Commit graph

1,399,042 commits

Author SHA1 Message Date
Wolfram Sang
ea59ad0ca9 rtc: sh: use local variables in probe() for mapping IO
No need to store the resource for the registers in the per-device struct
because we only need it during probe. Remove some unneeded unlikely()
while here and correct the type of 'regsize'.

Signed-off-by: Wolfram Sang <wsa+renesas@sang-engineering.com>
Link: https://lore.kernel.org/r/20250227134256.9167-17-wsa+renesas@sang-engineering.com
Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
2025-04-08 15:56:19 +02:00
Wolfram Sang
33df0a509d rtc: sh: remove useless wrapper function
The wrapper to enable interrupts is so thin that we can use it directly.
Also gets rid of an 'inline' which doesn't make sense here.

Signed-off-by: Wolfram Sang <wsa+renesas@sang-engineering.com>
Link: https://lore.kernel.org/r/20250227134256.9167-16-wsa+renesas@sang-engineering.com
Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
2025-04-08 15:56:19 +02:00
Wolfram Sang
689602e060 rtc: sh: simplify irq setup after refactoring
We only need the alarm_irq handler. That means we can remove everything
related to periodic_irq and carry_irq. Also, the shared handler can go
since we only we need the alarm interrupt in any case.

Signed-off-by: Wolfram Sang <wsa+renesas@sang-engineering.com>
Link: https://lore.kernel.org/r/20250227134256.9167-15-wsa+renesas@sang-engineering.com
Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
2025-04-08 15:56:19 +02:00
Wolfram Sang
a7e7d966cc rtc: sh: remove periodic interrupt handling
Because periodic interrupts are emulated by the RTC core, the PIE
handling code can simply go away now. And with it the custom proc-file.

Signed-off-by: Wolfram Sang <wsa+renesas@sang-engineering.com>
Link: https://lore.kernel.org/r/20250227134256.9167-14-wsa+renesas@sang-engineering.com
Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
2025-04-08 15:56:19 +02:00
Wolfram Sang
fb06b6b54b rtc: sh: only disable carry interrupts in probe()
With old, custom UIE handling removed, we can now disable the carry
interrupt in probe() and leave it like this. No further handling is
required.

Signed-off-by: Wolfram Sang <wsa+renesas@sang-engineering.com>
Link: https://lore.kernel.org/r/20250227134256.9167-13-wsa+renesas@sang-engineering.com
Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
2025-04-08 15:56:19 +02:00
Wolfram Sang
c090d390e5 rtc: sh: remove update interrupt handling
Since commit e428c6a277 ("RTC: Clean out UIE icotl implementations"),
the flag for UIE cannot be set anymore. Because UIE is now handled via
regular alarms and a timerqueue by the RTC core, the UIE handling code
can simply go away now.

Signed-off-by: Wolfram Sang <wsa+renesas@sang-engineering.com>
Link: https://lore.kernel.org/r/20250227134256.9167-12-wsa+renesas@sang-engineering.com
Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
2025-04-08 15:56:19 +02:00
Wolfram Sang
8f2efdbc30 rtc: sh: assign correct interrupts with DT
The DT bindings for this driver define the interrupts in the order as
they are numbered in the interrupt controller. The old platform_data,
however, listed them in a different order. So, for DT based platforms,
they are mixed up. Assign them specifically for DT, so we can keep the
bindings stable. After the fix, 'rtctest' passes again on the Renesas
Genmai board (RZ-A1 / R7S72100).

Fixes: dab5aec64b ("rtc: sh: add support for rza series")
Signed-off-by: Wolfram Sang <wsa+renesas@sang-engineering.com>
Link: https://lore.kernel.org/r/20250227134256.9167-11-wsa+renesas@sang-engineering.com
Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
2025-04-08 15:56:18 +02:00
Maxime Chevallier
4f038a6a02 net: ethtool: Don't call .cleanup_data when prepare_data fails
There's a consistent pattern where the .cleanup_data() callback is
called when .prepare_data() fails, when it should really be called to
clean after a successful .prepare_data() as per the documentation.

Rewrite the error-handling paths to make sure we don't cleanup
un-prepared data.

Fixes: c781ff12a2 ("ethtool: Allow network drivers to dump arbitrary EEPROM data")
Reviewed-by: Kory Maincent <kory.maincent@bootlin.com>
Reviewed-by: Simon Horman <horms@kernel.org>
Reviewed-by: Michal Kubecek <mkubecek@suse.cz>
Signed-off-by: Maxime Chevallier <maxime.chevallier@bootlin.com>
Link: https://patch.msgid.link/20250407130511.75621-1-maxime.chevallier@bootlin.com
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
2025-04-08 15:34:15 +02:00
Toke Høiland-Jørgensen
369609fc62 tc: Ensure we have enough buffer space when sending filter netlink notifications
The tfilter_notify() and tfilter_del_notify() functions assume that
NLMSG_GOODSIZE is always enough to dump the filter chain. This is not
always the case, which can lead to silent notify failures (because the
return code of tfilter_notify() is not always checked). In particular,
this can lead to NLM_F_ECHO not being honoured even though an action
succeeds, which forces userspace to create workarounds[0].

Fix this by increasing the message size if dumping the filter chain into
the allocated skb fails. Use the size of the incoming skb as a size hint
if set, so we can start at a larger value when appropriate.

