The normal mixed bag. A few more fixes than usual as I failed to send
them out earlier.
New device support
==================
adi,ad4080
- New driver for this high speed ADC. Includes extensions to iio-backends
necessary to support filter config, variable data lands and data
alignment control.
adi,ad4170-4
- New driver for this 24-bit very feature rich ADC suited for weigh scale
and thermocouple applications.
adi,ad7405
- New driver for this single channel isolated ADC with backend support
(adi-axi-adc)
google,cros_ec_activity
- Add activity detection to the existing set of cros_ec drivers covering
both human body and significant motion detection.
mediatek,mt6359
- Add support for MT6363 and MT6373 PMIC Auxiliary ADCs.
nicera,d3-323-aa
- New driver for this configurable Passive InfraRed sensor.
Device ID only
==============
mediatek,mt7981-auxadc
- Add ID to mt2701 driver as fully compatible with mt7986-auxadc.
rohm,bu79100g
- Add ID to ad7476 driver as fully compatible with TI ADS7866.
Features
========
Core
- New in_voltageY_convdelay to allow for devices to control timing
offsets between sampling different channels.
adi,ad-sigma-delta-library
- Support SPI offload (later fix for missing Kconfig dependency)
adi,ad4851
- SPI 3-wire support.
adi,ad7606
- Power supply control.
- convdelay and calibbias support for calibration purposes.
- gain calibration support based on external filter resistance provided
from device tree.
adi,ad7768-1
- Add output regulator for VCM output, typically used for preconditioning
circuits.
- Add gpio controller for the 4 GPIOs.
- Multiple scan type support to enable 16-bit modes.
- Support synchronization over SPI.
- Filter type and oversampling ratio control.
- Low pass filter cut off read only attribute.
adi,adxl313
- FIFO support
- DC activity, inactivity detection with power-save on inactivity
- AC coupled activity detection
- Documentation for this complex driver.
- debugfs register access.
adi,adxl345
- Sampling frequency and sensor range controls.
bosch,bmi270
- Add step counter support.
invensense,icm42600
- Wake on motion support.
Cleanup and fixes
=================
backend
- Drop unused parameter from iio_backend_ovesampling_ratio_set()
docs
- Fix ABI docs around I and Q modifiers.
treewide
- Switch remaining drives to use maple tree regcache.
- Drop use of DRIVER_NAME style definitions when only used in one
place.
- Drop unused export.h includes.
- Use = { } in place of memset in various drivers.
- Constify various info structures and related.
- Switch some drivers from array of chip_info structures to individual
named structures.
adi,ad-sigma_delta library
- Fix over allocation of scan buffer. (bits/bytes confusion)
- Sort includes and apply iwyu principles to ensure sensible set.
- Use u8 instead of uint8_t
- Replace hard coded type sizes with sizeof() and BITS_TO_BYTES() as
appropriate.
- Factor out setting of read address to reduce duplication.
- Switch to buffer predisable so error handling on buffer enable
functions correctly (balanced against postenable).
adi,ad4000
- Don't use sift_right() on an unsigned value.
adi,ad7173
- Add missing check on spi_setup() succeeding.
- Simplify clock enable disable code using devm_clk_get_enabled()
- Fix channel index for syscalib_mode
- Fix number of configuration slots for some devics.
- Fix the channel used for calibration.
- Fix setting ODR up in probe.
adi,ad7380
- Drop unused oversampling_ratio getter function call as value never
used.
adi,ad7606
- Exit if invalid dt_schema encountered rather than carrying on with
unknown config.
adi,ad7768-1
- Ensure SYNC_IN pulse is long enough.
- Switch sampling_frequency_available to read_avail() callback.
adi,ada4250
- Ensuring a dma-safe buffer for regmap_bulk_read()
- Use a local dev variable to simplify code
- Relax chip ID matching to allow for fallback dt compatibles.
- Make use of devm_regulator_get_enabled_read_voltage() to replace
equivalent code.
- Shuffle elements around in struct to improve logical groupings and
reduce holes.
- Use dev_err_probe()
adi,adxl313
- Use regcache to reduce traffic.
- Factor out enabling of measurement.
adi,adxl345
- Drop irq from struct as only used locally in code
- Simplify measure enable function using regmap_update_bits()
- Replace some magic numbers by units.h defines
- Simplify interrupt mapping code
- Simplify FIFO read out.
adi,axi-dac
- Factor out code to check for bus free to reduce duplication.
avago,apds9306
- Use a helper to get register address in both get and set functions.
bosch,bmi160+bmi270
- Ensure triggers suspended and resumed correctly.
bosch,bmo055
- Fix theoretical OOB acces to hw_xlate array.
freescale,vf610
- Drop -ENOMEM error message as plenty of existing prints if memory
allocation fails.
- Use dev_err_probe() and devm_clk_geT_enabled() to simplify probe().
kionix,kx022a
- Apply include what you use principles to includes.
invensense,itg3200
- Add missing dt-binding for this gyroscope.
invensense,icm42600
- Switch from int64_t and similar to s64 and other kernel types.
- Simplify arrangement of DMA safe buffers and potentially reduce
structure size a little.
invensense,mpu6050
- Reduce duplication in aux read/write code.
- Use sysfs_emit() to replace scnprintf()
murata,irsd200
- Drop duplicate printing of ret in dev_err_probe()
nxp,lpc3220-adc
- Add missing clocks property to dt-binding.
st,spear600
- Convert dt-binding that got left behind in staging to yaml in the main
tree.
st,stm32-adc
- Use dev_fwnode() rather than directly accessing the of_node.
vti,sca3000
- Use direct returns instead of gotos where simple.
Various other minor typo and white space fixes.
-----BEGIN PGP SIGNATURE-----
iQJFBAABCgAvFiEEbilms4eEBlKRJoGxVIU0mcT0FogFAmh572MRHGppYzIzQGtl
cm5lbC5vcmcACgkQVIU0mcT0FohKfw//Qox/G+yTyTSKX0CleP8sFHt6Dmanr5Zc
Q0jmsu0W3kVjj+jQlHw/5ivcRJI6/AE6WFjPhrmfG76KhnfiruDuu74P1HbmY4Nz
5l7M6RgZZAu9WGQ8oSYpPobkZS1H8X2mFYSF1sdQpG7NWE5n1NvUluvnUrb3k5Z9
qPBa1H6MsLkrzh8FubnwvgzWBGzmXa8hJBth40wlEoGcBIzWuqhybnts5levWUcq
/57d+YYscFR3VrVXWu9PWxWVTdA8LElOmPGf++4ftpLRxuwtlrQ/9YJsgwr+Wm6+
6l+lc3qQ9y6WZahqCwoqg8uVoGaY17NOjlOTZGwvOTEsX/kNnsg2XUMWl7azSRKk
8pfJV3jM8HgKJx70c5owdjIPl++3eo9PKLwosOOMm2T+f0jKdeJGIe8ziaEvy9nP
JcgsI3Q09lopr96OMB56JtAyx9tbtt8wLydQT6SpqNJiDNJTiX0kr0TBp9zHnlS9
tOfkKB/G9/UqsOv0uiZ0H/fqYK4T0G71Gfuc2Cbq+YMXEoIzTDrcI8OVpOxzzC/s
i73CIy6fsfSKcPNna889ukWE3pIqHhMhcVYmYS9Pf00YuhZvedpZ7B+vRQa/sqe3
4zGxPCScY7N0MyWDOKRVV2v4tCNtW3WeBVJjPc23WchP9XvccrBe23lH6iK/TnB6
J7r11JYzOkY=
=sY2q
-----END PGP SIGNATURE-----
Merge tag 'iio-for-6.17a' of ssh://gitolite.kernel.org/pub/scm/linux/kernel/git/jic23/iio into char-misc-next
Jonathan writes:
IIO: New device support, features, late breaking fixes and cleanup for 6.17
The normal mixed bag. A few more fixes than usual as I failed to send
them out earlier.
