| Age | Commit message (Collapse) | Author | Files | Lines |
|---|
|
After commit dfc256dac54c ("calibrate: Rework delay timer calibration"),
certain ARM configurations (such as multi_v5_defconfig) hang during
boot. The use of read_current_timer() in arch/arm's get_cycles() was
improperly converted to delay_read_timer(), resulting in get_cycles()
returning 0 even when the timer has been read or an uninitialized stack
value when delay_read_timer() returns false.
Flip the branches of the ternary condition to fix get_cycles().
Fixes: dfc256dac54c ("calibrate: Rework delay timer calibration")
Signed-off-by: Nathan Chancellor <nathan@kernel.org>
Signed-off-by: Thomas Gleixner <tglx@kernel.org>
Reviewed-by: Jinjie Ruan <ruanjinjie@huawei.com>
Cc: Thomas Gleixner <tglx@kernel.org>
Cc: linux-arm-kernel@lists.infradead.org
Link: https://patch.msgid.link/20260819-fix-arm-get_cycles-v1-1-208bf07ac540@kernel.org
|
|
tg_cpus() returns cpuset_num_cpus() unfloored, while its sibling
tg_tasks() already floors its result at 1. calc_concur_shares() feeds
nr = min(tg_tasks(tg), tg_cpus(tg))
into __calc_smp_shares() as shares_max, so an nr of 0 makes shares_max 0.
__calc_smp_shares() ends with
return clamp_t(long, shares, MIN_SHARES, shares_max);
and clamp() yields hi when hi < lo, so a zero shares_max silently defeats
the MIN_SHARES floor and returns 0 -- the exact case the comment above
that line says must return MIN_SHARES instead of 0.
That leaves a group sched_entity with load.weight == 0, and
__calc_prop_weight() then divides by cfs_rq->load.weight:
weight *= se->load.weight;
if (parent_entity(se))
weight /= cfs_rq->load.weight;
which takes a #DE inside enqueue_task_fair():
Oops: divide error: 0000 [#1] SMP NOPTI
RIP: 0010:enqueue_task_fair+0x422/0x950
Call Trace:
<TASK>
enqueue_task+0x8e/0x250
wake_up_new_task+0x148/0x2e0
kernel_clone+0x1c6/0x390
__x64_sys_clone+0xcc/0x100
do_syscall_64+0x147/0x3c0
</TASK>
This is not survivable in practice: with panic_on_oops=0 the kernel took
the first #DE and continued for 476 ms, then faulted at the same RIP with
identical register state and an identical RSP, because the oops recovery
path (kill task -> schedule()) re-enters the same enqueue while the rq
lock is held mid-enqueue. The second fault escalates to a panic.
Flooring tg_cpus() at 1 makes it symmetric with tg_tasks() and keeps
shares_max >= tg_shares, so the MIN_SHARES floor in __calc_smp_shares()
can no longer be bypassed.
Note this only removes the division hazard. Whether cpuset_num_cpus() can
legitimately return 0 -- via the cpu hotplug/suspend path where a v2
cpuset may transiently become empty, or via an RCU race -- is a separate
question still open on the report thread.
Fixes: 90ac22ffef48 ("sched/fair: Add cgroup_mode: max")
Signed-off-by: Jake Steinman <j@metarealtyinc.ca>
Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
Link: https://lore.kernel.org/all/20260818231333.1441757-1-j@metarealtyinc.ca/
Link: https://patch.msgid.link/20260819132104.2148918-1-j@metarealtyinc.ca
|
|
A read from /proc/sys/kernel/sched_rt_runtime_us leads to backtrace due
to missing cpu_hotplug_lock with CONFIG_CPUSETS=n. The callchain is
sched_rt_handler() -> partition_sched_domains() -> sched_cache_set() ->
static_key_enable_cpuslocked(&sched_cache_present).
sched_cache_set() itself is also invoked from sched_init_domains() which
is early during the boot, holding just the sched_domains_mutex_lock().
Here is no warning because it happens before user space is running (and
hotplug operations are not possible).
There is also sched_cache_active_set() which acquires the hotplug lock
before invoking any of the _cpuslocked() functions.
This is only a problem with CONFIG_CPUSETS=n because in the =y case the
other implementation of rebuild_sched_domains acquires the CPU-hotplug
lock.
Acquire CPU hotplug lock before in rebuild_sched_domains(), before
partition_sched_domains() is invoked for the CONFIG_CPUSETS=n case.
Fixes: a7660ce1590fc ("sched/cache: Fix has_multi_llcs iff at least one partition has multiple LLCs")
Signed-off-by: Sebastian Andrzej Siewior <bigeasy@linutronix.de>
Reivewed-by: Ridong Chen <ridong.chen@linux.dev>
Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
Reviewed-by: Chen Yu <yu.c.chen@intel.com>
Reviewed-by: Tim Chen <tim.c.chen@linux.intel.com>
Reviewed-by: Waiman Long <longman@redhat.com>
Reviewed-by: Valentin Schneider <vschneid@redhat.com>
Reviewed-by: Shrikanth Hegde <sshegde@linux.ibm.com>
Reviewed-by: Aaron Tomlin <atomlin@atomlin.com>
Tested-by: Dietmar Eggemann <dietmar.eggemann@arm.com>
Link: https://patch.msgid.link/20260813073855.ji2UrtVh@linutronix.de
|
|
SPI and LPI interrupts do not have an architected default value for their
IAFFID (interrupt affinity ID) - the property that determines an IRQ
affinity.
Current code awkwardly tries to set a default IAFFID value corresponding
to the logical cpu executing the gicv5_hwirq_init() function at SPI/LPI
allocation time.
There are two issues with this approach:
- gicv5_hwirq_init() is called in preemptible context and current code
uses smp_processor_id() to check the logical cpu executing the function.
Whilst that's harmless, it can spit a splat on DEBUG_PREEMPT kernels
- Setting the default SPI/LPI IAFFID to the one belonging to the cpu
executing the IRQ allocation is a completely arbitrary choice
It is saner to remove the SPI/LPI IAFFID set-up in the SPI/LPI domain IRQ
allocation code and flag SPI/LPI irqchips as IRQCHIP_AFFINITY_PRE_STARTUP
so that the SPI/LPI affinity is initialized by IRQ core to a sane value
before an IRQ is started up using the respective irq_chip
irq_set_affinity() callback.
Fixes: 5cb1b6dab2de ("irqchip/gic-v5: Add GICv5 IRS/SPI support")
Fixes: 0f0101325876 ("irqchip/gic-v5: Add GICv5 LPI/IPI support")
Signed-off-by: Lorenzo Pieralisi <lpieralisi@kernel.org>
Signed-off-by: Thomas Gleixner <tglx@kernel.org>
Link: https://patch.msgid.link/20260812-gicv5-7-2-fixes-v1-7-3743e82c69a4@kernel.org
|
|
In set-ups with a 2-level IST, L1 table entries are created dynamically
when LPIs are allocated.
The L1 allocation and mapping, implemented in gicv5_irs_iste_alloc() is
carried out in preemtible context and can be carried out on any IRS in
the system.
Current code indexes the per_cpu_irs_data per cpu array using
smp_processor_id() to retrieve the IRS that is local to the core
executing gicv5_irs_iste_alloc().
Since that's preemptible context, the core executing that function can
change on preemption. Given that every IRS in the system is equivalent
to each core, this is not really an issue in that even if the thread
is preempted and resumed on a different cpu, the table allocation and
mapping to an IRS would work seamlessly regardless.
On the other hand, smp_processor_id() spits a legitimate splat on
DEBUG_PREEMPT kernels when used in preemtible context and this should
be fixed.
Given that all IRSes are equivalent from a core perspective in terms of
IST initialization, always choose as a policy the IRS local to logical
cpu 0, preventing the smp_processor_id() splat.
Fixes: 0f0101325876 ("irqchip/gic-v5: Add GICv5 LPI/IPI support")
Signed-off-by: Lorenzo Pieralisi <lpieralisi@kernel.org>
Signed-off-by: Thomas Gleixner <tglx@kernel.org>
Link: https://sashiko.dev/#/message/20260810104747.E5CE71F000E9%40smtp.kernel.org
Link: https://patch.msgid.link/20260812-gicv5-7-2-fixes-v1-6-3743e82c69a4@kernel.org
|
|
In gicv5_irs_of_init(), an IRS is set-up using of_io_request_and_map() to
request its memory region (corresponding to the configuration frame) and
map the IRS configuration frame.
On gicv5_irs_of_init() failure, the driver unmaps the IRS iomem region but
does not release the requested memory region leaving it allocated in the
iomem resource tree.
Fix it by releasing the iomem region on gicv5_irs_of_init() probe failure.
Likewise, on both OF and ACPI driver init failure, IRS iomem regions are
requested but never released in gicv5_irs_remove().
Stash a copy of the IRS iomem region in a struct resource in
struct gicv5_irs_chip_data and use it to release the requested region in
gicv5_irs_remove() if the driver probe fails.
