Commit graph

1,403,262 commits

Author SHA1 Message Date
Arkadiusz Kubalewski
c035e73603 dpll: add phase-offset-monitor feature to netlink spec
Add enum dpll_feature_state for control over features.

Add dpll device level attribute:
DPLL_A_PHASE_OFFSET_MONITOR - to allow control over a phase offset monitor
feature. Attribute is present and shall return current state of a feature
(enum dpll_feature_state), if the device driver provides such capability,
otherwie attribute shall not be present.

Reviewed-by: Aleksandr Loktionov <aleksandr.loktionov@intel.com>
Reviewed-by: Milena Olech <milena.olech@intel.com>
Reviewed-by: Jiri Pirko <jiri@nvidia.com>
Signed-off-by: Arkadiusz Kubalewski <arkadiusz.kubalewski@intel.com>
Acked-by: Vadim Fedorenko <vadim.fedorenko@linux.dev>
Link: https://patch.msgid.link/20250612152835.1703397-2-arkadiusz.kubalewski@intel.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2025-06-13 18:21:57 -07:00
Russell King (Oracle)
bd1d76a6f1 net: stmmac: improve .set_clk_tx_rate() method error message
Improve the .set_clk_tx_rate() method error message to include the
PHY interface mode along with the speed, which will be helpful to
the RK implementations.

Signed-off-by: Russell King (Oracle) <rmk+kernel@armlinux.org.uk>
Reviewed-by: Andrew Lunn <andrew@lunn.ch>
Reviewed-by: Jacob Keller <jacob.e.keller@intel.com>
Link: https://patch.msgid.link/E1uPjjx-0049r5-NN@rmk-PC.armlinux.org.uk
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2025-06-13 18:18:33 -07:00
Russell King (Oracle)
91695b8592 net: phy: improve rgmii_clock() documentation
Improve the rgmii_clock() documentation to indicate that it can also
be used for MII, GMII and RMII modes as well as RGMII as the required
clock rates are identical, but note that it won't error out for 1G
speeds for MII and RMII.

Signed-off-by: Russell King (Oracle) <rmk+kernel@armlinux.org.uk>
Reviewed-by: Andrew Lunn <andrew@lunn.ch>
Link: https://patch.msgid.link/E1uPjjk-0049pI-MD@rmk-PC.armlinux.org.uk
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2025-06-13 18:18:08 -07:00
RubenKelevra
b776999bf2 net: pfcp: fix typo in message_priority field name
The field is spelled "message_priprity" in the big-endian bit-field
definition.  Nothing in-tree currently references the member, so the
typo does not break kernel builds, but it is clearly incorrect.

Signed-off-by: RubenKelevra <rubenkelevra@gmail.com>
Link: https://patch.msgid.link/20250612145012.185321-1-rubenkelevra@gmail.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2025-06-13 18:17:08 -07:00
Jakub Kicinski
f5e72579fe Merge branch 'dp83tg720-reduce-link-recovery'
Oleksij Rempel says:

====================
dp83tg720: Reduce link recovery

This patch series improves the link recovery behavior of the TI
DP83TG720 PHY driver.

Previously, we introduced randomized reset delay logic to avoid reset
collisions in multi-PHY setups. While this approach was functional, it
had notable drawbacks: unpredictable behavior, longer and more variable
link recovery times, and overall higher complexity in link handling.

With this new approach, we replace the randomized delay with
deterministic, role-specific delays in the PHY reset logic. This enables
us to:
- Remove the redundant empirical 600 ms delay in read_status()
- Drop the random polling interval logic
- Introduce a clean, adaptive polling strategy with consistent
behavior and improved responsiveness

As a result, the PHY is now able to recover link reliably in under
1000_ms
====================

Link: https://patch.msgid.link/20250612104157.2262058-1-o.rempel@pengutronix.de
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2025-06-13 18:09:49 -07:00
David Jander
cc8aeb0f53 net: phy: dp83tg720: switch to adaptive polling and remove random delays
Now that the PHY reset logic includes a role-specific asymmetric delay
to avoid synchronized reset deadlocks, the previously used randomized
polling intervals are no longer necessary.

This patch removes the get_random_u32_below()-based logic and introduces
an adaptive polling strategy:
- Fast polling for a short time after link-down
- Slow polling if the link remains down
- Slower polling when the link is up

This balances CPU usage and responsiveness while avoiding reset
collisions. Additionally, the driver still relies on polling for
all link state changes, as interrupt support is not implemented,
and link-up events are not reliably signaled by the PHY.

The polling parameters are now documented in the updated top-of-file
comment.

Co-developed-by: Oleksij Rempel <o.rempel@pengutronix.de>
Signed-off-by: David Jander <david@protonic.nl>
Signed-off-by: Oleksij Rempel <o.rempel@pengutronix.de>
Reviewed-by: Andrew Lunn <andrew@lunn.ch>
Link: https://patch.msgid.link/20250612104157.2262058-4-o.rempel@pengutronix.de
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2025-06-13 18:09:47 -07:00
David Jander
491e991f78 net: phy: dp83tg720: remove redundant 600ms post-reset delay
Now that dp83tg720_soft_reset() introduces role-specific delays to avoid
reset synchronization deadlocks, the fixed 600ms post-reset delay in
dp83tg720_read_status() is no longer needed.

The new logic provides both the required MDC timing and link stabilization,
making the old empirical delay redundant and unnecessarily long.

Co-developed-by: Oleksij Rempel <o.rempel@pengutronix.de>
Signed-off-by: David Jander <david@protonic.nl>
Signed-off-by: Oleksij Rempel <o.rempel@pengutronix.de>
Reviewed-by: Andrew Lunn <andrew@lunn.ch>
Link: https://patch.msgid.link/20250612104157.2262058-3-o.rempel@pengutronix.de
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2025-06-13 18:09:47 -07:00
David Jander
5f6ec55777 net: phy: dp83tg720: implement soft reset with asymmetric delay
Add a .soft_reset callback for the DP83TG720 PHY that issues a hardware
reset followed by an asymmetric post-reset delay. The delay differs
based on the PHY's master/slave role to avoid synchronized reset
deadlocks, which are known to occur when both link partners use
identical reset intervals.

The delay includes:
- a fixed 1ms wait to satisfy MDC access timing per datasheet, and
- an empirically chosen extra delay (97ms for master, 149ms for slave).

Co-developed-by: Oleksij Rempel <o.rempel@pengutronix.de>
Signed-off-by: David Jander <david@protonic.nl>
Signed-off-by: Oleksij Rempel <o.rempel@pengutronix.de>
Reviewed-by: Andrew Lunn <andrew@lunn.ch>
Link: https://patch.msgid.link/20250612104157.2262058-2-o.rempel@pengutronix.de
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2025-06-13 18:09:47 -07:00
Cheng-Yang Chou
545b343015 sched_ext: Always use SMP versions in kernel/sched/ext_idle.h
Simplify the scheduler by making formerly SMP-only primitives and data
structures unconditional.

tj: Updated subject for clarity.

Signed-off-by: Cheng-Yang Chou <yphbchou0911@gmail.com>
Signed-off-by: Tejun Heo <tj@kernel.org>
2025-06-13 14:47:59 -10:00
Cheng-Yang Chou
8834ace4a8 sched_ext: Always use SMP versions in kernel/sched/ext_idle.c
Simplify the scheduler by making formerly SMP-only primitives and data
structures unconditional.

tj: Updated subject for clarity. Fixed stray #else block which wasn't
    removed causing build failure.

Signed-off-by: Cheng-Yang Chou <yphbchou0911@gmail.com>
Signed-off-by: Tejun Heo <tj@kernel.org>
2025-06-13 14:47:52 -10:00
Cheng-Yang Chou
6a1cda143c sched_ext: Always use SMP versions in kernel/sched/ext.h
Simplify the scheduler by making formerly SMP-only primitives and data
structures unconditional.

tj: Updated subject for clarity. Replace #if defined() with #ifdef.

