixes: 827af4787e74 ("Bluetooth: MGMT: Add initial implementation of MGMT_OP_HCI_CMD_SYNC") Signed-off-by: Dmitry Antipov <dmantipov@yandex.ru> Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
2025-05-30PCI: host-common: Convert to library for host controller driversManivannan Sadhasivam10-12/+33
This common library will be used as a placeholder for helper functions shared by the host controller drivers. This avoids placing the host controller drivers specific helpers in drivers/pci/*.c, to avoid enlarging the kernel image on platforms that do not use host controller drivers at all (like x86/ACPI platforms). Suggested-by: Lukas Wunner <lukas@wunner.de> Signed-off-by: Manivannan Sadhasivam <manivannan.sadhasivam@linaro.org> Signed-off-by: Krzysztof Wilczyński <kwilczynski@kernel.org> Signed-off-by: Bjorn Helgaas <bhelgaas@google.com> Link: https://patch.msgid.link/20250508-pcie-reset-slot-v4-3-7050093e2b50@linaro.org
2025-05-30PCI/ERR: Remove misleading TODO regarding kernel panicManivannan Sadhasivam1-1/+0
A PCI device is just another peripheral in a system. So failure to recover it, must not result in a kernel panic. So remove the TODO which is quite misleading. Signed-off-by: Manivannan Sadhasivam <manivannan.sadhasivam@linaro.org> Signed-off-by: Krzysztof Wilczyński <kwilczynski@kernel.org> Signed-off-by: Bjorn Helgaas <bhelgaas@google.com> Reviewed-by: Wilfred Mallawa <wilfred.mallawa@wdc.com> Link: https://patch.msgid.link/20250508-pcie-reset-slot-v4-1-7050093e2b50@linaro.org
2025-05-30gfs2: Don't clear sb->s_fs_info in gfs2_sys_fs_addAndrew Price2-2/+3
When gfs2_sys_fs_add() fails, it sets sb->s_fs_info to NULL on its error path (see commit 0d515210b696 ("GFS2: Add kobject release method")). The intention seems to be to prevent dereferencing sb->s_fs_info once the object pointed to has been deallocated, but that would be better achieved by setting the pointer to NULL in free_sbd(). As a consequence, when the call to gfs2_sys_fs_add() fails in gfs2_fill_super(), sdp = GFS2_SB(inode) will evaluate to NULL in iput() -> gfs2_drop_inode(), and accessing sdp->sd_flags will be a NULL pointer dereference. Fix that by only setting sb->s_fs_info to NULL when actually freeing the object pointed to in free_sbd(). Fixes: ae9f3bd8259a ("gfs2: replace sd_aspace with sd_inode") Reported-by: syzbot+b12826218502df019f9d@syzkaller.appspotmail.com Signed-off-by: Andrew Price <anprice@redhat.com> Signed-off-by: Andreas Gruenbacher <agruenba@redhat.com>
2025-05-30Merge tag 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/rdma/rdmaLinus Torvalds76-772/+1484
Pull rdma updates from Jason Gunthorpe: "Usual collection of driver fixes: - Small bug fixes and cleansup in hfi, hns, rxe, mlx5, mana siw - Further ODP functionality in rxe - Remote access MRs in mana, along with more page sizes - Improve CM scalability with a rwlock around the agent - More trace points for hns - ODP hmm conversion to the new two step dma API - Support the ethernet HW device in mana as well as the RNIC - Cleanups: - Use secs_to_jiffies() when appropriate - Use ERR_CAST() instead of naked casts - Don't use %pK in printk - Unusued functions removed - Allocation type matching" * tag 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/rdma/rdma: (57 commits) RDMA/cma: Fix hang when cma_netevent_callback fails to queue_work RDMA/bnxt_re: Support extended stats for Thor2 VF RDMA/hns: Fix endian issue in trace events RDMA/mlx5: Avoid flexible array warning IB/cm: Remove dead code and adjust naming RDMA/core: Avoid hmm_dma_map_alloc() for virtual DMA devices RDMA/rxe: Break endless pagefault loop for RO pages RDMA/bnxt_re: Fix return code of bnxt_re_configure_cc RDMA/bnxt_re: Fix missing error handling for tx_queue RDMA/bnxt_re: Fix incorrect display of inactivity_cp in debugfs output RDMA/mlx5: Add support for 200Gbps per lane speeds RDMA/mlx5: Remove the redundant MLX5_IB_STAGE_UAR stage RDMA/iwcm: Fix use-after-free of work objects after cm_id destruction net: mana: Add support for auxiliary device servicing events RDMA/mana_ib: unify mana_ib functions to support any gdma device RDMA/mana_ib: Add support of mana_ib for RNIC and ETH nic net: mana: Probe rdma device in mana driver RDMA/siw: replace redundant ternary operator with just rv RDMA/umem: Separate implicit ODP initialization from explicit ODP RDMA/core: Convert UMEM ODP DMA mapping to caching IOVA and page linkage ...