Fixes: 5cb1b6dab2de ("irqchip/gic-v5: Add GICv5 IRS/SPI support")
Fixes: 35866efa52fe ("irqchip/gic-v5: Add ACPI IRS probing")
Signed-off-by: Lorenzo Pieralisi <lpieralisi@kernel.org>
Signed-off-by: Thomas Gleixner <tglx@kernel.org>
Link: https://sashiko.dev/#/message/20260810104747.E5CE71F000E9%40smtp.kernel.org
Link: https://patch.msgid.link/20260812-gicv5-7-2-fixes-v1-5-3743e82c69a4@kernel.org
|
|
Current code fails to disable interrupts on gicv5_starting_cpu() failure
and to set the handle_arch_irq pointer to NULL if gicv5_irs_enable() fails.
Update the respective error paths to fix them.
Fixes: 7ec80fb3f025 ("irqchip/gic-v5: Add GICv5 PPI support")
Signed-off-by: Lorenzo Pieralisi <lpieralisi@kernel.org>
Signed-off-by: Thomas Gleixner <tglx@kernel.org>
Link: https://patch.msgid.link/20260812-gicv5-7-2-fixes-v1-4-3743e82c69a4@kernel.org
|
|
GICv5 driver probe failures cause IRSes initialized by the kernel to be
unmapped and their data structures to be destroyed but the current driver
leaves the probed IRSes enabled, whereas they should be disabled.
Disable IRSes on driver probe failures so that the IRSes are brought back
to their quiescent HW state.
Fixes: 5cb1b6dab2de ("irqchip/gic-v5: Add GICv5 IRS/SPI support")
Fixes: 35866efa52fe ("irqchip/gic-v5: Add ACPI IRS probing")
Signed-off-by: Lorenzo Pieralisi <lpieralisi@kernel.org>
Signed-off-by: Thomas Gleixner <tglx@kernel.org>
Link: https://sashiko.dev/#/message/20260810104747.E5CE71F000E9%40smtp.kernel.org
Link: https://patch.msgid.link/20260812-gicv5-7-2-fixes-v1-3-3743e82c69a4@kernel.org
|
|
In gicv5_free_lpi_domain() the LPI domain being freed can be NULL.
Check it and return before trying to free it if it is.
Fixes: 0f0101325876 ("irqchip/gic-v5: Add GICv5 LPI/IPI support")
Signed-off-by: Lorenzo Pieralisi <lpieralisi@kernel.org>
Signed-off-by: Thomas Gleixner <tglx@kernel.org>
Link: https://sashiko.dev/#/message/20260810104747.E5CE71F000E9%40smtp.kernel.org
Link: https://patch.msgid.link/20260812-gicv5-7-2-fixes-v1-2-3743e82c69a4@kernel.org
|
|
In gic_acpi_parse_iaffid() a given MADT GICC entry might not correspond
to a logical cpu recognized by the kernel, resulting in the cpu variable
initialization to an error value.
Currently, the get_logical_index() return value is not checked for failure,
which might result in out-of-bounds memory corruption while trying to
index a per_cpu variable array.
Add a check to evaluate get_logical_index() return value.
Fixes: 35866efa52fe ("irqchip/gic-v5: Add ACPI IRS probing")
Signed-off-by: Lorenzo Pieralisi <lpieralisi@kernel.org>
Signed-off-by: Thomas Gleixner <tglx@kernel.org>
Link: https://sashiko.dev/#/message/20260810104747.E5CE71F000E9%40smtp.kernel.org
Link: https://patch.msgid.link/20260812-gicv5-7-2-fixes-v1-1-3743e82c69a4@kernel.org
|
|
The write disabling the GICv5 CPU interface is only guaranteed to take
effect after a context synchronization event. Without one, execution can
return from gicv5_cpu_disable_interrupts() while an interrupt is still
able to be taken.
Add an ISB after the ICC_CR0_EL1 write to ensure interrupts are
disabled before the function returns. No corresponding ISB is added
when enabling the interface, as interrupt delivery is asynchronous and
there is no obvious benefit to waiting for it.
Fixes: 7ec80fb3f025 ("irqchip/gic-v5: Add GICv5 PPI support")
Signed-off-by: Sascha Bischoff <sascha.bischoff@arm.com>
Signed-off-by: Thomas Gleixner <tglx@kernel.org>
Reviewed-by: Lorenzo Pieralisi <lpieralisi@kernel.org>
Link: https://sashiko.dev/#/patchset/20260724104819.1296803-1-sascha.bischoff@arm.com?part=6
Link: https://patch.msgid.link/20260811152630.942023-3-sascha.bischoff@arm.com
|
|
IRS affinity setup publishes an IRS pointer and IAFFID state in the
per-CPU data before the remaining IRS initialization can fail. The
error path then frees the IRS data without clearing that published
state, leaving CPUs associated with freed memory.
On initialization failure and normal IRS teardown, clear the per-CPU
IRS association by removing the stale pointer to irs_data. Also
invalidate the per-CPU IAFFID state for any CPUs that were tied to the
IRS before it was freed.
Fixes: 5cb1b6dab2de ("irqchip/gic-v5: Add GICv5 IRS/SPI support")
Fixes: 35866efa52fe ("irqchip/gic-v5: Add ACPI IRS probing")
Signed-off-by: Sascha Bischoff <sascha.bischoff@arm.com>
Signed-off-by: Thomas Gleixner <tglx@kernel.org>
Reviewed-by: Lorenzo Pieralisi <lpieralisi@kernel.org>
Link: https://sashiko.dev/#/patchset/20260724104819.1296803-1-sascha.bischoff@arm.com?part=2
Link: https://patch.msgid.link/20260811152630.942023-2-sascha.bischoff@arm.com
|
|
The INTC0 interrupt-merge (INTM) space has 50 sources at 10 per bank, i.e.
INTC0_INTM_NUM / INTM_IRQS_PER_BANK = 5 banks. This is reflected everywhere
the banks are indexed: the aspeed_intc0_intm_routes[] table has 5 valid
entries, and the mask/unmask/eoi paths compute the bank as (hwirq -
INTM_BASE) / INTM_IRQS_PER_BANK, spanning banks 0-4.
However, INTC0_INTM_BANK_NUM is hardcoded to 3, so
aspeed_intc0_disable_intm() only clears IER for banks 0-2 at probe. Banks 3
and 4 are left in whatever state the firmware configured them , which can
leave interrupts enabled before a handler is installed.
Derive the bank count from the source count so the probe-time disable
covers every bank.
Fixes: 07825e41519a ("irqchip/ast2700-intc: Add AST2700-A2 support")
Signed-off-by: Michael Pesa <michael.pesa@icloud.com>
Signed-off-by: Thomas Gleixner <tglx@kernel.org>
Link: https://patch.msgid.link/20260722050243.298355-1-michael.pesa@icloud.com
|
|
mpfs_cfg_clk_set_rate() passes the mask and value arguments to
regmap_update_bits() in the wrong order. The resulting write becomes
reg = orig_reg | val, causing bits to not be cleared if the clock
divider changes.
Pass the arguments in the correct order so the divider field is updated
as intended.
Fixes: c6f2dddfa7f9 ("clk: microchip: mpfs: use regmap for clocks")
Signed-off-by: Pedro Kopper <pedro.kopper@microchip.com>
Reviewed-by: Conor Dooley <conor.dooley@microchip.com>
Cc: stable@vger.kernel.org
Signed-off-by: Stephen Boyd <sboyd@kernel.org>
|
|
The clk_init_data structure contains several mutually-exclusive members
for different methods to specify the possible parents of a clock,
prompting drivers to initialize only the members they need. However,
not initializing all members may cause subtle issues, which are only
exposed when CONFIG_INIT_STACK_ALL_PATTERN or CONFIG_INIT_STACK_NONE is
enabled.
visconti_clk_register_gate() fills in init.parent_data, and assumes that
init.parent_names is NULL. However, the latter in uninitialized, and
thus may cause a crash.
Make sure all members are fully initialized, to fix such bugs, and to
avoid future breakage when converting drivers to a different method for
specifying the parents.
Fixes: b4cbe606dc3674b2 ("clk: visconti: Add support common clock driver and reset driver")
Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
Reviewed-by: Brian Masney <bmasney@redhat.com>
Reviewed-by: Nobuhiro Iwamatsu <nobuhiro.iwamatsu.x90@mail.toshiba>
Signed-off-by: Stephen Boyd <sboyd@kernel.org>
|
|
The clk_init_data structure contains several mutually-exclusive members
for different methods to specify the possible parents of a clock,
prompting drivers to initialize only the members they need. However,
not initializing all members may cause subtle issues, which are only
exposed when CONFIG_INIT_STACK_ALL_PATTERN or CONFIG_INIT_STACK_NONE is
enabled.
_register_mux() fills in init.parent_data, and assumes that
init.parent_names is NULL. However, the latter is uninitialized, and
thus may cause a crash.
