Commit graph

1,398,251 commits

Author SHA1 Message Date
Yang Li
55b9551fcd Bluetooth: hci_event: Disconnect device when BIG sync is lost
When a BIG sync is lost, the device should be set to "disconnected".
This ensures symmetry with the ISO path setup, where the device is
marked as "connected" once the path is established. Without this
change, the device state remains inconsistent and may lead to a
memory leak.

Fixes: b2a5f2e1c1 ("Bluetooth: hci_event: Add support for handling LE BIG Sync Lost event")
Signed-off-by: Yang Li <yang.li@amlogic.com>
Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
2025-08-22 13:57:14 -04:00
Luiz Augusto von Dentz
15bf2c6391 Bluetooth: hci_event: Detect if HCI_EV_NUM_COMP_PKTS is unbalanced
This attempts to detect if HCI_EV_NUM_COMP_PKTS contain an unbalanced
(more than currently considered outstanding) number of packets otherwise
it could cause the hcon->sent to underflow and loop around breaking the
tracking of the outstanding packets pending acknowledgment.

Fixes: f428091858 ("Bluetooth: Simplify num_comp_pkts_evt function")
Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
2025-08-22 13:56:57 -04:00
Ludovico de Nittis
b7fafbc499 Bluetooth: hci_event: Mark connection as closed during suspend disconnect
When suspending, the disconnect command for an active Bluetooth
connection could be issued, but the corresponding
`HCI_EV_DISCONN_COMPLETE` event might not be received before the system
completes the suspend process. This can lead to an inconsistent state.

On resume, the controller may auto-accept reconnections from the same
device (due to suspend event filters), but these new connections are
rejected by the kernel which still has connection objects from before
suspend. Resulting in errors like:
```
kernel: Bluetooth: hci0: ACL packet for unknown connection handle 1
kernel: Bluetooth: hci0: Ignoring HCI_Connection_Complete for existing
connection
```

This is a btmon snippet that shows the issue:
```
< HCI Command: Disconnect (0x01|0x0006) plen 3
        Handle: 1 Address: 78:20:A5:4A:DF:28 (Nintendo Co.,Ltd)
        Reason: Remote User Terminated Connection (0x13)
> HCI Event: Command Status (0x0f) plen 4
      Disconnect (0x01|0x0006) ncmd 2
        Status: Success (0x00)
[...]
// Host suspends with the event filter set for the device
// On resume, the device tries to reconnect with a new handle

> HCI Event: Connect Complete (0x03) plen 11
        Status: Success (0x00)
        Handle: 2
        Address: 78:20:A5:4A:DF:28 (Nintendo Co.,Ltd)

// Kernel ignores this event because there is an existing connection
with
// handle 1
```

By explicitly setting the connection state to BT_CLOSED we can ensure a
consistent state, even if we don't receive the disconnect complete event
in time.

Link: https://github.com/bluez/bluez/issues/1226
Fixes: 182ee45da0 ("Bluetooth: hci_sync: Rework hci_suspend_notifier")
Signed-off-by: Ludovico de Nittis <ludovico.denittis@collabora.com>
Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
2025-08-22 13:55:29 -04:00
Ludovico de Nittis
2f050a5392 Bluetooth: hci_event: Treat UNKNOWN_CONN_ID on disconnect as success
When the host sends an HCI_OP_DISCONNECT command, the controller may
respond with the status HCI_ERROR_UNKNOWN_CONN_ID (0x02). E.g. this can
happen on resume from suspend, if the link was terminated by the remote
device before the event mask was correctly set.

This is a btmon snippet that shows the issue:
```
> ACL Data RX: Handle 3 flags 0x02 dlen 12
      L2CAP: Disconnection Request (0x06) ident 5 len 4
        Destination CID: 65
        Source CID: 72
< ACL Data TX: Handle 3 flags 0x00 dlen 12
      L2CAP: Disconnection Response (0x07) ident 5 len 4
        Destination CID: 65
        Source CID: 72
> ACL Data RX: Handle 3 flags 0x02 dlen 12
      L2CAP: Disconnection Request (0x06) ident 6 len 4
        Destination CID: 64
        Source CID: 71
< ACL Data TX: Handle 3 flags 0x00 dlen 12
      L2CAP: Disconnection Response (0x07) ident 6 len 4
        Destination CID: 64
        Source CID: 71
< HCI Command: Set Event Mask (0x03|0x0001) plen 8
        Mask: 0x3dbff807fffbffff
          Inquiry Complete
          Inquiry Result
          Connection Complete
          Connection Request
          Disconnection Complete
          Authentication Complete
[...]
< HCI Command: Disconnect (0x01|0x0006) plen 3
        Handle: 3 Address: 78:20:A5:4A:DF:28 (Nintendo Co.,Ltd)
        Reason: Remote User Terminated Connection (0x13)
> HCI Event: Command Status (0x0f) plen 4
      Disconnect (0x01|0x0006) ncmd 1
        Status: Unknown Connection Identifier (0x02)
```

Currently, the hci_cs_disconnect function treats any non-zero status
as a command failure. This can be misleading because the connection is
indeed being terminated and the controller is confirming that is has no
knowledge of that connection handle. Meaning that the initial request of
disconnecting a device should be treated as done.

With this change we allow the function to proceed, following the success
path, which correctly calls `mgmt_device_disconnected` and ensures a
consistent state.

Link: https://github.com/bluez/bluez/issues/1226
Fixes: 182ee45da0 ("Bluetooth: hci_sync: Rework hci_suspend_notifier")
Signed-off-by: Ludovico de Nittis <ludovico.denittis@collabora.com>
Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
2025-08-22 13:54:27 -04:00
Tiffany Yang
7b281a4582 cgroup: selftests: Add tests for freezer time
Test cgroup v2 freezer time stat. Freezer time accounting should
be independent of other cgroups in the hierarchy and should increase
iff a cgroup is CGRP_FREEZE (regardless of whether it reaches
CGRP_FROZEN).

Skip these tests on systems without freeze time accounting.

Signed-off-by: Tiffany Yang <ynaffit@google.com>
Cc: Michal Koutný <mkoutny@suse.com>
Signed-off-by: Tejun Heo <tj@kernel.org>
2025-08-22 07:50:52 -10:00
Tiffany Yang
afa3701c0e cgroup: cgroup.stat.local time accounting
There isn't yet a clear way to identify a set of "lost" time that
everyone (or at least a wider group of users) cares about. However,
users can perform some delay accounting by iterating over components of
interest. This patch allows cgroup v2 freezing time to be one of those
components.

Track the cumulative time that each v2 cgroup spends freezing and expose
it to userland via a new local stat file in cgroupfs. Thank you to
Michal, who provided the ASCII art in the updated documentation.

To access this value:
  $ mkdir /sys/fs/cgroup/test
  $ cat /sys/fs/cgroup/test/cgroup.stat.local
  freeze_time_total 0

Ensure consistent freeze time reads with freeze_seq, a per-cgroup
sequence counter. Writes are serialized using the css_set_lock.

Signed-off-by: Tiffany Yang <ynaffit@google.com>
Cc: Tejun Heo <tj@kernel.org>
Cc: Michal Koutný <mkoutny@suse.com>
Signed-off-by: Tejun Heo <tj@kernel.org>
2025-08-22 07:50:43 -10:00
Chen Ridong
94a4acfec1 cgroup/psi: Set of->priv to NULL upon file release
Setting of->priv to NULL when the file is released enables earlier bug
detection. This allows potential bugs to manifest as NULL pointer
dereferences rather than use-after-free errors[1], which are generally more
difficult to diagnose.

[1] https://lore.kernel.org/cgroups/38ef3ff9-b380-44f0-9315-8b3714b0948d@huaweicloud.com/T/#m8a3b3f88f0ff3da5925d342e90043394f8b2091b
Signed-off-by: Chen Ridong <chenridong@huawei.com>
Signed-off-by: Tejun Heo <tj@kernel.org>
2025-08-22 07:47:43 -10:00
Chen Ridong
79f919a89c cgroup: split cgroup_destroy_wq into 3 workqueues
A hung task can occur during [1] LTP cgroup testing when repeatedly
mounting/unmounting perf_event and net_prio controllers with
systemd.unified_cgroup_hierarchy=1. The hang manifests in
cgroup_lock_and_drain_offline() during root destruction.