To trigger this, run the following commands:

 # ip link add type veth
 # tc qdisc replace dev veth0 root handle 1: fq_codel
 # tc -echo filter add dev veth0 parent 1: u32 match u32 0 0 $(for i in $(seq 32); do echo action pedit munge ip dport set 22; done)

Before this fix, tc just returns:

Not a filter(cmd 2)

After the fix, we get the correct echo:

added filter dev veth0 parent 1: protocol all pref 49152 u32 chain 0 fh 800::800 order 2048 key ht 800 bkt 0 terminal flowid not_in_hw
  match 00000000/00000000 at 0
	action order 1:  pedit action pass keys 1
 	index 1 ref 1 bind 1
	key #0  at 20: val 00000016 mask ffff0000
[repeated 32 times]

[0] 106ef21860

Fixes: 1da177e4c3 ("Linux-2.6.12-rc2")
Reported-by: Frode Nordahl <frode.nordahl@canonical.com>
Closes: https://bugs.launchpad.net/ubuntu/+source/openvswitch/+bug/2018500
Signed-off-by: Toke Høiland-Jørgensen <toke@redhat.com>
Reviewed-by: Jiri Pirko <jiri@nvidia.com>
Link: https://patch.msgid.link/20250407105542.16601-1-toke@redhat.com
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
2025-04-08 13:57:49 +02:00
Jiawen Wu
13e7d7240a net: libwx: Fix the wrong Rx descriptor field
WX_RXD_IPV6EX was incorrectly defined in Rx ring descriptor. In fact, this
field stores the 802.1ad ID from which the packet was received. The wrong
definition caused the statistics rx_csum_offload_errors to fail to grow
when receiving the 802.1ad packet with incorrect checksum.

Fixes: ef4f3c19f9 ("net: wangxun: libwx add rx offload functions")
Signed-off-by: Jiawen Wu <jiawenwu@trustnetic.com>
Reviewed-by: Michal Kubiak <michal.kubiak@intel.com>
Link: https://patch.msgid.link/20250407103322.273241-1-jiawenwu@trustnetic.com
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
2025-04-08 13:47:47 +02:00
Raju Rangoju
34a07c5b25 amd-xgbe: Convert to SPDX identifier
Use SPDX-License-Identifier accross all the files of the xgbe driver to
ensure compliance with Linux kernel standards, thus removing the
boiler-plate template license text.

Signed-off-by: Raju Rangoju <Raju.Rangoju@amd.com>
Acked-by: Shyam Sundar S K <Shyam-sundar.S-k@amd.com>
Reviewed-by: Simon Horman <horms@kernel.org>
Link: https://patch.msgid.link/20250407102913.3063691-1-Raju.Rangoju@amd.com
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
2025-04-08 13:26:33 +02:00
Bartosz Golaszewski
5e21900ef6
spi: xcomm: use new GPIO line value setter callbacks
struct gpio_chip now has callbacks for setting line values that return
an integer, allowing to indicate failures. Convert the driver to using
them.

Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski@linaro.org>
Link: https://patch.msgid.link/20250408-gpiochip-set-rv-spi-v1-1-597660766654@linaro.org
Signed-off-by: Mark Brown <broonie@kernel.org>
2025-04-08 12:16:10 +01:00
Roger Pau Monne
64a66e2c3b x86/xen: disable CPU idle and frequency drivers for PVH dom0
When running as a PVH dom0 the ACPI tables exposed to Linux are (mostly)
the native ones, thus exposing the C and P states, that can lead to
attachment of CPU idle and frequency drivers.  However the entity in
control of the CPU C and P states is Xen, as dom0 doesn't have a full view
of the system load, neither has all CPUs assigned and identity pinned.

Like it's done for classic PV guests, prevent Linux from using idle or
frequency state drivers when running as a PVH dom0.

On an AMD EPYC 7543P system without this fix a Linux PVH dom0 will keep the
host CPUs spinning at 100% even when dom0 is completely idle, as it's
attempting to use the acpi_idle driver.

Signed-off-by: Roger Pau Monné <roger.pau@citrix.com>
Reviewed-by: Jason Andryuk <jason.andryuk@amd.com>
Signed-off-by: Juergen Gross <jgross@suse.com>
Message-ID: <20250407101842.67228-1-roger.pau@citrix.com>
2025-04-08 13:15:56 +02:00
Daisuke Matsuda
6703cb3dce RDMA/rxe: Enable ODP in RDMA FLUSH operation
For persistent memories, add rxe_odp_flush_pmem_iova() so that ODP specific
steps are executed. Otherwise, no additional consideration is required.

Signed-off-by: Daisuke Matsuda <matsuda-daisuke@fujitsu.com>
Link: https://patch.msgid.link/20250324075649.3313968-2-matsuda-daisuke@fujitsu.com
Reviewed-by: Li Zhijian <lizhijian@fujitsu.com>
Signed-off-by: Leon Romanovsky <leon@kernel.org>
2025-04-08 07:13:56 -04:00
Thorsten Blum
4acdd3de31 rocker: Simplify if condition in ofdpa_port_fdb()
Remove the double negation and simplify the if condition.

No functional changes intended.

Signed-off-by: Thorsten Blum <thorsten.blum@linux.dev>
Reviewed-by: Jiri Pirko <jiri@nvidia.com>
Link: https://patch.msgid.link/20250407091442.743478-1-thorsten.blum@linux.dev
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
2025-04-08 13:11:29 +02:00
Bartosz Golaszewski
936df52c29
regulator: rpi-panel-attiny: use new GPIO line value setter callbacks
struct gpio_chip now has callbacks for setting line values that return
an integer, allowing to indicate failures. Convert the driver to using
them.

Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski@linaro.org>
Link: https://patch.msgid.link/20250408-gpiochip-set-rv-regulator-v1-4-a18b6154b31a@linaro.org
Signed-off-by: Mark Brown <broonie@kernel.org>
2025-04-08 12:05:42 +01:00
Bartosz Golaszewski
50faedda12
regulator: rpi-panel-attiny: use lock guards for the state mutex
Use mutex lock guards from linux/cleanup.h to simplify the driver code.