Make sure all members are fully initialized, to fix such bugs, and to
avoid future breakage when converting drivers to a different method for
specifying the parents.
Fixes: 667f420c09f1417c ("clk: ti: mux: resolve parent clocks by DT index, not by name")
Closes: https://lore.kernel.org/CAMuHMdU3yVqoyHC4eNF2NuYo8wy+6ODLoYat4R71X99Mxc_=kw@mail.gmail.com
Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
Reviewed-by: Brian Masney <bmasney@redhat.com>
Reviewed-by: Mathieu Dubois-Briand <mathieu.dubois-briand@bootlin.com>
Signed-off-by: Stephen Boyd <sboyd@kernel.org>
|
|
The quic_username@quicinc.com emails have been deprecated inside Qualcomm
for a while now in favor of firstname.lastname@oss.qualcomm.com Re-route
the emails to Taniya's current OSS email address to avoid Outlook bounces
("recipient's inbox is full").
Link: https://lore.kernel.org/20260817-topic-taniya_email_bounce-v1-1-d7af1f113d64@oss.qualcomm.com
Signed-off-by: Konrad Dybcio <konrad.dybcio@oss.qualcomm.com>
Cc: Taniya Das <taniya.das@oss.qualcomm.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
|
|
ocfs2_dir_foreach_blk_id() re-scans the inline data area the same way
ocfs2_dir_foreach_blk_el() re-scans a directory block, and is missing the
same two bounds:
for (i = 0; i < i_size_read(inode) && i < offset; ) {
de = (struct ocfs2_dir_entry *)(data->id_data + i);
if (le16_to_cpu(de->rec_len) < OCFS2_DIR_REC_LEN(1))
break;
i += le16_to_cpu(de->rec_len);
}
ocfs2_validate_inode_block() keeps i_size inside the inline area:
if (le16_to_cpu(data->id_count) >
ocfs2_max_inline_data_with_xattr(sb, di))
if (le64_to_cpu(di->i_size) > le16_to_cpu(data->id_count))
and that area runs to the end of the inode block, so for a full inline
directory data->id_data + i_size is the end of di_bh->b_data. A bogus
rec_len leaves i in the last OCFS2_DIR_REC_LEN(1) - 1 bytes of it, and
de->rec_len, at byte offset 8 within the entry, is then read past the
block.
The emit loop below hands i_size_read(inode) to ocfs2_check_dir_entry(),
which refuses both an entry that close to the end and one whose rec_len
runs past it. Apply the same two bounds to the re-validation scan,
reading i_size once into a local as ocfs2_check_dir_entry() takes it as
@size.
Unlike the extent case there is no mask to corrupt here: an unbounded i
only sets ctx->pos past i_size, which ends the readdir early rather than
moving it to the wrong place.
Link: https://lore.kernel.org/20260811024337.3972976-3-zhanxusheng@xiaomi.com
Signed-off-by: Zhan Xusheng <zhanxusheng@xiaomi.com>
Reviewed-by: Joseph Qi <joseph.qi@linux.alibaba.com>
Cc: Mark Fasheh <mark@fasheh.com>
Cc: Joel Becker <jlbec@evilplan.org>
Cc: Junxiao Bi <junxiao.bi@oracle.com>
Cc: Changwei Ge <gechangwei@live.cn>
Cc: Jun Piao <piaojun@huawei.com>
Cc: Heming Zhao <heming.zhao@suse.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
|
|
Patch series "ocfs2: bound-check both readdir re-validation scans", v2.
This patch (of 2):
When the inode version changed since the last readdir(),
ocfs2_dir_foreach_blk_el() re-scans the directory block from its start to
relocate the current position:
for (i = 0; i < sb->s_blocksize && i < offset; ) {
de = (struct ocfs2_dir_entry *)(bh->b_data + i);
if (le16_to_cpu(de->rec_len) < OCFS2_DIR_REC_LEN(1))
break;
i += le16_to_cpu(de->rec_len);
}
i walks the block on rec_len values taken from the block itself and the
only thing tested is that rec_len is not too small, so a single bogus
rec_len leaves i anywhere in the block, including its last
OCFS2_DIR_REC_LEN(1) - 1 bytes. @offset comes from ctx->pos, which
userspace moves with lseek() on the directory fd, and decides how far the
walk gets.
Two bounds are missing, both of which ocfs2_check_dir_entry() applies for
the emit loop below.
de->rec_len sits at byte offset 8 within the entry, so dereferencing de in
that tail reads past the s_blocksize buffer. ocfs2_check_dir_entry()
declines to look at an entry that close to the end:
size - buf_offset < OCFS2_DIR_REC_LEN(1)
Nothing bounds i += rec_len either, so i can end up past the block. The
emit loop that follows is guarded by offset < sb->s_blocksize and does not
run, but
offset = i;
ctx->pos = (ctx->pos & ~((loff_t)sb->s_blocksize - 1)) | offset;
runs first and ORs a value with bits above the block mask into ctx->pos,
corrupting the block number readdir() resumes from.
ocfs2_check_dir_entry() rejects that as "directory entry overrun":
next_offset = buf_offset + rlen;
... next_offset > size
Apply both bounds. For a consistent directory this changes nothing:
entries are at least OCFS2_DIR_REC_LEN(1) bytes and do not cross the end
of the block, so no valid entry is skipped.
Found by the sashiko review tool; fix approach suggested by Joseph Qi.
Link: https://lore.kernel.org/20260811024337.3972976-1-zhanxusheng@xiaomi.com
Link: https://sashiko.dev/#/patchset/20260806022044.167962-1-zhanxusheng@xiaomi.com
Link: https://lore.kernel.org/20260811024337.3972976-2-zhanxusheng@xiaomi.com
Signed-off-by: Zhan Xusheng <zhanxusheng@xiaomi.com>
Suggested-by: Joseph Qi <joseph.qi@linux.alibaba.com>
Reviewed-by: Joseph Qi <joseph.qi@linux.alibaba.com>
Cc: Mark Fasheh <mark@fasheh.com>
Cc: Joel Becker <jlbec@evilplan.org>
Cc: Junxiao Bi <junxiao.bi@oracle.com>
Cc: Changwei Ge <gechangwei@live.cn>
Cc: Jun Piao <piaojun@huawei.com>
Cc: Heming Zhao <heming.zhao@suse.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
|
|
squashfs_cache_get() puts a task to sleep when its block is not cached and
every cache entry is busy. Those sleeps are non-exclusive, so the
nr_exclusive == 1 budget squashfs_cache_put() has always passed to
wake_up() is inert and one release makes every waiter runnable. A wakee
only returns to squashfs_cache_get() if it observes cache->unused before
the entry is reclaimed; later wakees see zero and re-queue inside
wait_event() without rescanning. One freed entry satisfies exactly one
capacity waiter, so waking the rest is waste.
On a Meta production host serving a Python web application from a packaged
squashfs image, a 30-second trace caught 1,045,132 cache-release wake
calls and 19,511,556 wakeups: 18.7 per release, although each release
added only one reusable cache entry. This was causing significant spikes
in CPU usage.
Make the waits exclusive, enqueueing while still holding cache->lock so
that a concurrent lookup either sees the waiter queued or the waiter sees
the block that lookup publishes. Two things follow.
A wakee cannot be assumed to consume the entry it was woken for: it may
find its own block published meanwhile, share that entry, and leave the
freed one unclaimed. So a wakee which shares hands its wakeup on to the
next waiter, as commit 0ddad21d3e99 ("pipe: use exclusive waits when
reading or writing") does with wake_next_reader.
And a waiter can now sleep through a publication of the very block it
wants, which the old broadcast gave it repeated chances to notice. So
waiters are keyed by block: publishing wakes every waiter for that block
(nr_exclusive == 0), freeing an entry wakes one. That needs a custom wake
callback, like wake_page_function() in mm/filemap.c, which also records
which wakeup arrived so the handoff only fires for a capacity wakee.
Broadcast is kept where more than one task can proceed - every waiter for
a published block, and the wake_up_all() on entry->wait_queue - at the
cost of walking the queue under wait_queue.lock to test the key. Waiters
are now served FIFO with a scheduling round trip per handoff hop, so
per-waiter latency changes; the filebench run below is 4x oversubscribed,
where that should hurt most.
Measured on a 32-CPU VM against a read-only squashfs (gzip,
DECOMP_MULTI_PERCPU, FILE_DIRECT, default 8 metadata / 3 fragment cache
entries) staged in tmpfs, page cache dropped each iteration to force cold
decompression:
elbencho, 64 threads
metadata stat 700 -> 1320 files/s 1.9x
small-file read 40 -> 60 MiB/s 1.5x
filebench, 128 threads, open+read+stat+close (mean of 3x 30s)
throughput 11,314 -> 25,186 ops/s 2.2x
sched:sched_wakeup 27.0 -> 4.55 per op 5.9x fewer
context switches 37.2 -> 7.64 per op 4.9x fewer
Wakeups and context switches are per operation, since the two runs did
2.2x different amounts of work. Workloads which never queue for a cache
entry gain no wakeups.