Related case:
cgroup_fj_function_perf_event cgroup_fj_function.sh perf_event
cgroup_fj_function_net_prio cgroup_fj_function.sh net_prio

Call Trace:
	cgroup_lock_and_drain_offline+0x14c/0x1e8
	cgroup_destroy_root+0x3c/0x2c0
	css_free_rwork_fn+0x248/0x338
	process_one_work+0x16c/0x3b8
	worker_thread+0x22c/0x3b0
	kthread+0xec/0x100
	ret_from_fork+0x10/0x20

Root Cause:

CPU0                            CPU1
mount perf_event                umount net_prio
cgroup1_get_tree                cgroup_kill_sb
rebind_subsystems               // root destruction enqueues
				// cgroup_destroy_wq
// kill all perf_event css
                                // one perf_event css A is dying
                                // css A offline enqueues cgroup_destroy_wq
                                // root destruction will be executed first
                                css_free_rwork_fn
                                cgroup_destroy_root
                                cgroup_lock_and_drain_offline
                                // some perf descendants are dying
                                // cgroup_destroy_wq max_active = 1
                                // waiting for css A to die

Problem scenario:
1. CPU0 mounts perf_event (rebind_subsystems)
2. CPU1 unmounts net_prio (cgroup_kill_sb), queuing root destruction work
3. A dying perf_event CSS gets queued for offline after root destruction
4. Root destruction waits for offline completion, but offline work is
   blocked behind root destruction in cgroup_destroy_wq (max_active=1)

Solution:
Split cgroup_destroy_wq into three dedicated workqueues:
cgroup_offline_wq – Handles CSS offline operations
cgroup_release_wq – Manages resource release
cgroup_free_wq – Performs final memory deallocation

This separation eliminates blocking in the CSS free path while waiting for
offline operations to complete.

[1] https://github.com/linux-test-project/ltp/blob/master/runtest/controllers
Fixes: 334c3679ec ("cgroup: reimplement rebind_subsystems() using cgroup_apply_control() and friends")
Reported-by: Gao Yingjie <gaoyingjie@uniontech.com>
Signed-off-by: Chen Ridong <chenridong@huawei.com>
Suggested-by: Teju Heo <tj@kernel.org>
Signed-off-by: Tejun Heo <tj@kernel.org>
2025-08-22 07:44:11 -10:00
Luiz Augusto von Dentz
5d7eba62e5 Bluetooth: hci_conn: Make unacked packet handling more robust
This attempts to make unacked packet handling more robust by detecting
if there are no connections left then restore all buffers of the
respective pool.

Fixes: 5638d9ea9c ("Bluetooth: hci_conn: Fix not restoring ISO buffer count on disconnect")
Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
2025-08-22 13:40:18 -04:00
Eric Dumazet
02614eee26 idpf: do not linearize big TSO packets
idpf has a limit on number of scatter-gather frags
that can be used per segment.

Currently, idpf_tx_start() checks if the limit is hit
and forces a linearization of the whole packet.

This requires high order allocations that can fail
under memory pressure. A full size BIG-TCP packet
would require order-7 alocation on x86_64 :/

We can move the check earlier from idpf_features_check()
for TSO packets, to force GSO in this case, removing the
cost of a big copy.

This means that a linearization will eventually happen
with sizes smaller than one MSS.

__idpf_chk_linearize() is renamed to idpf_chk_tso_segment()
and moved to idpf_lib.c

Signed-off-by: Eric Dumazet <edumazet@google.com>
Cc: Przemek Kitszel <przemyslaw.kitszel@intel.com>
Cc: Jacob Keller <jacob.e.keller@intel.com>
Cc: Madhu Chittim <madhu.chittim@intel.com>
Cc: Pavan Kumar Linga <pavan.kumar.linga@intel.com>
Cc: Willem de Bruijn <willemb@google.com>
Cc: Andrew Lunn <andrew+netdev@lunn.ch>
Reviewed-by: Joshua Hay <joshua.a.hay@intel.com>
Tested-by: Brian Vazquez <brianvv@google.com>
Acked-by: Tony Nguyen <anthony.l.nguyen@intel.com>
Link: https://patch.msgid.link/20250818195934.757936-1-edumazet@google.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2025-08-22 10:37:18 -07:00
Thomas Huth
045f6a6e4d x86/mtrr: Remove license boilerplate text with bad FSF address
The Free Software Foundation does not reside in "675 Mass Ave, Cambridge"
anymore, so no need to mention that address in the source code here.  But
instead of updating the address to their current location, just drop the
license boilerplate text and use a proper SPDX license identifier instead.  The
text talks about the "GNU *Library* General Public License" and "any later
version", so LGPL-2.0+ is the right choice here.

  [ bp: Massage commit message. ]

Signed-off-by: Thomas Huth <thuth@redhat.com>
Signed-off-by: Borislav Petkov (AMD) <bp@alien8.de>
Link: https://lore.kernel.org/20250801084531.34089-1-thuth@redhat.com
2025-08-22 19:37:11 +02:00
Xaver Hugl
b065bd213c drm: re-allow no-op changes on non-primary planes in async flips
Commit fd40a63c63 ("drm/atomic: Let drivers decide which planes to
async flip") unintentionally disallowed no-op changes on non-primary
planes that the driver doesn't allow async flips on. This broke async
flips for compositors that disable the cursor plane in every async
atomic commit. To fix that, change drm_atomic_set_property to again
only run atomic_async_check if the plane would actually be changed by
the atomic commit.

Fixes: fd40a63c63 ("drm/atomic: Let drivers decide which planes to async flip")
Closes: https://gitlab.freedesktop.org/drm/amd/-/issues/4263
Signed-off-by: Xaver Hugl <xaver.hugl@kde.org>
Reviewed-by: André Almeida <andrealmeid@igalia.com>
Link: https://lore.kernel.org/r/20250822152849.87843-1-xaver.hugl@kde.org
[andrealmeid: fix checkpatch warning]
Signed-off-by: André Almeida <andrealmeid@igalia.com>
2025-08-22 14:31:21 -03:00
Uros Bizjak
966f504977 x86/asm: Use RDPKRU and WRPKRU mnemonics in <asm/special_insns.h>
Current minimum required version of binutils is 2.30, which supports RDPKRU and
WRPKRU instruction mnemonics.

Replace the byte-wise specification of RDPKRU and WRPKRU with these proper
mnemonics.

No functional change intended.

Signed-off-by: Uros Bizjak <ubizjak@gmail.com>
Signed-off-by: Borislav Petkov (AMD) <bp@alien8.de>
Acked-by: Peter Zijlstra (Intel) <peterz@infradead.org>
Link: https://lore.kernel.org/20250616083611.157740-1-ubizjak@gmail.com
2025-08-22 18:54:07 +02:00
Stuart Summers
2515d2b9ab
drm/xe/pcode: Initialize data0 for pcode read routine
There are two registers filled in when reading data from
pcode besides the mailbox itself. Currently, we allow a NULL
value for the second of these two (data1) and assume the first
is defined. However, many of the routines that are calling
this function assume that pcode will ignore the value being
passed in and so leave that first value (data0) defined but
uninitialized. To be safe, make sure this value is always
initialized to something (0 generally) in the event pcode
behavior changes and starts using this value.

v2: Fix sob/author

Signed-off-by: Stuart Summers <stuart.summers@intel.com>
Reviewed-by: Jonathan Cavitt <jonathan.cavitt@intel.com>
Link: https://lore.kernel.org/r/20250819201054.393220-1-stuart.summers@intel.com
Signed-off-by: Rodrigo Vivi <rodrigo.vivi@intel.com>
2025-08-22 12:26:06 -04:00
Brady Norander
dc88b77113 ALSA: hda: intel-dsp-config: Select SOF driver on MTL Chromebooks
The SOF driver is required for functional audio on MTL Chromebooks

Signed-off-by: Brady Norander <bradynorander@gmail.com>
Link: https://patch.msgid.link/20250821014730.8843-1-bradynorander@gmail.com
Signed-off-by: Takashi Iwai <tiwai@suse.de>
2025-08-22 18:20:19 +02:00
Paul Chaignon
0780f54ab1 selftests/bpf: Tests for is_scalar_branch_taken tnum logic
This patch adds tests for the new jeq and jne logic in
is_scalar_branch_taken. The following shows the first test failing
before the previous patch is applied. Once the previous patch is
applied, the verifier can use the tnum values to deduce that instruction
7 is dead code.

