summaryrefslogtreecommitdiff
AgeCommit message (Collapse)Author
2025-05-23Merge branch kvm-arm64/nv-nv into kvmarm-master/nextMarc Zyngier
* kvm-arm64/nv-nv: : . : Flick the switch on the NV support by adding the missing piece : in the form of the VNCR page management. From the cover letter: : : "This is probably the most interesting bit of the whole NV adventure. : So far, everything else has been a walk in the park, but this one is : where the real fun takes place. : : With FEAT_NV2, most of the NV support revolves around tricking a guest : into accessing memory while it tries to access system registers. The : hypervisor's job is to handle the context switch of the actual : registers with the state in memory as needed." : . KVM: arm64: nv: Release faulted-in VNCR page from mmu_lock critical section KVM: arm64: nv: Handle TLBI S1E2 for VNCR invalidation with mmu_lock held KVM: arm64: nv: Hold mmu_lock when invalidating VNCR SW-TLB before translating KVM: arm64: Document NV caps and vcpu flags KVM: arm64: Allow userspace to request KVM_ARM_VCPU_EL2* KVM: arm64: nv: Remove dead code from ERET handling KVM: arm64: nv: Plumb TLBI S1E2 into system instruction dispatch KVM: arm64: nv: Add S1 TLB invalidation primitive for VNCR_EL2 KVM: arm64: nv: Program host's VNCR_EL2 to the fixmap address KVM: arm64: nv: Handle VNCR_EL2 invalidation from MMU notifiers KVM: arm64: nv: Handle mapping of VNCR_EL2 at EL2 KVM: arm64: nv: Handle VNCR_EL2-triggered faults KVM: arm64: nv: Add userspace and guest handling of VNCR_EL2 KVM: arm64: nv: Add pseudo-TLB backing VNCR_EL2 KVM: arm64: nv: Don't adjust PSTATE.M when L2 is nesting KVM: arm64: nv: Move TLBI range decoding to a helper KVM: arm64: nv: Snapshot S1 ASID tagging information during walk KVM: arm64: nv: Extract translation helper from the AT code KVM: arm64: nv: Allocate VNCR page when required arm64: sysreg: Add layout for VNCR_EL2 Signed-off-by: Marc Zyngier <maz@kernel.org>
2025-05-23Merge branch kvm-arm64/at-fixes-6.16 into kvmarm-master/nextMarc Zyngier
* kvm-arm64/at-fixes-6.16: : . : Set of fixes for Address Translation (AT) instruction emulation, : which affect the (not yet upstream) NV support. : : From the cover letter: : : "Here's a small series of fixes for KVM's implementation of address : translation (aka the AT S1* instructions), addressing a number of : issues in increasing levels of severity: : : - We misreport PAR_EL1.PTW in a number of occasions, including state : that is not possible as per the architecture definition : : - We don't handle access faults at all, and that doesn't play very : well with the rest of the VNCR stuff : : - AT S1E{0,1} from EL2 with HCR_EL2.{E2H,TGE}={1,1} will absolutely : take the host down, no questions asked" : . KVM: arm64: Don't feed uninitialised data to HCR_EL2 KVM: arm64: Teach address translation about access faults KVM: arm64: Fix PAR_EL1.{PTW,S} reporting on AT S1E* Signed-off-by: Marc Zyngier <maz@kernel.org>
2025-05-23Merge branch kvm-arm64/fgt-masks into kvmarm-master/nextMarc Zyngier
* kvm-arm64/fgt-masks: (43 commits) : . : Large rework of the way KVM deals with trap bits in conjunction with : the CPU feature registers. It now draws a direct link between which : the feature set, the system registers that need to UNDEF to match : the configuration and bits that need to behave as RES0 or RES1 in : the trap registers that are visible to the guest. : : Best of all, these definitions are mostly automatically generated : from the JSON description published by ARM under a permissive : license. : . KVM: arm64: Handle TSB CSYNC traps KVM: arm64: Add FGT descriptors for FEAT_FGT2 KVM: arm64: Allow sysreg ranges for FGT descriptors KVM: arm64: Add context-switch for FEAT_FGT2 registers KVM: arm64: Add trap routing for FEAT_FGT2 registers KVM: arm64: Add sanitisation for FEAT_FGT2 registers KVM: arm64: Add FEAT_FGT2 registers to the VNCR page KVM: arm64: Use HCR_EL2 feature map to drive fixed-value bits KVM: arm64: Use HCRX_EL2 feature map to drive fixed-value bits KVM: arm64: Allow kvm_has_feat() to take variable arguments KVM: arm64: Use FGT feature maps to drive RES0 bits KVM: arm64: Validate FGT register descriptions against RES0 masks KVM: arm64: Switch to table-driven FGU configuration KVM: arm64: Handle PSB CSYNC traps KVM: arm64: Use KVM-specific HCRX_EL2 RES0 mask KVM: arm64: Remove hand-crafted masks for FGT registers KVM: arm64: Use computed FGT masks to setup FGT registers KVM: arm64: Propagate FGT masks to the nVHE hypervisor KVM: arm64: Unconditionally configure fine-grain traps KVM: arm64: Use computed masks as sanitisers for FGT registers ... Signed-off-by: Marc Zyngier <maz@kernel.org>
2025-05-23Merge branch kvm-arm64/mte-frac into kvmarm-master/nextMarc Zyngier
* kvm-arm64/mte-frac: : . : Prevent FEAT_MTE_ASYNC from being accidently exposed to a guest, : courtesy of Ben Horgan. From the cover letter: : : "The ID_AA64PFR1_EL1.MTE_frac field is currently hidden from KVM. : However, when ID_AA64PFR1_EL1.MTE==2, ID_AA64PFR1_EL1.MTE_frac==0 : indicates that MTE_ASYNC is supported. On a host with : ID_AA64PFR1_EL1.MTE==2 but without MTE_ASYNC support a guest with the : MTE capability enabled will incorrectly see MTE_ASYNC advertised as : supported. This series fixes that." : . KVM: selftests: Confirm exposing MTE_frac does not break migration KVM: arm64: Make MTE_frac masking conditional on MTE capability arm64/sysreg: Expose MTE_frac so that it is visible to KVM Signed-off-by: Marc Zyngier <maz@kernel.org>