Link: https://lore.kernel.org/20260807172421.3875982-1-usama.arif@linux.dev
Signed-off-by: Usama Arif <usama.arif@linux.dev>
Reviewed-by: Phillip Lougher <phillip@squashfs.org.uk>
Cc: Boris Burkov <boris@bur.io>
Cc: Christian Brauner <brauner@kernel.org>
Cc: Jeff Layton <jlayton@kernel.org>
Cc: Johannes Weiner <hannes@cmpxchg.org>
Cc: Rik van Riel <riel@surriel.com>
Cc: Shakeel Butt <shakeel.butt@linux.dev>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
|
|
prctl_set_auxv() copies the user vector into a stack buffer, forces
AT_NULL on the last two entries there, and then copies only len bytes into
mm->saved_auxv. Which is fine until the vector is shorter than the
buffer, because then the forced terminator sits past the end of the copy
and never lands in saved_auxv at all.
The code even says
/* Make sure the last entry is always AT_NULL */
and it does, just not in the part that gets copied.
So mm->saved_auxv keeps the stale tail from exec. Reproducing it is easy:
from a process with CAP_SYS_RESOURCE (just run it as root), call
prctl(PR_SET_MM, PR_SET_MM_AUXV, ...) with a vector that has a couple of
entries and no AT_NULL inside len (32 bytes on arm64), and then hexdump
/proc/self/auxv, or gcore the process and look at the AUXV note with
readelf -n. This is arm64, the new vector was just { AT_UID, 0x1111,
AT_GID, 0x2222 }:
idx before (from exec) after the prctl
[0] AT_SYSINFO_EHDR 0x7ed1d6e000 AT_UID 0x1111 <- new
[1] AT_MINSIGSTKSZ 0x1270 AT_GID 0x2222 <- new
[2] AT_HWCAP 0x119fff AT_HWCAP 0x119fff <- stale
[3] AT_PAGESZ 0x1000 AT_PAGESZ 0x1000 <- stale
... 16 more entries ... <- stale
[20] AT_NULL 0x0 AT_NULL 0x0
21 entries before the prctl, still 21 after: the two new ones plus all 19
left over from exec.
Every consumer walks the vector until AT_NULL, so what they get now is a
vector that never existed at exec, the head from the prctl glued onto the
tail of the old binary. gdb and crash pull the AUXV note out of coredumps
to find AT_PHDR, AT_ENTRY, AT_SYSINFO_EHDR and friends, and a mixed vector
points them at the wrong layout. /proc/<pid>/auxv and PR_GET_AUXV hand
the same mess out to live processes too. Nothing crashes, everything just
quietly reads a frankenstein auxv.
And callers that terminate their own vector hide the whole thing, which is
likely why nobody noticed since PR_SET_MM_AUXV landed in 2012. Nothing
exciting security wise either, I mean it needs CAP_SYS_RESOURCE to begin
with.
prctl_set_mm_map() right above already copies the whole buffer for exactly
this reason, so just do the same here. user_auxv is zero initialized and
only partially filled from userspace, so the rest is zeros and nothing
leaks.
Link: https://lore.kernel.org/20260809002901.32591-1-include@grrlz.net
Fixes: fe8c7f5cbf91 ("c/r: prctl: extend PR_SET_MM to set up more mm_struct entries")
Signed-off-by: Bradley Morgan <include@grrlz.net>
Cc: Alexey Dobriyan <adobriyan@gmail.com>
Cc: Cyrill Gorcuno <gorcunov@openvz.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
|
|
1. Update my university email to my personal Gmail, as the former will
expire after graduation.
2. Fix a typo in my Gmail domain.
Link: https://lore.kernel.org/20260810073235.22980-1-linfeng.sun.dev@gmail.com
Signed-off-by: Linfeng Sun <linfeng.sun.dev@gmail.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
|
|
WARN_ON_ONCE() takes a condition, not a message. The string literals are
always true, so the warnings still trigger but the messages are never
printed.
Use WARN_ONCE(1, ...) instead to print the messages and keep the once-only
behavior.
Found with a Coccinelle script. Clang's -Wstring-conversion also flags
such calls but is not enabled in kernel builds.
Link: https://lore.kernel.org/20260808123608.73613-1-kmehltretter@gmail.com
Fixes: 82114e45131f ("lib/interval_tree: add test case for interval_tree_iter_xxx() helpers")
Assisted-by: Claude:claude-fable-5 coccinelle
Signed-off-by: Karl Mehltretter <kmehltretter@gmail.com>
Reviewed-by: Andrew Morton <akpm@linux-foundation.org>
Reviewed-by: Wei Yang <richard.weiyang@gmail.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
|
|
Linux 7.2
There was a lot of conflicts this round between fixes and next,
and I'd like to get the merge resolutions that we have in drm-tip.
Signed-off-by: Dave Airlie <airlied@redhat.com>
|
|
Pull crypto update from Herbert Xu:
"API:
- Add af_alg_restrict sysctl and white list
- Fix potential suspend/resume races in hwrng
Algorithms:
- Optimize vli additive operations using compiler builtins in ecc
Drivers:
- Remove unsafe/deprecated algorithms from qce
- Mark qce as BROKEN
- Add runtime PM and interconnect bandwidth scaling support to qce
- Remove crypto_rng from qcom, sun8i and caam
- Fix SG list issues in iaa
- Fix SEV init path bugs in ccp"
* tag 'v7.3-p1' of git://git.kernel.org/pub/scm/linux/kernel/git/herbert/crypto-2.6: (122 commits)
crypto: lskcipher - propagate errors from unaligned crypt
crypto: keembay - use crypto_memneq() to compare CCM AEAD tags
crypto: keembay - use crypto_memneq() to compare GCM AEAD tags
crypto: sa2ul - use crypto_memneq() to compare AEAD tag
hwrng: drivers - use named initializers for acpi_device_id
crypto: qce - fix CCM AAD buffer underallocation
crypto: iaa - unmap dst before software fallback on decompress
crypto: iaa - use bounce buffer for multi-sg decompress input
crypto: iaa - avoid counting fallback decompression bytes
crypto: iaa - fall back to software for multi-entry scatterlists
hwrng: core - Stop/start hwrng_fillfn() kthread before/after suspend-resume
crypto: hisilicon/sec2 - fix CCM algorithm long packet failure
crypto: eip93 - use struct_size() and flexible array for ring allocation
crypto: krb5 - use kfree_sensitive() for derived key buffers
crypto: af_alg - Stop after finding name in allowlist
crypto: af_alg - Replace 'bool privileged' with flags
crypto: af_alg - Make cbc(paes) privileged-only
hwrng: imx-rngc - Disable clock on registration failure
crypto: qat - remove dead ADF_HEX code
crypto: qce - simplify qce_handle_request
...
|
|
Pull integrity updates from Mimi Zohar:
- TPM initialization is sometimes delayed until deferred_probe_initcall
Since ordering is not guaranteed within the same initcall level, IMA
may initialize before the TPM and fall back to TPM-bypass mode. A new
config option, CONFIG_IMA_INIT_LATE_SYNC, allows those building the
kernel to defer IMA initialization to late_initcall_sync, accepting
the integrity risk of missing early measurements in exchange for
avoiding TPM-bypass mode.
- The raw policy rules are now measured, as well as the complete
policy, closing a gap in integrity measurement coverage
* tag 'integrity-v7.3' of git://git.kernel.org/pub/scm/linux/kernel/git/zohar/linux-integrity:
ima: measure userspace policy writes before parsing
ima: add critical data measurement for loaded policy
security: ima: rename boot_aggregate when ima is initialised at late_sync
security: ima: introduce IMA_INIT_LATE_SYNC option
security: lsm: allow LSMs to register for late_initcall_sync init
|
|
Pull smack updates from Casey Schaufler:
- Spelling fix
- Code optimization in smackfs
- Fix credential mis-uses
- Place limits on two of the smackfs interfaces
* tag 'Smack-for-7.3' of https://github.com/cschaufler/smack-next:
smack: fix cred UAF in smack_file_send_sigiotask()
smack: restrict smackfs/{direct,mapped} values to 0-255
smack: deduplicate smackfs/{direct,mapped} file_operations
smack: show msgrcv() subject task in audit
smack: fix incorrect task context in smack_msg_queue_msgrcv
security: smack: fix spelling mistake
smack: simplify write handlers of sysfs entries
Smack: Fix error in capability bypass
|
|
Pull LSM updates from Paul Moore:
- Remove task_euid()
The task_euid(), and Rust counterpart, was never widely used, for
good reason, and now that the only user is gone we're removing it to
rid ourselves of both dead and funky code.
- Documentation improvements
Correct some of the kdoc comments for security_task_prctl() and
clarify the rust comments on task UID accessors.
