Commit Graph

1368207 Commits

Author SHA1 Message Date
Linus Torvalds
5722a6cecf Merge tag 'spi-v6.16' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/spi
Pull spi updates from Mark Brown:
 "The bulk of the changes in this release are driver work, as well as
  new device support we have some important work on performance over
  several drivers, and big overhauls for maintainability on a couple
  too. Highlights include:

   - Big cleanups of the sh-msiof driver from Geert Uytterhoeven, and of
     the NXP FSPI driver from Haibo Chen

   - Performance improvements for the AXI SPI engine

   - Support for writes to memory mapped flashes on Renesas devices

   - Integrated DMA support for Tegra210 QSPI, used by the Tegra234

   - DMA support for Amlogic SPI controllers

   - Support for AMD HID2, Qualcomm IPQ5018, Renesas RZ/G3E, Rockchip
     RK3528 and Samsung Exynos Autov920

  An update to fix some issues with the Atmel QSPI driver runtime PM
  pulled in a new API from the PM core, and the Renesas memory mapped
  write changes pull in some code that's shared in drivers/memory"

* tag 'spi-v6.16' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/spi: (90 commits)
  spi: spi-qpic-snand: return early on error from qcom_spi_io_op()
  spi: loopback-test: fix up const pointer issue in rx_ranges_cmp()
  spi: gpio: fix const issue in spi_to_spi_gpio()
  spi: spi-qpic-snand: remove superfluous parameters of qcom_spi_check_error()
  dt-bindings: spi: samsung: add exynosautov920-spi compatible
  spi: spi-qpic-snand: reuse qcom_spi_check_raw_flash_errors()
  spi: dt-bindings: Add rk3528-spi compatible
  spi: spi_amd: Update Kconfig dependencies
  spi: spi_amd: Add HIDDMA basic write support
  spi: spi_amd: Remove read{q,b} usage on DMA buffer
  spi: sh-msiof: Move register definitions to <linux/spi/sh_msiof.h>
  spi: sh-msiof: Document frame start sync pulse mode
  spi: sh-msiof: Double maximum DMA transfer size using two groups
  spi: sh-msiof: Simplify BRG's Division Ratio
  spi: sh-msiof: Increase TX FIFO size for R-Car V4H/V4M
  spi: sh-msiof: Correct RX FIFO size for R-Car Gen3
  spi: sh-msiof: Correct RX FIFO size for R-Car Gen2
  spi: sh-msiof: Add core support for dual-group transfers
  spi: sh-msiof: Correct SIMDR2_GRPMASK
  spi: sh-msiof: SIFCTR bitfield conversion
  ...
2025-05-27 15:53:55 -07:00
Linus Torvalds
350d9ab736 Merge tag 'regulator-v6.16' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/regulator
Pull regulator updates from Mark Brown:
 "This is a very quiet release, there was no work on the core and a good
  chunk of the updates were the result of conversions to use newer GPIO
  APIs.

  We did gain support for Analog ADP5055 and TI TPS65214 devices, and
  there's a new restart handler for the PCA9450 which allows devices
  using it to be properly power cycled on reboot, but otherwise it's
  minor fixes and API updates"

* tag 'regulator-v6.16' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/regulator: (24 commits)
  regulator: qcom_spmi: Constify struct spmi_voltage_range
  regulator: max8952: Correct Samsung "Electronics" spelling in copyright headers
  regulator: dt-bindings: mt6357: Drop fixed compatible requirement
  regulator: gpio: Use dev_err_probe
  regulator: pca9450: Add restart handler
  regulator: da9121: Fix Wvoid-pointer-to-enum-cast warning
  regulator: tps65219: Add TI TPS65214 Regulator Support
  regulator: tps65219: Add support for TPS65215 Regulator IRQs
  regulator: tps65219: Add support for TPS65215 regulator resources
  regulator: tps65219: Update struct names
  regulator: pf9453: convert to use maple tree register cache
  regulator: max20086: Change enable gpio to optional
  regulator: max20086: Fix MAX200086 chip id
  regulator: adp5055: Remove unneeded semicolon
  regulator: adp5055: remove duplicate device table
  regulator: adp5055: Add driver for adp5055
  regulator: dt-bindings: adi,adp5055-regulator: Add adp5055 support
  regulator: don't compare raw GPIO descriptor pointers
  regulator: rpi-panel-attiny: use new GPIO line value setter callbacks
  regulator: rpi-panel-attiny: use lock guards for the state mutex
  ...
2025-05-27 15:49:58 -07:00
Linus Torvalds
c971f11dbf Merge tag 'regmap-v6.16' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/regmap
Pull regmap updates from Mark Brown:
 "This release we have one new feature, support for chips that report
  edge interrupts but don't provide distinct readback of that status per
  line, plus a few cleanups"

* tag 'regmap-v6.16' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/regmap:
  regmap: irq: Add support for chips without separate IRQ status
  regmap-irq: Use dedicated interrupt wake setters
  regmap: Move selecting for REGMAP_MDIO and REGMAP_IRQ
  regcache: Use sort()'s default swap() implementation
2025-05-27 15:44:26 -07:00
Linus Torvalds
aacc73ceeb Merge tag 'gpio-updates-for-v6.16-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/brgl/linux
Pull gpio updates from Bartosz Golaszewski:
 "We have three new drivers, some refactoring in the GPIO core, lots of
  various changes across many drivers, new configfs interface for the
  virtual gpio-aggregator module and DT-bindings updates.

  The treewide conversion of GPIO drivers to using the new value setter
  callbacks is ongoing with another round of GPIO drivers updated. You
  will also see these commits coming in from other subsystems as with
  the relevant changes merged into mainline last cycle, I've started
  converting GPIO providers located elsewhere than drivers/gpio/.