Note that ret must be initialized in order to avoid a build warning as
scoped_guard() is implemented as a for loop.

Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski@linaro.org>
Link: https://patch.msgid.link/20250408-gpiochip-set-rv-regulator-v1-3-a18b6154b31a@linaro.org
Signed-off-by: Mark Brown <broonie@kernel.org>
2025-04-08 12:05:42 +01:00
Bartosz Golaszewski
1326e295d6
regulator: rpi-panel-attiny: use devres for mutex management
Simplify the probe() code and remove the remove() callback by using
devres to manage the mutex resources.

Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski@linaro.org>
Link: https://patch.msgid.link/20250408-gpiochip-set-rv-regulator-v1-2-a18b6154b31a@linaro.org
Signed-off-by: Mark Brown <broonie@kernel.org>
2025-04-08 12:05:41 +01:00
Bartosz Golaszewski
06bab1f101
regulator: rpi-panel-attiny: don't double-check GPIO range
GPIO core already checks GPIO ranges, there's no need to check it again
in the set() callback.

Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski@linaro.org>
Link: https://patch.msgid.link/20250408-gpiochip-set-rv-regulator-v1-1-a18b6154b31a@linaro.org
Signed-off-by: Mark Brown <broonie@kernel.org>
2025-04-08 12:05:40 +01:00
Julian Vetter
fc2e4f4f7b eth: nfp: remove __get_unaligned_cpu32 from netronome drivers
The __get_unaligned_cpu32 function is deprecated. So, replace it with
the more generic get_unaligned and just cast the input parameter.

Signed-off-by: Julian Vetter <julian@outer-limits.org>
Reviewed-by: Simon Horman <horms@kernel.org>
Link: https://patch.msgid.link/20250407083306.1553921-1-julian@outer-limits.org
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
2025-04-08 12:51:18 +02:00
Thorsten Blum
48afd55505 hamradio: Remove unnecessary strscpy_pad() size arguments
If the destination buffer has a fixed length, strscpy_pad()
automatically determines its size using sizeof() when the argument is
omitted. This makes the explicit sizeof() calls unnecessary - remove
them.

No functional changes intended.

Signed-off-by: Thorsten Blum <thorsten.blum@linux.dev>
Link: https://patch.msgid.link/20250407082607.741919-2-thorsten.blum@linux.dev
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
2025-04-08 12:38:47 +02:00
Hariprasad Kelam
b7db94734e octeontx2-pf: qos: fix VF root node parent queue index
The current code configures the Physical Function (PF) root node at TL1
and the Virtual Function (VF) root node at TL2.

This ensure at any given point of time PF traffic gets more priority.

                    PF root node
                      TL1
                     /  \
                    TL2  TL2 VF root node
                    /     \
                   TL3    TL3
                   /       \
                  TL4      TL4
                  /         \
                 SMQ        SMQ

Due to a bug in the current code, the TL2 parent queue index on the
VF interface is not being configured, leading to 'SMQ Flush' errors

Fixes: 5e6808b4c6 ("octeontx2-pf: Add support for HTB offload")
Signed-off-by: Hariprasad Kelam <hkelam@marvell.com>
Reviewed-by: Simon Horman <horms@kernel.org>
Link: https://patch.msgid.link/20250407070341.2765426-1-hkelam@marvell.com
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
2025-04-08 12:32:55 +02:00
Thorsten Blum
ee9c3082f1 ALSA: cs46xx: Remove commented out code
The code has been commented out ever since commit 1da177e4c3
("Linux-2.6.12-rc2"), remove it.

Signed-off-by: Thorsten Blum <thorsten.blum@linux.dev>
Link: https://patch.msgid.link/20250408083015.796638-2-thorsten.blum@linux.dev
Signed-off-by: Takashi Iwai <tiwai@suse.de>
2025-04-08 11:53:45 +02:00
Paolo Bonzini
c478032df0 KVM/arm64: First batch of fixes for 6.15
- Rework heuristics for resolving the fault IPA (HPFAR_EL2 v. re-walk
    stage-1 page tables) to align with the architecture. This avoids
    possibly taking an SEA at EL2 on the page table walk or using an
    architecturally UNKNOWN fault IPA.
 
  - Use acquire/release semantics in the KVM FF-A proxy to avoid reading
    a stale value for the FF-A version.
 
  - Fix KVM guest driver to match PV CPUID hypercall ABI.
 
  - Use Inner Shareable Normal Write-Back mappings at stage-1 in KVM
    selftests, which is the only memory type for which atomic
    instructions are architecturally guaranteed to work.
 -----BEGIN PGP SIGNATURE-----
 
 iI0EABYIADUWIQSNXHjWXuzMZutrKNKivnWIJHzdFgUCZ/RO9hccb2xpdmVyLnVw
 dG9uQGxpbnV4LmRldgAKCRCivnWIJHzdFmRuAP0YajO4qHJe1vHtCkamuPnEY0Kp
 E+t2TwPafPbrPdQ1PgEAq6lHuSdUnid1r/uhRKIT+ywW8tE97eNwQAa1LFma0Ac=
 =d4G5
 -----END PGP SIGNATURE-----

Merge tag 'kvmarm-fixes-6.15-1' of https://git.kernel.org/pub/scm/linux/kernel/git/kvmarm/kvmarm into HEAD

KVM/arm64: First batch of fixes for 6.15

 - Rework heuristics for resolving the fault IPA (HPFAR_EL2 v. re-walk
   stage-1 page tables) to align with the architecture. This avoids
   possibly taking an SEA at EL2 on the page table walk or using an
   architecturally UNKNOWN fault IPA.