New device support
==================
adi,ad4080
- New driver for this high speed ADC. Includes extensions to iio-backends
necessary to support filter config, variable data lands and data
alignment control.
adi,ad4170-4
- New driver for this 24-bit very feature rich ADC suited for weigh scale
and thermocouple applications.
adi,ad7405
- New driver for this single channel isolated ADC with backend support
(adi-axi-adc)
google,cros_ec_activity
- Add activity detection to the existing set of cros_ec drivers covering
both human body and significant motion detection.
mediatek,mt6359
- Add support for MT6363 and MT6373 PMIC Auxiliary ADCs.
nicera,d3-323-aa
- New driver for this configurable Passive InfraRed sensor.
Device ID only
==============
mediatek,mt7981-auxadc
- Add ID to mt2701 driver as fully compatible with mt7986-auxadc.
rohm,bu79100g
- Add ID to ad7476 driver as fully compatible with TI ADS7866.
Features
========
Core
- New in_voltageY_convdelay to allow for devices to control timing
offsets between sampling different channels.
adi,ad-sigma-delta-library
- Support SPI offload (later fix for missing Kconfig dependency)
adi,ad4851
- SPI 3-wire support.
adi,ad7606
- Power supply control.
- convdelay and calibbias support for calibration purposes.
- gain calibration support based on external filter resistance provided
from device tree.
adi,ad7768-1
- Add output regulator for VCM output, typically used for preconditioning
circuits.
- Add gpio controller for the 4 GPIOs.
- Multiple scan type support to enable 16-bit modes.
- Support synchronization over SPI.
- Filter type and oversampling ratio control.
- Low pass filter cut off read only attribute.
adi,adxl313
- FIFO support
- DC activity, inactivity detection with power-save on inactivity
- AC coupled activity detection
- Documentation for this complex driver.
- debugfs register access.
adi,adxl345
- Sampling frequency and sensor range controls.
bosch,bmi270
- Add step counter support.
invensense,icm42600
- Wake on motion support.
Cleanup and fixes
=================
backend
- Drop unused parameter from iio_backend_ovesampling_ratio_set()
docs
- Fix ABI docs around I and Q modifiers.
treewide
- Switch remaining drives to use maple tree regcache.
- Drop use of DRIVER_NAME style definitions when only used in one
place.
- Drop unused export.h includes.
- Use = { } in place of memset in various drivers.
- Constify various info structures and related.
- Switch some drivers from array of chip_info structures to individual
named structures.
adi,ad-sigma_delta library
- Fix over allocation of scan buffer. (bits/bytes confusion)
- Sort includes and apply iwyu principles to ensure sensible set.
- Use u8 instead of uint8_t
- Replace hard coded type sizes with sizeof() and BITS_TO_BYTES() as
appropriate.
- Factor out setting of read address to reduce duplication.
- Switch to buffer predisable so error handling on buffer enable
functions correctly (balanced against postenable).
adi,ad4000
- Don't use sift_right() on an unsigned value.
adi,ad7173
- Add missing check on spi_setup() succeeding.
- Simplify clock enable disable code using devm_clk_get_enabled()
- Fix channel index for syscalib_mode
- Fix number of configuration slots for some devics.
- Fix the channel used for calibration.
- Fix setting ODR up in probe.
adi,ad7380
- Drop unused oversampling_ratio getter function call as value never
used.
adi,ad7606
- Exit if invalid dt_schema encountered rather than carrying on with
unknown config.
adi,ad7768-1
- Ensure SYNC_IN pulse is long enough.
- Switch sampling_frequency_available to read_avail() callback.
adi,ada4250
- Ensuring a dma-safe buffer for regmap_bulk_read()
- Use a local dev variable to simplify code
- Relax chip ID matching to allow for fallback dt compatibles.
- Make use of devm_regulator_get_enabled_read_voltage() to replace
equivalent code.
- Shuffle elements around in struct to improve logical groupings and
reduce holes.
- Use dev_err_probe()
adi,adxl313
- Use regcache to reduce traffic.
- Factor out enabling of measurement.
adi,adxl345
- Drop irq from struct as only used locally in code
- Simplify measure enable function using regmap_update_bits()
- Replace some magic numbers by units.h defines
- Simplify interrupt mapping code
- Simplify FIFO read out.
adi,axi-dac
- Factor out code to check for bus free to reduce duplication.
avago,apds9306
- Use a helper to get register address in both get and set functions.
bosch,bmi160+bmi270
- Ensure triggers suspended and resumed correctly.
bosch,bmo055
- Fix theoretical OOB acces to hw_xlate array.
freescale,vf610
- Drop -ENOMEM error message as plenty of existing prints if memory
allocation fails.
- Use dev_err_probe() and devm_clk_geT_enabled() to simplify probe().
kionix,kx022a
- Apply include what you use principles to includes.
invensense,itg3200
- Add missing dt-binding for this gyroscope.
invensense,icm42600
- Switch from int64_t and similar to s64 and other kernel types.
- Simplify arrangement of DMA safe buffers and potentially reduce
structure size a little.
invensense,mpu6050
- Reduce duplication in aux read/write code.
- Use sysfs_emit() to replace scnprintf()
murata,irsd200
- Drop duplicate printing of ret in dev_err_probe()
nxp,lpc3220-adc
- Add missing clocks property to dt-binding.
st,spear600
- Convert dt-binding that got left behind in staging to yaml in the main
tree.
st,stm32-adc
- Use dev_fwnode() rather than directly accessing the of_node.
vti,sca3000
- Use direct returns instead of gotos where simple.
Various other minor typo and white space fixes.
