Commit graph

1,412,257 commits

Author SHA1 Message Date
Junxian Huang
b37ad2e290 RDMA/hns: Initialize bonding resources
Allocate bond_grp resources for each card when the first device in
this card is registered. Block the initialization of VF when its PF
is a bonded slave, as VF is not supported in this case due to HW
constraints.

Signed-off-by: Junxian Huang <huangjunxian6@hisilicon.com>
Link: https://patch.msgid.link/20251112093510.3696363-3-huangjunxian6@hisilicon.com
Signed-off-by: Leon Romanovsky <leon@kernel.org>
2025-11-24 02:58:29 -05:00
Junxian Huang
cdb3a6f183 RDMA/hns: Add helpers to obtain netdev and bus_num from hr_dev
Add helpers to obtain netdev and bus_num from hr_dev.

Signed-off-by: Junxian Huang <huangjunxian6@hisilicon.com>
Link: https://patch.msgid.link/20251112093510.3696363-2-huangjunxian6@hisilicon.com
Signed-off-by: Leon Romanovsky <leon@kernel.org>
2025-11-24 02:58:29 -05:00
Siva Reddy Kallam
04e031ff6e RDMA/bng_re: Initialize the Firmware and Hardware
Initialize the firmware and hardware with HWRM command.

Signed-off-by: Siva Reddy Kallam <siva.kallam@broadcom.com>
Link: https://patch.msgid.link/20251117171136.128193-9-siva.kallam@broadcom.com
Reviewed-by: Usman Ansari <usman.ansari@broadcom.com>
Signed-off-by: Leon Romanovsky <leon@kernel.org>
2025-11-24 02:58:29 -05:00
Siva Reddy Kallam
99e4e10283 RDMA/bng_re: Add basic debugfs infrastructure
Add basic debugfs infrastructure for Broadcom next generation
controller.

Signed-off-by: Siva Reddy Kallam <siva.kallam@broadcom.com>
Link: https://patch.msgid.link/20251117171136.128193-8-siva.kallam@broadcom.com
Reviewed-by: Usman Ansari <usman.ansari@broadcom.com>
Signed-off-by: Leon Romanovsky <leon@kernel.org>
2025-11-24 02:58:29 -05:00
Siva Reddy Kallam
53c6ee7d7f RDMA/bng_re: Enable Firmware channel and query device attributes
Enable Firmware channel and query device attributes

Signed-off-by: Siva Reddy Kallam <siva.kallam@broadcom.com>
Link: https://patch.msgid.link/20251117171136.128193-7-siva.kallam@broadcom.com
Reviewed-by: Usman Ansari <usman.ansari@broadcom.com>
Signed-off-by: Leon Romanovsky <leon@kernel.org>
2025-11-24 02:58:29 -05:00
Siva Reddy Kallam
4f830cd8d7 RDMA/bng_re: Add infrastructure for enabling Firmware channel
Add infrastructure for enabling Firmware channel.

Signed-off-by: Siva Reddy Kallam <siva.kallam@broadcom.com>
Link: https://patch.msgid.link/20251117171136.128193-6-siva.kallam@broadcom.com
Reviewed-by: Usman Ansari <usman.ansari@broadcom.com>
Signed-off-by: Leon Romanovsky <leon@kernel.org>
2025-11-24 02:58:29 -05:00
Siva Reddy Kallam
53310b698f RDMA/bng_re: Allocate required memory resources for Firmware channel
Allocate required memory resources for Firmware channel.

Signed-off-by: Siva Reddy Kallam <siva.kallam@broadcom.com>
Link: https://patch.msgid.link/20251117171136.128193-5-siva.kallam@broadcom.com
Reviewed-by: Usman Ansari <usman.ansari@broadcom.com>
Signed-off-by: Leon Romanovsky <leon@kernel.org>
2025-11-24 02:58:29 -05:00
Siva Reddy Kallam
745065770c RDMA/bng_re: Register and get the resources from bnge driver
Register and get the basic required resources from bnge driver.

Signed-off-by: Siva Reddy Kallam <siva.kallam@broadcom.com>
Link: https://patch.msgid.link/20251117171136.128193-4-siva.kallam@broadcom.com
Reviewed-by: Usman Ansari <usman.ansari@broadcom.com>
Signed-off-by: Leon Romanovsky <leon@kernel.org>
2025-11-24 02:58:29 -05:00
Siva Reddy Kallam
d0da769c19 RDMA/bng_re: Add Auxiliary interface
Add basic Auxiliary interface to the driver which supports
the BCM5770X NIC family.

Signed-off-by: Siva Reddy Kallam <siva.kallam@broadcom.com>
Link: https://patch.msgid.link/20251117171136.128193-3-siva.kallam@broadcom.com
Reviewed-by: Usman Ansari <usman.ansari@broadcom.com>
Signed-off-by: Leon Romanovsky <leon@kernel.org>
2025-11-24 02:58:29 -05:00
Gao Xiang
d53cd891f0 erofs: limit the level of fs stacking for file-backed mounts
Otherwise, it could cause potential kernel stack overflow (e.g., EROFS
mounting itself).

Reviewed-by: Sheng Yong <shengyong1@xiaomi.com>
Fixes: fb17675026 ("erofs: add file-backed mount support")
Reviewed-by: Chao Yu <chao@kernel.org>
Reviewed-by: Hongbo Li <lihongbo22@huawei.com>
Signed-off-by: Gao Xiang <hsiangkao@linux.alibaba.com>
2025-11-24 14:17:29 +08:00
Gao Xiang
ebe4f3f6eb erofs: correct FSDAX detection
The detection of the primary device is skipped incorrectly
if the multiple or flattened feature is enabled.