- Fix a memory leak in the LSM syscall selftests
* tag 'lsm-pr-20260814' of git://git.kernel.org/pub/scm/linux/kernel/git/pcmoore/lsm:
selftests/lsm: Fix memory leak in attr_lsm_count
cred: delete task_euid()
rust: task: clarify comments on task UID accessors
lsm: clarify security_task_prctl() hook documentation
|
|
Pull selinux updates from Paul Moore:
- Convert a __get_free_page() call into a kmalloc() call
We had some very old code that called out to __get_free_page() for
allocating a pathname. There is no reason this couldn't be done with
a call to kmalloc() so we've done the conversion and now there is one
less __get_free_page() caller in the kernel.
- Limit the number of retired/unknown DCCP netlink messages
While DCCP is gone from the kernel, there are still userspace tools
which try to talk to the kernel about DCCP sockets which were
generating SELinux related log noise (unrecognized netlink message).
This pull request both limits the log messages to just the first
instance and also explains to the user that DCCP support has been
removed.
- Convert the SELinux strlcat() calls to seq_buf_XXX() calls
As part of the effort to drop the strlcat() API from the kernel, the
SELinux/IMA code was converted over to using seq_buf_XXX() calls.
- Only calculate the SELinux IMA configuration string length once
Previously each call to generate a SELinux configuration string for
IMA would have to calculate the length of the string. While the
contents of the string will likely change over the lifetime of the
system, the length of the string will not. Calculate the string
length once at boot and reuse the length value throughout the
lifetime of the system.
- Further validation of the SELinux policy at policy load time
Perform additional sanity checks on the policy constraints and types.
- Proper cleanup and error handling for selinuxfs init failures
We were not properly cleaning up some state in the case where
selinuxfs fails to initialize properly. It's somewhat of an academic
exercise as a failure to initialize selinuxfs will cause the system
to fail on boot, but it's arguably better to make sure we do things
the proper way.
- Various code cleanups
Convert integer flags to boolean types and drop an uncessary goto
from the SELinux code.
* tag 'selinux-pr-20260814' of git://git.kernel.org/pub/scm/linux/kernel/git/pcmoore/selinux:
selinux: validate constraint expression attr and op at load time
selinux: compute the IMA configuration settings string length once at boot
selinux: replace strlcat() with seq_buf in selinux_ima_collect_state()
selinux: suppress warning flood for retired DCCP netlink messages
selinux: tighten type validation during policy load
selinux: drop unnecessary goto and label from avc_alloc_node()
selinux: convert int flags to bool flags in ss/services.c
selinux: clean up selinuxfs resources on init failure
selinux: hooks: use kmalloc() to allocate path buffer
|
|
Pull audit updates from Paul Moore:
- Drop BUG_ON() assertions from two functions
While I don't recall any bug reports from either of these assertions
in recent memory, neither of these checks warrant the kernel panic
that could result from BUG_ON(). One of the BUG_ON() calls is
converted to a WARN_ON_ONCE() and the other to a lockdep assertion.
- Fix an audit tree reference counting problem
Fix a corner case where audit could end up unintentionally dropping
the last reference to an audit tree while the tree was still in use.
We should probably revisit the audit tree handling code in full, but
this patch works, and should be easy to backport to stable trees and
downstream kernels.
- Update the audit syscall classification tables
Add some missing syscalls to the PERM class
* tag 'audit-pr-20260814' of git://git.kernel.org/pub/scm/linux/kernel/git/pcmoore/audit:
audit: avoid dropping live tree ref on fsnotify rule autoremove
audit: drop BUG_ON() from audit_signal_info_syscall()
audit: drop BUG_ON() from audit_add_to_parent()
audit: add missing syscalls to PERM class tables
|
|
Pull ring-buffer updates from Steven Rostedt:
- Remove unneeded semicolon
A macro ended with a semicolon that wasn't needed.
- Fix freeing cpu_buffer extra subbuffer with order greater than zero
When the cpu_buffer was being freed, its "free" page, was using
free_page() to free it when it could be more than one page.
- Hold the cpu_buffer lock when resizing the subbuffer
The freeing of the "free" page of the cpu_buffer was done without
locking. The order of the data was being saved and then the "free"
page was set to NULL. But there is a race that the "free" page could
have been updated between those two operations. Add locking around it
to prevent the race.
- Save the order of the data along with the data in the free page
The cpu_buffer would store just the data portion of the subbuffer
page in its descriptor. But it did not store the order of the data
pages. The order was being saved in the global buffer descriptor. But
this leads to races.
Have the cpu_buffer save the subbuf data along with its metadata
(which includes the order of the page) to make sure when it frees it,
it frees the correct order along with it.
- Remove the subbuf_size and use the order directly when needed
Having a size field for the size of the subbufer along with its order
allowed for races to have them get out of sync. Remove the
subbuf_size and use the order from the subbuf meta data directly
under locks.
Use the subbuf_order for other calculations in the ring buffer.
- Remove the useless "cpus" field of trace_buffer
The code has been restructured and the "cpus" field is no longer
used. Remove it.
- Remove the "mapped" field of the ring buffer and use a helper
function instead.
The "mapped" field has become a bit overused and made the code come
complex in using a counter for what is denoted as being mapped or
not. There are other fields that are set when the ring buffer is
considered mapped. Add a helper function to check those fields and
use that instead of keeping track of a counter.
* tag 'trace-ringbuffer-v7.3' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace:
ring-buffer: Remove ring_buffer_per_cpu::mapped
ring-buffer: Remove trace_buffer::cpus
ring-buffer: Dynamically calculate max_data_size
ring-buffer: Fix subbuf resize race with ring_buffer_alloc_read_page()
ring-buffer: Fix subbuf resize race with ring buffer readers
ring-buffer: Make cpu_buffer::free_page a buffer_data_read_page
ring-buffer: Hold cpu_buffer::lock when resizing a subbuf
ring-buffer: Free cpu_buffer::free_page with subbuf_order
ring-buffer: drop unneeded semicolon
|
|
Pull tracefs updates from Steven Rostedt:
- Define event fields before directory creation
Move the event_define_fields() call in event_create_dir() before the
eventfs directory creation. Previously, a failure after directory
creation wouldn't clean up eventfs_inode because the error path
didn't call eventfs_remove_dir(). This eliminates the need to clean
up the eventfs directories if event_define_fields() fails.
- Add warning for out of bounds pos in __eventfs_iterate()
Sashiko complains about the ctx->pos causing issues if it is less
than 2 or greater than MAX_INT in __eventfs_iterate(). The thing is,
the logic prevents that from happening. But to make Sashiko happy,
add a WARN_ON() and exit safely if the function ever does get input
that is out of the range the function expects.
* tag 'tracefs-v7.3' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace:
eventfs: Add warning for out of bounds pos in __eventfs_iterate()
eventfs: Define event fields before directory creation
|
|
* kvm-arm64/misc-7.3:
: Miscellaneous fixes for KVM/arm64, 7.3
:
: - Fixes for saving invalid table entries as part of saving the ITS
: tables (Fuad Tabba)
:
: - Don't reallocate the SPI array for re-attempted vgic_init(), avoiding
: a memory leak (Fuad Tabba)
:
: - Hold a reference on an LPI when saving the pending state (Qihang)
:
: - Don't WARN for out-of-range, guest-supplied INTID (Karl)
:
: - Avoid corrupting GPRs for 32-bit CP64 reads (Karl)
:
: - Reset 'in kernel' VGIC state when private IRQ allocation fails (Fuad)
:
: - Avoid kallsyms lookup in nVHE panic unless the host stage-2 is also
: disabled (Vincent)
:
: - Disregard Pending+Active state when computing maintenance IRQ for
: ICH_MISR_EL2.NP (Kajetan)
:
: - Various Sashiko-identified issues dealing with GICv5 (Sascha)
:
: - Fix CPU onlining in pKVM due to mismatched accesses when the MMU is
: disabled (Will)
KVM: arm64: Validate GICv5 timer PPIs before claiming ownership
KVM: arm64: vgic: Reject out-of-range GICv5 PPI IDs
KVM: arm64: vgic: Prevent speculative SPI array underflow
KVM: arm64: vgic: Free gic_kvm_info on initialization failure
KVM: arm64: Avoid mismatched accesses to 'struct kvm_nvhe_init_params'
KVM: arm64: vgic: Fix detection of MI on no pending LR
KVM: arm64: Drop %pB on nVHE panic when stage-2 is active
KVM: arm64: vgic: Reset in_kernel on private IRQ allocation failure
KVM: arm64: GICv2: Don't WARN on out-of-range GICV_DIR INTID
KVM: arm64: Preserve GPRs for AArch32 CP64 reads generating an UNDEF
KVM: arm64: vgic-v3: take an LPI reference in vgic_v3_save_pending_tables
KVM: arm64: vgic-its: Point saved ITEs at the next valid entry
KVM: arm64: vgic-its: Don't save collections the table cannot hold
KVM: arm64: vgic: Don't leak the SPI array when init is retried
KVM: arm64: vgic-its: Don't dereference a NULL collection on ITT save
Signed-off-by: Oliver Upton <oupton@kernel.org>
|
|
Pull tracing updates from Steven Rostedt:
- Expose btf_ids to trace events
In order to allow BPF programs to attach to system call trace events
(which are actually pseudo trace events built on top of raw_syscall
events), expose the BTF ID of the events. This will allow BPF
programs better precision in attaching to events.