* tag 'iio-for-6.17a' of ssh://gitolite.kernel.org/pub/scm/linux/kernel/git/jic23/iio: (201 commits)
iio: adc: ad_sigma_delta: Select IIO_BUFFER_DMAENGINE and SPI_OFFLOAD
iio: adc: ad7173: fix setting ODR in probe
iio: adc: ad7173: fix calibration channel
iio: adc: ad7173: fix num_slots
iio: adc: ad7173: fix channels index for syscalib_mode
iio: adc: ad_sigma_delta: change to buffer predisable
iio: ABI: fix correctness of I and Q modifiers
iio: Add driver for Nicera D3-323-AA PIR sensor
dt-bindings: iio: proximity: Add Nicera D3-323-AA PIR sensor
dt-bindings: vendor-prefixes: Add Nicera
iio: dac: vf610: Simplify with devm_clk_get_enabled()
iio: adc: vf610: Simplify with dev_err_probe
iio: adc: vf610: Drop -ENOMEM error message
iio: imu: bno055: make bno055_sysfs_attr const
iio: imu: bno055: fix OOB access of hw_xlate array
dt-bindings: iio: adc: Add support for MT7981
iio: accel: kionix-kx022a: Apply approximate iwyu principles to includes
iio: adc: ad4170-4: Add support for weigh scale, thermocouple, and RTD sens
iio: adc: ad4170-4: Add support for internal temperature sensor
iio: adc: ad4170-4: Add GPIO controller support
...
- Marek's change fixes the incorrect use of sgtable calls.
All patches have been reviewed on the mailing list, and have been in the
last linux-next releases (as part of our for-next branch).
Signed-off-by: Xu Yilun <yilun.xu@intel.com>
-----BEGIN PGP SIGNATURE-----
iIkEABYIADEWIQSgSJpClIeaArXyudb8twOBpKCM2gUCaHfSThMceWlsdW4ueHVA
aW50ZWwuY29tAAoJEPy3A4GkoIzavHMA/j/jKRa+IK6ElGlnAcknbKn9fZWmIrxB
thkLwV49jGdqAP9p4P+NiCY5nUYfA/erlSyIs8WM50V51NRikRKXjjwwDQ==
=TDKf
-----END PGP SIGNATURE-----
Merge tag 'fpga-for-6.17-rc1' of ssh://gitolite.kernel.org/pub/scm/linux/kernel/git/fpga/linux-fpga into char-misc-next
Xu writes:
FPGA Manager changes for 6.17-rc1
- Marek's change fixes the incorrect use of sgtable calls.
All patches have been reviewed on the mailing list, and have been in the
last linux-next releases (as part of our for-next branch).
Signed-off-by: Xu Yilun <yilun.xu@intel.com>
* tag 'fpga-for-6.17-rc1' of ssh://gitolite.kernel.org/pub/scm/linux/kernel/git/fpga/linux-fpga:
zynq_fpga: use sgtable-based scatterlist wrappers
========
- Make local functions static (as they should be).
- Fix the modem name for Foxconn T99W640 modem.
- Disable runtime PM for Qcom QDU100 modem as it doesn't support M3 state.
- Fix endianness of BHI vector table to allow MHI to work correctly on big
endian platforms like PowerPC.
- Add modem support for Semtech EM929x, Foxconn T99W696 and Telit FN990B40
modems.
- Fix the OOB access to Transfer Ring Element (TRE) by hardening the checks in
parse_xfer_event().
-----BEGIN PGP SIGNATURE-----
iQEzBAABCgAdFiEEZ6VDKoFIy9ikWCeXVZ8R5v6RzvUFAmh7EngACgkQVZ8R5v6R
zvV1aQf+OBLFMrCUMH0pr7pR6VxJkqpwkr1Ni/5nFVYVIfXIEWUaMYH0rf/sJHTG
JPcRNqlSl6lWsq/zZe3nHtV+DXm4JICb2oebE6IrfXNIWkrMrzzoLKDAfIbQ55Wa
hvmBcAgCIrzBG0cwVFBZbhsUUnT1DDQcxGTrG2iwciI23B0K0Lywxtq0eMf0uOKK
EUxrXNelBfp23ZhGPwz9N97F6b547indMmc0XTHysNIvM+qvGsgbFWYpFj2JuOf8
wMP7TYTm0Jb5nflu8sVTUSYqkrLIaywVKXbhWuCoUxC7fzvRG85tMWjjK0CMkyt+
RhKz8OirkGR8mTmA4XLvNCgHwBvq4Q==
=H1H0
-----END PGP SIGNATURE-----
Merge tag 'mhi-for-v6.17' of ssh://gitolite.kernel.org/pub/scm/linux/kernel/git/mani/mhi into char-misc-next
Manivannan writes:
MHI Host
========
- Make local functions static (as they should be).
- Fix the modem name for Foxconn T99W640 modem.
- Disable runtime PM for Qcom QDU100 modem as it doesn't support M3 state.
- Fix endianness of BHI vector table to allow MHI to work correctly on big
endian platforms like PowerPC.
- Add modem support for Semtech EM929x, Foxconn T99W696 and Telit FN990B40
modems.
- Fix the OOB access to Transfer Ring Element (TRE) by hardening the checks in
parse_xfer_event().
* tag 'mhi-for-v6.17' of ssh://gitolite.kernel.org/pub/scm/linux/kernel/git/mani/mhi:
bus: mhi: host: pci_generic: Add Telit FN990B40 modem support
bus: mhi: host: Detect events pointing to unexpected TREs
bus: mhi: host: pci_generic: Add Foxconn T99W696 modem
bus: mhi: host: Use str_true_false() helper
bus: mhi: host: pci_generic: Add support for EM929x and set MRU to 32768 for better performance.
bus: mhi: host: Fix endianness of BHI vector table
bus: mhi: host: pci_generic: Disable runtime PM for QDU100
bus: mhi: host: pci_generic: Fix the modem name of Foxconn T99W640
bus: mhi: host: Make local functions static
-----BEGIN PGP SIGNATURE-----
iQGzBAABCgAdFiEE6fsu8pdIjtWE/DpLiiy9cAdyT1EFAmh6+XEACgkQiiy9cAdy
T1G7TgwAtVHE3Dez70Yz4NcDAS5QPZgK8OTaRlUSSiSmgXMeRvXIzKWNBS+1TZQ6
Ih4iDJ3VwZ2gINM6egCSCkjxy1Ab02Du4qURa3BLmZ31wjJIK17V8SboUww+3xaT
xUfUSTKJPJjsqaAbqvWg6zIpwod+zTy27uaUoUitko5ELKMWpBumSxH7vWLq5klr
AIJgveUASEAmkZGwBr2fqPfdyWkNiPgYo6anSiU05J/Ga7s1RVU9WosevHbSsqAh
YUaH3N6ZOm6F3LHVYJGrFJVp/313T9FHR/sE+rbf8xAq6TxWWFWZanYcsMQoKy8c
P/wgWLJgVfNu2tsO7pSoydSpIPov5p0jHXr2erKkUaSnUk42+48Gsb/JS5Ne6u0h
qkKUdRu6iOuXFvjCq0yfQ+9KQysad/uknNfcRj1EujFArv4qzjDzGpkYckN7uRZL
s2ENtzd6ljNKwROiyduFmT2WLYxAhivB8XUo1zt2BtlzCEorIIOgjHIcQXzZGc5O
gwSuxQTf
=IWDL
-----END PGP SIGNATURE-----
Merge tag 'v6.16-rc6-smb3-client-fixes' of git://git.samba.org/sfrench/cifs-2.6
Pull smb client fixes from Steve French:
- fix creating special files to Samba when using SMB3.1.1 POSIX
Extensions
- fix incorrect caching on new file creation with directory leases
enabled
- two use after free fixes: one in oplock_break and one in async
decryption
* tag 'v6.16-rc6-smb3-client-fixes' of git://git.samba.org/sfrench/cifs-2.6:
Fix SMB311 posix special file creation to servers which do not advertise reparse support
smb: invalidate and close cached directory when creating child entries
smb: client: fix use-after-free in crypt_message when using async crypto
smb: client: fix use-after-free in cifs_oplock_break
This adds the usual scoped_guard(srcu_fast, &my_srcu) and
guard(srcu_fast)(&my_srcu).