 - Use acquire/release semantics in the KVM FF-A proxy to avoid reading
   a stale value for the FF-A version.

 - Fix KVM guest driver to match PV CPUID hypercall ABI.

 - Use Inner Shareable Normal Write-Back mappings at stage-1 in KVM
   selftests, which is the only memory type for which atomic
   instructions are architecturally guaranteed to work.
2025-04-08 05:49:31 -04:00
Maxime Ripard
92a2bf257e dma-buf: heaps: system: Remove global variable
The system heap is storing its struct dma_heap pointer in a global
variable but isn't using it anywhere.

Let's move the global variable into system_heap_create() to make it
local.

Signed-off-by: Maxime Ripard <mripard@kernel.org>
Reviewed-by: Christian König <christian.koenig@amd.com>
Reviewed-by: Mattijs Korpershoek <mkorpershoek@kernel.org>
Link: https://patchwork.freedesktop.org/patch/msgid/20250407-dma-buf-ecc-heap-v3-1-97cdd36a5f29@kernel.org
Signed-off-by: Christian König <christian.koenig@amd.com>
2025-04-08 11:48:39 +02:00
Thorsten Blum
080410fe61 ALSA: azt2320: Replace deprecated strcpy() with strscpy()
strcpy() is deprecated, use strscpy() instead.

Link: https://github.com/KSPP/linux/issues/88
Cc: linux-hardening@vger.kernel.org
Signed-off-by: Thorsten Blum <thorsten.blum@linux.dev>
Link: https://patch.msgid.link/20250407090832.743255-1-thorsten.blum@linux.dev
Signed-off-by: Takashi Iwai <tiwai@suse.de>
2025-04-08 11:48:37 +02:00
Jakub Kicinski
a1328a671e selftests: tls: check that disconnect does nothing
"Inspired" by syzbot test, pre-queue some data, disconnect()
and try to receive(). This used to trigger a warning in TLS's strp.
Now we expect the disconnect() to have almost no effect.

Link: https://lore.kernel.org/67e6be74.050a0220.2f068f.007e.GAE@google.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Reviewed-by: Sabrina Dubroca <sd@queasysnail.net>
Link: https://patch.msgid.link/20250404180334.3224206-2-kuba@kernel.org
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
2025-04-08 11:38:49 +02:00
Jakub Kicinski
5071a1e606 net: tls: explicitly disallow disconnect
syzbot discovered that it can disconnect a TLS socket and then
run into all sort of unexpected corner cases. I have a vague
recollection of Eric pointing this out to us a long time ago.
Supporting disconnect is really hard, for one thing if offload
is enabled we'd need to wait for all packets to be _acked_.
Disconnect is not commonly used, disallow it.

The immediate problem syzbot run into is the warning in the strp,
but that's just the easiest bug to trigger:

  WARNING: CPU: 0 PID: 5834 at net/tls/tls_strp.c:486 tls_strp_msg_load+0x72e/0xa80 net/tls/tls_strp.c:486
  RIP: 0010:tls_strp_msg_load+0x72e/0xa80 net/tls/tls_strp.c:486
  Call Trace:
   <TASK>
   tls_rx_rec_wait+0x280/0xa60 net/tls/tls_sw.c:1363
   tls_sw_recvmsg+0x85c/0x1c30 net/tls/tls_sw.c:2043
   inet6_recvmsg+0x2c9/0x730 net/ipv6/af_inet6.c:678
   sock_recvmsg_nosec net/socket.c:1023 [inline]
   sock_recvmsg+0x109/0x280 net/socket.c:1045
   __sys_recvfrom+0x202/0x380 net/socket.c:2237

Fixes: 3c4d755915 ("tls: kernel TLS support")
Reported-by: syzbot+b4cd76826045a1eb93c1@syzkaller.appspotmail.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Reviewed-by: Eric Dumazet <edumazet@google.com>
Reviewed-by: Sabrina Dubroca <sd@queasysnail.net>
Link: https://patch.msgid.link/20250404180334.3224206-1-kuba@kernel.org
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
2025-04-08 11:38:49 +02:00
Ricardo Cañuelo Navarro
f1a69a940d sctp: detect and prevent references to a freed transport in sendmsg
sctp_sendmsg() re-uses associations and transports when possible by
doing a lookup based on the socket endpoint and the message destination
address, and then sctp_sendmsg_to_asoc() sets the selected transport in
all the message chunks to be sent.

There's a possible race condition if another thread triggers the removal
of that selected transport, for instance, by explicitly unbinding an
address with setsockopt(SCTP_SOCKOPT_BINDX_REM), after the chunks have
been set up and before the message is sent. This can happen if the send
buffer is full, during the period when the sender thread temporarily
releases the socket lock in sctp_wait_for_sndbuf().

This causes the access to the transport data in
sctp_outq_select_transport(), when the association outqueue is flushed,
to result in a use-after-free read.

This change avoids this scenario by having sctp_transport_free() signal
the freeing of the transport, tagging it as "dead". In order to do this,
the patch restores the "dead" bit in struct sctp_transport, which was
removed in
commit 47faa1e4c5 ("sctp: remove the dead field of sctp_transport").

Then, in the scenario where the sender thread has released the socket
lock in sctp_wait_for_sndbuf(), the bit is checked again after
re-acquiring the socket lock to detect the deletion. This is done while
holding a reference to the transport to prevent it from being freed in
the process.

If the transport was deleted while the socket lock was relinquished,
sctp_sendmsg_to_asoc() will return -EAGAIN to let userspace retry the
send.

The bug was found by a private syzbot instance (see the error report [1]
and the C reproducer that triggers it [2]).