It also fixes the FSDAX misdetection for non-block extra blobs.

Fixes: c6993c4cb9 ("erofs: Fallback to normal access if DAX is not supported on extra device")
Reported-and-tested-by: syzbot+31b8fb02cb8a25bd5e78@syzkaller.appspotmail.com
Closes: https://lore.kernel.org/r/691af9f6.a70a0220.3124cb.0097.GAE@google.com
Cc: Yuezhang Mo <Yuezhang.Mo@sony.com>
Reviewed-by: Chao Yu <chao@kernel.org>
Signed-off-by: Gao Xiang <hsiangkao@linux.alibaba.com>
2025-11-24 14:16:30 +08:00
Hui Min Mina Chou
3239c52fd2 RISC-V: KVM: Flush VS-stage TLB after VCPU migration for Andes cores
Most implementations cache the combined result of two-stage translation,
but some, like Andes cores, use split TLBs that store VS-stage and
G-stage entries separately.

On such systems, when a VCPU migrates to another CPU, an additional
HFENCE.VVMA is required to avoid using stale VS-stage entries, which
could otherwise cause guest faults.

Introduce a static key to identify CPUs with split two-stage TLBs.
When enabled, KVM issues an extra HFENCE.VVMA on VCPU migration to
prevent stale VS-stage mappings.

Signed-off-by: Hui Min Mina Chou <minachou@andestech.com>
Signed-off-by: Ben Zong-You Xie <ben717@andestech.com>
Reviewed-by: Radim Krčmář <rkrcmar@ventanamicro.com>
Reviewed-by: Nutty Liu <nutty.liu@hotmail.com>
Link: https://lore.kernel.org/r/20251117084555.157642-1-minachou@andestech.com
Signed-off-by: Anup Patel <anup@brainfault.org>
2025-11-24 09:55:36 +05:30
Fangyu Yu
974555d6e4 RISC-V: KVM: Fix guest page fault within HLV* instructions
When executing HLV* instructions at the HS mode, a guest page fault
may occur when a g-stage page table migration between triggering the
virtual instruction exception and executing the HLV* instruction.

This may be a corner case, and one simpler way to handle this is to
re-execute the instruction where the virtual  instruction exception
occurred, and the guest page fault will be automatically handled.

Fixes: b91f0e4cb8 ("RISC-V: KVM: Factor-out instruction emulation into separate sources")
Signed-off-by: Fangyu Yu <fangyu.yu@linux.alibaba.com>
Reviewed-by: Anup Patel <anup@brainfault.org>
Link: https://lore.kernel.org/r/20251121133543.46822-1-fangyu.yu@linux.alibaba.com
Signed-off-by: Anup Patel <anup@brainfault.org>
2025-11-24 09:55:36 +05:30
Dong Yang
df60cb2e67 KVM: riscv: Support enabling dirty log gradually in small chunks
There is already support of enabling dirty log gradually in small chunks
for x86 in commit 3c9bd4006b ("KVM: x86: enable dirty log gradually in
small chunks") and c862626 ("KVM: arm64: Support enabling dirty log
gradually in small chunks"). This adds support for riscv.

x86 and arm64 writes protect both huge pages and normal pages now, so
riscv protect also protects both huge pages and normal pages.

On a nested virtualization setup (RISC-V KVM running inside a QEMU VM
on an [Intel® Core™ i5-12500H] host), I did some tests with a 2G Linux
VM using different backing page sizes. The time taken for
memory_global_dirty_log_start in the L2 QEMU is listed below:

Page Size      Before    After Optimization
  4K            4490.23ms         31.94ms
  2M             48.97ms          45.46ms
  1G             28.40ms          30.93ms

Signed-off-by: Quan Zhou <zhouquan@iscas.ac.cn>
Signed-off-by: Dong Yang <dayss1224@gmail.com>
Reviewed-by: Anup Patel <anup@brainfault.org>
Link: https://lore.kernel.org/r/20251103062825.9084-1-dayss1224@gmail.com
Signed-off-by: Anup Patel <anup@brainfault.org>
2025-11-24 09:55:36 +05:30
BillXiang
a2483d5d1e RISC-V: KVM: Introduce KVM_EXIT_FAIL_ENTRY_NO_VSFILE
Currently, we return CSR_HSTATUS as hardware_entry_failure_reason when
kvm_riscv_aia_alloc_hgei failed in KVM_DEV_RISCV_AIA_MODE_HWACCEL
mode, which is vague so it is better to return a well defined value
KVM_EXIT_FAIL_ENTRY_NO_VSFILE provided via uapi/asm/kvm.h.

Signed-off-by: BillXiang <xiangwencheng@lanxincomputing.com>
Reviewed-by: Anup Patel <anup@brainfault.org>
Link: https://lore.kernel.org/r/20250923053851.32863-1-xiangwencheng@lanxincomputing.com
Signed-off-by: Anup Patel <anup@brainfault.org>
2025-11-24 09:55:36 +05:30
Anup Patel
d1c5620781 KVM: riscv: selftests: Add SBI MPXY extension to get-reg-list
The KVM RISC-V allows SBI MPXY extensions for Guest/VM so add
it to the get-reg-list test.

Signed-off-by: Anup Patel <apatel@ventanamicro.com>
Reviewed-by: Andrew Jones <ajones@ventanamicro.com>
Link: https://lore.kernel.org/r/20251017155925.361560-5-apatel@ventanamicro.com
Signed-off-by: Anup Patel <anup@brainfault.org>
2025-11-24 09:55:36 +05:30
Anup Patel
7050f1d79f RISC-V: KVM: Add SBI MPXY extension support for Guest
The SBI MPXY extension is a platform-level functionality so KVM only
needs to forward SBI MPXY calls to KVM user-space.