  GPIO core:
   - use more lock guards where applicable
   - refactor GPIO ACPI code and shrink it in the process by 8%
   - move GPIO ACPI quirks into a separate file
   - remove unneeded #ifdef
   - convert GPIO devres helpers to using devm_add_action() where
     applicable which shrinks and simplifies the code
   - refactor GPIO descriptor validation in GPIO consumer interfaces
   - don't allow setting values on input lines in the GPIO core which
     will take off the burden from GPIO drivers of checking this down
     the line
   - provide gpiod_is_equal() as a way of safely comparing two GPIO
     descriptors (the only current user is in regulator core)

  New drivers:
   - add the GPIO module for the max77759 multifunction device
   - add the GPIO driver for the VeriSilicon BLZP1600 GPIO controller
   - add the GPIO driver for the Spacemit K1 SoC

  Driver improvements:
   - convert more drivers to using the new GPIO line value setter
     callbacks
   - convert more drivers to making the irq_chip immutable as is
     recommended by the interrupt subsystem
   - extend build testing coverage by enabling more modules to be built
     with COMPILE_TEST=y
   - extend the gpio-aggregator module with a configfs interface that
     makes the setup easier for user-space than the existing
     driver-level sysfs attributes and also adds more advanced
     configuration features (such as referring to aggregated lines by
     their original names or modifying their names as exposed by the
     aggregated chip)
   - add a missing mutex_destroy() in gpio-imx-scu
   - add an OF polarity quirk for s5m8767
   - allow building gpio-vf610 as a loadable module
   - make gpio-mxc not hardcode its GPIO base number with GPIO SYSFS
     interface disabled (another small step towards getting rid of the
     global GPIO numberspace)
   - add support for level-triggered interrupts to gpio-pca953x
   - don't double-check the ngpios property in gpio-ds4520 as GPIO core
     already does it
   - don't double-check the number of GPIOs in gpio-imx-scu as GPIO core
     already does it
   - remove unused callbacks from gpio-max3191x

  DT bindings:
   - add device-tree bindings for max77759, spacemit,k1 and blzp1600
     (new drivers added this cycle)
   - document more properties for gpio-vf610 and gpio-tegra186
   - document a new pca95xx variant
   - fix style of examples in several GPIO DT-binding documents

  Misc:
   - TODO list updates"

* tag 'gpio-updates-for-v6.16-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/brgl/linux: (123 commits)
  gpio: timberdale: select GPIOLIB_IRQCHIP
  gpio: lpc18xx: select GPIOLIB_IRQCHIP
  gpio: grgpio: select GPIOLIB_IRQCHIP
  gpio: bcm-kona: select GPIOLIB_IRQCHIP
  dt-bindings: gpio: vf610: add ngpios and gpio-reserved-ranges
  gpio: davinci: select GPIOLIB_IRQCHIP
  gpiolib-acpi: Update file references in the Documentation and MAINTAINERS
  gpiolib: acpi: Move quirks to a separate file
  gpiolib: acpi: Add acpi_gpio_need_run_edge_events_on_boot() getter
  gpiolib: acpi: Handle deferred list via new API
  gpiolib: acpi: Make sure we fill struct acpi_gpio_info
  gpiolib: acpi: Switch to use enum in acpi_gpio_in_ignore_list()
  gpiolib: acpi: Use temporary variable for struct acpi_gpio_info
  gpiolib: remove unneeded #ifdef
  gpio: mpc8xxx: select GPIOLIB_IRQCHIP
  gpio: pxa: select GPIOLIB_IRQCHIP
  gpio: pxa: Make irq_chip immutable
  gpio: timberdale: Make irq_chip immutable
  gpio: xgene-sb: Make irq_chip immutable
  gpio: davinci: Make irq_chip immutable
  ...
2025-05-27 15:22:01 -07:00
Linus Torvalds
a9e6060bb2 Merge tag 'sound-6.16-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound
Pull sound updates from Takashi Iwai:
 "We've received a lot of activities in this cycle, mostly about leaf
  driver codes rather than the core part, but with a good mixture of
  code cleanups and new driver additions. Below are some highlights:

  ASoC:
   - Support for automatically enumerating DAIs from standards
     conforming SoundWire SDCA devices; not much used as of this
     writing, rather for future implementations
   - Conversion of quite a few drivers to newer GPIO APIs
   - Continued cleanups and helper usages in allover places
   - Support for a wider range of Intel AVS platforms
   - Support for AMD ACP 7.x platforms, Cirrus Logic CS35L63 and CS48L32
     Everest Semiconductor ES8375 and ES8389, Longsoon-1 AC'97
     controllers, nVidia Tegra264, Richtek ALC203 and RT9123 and
     Rockchip SAI controllers

  HD-audio:
   - Lots of cleanups of TAS2781 codec drivers
   - A new HD-audio control bound via ACPI for Nvidia
   - Support for Tegra264, Intel WCL, usual new codec quirks

  USB-audio:
   - Fix a race at removal of MIDI device
   - Pioneer DJM-V10 support, Scarlett2 driver cleanups

  Misc:
   - Cleanups of deprecated PCI functions
   - Removal of unused / dead function codes"

* tag 'sound-6.16-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound: (364 commits)
  firmware: cs_dsp: Fix OOB memory read access in KUnit test
  ASoC: codecs: add support for ES8375
  ASoC: dt-bindings: Add Everest ES8375 audio CODEC
  ALSA: hda: acpi: Make driver's match data const static
  ALSA: hda: acpi: Use SYSTEM_SLEEP_PM_OPS()
  ALSA: atmel: Replace deprecated strcpy() with strscpy()
  ALSA: core: fix up bus match const issues.
  ASoC: wm_adsp: Make cirrus_dir const
  ASoC: tegra: Tegra264 support in isomgr_bw
  ASoC: tegra: AHUB: Add Tegra264 support
  ASoC: tegra: ADX: Add Tegra264 support
  ASoC: tegra: AMX: Add Tegra264 support
  ASoC: tegra: I2S: Add Tegra264 support
  ASoC: tegra: Update PLL rate for Tegra264
  ASoC: tegra: ASRC: Update ARAM address
  ASoC: tegra: ADMAIF: Add Tegra264 support
  ASoC: tegra: CIF: Add Tegra264 support
  dt-bindings: ASoC: Document Tegra264 APE support
  dt-bindings: ASoC: admaif: Add missing properties
  ASoC: dt-bindings: audio-graph-card2: reference audio-graph routing property
  ...
2025-05-27 15:05:18 -07:00
Linus Torvalds
11147c16a6 Merge tag 'pwm/for-6.16-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/ukleinek/linux
Pull pwm updates from Uwe Kleine-König:
 "This time around the pwm changes for the next release contain three
  new drivers (loongson, mc33xs2410 and rzg2l-gpt) and the usual
  collection of cleanups in both the core and drivers, support for new
  variants in existing drivers, conversion of dt bindings to yaml and
  documentation updates.