Signed-off-by: Cheng-Yang Chou <yphbchou0911@gmail.com>
Signed-off-by: Tejun Heo <tj@kernel.org>
2025-06-13 14:30:58 -10:00
Qiu Yutan
0051ea4aca net: arp: use kfree_skb_reason() in arp_rcv()
Replace kfree_skb() with kfree_skb_reason() in arp_rcv().

Signed-off-by: Qiu Yutan <qiu.yutan@zte.com.cn>
Signed-off-by: Jiang Kun <jiang.kun2@zte.com.cn>
Link: https://patch.msgid.link/20250612110259698Q2KNNOPQhnIApRskKN3Hi@zte.com.cn
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2025-06-13 17:30:02 -07:00
Cheng-Yang Chou
165af41516 sched_ext: Always use SMP versions in kernel/sched/ext.c
Simplify the scheduler by making formerly SMP-only primitives and data
structures unconditional.

tj: Updated subject for clarity.

Signed-off-by: Cheng-Yang Chou <yphbchou0911@gmail.com>
Signed-off-by: Tejun Heo <tj@kernel.org>
2025-06-13 14:29:39 -10:00
Tejun Heo
9ec5e0be0e Merge branch 'sched/core' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip into for-6.17 2025-06-13 14:21:47 -10:00
Corey Minyard
8ffcb7560b ipmi: Fix strcpy source and destination the same
The source and destination of some strcpy operations was the same.
Split out the part of the operations that needed to be done for those
particular calls so the unnecessary copy wasn't done.

Reported-by: kernel test robot <lkp@intel.com>
Closes: https://lore.kernel.org/oe-kbuild-all/202506140756.EFXXvIP4-lkp@intel.com/
Signed-off-by: Corey Minyard <corey@minyard.net>
2025-06-13 19:06:26 -05:00
Linus Torvalds
4774cfe354 SCSI fixes on 20250613
All fixes for drivers.  The core change in the error handler is simply
 to translate an ALUA specific sense code into a retry the ALUA
 components can handle and won't impact any other devices.
 
 Signed-off-by: James E.J. Bottomley <James.Bottomley@HansenPartnership.com>
 -----BEGIN PGP SIGNATURE-----
 
 iJwEABMIAEQWIQTnYEDbdso9F2cI+arnQslM7pishQUCaEyPIiYcamFtZXMuYm90
 dG9tbGV5QGhhbnNlbnBhcnRuZXJzaGlwLmNvbQAKCRDnQslM7pishVXlAPoCGJTL
 EhMVta96mQGEBK2YfgBQGh87cMSNi7u3f04xawEA84UrOhakLtsVYp9Rua7k0VzL
 blmQtDCoujlsPAasaQg=
 =0N8r
 -----END PGP SIGNATURE-----

Merge tag 'scsi-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi

Pull SCSI fixes from James Bottomley:
 "All fixes for drivers.

  The core change in the error handler is simply to translate an ALUA
  specific sense code into a retry the ALUA components can handle and
  won't impact any other devices"

* tag 'scsi-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi:
  scsi: error: alua: I/O errors for ALUA state transitions
  scsi: storvsc: Increase the timeouts to storvsc_timeout
  scsi: s390: zfcp: Ensure synchronous unit_add
  scsi: iscsi: Fix incorrect error path labels for flashnode operations
  scsi: mvsas: Fix typos in per-phy comments and SAS cmd port registers
  scsi: core: ufs: Fix a hang in the error handler
2025-06-13 16:49:39 -07:00
Jakub Kicinski
a7075659f7 Merge branch 'net-phy-improve-mdio-boardinfo-handling'
Heiner Kallweit says:

====================
net: phy: improve mdio-boardinfo handling

This series includes smaller improvements to mdio-boardinfo handling.
====================

Link: https://patch.msgid.link/6ae7bda0-c093-468a-8ac0-50a2afa73c45@gmail.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2025-06-13 16:37:29 -07:00
Heiner Kallweit
f59fdcef3a net: phy: directly copy struct mdio_board_info in mdiobus_register_board_info
Using a direct assignment instead of memcpy reduces the text segment
size from 0x273 bytes to 0x19b bytes in my case.

Signed-off-by: Heiner Kallweit <hkallweit1@gmail.com>
Reviewed-by: Andrew Lunn <andrew@lunn.ch>
Link: https://patch.msgid.link/af371f2a-42f3-4d94-80b9-3420380a3f6f@gmail.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2025-06-13 16:37:23 -07:00
Heiner Kallweit
11d40db271 net: phy: improve mdio-boardinfo.h
There's no need to include phy.h and mutex.h in mdio-boardinfo.h.
However mdio-boardinfo.c included phy.h indirectly this way so far,
include it explicitly instead. Whilst at it, sort the included
headers properly.

Signed-off-by: Heiner Kallweit <hkallweit1@gmail.com>
Reviewed-by: Andrew Lunn <andrew@lunn.ch>
Link: https://patch.msgid.link/86b7a1d6-9f9c-4d22-b3d8-5abdef0bb39a@gmail.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2025-06-13 16:37:23 -07:00
Heiner Kallweit
db4920604a net: phy: move definition of struct mdio_board_entry to mdio-boardinfo.c
Struct mdio_board_entry isn't used outside mdio-boardinfo.c, so remove
the definition from the header file.

Signed-off-by: Heiner Kallweit <hkallweit1@gmail.com>
Reviewed-by: Andrew Lunn <andrew@lunn.ch>
Link: https://patch.msgid.link/0afe52d0-6fe6-434a-9881-3979661ff7b0@gmail.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2025-06-13 16:37:23 -07:00
Heiner Kallweit
0893bf6bb4 net: phy: simplify mdiobus_setup_mdiodev_from_board_info
- Move declaration of variable bi into list_for_each_entry_safe()
- The return value of cb() effectively isn't used, this allows to simplify
  the code.

Signed-off-by: Heiner Kallweit <hkallweit1@gmail.com>
Reviewed-by: Andrew Lunn <andrew@lunn.ch>
Link: https://patch.msgid.link/f6bbe242-b43d-4c2b-8c51-2cb2cefbaf59@gmail.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2025-06-13 16:37:23 -07:00
Linus Torvalds
25294cb8a4 drm fixes for 6.16-rc2
vc4:
 - Fix infinite EPROBE_DEFER loop in vc4 probing.
 
 amdxdna:
 - Fix amdxdna firmware size.
 
 meson:
 - modesetting fixes
 
 sitronix:
 - Kconfig fix for st7171-i2c.
 
 dma-buf:
 - Fix -EBUSY WARN_ON_ONCE in dma-buf
 
 udmabuf:
 - Use dma_sync_sgtable_for_cpu in udmabuf.
 
 xe:
 - Fix regression disallowing 64K SVM migration
 - Use a bounce buffer for WA BB
 -----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCgAdFiEEEKbZHaGwW9KfbeusDHTzWXnEhr4FAmhMjOkACgkQDHTzWXnE
 hr6N8A/8CJBntMZGliV9P9PSVCXY621Zg4OS0SUFzW+68Iru8qCYlZVqjpiglweW
 Rf9iwMEsRfgrXooJ9EkXS9+DCrRdtVVCdwsXXLK7C3+dPOCcjgJb/7vLizVM5nv0
 YHvrTsySqwIHviOyPiiOBvxCi27O04GpcA1uojZQ6Rqzi/5WVEgNqzOkuZcbcPvi
 OAajkcGHqPfWp3LaXgmaUB61gdaq89M2odbmbDQgIVr5jsGydnQ7QHJ8TXpNpjgj
 uN37IAFW7rTpfuzZ8wfR7FZ7V5EE9kvbcLO76blA9Aeoz35M+z+DpfSFgcyYnGg5
 nw2YrQw2tJesY323Ago7x//ta7Rmg6kz9zDG1aGe6Pe4NPw8nbjDZf6ZvpOSiZ09
 9H45t8Si97P+xoQkBY9GMn71B5/s1I1HlVzPYX8XBHJt8rD5ByR4EHuY81kbwRNK
 UZrqJw7/4qOgIXbaPNQvC3zrO4oG5vFjRxON56m1KJIYt12pLgbQXBVQh/wjjmi8
 9Ci0cfXjom5WV08av/A4NX21Vp7shbjuncA2vKpfkrRkr9B/Y9woFsMMmFGGAVHT
 jJGAqCyPZi1nnVYMbcwC3Ft6WlPFUoDj15+ZprMu0Oi84kgOhpgAiBhTaclwDKwu
 3dzpOn+IBXiZAkuZyHXDfavLck0iO/2qNW58Ocg1LHK3o7sPB2E=
 =VNUR
 -----END PGP SIGNATURE-----