Signed-off-by: Anup Patel <apatel@ventanamicro.com>
Reviewed-by: Andrew Jones <ajones@ventanamicro.com>
Link: https://lore.kernel.org/r/20251017155925.361560-4-apatel@ventanamicro.com
Signed-off-by: Anup Patel <anup@brainfault.org>
2025-11-24 09:55:36 +05:30
Anup Patel
12fd6c62e9 RISC-V: KVM: Add separate source for forwarded SBI extensions
Add a separate source vcpu_sbi_forward.c for SBI extensions
which are entirely forwarded to KVM user-space.

Signed-off-by: Anup Patel <apatel@ventanamicro.com>
Reviewed-by: Andrew Jones <ajones@ventanamicro.com>
Link: https://lore.kernel.org/r/20251017155925.361560-3-apatel@ventanamicro.com
Signed-off-by: Anup Patel <anup@brainfault.org>
2025-11-24 09:55:36 +05:30
Anup Patel
e2f3e2d37b RISC-V: KVM: Convert kvm_riscv_vcpu_sbi_forward() into extension handler
All uses of kvm_riscv_vcpu_sbi_forward() also updates retdata->uexit so
to further reduce code duplication move retdata->uexit assignment to
kvm_riscv_vcpu_sbi_forward() and convert it into SBI extension handler.

Signed-off-by: Anup Patel <apatel@ventanamicro.com>
Reviewed-by: Andrew Jones <ajones@ventanamicro.com>
Link: https://lore.kernel.org/r/20251017155925.361560-2-apatel@ventanamicro.com
Signed-off-by: Anup Patel <anup@brainfault.org>
2025-11-24 09:55:36 +05:30
Linus Torvalds
ac3fd01e4c Linux 6.18-rc7 v6.18-rc7 2025-11-23 14:53:16 -08:00
Elaine Zhang
18191dd750 clk: rockchip: Add clock and reset driver for RK3506
Add the clock and reset tree definitions for the new
RK3506 SoC.

Signed-off-by: Finley Xiao <finley.xiao@rock-chips.com>
Signed-off-by: Elaine Zhang <zhangqing@rock-chips.com>
Link: https://patch.msgid.link/20251121075350.2564860-3-zhangqing@rock-chips.com
Signed-off-by: Heiko Stuebner <heiko@sntech.de>
2025-11-23 22:56:49 +01:00
Finley Xiao
84898f8e9c dt-bindings: clock: rockchip: Add RK3506 clock and reset unit
Add device tree bindings for clock and reset unit on RK3506 SoC.
Add clock and reset IDs for RK3506 SoC.

Signed-off-by: Finley Xiao <finley.xiao@rock-chips.com>
Signed-off-by: Elaine Zhang <zhangqing@rock-chips.com>
Reviewed-by: Conor Dooley <conor.dooley@microchip.com>
Link: https://patch.msgid.link/20251121075350.2564860-2-zhangqing@rock-chips.com
Signed-off-by: Heiko Stuebner <heiko@sntech.de>
2025-11-23 22:56:49 +01:00
Alexandre Courbot
bc197e24a3 rust: num: bounded: Always inline fits_within and from_expr
`from_expr` relies on `build_assert` to infer that the passed expression
fits the type's boundaries at build time. That inference can only be
successful its code (and that of `fits_within`, which performs the
check) is inlined, as a dedicated function would need to work with a
variable and cannot verify that property.

While inlining happens as expected in most cases, it is not guaranteed.
In particular, kernel options that optimize for size like
`CONFIG_CC_OPTIMIZE_FOR_SIZE` can result in `from_expr` not being
inlined.

Add `#[inline(always)]` attributes to both `fits_within` and `from_expr`
to make the compiler inline these functions more aggressively, as it
does not make sense to use them non-inlined anyway.

[ For reference, the errors look like:

    ld.lld: error: undefined symbol: rust_build_error
    >>> referenced by build_assert.rs:83 (rust/kernel/build_assert.rs:83)
    >>>               rust/doctests_kernel_generated.o:(<kernel::num::bounded::Bounded<u8, 1>>::from_expr) in archive vmlinux.a

      - Miguel ]

Fixes: 01e345e82e ("rust: num: add Bounded integer wrapping type")
Reported-by: kernel test robot <lkp@intel.com>
Closes: https://lore.kernel.org/oe-kbuild-all/202511210055.RUsFNku1-lkp@intel.com/
Suggested-by: Gary Guo <gary@garyguo.net>
Signed-off-by: Alexandre Courbot <acourbot@nvidia.com>
Link: https://patch.msgid.link/20251122-bounded_ints_fix-v1-1-1e07589d4955@nvidia.com
Signed-off-by: Miguel Ojeda <ojeda@kernel.org>
2025-11-23 22:49:55 +01:00
Anna Schumaker
b6d2a520f4 NFS: Add a module option to disable directory delegations
When this option is disabled then the client will not request directory
delegations or check if we have one during the revalidation paths.

Signed-off-by: Anna Schumaker <anna.schumaker@oracle.com>
Signed-off-by: Trond Myklebust <trond.myklebust@hammerspace.com>
2025-11-23 16:01:47 -05:00
Anna Schumaker
669c0580ac NFS: Shortcut lookup revalidations if we have a directory delegation
Holding a directory delegation means we know that nobody else has
modified the directory on the server, so we can take a few revalidation
shortcuts.