2025-05-23Merge branch kvm-arm64/ubsan-el2 into kvmarm-master/nextMarc Zyngier
* kvm-arm64/ubsan-el2: : . : Add UBSAN support to the EL2 portion of KVM, reusing most of the : existing logic provided by CONFIG_IBSAN_TRAP. : : Patches courtesy of Mostafa Saleh. : . KVM: arm64: Handle UBSAN faults KVM: arm64: Introduce CONFIG_UBSAN_KVM_EL2 ubsan: Remove regs from report_ubsan_failure() arm64: Introduce esr_is_ubsan_brk() Signed-off-by: Marc Zyngier <maz@kernel.org>
2025-05-23Merge branch kvm-arm64/pkvm-np-thp-6.16 into kvmarm-master/nextMarc Zyngier
* kvm-arm64/pkvm-np-thp-6.16: (21 commits) : . : Large mapping support for non-protected pKVM guests, courtesy of : Vincent Donnefort. From the cover letter: : : "This series adds support for stage-2 huge mappings (PMD_SIZE) to pKVM : np-guests, that is installing PMD-level mappings in the stage-2, : whenever the stage-1 is backed by either Hugetlbfs or THPs." : . KVM: arm64: np-guest CMOs with PMD_SIZE fixmap KVM: arm64: Stage-2 huge mappings for np-guests KVM: arm64: Add a range to pkvm_mappings KVM: arm64: Convert pkvm_mappings to interval tree KVM: arm64: Add a range to __pkvm_host_test_clear_young_guest() KVM: arm64: Add a range to __pkvm_host_wrprotect_guest() KVM: arm64: Add a range to __pkvm_host_unshare_guest() KVM: arm64: Add a range to __pkvm_host_share_guest() KVM: arm64: Introduce for_each_hyp_page KVM: arm64: Handle huge mappings for np-guest CMOs KVM: arm64: Extend pKVM selftest for np-guests KVM: arm64: Selftest for pKVM transitions KVM: arm64: Don't WARN from __pkvm_host_share_guest() KVM: arm64: Add .hyp.data section KVM: arm64: Unconditionally cross check hyp state KVM: arm64: Defer EL2 stage-1 mapping on share KVM: arm64: Move hyp state to hyp_vmemmap KVM: arm64: Introduce {get,set}_host_state() helpers KVM: arm64: Use 0b11 for encoding PKVM_NOPAGE KVM: arm64: Fix pKVM page-tracking comments ... Signed-off-by: Marc Zyngier <maz@kernel.org>
2025-05-23Merge branch 'so_passrights'David S. Miller
Kuniyuki Iwashima says: ==================== af_unix: Introduce SO_PASSRIGHTS. As long as recvmsg() or recvmmsg() is used with cmsg, it is not possible to avoid receiving file descriptors via SCM_RIGHTS. This series introduces a new socket option, SO_PASSRIGHTS, to allow disabling SCM_RIGHTS. The option is enabled by default. See patch 8 for background/context. This series is related to [0], but is split into a separate series, as most of the patches are specific to af_unix. The v2 of the BPF LSM extension part will be posted later, once this series is merged into net-next and has landed in bpf-next. [0]: https://lore.kernel.org/bpf/20250505215802.48449-1-kuniyu@amazon.com/ Changes: v5: * Patch 4 * Fix BPF selftest failure (setget_sockopt.c) v4: https://lore.kernel.org/netdev/20250515224946.6931-1-kuniyu@amazon.com/ * Patch 6 * Group sk->sk_scm_XXX bits by struct * Patch 9 * Remove errno handling v3: https://lore.kernel.org/netdev/20250514165226.40410-1-kuniyu@amazon.com/ * Patch 3 * Remove inline in scm.c * Patch 4 & 5 & 8 * Return -EOPNOTSUPP in getsockopt() * Patch 5 * Add CONFIG_SECURITY_NETWORK check for SO_PASSSEC * Patch 6 * Add kdoc for sk_scm_unused * Update sk_scm_XXX under lock_sock() in setsockopt() * Patch 7 * Update changelog (recent change -> aed6ecef55d7) v2: https://lore.kernel.org/netdev/20250510015652.9931-1-kuniyu@amazon.com/ * Added patch 4 & 5 to reuse sk_txrehash for scm_recv() flags v1: https://lore.kernel.org/netdev/20250508013021.79654-1-kuniyu@amazon.com/ ==================== Signed-off-by: David S. Miller <davem@davemloft.net>
2025-05-23selftest: af_unix: Test SO_PASSRIGHTS.Kuniyuki Iwashima
scm_rights.c has various patterns of tests to exercise GC. Let's add cases where SO_PASSRIGHTS is disabled. Signed-off-by: Kuniyuki Iwashima <kuniyu@amazon.com> Reviewed-by: Willem de Bruijn <willemb@google.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2025-05-23af_unix: Introduce SO_PASSRIGHTS.Kuniyuki Iwashima
As long as recvmsg() or recvmmsg() is used with cmsg, it is not possible to avoid receiving file descriptors via SCM_RIGHTS. This behaviour has occasionally been flagged as problematic, as it can be (ab)used to trigger DoS during close(), for example, by passing a FUSE-controlled fd or a hung NFS fd. For instance, as noted on the uAPI Group page [0], an untrusted peer could send a file descriptor pointing to a hung NFS mount and then close it. Once the receiver calls recvmsg() with msg_control, the descriptor is automatically installed, and then the responsibility for the final close() now falls on the receiver, which may result in blocking the process for a long time. Regarding this, systemd calls cmsg_close_all() [1] after each recvmsg() to close() unwanted file descriptors sent via SCM_RIGHTS. However, this cannot work around the issue at all, because the final fput() may still occur on the receiver's side once sendmsg() with SCM_RIGHTS succeeds. Also, even filtering by LSM at recvmsg() does not work for the same reason. Thus, we need a better way to refuse SCM_RIGHTS at sendmsg(). Let's introduce SO_PASSRIGHTS to disable SCM_RIGHTS. Note that this option is enabled by default for backward compatibility. Link: https://uapi-group.org/kernel-features/#disabling-reception-of-scm_rights-for-af_unix-sockets #[0] Link: https://github.com/systemd/systemd/blob/v257.5/src/basic/fd-util.c#L612-L628 #[1] Signed-off-by: Kuniyuki Iwashima <kuniyu@amazon.com> Reviewed-by: Willem de Bruijn <willemb@google.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2025-05-23af_unix: Inherit sk_flags at connect().Kuniyuki Iwashima