Link: https://people.igalia.com/rcn/kernel_logs/20250402__KASAN_slab-use-after-free_Read_in_sctp_outq_select_transport.txt [1]
Link: https://people.igalia.com/rcn/kernel_logs/20250402__KASAN_slab-use-after-free_Read_in_sctp_outq_select_transport__repro.c [2]
Cc: stable@vger.kernel.org
Fixes: df132eff46 ("sctp: clear the transport of some out_chunk_list chunks in sctp_assoc_rm_peer")
Suggested-by: Xin Long <lucien.xin@gmail.com>
Signed-off-by: Ricardo Cañuelo Navarro <rcn@igalia.com>
Acked-by: Xin Long <lucien.xin@gmail.com>
Link: https://patch.msgid.link/20250404-kasan_slab-use-after-free_read_in_sctp_outq_select_transport__20250404-v1-1-5ce4a0b78ef2@igalia.com
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
2025-04-08 11:34:06 +02:00
Sudeep Holla
4567bdaaaa firmware: arm_ffa: Skip Rx buffer ownership release if not acquired
Completion of the FFA_PARTITION_INFO_GET ABI transfers the ownership of
the caller’s Rx buffer from the producer(typically partition mnager) to
the consumer(this driver/OS). FFA_RX_RELEASE transfers the ownership
from the consumer back to the producer.

However, when we set the flag to just return the count of partitions
deployed in the system corresponding to the specified UUID while
invoking FFA_PARTITION_INFO_GET, the Rx buffer ownership shouldn't be
transferred to this driver. We must be able to skip transferring back
the ownership to the partition manager when we request just to get the
count of the partitions as the buffers are not acquired in this case.

Firmware may return FFA_RET_DENIED or other error for the ffa_rx_release()
in such cases.

Fixes: bb1be74985 ("firmware: arm_ffa: Add v1.1 get_partition_info support")
Message-Id: <20250321115700.3525197-1-sudeep.holla@arm.com>
Signed-off-by: Sudeep Holla <sudeep.holla@arm.com>
2025-04-08 10:32:15 +01:00
Cristian Marussi
c23c03bf1f firmware: arm_scmi: Fix timeout checks on polling path
Polling mode transactions wait for a reply busy-looping without holding a
spinlock, but currently the timeout checks are based only on elapsed time:
as a result we could hit a false positive whenever our busy-looping thread
is pre-empted and scheduled out for a time greater than the polling
timeout.

Change the checks at the end of the busy-loop to make sure that the polling
wasn't indeed successful or an out-of-order reply caused the polling to be
forcibly terminated.

Fixes: 31d2f803c1 ("firmware: arm_scmi: Add sync_cmds_completed_on_ret transport flag")
Reported-by: Huangjie <huangjie1663@phytium.com.cn>
Closes: https://lore.kernel.org/arm-scmi/20250123083323.2363749-1-jackhuang021@gmail.com/
Signed-off-by: Cristian Marussi <cristian.marussi@arm.com>
Cc: stable@vger.kernel.org # 5.18.x
Message-Id: <20250310175800.1444293-1-cristian.marussi@arm.com>
Signed-off-by: Sudeep Holla <sudeep.holla@arm.com>
2025-04-08 10:31:59 +01:00
Cristian Marussi
9ca67840c0 firmware: arm_scmi: Balance device refcount when destroying devices
Using device_find_child() to lookup the proper SCMI device to destroy
causes an unbalance in device refcount, since device_find_child() calls an
implicit get_device(): this, in turns, inhibits the call of the provided
release methods upon devices destruction.

As a consequence, one of the structures that is not freed properly upon
destruction is the internal struct device_private dev->p populated by the
drivers subsystem core.

KMemleak detects this situation since loading/unloding some SCMI driver
causes related devices to be created/destroyed without calling any
device_release method.

unreferenced object 0xffff00000f583800 (size 512):
  comm "insmod", pid 227, jiffies 4294912190
  hex dump (first 32 bytes):
    00 00 00 00 ad 4e ad de ff ff ff ff 00 00 00 00  .....N..........
    ff ff ff ff ff ff ff ff 60 36 1d 8a 00 80 ff ff  ........`6......
  backtrace (crc 114e2eed):
    kmemleak_alloc+0xbc/0xd8
    __kmalloc_cache_noprof+0x2dc/0x398
    device_add+0x954/0x12d0
    device_register+0x28/0x40
    __scmi_device_create.part.0+0x1bc/0x380
    scmi_device_create+0x2d0/0x390
    scmi_create_protocol_devices+0x74/0xf8
    scmi_device_request_notifier+0x1f8/0x2a8
    notifier_call_chain+0x110/0x3b0
    blocking_notifier_call_chain+0x70/0xb0
    scmi_driver_register+0x350/0x7f0
    0xffff80000a3b3038
    do_one_initcall+0x12c/0x730
    do_init_module+0x1dc/0x640
    load_module+0x4b20/0x5b70
    init_module_from_file+0xec/0x158

$ ./scripts/faddr2line ./vmlinux device_add+0x954/0x12d0
device_add+0x954/0x12d0:
kmalloc_noprof at include/linux/slab.h:901
(inlined by) kzalloc_noprof at include/linux/slab.h:1037
(inlined by) device_private_init at drivers/base/core.c:3510
(inlined by) device_add at drivers/base/core.c:3561

Balance device refcount by issuing a put_device() on devices found via
device_find_child().