Signed-off-by: Anna Schumaker <anna.schumaker@oracle.com>
Signed-off-by: Trond Myklebust <trond.myklebust@hammerspace.com>
2025-11-23 16:01:47 -05:00
Anna Schumaker
2da2116707 NFS: Request a directory delegation during RENAME
If we notice that we're renaming a file within a directory then we take
that as a sign that the user is working with the current directory and
may want a delegation to avoid extra revalidations when possible.

The nfs_request_directory_delegation() function exists within the NFS v4
module, so I add an extra flag to rename_setup() to indicate if a dentry
is being renamed within the same parent directory.

Signed-off-by: Anna Schumaker <anna.schumaker@oracle.com>
Signed-off-by: Trond Myklebust <trond.myklebust@hammerspace.com>
2025-11-23 16:01:47 -05:00
Anna Schumaker
156b094829 NFS: Request a directory delegation on ACCESS, CREATE, and UNLINK
This patch adds a new flag: NFS_INO_REQ_DIR_DELEG to signal that a
directory wants to request a directory delegation the next time it does
a GETATTR. I have the client request a directory delegation when doing
an access, create, or unlink call since these calls indicate that a user
is working with a directory.

Signed-off-by: Anna Schumaker <anna.schumaker@oracle.com>
Signed-off-by: Trond Myklebust <trond.myklebust@hammerspace.com>
2025-11-23 16:01:47 -05:00
Anna Schumaker
130ae65c01 NFS: Add support for sending GDD_GETATTR
I add this to the existing GETATTR compound as an option extra step that
we can send if the "dir_deleg" flag is set to 'true'. Actually enabling
this value will happen in a later patch.

Signed-off-by: Anna Schumaker <anna.schumaker@oracle.com>
Signed-off-by: Trond Myklebust <trond.myklebust@hammerspace.com>
2025-11-23 16:01:46 -05:00
Jonathan Curley
e0f8058f2c NFSv4/pNFS: Clear NFS_INO_LAYOUTCOMMIT in pnfs_mark_layout_stateid_invalid
Fixes a crash when layout is null during this call stack:

write_inode
    -> nfs4_write_inode
        -> pnfs_layoutcommit_inode

pnfs_set_layoutcommit relies on the lseg refcount to keep the layout
around. Need to clear NFS_INO_LAYOUTCOMMIT otherwise we might attempt
to reference a null layout.

Fixes: fe1cf9469d ("pNFS: Clear all layout segment state in pnfs_mark_layout_stateid_invalid")
Signed-off-by: Jonathan Curley <jcurley@purestorage.com>
Signed-off-by: Trond Myklebust <trond.myklebust@hammerspace.com>
2025-11-23 15:33:33 -05:00
Olga Kornievskaia
9e9fdd0ad0 NFSv4.1: protect destroying and nullifying bc_serv structure
When we are shutting down the client, we free the callback
server structure and then at a later pointer we free the
transport used by the client. Yet, it's possible that after
the callback server is freed, the transport receives a
backchannel request at which point we can dereferene freed
memory. Instead, do the freeing the bc server and nullying
bc_serv under the lock.

Signed-off-by: Olga Kornievskaia <okorniev@redhat.com>
Signed-off-by: Trond Myklebust <trond.myklebust@hammerspace.com>
2025-11-23 15:30:12 -05:00
Olga Kornievskaia
6f8b26c90a SUNRPC: new helper function for stopping backchannel server
Create a new backchannel function to stop the backchannel server
and clear the bc_serv in transport protected under the bc_pa_lock.

Signed-off-by: Olga Kornievskaia <okorniev@redhat.com>
Signed-off-by: Trond Myklebust <trond.myklebust@hammerspace.com>
2025-11-23 15:30:12 -05:00
Olga Kornievskaia
441244d427 SUNRPC: cleanup common code in backchannel request
Create a helper function for common code between rdma
and tcp backchannel handling of the backchannel request.
Make sure that access is protected by the bc_pa_lock
lock.

Signed-off-by: Olga Kornievskaia <okorniev@redhat.com>
Signed-off-by: Trond Myklebust <trond.myklebust@hammerspace.com>
2025-11-23 15:30:12 -05:00
Olga Kornievskaia
8936ff4736 NFSv4.1: pass transport for callback shutdown
When we are setting up the 4.1 callback server, we pass in
the appropriate rpc_xprt transport pointer with which to associate
the callback server structure. Similarly, pass in the rpc_xprt
pointer for when we are shutting down the callback. This will be
used to make sure that we free the server structure and then clear
the rpc_xprt's bc_server pointer in a safe manner.

Signed-off-by: Olga Kornievskaia <okorniev@redhat.com>
Signed-off-by: Trond Myklebust <trond.myklebust@hammerspace.com>
2025-11-23 15:30:12 -05:00
Eric Biggers
4f0382b090 lib/crypto: sha2: Add at_least decoration to fixed-size array params
Add the at_least (i.e. 'static') decoration to the fixed-size array
parameters of the sha2 library functions.  This causes clang to warn
when a too-small array of known size is passed.

Acked-by: Ard Biesheuvel <ardb@kernel.org>
Acked-by: "Jason A. Donenfeld" <Jason@zx2c4.com>
Link: https://lore.kernel.org/r/20251122194206.31822-7-ebiggers@kernel.org
Signed-off-by: Eric Biggers <ebiggers@kernel.org>
2025-11-23 12:19:47 -08:00
Eric Biggers
d5cc4e731d lib/crypto: sha1: Add at_least decoration to fixed-size array params
Add the at_least (i.e. 'static') decoration to the fixed-size array
parameters of the sha1 library functions.  This causes clang to warn
when a too-small array of known size is passed.