- Use "u64" to assign to hist_field->type
Instead of using kstrdup("u64", GFP_KERNEL) to assign the
hist_field->type, just point it to "u64" instead. The
hist_field->type is freed via kfree_const().
- Replace kmalloc()/strcpy() with kstrdup() for trace_printk
Instead of having two calls to copy the module format string, just
use kstrdup().
- Use __free() in trace event histograms and triggres where possible
- Use seq_buf in trace event code instead of strcat()
Instead of calculating the size of the buffer to use and filling it
with strcat(), use the seq_buf infrastructure that takes care of
making sure not to overflow the string size.
- Reject invalid preemptirq_delay_test CPU affinity
The preempt_delay_test module can take an invalid CPU affinity mask
and create confusing output. Simply have the module reject invalid
affinity masks.
- Prevent division by zero in ftrace_ops sample module code
If the ftrace_ops sample module code receives the module parameter
nr_function_calls set to zero, it can cause a division by zero error.
- Warn when an event dereferences a parameter in TP_printk()
On boot up and module load, the trace event TP_printk() is scanned
for possible bugs. As the TP_printk() code is executed when the user
reads the "trace" file and processes the data written when the
trace_event executed, the data it reads can be literally days old.
The scan currently checks for dereferencing printk formats like
"%pI6". But it does not check if the parameters themselves have a
dereference like:
TP_printk("offset %08x: value %08x",
(u32)(__entry->addr - __entry->edma->membase), __entry->value)
__entry represents the pointer to the event on the ring buffer. The
__entry->edma->membase is dereferencing a pointer on the ring buffer
to find membase, but the __entry->edma may no longer be a valid
pointer.
Warn on this case too.
- Replace some strcpy() with strscpy()
- Clean up mmiotrace events to use assign_type() macro
The assign_type() macro makes sure the event type is indeed the type
that is being parsed. The mmiotrace trace was written before that
macro was created so it just simply typecasted the pointer.
Replace the typecasting with the macro.
- Have the ENUM processing to numbers only process what is added
The code that converts ENUMs to their numbers in the trace events
scanned all events to do the processing. This was true when a module
was loaded too. That is, instead of processing just the events for
the module, it processed *all* events. Even the builtin ones that
were processed at boot up.
Add a check for the event->module matching mod if it is a module
before processing it.
* tag 'trace-v7.3' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace: (21 commits)
tracing: Have trace_event_update_all() only handle module that is loading
tracing: Cleanup event_enable_trigger_parse() by using __free()
tracing: Report every TP_printk double dereference
tracing/mmiotrace: Use trace_assign_type() in mmio_print_mark()
tracing: Make per-template BTF id lists file-local
tracing: Use seq_buf for string concatenation
tracing: Use strscpy() instead of strcpy() in trace_sched_switch
tracing: Warn when an event dereferences a pointer in TP_printk()
samples/ftrace: Prevent division by zero when nr_function_calls is zero
tracing: Reject invalid preemptirq_delay_test CPU affinity
fgraph: Use trace_seq_putc() in print_graph_return()
tracing/user_events: Replace a seq_printf() call by seq_puts() in user_seq_show()
tracing/user_events: Use seq_putc() in two functions
tracing: Bound histogram expression strings with seq_buf
tracing: Return ERR_PTR() from expr_str()
tracing: Use __free() for expr_str() buffer
kernel/trace/trace_printk: Use kstrdup() instead of kmalloc() and strcpy()
tracing: Point constant hist field type to string literal
selftests/bpf: Add test for tracepoint btf_ids tracefs file
tracing: Expose tracepoint BTF ids via tracefs
...
|
|
* kvm-arm64/vtr-patch:
: Inline patching of ICH_VTR_EL2 constant, courtesy of Marc Zyngier
:
: Unify readers of ICH_VTR_EL2 on an instruction-patched constant value,
: avoiding system register accesses known to trap under nested
: virtualization and sharing the implementation between pKVM and 'regular'
: KVM.
KVM: arm64: vgic-v3: Kill kvm_vgic_global_state.ich_vtr_el2
KVM: arm64: vgic-v3: Simplify initial GICv3 configuration sampling
KVM: arm64: Convert most ICH_VTR_EL2 accesses to inlined literal value
KVM: arm64: Add a helper providing an inlined literal value for ICH_VTR_EL2
KVM: arm64: Move GICv3 broken SEIS implementation detection to a CPU errrata
KVM: arm64: vgic-v3: Make vtr_to_* helpers use architectural field symbols
Signed-off-by: Oliver Upton <oupton@kernel.org>
|
|
Pull ftrace updates from Steven Rostedt:
- Deprecrate ftrace_enabled in disabling ftrace
The file /proc/sys/kernel/ftrace_enabled was created when ftrace was
first introduced back in 2008. It was to be a "kill switch" if
something was to go wrong. It was also used as a way to turn off
function tracing for the latency tracers that would have it on by
default. But in 2013 (Linux 3.10) the option "function-trace" was
introduced to disable function tracing for the latency tracers as the
"ftrace_enabled" file was considered too big of a hammer and caused
too many side effects.
When live kernel patching came along, disabling ftrace via the
ftrace_enabled file would put the system into an unstable state if a
live kernel patch was installed. This created the need to mark some
function hooks as "PERMANENT".
Now there's a need for BPF usage marked as PERMANENT for the same
reasons.
The file "ftrace_enabled" usage is no longer viable. It doesn't do
what it says it does and there is no reason to use it.
Make writing '0' to it a nop and print a message saying its usage is
deprecated. The return value of writing '0' is -EOPNOTSUPP so that
user space will error on that write (hopefully to inform any
developer that it no longer works).
Eventually the file should be removed completely, but for now just
making it not do anything is the path forward to that.
- Update the livepatch tests to handle ftrace_enabled being disabled
Because in the past, livepatch was broken by ftrace_enabled being
turned off, there's a test case that checks to make sure it still
doesn't break. But having the write of '0' return an error caused
that test to break. Updated the test to handle the new change.
* tag 'ftrace-v7.3' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace:
selftests/livepatch: update test-ftrace.sh for deprecated ftrace_enabled
ftrace: deprecate disabling via ftrace_enabled sysctl
|
|
Pull RTLA updates from Steven Rostedt:
- Extend support for unsetting CLI options
libsubcmd auto-generates "--no-<option>" to unset options, provided
the option callback supports it. Implement this for RTLA CLI beyond
boolean options, and document the few exceptions that are left out.
- Test all tracer options in runtime tests
Verify that RTLA sets osnoise/timerlat options correctly by reading
them from tracefs during runtime tests.
- Improve range validation for option arguments
Make CLI range validation consistent with the kernel limits and unify
implementation and error messages between options.
- Improve invalid option argument parsing
Consistently reject invalid values for numeric option arguments with
a unified error message for all options.
* tag 'trace-tools-v7.3' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace:
rtla/cli: Unify and improve handling of invalid option arguments
rtla/cli: Unify and improve range validation logic
rtla/tests: Test all tracer options in runtime tests
Documentation/rtla: Document unsetting options
rtla: Add unit tests for CLI with unset
rtla: Add unit tests for unset in opt callbacks
rtla: Allow unsetting non-list custom-callback CLI options
|
|
Pull Real-time Verifier updates from Steven Rostedt:
- Switch LTL and DOT parsers to Lark in code generation tool
The rvgen code generation tool originally parsed DOT files and LTL
specifications using custom string parsing and Ply, which is no
longer maintained. The DOT parser was fragile and prone to failure on
minor format variations. Both LTL and DOT parsers have been rewritten
to use the Lark parsing library.
- Simplify Hybrid Automata clock variables
The clock variables in hybrid automata monitors now use a single
representation of the elapsed time since the clock was reset, rather
than converting between invariant and guard representations. This
allows simpler code generation for the newly refactored parser.
- Generate cleanup hook for per-obj monitor
The code generation scripts now adds a cleanup function to per-obj
monitors for the user to wire to the appropriate event (e.g.
sched_process_exit for tasks).
- Reduce read_lock scope during per-task cleanup
Take the tasklist_lock only when necessary, that is when iterating
over for_each_process_thread().
- Simplify task monitor slot management
Only rely on the slot array for per-task slot management to avoid
inconsistency with the unused counter.
- Improve rvgen code robustness and templates
Use pathlib in rvgen and improve kernel path discovery. Also improve
consistency across templates when generating code (e.g. author
placeholder and monitor struct name).
- Update rtapp sleep monitor
Simplify the sleep monitor by excluding kernel threads and updating
the nanosleep check to focus only on CLOCK_REALTIME. Also switch to
use the sched_exit tracepoint to run in the context of the offending
(wakee) task.