Reported-by: Alice Ryhl <aliceryhl@google.com>
Closes: https://lore.kernel.org/linux-arm-kernel/Z8nK3uFkspy61yjP@arm.com/T/#mc1f73a0ea5e41014fa145147b7b839fc988ada8f
CC: Sudeep Holla <sudeep.holla@arm.com>
CC: Catalin Marinas <catalin.marinas@arm.com>
Fixes: d4f9dddd21 ("firmware: arm_scmi: Add dynamic scmi devices creation")
Signed-off-by: Cristian Marussi <cristian.marussi@arm.com>
Tested-by: Alice Ryhl <aliceryhl@google.com>
Message-Id: <20250306185447.2039336-1-cristian.marussi@arm.com>
Signed-off-by: Sudeep Holla <sudeep.holla@arm.com>
2025-04-08 10:31:59 +01:00
Mark Brown
f4f20f7a50
ASoC: wcd938x: enable t14s audio headset
Merge series from srinivas.kandagatla@linaro.org:

On Lenovo ThinkPad T14s, the headset is connected via a HiFi Switch to
support CTIA and OMTP headsets. This switch is used to minimise pop and
click during headset type switching.

This patchset adds required bindings and changes to codec and dts to
tnable the regulator required to power this switch along with wiring up
gpio that control the headset switching.

Without this patchset, there will be lots of noise on headset and mic
will not we functional.
2025-04-08 10:25:20 +01:00
Mark Brown
8e5e0e7110
ASoC: fsl_sai: add several improvements
Merge series from Shengjiu Wang <shengjiu.wang@nxp.com>:

Add several improvements for the sai interface.
1.allow to set mclk rate with zero clk_id for master mode
2.add xlate_tdm_slot_mask() callback to avoid channel constrain
3.separate 'is_dsp_mode' for tx and rx
4.separate set_tdm_slot() for tx and rx
2025-04-08 10:25:16 +01:00
Mark Brown
94112d3d94
ASoC: codec: wcd93xx: Convert to GPIO descriptors
Merge series from "Peng Fan (OSS)" <peng.fan@oss.nxp.com>:

of_gpio.h is deprecated, so update driver to use gpiod API.

The current driver use value 0 to assert reset and 1 to deassert reset.
The DTSes in tree that use the codec are using GPIO_ACTIVE_LOW.
So it is safe to use devm_gpiod_get to get GPIO descriptors and
use gpiod_set_value to configure output with value 1 means raw value
0, value 0 means raw value 1.

Note:
I not have devices to test, just my best pratice to do the convertion.
2025-04-08 10:25:12 +01:00
Mark Brown
1f4db3cb1a
ASoC: Intel: avs: 16 channels support
Merge series from Cezary Rojewski <cezary.rojewski@intel.com>:

Relatively small delta-wise patchset which raises max channels supported
from 8 to 16.  The existing limitation is software-based, not hardware
based.  The hardware, as per HDAudio specification, section 1.2.2,
(relevant register at SDnFMT, section 3.3.41) supports the
configurations for years.  The avs-driver becomes the first consumer of
that configuration on the Linux kernel side.

Set starts off with update to string_helpers so that functionality added
with parse_int_array_user() can be utilized in kernel-kernel
interactions.

Follow up is rasing the cap on HDAudio-library side.  The format
selection procedure found in the library is good-to-go as is.

Everything that follows these two patches is avs-driver specific:
- raise channels_max for every DAI-driver template
- provide i2s_test module parameter for testing purposes.  When combined
  with I2S loopback card, allows to test 16ch on most Intel hardware post
  Broadwell era
- adjust TDM masks to reflect the 8 -> 16 channels change
2025-04-08 10:25:08 +01:00
Mark Brown
aa446b5d9a
ASoC: Intel: avs: Add support for FCL platform
Merge series from Cezary Rojewski <cezary.rojewski@intel.com>:

The patchset is fairly straightforward - add support for Automotive
platforms based on new DSP architecture, Frisco Lake (FCL), a
PantherLake (PTL)-based platform is an example of.  The cAVS
architecture which all Intel AudioDSP followed for years ends with
RaptorLake familty.  Like all the major updates, this one received new
name too - Audio Context Engine (ACE).

While the range of improvements and changes on the firmware/hardware
side is large, software survives this evolution without need of any
major refactoring.  Additional hardware changes brought with LunarLake
(LNL, ACE 2.0) call for update in PCM-area.  The GPDMAs previously
utilized for non-HDAudio transfer types are no longer there, everything
is running through HDAudio LINK on the Back-End side now.

In terms of code, the mtl.c file, provided with patch 05 'ASoC: Intel:
avs: PTL-based platforms support' hosts largest number of new handlers -
new IRQ and INT control and DSP-cores management.  Combined with lnl.c
and ptl.c which layer the architecture changes done over ACE
generations, provide support for PTL-based platforms e.g.: FCL.
The inheritance in summary:

	mtl.c <- lnl.c <- ptl.c

The functional update to HDAudio library is there to help avs-driver
read certain capabilities directly from the hardware.  Once the pointer
to LINK is obtained, there is no need to call AudioDSP firmware to get
the caps.
2025-04-08 10:25:04 +01:00
Mark Brown
25293be4a7
ASoC: Intel: avs: Update machine board card names
Merge series from Amadeusz Sławiński <amadeuszx.slawinski@linux.intel.com>:

As discussed in user bug report [1] & [2], it was identified that HDA
card provides wrong FE device numbers to be used with UCM, at the same
time it was requested that we change card names to better names.

This patchset does that, by adding option for going back to old
behaviour in first patch. Using existing way of enumerating FEs from
topology in second patch. Then setting new names in all cards while
providing fallback to old name. Only exception is probe card, which is
used for debug purposes only, where we just directly rename card.