  0: call bpf_get_prandom_u32#7  ; R0_w=scalar()
  1: w0 = w0                     ; R0_w=scalar(smin=0,smax=umax=0xffffffff,var_off=(0x0; 0xffffffff))
  2: r0 >>= 30                   ; R0_w=scalar(smin=smin32=0,smax=umax=smax32=umax32=3,var_off=(0x0; 0x3))
  3: r0 <<= 30                   ; R0_w=scalar(smin=0,smax=umax=umax32=0xc0000000,smax32=0x40000000,var_off=(0x0; 0xc0000000))
  4: r1 = r0                     ; R0_w=scalar(id=1,smin=0,smax=umax=umax32=0xc0000000,smax32=0x40000000,var_off=(0x0; 0xc0000000)) R1_w=scalar(id=1,smin=0,smax=umax=umax32=0xc0000000,smax32=0x40000000,var_off=(0x0; 0xc0000000))
  5: r1 += 1024                  ; R1_w=scalar(smin=umin=umin32=1024,smax=umax=umax32=0xc0000400,smin32=0x80000400,smax32=0x40000400,var_off=(0x400; 0xc0000000))
  6: if r1 != r0 goto pc+1       ; R0_w=scalar(id=1,smin=umin=umin32=1024,smax=umax=umax32=0xc0000000,smin32=0x80000400,smax32=0x40000000,var_off=(0x400; 0xc0000000)) R1_w=scalar(smin=umin=umin32=1024,smax=umax=umax32=0xc0000000,smin32=0x80000400,smax32=0x40000400,var_off=(0x400; 0xc0000000))
  7: r10 = 0
  frame pointer is read only

Signed-off-by: Paul Chaignon <paul.chaignon@gmail.com>
Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
Acked-by: Eduard Zingerman <eddyz87@gmail.com>
Link: https://lore.kernel.org/bpf/550004f935e2553bdb2fb1f09cbde7d0452112d0.1755694148.git.paul.chaignon@gmail.com
2025-08-22 18:12:34 +02:00
Paul Chaignon
f41345f47f bpf: Use tnums for JEQ/JNE is_branch_taken logic
In the following toy program (reg states minimized for readability), R0
and R1 always have different values at instruction 6. This is obvious
when reading the program but cannot be guessed from ranges alone as
they overlap (R0 in [0; 0xc0000000], R1 in [1024; 0xc0000400]).

  0: call bpf_get_prandom_u32#7  ; R0_w=scalar()
  1: w0 = w0                     ; R0_w=scalar(var_off=(0x0; 0xffffffff))
  2: r0 >>= 30                   ; R0_w=scalar(var_off=(0x0; 0x3))
  3: r0 <<= 30                   ; R0_w=scalar(var_off=(0x0; 0xc0000000))
  4: r1 = r0                     ; R1_w=scalar(var_off=(0x0; 0xc0000000))
  5: r1 += 1024                  ; R1_w=scalar(var_off=(0x400; 0xc0000000))
  6: if r1 != r0 goto pc+1

Looking at tnums however, we can deduce that R1 is always different from
R0 because their tnums don't agree on known bits. This patch uses this
logic to improve is_scalar_branch_taken in case of BPF_JEQ and BPF_JNE.

This change has a tiny impact on complexity, which was measured with
the Cilium complexity CI test. That test covers 72 programs with
various build and load time configurations for a total of 970 test
cases. For 80% of test cases, the patch has no impact. On the other
test cases, the patch decreases complexity by only 0.08% on average. In
the best case, the verifier needs to walk 3% less instructions and, in
the worst case, 1.5% more. Overall, the patch has a small positive
impact, especially for our largest programs.

Signed-off-by: Paul Chaignon <paul.chaignon@gmail.com>
Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
Acked-by: Eduard Zingerman <eddyz87@gmail.com>
Acked-by: Shung-Hsi Yu <shung-hsi.yu@suse.com>
Acked-by: Daniel Borkmann <daniel@iogearbox.net>
Link: https://lore.kernel.org/bpf/be3ee70b6e489c49881cb1646114b1d861b5c334.1755694147.git.paul.chaignon@gmail.com
2025-08-22 18:12:24 +02:00
Krzysztof Kozlowski
d0fd848949 ARM: dts: microchip: Minor whitespace cleanup
The DTS code coding style expects exactly one space around '=' or '{'
characters.

Signed-off-by: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
Acked-by: Nicolas Ferre <nicolas.ferre@microchip.com>
Link: https://lore.kernel.org/r/20250819131736.86862-2-krzysztof.kozlowski@linaro.org
Signed-off-by: Claudiu Beznea <claudiu.beznea@tuxon.dev>
2025-08-22 18:10:52 +03:00
Cryolitia PukNgae
9c6182843b ALSA: usb-audio: Add mute TLV for playback volumes on some devices
Applying the quirk of that, the lowest Playback mixer volume setting
mutes the audio output, on more devices.

Link: https://gitlab.freedesktop.org/pipewire/pipewire/-/merge_requests/2514
Cc: <stable@vger.kernel.org>
Tested-by: Guoli An <anguoli@uniontech.com>
Signed-off-by: Cryolitia PukNgae <cryolitia@uniontech.com>
Link: https://patch.msgid.link/20250822-mixer-quirk-v1-1-b19252239c1c@uniontech.com
Signed-off-by: Takashi Iwai <tiwai@suse.de>
2025-08-22 17:06:28 +02:00
Yao Zi
70bb21cbc8 arm64: dts: rockchip: Add naneng-combphy for RK3528
Rockchip RK3528 ships a naneng-combphy that is shared by PCIe and USB
3.0 controllers. Describe it and the pipe-phy grf which it depends on.

Signed-off-by: Yao Zi <ziyao@disroot.org>
Link: https://lore.kernel.org/r/20250728102947.38984-8-ziyao@disroot.org
Signed-off-by: Heiko Stuebner <heiko@sntech.de>
2025-08-22 17:05:12 +02:00
Yu-cheng Yu
86e6815b31 x86/mm: Change cpa_flush() to call flush_kernel_range() directly
The function cpa_flush() calls __flush_tlb_one_kernel() and
flush_tlb_all().

Replacing that with a call to flush_tlb_kernel_range() allows
cpa_flush() to make use of INVLPGB or RAR without any additional
changes.

Initialize invlpgb_count_max to 1, since flush_tlb_kernel_range()
can now be called before invlpgb_count_max has been initialized
to the value read from CPUID.

[riel: remove now unused __cpa_flush_tlb]

Signed-off-by: Yu-cheng Yu <yu-cheng.yu@intel.com>
Signed-off-by: Rik van Riel <riel@surriel.com>
Signed-off-by: Dave Hansen <dave.hansen@linux.intel.com>
Acked-by: Dave Hansen <dave.hansen@linux.intel.com>
Link: https://lore.kernel.org/all/20250606171112.4013261-4-riel%40surriel.com
2025-08-22 07:55:21 -07:00
Jakub Kicinski
cd31182c80 Merge branch 'selftests-test-xdp_tx-for-single-buffer'
Dimitri Daskalakis says:

====================
selftests: Test XDP_TX for single-buffer

Ensure single buffer XDP functions correctly by covering the following cases:
1) Zero size payload
2) Full MTU
3) Single buffer packets through a multi-buffer XDP program

These changes were tested with netdevsim and fbnic.