Acked-by: Ard Biesheuvel <ardb@kernel.org>
Acked-by: "Jason A. Donenfeld" <Jason@zx2c4.com>
Link: https://lore.kernel.org/r/20251122194206.31822-6-ebiggers@kernel.org
Signed-off-by: Eric Biggers <ebiggers@kernel.org>
2025-11-23 12:19:47 -08:00
Eric Biggers
c2099fa616 lib/crypto: poly1305: Add at_least decoration to fixed-size array params
Add the at_least (i.e. 'static') decoration to the fixed-size array
parameters of the poly1305 library functions.  This causes clang to warn
when a too-small array of known size is passed.

Acked-by: Ard Biesheuvel <ardb@kernel.org>
Acked-by: "Jason A. Donenfeld" <Jason@zx2c4.com>
Link: https://lore.kernel.org/r/20251122194206.31822-5-ebiggers@kernel.org
Signed-off-by: Eric Biggers <ebiggers@kernel.org>
2025-11-23 12:19:47 -08:00
Eric Biggers
580f1d31df lib/crypto: md5: Add at_least decoration to fixed-size array params
Add the at_least (i.e. 'static') decoration to the fixed-size array
parameters of the md5 library functions.  This causes clang to warn when
a too-small array of known size is passed.

Acked-by: Ard Biesheuvel <ardb@kernel.org>
Acked-by: "Jason A. Donenfeld" <Jason@zx2c4.com>
Link: https://lore.kernel.org/r/20251122194206.31822-4-ebiggers@kernel.org
Signed-off-by: Eric Biggers <ebiggers@kernel.org>
2025-11-23 12:19:47 -08:00
Eric Biggers
2143d622cd lib/crypto: curve25519: Add at_least decoration to fixed-size array params
Add the at_least (i.e. 'static') decoration to the fixed-size array
parameters of the curve25519 library functions.  This causes clang to
warn when a too-small array of known size is passed.

Acked-by: Ard Biesheuvel <ardb@kernel.org>
Acked-by: "Jason A. Donenfeld" <Jason@zx2c4.com>
Link: https://lore.kernel.org/r/20251122194206.31822-3-ebiggers@kernel.org
Signed-off-by: Eric Biggers <ebiggers@kernel.org>
2025-11-23 12:19:47 -08:00
Eric Biggers
1b31b43bf5 lib/crypto: chacha: Add at_least decoration to fixed-size array params
Add the at_least (i.e. 'static') decoration to the fixed-size array
parameters of the chacha library functions.  This causes clang to warn
when a too-small array of known size is passed.

Acked-by: Ard Biesheuvel <ardb@kernel.org>
Acked-by: "Jason A. Donenfeld" <Jason@zx2c4.com>
Link: https://lore.kernel.org/r/20251122194206.31822-2-ebiggers@kernel.org
Signed-off-by: Eric Biggers <ebiggers@kernel.org>
2025-11-23 12:19:47 -08:00
Jason A. Donenfeld
ac653d57ad lib/crypto: chacha20poly1305: Statically check fixed array lengths
Several parameters of the chacha20poly1305 functions require arrays of
an exact length. Use the new at_least keyword to instruct gcc and
clang to statically check that the caller is passing an object of at
least that length.

Here it is in action, with this faulty patch to wireguard's cookie.h:

     struct cookie_checker {
     	u8 secret[NOISE_HASH_LEN];
    -	u8 cookie_encryption_key[NOISE_SYMMETRIC_KEY_LEN];
    +	u8 cookie_encryption_key[NOISE_SYMMETRIC_KEY_LEN - 1];
     	u8 message_mac1_key[NOISE_SYMMETRIC_KEY_LEN];

If I try compiling this code, I get this helpful warning:

  CC      drivers/net/wireguard/cookie.o
drivers/net/wireguard/cookie.c: In function ‘wg_cookie_message_create’:
drivers/net/wireguard/cookie.c:193:9: warning: ‘xchacha20poly1305_encrypt’ reading 32 bytes from a region of size 31 [-Wstringop-overread]
  193 |         xchacha20poly1305_encrypt(dst->encrypted_cookie, cookie, COOKIE_LEN,
      |         ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
  194 |                                   macs->mac1, COOKIE_LEN, dst->nonce,
      |                                   ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
  195 |                                   checker->cookie_encryption_key);
      |                                   ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
drivers/net/wireguard/cookie.c:193:9: note: referencing argument 7 of type ‘const u8 *’ {aka ‘const unsigned char *’}
In file included from drivers/net/wireguard/messages.h:10,
                 from drivers/net/wireguard/cookie.h:9,
                 from drivers/net/wireguard/cookie.c:6:
include/crypto/chacha20poly1305.h:28:6: note: in a call to function ‘xchacha20poly1305_encrypt’
   28 | void xchacha20poly1305_encrypt(u8 *dst, const u8 *src, const size_t src_len,

Acked-by: Ard Biesheuvel <ardb@kernel.org>
Signed-off-by: "Jason A. Donenfeld" <Jason@zx2c4.com>
Link: https://lore.kernel.org/r/20251123054819.2371989-4-Jason@zx2c4.com
Signed-off-by: Eric Biggers <ebiggers@kernel.org>
2025-11-23 12:19:21 -08:00
Jason A. Donenfeld
074e16d58e compiler_types: introduce at_least parameter decoration pseudo keyword
Clang and recent gcc support warning if they are able to prove that the
user is passing to a function an array that is too short in size. For
example:

    void blah(unsigned char herp[at_least 7]);
    static void schma(void)
    {
        unsigned char good[] = { 1, 2, 3, 4, 5, 6, 7 };
        unsigned char bad[] = { 1, 2, 3, 4, 5, 6 };
        blah(good);
        blah(bad);
    }

The notation here, `static 7`, which this commit makes explicit by
allowing us to write it as `at_least 7`, means that it's incorrect to
pass anything less than 7 elements. This is section 6.7.5.3 of C99:

    If the keyword static also appears within the [ and ] of the array
    type derivation, then for each call to the function, the value of
    the corresponding actual argument shall provide access to the first
    element of an array with at least as many elements as specified by
    the size expression.