  Thanks for contributions and reviews go to Alexey Charkov,
  AngeloGioacchino Del Regno, Bartosz Golaszewski, Biju Das, Binbin
  Zhou, Dan Carpenter, Dimitri Fedrau, Geert Uytterhoeven, George Stark,
  Huacai Chen, Juxin Gao, Krzysztof Kozlowski, Kuninori Morimoto,
  Laurent Pinchart, Neil Armstrong, Nuno Sá, Rob Herring, and Trevor
  Gamblin"

* tag 'pwm/for-6.16-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/ukleinek/linux: (39 commits)
  dt-bindings: timer: renesas,tpu: remove binding documentation
  pwm: adp5585: make sure to include mod_devicetable.h
  pwm: Tidyup PWM menu for Renesas
  pwm: Restore alphabetic ordering in Kconfig and Makefile
  pwm: Formally describe the procedure used to pick a hardware waveform setting
  pwm: Let pwm_set_waveform_might_sleep() return 0 instead of 1 after rounding up
  pwm: Let pwm_set_waveform_might_sleep() fail for exact but impossible requests
  ARM: shmobile: defconfig: Enable more support for RZN1D-DB/EB
  arm64: defconfig: Add Renesas MSIOF sound support
  arm64: defconfig: Enable Renesas RZ/G2L GPT config
  pwm: add support for NXPs high-side switch MC33XS2410
  dt-bindings: pwm: add support for MC33XS2410
  pwm: rzg2l-gpt: Accept requests for too high period length
  dt-bindings: pwm: vt8500-pwm: Convert to YAML
  dt-bindings: pwm: mediatek,pwm-disp: Add compatible for MT6893
  pwm: Fix various formatting issues in kernel-doc
  pwm: Add support for RZ/G2L GPT
  dt-bindings: pwm: Add RZ/G2L GPT binding
  pwm: Better document return value of pwm_round_waveform_might_sleep()
  pwm: loongson: Fix an error code in probe()
  ...
2025-05-27 15:01:47 -07:00
Linus Torvalds
d48d8380d9 Merge tag 'chrome-platform-v6.16' of git://git.kernel.org/pub/scm/linux/kernel/git/chrome-platform/linux
Pull chrome-platform updates from Tzung-Bi Shih:
 "New:

   - Support MT8192 Spherion and MT8186 Corsola devices in of_hw_prober

   - Turn cros_ec_proto from bool into tristate

   - Support Pin Assignment E in cros_ec_typec for USB-C to DP cables

  Improvements:

   - Avoid -Wflex-array-member-not-at-end warnings

  Cleanups:

   - Remove a redundant dependency in Kconfig for cros_kbd_led_backlight"

* tag 'chrome-platform-v6.16' of git://git.kernel.org/pub/scm/linux/kernel/git/chrome-platform/linux:
  platform/chrome: kunit: Avoid -Wflex-array-member-not-at-end
  platform/chrome: cros_ec_typec: Set Pin Assignment E in DP PORT VDO
  platform/chrome: of_hw_prober: Support touchscreen probing on Squirtle
  platform/chrome: of_hw_prober: Support trackpad probing on Corsola family
  platform/chrome: cros_kbd_led_backlight: Fix build dependencies
  platform/chrome: cros_kbd_led_backlight: Remove CROS_EC dependency
  platform/chrome: cros_ec_proto: Allow to build as module
  platform/chrome: cros_ec_debugfs: Avoid -Wflex-array-member-not-at-end warnings
  platform/chrome: cros_kbd_led_backlight: Avoid -Wflex-array-member-not-at-end warnings
  platform/chrome: cros_ec_proto: Avoid -Wflex-array-member-not-at-end warnings
  platform/chrome: of_hw_prober: Support Google Spherion
2025-05-27 14:54:35 -07:00
Linus Torvalds
bad14b5d2c Remove legacy 'cc-disable-warning' use from the generic build scripts
This just converts the 'cc-disable-warning' uses in the generic makefile
extrawarn script to use the plain 'cc-option' form instead.  Partly to
clean things up, and partly just to have the new form get some proper
test coverage.

I'll leave the various random other uses of 'cc-disable-warning' alone
and let subsystem maintainers decide if they want to convert to the new
unified model.

Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
2025-05-27 14:40:30 -07:00
Linus Torvalds
550ccb178d Make 'cc-option' work correctly for the -Wno-xyzzy pattern
This is the follow-up to commit a79be02bba ("Fix mis-uses of
'cc-option' for warning disablement") where I mentioned that the best
fix would be to just make 'cc-option' a bit smarter, and work for all
compiler options, including the '-Wno-xyzzy' pattern that it used to
accept unknown options for.

It turns out that fixing cc-option is pretty straightforward: just
rewrite any '-Wno-xyzzy' option pattern to use '-Wxyzzy' instead for
testing.

That makes the whole artificial distinction between 'cc-option' and
'cc-disable-warning' go away, and we can happily forget about the odd
build rule that you have to treat compiler options that disable warnings
specially.

The 'cc-disable-warning' helper remains as a backwards compatibility
syntax for now, but is implemented in terms of the new and improved
cc-option.

Acked-by: Masahiro Yamada <masahiroy@kernel.org>
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Cc: Arnd Bergmann <arnd@arndb.de>
Cc: Stephen Rothwell <sfr@canb.auug.org.au>
Cc: Thomas Weißschuh <linux@weissschuh.net>
Cc: Nathan Chancellor <nathan@kernel.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
2025-05-27 14:35:51 -07:00
Yonghong Song
5ffb537e41 selftests/bpf: Add tests with stack ptr register in conditional jmp
Add two tests:
  - one test has 'rX <op> r10' where rX is not r10, and
  - another test has 'rX <op> rY' where rX and rY are not r10
    but there is an early insn 'rX = r10'.

Without previous verifier change, both tests will fail.

Signed-off-by: Yonghong Song <yonghong.song@linux.dev>
Signed-off-by: Andrii Nakryiko <andrii@kernel.org>
Link: https://lore.kernel.org/bpf/20250524041340.4046304-1-yonghong.song@linux.dev
2025-05-27 14:09:12 -07:00
Yonghong Song
e2d2115e56 bpf: Do not include stack ptr register in precision backtracking bookkeeping
Yi Lai reported an issue ([1]) where the following warning appears
in kernel dmesg:
  [   60.643604] verifier backtracking bug
  [   60.643635] WARNING: CPU: 10 PID: 2315 at kernel/bpf/verifier.c:4302 __mark_chain_precision+0x3a6c/0x3e10
  [   60.648428] Modules linked in: bpf_testmod(OE)
  [   60.650471] CPU: 10 UID: 0 PID: 2315 Comm: test_progs Tainted: G           OE       6.15.0-rc4-gef11287f8289-dirty #327 PREEMPT(full)
  [   60.654385] Tainted: [O]=OOT_MODULE, [E]=UNSIGNED_MODULE
  [   60.656682] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.14.0-0-g155821a1990b-prebuilt.qemu.org 04/01/2014
  [   60.660475] RIP: 0010:__mark_chain_precision+0x3a6c/0x3e10
  [   60.662814] Code: 5a 30 84 89 ea e8 c4 d9 01 00 80 3d 3e 7d d8 04 00 0f 85 60 fa ff ff c6 05 31 7d d8 04
                       01 48 c7 c7 00 58 30 84 e8 c4 06 a5 ff <0f> 0b e9 46 fa ff ff 48 ...
  [   60.668720] RSP: 0018:ffff888116cc7298 EFLAGS: 00010246
  [   60.671075] RAX: 54d70e82dfd31900 RBX: ffff888115b65e20 RCX: 0000000000000000
  [   60.673659] RDX: 0000000000000001 RSI: 0000000000000004 RDI: 00000000ffffffff
  [   60.676241] RBP: 0000000000000400 R08: ffff8881f6f23bd3 R09: 1ffff1103ede477a
  [   60.678787] R10: dffffc0000000000 R11: ffffed103ede477b R12: ffff888115b60ae8
  [   60.681420] R13: 1ffff11022b6cbc4 R14: 00000000fffffff2 R15: 0000000000000001
  [   60.684030] FS:  00007fc2aedd80c0(0000) GS:ffff88826fa8a000(0000) knlGS:0000000000000000
  [   60.686837] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
  [   60.689027] CR2: 000056325369e000 CR3: 000000011088b002 CR4: 0000000000370ef0
  [   60.691623] Call Trace:
  [   60.692821]  <TASK>
  [   60.693960]  ? __pfx_verbose+0x10/0x10
  [   60.695656]  ? __pfx_disasm_kfunc_name+0x10/0x10
  [   60.697495]  check_cond_jmp_op+0x16f7/0x39b0
  [   60.699237]  do_check+0x58fa/0xab10
  ...