 # ./ksft-net-drv/drivers/net/xdp.py
 TAP version 13
 1..10
 ok 1 xdp.test_xdp_native_pass_sb
 ok 2 xdp.test_xdp_native_pass_mb
 ok 3 xdp.test_xdp_native_drop_sb
 ok 4 xdp.test_xdp_native_drop_mb
 ok 5 xdp.test_xdp_native_tx_sb
 ok 6 xdp.test_xdp_native_tx_mb
 # Failed run: pkt_sz 2048, offset 1. Last successful run: pkt_sz 1024, offset 256. Reason: Adjustment failed
 ok 7 xdp.test_xdp_native_adjst_tail_grow_data
 ok 8 xdp.test_xdp_native_adjst_tail_shrnk_data
 # Failed run: pkt_sz 512, offset -256. Last successful run: pkt_sz 512, offset -128. Reason: Adjustment failed
 ok 9 xdp.test_xdp_native_adjst_head_grow_data
 # Failed run: pkt_sz (2048) > HDS threshold (1536) and offset 64 > 48
 ok 10 xdp.test_xdp_native_adjst_head_shrnk_data
 # Totals: pass:10 fail:0 xfail:0 xpass:0 skip:0 error:0
====================

Link: https://patch.msgid.link/20250821014023.1481662-1-dimitri.daskalakis1@gmail.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2025-08-22 07:46:31 -07:00
Dimitri Daskalakis
bbd885b193 selftests: drv-net: xdp: Validate single-buff XDP_TX in multi-buff mode
Validate that drivers with multi-buff XDP programs properly reinitialize
xdp_buff between packets.

Signed-off-by: Dimitri Daskalakis <dimitri.daskalakis1@gmail.com>
Link: https://patch.msgid.link/20250821014023.1481662-4-dimitri.daskalakis1@gmail.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2025-08-22 07:46:27 -07:00
Dimitri Daskalakis
d06d70eb6a selftests: drv-net: xdp: Add a single-buffer XDP_TX test.
Test single-buffer XDP_TX for packets with various payload sizes.
Update the socat TX command to generate packets with 0 length payloads.

Signed-off-by: Dimitri Daskalakis <dimitri.daskalakis1@gmail.com>
Link: https://patch.msgid.link/20250821014023.1481662-3-dimitri.daskalakis1@gmail.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2025-08-22 07:46:27 -07:00
Dimitri Daskalakis
91aacd8cef selftests: drv-net: xdp: Extract common XDP_TX setup/validation.
In preparation of single-buffer XDP_TX tests, refactor common test code
into the _test_xdp_native_tx method. Add support for multiple payload
sizes, and additional validation for RX packet count. Pass the -n flag
to echo to avoid adding an extra byte into the TX packet.

Signed-off-by: Dimitri Daskalakis <dimitri.daskalakis1@gmail.com>
Link: https://patch.msgid.link/20250821014023.1481662-2-dimitri.daskalakis1@gmail.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2025-08-22 07:46:27 -07:00
Adrian Hunter
01fb93a363 x86/tdx: Skip clearing reclaimed pages unless X86_BUG_TDX_PW_MCE is present
Avoid clearing reclaimed TDX private pages unless the platform is affected
by the X86_BUG_TDX_PW_MCE erratum. This significantly reduces VM shutdown
time on unaffected systems.

Background

KVM currently clears reclaimed TDX private pages using MOVDIR64B, which:

   - Clears the TD Owner bit (which identifies TDX private memory) and
     integrity metadata without triggering integrity violations.
   - Clears poison from cache lines without consuming it, avoiding MCEs on
     access (refer TDX Module Base spec. 1348549-006US section 6.5.
     Handling Machine Check Events during Guest TD Operation).

The TDX module also uses MOVDIR64B to initialize private pages before use.
If cache flushing is needed, it sets TDX_FEATURES.CLFLUSH_BEFORE_ALLOC.
However, KVM currently flushes unconditionally, refer commit 94c477a751
("x86/virt/tdx: Add SEAMCALL wrappers to add TD private pages")

In contrast, when private pages are reclaimed, the TDX Module handles
flushing via the TDH.PHYMEM.CACHE.WB SEAMCALL.

Problem

Clearing all private pages during VM shutdown is costly. For guests
with a large amount of memory it can take minutes.

Solution

TDX Module Base Architecture spec. documents that private pages reclaimed
from a TD should be initialized using MOVDIR64B, in order to avoid
integrity violation or TD bit mismatch detection when later being read
using a shared HKID, refer April 2025 spec. "Page Initialization" in
section "8.6.2. Platforms not Using ACT: Required Cache Flush and
Initialization by the Host VMM"

That is an overstatement and will be clarified in coming versions of the
spec. In fact, as outlined in "Table 16.2: Non-ACT Platforms Checks on
Memory" and "Table 16.3: Non-ACT Platforms Checks on Memory Reads in Li
Mode" in the same spec, there is no issue accessing such reclaimed pages
using a shared key that does not have integrity enabled. Linux always uses
KeyID 0 which never has integrity enabled. KeyID 0 is also the TME KeyID
which disallows integrity, refer "TME Policy/Encryption Algorithm" bit
description in "Intel Architecture Memory Encryption Technologies" spec
version 1.6 April 2025. So there is no need to clear pages to avoid
integrity violations.

There remains a risk of poison consumption. However, in the context of
TDX, it is expected that there would be a machine check associated with the
original poisoning. On some platforms that results in a panic. However
platforms may support "SEAM_NR" Machine Check capability, in which case
Linux machine check handler marks the page as poisoned, which prevents it
from being allocated anymore, refer commit 7911f145de ("x86/mce:
Implement recovery for errors in TDX/SEAM non-root mode")

Improvement

By skipping the clearing step on unaffected platforms, shutdown time
can improve by up to 40%.

On platforms with the X86_BUG_TDX_PW_MCE erratum (SPR and EMR), continue
clearing because these platforms may trigger poison on partial writes to
previously-private pages, even with KeyID 0, refer commit 1e536e1068
("x86/cpu: Detect TDX partial write machine check erratum")

Signed-off-by: Adrian Hunter <adrian.hunter@intel.com>
Signed-off-by: Dave Hansen <dave.hansen@linux.intel.com>
Reviewed-by: Kirill A. Shutemov <kas@kernel.org>
Reviewed-by: Rick Edgecombe <rick.p.edgecombe@intel.com>
Reviewed-by: Xiaoyao Li <xiaoyao.li@intel.com>
Reviewed-by: Binbin Wu <binbin.wu@linux.intel.com>
Acked-by: Kai Huang <kai.huang@intel.com>
Acked-by: Vishal Annapurve <vannapurve@google.com>
Link: https://lore.kernel.org/all/20250819155811.136099-4-adrian.hunter%40intel.com
2025-08-22 07:45:50 -07:00
Adrian Hunter
a27b008a5d x86/tdx: Tidy reset_pamt functions
tdx_quirk_reset_paddr() was renamed to reflect that, in fact, the clearing
is necessary only for hardware with a certain quirk.  That is dealt with in
a subsequent patch.

Rename reset_pamt functions to contain "quirk" to reflect the new
functionality, and remove the now misleading comment.

Signed-off-by: Adrian Hunter <adrian.hunter@intel.com>
Signed-off-by: Dave Hansen <dave.hansen@linux.intel.com>
Reviewed-by: Rick Edgecombe <rick.p.edgecombe@intel.com>
Reviewed-by: Binbin Wu <binbin.wu@linux.intel.com>
Acked-by: Kai Huang <kai.huang@intel.com>
Acked-by: Vishal Annapurve <vannapurve@google.com>
Link: https://lore.kernel.org/all/20250819155811.136099-3-adrian.hunter%40intel.com
2025-08-22 07:45:50 -07:00
Adrian Hunter
94272b084a x86/tdx: Eliminate duplicate code in tdx_clear_page()
tdx_clear_page() and reset_tdx_pages() duplicate the TDX page clearing
logic.  Rename reset_tdx_pages() to tdx_quirk_reset_paddr() and create
tdx_quirk_reset_page() to call tdx_quirk_reset_paddr() and be used in
place of tdx_clear_page().

The new name reflects that, in fact, the clearing is necessary only for
hardware with a certain quirk.  That is dealt with in a subsequent patch
but doing the rename here avoids additional churn.

Note reset_tdx_pages() is slightly different from tdx_clear_page() because,
more appropriately, it uses mb() in place of __mb().  Except when extra
debugging is enabled (kcsan at present), mb() just calls __mb().