For SOCK_STREAM embryo sockets, the SO_PASS{CRED,PIDFD,SEC} options are inherited from the parent listen()ing socket. Currently, this inheritance happens at accept(), because these attributes were stored in sk->sk_socket->flags and the struct socket is not allocated until accept(). This leads to unintentional behaviour. When a peer sends data to an embryo socket in the accept() queue, unix_maybe_add_creds() embeds credentials into the skb, even if neither the peer nor the listener has enabled these options. If the option is enabled, the embryo socket receives the ancillary data after accept(). If not, the data is silently discarded. This conservative approach works for SO_PASS{CRED,PIDFD,SEC}, but would not for SO_PASSRIGHTS; once an SCM_RIGHTS with a hung file descriptor was sent, it'd be game over. To avoid this, we will need to preserve SOCK_PASSRIGHTS even on embryo sockets. Commit aed6ecef55d7 ("af_unix: Save listener for embryo socket.") made it possible to access the parent's flags in sendmsg() via unix_sk(other)->listener->sk->sk_socket->flags, but this introduces an unnecessary condition that is irrelevant for most sockets, accept()ed sockets and clients. Therefore, we moved SOCK_PASSXXX into struct sock. Let’s inherit sk->sk_scm_recv_flags at connect() to avoid receiving SCM_RIGHTS on embryo sockets created from a parent with SO_PASSRIGHTS=0. Note that the parent socket is locked in connect() so we don't need READ_ONCE() for sk_scm_recv_flags. Now, we can remove !other->sk_socket check in unix_maybe_add_creds() to avoid slow SOCK_PASS{CRED,PIDFD} handling for embryo sockets created from a parent with SO_PASS{CRED,PIDFD}=0. Signed-off-by: Kuniyuki Iwashima <kuniyu@amazon.com> Reviewed-by: Willem de Bruijn <willemb@google.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2025-05-23af_unix: Move SOCK_PASS{CRED,PIDFD,SEC} to struct sock.Kuniyuki Iwashima
As explained in the next patch, SO_PASSRIGHTS would have a problem if we assigned a corresponding bit to socket->flags, so it must be managed in struct sock. Mixing socket->flags and sk->sk_flags for similar options will look confusing, and sk->sk_flags does not have enough space on 32bit system. Also, as mentioned in commit 16e572626961 ("af_unix: dont send SCM_CREDENTIALS by default"), SOCK_PASSCRED and SOCK_PASSPID handling is known to be slow, and managing the flags in struct socket cannot avoid that for embryo sockets. Let's move SOCK_PASS{CRED,PIDFD,SEC} to struct sock. While at it, other SOCK_XXX flags in net.h are grouped as enum. Note that assign_bit() was atomic, so the writer side is moved down after lock_sock() in setsockopt(), but the bit is only read once in sendmsg() and recvmsg(), so lock_sock() is not needed there. Signed-off-by: Kuniyuki Iwashima <kuniyu@amazon.com> Reviewed-by: Willem de Bruijn <willemb@google.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2025-05-23net: Restrict SO_PASS{CRED,PIDFD,SEC} to AF_{UNIX,NETLINK,BLUETOOTH}.Kuniyuki Iwashima
SCM_CREDENTIALS and SCM_SECURITY can be recv()ed by calling scm_recv() or scm_recv_unix(), and SCM_PIDFD is only used by scm_recv_unix(). scm_recv() is called from AF_NETLINK and AF_BLUETOOTH. scm_recv_unix() is literally called from AF_UNIX. Let's restrict SO_PASSCRED and SO_PASSSEC to such sockets and SO_PASSPIDFD to AF_UNIX only. Later, SOCK_PASS{CRED,PIDFD,SEC} will be moved to struct sock and united with another field. Signed-off-by: Kuniyuki Iwashima <kuniyu@amazon.com> Reviewed-by: Willem de Bruijn <willemb@google.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2025-05-23tcp: Restrict SO_TXREHASH to TCP socket.Kuniyuki Iwashima
sk->sk_txrehash is only used for TCP. Let's restrict SO_TXREHASH to TCP to reflect this. Later, we will make sk_txrehash a part of the union for other protocol families. Note that we need to modify BPF selftest not to get/set SO_TEREHASH for non-TCP sockets. Signed-off-by: Kuniyuki Iwashima <kuniyu@amazon.com> Reviewed-by: Willem de Bruijn <willemb@google.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2025-05-23scm: Move scm_recv() from scm.h to scm.c.Kuniyuki Iwashima
scm_recv() has been placed in scm.h since the pre-git era for no particular reason (I think), which makes the file really fragile. For example, when you move SOCK_PASSCRED from include/linux/net.h to enum sock_flags in include/net/sock.h, you will see weird build failure due to terrible dependency. To avoid the build failure in the future, let's move scm_recv(_unix())? and its callees to scm.c. Note that only scm_recv() needs to be exported for Bluetooth. scm_send() should be moved to scm.c too, but I'll revisit later. Signed-off-by: Kuniyuki Iwashima <kuniyu@amazon.com> Reviewed-by: Willem de Bruijn <willemb@google.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2025-05-23af_unix: Don't pass struct socket to maybe_add_creds().Kuniyuki Iwashima
We will move SOCK_PASS{CRED,PIDFD,SEC} from struct socket.flags to struct sock for better handling with SOCK_PASSRIGHTS. Then, we don't need to access struct socket in maybe_add_creds(). Let's pass struct sock to maybe_add_creds() and its caller queue_oob(). While at it, we append the unix_ prefix and fix double spaces around the pid assignment. Signed-off-by: Kuniyuki Iwashima <kuniyu@amazon.com> Reviewed-by: Willem de Bruijn <willemb@google.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2025-05-23af_unix: Factorise test_bit() for SOCK_PASSCRED and SOCK_PASSPIDFD.Kuniyuki Iwashima