Suggested-by: Steven Rostedt <rostedt@goodmis.org>
Signed-off-by: Paul E. McKenney <paulmck@kernel.org>
Cc: Mathieu Desnoyers <mathieu.desnoyers@efficios.com>
Cc: Sebastian Andrzej Siewior <bigeasy@linutronix.de>
Reviewed-by: Steven Rostedt (Google) <rostedt@goodmis.org>
Signed-off-by: Neeraj Upadhyay (AMD) <neeraj.upadhyay@kernel.org>
When a remote device sends a completion event to the host, it contains a
pointer to the consumed TRE. The host uses this pointer to process all of
the TREs between it and the host's local copy of the ring's read pointer.
This works when processing completion for chained transactions, but can
lead to nasty results if the device sends an event for a single-element
transaction with a read pointer that is multiple elements ahead of the
host's read pointer.
For instance, if the host accesses an event ring while the device is
updating it, the pointer inside of the event might still point to an old
TRE. If the host uses the channel's xfer_cb() to directly free the buffer
pointed to by the TRE, the buffer will be double-freed.
This behavior was observed on an ep that used upstream EP stack without
'commit 6f18d174b7 ("bus: mhi: ep: Update read pointer only after buffer
is written")'. Where the device updated the events ring pointer before
updating the event contents, so it left a window where the host was able to
access the stale data the event pointed to, before the device had the
chance to update them. The usual pattern was that the host received an
event pointing to a TRE that is not immediately after the last processed
one, so it got treated as if it was a chained transaction, processing all
of the TREs in between the two read pointers.
This commit aims to harden the host by ensuring transactions where the
event points to a TRE that isn't local_rp + 1 are chained.
Fixes: 1d3173a3ba ("bus: mhi: core: Add support for processing events from client device")
Signed-off-by: Youssef Samir <quic_yabdulra@quicinc.com>
[mani: added stable tag and reworded commit message]
Signed-off-by: Manivannan Sadhasivam <mani@kernel.org>
Reviewed-by: Jeff Hugo <jeff.hugo@oss.qualcomm.com>
Cc: stable@vger.kernel.org
Link: https://patch.msgid.link/20250714163039.3438985-1-quic_yabdulra@quicinc.com
T99W696 modem is based on Qualcomm SDX61 chipset, which is an economic
version compared to the baseline SDX62/SDX65 chipsets. Add support for it
by introducing a new 'mhi_channel_config'. Since this modem supports the
NMEA channel, a new config is needed.
Signed-off-by: Slark Xiao <slark_xiao@163.com>
[mani: reworded commit message]
Signed-off-by: Manivannan Sadhasivam <mani@kernel.org>
Link: https://patch.msgid.link/20250528092232.16111-1-slark_xiao@163.com
Add MHI controller config for EM929x. It uses the same configuration
as EM919x. Also set the MRU to 32768 to improve downlink throughput.
02:00.0 Unassigned class [ff00]: Qualcomm Technologies, Inc Device 0308
Subsystem: Device 18d7:0301
Signed-off-by: Adam Xue <zxue@semtech.com>
Signed-off-by: Manivannan Sadhasivam <mani@kernel.org>
Link: https://patch.msgid.link/20250528175943.12739-1-zxue@semtech.com
On big endian platform like PowerPC, the MHI bus (which is little endian)
does not start properly. The following example shows the error messages by
using QCN9274 WLAN device with ath12k driver:
ath12k_pci 0001:01:00.0: BAR 0: assigned [mem 0xc00000000-0xc001fffff 64bit]
ath12k_pci 0001:01:00.0: MSI vectors: 1
ath12k_pci 0001:01:00.0: Hardware name: qcn9274 hw2.0
ath12k_pci 0001:01:00.0: failed to set mhi state: POWER_ON(2)
ath12k_pci 0001:01:00.0: failed to start mhi: -110
ath12k_pci 0001:01:00.0: failed to power up :-110
ath12k_pci 0001:01:00.0: failed to create soc core: -110
ath12k_pci 0001:01:00.0: failed to init core: -110
ath12k_pci: probe of 0001:01:00.0 failed with error -110
The issue seems to be with the incorrect DMA address/size used for
transferring the firmware image over BHI. So fix it by converting the DMA
address and size of the BHI vector table to little endian format before
sending them to the device.
Fixes: 6cd330ae76 ("bus: mhi: core: Add support for ringing channel/event ring doorbells")
Signed-off-by: Alexander Wilhelm <alexander.wilhelm@westermo.com>
[mani: added stable tag and reworded commit message]
Signed-off-by: Manivannan Sadhasivam <mani@kernel.org>
Reviewed-by: Jeff Hugo <jeff.hugo@oss.qualcomm.com>
Reviewed-by: Krishna Chaitanya Chundru <krishna.chundru@oss.qualcomm.com>
Cc: stable@vger.kernel.org
Link: https://patch.msgid.link/20250519145837.958153-1-alexander.wilhelm@westermo.com
The QDU100 device does not support the MHI M3 state, necessitating the
disabling of runtime PM for this device. It is essential to disable
runtime PM if the device does not support M3 state.
Signed-off-by: Vivek Pernamitta <quic_vpernami@quicinc.com>
[mani: Fixed the kdoc comment for no_m3]
Signed-off-by: Manivannan Sadhasivam <mani@kernel.org>
Reviewed-by: Krishna Chaitanya Chundru <krishna.chundru@oss.qualcomm.com>
Link: https://patch.msgid.link/20250425-vdev_next-20250411_pm_disable-v4-1-d4870a73ebf9@quicinc.com
T99W640 was mistakenly mentioned as T99W515. T99W515 is a LGA device, not
a M.2 modem device. So correct it's name to avoid name mismatch issue.
Fixes: bf30a75e6e ("bus: mhi: host: Add support for Foxconn SDX72 modems")
Signed-off-by: Slark Xiao <slark_xiao@163.com>
[mani: commit message fixup]
Signed-off-by: Manivannan Sadhasivam <mani@kernel.org>
Link: https://patch.msgid.link/20250606095019.383992-1-slark_xiao@163.com
In the original design, it is assumed local and peer eswitches have the
same number of vfs. However, in new firmware, local and peer eswitches
can have different number of vfs configured by mlxconfig. In such
configuration, it is incorrect to derive the number of vfs from the
local device's eswitch.