2025-05-30Merge tag 'i2c-for-6.16-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/wsa/linuxLinus Torvalds65-662/+2124
Pull i2c updates from Wolfram Sang: "Core updates: - move towards using the 'fwnode' handle instead of 'of_node' (meaning 'of_node' even gets removed from i2c_board_info) - add support for Write Disable-aware SPD eeproms - minor stuff (use new helpers, typo fixes) i2c-atr (address translator) updates: - support per-channel alias pools - added support for dynamic address translation (also adds FPC202 driver as its user) - add 'static' and 'passthrough' flags Cleanups and refactorings - Many drivers switched to dev_err_probe() - Generic cleanups applied to designware, iproc, ismt, mlxbf, npcm7xx, qcom-geni, pasemi, and thunderx - davinci: declare I2C mangling support among I2C features - designware: clean up DTS handling - designware: fix PM runtime on driver unregister - imx: improve error logging during probe - lpc2k: improve checks in probe error path - xgene-slimpro: improve PCC shared memory handling - pasemi: improve error handling in reset, smbus clear, timeouts - tegra: validate buffer length during transfers - wmt: convert binding to YAML format Improvements and extended support: - microchip-core: add SMBus support - mlxbf: add support for repeated start in block transfers - mlxbf: improve timer configuration - npcm: attempt clock toggle recovery before failing init - octeon: add support for block mode operations - pasemi: add support for unjam device feature - riic: add support for bus recovery New device support: - MediaTek Dimensity 1200 (MT6893) - Sophgo SG2044 - Renesas RZ/V2N (R9A09G056) - Rockchip RK3528 - AMD ISP (new driver)" * tag 'i2c-for-6.16-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/wsa/linux: (89 commits) i2c: Use str_read_write() helper i2c: mlxbf: avoid 64-bit division i2c: viai2c-wmt: Replace dev_err() with dev_err_probe() in probe function i2c: designware: Don't warn about missing get_clk_rate_khz i2c: designware: Invoke runtime suspend on quick slave re-registration i2c-mlxbf: Improve I2C bus timing configuration i2c-mlxbf: Add repeated start condition support i2c: xgene-slimpro: Replace dev_err() with dev_err_probe() in probe function dt-bindings: i2c: i2c-wmt: Convert to YAML i2c: microchip-corei2c: add smbus support i2c: mlxbf: Allow build with COMPILE_TEST i2c: I2C_DESIGNWARE_AMDISP should depend on DRM_AMD_ISP i2c: atr: add passthrough flag i2c: atr: add static flag i2c: atr: allow replacing mappings in attach_addr() i2c: atr: deduplicate logic in attach_addr() i2c: atr: do not create mapping in detach_addr() i2c: atr: split up i2c_atr_get_mapping_by_addr() i2c: atr: find_mapping() -> get_mapping() i2c: atr: Fix lockdep for nested ATRs ...
2025-05-30Merge tag 'pinctrl-v6.16-1' of git://git.kernel.org/pub/scm/linux/kernel/git/linusw/linux-pinctrlLinus Torvalds79-857/+9753
Pull pin control updates from Linus Walleij: "An especially linear and sparse improvement and new drivers release. Nothing exciting. The biggest change in Bartosz changes to make gpiochip set/get calls return error codes (something we should have fixed ages ago but is now finally getting fixed.) Core changes: - Add the devres devm_pinctrl_register_mappings() call that can register some pin control machine mappings and have them go away with the associated device New drivers: - Support for the Mediatek MT6893 and MT8196 SoCs - Support for the Renesas RZ/V2N SoC - Support for the NXP Freescale i.MX943 SoC Improvements: - Per-SoC suspend/resume callbacks in the Samsung drivers - Set all pins as input (High-Z) at probe in the MCP23S08 driver - Switch most GPIO chips to use the setters/getters with a return value - EGPIO support in the Qualcomm QCM2290 driver - Fix up the number of available GPIO lines in Qualcomm QCS8300 and QCS615" * tag 'pinctrl-v6.16-1' of git://git.kernel.org/pub/scm/linux/kernel/git/linusw/linux-pinctrl: (82 commits) pinctrl: freescale: Add support for imx943 pinctrl pinctrl: core: add devm_pinctrl_register_mappings() pinctrl: remove extern specifier for functions in machine.h pinctrl: mediatek: eint: Fix invalid pointer dereference for v1 platforms pinctrl: freescale: Enable driver if platform is enabled. pinctrl: freescale: Depend imx-scu driver on OF pinctrl: armada-37xx: propagate error from armada_37xx_pmx_set_by_name() pinctrl: armada-37xx: propagate error from armada_37xx_gpio_get_direction() pinctrl: armada-37xx: propagate error from armada_37xx_pmx_gpio_set_direction() pinctrl: armada-37xx: propagate error from armada_37xx_gpio_get() pinctrl: armada-37xx: propagate error from armada_37xx_gpio_direction_output() pinctrl: armada-37xx: set GPIO output value before setting direction pinctrl: armada-37xx: use correct OUTPUT_VAL register for GPIOs > 31 pinctrl: meson: Drop unused aml_pctl_find_group_by_name() pinctrl: at91: Fix possible out-of-boundary access pinctrl: add stubs for OF-specific pinconf functions pinctrl: qcom: correct the ngpios entry for QCS8300 pinctrl: qcom: correct the ngpios entry for QCS615 dt-bindings: pinctrl: qcom: correct gpio-ranges in examples for qcs8300 dt-bindings: pinctrl: qcom: correct gpio-ranges in examples for qcs615 ...