Currently, the same checks for SOCK_PASSCRED and SOCK_PASSPIDFD are scattered across many places. Let's centralise the bit tests to make the following changes cleaner. Signed-off-by: Kuniyuki Iwashima <kuniyu@amazon.com> Reviewed-by: Willem de Bruijn <willemb@google.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2025-05-23Revert "crypto: testmgr - Add hash export format testing"Herbert Xu
This reverts commit 18c438b228558e05ede7dccf947a6547516fc0c7. The s390 hmac and sha3 algorithms are failing the test. Revert the change until they have been fixed. Reported-by: Ingo Franzki <ifranzki@linux.ibm.com> Link: https://lore.kernel.org/all/623a7fcb-b4cb-48e6-9833-57ad2b32a252@linux.ibm.com/ Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
2025-05-23platform/x86/intel/pmc: Fix Arrow Lake U/H NPU PCI IDTodd Brandt
The ARL requires that the GMA and NPU devices both be in D3Hot in order for PC10 and S0iX to be achieved in S2idle. The original ARL-H/U addition to the intel_pmc_core driver attempted to do this by switching them to D3 in the init and resume calls of the intel_pmc_core driver. The problem is the ARL-H/U have a different NPU device and thus are not being properly set and thus S0iX does not work properly in ARL-H/U. This patch creates a new ARL-H specific device id that is correct and also adds the D3 fixup to the suspend callback. This way if the PCI devies drop from D3 to D0 after resume they can be corrected for the next suspend. Thus there is no dropout in S0iX. Fixes: bd820906ea9d ("platform/x86/intel/pmc: Add Arrow Lake U/H support to intel_pmc_core driver") Signed-off-by: Todd Brandt <todd.e.brandt@intel.com> Link: https://lore.kernel.org/r/a61f78be45c13f39e122dcc684b636f4b21e79a0.1747737446.git.todd.e.brandt@intel.com Reviewed-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com> Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
2025-05-23mips, net: ensure that SOCK_COREDUMP is definedChristian Brauner
For historical reasons mips has to override the socket enum values but the defines are all the same. So simply move the ARCH_HAS_SOCKET_TYPES scope. Fixes: a9194f88782a ("coredump: add coredump socket") Suggested-by: Arnd Bergmann <arnd@arndb.de> Signed-off-by: Christian Brauner <brauner@kernel.org>
2025-05-23i2c: mlxbf: avoid 64-bit divisionArnd Bergmann
The 64-bit division in mlxbf_i2c_get_ticks() causes link failures when compile-testing on 32-bit machines: ERROR: modpost: "__udivdi3" [drivers/i2c/busses/i2c-mlxbf.ko] undefined! Change this to a div_u64(), which should replace the constant division with a a multiply/shift combination in the mlxbf_i2c_get_ticks(). The frequency calculation functions require a slow library call but should be used much rarer. Fixes: 053859002c20 ("i2c: mlxbf: Allow build with COMPILE_TEST") Signed-off-by: Arnd Bergmann <arnd@arndb.de> Link: https://lore.kernel.org/r/20250520152600.1975628-1-arnd@kernel.org Signed-off-by: Andi Shyti <andi@smida.it>
2025-05-23i2c: viai2c-wmt: Replace dev_err() with dev_err_probe() in probe functionEnrico Zanda
This simplifies the code while improving log. Signed-off-by: Enrico Zanda <e.zanda1@gmail.com> Link: https://lore.kernel.org/r/20250513210246.528370-2-e.zanda1@gmail.com Signed-off-by: Andi Shyti <andi@smida.it>
2025-05-23i2c: designware: Don't warn about missing get_clk_rate_khzHeikki Krogerus
Converting the WARN_ON() to a dev_dbg() message in i2c_dw_clk_rate(). That removes the need to supply a dummy implementation for the callback (or alternatively a dummy clk device) when the fallback path is preferred where the existing values already in the clock registers are used - when a firmware has programmed the clock registers. The fallback path was introduced in commit 4fec76e0985c ("i2c: designware: Fix wrong setting for {ss,fs,hs}_{h,l}cnt registers"). Signed-off-by: Heikki Krogerus <heikki.krogerus@linux.intel.com> Acked-by: Jarkko Nikula <jarkko.nikula@linux.intel.com> Link: https://lore.kernel.org/r/20250513124015.2568924-1-heikki.krogerus@linux.intel.com Signed-off-by: Andi Shyti <andi.shyti@kernel.org>
2025-05-23i2c: designware: Invoke runtime suspend on quick slave re-registrationTan En De
Replaced pm_runtime_put() with pm_runtime_put_sync_suspend() to ensure the runtime suspend is invoked immediately when unregistering a slave. This prevents a race condition where suspend was skipped when unregistering and registering slave in quick succession. For example, consider the rapid sequence of `delete_device -> new_device -> delete_device -> new_device`. In this sequence, it is observed that the dw_i2c_plat_runtime_suspend() might not be invoked after `delete_device` operation. This is because after `delete_device` operation, when the pm_runtime_put() is about to trigger suspend, the following `new_device` operation might race and cancel the suspend. If that happens, during the `new_device` operation, dw_i2c_plat_runtime_resume() is skipped (since there was no suspend), which means `i_dev->init()`, i.e. i2c_dw_init_slave(), is skipped. Since i2c_dw_init_slave() is skipped, i2c_dw_configure_fifo_slave() is skipped too, which leaves `DW_IC_INTR_MASK` unconfigured. If we inspect the interrupt mask register using devmem, it will show as zero. Example shell script to reproduce the issue: ``` #!