Further analysis shows the warning is at line 4302 as below:

  4294                 /* static subprog call instruction, which
  4295                  * means that we are exiting current subprog,
  4296                  * so only r1-r5 could be still requested as
  4297                  * precise, r0 and r6-r10 or any stack slot in
  4298                  * the current frame should be zero by now
  4299                  */
  4300                 if (bt_reg_mask(bt) & ~BPF_REGMASK_ARGS) {
  4301                         verbose(env, "BUG regs %x\n", bt_reg_mask(bt));
  4302                         WARN_ONCE(1, "verifier backtracking bug");
  4303                         return -EFAULT;
  4304                 }

With the below test (also in the next patch):
  __used __naked static void __bpf_jmp_r10(void)
  {
	asm volatile (
	"r2 = 2314885393468386424 ll;"
	"goto +0;"
	"if r2 <= r10 goto +3;"
	"if r1 >= -1835016 goto +0;"
	"if r2 <= 8 goto +0;"
	"if r3 <= 0 goto +0;"
	"exit;"
	::: __clobber_all);
  }

  SEC("?raw_tp")
  __naked void bpf_jmp_r10(void)
  {
	asm volatile (
	"r3 = 0 ll;"
	"call __bpf_jmp_r10;"
	"r0 = 0;"
	"exit;"
	::: __clobber_all);
  }

The following is the verifier failure log:
  0: (18) r3 = 0x0                      ; R3_w=0
  2: (85) call pc+2
  caller:
   R10=fp0
  callee:
   frame1: R1=ctx() R3_w=0 R10=fp0
  5: frame1: R1=ctx() R3_w=0 R10=fp0
  ; asm volatile ("                                 \ @ verifier_precision.c:184
  5: (18) r2 = 0x20202000256c6c78       ; frame1: R2_w=0x20202000256c6c78
  7: (05) goto pc+0
  8: (bd) if r2 <= r10 goto pc+3        ; frame1: R2_w=0x20202000256c6c78 R10=fp0
  9: (35) if r1 >= 0xffe3fff8 goto pc+0         ; frame1: R1=ctx()
  10: (b5) if r2 <= 0x8 goto pc+0
  mark_precise: frame1: last_idx 10 first_idx 0 subseq_idx -1
  mark_precise: frame1: regs=r2 stack= before 9: (35) if r1 >= 0xffe3fff8 goto pc+0
  mark_precise: frame1: regs=r2 stack= before 8: (bd) if r2 <= r10 goto pc+3
  mark_precise: frame1: regs=r2,r10 stack= before 7: (05) goto pc+0
  mark_precise: frame1: regs=r2,r10 stack= before 5: (18) r2 = 0x20202000256c6c78
  mark_precise: frame1: regs=r10 stack= before 2: (85) call pc+2
  BUG regs 400

The main failure reason is due to r10 in precision backtracking bookkeeping.
Actually r10 is always precise and there is no need to add it for the precision
backtracking bookkeeping.

One way to fix the issue is to prevent bt_set_reg() if any src/dst reg is
r10. Andrii suggested to go with push_insn_history() approach to avoid
explicitly checking r10 in backtrack_insn().

This patch added push_insn_history() support for cond_jmp like 'rX <op> rY'
operations. In check_cond_jmp_op(), if any of rX or rY is a stack pointer,
push_insn_history() will record such information, and later backtrack_insn()
will do bt_set_reg() properly for those register(s).

  [1] https://lore.kernel.org/bpf/Z%2F8q3xzpU59CIYQE@ly-workstation/

Reported by: Yi Lai <yi1.lai@linux.intel.com>

Fixes: 407958a0e9 ("bpf: encapsulate precision backtracking bookkeeping")
Signed-off-by: Yonghong Song <yonghong.song@linux.dev>
Signed-off-by: Andrii Nakryiko <andrii@kernel.org>
Link: https://lore.kernel.org/bpf/20250524041335.4046126-1-yonghong.song@linux.dev
2025-05-27 14:09:12 -07:00
Namhyung Kim
0e71bcdcf1 perf test: Add AMD IBS sw filter test
The kernel v6.14 added 'swfilt' to support privilege filtering in
software so that IBS can be used by regular users.  Add a test case in
x86 to verify the behavior.

  $ sudo perf test -vv 'IBS software filter'
  113: AMD IBS software filtering:
  --- start ---
  test child forked, pid 178826
  check availability of IBS swfilt
  run perf record with modifier and swfilt
  [ perf record: Woken up 3 times to write data ]
  [ perf record: Captured and wrote 0.000 MB /dev/null ]
  [ perf record: Woken up 3 times to write data ]
  [ perf record: Captured and wrote 0.000 MB /dev/null ]
  [ perf record: Woken up 3 times to write data ]
  [ perf record: Captured and wrote 0.000 MB /dev/null ]
  [ perf record: Woken up 0 times to write data ]
  [ perf record: Captured and wrote 0.000 MB /dev/null ]
  check number of samples with swfilt
  [ perf record: Woken up 3 times to write data ]
  [ perf record: Captured and wrote 0.037 MB - ]
  [ perf record: Woken up 3 times to write data ]
  [ perf record: Captured and wrote 0.041 MB - ]
  ---- end(0) ----
  113: AMD IBS software filtering                                      : Ok