2025-05-30Merge tag 'clk-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/clk/linuxLinus Torvalds100-526/+7298
Pull clk updates from Stephen Boyd: "This has been a semi-quiet cycle. The core framework remains unchanged this time around. In terms of shiny new code though, we have support for the SpacemiT K1 SoC, Sophgo SG2044, and T-HEAD TH1520 VO clk drivers joining the usual silicon players like Qualcomm, Samsung, Allwinner, and Renesas. Surprisingly, the Qualcomm pile was smaller than usual but that is likely because they put one SoC support inside a driver for a different SoC that is very similar. Other than all those new clk drivers there are the usual clk data updates to fix parents, frequency tables, and add missing clks along with some Kconfig changes to make compile testing simpler and even more DT binding conversions to boot. The exciting part is still the new SoC support like SpacemiT and Sophgo support though, which really dominate the diffstat because they introduce a whole new silicon vendor clk driver. New Drivers: - Camera clock controller driver for Qualcomm QCS8300 - DE (display engine) 3.3 clocks on Allwinner H616 - Samsung ExynosAutov920 CPU cluster CL0, CL1 and CL2 clock controllers - Video Output (VO) subsystem clk controller in the T-HEAD TH1520 SoC - Clock driver for Sophgo SG2044 - Clock driver for SpacemiT K1 SoC - Renesas RZ/V2N (R9A09G056) SoC clk driver Updates: - Correct data in various SoC clk drivers - Allow clkaN to be optional in the Qualcomm RPMh clock controller driver if command db doesn't define it - Change Kconfig options to not enable by default during compile testing - Add missing clks in various SoC clk drivers - Remove some duplicate clk DT bindings and convert some more to YAML" * tag 'clk-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/clk/linux: (93 commits) clk: qcom: gcc-x1e80100: Set FORCE MEM CORE for UFS clocks clk: qcom: gcc: Set FORCE_MEM_CORE_ON for gcc_ufs_axi_clk for 8650/8750 clk: qcom: rpmh: make clkaN optional clk: qcom: Add support for Camera Clock Controller on QCS8300 clk: rockchip: rk3528: add slab.h header include clk: rockchip: rk3576: add missing slab.h include clk: meson: Do not enable by default during compile testing clk: meson-g12a: add missing fclk_div2 to spicc clk: qcom: gcc-msm8939: Fix mclk0 & mclk1 for 24 MHz clk: rockchip: rename gate-grf clk file clk: rockchip: rename branch_muxgrf to branch_grf_mux clk: sunxi-ng: ccu: add Display Engine 3.3 (DE33) support dt-bindings: allwinner: add H616 DE33 clock binding clk: samsung: correct clock summary for hsi1 block dt-bindings: clock: add SM6350 QCOM video clock bindings clk: rockchip: Pass NULL as reg pointer when registering GRF MMC clocks clk: sunxi-ng: h616: Add LVDS reset for LCD TCON dt-bindings: clock: sun50i-h616-ccu: Add LVDS reset clk: rockchip: rk3036: mark ddrphy as critical clk: rockchip: rk3036: fix implementation of usb480m clock mux ...
2025-05-30Merge tag 'f2fs-for-6.16-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/jaegeuk/f2fsLinus Torvalds28-1784/+2057
Pull f2fs updates from Jaegeuk Kim: "In this round, Matthew converted most of page operations to using folio. Beyond the work, we've applied some performance tunings such as GC and linear lookup, in addition to enhancing fault injection and sanity checks. Enhancements: - large number of folio conversions - add a control to turn on/off the linear lookup for performance - tune GC logics for zoned block device - improve fault injection and sanity checks Bug fixes: - handle error cases of memory donation - fix to correct check conditions in f2fs_cross_rename - fix to skip f2fs_balance_fs() if checkpoint is disabled - don't over-report free space or inodes in statvfs - prevent the current section from being selected as a victim during GC - fix to calculate first_zoned_segno correctly - fix to avoid inconsistence between SIT and SSA for zoned block device As usual, there are several debugging patches and clean-ups as well" * tag 'f2fs-for-6.16-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/jaegeuk/f2fs: (195 commits) f2fs: fix to correct check conditions in f2fs_cross_rename f2fs: use d_inode(dentry) cleanup dentry->d_inode f2fs: fix to skip f2fs_balance_fs() if checkpoint is disabled f2fs: clean up to check bi_status w/ BLK_STS_OK f2fs: introduce is_{meta,node}_folio f2fs: add ckpt_valid_blocks to the section entry f2fs: add a method for calculating the remaining blocks in the current segment in LFS mode. f2fs: introduce FAULT_VMALLOC f2fs: use vmalloc instead of kvmalloc in .init_{,de}compress_ctx f2fs: add f2fs_bug_on() in f2fs_quota_read() f2fs: add f2fs_bug_on() to detect potential bug f2fs: remove unused sbi argument from checksum functions f2fs: fix 32-bits hexademical number in fault injection doc f2fs: don't over-report free space or inodes in statvfs f2fs: return bool from __write_node_folio f2fs: simplify return value handling in f2fs_fsync_node_pages f2fs: always unlock the page in f2fs_write_single_data_page f2fs: remove wbc->for_reclaim handling f2fs: return bool from __f2fs_write_meta_folio f2fs: fix to return correct error number in f2fs_sync_node_pages() ...