/bin/sh SLAVE_LADDR=0x1010 SLAVE_BUS=13 NEW_DEVICE=/sys/bus/i2c/devices/i2c-$SLAVE_BUS/new_device DELETE_DEVICE=/sys/bus/i2c/devices/i2c-$SLAVE_BUS/delete_device # Create initial device echo slave-24c02 $SLAVE_LADDR > $NEW_DEVICE sleep 2 # Rapid sequence of # delete_device -> new_device -> delete_device -> new_device echo $SLAVE_LADDR > $DELETE_DEVICE echo slave-24c02 $SLAVE_LADDR > $NEW_DEVICE echo $SLAVE_LADDR > $DELETE_DEVICE echo slave-24c02 $SLAVE_LADDR > $NEW_DEVICE # Using devmem to inspect IC_INTR_MASK will show as zero ``` Signed-off-by: Tan En De <ende.tan@starfivetech.com> Acked-by: Jarkko Nikula <jarkko.nikula@linux.intel.com> Link: https://lore.kernel.org/r/20250412023303.378600-1-ende.tan@starfivetech.com Signed-off-by: Andi Shyti <andi.shyti@kernel.org>
2025-05-23i2c-mlxbf: Improve I2C bus timing configurationChris Babroski
Update the I2C bus timing configuration on BlueField to match the configuration recommended and verified by the HW team. I2C block read failures were found on BlueField 3 during communication with a device that requires the use of repeated start conditions. Testing showed that these failures were caused by the I2C transaction getting aborted early due to a short bus "timeout" configuration value. This value determines how long the clock can be held low before the I2C transaction is aborted. Upon further inspection, it was also found that other I2C bus timing configuration values used by the kernel driver do not match the configuration that is recommended by the HW team and used in the BlueField BSP I2C drivers. Signed-off-by: Chris Babroski <cbabroski@nvidia.com> Reviewed-by: Asmaa Mnebhi <asmaa@nvidia.com> Reviewed-by: Khalil Blaiech <kblaiech@nvidia.com> Link: https://lore.kernel.org/r/20250506193059.321345-2-cbabroski@nvidia.com Signed-off-by: Andi Shyti <andi.shyti@kernel.org>
2025-05-23i2c-mlxbf: Add repeated start condition supportChris Babroski
Add support for SMBus repeated start conditions to the Mellanox I2C driver. This support is specifically enabled for the I2C_FUNC_SMBUS_WRITE_I2C_BLOCK implementation which is required for communication with a specific I2C device on BlueField 3. Signed-off-by: Chris Babroski <cbabroski@nvidia.com> Reviewed-by: Asmaa Mnebhi <asmaa@nvidia.com> Reviewed-by: Khalil Blaiech <kblaiech@nvidia.com> Link: https://lore.kernel.org/r/20250506193059.321345-1-cbabroski@nvidia.com Signed-off-by: Andi Shyti <andi.shyti@kernel.org>
2025-05-23i2c: xgene-slimpro: Replace dev_err() with dev_err_probe() in probe functionEnrico Zanda
This simplifies the code while improving log. Signed-off-by: Enrico Zanda <e.zanda1@gmail.com> Link: https://lore.kernel.org/r/20250511203920.325704-2-e.zanda1@gmail.com Signed-off-by: Andi Shyti <andi.shyti@kernel.org>
2025-05-23dt-bindings: i2c: i2c-wmt: Convert to YAMLAlexey Charkov
Rewrite the textual description for the WonderMedia I2C controller as YAML schema, and switch the filename to follow the compatible string. The controller only supports two bus speeds (100kHz and 400kHz) so restrict clock-frequency values accordingly. Reviewed-by: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org> Signed-off-by: Alexey Charkov <alchark@gmail.com> Link: https://lore.kernel.org/r/20250506-vt8500-i2c-binding-v3-1-401c3e090a88@gmail.com Signed-off-by: Andi Shyti <andi.shyti@kernel.org>
2025-05-23i2c: microchip-corei2c: add smbus supportprashanth kumar burujukindi
Add hardware support for the SMBUS commands smbus_quick, smbus_byte, smbus_byte_data, smbus_word_data and smbus_block_data, replacing the fallback to software emulation Signed-off-by: prashanth kumar burujukindi <prashanthkumar.burujukindi@microchip.com> Signed-off-by: Conor Dooley <conor.dooley@microchip.com> Link: https://lore.kernel.org/r/20250430-preview-dormitory-85191523283d@spud Signed-off-by: Andi Shyti <andi.shyti@kernel.org>
2025-05-23i2c: mlxbf: Allow build with COMPILE_TESTAndi Shyti
Extend the Kconfig dependency to include COMPILE_TEST so the Mellanox BlueField I2C driver can be built on non-ARM64 platforms for compile testing purposes. Signed-off-by: Andi Shyti <andi.shyti@kernel.org> Cc: Khalil Blaiech <kblaiech@nvidia.com> Cc: Asmaa Mnebhi <asmaa@nvidia.com> Link: https://lore.kernel.org/r/20250505215854.2896383-1-andi.shyti@kernel.org
2025-05-23i2c: I2C_DESIGNWARE_AMDISP should depend on DRM_AMD_ISPGeert Uytterhoeven
The AMD Image Signal Processor I2C functionality is only present on AMD platforms with ISP support, and its platform device is instantiated by the AMD ISP driver. Hence add a dependency on DRM_AMD_ISP, to prevent asking the user about this driver when configuring a kernel that does not support the AMD ISP. Fixes: d6263c468a76 ("i2c: amd-isp: Add ISP i2c-designware driver") Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be> Reviewed-by: Pratap Nirujogi <pratap.nirujogi@amd.com> Link: https://lore.kernel.org/r/3888f892b8c4d8c8acd17e56581e726ace7f7092.1746536495.git.geert+renesas@glider.be Signed-off-by: Andi Shyti <andi.shyti@kernel.org>
2025-05-23drm/xe: Default auto_link_downgrade status to falseAradhya Bhatia