Merge tag 'drm-fixes-2025-06-14' of https://gitlab.freedesktop.org/drm/kernel

Pull drm fixes from Dave Airlie:
 "Quiet week, only two pull requests came my way, xe has a couple of
  fixes and then a bunch of fixes across the board, vc4 probably fixes
  the biggest problem:

  vc4:
   - Fix infinite EPROBE_DEFER loop in vc4 probing

  amdxdna:
   - Fix amdxdna firmware size

  meson:
   - modesetting fixes

  sitronix:
   - Kconfig fix for st7171-i2c

  dma-buf:
   - Fix -EBUSY WARN_ON_ONCE in dma-buf

  udmabuf:
   - Use dma_sync_sgtable_for_cpu in udmabuf

  xe:
   - Fix regression disallowing 64K SVM migration
   - Use a bounce buffer for WA BB"

* tag 'drm-fixes-2025-06-14' of https://gitlab.freedesktop.org/drm/kernel:
  drm/xe/lrc: Use a temporary buffer for WA BB
  udmabuf: use sgtable-based scatterlist wrappers
  dma-buf: fix compare in WARN_ON_ONCE
  drm/sitronix: st7571-i2c: Select VIDEOMODE_HELPERS
  drm/meson: fix more rounding issues with 59.94Hz modes
  drm/meson: use vclk_freq instead of pixel_freq in debug print
  drm/meson: fix debug log statement when setting the HDMI clocks
  drm/vc4: fix infinite EPROBE_DEFER loop
  drm/xe/svm: Fix regression disallowing 64K SVM migration
  accel/amdxdna: Fix incorrect PSP firmware size
2025-06-13 16:27:27 -07:00
Marek Vasut
66db1d3cbd PCI/pwrctrl: Add optional slot clock for PCI slots
Add the ability to enable optional slot clock into the pwrctrl driver.
This is used to enable slot clock in split-clock topologies, where the PCIe
host/controller supply and PCIe slot supply are not provided by the same
clock. The PCIe host/controller clock should be described in the controller
node as the controller clock, while the slot clock should be described in
controller bridge/slot subnode.

Example DT snippet:

  &pcicontroller {
      clocks = <&clk_dif 0>;             /* PCIe controller clock */

      pci@0,0 {
          #address-cells = <3>;
          #size-cells = <2>;
          reg = <0x0 0x0 0x0 0x0 0x0>;
          compatible = "pciclass,0604";
          device_type = "pci";
          clocks = <&clk_dif 1>;         /* PCIe slot clock */
          vpcie3v3-supply = <&reg_3p3v>;
          ranges;
      };
  };

Example clock topology:
   ____________                    ____________
  |  PCIe host |                  | PCIe slot  |
  |            |                  |            |
  |    PCIe RX<|==================|>PCIe TX    |
  |    PCIe TX<|==================|>PCIe RX    |
  |            |                  |            |
  |   PCIe CLK<|======..  ..======|>PCIe CLK   |
  '------------'      ||  ||      '------------'
                      ||  ||
   ____________       ||  ||
  |  9FGV0441  |      ||  ||
  |            |      ||  ||
  |   CLK DIF0<|======''  ||
  |   CLK DIF1<|==========''
  |   CLK DIF2<|
  |   CLK DIF3<|
  '------------'

Immutable commit for Geert Uytterhoeven <geert+renesas@glider.be>

Signed-off-by: Marek Vasut <marek.vasut+renesas@mailbox.org>
Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
Reviewed-by: Anand Moon <linux.amoon@gmail.com>
Reviewed-by: Manivannan Sadhasivam <manivannan.sadhasivam@linaro.org>
Reviewed-by: Geert Uytterhoeven <geert+renesas@glider.be>
Acked-by: Bartosz Golaszewski <bartosz.golaszewski@linaro.org>
2025-06-13 16:59:52 -05:00
Luis Gerhorst
f66b4aaff2 bpf: Remove redundant free_verifier_state()/pop_stack()
This patch removes duplicated code.

Eduard points out [1]:

    Same cleanup cycles are done in push_stack() and push_async_cb(),
    both functions are only reachable from do_check_common() via
    do_check() -> do_check_insn().

    Hence, I think that cur state should not be freed in push_*()
    functions and pop_stack() loop there is not needed.

This would also fix the 'symptom' for [2], but the issue also has a
simpler fix which was sent separately. This fix also makes sure the
push_*() callers always return an error for which
error_recoverable_with_nospec(err) is false. This is required because
otherwise we try to recover and access the stale `state`.

Moving free_verifier_state() and pop_stack(..., pop_log=false) to happen
after the bpf_vlog_reset() call in do_check_common() is fine because the
pop_stack() call that is moved does not call bpf_vlog_reset() with the
pop_log=false parameter.

[1] https://lore.kernel.org/all/b6931bd0dd72327c55287862f821ca6c4c3eb69a.camel@gmail.com/
[2] https://lore.kernel.org/all/68497853.050a0220.33aa0e.036a.GAE@google.com/

Reported-by: Eduard Zingerman <eddyz87@gmail.com>
Link: https://lore.kernel.org/all/b6931bd0dd72327c55287862f821ca6c4c3eb69a.camel@gmail.com/
Acked-by: Eduard Zingerman <eddyz87@gmail.com>
Signed-off-by: Luis Gerhorst <luis.gerhorst@fau.de>
Link: https://lore.kernel.org/r/20250613090157.568349-2-luis.gerhorst@fau.de
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
2025-06-13 14:59:30 -07:00
Danilo Krummrich
20c96ed278 rust: devres: do not dereference to the internal Revocable
We can't expose direct access to the internal Revocable, since this
allows users to directly revoke the internal Revocable without Devres
having the chance to synchronize with the devres callback -- we have to
guarantee that the internal Revocable has been fully revoked before
the device is fully unbound.

Hence, remove the corresponding Deref implementation and, instead,
provide indirect accessors for the internal Revocable.

Note that we can still support Devres::revoke() by implementing the
required synchronization (which would be almost identical to the
synchronization in Devres::drop()).

Fixes: 76c01ded72 ("rust: add devres abstraction")
Reviewed-by: Benno Lossin <lossin@kernel.org>
Link: https://lore.kernel.org/r/20250611174827.380555-1-dakr@kernel.org
Signed-off-by: Danilo Krummrich <dakr@kernel.org>
2025-06-13 23:48:53 +02:00
Danilo Krummrich
f744201c61 rust: devres: fix race in Devres::drop()
In Devres::drop() we first remove the devres action and then drop the
wrapped device resource.

The design goal is to give the owner of a Devres object control over when
the device resource is dropped, but limit the overall scope to the
corresponding device being bound to a driver.

However, there's a race that was introduced with commit 8ff656643d
("rust: devres: remove action in `Devres::drop`"), but also has been
(partially) present from the initial version on.

In Devres::drop(), the devres action is removed successfully and
subsequently the destructor of the wrapped device resource runs.
However, there is no guarantee that the destructor of the wrapped device
resource completes before the driver core is done unbinding the
corresponding device.