2025-05-30bcachefs: Mark bch_errcode helpers __attribute__((const))Kent Overstreet2-3/+7
These don't access global memory or defer pointer arguments - this enables CSE optimizations. Signed-off-by: Kent Overstreet <kent.overstreet@linux.dev>
2025-05-30bcachefs: Add missing printbuf_reset() in bch2_check_dirent_inode_dirent()Kent Overstreet1-0/+1
We were accidentally including the contents from the previous fsck_err(). Signed-off-by: Kent Overstreet <kent.overstreet@linux.dev>
2025-05-30bcachefs: sysfs/errorsKent Overstreet3-0/+29
Make the superblock error counters available in sysfs; the only other way they can be seen is 'show-super', but we don't write the superblock every time the error count gets incremented. Signed-off-by: Kent Overstreet <kent.overstreet@linux.dev>
2025-05-30LoongArch: Fix panic caused by NULL-PMD in huge_pte_offset()Tianyang Zhang1-1/+2
ERROR INFO: CPU 25 Unable to handle kernel paging request at virtual address 0x0 ... Call Trace: [<900000000023c30c>] huge_pte_offset+0x3c/0x58 [<900000000057fd4c>] hugetlb_follow_page_mask+0x74/0x438 [<900000000051fee8>] __get_user_pages+0xe0/0x4c8 [<9000000000522414>] faultin_page_range+0x84/0x380 [<9000000000564e8c>] madvise_vma_behavior+0x534/0xa48 [<900000000056689c>] do_madvise+0x1bc/0x3e8 [<9000000000566df4>] sys_madvise+0x24/0x38 [<90000000015b9e88>] do_syscall+0x78/0x98 [<9000000000221f18>] handle_syscall+0xb8/0x158 In some cases, pmd may be NULL and rely on NULL as the return value for processing, so it is necessary to determine this situation here. Cc: stable@vger.kernel.org Fixes: bd51834d1cf6 ("LoongArch: Return NULL from huge_pte_offset() for invalid PMD") Signed-off-by: Tianyang Zhang <zhangtianyang@loongson.cn> Signed-off-by: Huacai Chen <chenhuacai@loongson.cn>
2025-05-30LoongArch: Preserve firmware configuration when desiredHuacai Chen1-2/+12
If we must preserve the firmware resource assignments, claim the existing resources rather than reassigning everything. According to PCI Firmware Specification: if ACPI DSM#5 function returns 0, the OS must retain the resource allocation for PCI in the firmware; if ACPI DSM#5 function returns 1, the OS can ignore the resource allocation for PCI and reallocate it. Signed-off-by: Qihang Gao <gaoqihang@loongson.cn> Signed-off-by: Juxin Gao <gaojuxin@loongson.cn> Signed-off-by: Huacai Chen <chenhuacai@loongson.cn>
2025-05-30LoongArch: Avoid using $r0/$r1 as "mask" for csrxchgHuacai Chen1-4/+12
When building kernel with LLVM there are occasionally such errors: In file included from ./include/linux/spinlock.h:59: In file included from ./include/linux/irqflags.h:17: arch/loongarch/include/asm/irqflags.h:38:3: error: must not be $r0 or $r1 38 | "csrxchg %[val], %[mask], %[reg]\n\t" | ^ <inline asm>:1:16: note: instantiated into assembly here 1 | csrxchg $a1, $ra, 0 | ^ To prevent the compiler from allocating $r0 or $r1 for the "mask" of the csrxchg instruction, the 'q' constraint must be used but Clang < 21 does not support it. So force to use $t0 in the inline asm, in order to avoid using $r0/$r1 while keeping the backward compatibility. Cc: stable@vger.kernel.org Link: https://github.com/llvm/llvm-project/pull/141037 Reviewed-by: Yanteng Si <si.yanteng@linux.dev> Suggested-by: WANG Rui <wangrui@loongson.cn> Signed-off-by: Huacai Chen <chenhuacai@loongson.cn>
2025-05-30LoongArch: Introduce the numa_memblks conversionHuacai Chen8-139/+16
Commit 87482708210ff3333a ("mm: introduce numa_memblks") has moved numa_memblks from x86 to the generic code, but LoongArch was left out of this conversion. This patch introduces the generic numa_memblks for LoongArch. In detail: 1. Enable NUMA_MEMBLKS (but disable NUMA_EMU) in Kconfig; 2. Use generic definition for numa_memblk and numa_meminfo; 3. Use generic implementation for numa_add_memblk() and its friends; 4. Use generic implementation for numa_set_distance() and its friends; 5. Use generic implementation for memory_add_physaddr_to_nid() and its friends. Note: Disable NUMA_EMU because it needs more efforts and no obvious demand now. Tested-by: Binbin Zhou <zhoubinbin@loongson.cn> Signed-off-by: Yuquan Wang <wangyuquan1236@phytium.com.cn> Signed-off-by: Huacai Chen <chenhuacai@loongson.cn>
2025-05-30LoongArch: Increase max supported CPUs up to 2048Huacai Chen4-12/+41
Increase max supported CPUs up to 2048, including: 1. Increase CSR.CPUID register's effective width; 2. Define MAX_CORE_PIC (a.k.a. max physical ID) to 2048; 3. Allow NR_CPUS (a.k.a. max logical ID) to be as large as 2048; 4. Introduce acpi_numa_x2apic_affinity_init() to handle ACPI SRAT for CPUID >= 256. Note: The reason of increasing to 2048 rather than 4096/8192 is because the IPI hardware can only support 2048 as a maximum. Reviewed-by: Yanteng Si <si.yanteng@linux.dev> Signed-off-by: Huacai Chen <chenhuacai@loongson.cn>
2025-05-30LoongArch: Enable HAVE_ARCH_STACKLEAKYouling Tang6-8/+17