Here is the output from gcc 15:

    zx2c4@thinkpad /tmp $ gcc -c a.c
    a.c: In function ‘schma’:
    a.c:9:9: warning: ‘blah’ accessing 7 bytes in a region of size 6 [-Wstringop-overflow=]
        9 |         blah(bad);
          |         ^~~~~~~~~
    a.c:9:9: note: referencing argument 1 of type ‘unsigned char[7]’
    a.c:2:6: note: in a call to function ‘blah’
        2 | void blah(unsigned char herp[at_least 7]);
          |      ^~~~

And from clang 21:

    zx2c4@thinkpad /tmp $ clang -c a.c
    a.c:9:2: warning: array argument is too small; contains 6 elements, callee requires at least 7
          [-Warray-bounds]
        9 |         blah(bad);
          |         ^    ~~~
    a.c:2:25: note: callee declares array parameter as static here
        2 | void blah(unsigned char herp[at_least 7]);
          |                         ^   ~~~~~~~~~~
    1 warning generated.

So these are covered by, variously, -Wstringop-overflow and
-Warray-bounds.

Acked-by: Ard Biesheuvel <ardb@kernel.org>
Signed-off-by: "Jason A. Donenfeld" <Jason@zx2c4.com>
Link: https://lore.kernel.org/r/20251123054819.2371989-3-Jason@zx2c4.com
Signed-off-by: Eric Biggers <ebiggers@kernel.org>
2025-11-23 12:18:36 -08:00
Jason A. Donenfeld
d96f562054 wifi: iwlwifi: trans: rename at_least variable to min_mode
The subsequent commit is going to add a macro that redefines `at_least`
to mean something else. Given that the usage here in iwlwifi is the only
use of that identifier in the whole kernel, just rename it to a more
fitting name, `min_mode`.

Cc: Miri Korenblit <miriam.rachel.korenblit@intel.com>
Acked-by: Ard Biesheuvel <ardb@kernel.org>
Signed-off-by: "Jason A. Donenfeld" <Jason@zx2c4.com>
Link: https://lore.kernel.org/r/20251123054819.2371989-1-Jason@zx2c4.com
Signed-off-by: Eric Biggers <ebiggers@kernel.org>
2025-11-23 12:18:20 -08:00
Miguel Ojeda
a762f883ec rust: i2c: prepare for core::ffi::CStr
The rust-next tree contains commit:

    3b83f5d5e7 ("rust: replace `CStr` with `core::ffi::CStr`")

which, when merged together with commits:

    57c5bd9aee ("rust: i2c: add basic I2C device and driver abstractions")
    f3cc26a417 ("rust: i2c: add manual I2C device creation abstractions")

from this tree (driver-core), produces errors like the following:

    error[E0599]: no method named `len_with_nul` found for reference `&'static ffi::CStr` in the current scope
      --> rust/kernel/i2c.rs:48:16
       |
    48 |             id.len_with_nul() <= Self::I2C_NAME_SIZE,
       |                ^^^^^^^^^^^^ method not found in `&CStr`

    error[E0599]: no method named `as_bytes_with_nul` found for reference `&'static ffi::CStr` in the current scope
      --> rust/kernel/i2c.rs:51:22
       |
    51 |         let src = id.as_bytes_with_nul();
       |                      ^^^^^^^^^^^^^^^^^
       |
    help: there is a method `to_bytes_with_nul` with a similar name
       |
    51 |         let src = id.to_bytes_with_nul();
       |                      ~~~~~~~~~~~~~~~~~

which were detected in linux-next by Stephen [1].

The `i2c` code can be independently prepared to be ready for the change,
thus do so.

The change is similar to the one done by Tamir in commit 657403637f
("rust: acpi: use `core::ffi::CStr` method names").

Link: https://lore.kernel.org/all/20251120181111.65ce75a0@canb.auug.org.au/ [1]
Signed-off-by: Miguel Ojeda <ojeda@kernel.org>
Link: https://patch.msgid.link/20251123163536.1771801-1-ojeda@kernel.org
Signed-off-by: Danilo Krummrich <dakr@kernel.org>
2025-11-24 09:14:47 +13:00
Scott Mayhew
2e47c3cc64 NFSv4: ensure the open stateid seqid doesn't go backwards
We have observed an NFSv4 client receiving a LOCK reply with a status of
NFS4ERR_OLD_STATEID and subsequently retrying the LOCK request with an
earlier seqid value in the stateid.  As this was for a new lockowner,
that would imply that nfs_set_open_stateid_locked() had updated the open
stateid seqid with an earlier value.

Looking at nfs_set_open_stateid_locked(), if the incoming seqid is out
of sequence, the task will sleep on the state->waitq for up to 5
seconds.  If the task waits for the full 5 seconds, then after finishing
the wait it'll update the open stateid seqid with whatever value the
incoming seqid has.  If there are multiple waiters in this scenario,
then the last one to perform said update may not be the one with the
highest seqid.