Fix this by updating the peer miss rules add and delete functions to use
the peer device's eswitch and vf count instead of the local device's
information, ensuring correct behavior regardless of vf configuration
differences.
Fixes: ac004b8321 ("net/mlx5e: E-Switch, Add peer miss rules")
Signed-off-by: Shahar Shitrit <shshitrit@nvidia.com>
Reviewed-by: Mark Bloch <mbloch@nvidia.com>
Signed-off-by: Tariq Toukan <tariqt@nvidia.com>
Reviewed-by: Simon Horman <horms@kernel.org>
Link: https://patch.msgid.link/1752753970-261832-3-git-send-email-tariqt@nvidia.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
If cmd_exec() is called with callback and mlx5_cmd_invoke() returns an
error, resources allocated in cmd_exec() will not be freed.
Fix the code to release the resources if mlx5_cmd_invoke() returns an
error.
Fixes: f086470122 ("net/mlx5: cmdif, Return value improvements")
Reported-by: Alex Tereshkin <atereshkin@nvidia.com>
Signed-off-by: Chiara Meiohas <cmeiohas@nvidia.com>
Reviewed-by: Moshe Shemesh <moshe@nvidia.com>
Signed-off-by: Vlad Dumitrescu <vdumitrescu@nvidia.com>
Signed-off-by: Tariq Toukan <tariqt@nvidia.com>
Reviewed-by: Simon Horman <horms@kernel.org>
Link: https://patch.msgid.link/1752753970-261832-2-git-send-email-tariqt@nvidia.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
The TCP header fields seq and ack_seq are 32-bit values in network
byte order as (__be32). these fields were earlier printed using
ntohs(), which converts only 16-bit values and produces incorrect
results for 32-bit fields. This patch is changeing the conversion
to ntohl(), ensuring correct interpretation of these sequence numbers.
Notably, the format specifier is updated from %d to %u to reflect the
unsigned nature of these fields.
improves the accuracy of debug log messages for TCP sequence and
acknowledgment numbers during TX timeouts.
Signed-off-by: Alok Tiwari <alok.a.tiwari@oracle.com>
Reviewed-by: Simon Horman <horms@kernel.org>
Link: https://patch.msgid.link/20250717193552.3648791-1-alok.a.tiwari@oracle.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Wire-up ethtool_ops::nway_reset to phy_ethtool_nway_reset in order to
support re-starting auto-negotiation.
Signed-off-by: Florian Fainelli <florian.fainelli@broadcom.com>
Reviewed-by: Andrew Lunn <andrew@lunn.ch>
Link: https://patch.msgid.link/20250717180915.2611890-1-florian.fainelli@broadcom.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Stanislav Fomichev says:
====================
net: maintain netif vs dev prefix semantics
Commit cc34acd577 ("docs: net: document new locking reality")
introduced netif_ vs dev_ function semantics: the former expects locked
netdev, the latter takes care of the locking. We don't strictly
follow this semantics on either side, but there are more dev_xxx handlers
now that don't fit. Rename them to netif_xxx where appropriate. We care only
about driver-visible APIs, don't touch stack-internal routines.
The rest seem to be ok:
* dev_xdp_prog_count - mostly called by sw drivers (bonding), should not matter
* dev_get_by_xxx - too many to reasonably cleanup, already have different flavors
* dev_fetch_sw_netstats - don't need instance lock
* dev_get_tstats64 - never called directly, only as an ndo callback
* dev_pick_tx_zero - never called directly, only as an ndo callback
* dev_add_pack / dev_remove_pack - called early enough (in module init) to not matter
* dev_get_iflink - mostly called by sw drivers, should not matter
* dev_fill_forward_path - ditto
* dev_getbyhwaddr_rcu - ditto
* dev_getbyhwaddr - ditto
* dev_getfirstbyhwtype - ditto
* dev_valid_name - ditto
* __dev_forward_skb dev_forward_skb dev_queue_xmit_nit - established helpers, no netif vs dev distinction
====================
Link: https://patch.msgid.link/20250717172333.1288349-1-sdf@fomichev.me
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Commit cc34acd577 ("docs: net: document new locking reality")
introduced netif_ vs dev_ function semantics: the former expects locked
netdev, the latter takes care of the locking. We don't strictly
follow this semantics on either side, but there are more dev_xxx handlers
now that don't fit. Rename them to netif_xxx where appropriate.
netif_close_many is used only by vlan/dsa and one mtk driver, so move it into
NETDEV_INTERNAL namespace.
Signed-off-by: Stanislav Fomichev <sdf@fomichev.me>
Link: https://patch.msgid.link/20250717172333.1288349-8-sdf@fomichev.me
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Commit cc34acd577 ("docs: net: document new locking reality")
introduced netif_ vs dev_ function semantics: the former expects locked
netdev, the latter takes care of the locking. We don't strictly
follow this semantics on either side, but there are more dev_xxx handlers
now that don't fit. Rename them to netif_xxx where appropriate.
Note that one dev_set_threaded call still remains in mt76 for debugfs file.
Signed-off-by: Stanislav Fomichev <sdf@fomichev.me>
Link: https://patch.msgid.link/20250717172333.1288349-7-sdf@fomichev.me
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Commit cc34acd577 ("docs: net: document new locking reality")
introduced netif_ vs dev_ function semantics: the former expects locked
netdev, the latter takes care of the locking. We don't strictly
follow this semantics on either side, but there are more dev_xxx handlers
now that don't fit. Rename them to netif_xxx where appropriate.
Signed-off-by: Stanislav Fomichev <sdf@fomichev.me>
Link: https://patch.msgid.link/20250717172333.1288349-6-sdf@fomichev.me
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Commit cc34acd577 ("docs: net: document new locking reality")
introduced netif_ vs dev_ function semantics: the former expects locked
netdev, the latter takes care of the locking. We don't strictly
follow this semantics on either side, but there are more dev_xxx handlers
now that don't fit. Rename them to netif_xxx where appropriate.
__netif_set_mtu is used only by bond, so move it into
NETDEV_INTERNAL namespace.
Signed-off-by: Stanislav Fomichev <sdf@fomichev.me>
Link: https://patch.msgid.link/20250717172333.1288349-5-sdf@fomichev.me
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Commit cc34acd577 ("docs: net: document new locking reality")
introduced netif_ vs dev_ function semantics: the former expects locked
netdev, the latter takes care of the locking. We don't strictly
follow this semantics on either side, but there are more dev_xxx handlers
now that don't fit. Rename them to netif_xxx where appropriate.
netif_pre_changeaddr_notify is used only by ipvlan/bond, so move it into
NETDEV_INTERNAL namespace.