Do note that patch 2, will require updated topologies if topology
exposes more than 1 FE on card. Old topologies didn't assign id field
and it defaulted to 0, however when we use this field by setting
snd_soc_component_driver::use_dai_pcm_id field, we need topologies with
distinct values in FEs. Necessary changes are provided in avsdk and
avs-topology-xml repositories ([4] & [5]). linux-firmware update will
follow as soon as this changeset is merged.

[1]
Link: https://bugzilla.kernel.org/show_bug.cgi?id=219654
[2]
Link: https://github.com/alsa-project/alsa-ucm-conf/pull/499
[3]
Link: https://lore.kernel.org/linux-sound/20250127144445.2739017-1-amadeuszx.slawinski@linux.intel.com/
[4]
a879c8ae4b
[5]
9b94d52cbc
bdbc8d6ba9
2025-04-08 10:25:00 +01:00
Mark Brown
d4c29a3360
ASoC: codecs: lpass-wsa: fix VI capture setup.
Merge series from srinivas.kandagatla@linaro.org:

This two patches fixes below two issues with the VI setup.

1. Only one channel gets enabled on VI feedback patch instead of two
channels
2. recording rate is hardcoded to 8K instead dyamically setting it up.

Both of these issues are fixed in these patches.
2025-04-08 10:24:55 +01:00
Christian Brauner
4e5c53e038
Merge patch series "VFS: improve interface for lookup_one functions"
NeilBrown <neil@brown.name> says:

VFS has some functions with names containing "lookup_one_len" and others
without the "_len".  This difference has nothing to do with "len".  This
is an historical accident but can be confusing.

The functions without "_len" take a "mnt_idmap" pointer.  This is found
in the "vfsmount" and that is an important question when choosing which
to use: do you have a vfsmount, or are you "inside" the filesystem.  A
related question is "is permission checking relevant here?".

nfsd and cachefiles *do* have a vfsmount but *don't* use the non-_len
functions.  They pass nop_mnt_idmap and refuse to work on filesystems
which have any other idmap.

This series changes nfsd and cachefile to use the lookup_one family of
functions and to explictily pass &nop_mnt_idmap which is consistent with
all other vfs interfaces used where &nop_mnt_idmap is explicitly passed.

The remaining uses of the "_one" functions do not require permission
checks so these are renamed to be "_noperm" and the permission checking
is removed.

This series also changes these lookup function to take a qstr instead of
separate name and len.  In many cases this simplifies the call.

* patches from https://lore.kernel.org/r/20250319031545.2999807-2-neil@brown.name:
  VFS: change lookup_one_common and lookup_noperm_common to take a qstr
  Use try_lookup_noperm() instead of d_hash_and_lookup() outside of VFS
  VFS: rename lookup_one_len family to lookup_noperm and remove permission check
  cachefiles: Use lookup_one() rather than lookup_one_len()
  nfsd: Use lookup_one() rather than lookup_one_len()
  VFS: improve interface for lookup_one functions

Link: https://lore.kernel.org/r/20250319031545.2999807-2-neil@brown.name
Signed-off-by: Christian Brauner <brauner@kernel.org>
2025-04-08 11:24:42 +02:00
NeilBrown
390e34bc14
VFS: change lookup_one_common and lookup_noperm_common to take a qstr
These function already take a qstr of course, but they also currently
take a name/len was well and fill in the qstr.
Now they take a qstr that is already filled in, which is what all the
callers have.

Signed-off-by: NeilBrown <neilb@suse.de>
Link: https://lore.kernel.org/r/20250319031545.2999807-7-neil@brown.name
Signed-off-by: Christian Brauner <brauner@kernel.org>
2025-04-08 11:24:41 +02:00
NeilBrown
06c567403a
Use try_lookup_noperm() instead of d_hash_and_lookup() outside of VFS
try_lookup_noperm() and d_hash_and_lookup() are nearly identical.  The
former does some validation of the name where the latter doesn't.
Outside of the VFS that validation is likely valuable, and having only
one exported function for this task is certainly a good idea.

So make d_hash_and_lookup() local to VFS files and change all other
callers to try_lookup_noperm().  Note that the arguments are swapped.

Signed-off-by: NeilBrown <neilb@suse.de>
Link: https://lore.kernel.org/r/20250319031545.2999807-6-neil@brown.name
Signed-off-by: Christian Brauner <brauner@kernel.org>
2025-04-08 11:24:41 +02:00
NeilBrown
fa6fe07d15
VFS: rename lookup_one_len family to lookup_noperm and remove permission check
The lookup_one_len family of functions is (now) only used internally by
a filesystem on itself either
- in a context where permission checking is irrelevant such as by a
  virtual filesystem populating itself, or xfs accessing its ORPHANAGE
  or dquota accessing the quota file; or
- in a context where a permission check (MAY_EXEC on the parent) has just
  been performed such as a network filesystem finding in "silly-rename"
  file in the same directory.  This is also the context after the
  _parentat() functions where currently lookup_one_qstr_excl() is used.

So the permission check is pointless.

The name "one_len" is unhelpful in understanding the purpose of these
functions and should be changed.  Most of the callers pass the len as
"strlen()" so using a qstr and QSTR() can simplify the code.

This patch renames these functions (include lookup_positive_unlocked()
which is part of the family despite the name) to have a name based on
"lookup_noperm".  They are changed to receive a 'struct qstr' instead
of separate name and len.  In a few cases the use of QSTR() results in a
new call to strlen().

try_lookup_noperm() takes a pointer to a qstr instead of the whole
qstr.  This is consistent with d_hash_and_lookup() (which is nearly
identical) and useful for lookup_noperm_unlocked().

The new lookup_noperm_common() doesn't take a qstr yet.  That will be
tidied up in a subsequent patch.