Signed-off-by: Adrian Hunter <adrian.hunter@intel.com>
Signed-off-by: Dave Hansen <dave.hansen@linux.intel.com>
Reviewed-by: Kirill A. Shutemov <kas@kernel.org>
Reviewed-by: Binbin Wu <binbin.wu@linux.intel.com>
Reviewed-by: Xiaoyao Li <xiaoyao.li@intel.com>
Reviewed-by: Rick Edgecombe <rick.p.edgecombe@intel.com>
Acked-by: Kai Huang <kai.huang@intel.com>
Acked-by: Sean Christopherson <seanjc@google.com>
Acked-by: Vishal Annapurve <vannapurve@google.com>
Link: https://lore.kernel.org/all/20250819155811.136099-2-adrian.hunter%40intel.com
2025-08-22 07:45:50 -07:00
Xiaoyao Li
d8b483ba43 MAINTAINERS: Add KVM mail list to the TDX entry
KVM is the primary user of TDX within the kernel, and it is KVM that
provides support for running TDX guests.

Add the KVM mailing list to the TDX entry so that KVM people can be
informed of proposed changes and updates related to TDX.

Signed-off-by: Xiaoyao Li <xiaoyao.li@intel.com>
Signed-off-by: Dave Hansen <dave.hansen@linux.intel.com>
Acked-by: Sean Christopherson <seanjc@google.com>
Link: https://lore.kernel.org/all/20250709141035.70299-1-xiaoyao.li%40intel.com
2025-08-22 07:30:23 -07:00
Kirill A. Shutemov
957e385540 MAINTAINERS: Add Rick Edgecombe as a TDX reviewer
Rick worked extensively to enable TDX in KVM. He will continue to work
on TDX and should be involved in discussions regarding TDX.

Add Rick as a TDX reviewer.

Signed-off-by: Kirill A. Shutemov <kirill.shutemov@linux.intel.com>
Signed-off-by: Dave Hansen <dave.hansen@linux.intel.com>
Link: https://lore.kernel.org/all/20250708101922.50560-3-kirill.shutemov%40linux.intel.com
2025-08-22 07:30:23 -07:00
Kirill A. Shutemov
81e39b6d89 MAINTAINERS: Update the file list in the TDX entry.
This includes files that were previously missed in the TDX entry file
list and makes it more future-proof. Most importantly, this now covers
the recently added KVM enabling.

[ dhansen: move from explicit files to "tdx" filename match ]

Signed-off-by: Kirill A. Shutemov <kirill.shutemov@linux.intel.com>
Signed-off-by: Dave Hansen <dave.hansen@linux.intel.com>
Link: https://lore.kernel.org/all/20250708101922.50560-2-kirill.shutemov%40linux.intel.com
2025-08-22 07:30:23 -07:00
Linus Torvalds
cf6fc5eefc s390 fixes for 6.17-rc3
- When kernel lockdown is active userspace tools that rely on read
   operations only are unnecessarily blocked. Fix that by avoiding
   ioctl registration during lockdown
 
 - Invalid NULL pointer accesses succeed due to the lowcore is always
   mapped the identity mapping pinned to zero. To fix that never map
   the first two pages of physical memory with identity mapping
 
 - Fix invalid SCCB present check in the SCLP interrupt handler
 
 - Update defconfigs
 -----BEGIN PGP SIGNATURE-----
 
 iI0EABYKADUWIQQrtrZiYVkVzKQcYivNdxKlNrRb8AUCaKhfnRccYWdvcmRlZXZA
 bGludXguaWJtLmNvbQAKCRDNdxKlNrRb8KsfAP4m5In0Dv8QMvfxKZuImMcUXN0m
 FABuwlSVVoV2dKb0/AD/XX5XVvkg6EWEbAfknaQ06U6WdWQX/3BtS3hfDuLk1gQ=
 =4N65
 -----END PGP SIGNATURE-----

Merge tag 's390-6.17-3' of git://git.kernel.org/pub/scm/linux/kernel/git/s390/linux

Pull s390 fixes from Alexander Gordeev:

 - When kernel lockdown is active userspace tools that rely on read
   operations only are unnecessarily blocked. Fix that by avoiding ioctl
   registration during lockdown

 - Invalid NULL pointer accesses succeed due to the lowcore is always
   mapped the identity mapping pinned to zero. To fix that never map the
   first two pages of physical memory with identity mapping

 - Fix invalid SCCB present check in the SCLP interrupt handler

 - Update defconfigs

* tag 's390-6.17-3' of git://git.kernel.org/pub/scm/linux/kernel/git/s390/linux:
  s390/hypfs: Enable limited access during lockdown
  s390/hypfs: Avoid unnecessary ioctl registration in debugfs
  s390/mm: Do not map lowcore with identity mapping
  s390/sclp: Fix SCCB present check
  s390/configs: Set HZ=1000
  s390/configs: Update defconfigs
2025-08-22 10:16:47 -04:00
Linus Torvalds
b3d80535e2 xen: branch for v6.17-rc3
-----BEGIN PGP SIGNATURE-----
 
 iHUEABYKAB0WIQRTLbB6QfY48x44uB6AXGG7T9hjvgUCaKf/jgAKCRCAXGG7T9hj
 vsTcAP0eRBCWDlCTzyuRN+2MpyryoNspFcovhJGwMG16a/7SbgEA/Vi7WqK7Y0XT
 /7ovC2AzehL9iJaZvl8hWULVnw9C8Aw=
 =gDSN
 -----END PGP SIGNATURE-----

Merge tag 'for-linus-6.17-rc3-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/xen/tip

Pull xen fixes from Juergen Gross:
 "Two small cleanups which are both relevant only when running as a Xen
  guest"

* tag 'for-linus-6.17-rc3-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/xen/tip:
  drivers/xen/xenbus: remove quirk for Xen 3.x
  compiler: remove __ADDRESSABLE_ASM{_STR,}() again
2025-08-22 09:50:17 -04:00
Linus Torvalds
272aa18fea platform-drivers-x86 for v6.17-2
Fixes and New HW Support:
 
  - amd/hsmp:
 
    - Ensure sock->metric_tbl_addr is non-NULL
 
    - Register driver even if hwmon registration fails
 
  - amd/pmc: Drop SMU F/W match for Cezanne
 
  - dell-smbios-wmi: Separate "priority" from WMI device ID
 
  - hp-wmi: mark Victus 16-r1xxx for Victus s fan and thermal profile support
 
  - intel-uncore-freq: Check write blocked for efficiency latency control
 
 The following is an automated shortlog grouped by driver:
 
 amd/hsmp:
  -  Ensure sock->metric_tbl_addr is non-NULL
  -  Ensure success even if hwmon registration fails
 
 amd: pmc:
  -  Drop SMU F/W match for Cezanne
 
 dell-smbios-wmi:
  -  Stop touching WMI device ID
 
 hp-wmi:
  -  mark Victus 16-r1xxx for victus_s fan and thermal profile support
 
 intel-uncore-freq:
  -  Check write blocked for ELC
 -----BEGIN PGP SIGNATURE-----
 
 iHUEABYIAB0WIQSCSUwRdwTNL2MhaBlZrE9hU+XOMQUCaKhs0wAKCRBZrE9hU+XO
 MQOXAP4zJofX7KXdbIqCpAdlL+zbdDKichzyZG36u+BKdOn8VQEArbQaZoHEq/05
 ReoDwmIWS7KWgcbXkZxlwkWYbrOLpwM=
 =ZB4H
 -----END PGP SIGNATURE-----

Merge tag 'platform-drivers-x86-v6.17-2' of git://git.kernel.org/pub/scm/linux/kernel/git/pdx86/platform-drivers-x86

Pull x86 platform driver fixes from Ilpo Järvinen:

 - amd/hsmp:
     - Ensure sock->metric_tbl_addr is non-NULL
     - Register driver even if hwmon registration fails