Reviewed-by: Ravi Bangoria <ravi.bangoria@amd.com>
Signed-off-by: Namhyung Kim <namhyung@kernel.org>
Tested-by: Arnaldo Carvalho de Melo <acme@redhat.com> # On a 9950x3d
Cc: Adrian Hunter <adrian.hunter@intel.com>
Cc: Ian Rogers <irogers@google.com>
Cc: Ingo Molnar <mingo@kernel.org>
Cc: Jiri Olsa <jolsa@kernel.org>
Cc: Kan Liang <kan.liang@linux.intel.com>
Cc: Peter Zijlstra <peterz@infradead.org>
Link: https://lore.kernel.org/r/20250524002754.1266681-1-namhyung@kernel.org
Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
2025-05-27 18:07:02 -03:00
Yicong Yang
fa9b3578ed perf mem: Count L2 HITM for c2c statistic
L2 HITM is not counted in c2c statistic decoding. Count it for lcl_hitm
like how we handle L2 Peer snoop.

Reviewed-by: Leo Yan <leo.yan@arm.com>
Signed-off-by: Yicong Yang <yangyicong@hisilicon.com>
Cc: CaiJingtao <caijingtao@huawei.com>
Cc: Catalin Marinas <catalin.marinas@arm.com>
Cc: Ian Rogers <irogers@google.com>
Cc: Ingo Molnar <mingo@redhat.com>
Cc: James Clark <james.clark@linaro.org>
Cc: Jiri Olsa <jolsa@kernel.org>
Cc: John Garry <john.g.garry@oracle.com>
Cc: Jonathan Cameron <jonathan.cameron@huawei.com>
Cc: Junhao He <hejunhao3@huawei.com>
Cc: Leo Yan <leo.yan@linux.dev>
Cc: Mark Rutland <mark.rutland@arm.com>
Cc: Namhyung Kim <namhyung@kernel.org>
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: Will Deacon <will@kernel.org>
Cc: Yushan Wang <wangyushan12@huawei.com>
Cc: Zeng Tao <prime.zeng@hisilicon.com>
Cc: xueshan2@huawei.com
Link: https://lore.kernel.org/r/20250425033845.57671-4-yangyicong@huawei.com
Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
2025-05-27 18:05:28 -03:00
Yicong Yang
846b62b343 perf arm-spe: Add support for SPE Data Source packet on HiSilicon HIP12
Add data source encoding for HiSilicon HIP12 and coresponding mapping
to the perf's memory data source. This will help to synthesize the data
and support upper layer tools like perf-mem and perf-c2c.

Reviewed-by: Leo Yan <leo.yan@arm.com>
Signed-off-by: Yicong Yang <yangyicong@hisilicon.com>
Cc: CaiJingtao <caijingtao@huawei.com>
Cc: Catalin Marinas <catalin.marinas@arm.com>
Cc: Ian Rogers <irogers@google.com>
Cc: Ingo Molnar <mingo@redhat.com>
Cc: James Clark <james.clark@linaro.org>
Cc: Jiri Olsa <jolsa@kernel.org>
Cc: John Garry <john.g.garry@oracle.com>
Cc: Jonathan Cameron <jonathan.cameron@huawei.com>
Cc: Junhao He <hejunhao3@huawei.com>
Cc: Leo Yan <leo.yan@linux.dev>
Cc: Mark Rutland <mark.rutland@arm.com>
Cc: Namhyung Kim <namhyung@kernel.org>
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: Will Deacon <will@kernel.org>
Cc: Yushan Wang <wangyushan12@huawei.com>
Cc: Zeng Tao <prime.zeng@hisilicon.com>
Cc: xueshan2@huawei.com
Link: https://lore.kernel.org/r/20250425033845.57671-3-yangyicong@huawei.com
Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
2025-05-27 17:57:58 -03:00
Rob Herring (Arm)
a39a3fbe31 dt-bindings: arm/cpus: Allow 2 power-domains entries
Some platforms have both "perf" and "psci" power domains, so allow 2
entries.

Signed-off-by: Rob Herring (Arm) <robh@kernel.org>
2025-05-27 15:34:38 -05:00
Damon Ding
6579a03e68 drm/bridge: analogix_dp: Remove the unnecessary calls to clk_disable_unprepare() during probing
With the commit f37952339c ("drm/bridge: analogix_dp: handle clock via
runtime PM"), the PM operations can help enable/disable the clock. The
err_disable_clk label and clk_disable_unprepare() operations are no
longer necessary because the analogix_dp_resume() will not be called
during probing.

Fixes: f37952339c ("drm/bridge: analogix_dp: handle clock via runtime PM")
Suggested-by: Douglas Anderson <dianders@chromium.org>
Reviewed-by: Douglas Anderson <dianders@chromium.org>
Signed-off-by: Damon Ding <damon.ding@rock-chips.com>
Reviewed-by: Heiko Stuebner <heiko@sntech.de>
Link: https://lore.kernel.org/r/20250302083043.3197235-1-damon.ding@rock-chips.com
Signed-off-by: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com>
2025-05-27 23:13:08 +03:00
Nicolas Frattaroli
be9b3f9a54 drm/connector: only call HDMI audio helper plugged cb if non-null
On driver remove, sound/soc/codecs/hdmi-codec.c calls the plugged_cb
with NULL as the callback function and codec_dev, as seen in its
hdmi_remove function.

The HDMI audio helper then happily tries calling said null function
pointer, and produces an Oops as a result.

Fix this by only executing the callback if fn is non-null. This means
the .plugged_cb and .plugged_cb_dev members still get appropriately
cleared.

Fixes: baf616647f ("drm/connector: implement generic HDMI audio helpers")
Signed-off-by: Nicolas Frattaroli <nicolas.frattaroli@collabora.com>
Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com>
Link: https://lore.kernel.org/r/20250527-hdmi-audio-helper-remove-fix-v1-1-6cf77de364d8@collabora.com
Signed-off-by: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com>
2025-05-27 23:08:21 +03:00
Steven Rostedt
c98cc9797b ring-buffer: Move cpus_read_lock() outside of buffer->mutex
Running a modified trace-cmd record --nosplice where it does a mmap of the
ring buffer when '--nosplice' is set, caused the following lockdep splat:

 ======================================================
 WARNING: possible circular locking dependency detected
 6.15.0-rc7-test-00002-gfb7d03d8a82f #551 Not tainted
 ------------------------------------------------------
 trace-cmd/1113 is trying to acquire lock:
 ffff888100062888 (&buffer->mutex){+.+.}-{4:4}, at: ring_buffer_map+0x11c/0xe70

 but task is already holding lock:
 ffff888100a5f9f8 (&cpu_buffer->mapping_lock){+.+.}-{4:4}, at: ring_buffer_map+0xcf/0xe70

 which lock already depends on the new lock.