Add a check to ensure that the seqid can only be incremented, and add a
tracepoint to indicate when old seqids are skipped.

Signed-off-by: Scott Mayhew <smayhew@redhat.com>
Reviewed-by: Benjamin Coddington <bcodding@hammerspace.com>
Signed-off-by: Trond Myklebust <trond.myklebust@hammerspace.com>
2025-11-23 15:10:08 -05:00
Linus Torvalds
d0e88704d9 Fixes for the Allwinner clk driver:
- Lower the minimum rate for the A523 audio PLL to support
    frequencies required by audio devices
  - Mark a couple clks critical on A523 so that Linux doesn't turn
    them off when they're used by other code like TF-A
 -----BEGIN PGP SIGNATURE-----
 
 iQJIBAABCAAyFiEE9L57QeeUxqYDyoaDrQKIl8bklSUFAmkjV3AUHHN3Ym95ZEBj
 aHJvbWl1bS5vcmcACgkQrQKIl8bklSUPzw/+JyChC42SYjZAAbzT/aBE7STbjlWT
 EnY4RcES5AJ9xav9wXI6UbI9941xJWfhpijqJ5UOuXiHP9pGOzrElI+iyevL5iDu
 AL6qijUsE+3NL505LqwLo1IvrnCtdOy5o8JVI+A84QLs0SQCXGjFewxo1vSOCm/o
 va6zyFNW11Vk4dfMw1dS3bna9yhCXkZh0nzvelsYc0KyZODd6qk838Qjnq80A3tC
 5kXNFWFTuz9CLqc3emzACF3uRxT296gTLX92evyi1Pq+d69QaAdaVJQHSOJiMfT2
 tbiGpOyZHGm+vlZ8O2awE71ODgqOvSXcbewCm9DA7xp3TEAf0Kdy5zz8Jl6qmVuG
 PvYnhJe+B1SUm6iTwrzJTeyOD468Xi7yICbg+HKIrr1efpL4NzSIKypAJH9bv+DY
 t7wySo3Yql/9LOQQKE/TG8JGi8mozYNZSTiMrBtdUw9ev2kOW0zwaM9V7SEH1WK2
 urerDjloOPZ+Nf7eIN8dZfhFDi3sEO5/YcBev1FiQ+iIZtIZwltFnbvAHzrcLStb
 VttJla6lN05kUdPMkTBg1oNu2FLnS47eJWHCjDysOjsGnKx+Mjm+RB+p7wjqLc3e
 y0IRzlj7w2+PZFI7Q4KRfDT5srHP2TqBE2y6xAdQsU8xWx/tKSvVYgO0Vmu7AbJh
 8L77KUw2tQPaFbo=
 =A1l6
 -----END PGP SIGNATURE-----

Merge tag 'clk-fixes-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/clk/linux

Pull clk fixes from Stephen Boyd:
 "Fixes for the Allwinner A523 clk driver:

   - Lower the minimum rate for the A523 audio PLL to support
     frequencies required by audio devices

   - Mark a couple clks critical on A523 so that Linux doesn't turn them
     off when they're used by other code like TF-A"

* tag 'clk-fixes-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/clk/linux:
  clk: sunxi-ng: sun55i-a523-ccu: Lower audio0 pll minimum rate
  clk: sunxi-ng: sun55i-a523-r-ccu: Mark bus-r-dma as critical
  clk: sunxi-ng: Mark A523 bus-r-cpucfg clock as critical
2025-11-23 12:03:28 -08:00
René Rebe
123b5eb726 riscv: dts: sifive: unmatched: Add PWM controlled fans
This adds the two PWM-controlled fans of the HiFive Unmatched board to
the device tree.

Signed-off-by: René Rebe <rene@exactco.de>
Signed-off-by: Conor Dooley <conor.dooley@microchip.com>
2025-11-23 19:59:48 +00:00
Linus Torvalds
1af5c1d3a9 Miscellaneous fixes:
- Fix a race in timer->function clearing in timer_shutdown_sync()
 
  - Fix a timekeeper sysfs-setup resource leak in error paths
 
  - Fix the NOHZ report_idle_softirq() syslog rate-limiting
    logic to have no side effects on the return value
 
 Signed-off-by: Ingo Molnar <mingo@kernel.org>
 -----BEGIN PGP SIGNATURE-----
 
 iQJFBAABCgAvFiEEBpT5eoXrXCwVQwEKEnMQ0APhK1gFAmkivgERHG1pbmdvQGtl
 cm5lbC5vcmcACgkQEnMQ0APhK1i/0g/+ODFR6NF7cNcsZPhKdRt/A9Il72qmjteG
 Fqzacev1rzaQpPSaRpOnEAnqDRmfnFLZ0I4WA36QJxfApHHg9kI8GzEaa7WDvQOc
 kOL317i3vsme+tolI0fwazvMRnwgSipHVvXp76eyaEKXHM97i81XUpJYynxl+j9R
 0le8wpcBQKMUnpvYWN4J7u0AOO0vXCdaKSM2r9bgecXGyaqgzdyLYqGhgPLd0tYC
 Tn3pSrQIffORZQed3hKjXmC4DSs+tsdQr1npphxrzHy3Q8rXbt3eEj96IYyHdz1f
 /3eetSWRcd0jnZYIjuA9xG7xMSBBitkPBzSQMaZMdzV2d03oPU2WVvoKLSPnFNxz
 JQIErExLJH2AOrYNLmx+6DJ0Ql8398KdISJnb6HdX1cZcljRKmqlo9BIaPorQDqf
 WFm8WvhthBXHwEbWx/ecaPkV2aBQpXTTH7AkCebBLF+YTxtHUVGjwlBQ/CltABk3
 a4U93M/Zdyaxys/9YpIeWAsg0y3b54r6aFbReyt8CiMVe+gKqTOnT3Jy4hqFZPnB
 x+AHtooGsN7CIV4q9NIB6EmvJ5J1HFkmGQrWo1y/OHbZp2mDJy/1sQ+rj7NXdBZA
 ibrUHIWzTtZ6WpuR1ABD3wubhb7/BF3Gwh4v27AUtLFKW/cZq7ovMODVrp+Svt6X
 3EOg/YofAy0=
 =JVik
 -----END PGP SIGNATURE-----