Signed-off-by: Stanislav Fomichev <sdf@fomichev.me>
Link: https://patch.msgid.link/20250717172333.1288349-4-sdf@fomichev.me
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Commit cc34acd577 ("docs: net: document new locking reality")
introduced netif_ vs dev_ function semantics: the former expects locked
netdev, the latter takes care of the locking. We don't strictly
follow this semantics on either side, but there are more dev_xxx handlers
now that don't fit. Rename them to netif_xxx where appropriate.
netif_get_mac_address is used only by tun/tap, so move it into
NETDEV_INTERNAL namespace.
Signed-off-by: Stanislav Fomichev <sdf@fomichev.me>
Link: https://patch.msgid.link/20250717172333.1288349-3-sdf@fomichev.me
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Commit cc34acd577 ("docs: net: document new locking reality")
introduced netif_ vs dev_ function semantics: the former expects locked
netdev, the latter takes care of the locking. We don't strictly
follow this semantics on either side, but there are more dev_xxx handlers
now that don't fit. Rename them to netif_xxx where appropriate.
Signed-off-by: Stanislav Fomichev <sdf@fomichev.me>
Link: https://patch.msgid.link/20250717172333.1288349-2-sdf@fomichev.me
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Virtual devices (e.g., VXLAN) that do not have a notion of a carrier are
created with an "UNKNOWN" operational state which some users find
confusing [1].
It is possible to set the operational state from user space either
during device creation or afterwards and some applications will start
doing that in order to avoid the above problem.
Add a test for this functionality to ensure it does not regress.
[1] https://lore.kernel.org/netdev/20241119153703.71f97b76@hermes.local/
Reviewed-by: Petr Machata <petrm@nvidia.com>
Signed-off-by: Ido Schimmel <idosch@nvidia.com>
Reviewed-by: Simon Horman <horms@kernel.org>
Link: https://patch.msgid.link/20250717125151.466882-1-idosch@nvidia.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Detect NICs and drivers that either drop frames with a corrupted TCP
checksum or, worse, pass them up as valid. The test flips one bit in
the checksum, transmits the packet in internal loopback, and fails when
the driver reports CHECKSUM_UNNECESSARY.
Discussed at:
https://lore.kernel.org/all/20250625132117.1b3264e8@kernel.org/
Signed-off-by: Oleksij Rempel <o.rempel@pengutronix.de>
Reviewed-by: Simon Horman <horms@kernel.org>
Link: https://patch.msgid.link/20250717083524.1645069-1-o.rempel@pengutronix.de
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
The fsl_mc_get_endpoint() function uses device_find_child() for
localization, which implicitly calls get_device() to increment the
device's reference count before returning the pointer. However, the
caller dpaa2_switch_port_connect_mac() fails to properly release this
reference in multiple scenarios. We should call put_device() to
decrement reference count properly.
As comment of device_find_child() says, 'NOTE: you will need to drop
the reference with put_device() after use'.
Found by code review.
Cc: stable@vger.kernel.org
Fixes: 84cba72956 ("dpaa2-switch: integrate the MAC endpoint support")
Signed-off-by: Ma Ke <make24@iscas.ac.cn>
Tested-by: Ioana Ciornei <ioana.ciornei@nxp.com>
Reviewed-by: Ioana Ciornei <ioana.ciornei@nxp.com>
Reviewed-by: Simon Horman <horms@kernel.org>
Link: https://patch.msgid.link/20250717022309.3339976-3-make24@iscas.ac.cn
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
The fsl_mc_get_endpoint() function uses device_find_child() for
localization, which implicitly calls get_device() to increment the
device's reference count before returning the pointer. However, the
caller dpaa2_eth_connect_mac() fails to properly release this
reference in multiple scenarios. We should call put_device() to
decrement reference count properly.
As comment of device_find_child() says, 'NOTE: you will need to drop
the reference with put_device() after use'.
Found by code review.
Cc: stable@vger.kernel.org
Fixes: 7194792308 ("dpaa2-eth: add MAC/PHY support through phylink")
Signed-off-by: Ma Ke <make24@iscas.ac.cn>
Tested-by: Ioana Ciornei <ioana.ciornei@nxp.com>
Reviewed-by: Ioana Ciornei <ioana.ciornei@nxp.com>
Reviewed-by: Simon Horman <horms@kernel.org>
Link: https://patch.msgid.link/20250717022309.3339976-2-make24@iscas.ac.cn
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
The fsl_mc_get_endpoint() function may call fsl_mc_device_lookup()
twice, which would increment the device's reference count twice if
both lookups find a device. This could lead to a reference count leak.
Found by code review.
Cc: stable@vger.kernel.org
Fixes: 1ac210d128 ("bus: fsl-mc: add the fsl_mc_get_endpoint function")
Signed-off-by: Ma Ke <make24@iscas.ac.cn>
Tested-by: Ioana Ciornei <ioana.ciornei@nxp.com>
Reviewed-by: Simon Horman <horms@kernel.org>
Fixes: 8567494ceb ("bus: fsl-mc: rescan devices if endpoint not found")
Link: https://patch.msgid.link/20250717022309.3339976-1-make24@iscas.ac.cn
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Fuzzer reported a memory access error in bpf_program__record_reloc()
that happens when:
- ".addr_space.1" section exists
- there is a relocation referencing this section
- there are no arena maps defined in BTF.
Sanity checks for maps existence are already present in
bpf_program__record_reloc(), hence this commit adds another one.
[1] https://github.com/libbpf/libbpf/actions/runs/16375110681/job/46272998064
Signed-off-by: Eduard Zingerman <eddyz87@gmail.com>
Signed-off-by: Andrii Nakryiko <andrii@kernel.org>
Link: https://lore.kernel.org/bpf/20250718222059.281526-1-eddyz87@gmail.com
Add a new SKB drop reason (SKB_DROP_REASON_PFMEMALLOC) to track packets
dropped due to memory pressure. In production environments, we've observed
memory exhaustion reported by memory layer stack traces, but these drops
were not properly tracked in the SKB drop reason infrastructure.
While most network code paths now properly report pfmemalloc drops, some
protocol-specific socket implementations still use sk_filter() without
drop reason tracking:
- Bluetooth L2CAP sockets
- CAIF sockets
- IUCV sockets
- Netlink sockets
- SCTP sockets
- Unix domain sockets
These remaining cases represent less common paths and could be converted
in a follow-up patch if needed. The current implementation provides
significantly improved observability into memory pressure events in the
network stack, especially for key protocols like TCP and UDP, helping to
diagnose problems in production environments.
Reported-by: Matt Fleming <mfleming@cloudflare.com>
Signed-off-by: Jesper Dangaard Brouer <hawk@kernel.org>
Link: https://patch.msgid.link/175268316579.2407873.11634752355644843509.stgit@firesoul
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Add a proper description for the sk_stream_write_space() function as
previously marked by a FIXME comment.
No functional changes.
Signed-off-by: Suchit Karunakaran <suchitkarunakaran@gmail.com>
Link: https://patch.msgid.link/20250716153404.7385-1-suchitkarunakaran@gmail.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
* Three fixes for unnecessary spew: an ACPI CPPC boot-time debug
message, the link-time warnings for R_RISCV_NONE in binaries, and some
compile-time warnings in __put_user_nocheck.