Add support for the stackleak feature. It initializes the stack with the poison value before returning from system calls which improves the kernel security. At the same time, disables the plugin in EFI stub code because EFI stub is out of scope for the protection. Tested on Loongson-3A5000 (enable GCC_PLUGIN_STACKLEAK and LKDTM): # echo STACKLEAK_ERASING > /sys/kernel/debug/provoke-crash/DIRECT # dmesg lkdtm: Performing direct entry STACKLEAK_ERASING lkdtm: stackleak stack usage: high offset: 320 bytes current: 448 bytes lowest: 1264 bytes tracked: 1264 bytes untracked: 208 bytes poisoned: 14528 bytes low offset: 64 bytes lkdtm: OK: the rest of the thread stack is properly erased Signed-off-by: Youling Tang <tangyouling@kylinos.cn> Signed-off-by: Huacai Chen <chenhuacai@loongson.cn>
2025-05-30LoongArch: Enable ARCH_SUPPORTS_MSEAL_SYSTEM_MAPPINGSYuli Wang4-3/+6
Provide support for CONFIG_MSEAL_SYSTEM_MAPPINGS on LoongArch, covering the vdso. Link: https://lore.kernel.org/all/25bad37f-273e-4626-999c-e1890be96182@lucifer.local/ Acked-by: Liam R. Howlett <Liam.Howlett@oracle.com> Acked-by: Lorenzo Stoakes <lorenzo.stoakes@oracle.com> Reviewed-by: Jeff Xu <jeffxu@chromium.org> Tested-by: Yuli Wang <wangyuli@uniontech.com> Signed-off-by: Yuli Wang <wangyuli@uniontech.com> Signed-off-by: Huacai Chen <chenhuacai@loongson.cn>
2025-05-30LoongArch: Add SCHED_MC (Multi-core scheduler) supportTianyang Zhang4-0/+56
In order to achieve more reasonable load balancing behavior, add SCHED_MC (Multi-core scheduler) support. The LLC distribution of LoongArch now is consistent with NUMA node, the balancing domain of SCHED_MC can effectively reduce the situation where processes are awakened to smt_sibling. Co-developed-by: Hongliang Wang <wanghongliang@loongson.cn> Signed-off-by: Hongliang Wang <wanghongliang@loongson.cn> Signed-off-by: Tianyang Zhang <zhangtianyang@loongson.cn> Signed-off-by: Huacai Chen <chenhuacai@loongson.cn>
2025-05-30LoongArch: Add some annotations in archhelpYouling Tang1-1/+6
- Add annotations to the kernel image. - Modify the annotations of make insatll. Signed-off-by: Youling Tang <tangyouling@kylinos.cn> Signed-off-by: Huacai Chen <chenhuacai@loongson.cn>
2025-05-30LoongArch: Using generic scripts/install.sh in `make install`Youling Tang1-3/+1
Use the generic script/install.sh to perform the make install operation. This will automatically generate the initrd file and modify the grub.cfg without manual intervention (The previous kernel image, config file and System.map will also be generated), similar to other architectures. Signed-off-by: Youling Tang <tangyouling@kylinos.cn> Signed-off-by: Huacai Chen <chenhuacai@loongson.cn>
2025-05-30LoongArch: Add a default install.shYouling Tang1-0/+56
As specified in scripts/install.sh, the priority order is as follows (from highest to lowest): ~/bin/installkernel /sbin/installkernel arch/loongarch/boot/install.sh Fallback to default install.sh if installkernel is not found. Signed-off-by: Youling Tang <tangyouling@kylinos.cn> Signed-off-by: Huacai Chen <chenhuacai@loongson.cn>
2025-05-30Merge commit 'core-entry-2025-05-25' into loongarch-nextHuacai Chen8-79/+119
LoongArch architecture changes for 6.16 modify some same files with the core-entry changes, so merge them to create a base to resolve conflicts.
2025-05-30asm-generic: Add sched.h inclusion in simd.hHuacai Chen1-0/+1
Commit 7ba8df47810f073 ("asm-generic: Make simd.h more resilient") causes a build error for PREEMPT_RT kernels: CC lib/crypto/sha256.o In file included from ./include/asm-generic/simd.h:6, from ./arch/loongarch/include/generated/asm/simd.h:1, from ./include/crypto/internal/simd.h:9, from ./include/crypto/internal/sha2.h:6, from lib/crypto/sha256.c:15: ./include/asm-generic/simd.h: In function 'may_use_simd': ./include/linux/preempt.h:111:34: error: 'current' undeclared (first use in this function) 111 | # define softirq_count() (current->softirq_disable_cnt & SOFTIRQ_MASK) | ^~~~~~~ ./include/linux/preempt.h:112:82: note: in expansion of macro 'softirq_count' 112 | # define irq_count() ((preempt_count() & (NMI_MASK | HARDIRQ_MASK)) | softirq_count()) | ^~~~~~~~~~~~~ ./include/linux/preempt.h:143:34: note: in expansion of macro 'irq_count' 143 | #define in_interrupt() (irq_count()) | ^~~~~~~~~ ./include/asm-generic/simd.h:18:17: note: in expansion of macro 'in_interrupt' 18 | return !in_interrupt(); | ^~~~~~~~~~~~ So add sched.h inclusion in simd.h to fix it. Fixes: 7ba8df47810f073 ("asm-generic: Make simd.h more resilient") Signed-off-by: Huacai Chen <chenhuacai@loongson.cn> Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
2025-05-30crypto: s390/sha256 - rename module to sha256-s390Eric Biggers1-1/+2
When the s390 SHA-256 code is built as a loadable module, name it sha256-s390.ko instead of sha256.ko. This avoids a module name collision with crypto/sha256.ko and makes it consistent with the other architectures. We should consider making a single module provide all the SHA-256 library code, which would prevent issues like this. But for now this is the fix that's needed. Fixes: b9eac03edcf8 ("crypto: s390/sha256 - implement library instead of shash") Reported-by: Alex Williamson <alex.williamson@redhat.com> Closes: https://lore.kernel.org/r/20250529110526.6d2959a9.alex.williamson@redhat.com/ Signed-off-by: Eric Biggers <ebiggers@google.com> Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