xe_pcode_read() can return back successfully without updating the variable 'val'. This can cause an arbitrary value to show up in the sysfs file. Allow the auto_link_downgrade_status to default to 0 to avoid any arbitrary value from coming up. Fixes: 0e414bf7ad01 ("drm/xe: Expose PCIe link downgrade attributes") Reviewed-by: Tejas Upadhyay <tejas.upadhyay@intel.com> Signed-off-by: Aradhya Bhatia <aradhya.bhatia@intel.com> Link: https://lore.kernel.org/r/20250516124355.4872-1-aradhya.bhatia@intel.com Signed-off-by: Matt Roper <matthew.d.roper@intel.com> (cherry picked from commit a7f87deac2295d11865048bcb9c2de369b52ed93) Signed-off-by: Thomas Hellström <thomas.hellstrom@linux.intel.com>
2025-05-23drm/xe/guc: Make creation of SLPC debugfs files conditionalAradhya Bhatia
Platforms that do not support SLPC are exempted from the GuC PC support. The GuC PC does not get initialized, and neither do its BOs get created. This causes a problem because the GuC PC debugfs file is still being created. Whenever the file is attempted to read, it causes a NULL pointer dereference on the supposed BO of the GuC PC. So, make the creation of SLPC debugfs files conditional to when SLPC features are supported. Fixes: aaab5404b16f ("drm/xe: Introduce GuC PC debugfs") Suggested-by: Matt Roper <matthew.d.roper@intel.com> Reviewed-by: Tejas Upadhyay <tejas.upadhyay@intel.com> Reviewed-by: Stuart Summers <stuart.summers@intel.com> Signed-off-by: Aradhya Bhatia <aradhya.bhatia@intel.com> Link: https://lore.kernel.org/r/20250516141902.5614-1-aradhya.bhatia@intel.com Signed-off-by: Matt Roper <matthew.d.roper@intel.com> (cherry picked from commit 17486cf3df5320752cc67ee8bcb2379d1b9de76c) Signed-off-by: Thomas Hellström <thomas.hellstrom@linux.intel.com>
2025-05-23xen/arm: call uaccess_ttbr0_enable for dm_op hypercallStefano Stabellini
dm_op hypercalls might come from userspace and pass memory addresses as parameters. The memory addresses typically correspond to buffers allocated in userspace to hold extra hypercall parameters. On ARM, when CONFIG_ARM64_SW_TTBR0_PAN is enabled, they might not be accessible by Xen, as a result ioreq hypercalls might fail. See the existing comment in arch/arm64/xen/hypercall.S regarding privcmd_call for reference. For privcmd_call, Linux calls uaccess_ttbr0_enable before issuing the hypercall thanks to commit 9cf09d68b89a. We need to do the same for dm_op. This resolves the problem. Cc: stable@kernel.org Fixes: 9cf09d68b89a ("arm64: xen: Enable user access before a privcmd hvc call") Signed-off-by: Stefano Stabellini <stefano.stabellini@amd.com> Reviewed-by: Juergen Gross <jgross@suse.com> Message-ID: <alpine.DEB.2.22.394.2505121446370.8380@ubuntu-linux-20-04-desktop> Signed-off-by: Juergen Gross <jgross@suse.com>
2025-05-23xen/x86: fix initial memory balloon targetRoger Pau Monne
When adding extra memory regions as ballooned pages also adjust the balloon target, otherwise when the balloon driver is started it will populate memory to match the target value and consume all the extra memory regions added. This made the usage of the Xen `dom0_mem=,max:` command line parameter for dom0 not work as expected, as the target won't be adjusted and when the balloon is started it will populate memory straight to the 'max:' value. It would equally affect domUs that have memory != maxmem. Kernels built with CONFIG_XEN_UNPOPULATED_ALLOC are not affected, because the extra memory regions are consumed by the unpopulated allocation driver, and then balloon_add_regions() becomes a no-op. Reported-by: John <jw@nuclearfallout.net> Fixes: 87af633689ce ('x86/xen: fix balloon target initialization for PVH dom0') Signed-off-by: Roger Pau Monné <roger.pau@citrix.com> Reviewed-by: Juergen Gross <jgross@suse.com> Tested-by: Marek Marczykowski-Górecki <marmarek@invisiblethingslab.com> Message-ID: <20250514080427.28129-1-roger.pau@citrix.com> Signed-off-by: Juergen Gross <jgross@suse.com>
2025-05-23xen: enable XEN_UNPOPULATED_ALLOC as part of xen.configRoger Pau Monne
PVH dom0 is useless without XEN_UNPOPULATED_ALLOC, as otherwise it will very likely balloon out all dom0 memory to map foreign and grant pages. Enable it by default as part of xen.config. This also requires enabling MEMORY_HOTREMOVE and ZONE_DEVICE. Signed-off-by: Roger Pau Monné <roger.pau@citrix.com> Reviewed-by: Juergen Gross <jgross@suse.com> Message-ID: <20250514092037.28970-1-roger.pau@citrix.com> Signed-off-by: Juergen Gross <jgross@suse.com>
2025-05-23xen: swiotlb: Wire up map_resource callbackJohn Ernberg
When running Xen on iMX8QXP, an Arm SoC without IOMMU, DMA performed via its eDMA v3 DMA engine fail with a mapping error. The eDMA performs DMA between RAM and MMIO space, and it's the MMIO side that cannot be mapped. MMIO->RAM DMA access cannot be bounce buffered if it would straddle a page boundary and on Xen the MMIO space is 1:1 mapped for Arm, and x86 PV Dom0. Cases where MMIO space is not 1:1 mapped, such as x86 PVH Dom0, requires an IOMMU present to deal with the mapping. Considering the above the map_resource callback can just be wired to the existing dma_direct_map_resource() function. There is nothing to do for unmap so the unmap callback is not needed. Signed-off-by: John Ernberg <john.ernberg@actia.se> Reviewed-by: Stefano Stabellini <sstabellini@kernel.org> Message-ID: <20250512071440.3726697-1-john.ernberg@actia.se> Signed-off-by: Juergen Gross <jgross@suse.com>
2025-05-22drm/xe/ptl: Update the PTL pci id tableMatt Atwood
Update to current bspec table. Bspec: 72574 Signed-off-by: Matt Atwood <matthew.s.atwood@intel.com> Reviewed-by: Tejas Upadhyay <tejas.upadhyay@intel.com> Reviewed-by: Clint Taylor <Clinton.A.Taylor@intel.com> Link: https://lore.kernel.org/r/20250520195749.371748-1-matthew.s.atwood@intel.com Signed-off-by: Matt Roper <matthew.d.roper@intel.com> (cherry picked from commit 49c6dc74b5968885f421f9f1b45eb4890b955870) Signed-off-by: Lucas De Marchi <lucas.demarchi@intel.com>