* A fix for a race during text patching.
* Interrupts are no longer disabled during exception handling.
* A fix for a missing sign extension in the misaligned load handler.
* A fix to avoid static ftrace being selected in Kconfig, as we have
moved to dynamic ftrace.
-----BEGIN PGP SIGNATURE-----
iQJNBAABCAA3FiEEKzw3R0RoQ7JKlDp6LhMZ81+7GIkFAmh6wioZHHBhbG1lcmRh
YmJlbHRAZ29vZ2xlLmNvbQAKCRAuExnzX7sYiUhvD/4uTFU7CpUfbw0mlN4e2aJl
NdJPzfZn/Le+mI2L4iq9IW7qousBAM9bcjd4SHRTUPSRQpsF315n7hf+1dI5hLHk
vmbnzRuVS5FqL026t9tx61Kx5d8zPUzWoHbKHNsGyn4p6mnNyDpLrfecDR83VF27
ZzwXYVh2xHcqK5NSpKqNm35E7KNHYJtL07Hb5s2XnuW+ML/mfaDoNDKrLvwUSpEo
eS7kMyc6pKmia33b/Brb5WDUsArdYlfI6CHICjD7eDAYsj8KwjtKxRFGDavAIazw
6RTTWD414+XbHNWByQRvroVihK1Orr2MP5TtCXr3b/7ehnViIkipL9qZvrpLqTJO
Lq+lr7Uxw5sgMWvnwgf03OB6BbPEiAeDZ2xr4lgEnSBtJQ/fn4VAAHFJXgPwwrgL
bOF0+/DDpRGo+VJ1n5fbRF9zRczXD5UnakvDdB3k7XPMyf5Y9+dzAa6XdrgwW35U
tIPCP79l5lVa10Uzc77CA2+pDrSeJomnDrkfqdFXL6nf+8zddbuR2SDepkSDY6b1
XHEjnZJF9yoIuf2boE7/CEmVgyn/JRJ6cPu1yAd6R6O9jg+cFs9kXWepU5NdaCwo
Db/8EeXips/ktAbTgNHzLMWL956/afDS8Wl6PUiqTGrvbYywQsDtDgSOsYe0oubo
NepL3StcPKi1OIjrRUuslw==
=2jFG
-----END PGP SIGNATURE-----
Merge tag 'riscv-for-linus-6.16-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/riscv/linux
Pull RISC-V fixes from Palmer Dabbelt:
- Three fixes for unnecessary spew: an ACPI CPPC boot-time debug
message, the link-time warnings for R_RISCV_NONE in binaries, and
some compile-time warnings in __put_user_nocheck
- A fix for a race during text patching
- Interrupts are no longer disabled during exception handling
- A fix for a missing sign extension in the misaligned load handler
- A fix to avoid static ftrace being selected in Kconfig, as we have
moved to dynamic ftrace
* tag 'riscv-for-linus-6.16-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/riscv/linux:
riscv: uaccess: Fix -Wuninitialized and -Wshadow in __put_user_nocheck
riscv: Stop supporting static ftrace
riscv: traps_misaligned: properly sign extend value in misaligned load handler
riscv: Enable interrupt during exception handling
riscv: ftrace: Properly acquire text_mutex to fix a race condition
ACPI: RISC-V: Remove unnecessary CPPC debug message
riscv: Stop considering R_RISCV_NONE as bad relocations
The __cxl_decoder_detach() function is expected to return NULL on error
but this error path accidentally returns an error pointer. It could
potentially lead to an error pointer dereference in the caller. Change
it to return NULL.
Fixes: b3a8822551 ("cxl/region: Consolidate cxl_decoder_kill_region() and cxl_region_detach()")
Signed-off-by: Dan Carpenter <dan.carpenter@linaro.org>
Link: https://patch.msgid.link/7def7da0-326a-410d-8c92-718c8963c0a2@sabinyo.mountain
Signed-off-by: Dave Jiang <dave.jiang@intel.com>
Rename the shortterm-related identifiers to wait-related.
The usage of shortterm_users refcount is now beyond its name. It is
also used for references which live longer than an ioctl execution.
E.g. vdev holds idev's shortterm_users refcount on vdev allocation,
releases it during idev's pre_destroy(). Rename the refcount as
wait_cnt, since it is always used to sync the referencing & the
destruction of the object by waiting for it to go to zero.
List all changed identifiers:
iommufd_object::shortterm_users -> iommufd_object::wait_cnt
REMOVE_WAIT_SHORTTERM -> REMOVE_WAIT
iommufd_object_dec_wait_shortterm() -> iommufd_object_dec_wait()
zerod_shortterm -> zerod_wait_cnt
No functional change intended.
Link: https://patch.msgid.link/r/20250716070349.1807226-9-yilun.xu@linux.intel.com
Suggested-by: Kevin Tian <kevin.tian@intel.com>
Suggested-by: Jason Gunthorpe <jgg@nvidia.com>
Reviewed-by: Jason Gunthorpe <jgg@nvidia.com>
Reviewed-by: Nicolin Chen <nicolinc@nvidia.com>
Tested-by: Nicolin Chen <nicolinc@nvidia.com>
Signed-off-by: Xu Yilun <yilun.xu@linux.intel.com>
Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
This tests the flow to tombstone vdevice when idevice is to be unbound
before vdevice destruction. The expected results of the tombstone are:
- The vdevice ID can't be reused anymore (not tested in this patch).
- Even ioctl(IOMMU_DESTROY) can't free the vdevice ID.
- iommufd_fops_release() can still free everything.
Link: https://patch.msgid.link/r/20250716070349.1807226-8-yilun.xu@linux.intel.com
Reviewed-by: Nicolin Chen <nicolinc@nvidia.com>
Tested-by: Nicolin Chen <nicolinc@nvidia.com>
Signed-off-by: Xu Yilun <yilun.xu@linux.intel.com>
Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
no_viommu is not applicable for some viommu/vdevice tests. Explicitly
report the skipping, don't do it silently.
Opportunistically adjust the line wrappings after the indentation
changes using git clang-format.
Only add the prints. No functional change intended.
Link: https://patch.msgid.link/r/20250716070349.1807226-7-yilun.xu@linux.intel.com
Reviewed-by: Jason Gunthorpe <jgg@nvidia.com>
Reviewed-by: Kevin Tian <kevin.tian@intel.com>
Reviewed-by: Nicolin Chen <nicolinc@nvidia.com>
Tested-by: Nicolin Chen <nicolinc@nvidia.com>
Signed-off-by: Xu Yilun <yilun.xu@linux.intel.com>
Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
Remove struct device *dev from struct vdevice.
The dev pointer is the Plan B for vdevice to reference the physical
device. As now vdev->idev is added without refcounting concern, just
use vdev->idev->dev when needed. To avoid exposing
struct iommufd_device in the public header, export a
iommufd_vdevice_to_device() helper.