- Add wakeup monitor
Add the new rtapp/wakeup monitor to detect when lower-priority tasks
wake up higher-priority ones, complementing the existing sleep
monitor by running in the waker context and capturing its stack
trace.
- Fix tools/rv exit status on failure
Ensure the rv tool returns a failure exit code when a monitor fails
to start because it was already running.
- Add automated selftests for tools/rv and rvgen
Introduced automated bash selftests to validate rv monitor listing
and execution under different configurations. Added tests for the
rvgen code generator, validating generated files against expected
output (golden). Tests are reachable via make check.
- Add KUnit test coverage for verification monitors
Added comprehensive KUnit tests to validate the functionality of
deterministic, hybrid, and LTL monitors by emulating event sequences
and timing in a mock environment without affecting the running kernel
while expecting mock reactions to fire. Ensure real RV monitors
cannot run during KUnit tests to avoid state corruption.
- Mock current in rv monitors
Mock the call to current in rv monitors when the KUnit tests are
built to allow them to run the test on dummy tasks. No overhead is
expected when KUnit tests aren't running.
- Introduce rvgen kunit subcommand
Added a new 'kunit' subcommand to rvgen to automatically patch an
already generated monitor with KUnit integration templates by parsing
its event handlers and creating the required mock structures and
initializations.
- Refine kernel verification selftests
Added new selftests for the deadline and stall monitors and
rearranged the existing wwnr_printk test to resolve flakiness.
Additionally, fixed an issue in the selftests framework where
negative assertion failures were not correctly propagated due to
shell rules.
- Fix 32-bit build of nomiss KUnit test
A previous commit introduced a division between an u64 and a constant
value and that doesn't build on 32-bit systems. Use div_u64()
instead.
- Document changes in sleep monitor
The sleep monitor introduced some changes in the past like allowing
epoll_wait() as a valid sleep and a task going to runnable before
scheduling as a valid wakeup. Document both.
* tag 'trace-rv-v7.3' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace: (40 commits)
Documentation/rv: Explain epoll and aborted sleeps
rv: Fix 32-bit build of nomiss KUnit test
selftests/verification: Add selftests for deadline and stall monitors
selftests/verification: Rearrange the wwnr_printk test
selftests/verification: Fix wrong errexit assumption
rv: Add KUnit tests for some LTL monitors
rv: Add KUnit mock for current
rv: Add KUnit tests for some DA/HA monitors
rv: Export task monitor slot and react symbols
verification/rvgen: Add selftests for rvgen kunit
verification/rvgen: Add the rvgen kunit subcommand
verification/rvgen: Add selftests
verification/rvgen: Add golden and spec folders for tests
tools/rv: Add selftests
verification/rvgen: Improve consistency in template files
verification/rvgen: Use pathlib instead of os.path
verification/rvgen: Improve rv_dir discovery in RVGenerator
tools/rv: Fix exit status when monitor execution fails
rv: Use generic rv_this for the rv_monitor variable in LTL
rv/rtapp: Add wakeup monitor
...
|
|
Missing reset_control_status() support is not Gen5 specific. It depends
on the firmware used, if any. Refactor the code to handle missing
reset_control_status() more generically.
Fixes: 87e713f20048 ("i2c: rcar: add R-Car Gen5 support")
Suggested-by: Geert Uytterhoeven <geert+renesas@glider.be>
Signed-off-by: Wolfram Sang <wsa+renesas@sang-engineering.com>
Signed-off-by: Andi Shyti <andi.shyti@kernel.org>
Link: https://patch.msgid.link/20260817083046.11935-2-wsa+renesas@sang-engineering.com
|
|
mxs_i2c_probe() requests an exclusive DMA channel before resetting the
controller and registering the I2C adapter. If either later operation
fails, probe returns without releasing the channel because the remove
callback is not invoked after a failed probe.
Use devm_dma_request_chan() so the device core releases the channel on
probe failure and driver detach. Remove the manual release from the
remove callback because the channel is now device-managed.
This issue was found by a static analysis checker and confirmed by
manual source review.
Fixes: 62885f59a261 ("MXS: Implement DMA support into mxs-i2c")
Assisted-by: unnamed:claude-opus-4.8 typestate
Signed-off-by: Ruoyu Wang <ruoyuw560@gmail.com>
Cc: <stable@vger.kernel.org> # v3.7+
Reviewed-by: Frank Li <Frank.Li@nxp.com>
Signed-off-by: Andi Shyti <andi.shyti@kernel.org>
Link: https://patch.msgid.link/20260815151720.3757460-1-ruoyuw560@gmail.com
|
|
of_parse_phandle() takes a reference on the parent node. If a later
devm_kstrdup() fails, err_rollback only releases nodes for indices
0..i-1, so the current node is leaked.
of_node_put() the current parent before rolling back.
Fixes: 7c0195fa9a9e ("i2c: mux: demux-pinctrl: check the return value of devm_kstrdup()")
Signed-off-by: Linkai Gong <gonglinkai@kylinos.cn>
Cc: <stable@vger.kernel.org> # v6.6+
Signed-off-by: Andi Shyti <andi.shyti@kernel.org>
Link: https://patch.msgid.link/20260813095617.2246320-1-gonglinkai@kylinos.cn
|
|
ocores_i2c_resume() enables the controller clock before reinitializing
the hardware. If the clock rate changed while the device was suspended,
ocores_init() may reject the resulting prescaler. The callback then
returns an error with the clock still enabled, while the controller
itself remains disabled.
Disable and unprepare the clock when ocores_init() fails so the failed
resume path balances the successful clk_prepare_enable() call.
This issue was found by a static analysis checker and confirmed by manual
source review.
Fixes: e961a094afe0 ("i2c: ocores: add common clock support")
Signed-off-by: Ruoyu Wang <ruoyuw560@gmail.com>
Reviewed-by: Max Filippov <jcmvbkbc@gmail.com>
Signed-off-by: Andi Shyti <andi.shyti@kernel.org>
Link: https://patch.msgid.link/20260813153155.3953577-1-ruoyuw560@gmail.com
|
|
Reset I2C controller in probe stage to avoid unexpected LPI2C controller
state left from previous stages and hang system boot.
Per the LPI2C reference manual, section 7.1.4 "Controller Control (MCR)"
and 7.1.20 Target Control (SCR), the RST bit (bit 1) description states:
"The reset takes effect immediately and remains asserted until negated
by software. There is no minimum delay required before clearing the
software reset."
Therefore, it is safe to write 0 to MCR and SCR immediately after
asserting the RST bit without any additional delay.
Signed-off-by: Carlos Song <carlos.song@nxp.com>
Reviewed-by: Frank Li <Frank.Li@nxp.com>
Signed-off-by: Andi Shyti <andi.shyti@kernel.org>
Link: https://lore.kernel.org/r/20260716071957.2670263-3-carlos.song@oss.nxp.com
|
|
When probe fails at devm_clk_rate_exclusive_get() or clk_get_rate(),
which occur before runtime PM is initialized, the clocks enabled by
clk_bulk_prepare_enable() are never disabled.
When probe fails after runtime PM is initialized, the previous error
path called pm_runtime_put_sync(), which triggers the runtime suspend
callback. However, due to different clock management strategies on
different SoCs[1] (to avoid deadlocks between the global prepare_lock
and runtime PM), the callback may only disable clocks without
unpreparing them, causing an incomplete unwind.
Introduce a new error label 'clk_disable' to explicitly invoke
clk_bulk_disable_unprepare(). Replace pm_runtime_put_sync() with the
sequence of pm_runtime_disable(), pm_runtime_set_suspended() and
pm_runtime_put_noidle() to bypass the runtime suspend callback during
error recovery. During the LPI2C driver probe phase, clock APIs are
used exclusively to manage clocks. Once probing succeeds, clock
management is handed over to the runtime PM core.
[1] https://lore.kernel.org/all/20251125084718.2156168-1-carlos.song@nxp.com/
Signed-off-by: Carlos Song <carlos.song@nxp.com>
Reviewed-by: Frank Li <Frank.Li@nxp.com>
Signed-off-by: Andi Shyti <andi.shyti@kernel.org>
Link: https://lore.kernel.org/r/20260716071957.2670263-2-carlos.song@oss.nxp.com
|
|
platform_get_irq(), devm_request_irq() and devm_request_threaded_irq()
already print an error message via dev_err_probe() on failure, so
wrapping their return value with another dev_err_probe() results in
duplicate error output.
Drop these redundant dev_err_probe() calls across i2c bus drivers
and return the error code directly instead.