Merge tag 'timers-urgent-2025-11-23' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip

Pull timer fixes from Ingo Molnar:

 - Fix a race in timer->function clearing in timer_shutdown_sync()

 - Fix a timekeeper sysfs-setup resource leak in error paths

 - Fix the NOHZ report_idle_softirq() syslog rate-limiting
   logic to have no side effects on the return value

* tag 'timers-urgent-2025-11-23' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
  timers: Fix NULL function pointer race in timer_shutdown_sync()
  timekeeping: Fix resource leak in tk_aux_sysfs_init() error paths
  tick/sched: Fix bogus condition in report_idle_softirq()
2025-11-23 08:23:30 -08:00
Linus Torvalds
e624f73775 Fix perf CPU-clock counters, and address a static checker warning.
Signed-off-by: Ingo Molnar <mingo@kernel.org>
 -----BEGIN PGP SIGNATURE-----
 
 iQJFBAABCgAvFiEEBpT5eoXrXCwVQwEKEnMQ0APhK1gFAmkiu0sRHG1pbmdvQGtl
 cm5lbC5vcmcACgkQEnMQ0APhK1h5+xAAsBjDSBSLwCyMb+k9iP482jMgMkl3s3m1
 LjqBvdJgbBZvZF2mfxRFRcgR8KLNyy4uXq05w0Bb5zP4pTvPK0cNuhG6SmlAhppr
 r4OHwnbRThXoKssWYVTc5qILEiCAoRbwSXDYdFjgl29Fd0u+IIv2sQIYRKkna8OJ
 A73TuOjFTWdU58sKPqY/tp7O0duzyFoicFkkap4atAV8lPHlDZJl+r1ayBtmx3pD
 xe9u9kHQXYq6NLPwXKrKIA77RAa3w1nTAe9zh/mIFF36MvifxGhSwNSB4Fr/RKuN
 2lBzCW5KnTrY9Mzs1Ds4k1RBt6RNNn30AZU/c9RB1qdzl1X6Z1xtse72yjHYQPb1
 +VM4YwMhnaJkGEczK6KP62DfNa/scrSjehLHXwqNPCt+FzJY2YRXp5s3v8SK8AXP
 rlRBnL0U8FhImR3VucgHp6LIkZMvuKI/+dDdW/KIO6XkZqbYQ/fORAgCFNGJDNAo
 UQv4mb11qk2Bv/QC0NJGfQqIb2mS+/xmM8q31Ipf9eC0eHzM0sLmVtJW9IX61qfI
 K+rP4qmIKkWJMLMkwGJxpw2G0v3Wfx0LQ6xa9io/Bw9F/9rs8/Qd5C2eafZmCRqW
 Mt/dK+2eYnR/+hKsWN/xN8ayawN2Ra5NSJjQAxL5CfLEXJRQAmrvwpWPNA/Ef3Dg
 0KOqU6yJlNo=
 =kaoD
 -----END PGP SIGNATURE-----

Merge tag 'perf-urgent-2025-11-23' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip

Pull perf fixes from Ingo Molnar:
 "Fix perf CPU-clock counters, and address a static checker warning"

* tag 'perf-urgent-2025-11-23' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
  perf: Fix 0 count issue of cpu-clock
  perf/x86/intel/uncore: Remove superfluous check
2025-11-23 08:20:15 -08:00
Thorsten Blum
dc30fe7a0a PM / devfreq: tegra30: use min to simplify actmon_cpu_to_emc_rate
Use min() to improve the readability of actmon_cpu_to_emc_rate() and
remove any unnecessary curly braces.

Reviewed-by: Dmitry Osipenko <digetx@gmail.com>
Signed-off-by: Thorsten Blum <thorsten.blum@linux.dev>
Acked-by: Thierry Reding <treding@nvidia.com>
Signed-off-by: Chanwoo Choi <cw00.choi@samsung.com>
Link: https://patchwork.kernel.org/project/linux-pm/patch/20251112172121.3741-2-thorsten.blum@linux.dev/
2025-11-24 00:02:07 +09:00
Pengjie Zhang
26dd44a400 PM / devfreq: hisi: Fix potential UAF in OPP handling
Ensure all required data is acquired before calling dev_pm_opp_put(opp)
to maintain correct resource acquisition and release order.

Fixes: 7da2fdaaa1 ("PM / devfreq: Add HiSilicon uncore frequency scaling driver")
Signed-off-by: Pengjie Zhang <zhangpengjie2@huawei.com>
Reviewed-by: Jie Zhan <zhanjie9@hisilicon.com>
Acked-by: Chanwoo Choi <cw00.choi@samsung.com>
Signed-off-by: Chanwoo Choi <cw00.choi@samsung.com>
Link: https://patchwork.kernel.org/project/linux-pm/patch/20250915062135.748653-1-zhangpengjie2@huawei.com/
2025-11-24 00:02:07 +09:00