Link: https://patch.msgid.link/r/20250716070349.1807226-6-yilun.xu@linux.intel.com
Reviewed-by: Jason Gunthorpe <jgg@nvidia.com>
Reviewed-by: Kevin Tian <kevin.tian@intel.com>
Reviewed-by: Nicolin Chen <nicolinc@nvidia.com>
Co-developed-by: Nicolin Chen <nicolinc@nvidia.com>
Signed-off-by: Nicolin Chen <nicolinc@nvidia.com>
Tested-by: Nicolin Chen <nicolinc@nvidia.com>
Signed-off-by: Xu Yilun <yilun.xu@linux.intel.com>
Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
Destroy iommufd_vdevice (vdev) on iommufd_idevice (idev) destruction so
that vdev can't outlive idev.
idev represents the physical device bound to iommufd, while the vdev
represents the virtual instance of the physical device in the VM. The
lifecycle of the vdev should not be longer than idev. This doesn't
cause real problem on existing use cases cause vdev doesn't impact the
physical device, only provides virtualization information. But to
extend vdev for Confidential Computing (CC), there are needs to do
secure configuration for the vdev, e.g. TSM Bind/Unbind. These
configurations should be rolled back on idev destroy, or the external
driver (VFIO) functionality may be impact.
The idev is created by external driver so its destruction can't fail.
The idev implements pre_destroy() op to actively remove its associated
vdev before destroying itself. There are 3 cases on idev pre_destroy():
1. vdev is already destroyed by userspace. No extra handling needed.
2. vdev is still alive. Use iommufd_object_tombstone_user() to
destroy vdev and tombstone the vdev ID.
3. vdev is being destroyed by userspace. The vdev ID is already
freed, but vdev destroy handler is not completed. This requires
multi-threads syncing - vdev holds idev's short term users
reference until vdev destruction completes, idev leverages
existing wait_shortterm mechanism for syncing.
idev should also block any new reference to it after pre_destroy(),
or the following wait shortterm would timeout. Introduce a 'destroying'
flag, set it to true on idev pre_destroy(). Any attempt to reference
idev should honor this flag under the protection of
idev->igroup->lock.
Link: https://patch.msgid.link/r/20250716070349.1807226-5-yilun.xu@linux.intel.com
Originally-by: Nicolin Chen <nicolinc@nvidia.com>
Suggested-by: Jason Gunthorpe <jgg@nvidia.com>
Reviewed-by: Kevin Tian <kevin.tian@intel.com>
Reviewed-by: Nicolin Chen <nicolinc@nvidia.com>
Reviewed-by: Jason Gunthorpe <jgg@nvidia.com>
Co-developed-by: "Aneesh Kumar K.V (Arm)" <aneesh.kumar@kernel.org>
Signed-off-by: "Aneesh Kumar K.V (Arm)" <aneesh.kumar@kernel.org>
Tested-by: Nicolin Chen <nicolinc@nvidia.com>
Signed-off-by: Xu Yilun <yilun.xu@linux.intel.com>
Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
Add a pre_destroy() op which gives objects a chance to clear their
short term users references before destruction. This op is intended for
external driver created objects (e.g. idev) which does deterministic
destruction.
In order to manage the lifecycle of interrelated objects as well as the
deterministic destruction (e.g. vdev can't outlive idev, and idev
destruction can't fail), short term users references are allowed to
live out of an ioctl execution. An immediate use case is, vdev holds
idev's short term user reference until vdev destruction completes, idev
leverages existing wait_shortterm mechanism to ensure it is destroyed
after vdev.
This extended usage makes the referenced object unable to just wait for
its reference gone. It needs to actively trigger the reference removal,
as well as prevent new references before wait. Should implement these
work in pre_destroy().
Link: https://patch.msgid.link/r/20250716070349.1807226-4-yilun.xu@linux.intel.com
Suggested-by: Jason Gunthorpe <jgg@nvidia.com>
Reviewed-by: Kevin Tian <kevin.tian@intel.com>
Reviewed-by: Nicolin Chen <nicolinc@nvidia.com>
Reviewed-by: Jason Gunthorpe <jgg@nvidia.com>
Tested-by: Nicolin Chen <nicolinc@nvidia.com>
Signed-off-by: Xu Yilun <yilun.xu@linux.intel.com>
Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
Add the iommufd_object_tombstone_user() helper, which allows the caller
to destroy an iommufd object created by userspace.
This is useful on some destroy paths when the kernel caller finds the
object should have been removed by userspace but is still alive. With
this helper, the caller destroys the object but leave the object ID
reserved (so called tombstone). The tombstone prevents repurposing the
object ID without awareness of the original user.
Since this happens for abnormal userspace behavior, for simplicity, the
tombstoned object ID would be permanently leaked until
iommufd_fops_release(). I.e. the original user gets an error when
calling ioctl(IOMMU_DESTROY) on that ID.
The first use case would be to ensure the iommufd_vdevice can't outlive
the associated iommufd_device.
Link: https://patch.msgid.link/r/20250716070349.1807226-3-yilun.xu@linux.intel.com
Suggested-by: Jason Gunthorpe <jgg@nvidia.com>
Reviewed-by: Lu Baolu <baolu.lu@linux.intel.com>
Reviewed-by: Nicolin Chen <nicolinc@nvidia.com>
Reviewed-by: Kevin Tian <kevin.tian@intel.com>
Reviewed-by: Jason Gunthorpe <jgg@nvidia.com>
Co-developed-by: "Aneesh Kumar K.V (Arm)" <aneesh.kumar@kernel.org>
Signed-off-by: "Aneesh Kumar K.V (Arm)" <aneesh.kumar@kernel.org>
Tested-by: Nicolin Chen <nicolinc@nvidia.com>
Signed-off-by: Xu Yilun <yilun.xu@linux.intel.com>
Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
To solve the vdevice lifecycle issue, future patches make the vdevice
allocation protected by lock. That will make
_iommufd_object_alloc_ucmd() not applicable for vdevice. Roll back to
use _iommufd_object_alloc() for preparation.
Link: https://patch.msgid.link/r/20250716070349.1807226-2-yilun.xu@linux.intel.com
Reviewed-by: Nicolin Chen <nicolinc@nvidia.com>
Reviewed-by: Kevin Tian <kevin.tian@intel.com>
Reviewed-by: Jason Gunthorpe <jgg@nvidia.com>
Tested-by: Nicolin Chen <nicolinc@nvidia.com>
Signed-off-by: Xu Yilun <yilun.xu@linux.intel.com>
Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
This has triggered an overflow inside the ioas iova auto allocation logic,
test it directly. Use the same stimulus syzkaller found.
Link: https://patch.msgid.link/all/2-v1-7b4a16fc390b+10f4-iommufd_alloc_overflow_jgg@nvidia.com/
Tested-by: Yi Liu <yi.l.liu@intel.com>
Tested-by: Nicolin Chen <nicolinc@nvidia.com>
Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