2025-05-22drm/xe: Use xe_mmio_read32() to read mtcfg registerShuicheng Lin
The mtcfg register is a 32-bit register and should therefore be accessed using xe_mmio_read32(). Other 3 changes per codestyle suggestion: " xe_mmio.c:83: CHECK: Alignment should match open parenthesis xe_mmio.c:131: CHECK: Comparison to NULL could be written "!xe->mmio.regs" xe_mmio.c:315: CHECK: line length of 103 exceeds 100 columns " Fixes: dd08ebf6c352 ("drm/xe: Introduce a new DRM driver for Intel GPUs") Reviewed-by: Tejas Upadhyay <tejas.upadhyay@intel.com> Cc: Matt Roper <matthew.d.roper@intel.com> Signed-off-by: Shuicheng Lin <shuicheng.lin@intel.com> Link: https://lore.kernel.org/r/20250513153010.3464767-1-shuicheng.lin@intel.com Signed-off-by: Matt Roper <matthew.d.roper@intel.com> (cherry picked from commit d2662cf8f44a68deb6c76ad9f1d9f29dbf7ba601) Signed-off-by: Lucas De Marchi <lucas.demarchi@intel.com>
2025-05-22drm/xe/mocs: Check if all domains awakeTejas Upadhyay
Check if all domains are awake specially for LNCF regs Fixes: 298661cd9cea ("drm/xe: Fix MOCS debugfs LNCF readout") Improvements-suggested-by: Himal Prasad Ghimiray <himal.prasad.ghimiray@intel.com> Reviewed-by: Badal Nilawar <badal.nilawar@intel.com> Link: https://patchwork.freedesktop.org/patch/msgid/20250506142300.1865783-1-tejas.upadhyay@intel.com Signed-off-by: Tejas Upadhyay <tejas.upadhyay@intel.com> (cherry picked from commit a383cf218ef8bb35d4c03958bd956573b65cf778) Signed-off-by: Lucas De Marchi <lucas.demarchi@intel.com>
2025-05-22Merge tag 'bcachefs-2025-05-22' of git://evilpiepirate.org/bcachefsLinus Torvalds
Pull bcachefs fixes from Kent Overstreet: "Small stuff, main ones users will be interested in: - Couple more casefolding fixes; we can now detect and repair casefolded dirents in non-casefolded dir and vice versa - Fix for massive write inflation with mmapped io, which hit certain databases" * tag 'bcachefs-2025-05-22' of git://evilpiepirate.org/bcachefs: bcachefs: Check for casefolded dirents in non casefolded dirs bcachefs: Fix bch2_dirent_create_snapshot() for casefolding bcachefs: Fix casefold opt via xattr interface bcachefs: mkwrite() now only dirties one page bcachefs: fix extent_has_stripe_ptr() bcachefs: Fix bch2_btree_path_traverse_cached() when paths realloced
2025-05-23erofs: clean up erofs_{init,exit}_sysfs()Gao Xiang
Get rid of useless `goto`s. No logic changes. Signed-off-by: Gao Xiang <hsiangkao@linux.alibaba.com> Link: https://lore.kernel.org/r/20250522084953.412096-1-hsiangkao@linux.alibaba.com
2025-05-22Merge tag 'pmdomain-v6.15-rc3' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/ulfh/linux-pm Pull pmdomain fixes from Ulf Hansson: "Core: - Fix error checking in genpd_dev_pm_attach_by_id() Providers: - renesas: Remove obsolete nullify checks for rcar domains" * tag 'pmdomain-v6.15-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/ulfh/linux-pm: pmdomain: core: Fix error checking in genpd_dev_pm_attach_by_id() pmdomain: renesas: rcar: Remove obsolete nullify checks
2025-05-22Merge tag 'v6.16-rockchip-clk1' of ↵Stephen Boyd
git://git.kernel.org/pub/scm/linux/kernel/git/mmind/linux-rockchip into clk-rockchip Pull Rockchip clk driver updates from Heiko Stuebner: - Ability to handle different "General Register Files" syscons, not just a single system-one, plus ability to model individual gates found there. - For whatever reason Rockchip also moved the mmc-phase-clocks from the clock-unit for the GRF on some newer socs like the rk3528 (before moving them fully to the mmc controller itself on the rk3576), so add a new clock-variant for the phases, reusing the new GRF handling. - The old rk3036 got real handling of the usb480m mux and some PLL rates were added. * tag 'v6.16-rockchip-clk1' of git://git.kernel.org/pub/scm/linux/kernel/git/mmind/linux-rockchip: clk: rockchip: rk3528: add slab.h header include clk: rockchip: rk3576: add missing slab.h include clk: rockchip: rename gate-grf clk file clk: rockchip: rename branch_muxgrf to branch_grf_mux clk: rockchip: Pass NULL as reg pointer when registering GRF MMC clocks clk: rockchip: rk3036: mark ddrphy as critical clk: rockchip: rk3036: fix implementation of usb480m clock mux dt-bindings: clock: rk3036: add SCLK_USB480M clock-id clk: rockchip: rk3528: Add SD/SDIO tuning clocks in GRF region clk: rockchip: Support MMC clocks in GRF region dt-bindings: clock: Add GRF clock definition for RK3528 clk: rockchip: add GATE_GRFs for SAI MCLKOUT to rk3576 clk: rockchip: introduce GRF gates clk: rockchip: introduce auxiliary GRFs dt-bindings: clock: rk3576: add IOC gated clocks clk: rockchip: rk3568: Add PLL rate for 33.3MHz clk: rockchip: Drop empty init callback for rk3588 PLL type clk: rockchip: rk3588: Add PLL rate for 1500 MHz
2025-05-22bpf, sockmap: Avoid using sk_socket after free when sendingJiayuan Chen