 the existing dependency chain (in reverse order) is:

 -> #5 (&cpu_buffer->mapping_lock){+.+.}-{4:4}:
        __mutex_lock+0x192/0x18c0
        ring_buffer_map+0xcf/0xe70
        tracing_buffers_mmap+0x1c4/0x3b0
        __mmap_region+0xd8d/0x1f70
        do_mmap+0x9d7/0x1010
        vm_mmap_pgoff+0x20b/0x390
        ksys_mmap_pgoff+0x2e9/0x440
        do_syscall_64+0x79/0x1c0
        entry_SYSCALL_64_after_hwframe+0x76/0x7e

 -> #4 (&mm->mmap_lock){++++}-{4:4}:
        __might_fault+0xa5/0x110
        _copy_to_user+0x22/0x80
        _perf_ioctl+0x61b/0x1b70
        perf_ioctl+0x62/0x90
        __x64_sys_ioctl+0x134/0x190
        do_syscall_64+0x79/0x1c0
        entry_SYSCALL_64_after_hwframe+0x76/0x7e

 -> #3 (&cpuctx_mutex){+.+.}-{4:4}:
        __mutex_lock+0x192/0x18c0
        perf_event_init_cpu+0x325/0x7c0
        perf_event_init+0x52a/0x5b0
        start_kernel+0x263/0x3e0
        x86_64_start_reservations+0x24/0x30
        x86_64_start_kernel+0x95/0xa0
        common_startup_64+0x13e/0x141

 -> #2 (pmus_lock){+.+.}-{4:4}:
        __mutex_lock+0x192/0x18c0
        perf_event_init_cpu+0xb7/0x7c0
        cpuhp_invoke_callback+0x2c0/0x1030
        __cpuhp_invoke_callback_range+0xbf/0x1f0
        _cpu_up+0x2e7/0x690
        cpu_up+0x117/0x170
        cpuhp_bringup_mask+0xd5/0x120
        bringup_nonboot_cpus+0x13d/0x170
        smp_init+0x2b/0xf0
        kernel_init_freeable+0x441/0x6d0
        kernel_init+0x1e/0x160
        ret_from_fork+0x34/0x70
        ret_from_fork_asm+0x1a/0x30

 -> #1 (cpu_hotplug_lock){++++}-{0:0}:
        cpus_read_lock+0x2a/0xd0
        ring_buffer_resize+0x610/0x14e0
        __tracing_resize_ring_buffer.part.0+0x42/0x120
        tracing_set_tracer+0x7bd/0xa80
        tracing_set_trace_write+0x132/0x1e0
        vfs_write+0x21c/0xe80
        ksys_write+0xf9/0x1c0
        do_syscall_64+0x79/0x1c0
        entry_SYSCALL_64_after_hwframe+0x76/0x7e

 -> #0 (&buffer->mutex){+.+.}-{4:4}:
        __lock_acquire+0x1405/0x2210
        lock_acquire+0x174/0x310
        __mutex_lock+0x192/0x18c0
        ring_buffer_map+0x11c/0xe70
        tracing_buffers_mmap+0x1c4/0x3b0
        __mmap_region+0xd8d/0x1f70
        do_mmap+0x9d7/0x1010
        vm_mmap_pgoff+0x20b/0x390
        ksys_mmap_pgoff+0x2e9/0x440
        do_syscall_64+0x79/0x1c0
        entry_SYSCALL_64_after_hwframe+0x76/0x7e

 other info that might help us debug this:

 Chain exists of:
   &buffer->mutex --> &mm->mmap_lock --> &cpu_buffer->mapping_lock

  Possible unsafe locking scenario:

        CPU0                    CPU1
        ----                    ----
   lock(&cpu_buffer->mapping_lock);
                                lock(&mm->mmap_lock);
                                lock(&cpu_buffer->mapping_lock);
   lock(&buffer->mutex);

  *** DEADLOCK ***

 2 locks held by trace-cmd/1113:
  #0: ffff888106b847e0 (&mm->mmap_lock){++++}-{4:4}, at: vm_mmap_pgoff+0x192/0x390
  #1: ffff888100a5f9f8 (&cpu_buffer->mapping_lock){+.+.}-{4:4}, at: ring_buffer_map+0xcf/0xe70

 stack backtrace:
 CPU: 5 UID: 0 PID: 1113 Comm: trace-cmd Not tainted 6.15.0-rc7-test-00002-gfb7d03d8a82f #551 PREEMPT
 Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
 Call Trace:
  <TASK>
  dump_stack_lvl+0x6e/0xa0
  print_circular_bug.cold+0x178/0x1be
  check_noncircular+0x146/0x160
  __lock_acquire+0x1405/0x2210
  lock_acquire+0x174/0x310
  ? ring_buffer_map+0x11c/0xe70
  ? ring_buffer_map+0x11c/0xe70
  ? __mutex_lock+0x169/0x18c0
  __mutex_lock+0x192/0x18c0
  ? ring_buffer_map+0x11c/0xe70
  ? ring_buffer_map+0x11c/0xe70
  ? function_trace_call+0x296/0x370
  ? __pfx___mutex_lock+0x10/0x10
  ? __pfx_function_trace_call+0x10/0x10
  ? __pfx___mutex_lock+0x10/0x10
  ? _raw_spin_unlock+0x2d/0x50
  ? ring_buffer_map+0x11c/0xe70
  ? ring_buffer_map+0x11c/0xe70
  ? __mutex_lock+0x5/0x18c0
  ring_buffer_map+0x11c/0xe70
  ? do_raw_spin_lock+0x12d/0x270
  ? find_held_lock+0x2b/0x80
  ? _raw_spin_unlock+0x2d/0x50
  ? rcu_is_watching+0x15/0xb0
  ? _raw_spin_unlock+0x2d/0x50
  ? trace_preempt_on+0xd0/0x110
  tracing_buffers_mmap+0x1c4/0x3b0
  __mmap_region+0xd8d/0x1f70
  ? ring_buffer_lock_reserve+0x99/0xff0
  ? __pfx___mmap_region+0x10/0x10
  ? ring_buffer_lock_reserve+0x99/0xff0
  ? __pfx_ring_buffer_lock_reserve+0x10/0x10
  ? __pfx_ring_buffer_lock_reserve+0x10/0x10
  ? bpf_lsm_mmap_addr+0x4/0x10
  ? security_mmap_addr+0x46/0xd0
  ? lock_is_held_type+0xd9/0x130
  do_mmap+0x9d7/0x1010
  ? 0xffffffffc0370095
  ? __pfx_do_mmap+0x10/0x10
  vm_mmap_pgoff+0x20b/0x390
  ? __pfx_vm_mmap_pgoff+0x10/0x10
  ? 0xffffffffc0370095
  ksys_mmap_pgoff+0x2e9/0x440
  do_syscall_64+0x79/0x1c0
  entry_SYSCALL_64_after_hwframe+0x76/0x7e
 RIP: 0033:0x7fb0963a7de2
 Code: 00 00 00 0f 1f 44 00 00 41 f7 c1 ff 0f 00 00 75 27 55 89 cd 53 48 89 fb 48 85 ff 74 3b 41 89 ea 48 89 df b8 09 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 76 5b 5d c3 0f 1f 00 48 8b 05 e1 9f 0d 00 64
 RSP: 002b:00007ffdcc8fb878 EFLAGS: 00000246 ORIG_RAX: 0000000000000009
 RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007fb0963a7de2
 RDX: 0000000000000001 RSI: 0000000000001000 RDI: 0000000000000000
 RBP: 0000000000000001 R08: 0000000000000006 R09: 0000000000000000
 R10: 0000000000000001 R11: 0000000000000246 R12: 0000000000000000
 R13: 00007ffdcc8fbe68 R14: 00007fb096628000 R15: 00005633e01a5c90
  </TASK>