 - amd/pmc: Drop SMU F/W match for Cezanne

 - dell-smbios-wmi: Separate "priority" from WMI device ID

 - hp-wmi: mark Victus 16-r1xxx for Victus s fan and thermal profile
   support

 - intel-uncore-freq: Check write blocked for efficiency latency control

* tag 'platform-drivers-x86-v6.17-2' of git://git.kernel.org/pub/scm/linux/kernel/git/pdx86/platform-drivers-x86:
  platform/x86: hp-wmi: mark Victus 16-r1xxx for victus_s fan and thermal profile support
  platform/x86/amd/hsmp: Ensure success even if hwmon registration fails
  platform/x86/amd/hsmp: Ensure sock->metric_tbl_addr is non-NULL
  platform/x86/intel-uncore-freq: Check write blocked for ELC
  platform/x86/amd: pmc: Drop SMU F/W match for Cezanne
  platform/x86: dell-smbios-wmi: Stop touching WMI device ID
2025-08-22 09:35:21 -04:00
Linus Torvalds
a2e94e8079 block-6.17-20250822
-----BEGIN PGP SIGNATURE-----
 
 iQJEBAABCAAuFiEEwPw5LcreJtl1+l5K99NY+ylx4KYFAmiobRkQHGF4Ym9lQGtl
 cm5lbC5kawAKCRD301j7KXHgpnvDEAC6ybsqvNAOSV1Tdk1EQZ/mIrmIb7tVrp/P
 zRReWTK9jF7kzOLn2Mqgu0c4RFLCMABXmPb5F2aLx72uSxMSFq2sI9QZCgGzZQeZ
 yjOIxFBAPsdgr+gyIOdS3zH04+IKfJw20ojJb83irCgd5M1hpmVwzZ3iGMq8Gs9q
 VJQYvKny7tjjpuLpk3DWl7t1J0YV+0sGQhk3iZdWEHrui7mqmfh6DkeB5forTu6z
 Gn5e4DNbZvmcvkJQ+Rnkua1UmTZ4hr/+3YV9mqzsWYv+1hOTx/uomGbY7DjSdSyK
 vWWNwN97sgAjwhaFgWvB2iRk1pdAb4A3zP+NV1MXheOhHnAT3C6i43DaS1fivone
 YKLEqy4v3IzB5WcdlwclJW2qizoLtopu7A4pRURv9v+Q0wb4Q2YM0gRum59QgxZN
 +YUhglR5ucazYPmIAxOZMaU/WMIN6m4h3hRa1RkFRNXkBvPGxV2fQxi8exX0QWqf
 oxSSfImO0QVjYPlAL7oi0eWwHtqXtebXXdrUNozQdnrEQnimTrxPAuSnfRIv63un
 swlaCzfqXXhtl25t9p6Sx7xM7aKF2k7tYnZdSM7JjiOS7KXHFaZcYt3YcoFfdLc7
 X/vtT9OQWwnEtqzFKnK8EvcjSN+4KbXwI4neVLmsWK81dwqI2huScB+Xe5eBPidU
 6d6dZzUikA==
 =mbqK
 -----END PGP SIGNATURE-----

Merge tag 'block-6.17-20250822' of git://git.kernel.dk/linux

Pull block fixes from Jens Axboe:
 "A set of fixes for block that should go into this tree. A bit larger
  than what I usually have at this point in time, a lot of that is the
  continued fixing of the lockdep annotation for queue freezing that we
  recently added, which has highlighted a number of little issues here
  and there. This contains:

   - MD pull request via Yu:

       - Add a legacy_async_del_gendisk mode, to prevent a user tools
         regression. New user tools releases will not use such a mode,
         the old release with a new kernel now will have warning about
         deprecated behavior, and we prepare to remove this legacy mode
         after about a year later

       - The rename in kernel causing user tools build failure, revert
         the rename in mdp_superblock_s

       - Fix a regression that interrupted resync can be shown as
         recover from mdstat or sysfs

   - Improve file size detection for loop, particularly for networked
     file systems, by using getattr to get the size rather than the
     cached inode size.

   - Hotplug CPU lock vs queue freeze fix

   - Lockdep fix while updating the number of hardware queues

   - Fix stacking for PI devices

   - Silence bio_check_eod() for the known case of device removal where
     the size is truncated to 0 sectors"

* tag 'block-6.17-20250822' of git://git.kernel.dk/linux:
  block: avoid cpu_hotplug_lock depedency on freeze_lock
  block: decrement block_rq_qos static key in rq_qos_del()
  block: skip q->rq_qos check in rq_qos_done_bio()
  blk-mq: fix lockdep warning in __blk_mq_update_nr_hw_queues
  block: tone down bio_check_eod
  loop: use vfs_getattr_nosec for accurate file size
  loop: Consolidate size calculation logic into lo_calculate_size()
  block: remove newlines from the warnings in blk_validate_integrity_limits
  block: handle pi_tuple_size in queue_limits_stack_integrity
  selftests: ublk: Use ARRAY_SIZE() macro to improve code
  md: fix sync_action incorrect display during resync
  md: add helper rdev_needs_recovery()
  md: keep recovery_cp in mdp_superblock_s
  md: add legacy_async_del_gendisk mode
2025-08-22 09:29:51 -04:00
Qianfeng Rong
9a0352dd45 refscale: Use kcalloc() instead of kzalloc()
Use kcalloc() in main_func() to gain built-in overflow protection, making
memory allocation safer when calculating allocation size compared to
explicit multiplication.

Signed-off-by: Qianfeng Rong <rongqianfeng@vivo.com>
Signed-off-by: Paul E. McKenney <paulmck@kernel.org>
2025-08-22 06:26:22 -07:00
Qianfeng Rong
3e15cccf3e rcutorture: Use kcalloc() instead of kzalloc()
Use kcalloc() in rcu_torture_writer() to gain built-in overflow protection,
making memory allocation safer when calculating allocation size compared to
explicit multiplication.

Change sizeof(ulo[0]) and sizeof(rgo[0]) to sizeof(*ulo) and sizeof(*rgo),
as this is more consistent with coding conventions.

Signed-off-by: Qianfeng Rong <rongqianfeng@vivo.com>
Signed-off-by: Paul E. McKenney <paulmck@kernel.org>
2025-08-22 06:26:22 -07:00
Linus Torvalds
d28de4fc0a io_uring-6.17-20250822
-----BEGIN PGP SIGNATURE-----
 
 iQJEBAABCAAuFiEEwPw5LcreJtl1+l5K99NY+ylx4KYFAmiobS0QHGF4Ym9lQGtl
 cm5lbC5kawAKCRD301j7KXHgpl2rD/44niBCUuj5CTZKqCCkVMduiBIvRWmRl+Fz
 Xth2qCwn5RBCi9dZWe4D8xTr0d9d3CTdCUMLiINm6+lyLTcE3taz2AczBHcs/FWZ
 rL7anFYtVLcadoqabrlbkI02dEIY4ARkpAfenyaBO693GoI5YD2CBxTH0YkVF2Qw
 beasIRi0s+TbmGQbtqbAROCdIywX6LpyEiT4tuDfLixDHwfoV0teLb57H7TrfJ3j
 MwuFX83JN2ZpGvHSJHs7/T21OwDJ8h2hV4TgFt5hwKg7UKpVq0crh/+lLlZnZxUw
 D5GMW3EDYaOwUO1dxTpFWKuKUCpzvaOpBdqhK3UNsSJwEu6riRzkC/7IydbX1qcI
 dBAvJqg4TJYRpAFwMS0yNZ1gA+rC/kXFQrbJivaRm57ZLrxvhSI4RCPgv+Vd5ayP
 Bd25paIDEndk2sDf9iMESM4yPciTCmjWhjFc6TQwo7uidJagXbXJQD1fXDxDoT+m
 /gGv0UG4vZ20sUZbBOLHeVUFxlaw9MtgFwq1RSPMCUBhYbaxW57BVwjngAaTILNK
 NzBkpamtzJxk66GL1fLZ/fmMdNJenM+40GyHLAt/e46x95aooExaV4a/FtrYXQVa
 LAJTEFUTG4Ybu5zRxTpl1evEXfktpOHlubdQnsAaP1sj8ydRL+JJmRlcbReWQupy
 SeuJhF4rbQ==
 =jOfg
 -----END PGP SIGNATURE-----

Merge tag 'io_uring-6.17-20250822' of git://git.kernel.dk/linux

Pull io_uring fixes from Jens Axboe:
 "Just two small fixes - one that fixes inconsistent ->async_data vs
  REQ_F_ASYNC_DATA handling in futex, and a followup that just ensures
  that if other opcode handlers mess this up, it won't cause any issues"

* tag 'io_uring-6.17-20250822' of git://git.kernel.dk/linux:
  io_uring: clear ->async_data as part of normal init
  io_uring/futex: ensure io_futex_wait() cleans up properly on failure
2025-08-22 09:25:59 -04:00
Nikil Paul S
de117fe3f5 docs: rcu: Replace multiple dead OLS links in RTFP.txt
This patch updates several dead OLS links in RTFP.txt, replacing them
with working copies hosted on kernel.org.