If in Devres::drop(), the devres action can't be removed, it means that
the devres callback has been executed already, or is still running
concurrently. In case of the latter, either Devres::drop() wins revoking
the Revocable or the devres callback wins revoking the Revocable. If
Devres::drop() wins, we (again) have no guarantee that the destructor of
the wrapped device resource completes before the driver core is done
unbinding the corresponding device.

CPU0					CPU1
------------------------------------------------------------------------
Devres::drop() {			Devres::devres_callback() {
   self.data.revoke() {			   this.data.revoke() {
      is_available.swap() == true
					      is_available.swap == false
					   }
					}

					// [...]
					// device fully unbound
      drop_in_place() {
         // release device resource
      }
   }
}

Depending on the specific device resource, this can potentially lead to
user-after-free bugs.

In order to fix this, implement the following logic.

In the devres callback, we're always good when we get to revoke the
device resource ourselves, i.e. Revocable::revoke() returns true.

If Revocable::revoke() returns false, it means that Devres::drop(),
concurrently, already drops the device resource and we have to wait for
Devres::drop() to signal that it finished dropping the device resource.

Note that if we hit the case where we need to wait for the completion of
Devres::drop() in the devres callback, it means that we're actually
racing with a concurrent Devres::drop() call, which already started
revoking the device resource for us. This is rather unlikely and means
that the concurrent Devres::drop() already started doing our work and we
just need to wait for it to complete it for us. Hence, there should not
be any additional overhead from that.

(Actually, for now it's even better if Devres::drop() does the work for
us, since it can bypass the synchronize_rcu() call implied by
Revocable::revoke(), but this goes away anyways once I get to implement
the split devres callback approach, which allows us to first flip the
atomics of all registered Devres objects of a certain device, execute a
single synchronize_rcu() and then drop all revocable objects.)

In Devres::drop() we try to revoke the device resource. If that is *not*
successful, it means that the devres callback already did and we're good.

Otherwise, we try to remove the devres action, which, if successful,
means that we're good, since the device resource has just been revoked
by us *before* we removed the devres action successfully.

If the devres action could not be removed, it means that the devres
callback must be running concurrently, hence we signal that the device
resource has been revoked by us, using the completion.

This makes it safe to drop a Devres object from any task and at any point
of time, which is one of the design goals.

Fixes: 76c01ded72 ("rust: add devres abstraction")
Reported-by: Alice Ryhl <aliceryhl@google.com>
Closes: https://lore.kernel.org/lkml/aD64YNuqbPPZHAa5@google.com/
Reviewed-by: Benno Lossin <lossin@kernel.org>
Link: https://lore.kernel.org/r/20250612121817.1621-4-dakr@kernel.org
Signed-off-by: Danilo Krummrich <dakr@kernel.org>
2025-06-13 23:47:53 +02:00
Danilo Krummrich
4b76fafb20 rust: revocable: indicate whether data has been revoked already
Return a boolean from Revocable::revoke() and Revocable::revoke_nosync()
to indicate whether the data has been revoked already.

Return true if the data hasn't been revoked yet (i.e. this call revoked
the data), false otherwise.

This is required by Devres in order to synchronize the completion of the
revoke process.

Reviewed-by: Benno Lossin <lossin@kernel.org>
Acked-by: Miguel Ojeda <ojeda@kernel.org>
Link: https://lore.kernel.org/r/20250612121817.1621-3-dakr@kernel.org
Signed-off-by: Danilo Krummrich <dakr@kernel.org>
2025-06-13 23:46:59 +02:00
Danilo Krummrich
1b56e765bf rust: completion: implement initial abstraction
Implement a minimal abstraction for the completion synchronization
primitive.

This initial abstraction only adds complete_all() and
wait_for_completion(), since that is what is required for the subsequent
Devres patch.

Cc: Ingo Molnar <mingo@redhat.com>
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: Juri Lelli <juri.lelli@redhat.com>
Cc: Vincent Guittot <vincent.guittot@linaro.org>
Cc: Dietmar Eggemann <dietmar.eggemann@arm.com>
Cc: Steven Rostedt <rostedt@goodmis.org>
Cc: Ben Segall <bsegall@google.com>
Cc: Mel Gorman <mgorman@suse.de>
Cc: Valentin Schneider <vschneid@redhat.com>
Reviewed-by: Alice Ryhl <aliceryhl@google.com>
Reviewed-by: Boqun Feng <boqun.feng@gmail.com>
Reviewed-by: Benno Lossin <lossin@kernel.org>
Acked-by: Miguel Ojeda <ojeda@kernel.org>
Link: https://lore.kernel.org/r/20250612121817.1621-2-dakr@kernel.org
Signed-off-by: Danilo Krummrich <dakr@kernel.org>
2025-06-13 23:46:56 +02:00
Jens Axboe
b62e0efd8a io_uring: run local task_work from ring exit IOPOLL reaping
In preparation for needing to shift NVMe passthrough to always use
task_work for polled IO completions, ensure that those are suitably
run at exit time. See commit:

9ce6c9875f ("nvme: always punt polled uring_cmd end_io work to task_work")

for details on why that is necessary.

Signed-off-by: Jens Axboe <axboe@kernel.dk>
2025-06-13 15:26:17 -06:00
Jens Axboe
9ce6c9875f nvme: always punt polled uring_cmd end_io work to task_work
Currently NVMe uring_cmd completions will complete locally, if they are
polled. This is done because those completions are always invoked from
task context. And while that is true, there's no guarantee that it's
invoked under the right ring context, or even task. If someone does
NVMe passthrough via multiple threads and with a limited number of
poll queues, then ringA may find completions from ringB. For that case,
completing the request may not be sound.

Always just punt the passthrough completions via task_work, which will
redirect the completion, if needed.

Cc: stable@vger.kernel.org
Fixes: 585079b6e4 ("nvme: wire up async polling for io passthrough commands")
Signed-off-by: Jens Axboe <axboe@kernel.dk>
2025-06-13 15:18:34 -06:00
Linus Torvalds
18531f4d1c ACPI updates for 6.16-rc2
- Update the faux device handling code in the driver core and address
    an ACPI APEI error injection driver failure that started to occur
    after switching it over to using a faux device on top of that (Dan
    Williams).
 
  - Update data types of variables passed as arguments to
    mwait_idle_with_hints() in the ACPI PAD (processor aggregator device)
    driver to match the function definition after recent changes (Uros
    Bizjak).
 
  - Fix a NULL pointer dereference in the ACPI CPPC library that occurs
    when nosmp is passed to the kernel in the command line (Yunhui Cui).
 
  - Ignore ECDT tables with an invalid ID string to prevent using an
    incorrect GPE for signaling events on some systems (Armin Wolf).
 