The issue is that cpus_read_lock() is taken within buffer->mutex. The
memory mapped pages are taken with the mmap_lock held. The buffer->mutex
is taken within the cpu_buffer->mapping_lock. There's quite a chain with
all these locks, where the deadlock can be fixed by moving the
cpus_read_lock() outside the taking of the buffer->mutex.

Cc: stable@vger.kernel.org
Cc: Masami Hiramatsu <mhiramat@kernel.org>
Cc: Mathieu Desnoyers <mathieu.desnoyers@efficios.com>
Cc: Vincent Donnefort <vdonnefort@google.com>
Link: https://lore.kernel.org/20250527105820.0f45d045@gandalf.local.home
Fixes: 117c39200d ("ring-buffer: Introducing ring-buffer mapping functions")
Signed-off-by: Steven Rostedt (Google) <rostedt@goodmis.org>
2025-05-27 15:46:39 -04:00
Radhey Shyam Pandey
577ce77c84 dt-bindings: usb: dwc3-xilinx: allow dma-coherent
On Versal Gen 2 SoC the LPD USB DMA controller is coherent with the CPU
so allow specifying the information.

Signed-off-by: Radhey Shyam Pandey <radhey.shyam.pandey@amd.com>
Link: https://lore.kernel.org/r/1747401516-286356-1-git-send-email-radhey.shyam.pandey@amd.com
Signed-off-by: Rob Herring (Arm) <robh@kernel.org>
2025-05-27 14:37:32 -05:00
Alexander Stein
08fbd355be media: dt-bindings: sony,imx219: Allow props from video-interface-devices
Allow properties from video-interface-devices. The change is identical to
commit b6339ecfd0 ("media: dt-bindings: sony,imx290: Allow props from
video-interface-devices")

Signed-off-by: Alexander Stein <alexander.stein@ew.tq-group.com>
Reviewed-by: Jai Luthra <jai.luthra@ideasonboard.com>
Link: https://lore.kernel.org/r/20250515142945.1348722-1-alexander.stein@ew.tq-group.com
Signed-off-by: Rob Herring (Arm) <robh@kernel.org>
2025-05-27 14:37:32 -05:00
Krzysztof Kozlowski
3e188f8f68 dt-bindings: soundwire: qcom: Document v2.1.0 version of IP block
All Qualcomm SoC Soundwire controllers are version-detectable (even
1.x), however certain unidentified quirks might be potentially needed,
so document v2.1 version used on Qualcomm SM8650 and SM8750 SoCs,
fallbacking to v2.0.

Suggested-by: Konrad Dybcio <konrad.dybcio@oss.qualcomm.com>
Signed-off-by: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
Link: https://lore.kernel.org/r/20250519080453.29858-2-krzysztof.kozlowski@linaro.org
Signed-off-by: Rob Herring (Arm) <robh@kernel.org>
2025-05-27 14:37:32 -05:00
Kees Cook
368556dd23 wifi: iwlwifi: mld: Work around Clang loop unrolling bug
The nested loop in iwl_mld_send_proto_offload() confuses Clang into
thinking there could be a final loop iteration past the end of the
"nsc" array (which is only 4 entries). The FORTIFY checking in memcmp()
(via ipv6_addr_cmp()) notices this (due to the available bytes in the
out-of-bounds position of &nsc[4] being 0), and errors out, failing
the build. For some reason (likely due to architectural loop unrolling
configurations), this is only exposed on ARM builds currently. Due to
Clang's lack of inline tracking[1], the warning is not very helpful:

include/linux/fortify-string.h:719:4: error: call to '__read_overflow' declared with 'error' attribute: detected read beyond size of object (1st parameter)
  719 |                         __read_overflow();
      |                         ^
1 error generated.

But this was tracked down to iwl_mld_send_proto_offload()'s
ipv6_addr_cmp() call.

An upstream Clang bug has been filed[2] to track this. For now fix the
build by explicitly bounding the inner loop by "n_nsc", which is what
"c" is already limited to.

Reported-by: Nathan Chancellor <nathan@kernel.org>
Closes: https://github.com/ClangBuiltLinux/linux/issues/2076
Link: https://github.com/llvm/llvm-project/pull/73552 [1]
Link: https://github.com/llvm/llvm-project/issues/136603 [2]
Link: https://lore.kernel.org/r/20250421204153.work.935-kees@kernel.org
Signed-off-by: Kees Cook <kees@kernel.org>
2025-05-27 12:26:00 -07:00
Rodrigo Vivi
39578fa404 drm/xe: Add missing documentation of rpa_freq
While at it, already adjust the rpe_freq frequency, to highlight
that both are calculated by PCODE at runtime.

Fixes: c6aac2fa77 ("drm/xe: Introduce the RPa information")
Cc: Vinay Belgaumkar <vinay.belgaumkar@intel.com>
Cc: Lucas De Marchi <lucas.demarchi@intel.com>
Reviewed-by: Lucas De Marchi <lucas.demarchi@intel.com>
Reviewed-by: Vinay Belgaumkar <vinay.belgaumkar@intel.com>
Link: https://lore.kernel.org/r/20250521165146.39616-4-rodrigo.vivi@intel.com
Signed-off-by: Rodrigo Vivi <rodrigo.vivi@intel.com>
2025-05-27 15:25:06 -04:00
Rodrigo Vivi
af53f0fd99 drm/xe: Make xe_gt_freq part of the Documentation
The documentation was created with the creation of the component,
however it has never been actually shown in the actual Documentation.