2025-05-30MIPS: loongson2ef: lemote-2f: add missing function prototypesRandy Dunlap1-0/+9
Add several missing function prototypes for lemote-2f to eliminate build warnings: arch/mips/loongson2ef/lemote-2f/machtype.c:10:13: warning: no previous prototype for 'mach_prom_init_machtype' [-Wmissing-prototypes] 10 | void __init mach_prom_init_machtype(void) arch/mips/loongson2ef/common/machtype.c:34:20: warning: no previous prototype for 'mach_prom_init_machtype' [-Wmissing-prototypes] 34 | void __weak __init mach_prom_init_machtype(void) arch/mips/loongson2ef/lemote-2f/pm.c:52:6: warning: no previous prototype for 'setup_wakeup_events' [-Wmissing-prototypes] 52 | void setup_wakeup_events(void) arch/mips/loongson2ef/lemote-2f/pm.c:90:5: warning: no previous prototype for 'wakeup_loongson' [-Wmissing-prototypes] 90 | int wakeup_loongson(void) arch/mips/loongson2ef/lemote-2f/pm.c:137:13: warning: no previous prototype for 'mach_suspend' [-Wmissing-prototypes] 137 | void __weak mach_suspend(void) arch/mips/loongson2ef/lemote-2f/pm.c:142:13: warning: no previous prototype for 'mach_resume' [-Wmissing-prototypes] 142 | void __weak mach_resume(void) Signed-off-by: Randy Dunlap <rdunlap@infradead.org> Cc: Jiaxun Yang <jiaxun.yang@flygoat.com> Cc: linux-mips@vger.kernel.org Cc: Thomas Bogendoerfer <tsbogend@alpha.franken.de> Signed-off-by: Thomas Bogendoerfer <tsbogend@alpha.franken.de>
2025-05-30MIPS: loongson2ef: cs5536: add missing function prototypesRandy Dunlap1-0/+20
Add missing function prototypes for cs5536, mostly for PCI functions, and for init_mfgpt_clocksource(). arch/mips/loongson2ef/common/cs5536/cs5536_ide.c:15:6: warning: no previous prototype for 'pci_ide_write_reg' [-Wmissing-prototypes] 15 | void pci_ide_write_reg(int reg, u32 value) arch/mips/loongson2ef/common/cs5536/cs5536_ide.c:96:5: warning: no previous prototype for 'pci_ide_read_reg' [-Wmissing-prototypes] 96 | u32 pci_ide_read_reg(int reg) arch/mips/loongson2ef/common/cs5536/cs5536_ehci.c:15:6: warning: no previous prototype for 'pci_ehci_write_reg' [-Wmissing-prototypes] 15 | void pci_ehci_write_reg(int reg, u32 value) arch/mips/loongson2ef/common/cs5536/cs5536_ehci.c:75:5: warning: no previous prototype for 'pci_ehci_read_reg' [-Wmissing-prototypes] 75 | u32 pci_ehci_read_reg(int reg) arch/mips/loongson2ef/common/cs5536/cs5536_acc.c:15:6: warning: no previous prototype for 'pci_acc_write_reg' [-Wmissing-prototypes] 15 | void pci_acc_write_reg(int reg, u32 value) arch/mips/loongson2ef/common/cs5536/cs5536_acc.c:62:5: warning: no previous prototype for 'pci_acc_read_reg' [-Wmissing-prototypes] 62 | u32 pci_acc_read_reg(int reg) arch/mips/loongson2ef/common/cs5536/cs5536_ohci.c:15:6: warning: no previous prototype for 'pci_ohci_write_reg' [-Wmissing-prototypes] 15 | void pci_ohci_write_reg(int reg, u32 value) arch/mips/loongson2ef/common/cs5536/cs5536_ohci.c:70:5: warning: no previous prototype for 'pci_ohci_read_reg' [-Wmissing-prototypes] 70 | u32 pci_ohci_read_reg(int reg) arch/mips/loongson2ef/common/cs5536/cs5536_isa.c:84:6: warning: no previous prototype for 'pci_isa_write_bar' [-Wmissing-prototypes] 84 | void pci_isa_write_bar(int n, u32 value) arch/mips/loongson2ef/common/cs5536/cs5536_isa.c:110:5: warning: no previous prototype for 'pci_isa_read_bar' [-Wmissing-prototypes] 110 | u32 pci_isa_read_bar(int n) arch/mips/loongson2ef/common/cs5536/cs5536_isa.c:134:6: warning: no previous prototype for 'pci_isa_write_reg' [-Wmissing-prototypes] 134 | void pci_isa_write_reg(int reg, u32 value) arch/mips/loongson2ef/common/cs5536/cs5536_isa.c:228:5: warning: no previous prototype for 'pci_isa_read_reg' [-Wmissing-prototypes] 228 | u32 pci_isa_read_reg(int reg) arch/mips/loongson2ef/common/cs5536/cs5536_mfgpt.c:195:12: warning: no previous prototype for 'init_mfgpt_clocksource' [-Wmissing-prototypes] 195 | int __init init_mfgpt_clocksource(void) Signed-off-by: Randy Dunlap <rdunlap@infradead.org> Cc: Jiaxun Yang <jiaxun.yang@flygoat.com> Cc: linux-mips@vger.kernel.org Cc: Thomas Bogendoerfer <tsbogend@alpha.franken.de> Signed-off-by: Thomas Bogendoerfer <tsbogend@alpha.franken.de>
2025-05-30net: usb: aqc111: debug info before sanitationOliver Neukum1-4/+4
If we sanitize error returns, the debug statements need to come before that so that we don't lose information. Signed-off-by: Oliver Neukum <oneukum@suse.com> Fixes: 405b0d610745 ("net: usb: aqc111: fix error handling of usbnet read calls") Reviewed-by: Andrew Lunn <andrew@lunn.ch> Signed-off-by: David S. Miller <davem@davemloft.net>
2025-05-30Merge tag 'md-6.16-20250530' of https://git.kernel.org/pub/scm/linux/kernel/git/mdraid/linux into block-6.16Jens Axboe7-52/+60
Pull MD fixes from Yu: "- fix REQ_RAHEAD and REQ_NOWAIT IO err handling for raid1/10 - fix max_write_behind setting for dm-raid - some minor cleanups" * tag 'md-6.16-20250530' of https://git.kernel.org/pub/scm/linux/kernel/git/mdraid/linux: md/md-bitmap: remove parameter slot from bitmap_create() md/md-bitmap: cleanup bitmap_ops->startwrite() md/dm-raid: remove max_write_behind setting limit md/md-bitmap: fix dm-raid max_write_behind setting md/raid1,raid10: don't handle IO error for REQ_RAHEAD and REQ_NOWAIT