  - Add a new IRQ override quirk for MACHENIKE 16P (Wentao Guan).
 -----BEGIN PGP SIGNATURE-----
 
 iQFGBAABCAAwFiEEcM8Aw/RY0dgsiRUR7l+9nS/U47UFAmhMhWMSHHJqd0Byand5
 c29ja2kubmV0AAoJEO5fvZ0v1OO11QwIAJauSuEZ6CMSB+ntXZ0WO+Sx62EKn1/w
 sC8auAtfmp7H31m1YjqJllt/n2tadJO2ZMAzMuHeVp+1LIxHnNPR6e97+8z+Xj3m
 224NUki1kG7EyEYEwtZnHVOQBue1nKxNZqQ4NHuuwIXIj2dE4GgsCEqT+vrZVmI+
 JLZWo8pMH2puAakdBkPtsdqWzTNq7lOAsigkoDvbO4Azz2GCPilgrgzOeqdOlFw8
 URwM7qhk6Wd77Zr9kyzQIRBt8LVwKIF6i13eR4CXCNzp+5O0qYlci1dBYErL/oWU
 u2D5ebQMCCKqBnNHowBr9ChM4QwmHB9YdTnx574z7kUKCjrgQOrC7hQ=
 =Jx0s
 -----END PGP SIGNATURE-----

Merge tag 'acpi-6.16-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm

Pull ACPI fixes from Rafael Wysocki:
 "These fix an ACPI APEI error injection driver failure that started to
  occur after switching it over to using a faux device, address an EC
  driver issue related to invalid ECDT tables, clean up the usage of
  mwait_idle_with_hints() in the ACPI PAD driver, add a new IRQ override
  quirk, and fix a NULL pointer dereference related to nosmp:

   - Update the faux device handling code in the driver core and address
     an ACPI APEI error injection driver failure that started to occur
     after switching it over to using a faux device on top of that (Dan
     Williams)

   - Update data types of variables passed as arguments to
     mwait_idle_with_hints() in the ACPI PAD (processor aggregator
     device) driver to match the function definition after recent
     changes (Uros Bizjak)

   - Fix a NULL pointer dereference in the ACPI CPPC library that occurs
     when nosmp is passed to the kernel in the command line (Yunhui Cui)

   - Ignore ECDT tables with an invalid ID string to prevent using an
     incorrect GPE for signaling events on some systems (Armin Wolf)

   - Add a new IRQ override quirk for MACHENIKE 16P (Wentao Guan)"

* tag 'acpi-6.16-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm:
  ACPI: resource: Use IRQ override on MACHENIKE 16P
  ACPI: EC: Ignore ECDT tables with an invalid ID string
  ACPI: CPPC: Fix NULL pointer dereference when nosmp is used
  ACPI: PAD: Update arguments of mwait_idle_with_hints()
  ACPI: APEI: EINJ: Do not fail einj_init() on faux_device_create() failure
  driver core: faux: Quiet probe failures
  driver core: faux: Suppress bind attributes
2025-06-13 13:39:15 -07:00
Linus Torvalds
f688b599d7 Power management updates for 6.16-rc2
- Implement CpuId Rust abstraction and use it to fix doctest failure
    related to the recently introduced cpumask abstraction (Viresh Kumar).
 
  - Do minor cleanups in the `# Safety` sections for cpufreq abstractions
    added recently (Viresh Kumar).
 
  - Unbreak cpupower systemd service units installation on some systems
    by adding a unitdir variable for specifying the location to install
    them (Francesco Poli).
 
  - Eliminate mwait_play_dead_cpuid_hint() again after reverting its
    elimination during the 6.16 merge window due to a problem with
    handling "dead" SMT siblings, but this time prevent leaving them in
    C1 after initialization by taking them online and back offline when
    a proper cpuidle driver for the platform has been registered (Rafael
    Wysocki).
 
  - Update data types of variables passed as arguments to
    mwait_idle_with_hints() to match the function definition
    after recent changes (Uros Bizjak).
 -----BEGIN PGP SIGNATURE-----
 
 iQFGBAABCAAwFiEEcM8Aw/RY0dgsiRUR7l+9nS/U47UFAmhMgawSHHJqd0Byand5
 c29ja2kubmV0AAoJEO5fvZ0v1OO1dA0H/j7V4sfA383pZfWwegRC4MQeiW4EVdIx
 2G6d33Gsfv+zEzTSsPvtKghR4eUIldTdco04bqusMcI+qIfgdWIEBpi2tQhJU2Tt
 Bgc24Kya0n85KKNLHs60xm0WXhkAyu3TFad+4yTGXRZEmAD+O6lyUPjum+mn+gbx
 HuLE6KE9D/qzzYOU03kjCsJExBf7vv0bBNIqGqNyuFLYOaoqZd5rLhNhhxm2AkYi
 hZ5wmYBY+2SJRzwryNNHQKKmZ1jk9HGapnIVrxQ2Pjc0AhX+tRW7FI5lDDvUWtW+
 RN/226Y3OQ3JHXAj4S0K64t0ZEpiEKS2oPatjGzosNmdyI0f+CRACQs=
 =OcND
 -----END PGP SIGNATURE-----

Merge tag 'pm-6.16-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm

Pull power management fixes from Rafael Wysocki:
 "These fix the cpupower utility installation, fix up the recently added
  Rust abstractions for cpufreq and OPP, restore the x86 update
  eliminating mwait_play_dead_cpuid_hint() that has been reverted during
  the 6.16 merge window along with preventing the failure caused by it
  from happening, and clean up mwait_idle_with_hints() usage in
  intel_idle:

   - Implement CpuId Rust abstraction and use it to fix doctest failure
     related to the recently introduced cpumask abstraction (Viresh
     Kumar)

   - Do minor cleanups in the `# Safety` sections for cpufreq
     abstractions added recently (Viresh Kumar)

   - Unbreak cpupower systemd service units installation on some systems
     by adding a unitdir variable for specifying the location to install
     them (Francesco Poli)

   - Eliminate mwait_play_dead_cpuid_hint() again after reverting its
     elimination during the 6.16 merge window due to a problem with
     handling "dead" SMT siblings, but this time prevent leaving them in
     C1 after initialization by taking them online and back offline when
     a proper cpuidle driver for the platform has been registered
     (Rafael Wysocki)

   - Update data types of variables passed as arguments to
     mwait_idle_with_hints() to match the function definition after
     recent changes (Uros Bizjak)"

* tag 'pm-6.16-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm:
  rust: cpu: Add CpuId::current() to retrieve current CPU ID
  rust: Use CpuId in place of raw CPU numbers
  rust: cpu: Introduce CpuId abstraction
  intel_idle: Update arguments of mwait_idle_with_hints()
  cpufreq: Convert `/// SAFETY` lines to `# Safety` sections
  cpupower: split unitdir from libdir in Makefile
  Reapply "x86/smp: Eliminate mwait_play_dead_cpuid_hint()"
  ACPI: processor: Rescan "dead" SMT siblings during initialization
  intel_idle: Rescan "dead" SMT siblings during initialization
  x86/smp: PM/hibernate: Split arch_resume_nosmt()
  intel_idle: Use subsys_initcall_sync() for initialization
2025-06-13 13:27:41 -07:00
Rafael J. Wysocki
28b069933d Merge branches 'acpi-pad', 'acpi-cppc', 'acpi-ec' and 'acpi-resource'
Merge assorted ACPI updates for 6.16-rc2:

 - Update data types of variables passed as arguments to
   mwait_idle_with_hints() in the ACPI PAD (processor aggregator device)
   driver to match the function definition after recent changes (Uros
   Bizjak).

 - Fix a NULL pointer dereference in the ACPI CPPC library that occurs
   when nosmp is passed to the kernel in the command line (Yunhui Cui).

 - Ignore ECDT tables with an invalid ID string to prevent using an
   incorrect GPE for signaling events on some systems (Armin Wolf).

 - Add a new IRQ override quirk for MACHENIKE 16P (Wentao Guan).

* acpi-pad:
  ACPI: PAD: Update arguments of mwait_idle_with_hints()

* acpi-cppc:
  ACPI: CPPC: Fix NULL pointer dereference when nosmp is used

* acpi-ec:
  ACPI: EC: Ignore ECDT tables with an invalid ID string

* acpi-resource:
  ACPI: resource: Use IRQ override on MACHENIKE 16P
2025-06-13 21:55:30 +02:00
Mario Limonciello
907a7a2e5b PCI/PM: Set up runtime PM even for devices without PCI PM
4d4c10f763 ("PCI: Explicitly put devices into D0 when initializing")
intended to put PCI devices into D0, but in doing so unintentionally
changed runtime PM initialization not to occur on devices that don't
support PCI PM.  This caused a regression in vfio-pci due to an imbalance
with its use.

Adjust the logic in pci_pm_init() so that even if PCI PM isn't supported
runtime PM is still initialized.