The sk->sk_socket is not locked or referenced in backlog thread, and during the call to skb_send_sock(), there is a race condition with the release of sk_socket. All types of sockets(tcp/udp/unix/vsock) will be affected. Race conditions: ''' CPU0 CPU1 backlog::skb_send_sock sendmsg_unlocked sock_sendmsg sock_sendmsg_nosec close(fd): ... ops->release() -> sock_map_close() sk_socket->ops = NULL free(socket) sock->ops->sendmsg ^ panic here ''' The ref of psock become 0 after sock_map_close() executed. ''' void sock_map_close() { ... if (likely(psock)) { ... // !! here we remove psock and the ref of psock become 0 sock_map_remove_links(sk, psock) psock = sk_psock_get(sk); if (unlikely(!psock)) goto no_psock; <=== Control jumps here via goto ... cancel_delayed_work_sync(&psock->work); <=== not executed sk_psock_put(sk, psock); ... } ''' Based on the fact that we already wait for the workqueue to finish in sock_map_close() if psock is held, we simply increase the psock reference count to avoid race conditions. With this patch, if the backlog thread is running, sock_map_close() will wait for the backlog thread to complete and cancel all pending work. If no backlog running, any pending work that hasn't started by then will fail when invoked by sk_psock_get(), as the psock reference count have been zeroed, and sk_psock_drop() will cancel all jobs via cancel_delayed_work_sync(). In summary, we require synchronization to coordinate the backlog thread and close() thread. The panic I catched: ''' Workqueue: events sk_psock_backlog RIP: 0010:sock_sendmsg+0x21d/0x440 RAX: 0000000000000000 RBX: ffffc9000521fad8 RCX: 0000000000000001 ... Call Trace: <TASK> ? die_addr+0x40/0xa0 ? exc_general_protection+0x14c/0x230 ? asm_exc_general_protection+0x26/0x30 ? sock_sendmsg+0x21d/0x440 ? sock_sendmsg+0x3e0/0x440 ? __pfx_sock_sendmsg+0x10/0x10 __skb_send_sock+0x543/0xb70 sk_psock_backlog+0x247/0xb80 ... ''' Fixes: 4b4647add7d3 ("sock_map: avoid race between sock_map_close and sk_psock_put") Reported-by: Michal Luczaj <mhal@rbox.co> Signed-off-by: Jiayuan Chen <jiayuan.chen@linux.dev> Signed-off-by: Martin KaFai Lau <martin.lau@kernel.org> Reviewed-by: John Fastabend <john.fastabend@gmail.com> Link: https://lore.kernel.org/r/20250516141713.291150-1-jiayuan.chen@linux.dev
2025-05-22Merge tag 'mmc-v6.15-rc6' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/ulfh/mmc Pull MMC host fixes from Ulf Hansson: - sdhci_am654: Fix MMC init failures on am62x boards - sdhci-of-dwcmshc: Add PD workaround on RK3576 to avoid hang * tag 'mmc-v6.15-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/ulfh/mmc: mmc: sdhci_am654: Add SDHCI_QUIRK2_SUPPRESS_V1P8_ENA quirk to am62 compatible mmc: sdhci-of-dwcmshc: add PD workaround on RK3576
2025-05-22Merge tag 'sunxi-clk-for-6.16' of ↵Stephen Boyd
https://git.kernel.org/pub/scm/linux/kernel/git/sunxi/linux into clk-allwinner Pull Allwinner clk driver updates from Chen-Yu Tsai: - Add support for DE (display engine) 3.3 clocks on H616 - Add missing LVDS reset control on H616 - Do not enable by default during compile testing * tag 'sunxi-clk-for-6.16' of https://git.kernel.org/pub/scm/linux/kernel/git/sunxi/linux: clk: sunxi-ng: ccu: add Display Engine 3.3 (DE33) support dt-bindings: allwinner: add H616 DE33 clock binding clk: sunxi-ng: h616: Add LVDS reset for LCD TCON dt-bindings: clock: sun50i-h616-ccu: Add LVDS reset clk: sunxi: Do not enable by default during compile testing clk: sunxi-ng: Do not enable by default during compile testing
2025-05-22Merge tag 'clk-meson-v6.16-1' of https://github.com/BayLibre/clk-meson into ↵Stephen Boyd
clk-amlogic Pull Amlogic clk driver updates from Jerome Brunet: - Fix Amlogic G12 SPICC clock sources - Compile test Amlogic clocks only if ARCH_MESON is set * tag 'clk-meson-v6.16-1' of https://github.com/BayLibre/clk-meson: clk: meson: Do not enable by default during compile testing clk: meson-g12a: add missing fclk_div2 to spicc
2025-05-22Merge tag 'samsung-clk-6.16' of ↵Stephen Boyd
https://git.kernel.org/pub/scm/linux/kernel/git/krzk/linux into clk-samsung Pull Samsung SoC clock driver updates from Krzysztof Kozlowski: - Add Samsung ExynosAutov920 CPU cluster CL0, CL1 and CL2 clock controllers - Fix Samsung ExynosAutov920 HSI1 USBDRD clock parents - Minor cleanup for Samsung Exynos4 clk drivers * tag 'samsung-clk-6.16' of https://git.kernel.org/pub/scm/linux/kernel/git/krzk/linux: clk: samsung: correct clock summary for hsi1 block clk: samsung: exynosautov920: Fix incorrect CLKS_NR_CPUCL0 definition clk: samsung: exynosautov920: add cpucl1/2 clock support dt-bindings: clock: exynosautov920: add cpucl1/2 clock definitions clk: samsung: exynosautov920: add cpucl0 clock support dt-bindings: clock: exynosautov920: add cpucl0 clock definitions clk: samsung: Use samsung CCF common function
2025-05-22Merge tag 'renesas-clk-for-v6.16-tag2' of ↵Stephen Boyd
git://git.kernel.org/pub/scm/linux/kernel/git/geert/renesas-drivers into clk-renesas Pull Renesas clk driver updates from Geert Uytterhoeven: - Add Expanded Serial Peripheral Interface (xSPI) clocks and resets on Renesas RZ/G3E * tag 'renesas-clk-for-v6.16-tag2' of git://git.kernel.org/pub/scm/linux/kernel/git/geert/renesas-drivers: clk: renesas: r9a09g047: Add XSPI clock/reset clk: renesas: r9a09g047: Add support for xspi mux and divider dt-bindings: clock: renesas,r9a09g047-cpg: Add XSPI and GBETH PTP core clocks clk: renesas: Use str_on_off() helper
2025-05-22Merge tag 'thead-clk-for-v6.16' of https://github.com/pdp7/linux into clk-theadStephen Boyd
Pull T-HEAD clk driver updates from Drew Fustini: - Clk driver for Video Output (VO) subsystem in the T-HEAD TH1520 SoC * tag 'thead-clk-for-v6.16' of https://github.com/pdp7/linux: clk: thead: Add clock support for VO subsystem in T-HEAD TH1520 SoC dt-bindings: clock: thead: Add TH1520 VO clock controller