2025-05-30spi: bcm63xx-hsspi: fix shared resetÁlvaro Fernández Rojas1-1/+1
Some bmips SoCs (bcm6362, bcm63268) share the same SPI reset for both SPI and HSSPI controllers, so reset shouldn't be exclusive. Fixes: 0eeadddbf09a ("spi: bcm63xx-hsspi: add reset support") Reported-by: Jonas Gorski <jonas.gorski@gmail.com> Signed-off-by: Álvaro Fernández Rojas <noltari@gmail.com> Reviewed-by: Florian Fainelli <florian.fainelli@broadcom.com> Link: https://patch.msgid.link/20250529130915.2519590-3-noltari@gmail.com Signed-off-by: Mark Brown <broonie@kernel.org>
2025-05-30spi: bcm63xx-spi: fix shared resetÁlvaro Fernández Rojas1-1/+1
Some bmips SoCs (bcm6362, bcm63268) share the same SPI reset for both SPI and HSSPI controllers, so reset shouldn't be exclusive. Fixes: 38807adeaf1e ("spi: bcm63xx-spi: add reset support") Reported-by: Jonas Gorski <jonas.gorski@gmail.com> Signed-off-by: Álvaro Fernández Rojas <noltari@gmail.com> Reviewed-by: Florian Fainelli <florian.fainelli@broadcom.com> Link: https://patch.msgid.link/20250529130915.2519590-2-noltari@gmail.com Signed-off-by: Mark Brown <broonie@kernel.org>
2025-05-30KVM: arm64: vgic-debug: Avoid dereferencing NULL ITE pointerMarc Zyngier1-1/+4
Dan reports that iterating over a device ITEs can legitimately lead to a NULL pointer, and that the NULL check is placed *after* the pointer has already been dereferenced. Hoist the pointer check as early as possible and be done with it. Reported-by: Dan Carpenter <dan.carpenter@linaro.org> Fixes: 30deb51a677b ("KVM: arm64: vgic-its: Add debugfs interface to expose ITS tables") Link: https://lore.kernel.org/r/aDBylI1YnjPatAbr@stanley.mountain Cc: Jing Zhang <jingzhangos@google.com> Link: https://lore.kernel.org/r/20250530091647.1152489-1-maz@kernel.org Signed-off-by: Marc Zyngier <maz@kernel.org>
2025-05-30KVM: arm64: vgic-init: Plug vCPU vs. VGIC creation raceOliver Upton1-1/+26
syzkaller has found another ugly race in the VGIC, this time dealing with VGIC creation. Since kvm_vgic_create() doesn't sufficiently protect against in-flight vCPU creations, it is possible to get a vCPU into the kernel w/ an in-kernel VGIC but no allocation of private IRQs: Unable to handle kernel NULL pointer dereference at virtual address 0000000000000d20 Mem abort info: ESR = 0x0000000096000046 EC = 0x25: DABT (current EL), IL = 32 bits SET = 0, FnV = 0 EA = 0, S1PTW = 0 FSC = 0x06: level 2 translation fault Data abort info: ISV = 0, ISS = 0x00000046, ISS2 = 0x00000000 CM = 0, WnR = 1, TnD = 0, TagAccess = 0 GCS = 0, Overlay = 0, DirtyBit = 0, Xs = 0 user pgtable: 4k pages, 48-bit VAs, pgdp=0000000103e4f000 [0000000000000d20] pgd=0800000102e1c403, p4d=0800000102e1c403, pud=0800000101146403, pmd=0000000000000000 Internal error: Oops: 0000000096000046 [#1] PREEMPT SMP CPU: 9 UID: 0 PID: 246 Comm: test Not tainted 6.14.0-rc6-00097-g0c90821f5db8 #16 Hardware name: linux,dummy-virt (DT) pstate: 814020c5 (Nzcv daIF +PAN -UAO -TCO +DIT -SSBS BTYPE=--) pc : _raw_spin_lock_irqsave+0x34/0x8c lr : kvm_vgic_set_owner+0x54/0xa4 sp : ffff80008086ba20 x29: ffff80008086ba20 x28: ffff0000c19b5640 x27: 0000000000000000 x26: 0000000000000000 x25: ffff0000c4879bd0 x24: 000000000000001e x23: 0000000000000000 x22: 0000000000000000 x21: ffff0000c487af80 x20: ffff0000c487af18 x19: 0000000000000000 x18: 0000001afadd5a8b x17: 0000000000000000 x16: 0000000000000000 x15: 0000000000000001 x14: ffff0000c19b56c0 x13: 0030c9adf9d9889e x12: ffffc263710e1908 x11: 0000001afb0d74f2 x10: e0966b840b373664 x9 : ec806bf7d6a57cd5 x8 : ffff80008086b980 x7 : 0000000000000001 x6 : 0000000000000001 x5 : 0000000080800054 x4 : 4ec4ec4ec4ec4ec5 x3 : 0000000000000000 x2 : 0000000000000001 x1 : 0000000000000000 x0 : 0000000000000d20 Call trace: _raw_spin_lock_irqsave+0x34/0x8c (P) kvm_vgic_set_owner+0x54/0xa4 kvm_timer_enable+0xf4/0x274 kvm_arch_vcpu_run_pid_change+0xe0/0x380 kvm_vcpu_ioctl+0x93c/0x9e0 __arm64_sys_ioctl+0xb4/0xec invoke_syscall+0x48/0x110 el0_svc_common.constprop.0+0x40/0xe0 do_el0_svc+0x1c/0x28 el0_svc+0x30/0xd0 el0t_64_sync_handler+0x10c/0x138 el0t_64_sync+0x198/0x19c Code: b9000841 d503201f 52800001 52800022 (88e17c02) ---[ end trace 0000000000000000 ]--- Plug the race by explicitly checking for an in-progress vCPU creation and failing kvm_vgic_create() when that's the case. Add some comments to document all the things kvm_vgic_create() is trying to guard against too. Reported-by: Alexander Potapenko <glider@google.com> Signed-off-by: Oliver Upton <oliver.upton@linux.dev> Tested-by: Alexander Potapenko <glider@google.com> Link: https://lore.kernel.org/r/20250523194722.4066715-6-oliver.upton@linux.dev Signed-off-by: Marc Zyngier <maz@kernel.org>
2025-05-30KVM: arm64: Unmap vLPIs affected by changes to GSI routing informationOliver Upton1-0/+23