Fixes: 4d4c10f763 ("PCI: Explicitly put devices into D0 when initializing")
Reported-by: Giovanni Cabiddu <giovanni.cabiddu@intel.com>
Closes: https://lore.kernel.org/linux-pci/20250424043232.1848107-1-superm1@kernel.org/T/#m7e8929d6421690dc8bd6dc639d86c2b4db27cbc4
Reported-by: Nicolas Dichtel <nicolas.dichtel@6wind.com>
Closes: https://lore.kernel.org/linux-pci/20250424043232.1848107-1-superm1@kernel.org/T/#m40d277dcdb9be64a1609a82412d1aa906263e201
Signed-off-by: Mario Limonciello <mario.limonciello@amd.com>
Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
Tested-by: Giovanni Cabiddu <giovanni.cabiddu@intel.com>
Tested-by: Nicolas Dichtel <nicolas.dichtel@6wind.com>
Reviewed-by: Kuppuswamy Sathyanarayanan <sathyanarayanan.kuppuswamy@linux.intel.com>
Acked-by: Rafael J. Wysocki <rafael@kernel.org>
Cc: Alex Williamson <alex.williamson@redhat.com>
Link: https://patch.msgid.link/20250611233117.61810-1-superm1@kernel.org
2025-06-13 14:38:45 -05:00
Rafael J. Wysocki
dd3581853c Merge branch 'pm-cpuidle'
Merge cpuidle updates for 6.16-rc2:

 - Update data types of variables passed as arguments to
   mwait_idle_with_hints() to match the function definition
   after recent changes (Uros Bizjak).

 - Eliminate mwait_play_dead_cpuid_hint() again after reverting its
   elimination during the merge window due to a problem with handling
   "dead" SMT siblings, but this time prevent leaving them in C1 after
   initialization by taking them online and back offline when a proper
   cpuidle driver for the platform has been registered (Rafael Wysocki).

* pm-cpuidle:
  intel_idle: Update arguments of mwait_idle_with_hints()
  Reapply "x86/smp: Eliminate mwait_play_dead_cpuid_hint()"
  ACPI: processor: Rescan "dead" SMT siblings during initialization
  intel_idle: Rescan "dead" SMT siblings during initialization
  x86/smp: PM/hibernate: Split arch_resume_nosmt()
  intel_idle: Use subsys_initcall_sync() for initialization
2025-06-13 21:28:07 +02:00
Rafael J. Wysocki
ea2867608b Merge branch 'pm-tools'
Merge a cpupower utility fix for 6.16-rc2 that unbreaks systemd service
units installation on some sysems (Francesco Poli).

* pm-tools:
  cpupower: split unitdir from libdir in Makefile
2025-06-13 21:25:38 +02:00
Eduard Zingerman
4a4b84ba9e selftests/bpf: verify jset handling in CFG computation
A test case to check if both branches of jset are explored when
computing program CFG.

At 'if r1 & 0x7 ...':
- register 'r2' is computed alive only if jump branch of jset
  instruction is followed;
- register 'r0' is computed alive only if fallthrough branch of jset
  instruction is followed.

Signed-off-by: Eduard Zingerman <eddyz87@gmail.com>
Link: https://lore.kernel.org/r/20250613175331.3238739-2-eddyz87@gmail.com
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
2025-06-13 11:51:19 -07:00
Eduard Zingerman
3157f7e299 bpf: handle jset (if a & b ...) as a jump in CFG computation
BPF_JSET is a conditional jump and currently verifier.c:can_jump()
does not know about that. This can lead to incorrect live registers
and SCC computation.

E.g. in the following example:

   1: r0 = 1;
   2: r2 = 2;
   3: if r1 & 0x7 goto +1;
   4: exit;
   5: r0 = r2;
   6: exit;

W/o this fix insn_successors(3) will return only (4), a jump to (5)
would be missed and r2 won't be marked as alive at (3).

Fixes: 14c8552db6 ("bpf: simple DFA-based live registers analysis")
Reported-by: syzbot+a36aac327960ff474804@syzkaller.appspotmail.com
Suggested-by: Alexei Starovoitov <alexei.starovoitov@gmail.com>
Signed-off-by: Eduard Zingerman <eddyz87@gmail.com>
Link: https://lore.kernel.org/r/20250613175331.3238739-1-eddyz87@gmail.com
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
2025-06-13 11:51:19 -07:00
Linus Torvalds
02adc1490e spi: Fies for v6.16
A collection of driver specific fixes, most minor apart from the OMAP
 ones which disable some recent performance optimisations in some
 non-standard cases where we could start driving the bus incorrectly.
 
 The change to the stm32-ospi driver to use the newer reset APIs is a fix
 for interactions with other IP sharing the same reset line in some SoCs.
 -----BEGIN PGP SIGNATURE-----
 
 iQEzBAABCgAdFiEEreZoqmdXGLWf4p/qJNaLcl1Uh9AFAmhMXiEACgkQJNaLcl1U
 h9DfLwf9F7yAsLh7eGYPCqjDB365LaAuroOWuM5hB74cTFis9WJpcEI1pk9GdaD0
 m7TAkc+cxo0KBvpe0/t0+oqSBkUdcZ4ASXZp4zYnsj9dGhBcmlS0szHIOZWknMxZ
 E2pzHWj6p4/+zntWa+CCiiVGHz0PV3I9Oq3V1kI1EqyAZXc9uf5hj0hITVulJ4ih
 8+Y+927MpJ2dis8CaHeubDfNxnwJlCLS5GFwZaEhTXWp6IttxjH5KmeZu2Wtahdw
 ZcqUDLPYxdzoirDoGvdGBTHc0NMF843WD9wFWb29BzuyPLZYGAwGXDhGtHqSaGAo
 6HB5529nuKDAC1XNyRN6NA4bQosMaw==
 =ShaP
 -----END PGP SIGNATURE-----

Merge tag 'spi-fix-v6.16-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/spi

Pull spi fixes from Mark Brown:
 "A collection of driver specific fixes, most minor apart from the OMAP
  ones which disable some recent performance optimisations in some
  non-standard cases where we could start driving the bus incorrectly.

  The change to the stm32-ospi driver to use the newer reset APIs is a
  fix for interactions with other IP sharing the same reset line in some
  SoCs"

* tag 'spi-fix-v6.16-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/spi:
  spi: spi-pci1xxxx: Drop MSI-X usage as unsupported by DMA engine
  spi: stm32-ospi: clean up on error in probe()
  spi: stm32-ospi: Make usage of reset_control_acquire/release() API
  spi: offload: check offload ops existence before disabling the trigger
  spi: spi-pci1xxxx: Fix error code in probe
  spi: loongson: Fix build warnings about export.h
  spi: omap2-mcspi: Disable multi-mode when the previous message kept CS asserted
  spi: omap2-mcspi: Disable multi mode when CS should be kept asserted after message
2025-06-13 11:01:44 -07:00
Linus Torvalds
601dddb6c5 regulator: Fix for v6.16
One minor fix for a leak in the DT parsing code in the max20086 driver.
 -----BEGIN PGP SIGNATURE-----
 
 iQEzBAABCgAdFiEEreZoqmdXGLWf4p/qJNaLcl1Uh9AFAmhMXpMACgkQJNaLcl1U
 h9DxfAf/Sk4lxMl2JHbjk+TYXz5Q+Y04fpGYMCnV1u64kq9yxB2NKBjMomS6YysY
 qsueW1caCJM/D/8MUqkU6mbQxGCt6V8eKWjVxcjfPOEM/lWCP+FfsMOdu9rXij1s
 bhR4fI7jmaDYNjwaDCnyK7F0/TxUj5GiOPV3d+5C3gQ6VXFB+wTs1jzalvszP7WP
 3doM/U8NZH7gg7zztvKW8l89d8OWCc7L83dW/ecrAAMX+jbi6JC8qT5VTbKkdSfs
 Y1dPrTloRIj+z1n72YY6RLsqD8qO5P5KW2wy1qbnqFEZx82s0xFcAgcCkkeK3lnG
 He8R+qqfZvjL1o+shdlCHthr+R82Bw==
 =bJgB
 -----END PGP SIGNATURE-----

Merge tag 'regulator-fix-v6.16-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/regulator

Pull regulator fix from Mark Brown:
 "One minor fix for a leak in the DT parsing code in the max20086 driver"

* tag 'regulator-fix-v6.16-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/regulator:
  regulator: max20086: Fix refcount leak in max20086_parse_regulators_dt()
2025-06-13 11:00:19 -07:00
Oleg Nesterov
f90fff1e15 posix-cpu-timers: fix race between handle_posix_cpu_timers() and posix_cpu_timer_del()
If an exiting non-autoreaping task has already passed exit_notify() and
calls handle_posix_cpu_timers() from IRQ, it can be reaped by its parent
or debugger right after unlock_task_sighand().