Originally posted as part of a 2-patch series, this is now being sent
as a standalone v4 patch to avoid confusion.

Signed-off-by: Nikil Paul S <snikilpaul@gmail.com>
Signed-off-by: Paul E. McKenney <paulmck@kernel.org>
2025-08-22 06:25:47 -07:00
Paul E. McKenney
14b0a12a70 doc: Fix typo in RCU's torture.rst documentation
s/you//

Reported-by: Randy Dunlap <rdunlap@infradead.org>
Signed-off-by: Paul E. McKenney <paulmck@kernel.org>
2025-08-22 06:25:47 -07:00
Bagas Sanjaya
9832258da7 Documentation: RCU: Retitle toctree index
toctree index title ("RCU concepts") is rather a misnomer: RCU concepts
is already described in rcu.rst, whereas the toctree suggests that
the docs themes about handbook on RCU subsystem instead.

Edit the title to reflect the fact.

Signed-off-by: Bagas Sanjaya <bagasdotme@gmail.com>
Signed-off-by: Paul E. McKenney <paulmck@kernel.org>
2025-08-22 06:25:47 -07:00
Bagas Sanjaya
326b16baed Documentation: RCU: Reduce toctree depth
toctree index for RCU currently has maximum depth of 3. Since no docs
currently use more than 3 section heading levels, this effectively spills
the entire docs hierarchy.

Tidy up by reducing toctree depth to 2 (only showing docs title and
second-level sections).

Signed-off-by: Bagas Sanjaya <bagasdotme@gmail.com>
Signed-off-by: Paul E. McKenney <paulmck@kernel.org>
2025-08-22 06:25:47 -07:00
Bagas Sanjaya
8495e00fe6 Documentation: RCU: Wrap kvm-remote.sh rerun snippet in literal code block
Unlike other kvm*.sh snippets in RCU torture test documentation,
kvm-remote.sh rerun snippet isn't formatted as literal code block,
causing it to be definition list instead in htmldocs output.

Wrap it like the rest.

Fixes: 0c208a7930 ("doc: Update torture.rst")
Signed-off-by: Bagas Sanjaya <bagasdotme@gmail.com>
Signed-off-by: Paul E. McKenney <paulmck@kernel.org>
Reviewed-by: Randy Dunlap <rdunlap@infradead.org>
2025-08-22 06:25:47 -07:00
Linus Torvalds
edeee68c42 SCSI fixes on 20250822
All fixes in drivers.  The largest diffstat in ufs is caused by the
 doc update with the next being the qcom null pointer deref fix.
 
 Signed-off-by: James E.J. Bottomley <James.Bottomley@HansenPartnership.com>
 -----BEGIN PGP SIGNATURE-----
 
 iJwEABMIAEQWIQTnYEDbdso9F2cI+arnQslM7pishQUCaKhBSSYcamFtZXMuYm90
 dG9tbGV5QGhhbnNlbnBhcnRuZXJzaGlwLmNvbQAKCRDnQslM7pisheYBAP9IwgCR
 ANnFXfILBJ0vGkZiVsV7lZPtcUChbTT0stGCXAD/axlU11QwE673mlxkVK5JuFGc
 fnCdTAt0iM1AqiGiCeI=
 =+twj
 -----END PGP SIGNATURE-----

Merge tag 'scsi-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi

Pull SCSI fixes from James Bottomley:
 "All fixes in drivers. The largest diffstat in ufs is caused by the doc
  update with the next being the qcom null pointer deref fix"

* tag 'scsi-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi:
  scsi: ufs: ufs-qcom: Fix ESI null pointer dereference
  scsi: ufs: core: Rename ufshcd_wait_for_doorbell_clr()
  scsi: ufs: core: Fix the return value documentation
  scsi: ufs: core: Remove WARN_ON_ONCE() call from ufshcd_uic_cmd_compl()
  scsi: ufs: core: Fix IRQ lock inversion for the SCSI host lock
  scsi: qla4xxx: Prevent a potential error pointer dereference
  scsi: ufs: ufs-pci: Add support for Intel Wildcat Lake
  scsi: fnic: Remove a useless struct mempool forward declaration
2025-08-22 09:20:42 -04:00
Linus Torvalds
afd58777de MMC host:
- sdhci_am654: Disable HS400 for AM62P SR1.0 and SR1.1
  - sdhci-of-arasan: Ensure CD logic stabilization before power-up
  - sdhci-pci-gli: Mask the replay timer timeout of AER for GL9763e
 
 MEMSTICK:
  - Fix deadlock by moving removing flag earlier
 -----BEGIN PGP SIGNATURE-----
 
 iQJLBAABCgA1FiEEugLDXPmKSktSkQsV/iaEJXNYjCkFAmioRt4XHHVsZi5oYW5z
 c29uQGxpbmFyby5vcmcACgkQ/iaEJXNYjCkW/w/+NeQhlSoTGr/eBWL2BqF3+b1J
 yxyS/DIW0CukTrpQNMqsu9yeWqRqqugBGm613/ffJ2elCOV8sfhyQt8tgvIur9WB
 mWEXui8PwReNa4ZLmUVbFMLfLL0uJO0MIYRXFxJB8CGk0OXsN4jffaomurVdmXsS
 4WkvzHcm64MmGINPkGnkWICMIHiErjAaQOZJBmasG7VxkdHVvJjbi0QFeWjnVExd
 7HXN2qPU1y8Vv7jgArGaGnL7ZElmzEjcDn7+ZCStC4Q6QjTsKE3FFjsEkiF08b1M
 1BBwx6NfB/KOBxBNy6g7vLmeD52oLIET2AQ8E4aQ2MpQF24323eDmY/TLR7d8SIq
 jctdi21qcqQLeaj2oStcgS+FTH2vpkSQBK4kv/cRTcEVpvun+KYrCNpFI0JDovY0
 0BHOukSHMkB0i0X1uyBmMXlxFGne67sDM42tynfkHVMfb6MTtk50EqyWi5shoYcJ
 PUPv/E+AemohyKzqLpU177Lx84pX3km9oK21tVGJS62Qv8ydgJLV2YXWU7IKQ+Mv
 d+X7Ks6AlHIbhMdo00/L/4nLNjvUiAzJ480QnAE1qt+luFhnKievFaZ0hX2z7E14
 WGnpPlph2S2UUfJpeA4JuM3Pb2nwvjVm4pl5CZYRg2cRJz4DGRK20NbcZ/waA02I
 umWZrQ1PzgyYOqYRmkE=
 =FuWR
 -----END PGP SIGNATURE-----

Merge tag 'mmc-v6.17-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/ulfh/mmc

Pull MMC fixes from Ulf Hansson:
 "MMC host:
   - sdhci_am654: Disable HS400 for AM62P SR1.0 and SR1.1
   - sdhci-of-arasan: Ensure CD logic stabilization before power-up
   - sdhci-pci-gli: Mask the replay timer timeout of AER for GL9763e

  MEMSTICK:
   - Fix deadlock by moving removing flag earlier"

* tag 'mmc-v6.17-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/ulfh/mmc:
  mmc: sdhci_am654: Disable HS400 for AM62P SR1.0 and SR1.1
  memstick: Fix deadlock by moving removing flag earlier
  mmc: sdhci-of-arasan: Ensure CD logic stabilization before power-up
  mmc: sdhci-pci-gli: GL9763e: Mask the replay timer timeout of AER
  mmc: sdhci-pci-gli: GL9763e: Rename the gli_set_gl9763e() for consistency
  mmc: sdhci-pci-gli: Add a new function to simplify the code
2025-08-22 09:17:49 -04:00
Liao Yuanhong
f123430130 pds_fwctl: Remove the use of dev_err_probe()
Logging messages that show some type of "out of memory" error are generally
unnecessary as there is a generic message and a stack dump done by the
memory subsystem. These messages generally increase kernel size without
much added value[1].