Signed-off-by: Pei Xiao <xiaopei01@kylinos.cn>
Signed-off-by: Andi Shyti <andi.shyti@kernel.org>
Link: https://lore.kernel.org/r/aea09858af6be39497325e2560267771ed62e6b0.1784537126.git.xiaopei01@kylinos.cn
|
|
Pull fwctl updates from Jason Gunthorpe:
- Support more commands in bnxt, this completes what they originally
wanted to do
- Rust bindings for fwctl. The Nova GPU is expected to use them next
cycle
* tag 'for-linus-fwctl' of git://git.kernel.org/pub/scm/linux/kernel/git/fwctl/fwctl:
rust: introduce abstractions for fwctl
fwctl/bnxt: Add DMA buffer support for HWRM commands
bnxt_en: Update bnxt firmware spec
|
|
The interrupt core calls the irq_domain_activate() callback from
__setup_irq() with desc->lock held and interrupts disabled. Both
aspeed_intc1_irq_domain_activate() and aspeed_intc0_resolve_route() test a
compatible string with fwnode_device_is_compatible().
fwnode_device_is_compatible() invokes fwnode_property_match_string(), which
allocates with GFP_KERNEL. That's obviously not possible with interrupts
disabled and a raw spinlock held.
Both call sites are only ever handed OF nodes, so use
of_device_is_compatible() instead: it walks the property in place and does
not allocate.
Fixes: 07825e41519a ("irqchip/ast2700-intc: Add AST2700-A2 support")
Reported-by: Andrew Jeffery <andrew@codeconstruct.com.au>
Signed-off-by: Ryan Chen <ryan_chen@aspeedtech.com>
Signed-off-by: Thomas Gleixner <tglx@kernel.org>
Tested-by: Andrew Jeffery <andrew@codeconstruct.com.au>
Link: https://patch.msgid.link/20260819-fix-ast2700-intc-atomic-alloc-v1-1-d92a02e2a239@aspeedtech.com
|
|
Pull iommufd updates from Jason Gunthorpe:
"One small feature this cycle, the noiommu mode is useful in
single-purpose VMs running something like DPDK. It avoids the double
translation overhead and it seems to be commonly used with some hacks.
Summary:
- Formal API for "no iommu" mode in VFIO. iommufd now works in this
environment and provides page pinning and phyiscal address services
to userspace. This avoids nasty fragile tricks with mprotect and
pgmap
- Fix sykzaller crash racing change_process with map_pages
- Various skyzkaller/AI fixes for the selftests"
* tag 'for-linus-iommufd' of git://git.kernel.org/pub/scm/linux/kernel/git/jgg/iommufd:
iommufd: Fix UAF in selftest IOPF reporting
iommu/iommufd: Fix NULL pointer deref in iommufd_ioas_change_process when racing with iopt_map_file_pages
Documentation: Update VFIO NOIOMMU mode
vfio: Enable cdev noiommu mode under iommufd
iommufd: Add an ioctl to query PA from IOVA for noiommu mode
iommufd: Allow binding to a noiommu device
iommufd: Move igroup allocation to a function
iommufd: Support a HWPT without an iommu driver for noiommu
iommufd: Simplify iommufd_device_remove_vdev()
iommufd: Fix grammar and spelling in comments
iommu: Fix dev_iommu memory leak when device_add fails in iommu_mock_device_add
iommufd/selftest: Fix dmabuf leak in iommufd_test_dmabuf_get()
iommufd/selftest: Avoid selftest dirty bitmap size wrap
|
|
rzg2l_clear_irq_int() and rzg2l_clear_tint_int() perform a
read-modify-write on the ISCR/TSCR status registers to clear the bit
for the interrupt just handled. Since these registers are
write-0-to-clear per bit, this is racy:
If another interrupt's status bit gets set between the read and the write,
that bit is written back as 0 by the software-constructed value, clearing
an interrupt that hasn't been serviced yet and losing it.
This can be reproduced by triggering multiple interrupts at once, e.g.:
gpioset -c gpiochip0 355=0 353=0 328=0 352=0
Fix this by writing back only the bit being cleared, with all other bits
set to 1, instead of read-modify-writing the whole register. Since 1-bits
are left unchanged by hardware, concurrently-set status bits for other
interrupts are preserved.
Fixes: 3fed09559cd8 ("irqchip: Add RZ/G2L IA55 Interrupt Controller driver")
Signed-off-by: Biju Das <biju.das.jz@bp.renesas.com>
Signed-off-by: Thomas Gleixner <tglx@kernel.org>
Link: https://patch.msgid.link/20260818110937.5816-1-biju.das.jz@bp.renesas.com
|
|
Pull iommu updates from Joerg Roedel:
"ARM SMMUv2:
- Device-tree binding updates for Qualcomm Eliza, Maili, Shikra and
IPQ9650 SoCs
- Add support for Qualcomm SM8450
- Numerous fixes for lifetime and ordering issues found by Sashiko in
the Qualcomm driver
ARM SMMUv3:
- Fix interrupt type in device-tree binding example for NVIDIA CMDQV
- Numerous fixes for issues identified by Sashiko in the NVIDIA CMDQV
driver
- Work around TLB erratum T264-SMMU-3 on Tegra264 by repeating the
invalidation sequence
- Add support for HAFT (hardware access flag in table entries) when
using SVA
- Probe for 52-bit addressing with a page size smaller than 64k
('DS') but don't do anything with it for now
- Minor driver improvements (remove sort_nonatomic(), use
readl_relaxed_poll_timeout_atomic(), fix IOPF teardown ordering)
Intel VT-d:
- Consolidation of complex enablement logic into a clean,
priority-based state machine
- Support for the DMA_REMAP_OPT_OUT flag from the VT-d v5.2
specification
- An update to cache_tag_flush_devtlb_psi() to use full-range
constants instead of modifying shared variables for
CACHE_TAG_NESTING_DEVTLB
- A fix for the UCTP context-table slot when copying root entries
- Fixes for several pre-existing issues reported by Sashiko
- General code cleanup and refinement
AMD IOMMU:
- Add SNP page-mode-0 support, enabling passthrough, v2 DMA page
tables and host SVA on supporting systems
- Fix invalid PPR handling, COMPLETE_PPR responses and guest-mode
reporting
- Improve Southbridge IOAPIC validation and remove the dependency on
hard-coded device IDs
- Fix PCI-device lifetime, debugfs and diagnostic issues
IOMMU core and IOMMUFD:
- Restore serialization of the shared MSI-page list
- Fix SVA-handle publication and several IOMMUFD reference and error
path leaks
- Return the expected zero result for invalid generic page-table
translations
- Allocate per-CPU IOVA magazines lazily to reduce memory use on
large systems
PCI ATS:
- Make VF support checks account for the associated PF and validate
that VF and PF Smallest Translation Unit settings agree
Platform drivers:
- Fix Qualcomm runtime-PM, probe unwind, fault reporting and page
table initialization races
- Rework Rockchip state handling and fix clock, probe and stale-fault
handling
- Fix smaller issues in the MSM and MediaTek drivers
Device-tree bindings:
- Add new Qualcomm SMMU compatibles, convert the OMAP IOMMU binding
to YAML, and fix the Tegra264 CMDQV interrupt example
Various smaller cleanups, documentation fixes and a Rust IOMMU
safety/readability improvement"
* tag 'iommu-updates-v7.3' of git://git.kernel.org/pub/scm/linux/kernel/git/iommu/linux: (93 commits)
iommu/amd: Add SNP page mode 0 support
iommu/amd: Fix GN bit setting in COMPLETE_PPR_REQUEST command
iommu/amd: Rate limit INVALID_PPR_REQUEST error logging
iommu/amd: Fix missing CMD_COMPLETE_PPR response for invalid PPR requests
iommu/amd: Introduce PPR_TAG_LAST_PAGE() macro
iommu/amd: Fix incorrect device ID in invalid PASID error message
iommu/vt-d: Flush context cache with correct SID when tearing down aliases
iommu/vt-d: Tear down scalable-mode context on probe failure
iommu/vt-d: Fix iopf_refcount leak on RID domain replacement
iommu/vt-d: Clear Present bit before tearing down copied context entry
iommu/vt-d: Fix copied_tables bitmap leak on error in copy_translation_tables
iommu/vt-d: Cache max domain ID to avoid redundant calculation
iommu/vt-d: Support the new DMA_REMAP_OPT_OUT flag bit
iommu/vt-d: Remove dmar_disabled
iommu/vt-d: Remove the 'force_on' variable
iommu/vt-d: Call dmar_can_force_on() for tboot opt-in
iommu/vt-d: Use dmar_can_force_on() for platform opt-in
iommu/vt-d: Consolidate dmar policy management and force_on logic
iommu/vt-d: Remove dead code when CONFIG_INTEL_IOMMU is not set
iommu/vt-d: Force requesting ACS when tboot is enabled
...
|
Nathan Chancellor
Jake Steinman
Sebastian Andrzej Siewior
Lorenzo Pieralisi
Sascha Bischoff
Michael Pesa
Pedro Kopper
Geert Uytterhoeven
Konrad Dybcio
Zhan Xusheng
Usama Arif
Bradley Morgan
Linfeng Sun
Karl Mehltretter
Dave Airlie
Linus Torvalds
Oliver Upton
Wolfram Sang
Ruoyu Wang
Linkai Gong
Carlos Song
Pei Xiao
Ryan Chen
Biju Das