Signed-off-by: NeilBrown <neil@brown.name>
Link: https://lore.kernel.org/r/20250319031545.2999807-5-neil@brown.name
Signed-off-by: Christian Brauner <brauner@kernel.org>
2025-04-08 11:24:36 +02:00
Mateusz Guzik
e45960c279
fs: unconditionally use atime_needs_update() in pick_link()
Vast majority of the time the func returns false.

This avoids a branch to determine whether we are in RCU mode.

Signed-off-by: Mateusz Guzik <mjguzik@gmail.com>
Link: https://lore.kernel.org/20250408073641.1799151-1-mjguzik@gmail.com
Signed-off-by: Christian Brauner <brauner@kernel.org>
2025-04-08 11:08:24 +02:00
Andy Shevchenko
b8c7a1ac88 gpiolib: of: Move Atmel HSMCI quirk up out of the regulator comment
The regulator comment in of_gpio_set_polarity_by_property()
made on top of a couple of the cases, while Atmel HSMCI quirk
is not related to that. Make it clear by moving Atmel HSMCI
quirk up out of the scope of the regulator comment.

Signed-off-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
Link: https://lore.kernel.org/r/20250402122058.1517393-3-andriy.shevchenko@linux.intel.com
Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski@linaro.org>
2025-04-08 11:06:45 +02:00
Andy Shevchenko
2b9c536430 gpiolib: of: Fix the choice for Ingenic NAND quirk
The Ingenic NAND quirk has been added under CONFIG_LCD_HX8357 ifdeffery
which sounds quite wrong. Fix the choice for Ingenic NAND quirk
by wrapping it into own ifdeffery related to the respective driver.

Fixes: 3a7fd473bd ("mtd: rawnand: ingenic: move the GPIO quirk to gpiolib-of.c")
Signed-off-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
Link: https://lore.kernel.org/r/20250402122058.1517393-2-andriy.shevchenko@linux.intel.com
Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski@linaro.org>
2025-04-08 11:06:33 +02:00
Paolo Abeni
cd23e77e65 Merge branch 'net_sched-make-qlen_notify-idempotent'
Cong Wang says:

====================
net_sched: make ->qlen_notify() idempotent

Gerrard reported a vulnerability exists in fq_codel where manipulating
the MTU can cause codel_dequeue() to drop all packets. The parent qdisc's
sch->q.qlen is only updated via ->qlen_notify() if the fq_codel queue
remains non-empty after the drops. This discrepancy in qlen between
fq_codel and its parent can lead to a use-after-free condition.

Let's fix this by making all existing ->qlen_notify() idempotent so that
the sch->q.qlen check will be no longer necessary.

Patch 1~5 make all existing ->qlen_notify() idempotent to prepare for
patch 6 which removes the sch->q.qlen check. They are followed by 5
selftests for each type of Qdisc's we touch here.

All existing and new Qdisc selftests pass after this patchset.

Fixes: 4b549a2ef4 ("fq_codel: Fair Queue Codel AQM")
Fixes: 76e3cc126b ("codel: Controlled Delay AQM")
Acked-by: Jamal Hadi Salim <jhs@mojatatu.com>
====================

Link: https://patch.msgid.link/20250403211033.166059-1-xiyou.wangcong@gmail.com
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
2025-04-08 10:58:16 +02:00
Cong Wang
ce94507f5f selftests/tc-testing: Add a test case for FQ_CODEL with ETS parent
Add a test case for FQ_CODEL with ETS parent to verify packet drop
behavior when the queue becomes empty. This helps ensure proper
notification mechanisms between qdiscs.

Note this is best-effort, it is hard to play with those parameters
perfectly to always trigger ->qlen_notify().

Cc: Pedro Tammela <pctammela@mojatatu.com>
Signed-off-by: Cong Wang <xiyou.wangcong@gmail.com>
Reviewed-by: Victor Nogueira <victor@mojatatu.com>
Link: https://patch.msgid.link/20250403211636.166257-6-xiyou.wangcong@gmail.com
Acked-by: Jamal Hadi Salim <jhs@mojatatu.com>
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
2025-04-08 10:58:16 +02:00
Cong Wang
0d5c27ecb6 selftests/tc-testing: Add a test case for FQ_CODEL with DRR parent
Add a test case for FQ_CODEL with DRR parent to verify packet drop
behavior when the queue becomes empty. This helps ensure proper
notification mechanisms between qdiscs.

Note this is best-effort, it is hard to play with those parameters
perfectly to always trigger ->qlen_notify().

Cc: Pedro Tammela <pctammela@mojatatu.com>
Signed-off-by: Cong Wang <xiyou.wangcong@gmail.com>
Reviewed-by: Victor Nogueira <victor@mojatatu.com>
Link: https://patch.msgid.link/20250403211636.166257-5-xiyou.wangcong@gmail.com
Acked-by: Jamal Hadi Salim <jhs@mojatatu.com>
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
2025-04-08 10:58:16 +02:00
Cong Wang
72b05c1bf7 selftests/tc-testing: Add a test case for FQ_CODEL with HFSC parent
Add a test case for FQ_CODEL with HFSC parent to verify packet drop
behavior when the queue becomes empty. This helps ensure proper
notification mechanisms between qdiscs.

Note this is best-effort, it is hard to play with those parameters
perfectly to always trigger ->qlen_notify().

Cc: Pedro Tammela <pctammela@mojatatu.com>
Signed-off-by: Cong Wang <xiyou.wangcong@gmail.com>
Reviewed-by: Victor Nogueira <victor@mojatatu.com>
Link: https://patch.msgid.link/20250403211636.166257-4-xiyou.wangcong@gmail.com
Acked-by: Jamal Hadi Salim <jhs@mojatatu.com>
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
2025-04-08 10:58:15 +02:00