KVM's interrupt infrastructure is dodgy at best, allowing for some ugly 'off label' usage of the various UAPIs. In one example, userspace can change the routing entry of a particular "GSI" after configuring irqbypass with KVM_IRQFD. KVM/arm64 is oblivious to this, and winds up preserving the stale translation in cases where vLPIs are configured. Honor userspace's intentions and tear down the vLPI mapping if affected by a "GSI" routing change. Make no attempt to reconstruct vLPIs if the new target is an MSI and just fall back to software injection. Tested-by: Sweet Tea Dorminy <sweettea-kernel@dorminy.me> Signed-off-by: Oliver Upton <oliver.upton@linux.dev> Link: https://lore.kernel.org/r/20250523194722.4066715-5-oliver.upton@linux.dev Signed-off-by: Marc Zyngier <maz@kernel.org>
2025-05-30KVM: arm64: Resolve vLPI by host IRQ in vgic_v4_unset_forwarding()Oliver Upton3-24/+27
The virtual mapping and "GSI" routing of a particular vLPI is subject to change in response to the guest / userspace. This can be pretty annoying to deal with when KVM needs to track the physical state that's managed for vLPI direct injection. Make vgic_v4_unset_forwarding() resilient by using the host IRQ to resolve the vgic IRQ. Since this uses the LPI xarray directly, finding the ITS by doorbell address + grabbing it's its_lock is no longer necessary. Note that matching the right ITS / ITE is already handled in vgic_v4_set_forwarding(), and unless there's a bug in KVM's VGIC ITS emulation the virtual mapping that should remain stable for the lifetime of the vLPI mapping. Tested-by: Sweet Tea Dorminy <sweettea-kernel@dorminy.me> Signed-off-by: Oliver Upton <oliver.upton@linux.dev> Link: https://lore.kernel.org/r/20250523194722.4066715-4-oliver.upton@linux.dev Signed-off-by: Marc Zyngier <maz@kernel.org>
2025-05-30KVM: arm64: Protect vLPI translation with vgic_irq::irq_lockOliver Upton2-42/+47
Though undocumented, KVM generally protects the translation of a vLPI with the its_lock. While this makes perfectly good sense, as the ITS itself contains the guest translation, an upcoming change will require twiddling the vLPI mapping in an atomic context. Switch to using the vIRQ's irq_lock to protect the translation. Use of the its_lock in vgic_v4_unset_forwarding() is preserved for now as it still needs to walk the ITS. Tested-by: Sweet Tea Dorminy <sweettea-kernel@dorminy.me> Signed-off-by: Oliver Upton <oliver.upton@linux.dev> Link: https://lore.kernel.org/r/20250523194722.4066715-3-oliver.upton@linux.dev Signed-off-by: Marc Zyngier <maz@kernel.org>
2025-05-30KVM: arm64: Use lock guard in vgic_v4_set_forwarding()Oliver Upton1-6/+4
The locking dance is about to get more interesting, switch the its_lock over to a lock guard to make it a bit easier to handle. Tested-by: Sweet Tea Dorminy <sweettea-kernel@dorminy.me> Signed-off-by: Oliver Upton <oliver.upton@linux.dev> Link: https://lore.kernel.org/r/20250523194722.4066715-2-oliver.upton@linux.dev Signed-off-by: Marc Zyngier <maz@kernel.org>
2025-05-30KVM: arm64: Mask out non-VA bits from TLBI VA* on VNCR invalidationMarc Zyngier1-2/+4
When handling a TLBI VA* instruction that potentially targets a VNCR page mapping, we fail to mask out the top bits that contain the ASID and TTL fields, hence potentially failing the VA check in the TLB code. An additional wrinkle is that we fail to sign extend the VA, again leading to failed VA checks. Fix both in one go by sign-extending the VA from bit 48, making it comparable to the way we interpret VNCR_EL2.BADDR. Fixes: 4ffa72ad8f37e ("KVM: arm64: nv: Add S1 TLB invalidation primitive for VNCR_EL2") Link: https://lore.kernel.org/r/20250525175759.780891-1-maz@kernel.org Signed-off-by: Marc Zyngier <maz@kernel.org>
2025-05-30arm64: sysreg: Drag linux/kconfig.h to work around vdso build issueMarc Zyngier1-0/+1
Broonie reports that fed55f49fad18 ("arm64: errata: Work around AmpereOne's erratum AC04_CPU_23") breaks one of the vdso selftests (vdso_test_chacha) as it indirectly drags asm/sysreg.h. It is rather unfortunate (and worrying) that userspace gets built with non-UAPI headers. In any case, paper over the issue by dragging linux/kconfig.h in asm/sysreg.h. It is the right thing to do, at least from the kernel perspective. Reported-by: Mark Brown <broonie@kernel.org> Fixes: fed55f49fad18 ("arm64: errata: Work around AmpereOne's erratum AC04_CPU_23") Link: https://lore.kernel.org/r/aDCDGZ-G-nCP3hJI@finisterre.sirena.org.uk Cc: D Scott Phillips <scott@os.amperecomputing.com> Cc: Catalin Marinas <catalin.marinas@arm.com> Cc: Oliver Upton <oliver.upton@linux.dev> Cc: Will Deacon <will@kernel.org> Reviewed-by: Oliver Upton <oliver.upton@linux.dev> Acked-by: Will Deacon <will@kernel.org> Link: https://lore.kernel.org/r/20250523170208.530818-1-maz@kernel.org Signed-off-by: Marc Zyngier <maz@kernel.org>
2025-05-30md/md-bitmap: remove parameter slot from bitmap_create()Yu Kuai3-7/+7
All callers pass in '-1' for 'slot', hence it can be removed. Link: https://lore.kernel.org/linux-raid/20250524061320.370630-6-yukuai1@huaweicloud.com Signed-off-by: Yu Kuai <yukuai3@huawei.com> Reviewed-by: Christoph Hellwig <hch@lst.de> Reviewed-by: Xiao Ni <xni@redhat.com> Reviewed-by: Christoph Hellwig <hch@lst.de> Reviewed-by: Hannes Reinecke <hare@suse.de>