The dev_err_probe() doesn't do anything when error is '-ENOMEM'. Therefore,
remove the useless call to dev_err_probe(), and just return the value
instead.

[1]: https://lore.kernel.org/lkml/1402419340.30479.18.camel@joe-AO725/

Link: https://patch.msgid.link/r/20250820124011.474224-1-liaoyuanhong@vivo.com
Signed-off-by: Liao Yuanhong <liaoyuanhong@vivo.com>
Reviewed-by: Dave Jiang <dave.jiang@intel.com>
Reviewed-by: Jonathan Cameron <jonathan.cameron@huawei.com>
Reviewed-by: Brett Creeley <brett.creeley@amd.com>
Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
2025-08-22 10:14:18 -03:00
Linus Torvalds
e2d324af56 RDMA v6.17 first rc pull request
- Syzkaller found WARN_ON in rxe due to poor lifecycle management of
   resources linked to skbs
 
 - Missing error path handling in erdma qp creation
 
 - Initialize the qp number for the GSI QP in erdma
 
 - Mismatching of DIP, SCC and QP numbers in hns
 
 - SRQ bug fixes in bnxt_re
 
 - Memory leak and possibly uninited memory in bnxt_re
 
 - Remove retired irdma maintainer
 
 - Fix kfree() for kvalloc() in ODP
 
 - Fix memory leak in hns
 -----BEGIN PGP SIGNATURE-----
 
 iHUEABYKAB0WIQRRRCHOFoQz/8F5bUaFwuHvBreFYQUCaKeiiAAKCRCFwuHvBreF
 YWZtAQCYRx4n6lVWJ8t954bVZGcxLvruY6SVhR5r7xGTEEW/cwD/VnRJb7fwfgTc
 bP7+DIG+qLK2JWVNT4GptgpnjOuDPwY=
 =KjJs
 -----END PGP SIGNATURE-----

Merge tag 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/rdma/rdma

Pull rdma fixes from Jason Gunthorpe:

 - syzkaller found a WARN_ON in rxe due to poor lifecycle management of
   resources linked to skbs

 - Missing error path handling in erdma qp creation

 - Initialize the qp number for the GSI QP in erdma

 - Mismatching of DIP, SCC and QP numbers in hns

 - SRQ bug fixes in bnxt_re

 - Memory leak and possibly uninited memory in bnxt_re

 - Remove retired irdma maintainer

 - Fix kfree() for kvalloc() in ODP

 - Fix memory leak in hns

* tag 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/rdma/rdma:
  RDMA/hns: Fix dip entries leak on devices newer than hip09
  RDMA/core: Free pfn_list with appropriate kvfree call
  MAINTAINERS: Remove bouncing irdma maintainer
  RDMA/bnxt_re: Fix to initialize the PBL array
  RDMA/bnxt_re: Fix a possible memory leak in the driver
  RDMA/bnxt_re: Fix to remove workload check in SRQ limit path
  RDMA/bnxt_re: Fix to do SRQ armena by default
  RDMA/hns: Fix querying wrong SCC context for DIP algorithm
  RDMA/erdma: Fix unset QPN of GSI QP
  RDMA/erdma: Fix ignored return value of init_kernel_qp
  RDMA/rxe: Flush delayed SKBs while releasing RXE resources
2025-08-22 09:13:24 -04:00
Krzysztof Kozlowski
90741cc5be arm64: dts: marvell: Minor whitespace cleanup
The DTS code coding style expects exactly one space around '='
character.

Signed-off-by: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
Signed-off-by: Gregory CLEMENT <gregory.clement@bootlin.com>
2025-08-22 15:12:49 +02:00
Linus Torvalds
c37d2bc92b IOMMU Fixes for Linux v6.17-rc2:
Including:
 
 	- AMD-Vi: Fix potential stack buffer overflow via command line.
 
 	- NVidia-Tegra: Fix endianess sparse warning.
 
 	- ARM-SMMU: Fix ATS-masters reference count issue.
 
 	- Virtio-IOMMU: Fix race condition on instance lookup.
 
 	- RISC-V IOMMU: Fix potential NULL-ptr dereference in
 	  riscv_iommu_iova_to_phys().
 -----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCAAdFiEEr9jSbILcajRFYWYyK/BELZcBGuMFAmioMvgACgkQK/BELZcB
 GuMzlxAAh1sQ3jPkyEcQzCErCYvvICWMzEiV0Lweot5xBFcAZAXQEcYJy9u1PnA7
 NNoSfhaEyufkANUznvI5ikkJzv9wfIOK1mn3vjaeZe7ymXqh0m+JqFWS1hQynjp4
 6DEIYEJLB1pLDM41P+S+AnVWfS88XwMsUd13es773zJgPLHfK9U97oFWfUhkj6ei
 9ItvgSAiqAcIPYu1/hI5Te7vIC5RBRyOfvAhhzxx2255T3bdUqbVUz3ERLXZ808M
 MOmhznlVAChhoOKTdWRpOaVnFsaWCbUBhdnnSwwL7lsmixd4wDELZM/8jGA8hlIT
 7sbMIiiEdWqPfpMZxDuz7IfEilhFmZP8+e5c8VPL37PTouj2RdCGPbLtzGFzlMKU
 QF40K6FAJCbE9mmgmtdD33xhBkc3/7gar9Xvc3k9VEvVOfvZ/TxgPTW4ZilaO+OK
 C8S1/x3T6MFZmndKT/H1SAm+AM4pViON48N5t4L6rVA/na0xraOXNjFnsNeK6gLY
 lK5pz7St69Ud7KQUQXhUgKSktDDQOnZYcbn0I7z2KfSAIWFxqJgT9F5XtTde1kdm
 XZVe4qp59UzOgZQu1Q1K5F2peQGFSjoaK69r4I0Mh2VY7jokW/tZmqUgyTbW42hD
 qH/jhcPblpOTCFM9LPn94oShmTlMcNhKYbfO+VKIY9ThhxPVHJc=
 =BWSF
 -----END PGP SIGNATURE-----

Merge tag 'iommu-fixes-v6.17-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/iommu/linux

Pull iommu fixes from Joerg Roedel:

 - AMD-Vi: Fix potential stack buffer overflow via command line

 - NVidia-Tegra: Fix endianess sparse warning

 - ARM-SMMU: Fix ATS-masters reference count issue

 - Virtio-IOMMU: Fix race condition on instance lookup

 - RISC-V IOMMU: Fix potential NULL-ptr dereference in
   riscv_iommu_iova_to_phys()

* tag 'iommu-fixes-v6.17-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/iommu/linux:
  iommu/riscv: prevent NULL deref in iova_to_phys
  iommu/virtio: Make instance lookup robust
  iommu/arm-smmu-v3: Fix smmu_domain->nr_ats_masters decrement
  iommu/tegra241-cmdqv: Fix missing cpu_to_le64 at lvcmdq_err_map
  iommu/amd: Avoid stack buffer overflow from kernel cmdline
2025-08-22 09:10:30 -04:00
Lorenzo Bianconi
563fcd6475 pinctrl: airoha: Fix return value in pinconf callbacks
Pinctrl stack requires ENOTSUPP error code if the parameter is not
supported by the pinctrl driver. Fix the returned error code in pinconf
callbacks if the operation is not supported.

Fixes: 1c8ace2d07 ("pinctrl: airoha: Add support for EN7581 SoC")
Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org>
Link: https://lore.kernel.org/20250822-airoha-pinconf-err-val-fix-v1-1-87b4f264ced2@kernel.org
Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
2025-08-22 15:08:58 +02:00