If a concurrent posix_cpu_timer_del() runs at that moment, it won't be
able to detect timer->it.cpu.firing != 0: cpu_timer_task_rcu() and/or
lock_task_sighand() will fail.

Add the tsk->exit_state check into run_posix_cpu_timers() to fix this.

This fix is not needed if CONFIG_POSIX_CPU_TIMERS_TASK_WORK=y, because
exit_task_work() is called before exit_notify(). But the check still
makes sense, task_work_add(&tsk->posix_cputimers_work.work) will fail
anyway in this case.

Cc: stable@vger.kernel.org
Reported-by: Benoît Sevens <bsevens@google.com>
Fixes: 0bdd2ed413 ("sched: run_posix_cpu_timers: Don't check ->exit_state, use lock_task_sighand()")
Signed-off-by: Oleg Nesterov <oleg@redhat.com>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
2025-06-13 10:55:49 -07:00
Linus Torvalds
3ca933aad0 tracing fix for 6.16:
- Do not free "head" variable in filter_free_subsystem_filters()
 
   The first error path jumps to "free_now" label but first frees the newly
   allocated "head" variable. But the "free_now" code checks this variable,
   and if it is not NULL, it will iterate the list. As this list variable
   was already initialized, the "free_now" code will not do anything as it
   is empty. But freeing it will cause a UAF bug. The error path should
   simply jump to the "free_now" label and leave the "head" variable alone.
 -----BEGIN PGP SIGNATURE-----
 
 iIoEABYKADIWIQRRSw7ePDh/lE+zeZMp5XQQmuv6qgUCaExH8RQccm9zdGVkdEBn
 b29kbWlzLm9yZwAKCRAp5XQQmuv6qs+DAQDWBAAmviDcMb+e+9uZi8rR8+Aj+j5S
 efPe/g4D2otl5QD/T7u5TZFrSOZfl4Gv9Z1ZWhKj+xfw3FiphODrzHdcsgo=
 =eP9r
 -----END PGP SIGNATURE-----

Merge tag 'trace-v6.16-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace

Pull tracing fix from Steven Rostedt:

 - Do not free "head" variable in filter_free_subsystem_filters()

   The first error path jumps to "free_now" label but first frees the
   newly allocated "head" variable. But the "free_now" code checks this
   variable, and if it is not NULL, it will iterate the list. As this
   list variable was already initialized, the "free_now" code will not
   do anything as it is empty. But freeing it will cause a UAF bug.

   The error path should simply jump to the "free_now" label and leave
   the "head" variable alone.

* tag 'trace-v6.16-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace:
  tracing: Do not free "head" on error path of filter_free_subsystem_filters()
2025-06-13 10:51:11 -07:00
Andrii Nakryiko
e4c8f96ade Merge branch 'veristat-memory-accounting-for-bpf-programs'
Eduard Zingerman says:

====================
veristat: memory accounting for bpf programs

When working on the verifier, it is sometimes interesting to know how a
particular change affects memory consumption. This patch-set modifies
veristat to provide such information. As a collateral, kernel needs an
update to make allocations reachable from BPF program load accountable
in memcg statistics.

Here is a sample output:

  Program          Peak states  Peak memory (MiB)
  ---------------  -----------  -----------------
  lavd_select_cpu         2153                 43
  lavd_enqueue            1982                 41
  lavd_dispatch           3480                 28

Technically, this is implemented by creating and entering a new cgroup
at the start of veristat execution. The difference between values from
cgroup "memory.peak" file before and after bpf_object__load() is used
as a metric.

To minimize measurements jitter data is collected in megabytes.

Changelog:
v2: https://lore.kernel.org/bpf/20250612130835.2478649-1-eddyz87@gmail.com/
v2 -> v3:
- bpf_verifier_state->jmp_history and
  bpf_verifier_env->explored_states allocations are switched from
  GFP_USER to GFP_KERNEL_ACCOUNT (Andrii, Alexei);
- veristat.c:STR macro removed, PATH_MAX-1 == 4095 is hard-coded in
  scanf format strings (Andrii);
- env->{orig,stat}_cgroup size changed to PATH_MAX (Andrii);
- snprintf_trunc() is removed, flag -Wno-format-truncation
  is added to CFLAGS for veristat.o when compiled with gcc;

v1: https://lore.kernel.org/bpf/20250605230609.1444980-1-eddyz87@gmail.com/
v1 -> v2:
- a single cgroup, created at the beginning of execution, is now used
  for measurements (Andrii, Mykyta);
- cgroup namespace is not created, as it turned out to be useless
  (Andrii);
- veristat no longer mounts cgroup fs or changes subtree_control,
  instead it looks for an existing mount point and reports an error if
  memory.peak file can't be opened (Andrii, Alexei);
- if 'mem_peak' statistics is not enabled, veristat skips cgroup
  setup;
- code sharing with cgroup_helpers.c was considered but was decided
  against to simplify veristat github sync.
====================

Link: https://patch.msgid.link/20250613072147.3938139-1-eddyz87@gmail.com
Signed-off-by: Andrii Nakryiko <andrii@kernel.org>
2025-06-13 10:44:17 -07:00
Eduard Zingerman
67cdcc405b veristat: Memory accounting for bpf programs
This commit adds a new field mem_peak / "Peak memory (MiB)" field to a
set of gathered statistics. The field is intended as an estimate for
peak verifier memory consumption for processing of a given program.

Mechanically stat is collected as follows:
- At the beginning of handle_verif_mode() a new cgroup is created
  and veristat process is moved into this cgroup.
- At each program load:
  - bpf_object__load() is split into bpf_object__prepare() and
    bpf_object__load() to avoid accounting for memory allocated for
    maps;
  - before bpf_object__load():
    - a write to "memory.peak" file of the new cgroup is used to reset
      cgroup statistics;
    - updated value is read from "memory.peak" file and stashed;
  - after bpf_object__load() "memory.peak" is read again and
    difference between new and stashed values is used as a metric.

If any of the above steps fails veristat proceeds w/o collecting
mem_peak information for a program, reporting mem_peak as -1.

While memcg provides data in bytes (converted from pages), veristat
converts it to megabytes to avoid jitter when comparing results of
different executions.

The change has no measurable impact on veristat running time.

A correlation between "Peak states" and "Peak memory" fields provides
a sanity check for gathered statistics, e.g. a sample of data for
sched_ext programs:

Program                   Peak states  Peak memory (MiB)
------------------------  -----------  -----------------
lavd_select_cpu                  2153                 44
lavd_enqueue                     1982                 41
lavd_dispatch                    3480                 28
layered_dispatch                 1417                 17
layered_enqueue                   760                 11
lavd_cpu_offline                  349                  6
lavd_cpu_online                   349                  6
lavd_init                         394                  6
rusty_init                        350                  5
layered_select_cpu                391                  4
...
rusty_stopping                    134                  1
arena_topology_node_init          170                  0

Signed-off-by: Eduard Zingerman <eddyz87@gmail.com>
Signed-off-by: Andrii Nakryiko <andrii@kernel.org>
Link: https://lore.kernel.org/bpf/20250613072147.3938139-3-eddyz87@gmail.com
2025-06-13 10:44:12 -07:00
Eduard Zingerman
43736ec3e0 bpf: Include verifier memory allocations in memcg statistics
This commit adds __GFP_ACCOUNT flag to verifier induced memory
allocations. The intent is to account for all allocations reachable
from BPF_PROG_LOAD command, which is needed to track verifier memory
consumption in veristat. This includes allocations done in verifier.c,
and some allocations in btf.c, functions in log.c do not allocate.

There is also a utility function bpf_memcg_flags() which selectively
adds GFP_ACCOUNT flag depending on the `cgroup.memory=nobpf` option.
As far as I understand [1], the idea is to remove bpf_prog instances
and maps from memcg accounting as these objects do not strictly belong
to cgroup, hence it should not apply here.

(btf_parse_fields() is reachable from both program load and map
 creation, but allocated record is not persistent as is freed as soon
 as map_check_btf() exits).

[1] https://lore.kernel.org/all/20230210154734.4416-1-laoar.shao@gmail.com/

Signed-off-by: Eduard Zingerman <eddyz87@gmail.com>
Signed-off-by: Andrii Nakryiko <andrii@kernel.org>
Link: https://lore.kernel.org/bpf/20250613072147.3938139-2-eddyz87@gmail.com
2025-06-13 10:29:45 -07:00
Raven Black
13b86ea92e
ASoC: amd: yc: update quirk data for HP Victus
Make the internal microphone work on HP Victus laptops.

Signed-off-by: Raven Black <ravenblack@gmail.com>
Link: https://patch.msgid.link/20250613-support-hp-victus-microphone-v1-1-bebc4c3a2041@gmail.com
Signed-off-by: Mark Brown <broonie@kernel.org>
2025-06-13 18:14:19 +01:00
Mark Brown
dc8b60918f
ASoC: cs35l56: Change firmware filenames for SoundWire
Merge series from Richard Fitzgerald <rf@opensource.cirrus.com>:

Change the firmware filename format on SoundWire systems to
directly tie it to the physical amp it applies to. This is mainly
to decouple it from the ALSA prefix strings to avoid complications
when the SoundWire machine driver starts creating dailinks based on
SDCA Disco info instead of hardcoded match tables. It also avoids
errors from having to rename firmware files from a hardware-address
to a ALSA-prefix naming for Linux publication. There are already
published firmware files for the L56 B0 silicon so that has a fallback
scheme for backward compatibility which has been separated into its
own patch on top of the main change.

We'd like to get this into 6.16 so that the L63 support starts "clean"
with this new naming and we don't have to support one kernel version
with L63 using the old naming. Unfortunately we didn't manage to get
these patches through internal review and testing before the merge
window opened.
2025-06-13 18:12:49 +01:00
Maíra Canal
60ba943380
drm/vkms: Compile all tests with CONFIG_DRM_VKMS_KUNIT_TEST
The Kconfig option `CONFIG_DRM_VKMS_KUNIT_TESTS` does not exist. However,
the VKMS format tests use such an option for compilation, meaning that
they are not compiled at all.

Use the Kconfig option `CONFIG_DRM_VKMS_KUNIT_TEST` to compile all VKMS
KUnit tests.

Fixes: 3e897853de ("drm/vkms: Create KUnit tests for YUV conversions")
Signed-off-by: Maíra Canal <mcanal@igalia.com>
Reviewed-by: José Expósito <jose.exposito89@gmail.com>
Link: https://lore.kernel.org/r/20250611205704.334527-1-mcanal@igalia.com
Signed-off-by: Louis Chauvet <louis.chauvet@bootlin.com>
2025-06-13 19:11:39 +02:00
Song Liu
ccefa19335 bpf/veristat: Fix veristat for map type BPF_MAP_TYPE_CGRP_STORAGE
BPF_MAP_TYPE_CGRP_STORAGE doesn't allow non-zero max_entries. So veristat
should not set it to 1.

Signed-off-by: Song Liu <song@kernel.org>
Signed-off-by: Andrii Nakryiko <andrii@kernel.org>
Link: https://lore.kernel.org/bpf/20250613050001.1058733-1-song@kernel.org
2025-06-13 10:08:22 -07:00
Linus Torvalds
dde6379705 ARM:
- Rework of system register accessors for system registers that are
   directly writen to memory, so that sanitisation of the in-memory
   value happens at the correct time (after the read, or before the
   write). For convenience, RMW-style accessors are also provided.
 
 - Multiple fixes for the so-called "arch-timer-edge-cases' selftest,
   which was always broken.
 
 x86:
 
 - Make KVM_PRE_FAULT_MEMORY stricter for TDX, allowing userspace to pass
   only the "untouched" addresses and flipping the shared/private bit
   in the implementation.
 
 - Disable SEV-SNP support on initialization failure
 -----BEGIN PGP SIGNATURE-----
 
 iQFIBAABCAAyFiEE8TM4V0tmI4mGbHaCv/vSX3jHroMFAmhMVEQUHHBib256aW5p
 QHJlZGhhdC5jb20ACgkQv/vSX3jHroNCYwgAoqYz+RTcIx6EwHD/kN/9maUcQVl1
 MMmXqfF2jQYmTvk7ocEW1qwx/SV0kB+H9LOThV8SWTvVxDbNqAaUWRDz+wcz3zaO
 6/sUwz4dtU4XaTgxYhhB82lsPtJHyM+FM+bNL4rFFnrA1tZ93wRsMEeryZ5h960V
 C1Bc+PLBdpj+S3gQGvxeMxnG/n0oOAcecUqQa3ViIOKSfZEc/11+BjjvfvkYqExq
 s206faKSqor8xVXUbgtOk3LZreIExj/mD+pwMiUBvG0H0g4wnaG7Arc41QCFMowF
 4l4sQVMWFZiKQvQZSfdQOeNsXcepWw0qISK7UeoWpLnpM78uUfCS6iG1rA==
 =Hc3G
 -----END PGP SIGNATURE-----

Merge tag 'for-linus' of git://git.kernel.org/pub/scm/virt/kvm/kvm

Pull kvm fixes from Paolo Bonzini:
 "ARM:

   - Rework of system register accessors for system registers that are
     directly writen to memory, so that sanitisation of the in-memory
     value happens at the correct time (after the read, or before the
     write). For convenience, RMW-style accessors are also provided.

   - Multiple fixes for the so-called "arch-timer-edge-cases' selftest,
     which was always broken.

  x86:

   - Make KVM_PRE_FAULT_MEMORY stricter for TDX, allowing userspace to
     pass only the "untouched" addresses and flipping the shared/private
     bit in the implementation.

   - Disable SEV-SNP support on initialization failure

* tag 'for-linus' of git://git.kernel.org/pub/scm/virt/kvm/kvm:
  KVM: x86/mmu: Reject direct bits in gpa passed to KVM_PRE_FAULT_MEMORY
  KVM: x86/mmu: Embed direct bits into gpa for KVM_PRE_FAULT_MEMORY
  KVM: SEV: Disable SEV-SNP support on initialization failure
  KVM: arm64: selftests: Determine effective counter width in arch_timer_edge_cases
  KVM: arm64: selftests: Fix xVAL init in arch_timer_edge_cases
  KVM: arm64: selftests: Fix thread migration in arch_timer_edge_cases
  KVM: arm64: selftests: Fix help text for arch_timer_edge_cases
  KVM: arm64: Make __vcpu_sys_reg() a pure rvalue operand
  KVM: arm64: Don't use __vcpu_sys_reg() to get the address of a sysreg
  KVM: arm64: Add RMW specific sysreg accessor
  KVM: arm64: Add assignment-specific sysreg accessor
2025-06-13 10:05:31 -07:00