While doing this, fixes the identation style, to avoid new warnings
while building htmldocs.

Fixes: bef52b5c7a ("drm/xe: Create a xe_gt_freq component for raw management and sysfs")
Reviewed-by: Lucas De Marchi <lucas.demarchi@intel.com>
Link: https://lore.kernel.org/r/20250521165146.39616-3-rodrigo.vivi@intel.com
Signed-off-by: Rodrigo Vivi <rodrigo.vivi@intel.com>
2025-05-27 15:25:05 -04:00
Frank Li
cf0da5b0e0 dt-bindings: watchdog: fsl-imx-wdt: add compatible string fsl,ls1021a-wdt
Add compatible string fsl,ls1021a-wdt for ls1021a SoC. fsl,ls1021a-wdt
allow big-endian property.

Signed-off-by: Frank Li <Frank.Li@nxp.com>
Acked-by: Conor Dooley <conor.dooley@microchip.com>
Link: https://lore.kernel.org/r/20250522194732.493624-1-Frank.Li@nxp.com
Signed-off-by: Rob Herring (Arm) <robh@kernel.org>
2025-05-27 14:06:36 -05:00
Rob Herring (Arm)
b18d797fa4 dt-bindings: pinctrl: amlogic,pinctrl-a4: Add missing constraint on allowed 'group' node properties
The "^group-[0-9a-z-]+$" nodes schema doesn't constrain the allowed
properties as the referenced common schemas don't have constraints.
Add the missing "unevaluatedProperties" constraint.

Acked-by: Conor Dooley <conor.dooley@microchip.com>
Link: https://lore.kernel.org/r/20250507215852.2748420-1-robh@kernel.org
Signed-off-by: Rob Herring (Arm) <robh@kernel.org>
2025-05-27 14:06:36 -05:00
Christian Brauner
5722bcd7d3 Merge patch series "dropbehind fixes and cleanups"
Jens Axboe <axboe@kernel.dk> says:

As per the thread here:

https://lore.kernel.org/linux-fsdevel/20250525083209.GS2023217@ZenIV/

there was an issue with the dropbehind support, and hence it got
reverted (effectively) for the 6.15 kernel release. The problem stems
from the fact that the folio can get redirtied and/or scheduled for
writeback after the initial dropbehind test, and before we have it
locked again for invalidation.

Patches 1+2 add a generic helper that both the read and write side can
use, and which checks for !dirty && !writeback before going ahead with
the invalidation. Patch 3 reverts the FOP_DONTCACHE disable, and patches
4 and 5 do a bit of cleanup work to further unify how the read and write
side handling works.

This can reasonably be considered a 2 part series, as 1-3 fix the issue
and could go to stable, while 4-5 just cleanup the code.

* patches from https://lore.kernel.org/20250527133255.452431-1-axboe@kernel.dk:
  mm/filemap: unify dropbehind flag testing and clearing
  mm/filemap: unify read/write dropbehind naming
  Revert "Disable FOP_DONTCACHE for now due to bugs"
  mm/filemap: use filemap_end_dropbehind() for read invalidation
  mm/filemap: gate dropbehind invalidate on folio !dirty && !writeback

Link: https://lore.kernel.org/20250527133255.452431-1-axboe@kernel.dk
Signed-off-by: Christian Brauner <brauner@kernel.org>
2025-05-27 21:06:30 +02:00
Jens Axboe
a1d98e4ffb mm/filemap: unify dropbehind flag testing and clearing
The read and write side does this a bit differently, unify it such that
the _{read,write} helpers check the bit before locking, and the generic
handler is in charge of clearing the bit and invalidating, once under
the folio lock.

Signed-off-by: Jens Axboe <axboe@kernel.dk>
Link: https://lore.kernel.org/20250527133255.452431-6-axboe@kernel.dk
Signed-off-by: Christian Brauner <brauner@kernel.org>
2025-05-27 21:06:24 +02:00
Jens Axboe
1da7a06d9c mm/filemap: unify read/write dropbehind naming
The read side is filemap_end_dropbehind_read(), while the write side
used folio_ as the prefix rather than filemap_. The read side makes more
sense, unify the naming such that the write side follows that.

Signed-off-by: Jens Axboe <axboe@kernel.dk>
Link: https://lore.kernel.org/20250527133255.452431-5-axboe@kernel.dk
Signed-off-by: Christian Brauner <brauner@kernel.org>
2025-05-27 21:06:24 +02:00
Jens Axboe
7b2b67dbd4 Revert "Disable FOP_DONTCACHE for now due to bugs"
This reverts commit 478ad02d68.

Both the read and write side dirty && writeback races should be resolved
now, revert the commit that disabled FOP_DONTCACHE for filesystems.

Link: https://lore.kernel.org/linux-fsdevel/20250525083209.GS2023217@ZenIV/
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Link: https://lore.kernel.org/20250527133255.452431-4-axboe@kernel.dk
Signed-off-by: Christian Brauner <brauner@kernel.org>
2025-05-27 21:06:24 +02:00
Jens Axboe
25b065a744 mm/filemap: use filemap_end_dropbehind() for read invalidation
Use the filemap_end_dropbehind() helper rather than calling
folio_unmap_invalidate() directly, as we need to check if the folio has
been redirtied or marked for writeback once the folio lock has been
re-acquired.

Cc: stable@vger.kernel.org
Reported-by: Trond Myklebust <trondmy@hammerspace.com>
Fixes: 8026e49bff ("mm/filemap: add read support for RWF_DONTCACHE")
Link: https://lore.kernel.org/linux-fsdevel/ba8a9805331ce258a622feaca266b163db681a10.camel@hammerspace.com/
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Link: https://lore.kernel.org/20250527133255.452431-3-axboe@kernel.dk
Signed-off-by: Christian Brauner <brauner@kernel.org>
2025-05-27 21:06:24 +02:00
Jens Axboe
095f627add mm/filemap: gate dropbehind invalidate on folio !dirty && !writeback
It's possible for the folio to either get marked for writeback or
redirtied. Add a helper, filemap_end_dropbehind(), which guards the
folio_unmap_invalidate() call behind check for the folio being both
non-dirty and not under writeback AFTER the folio lock has been
acquired. Use this helper folio_end_dropbehind_write().

Cc: stable@vger.kernel.org
Reported-by: Al Viro <viro@zeniv.linux.org.uk>
Fixes: fb7d3bc414 ("mm/filemap: drop streaming/uncached pages when writeback completes")
Link: https://lore.kernel.org/linux-fsdevel/20250525083209.GS2023217@ZenIV/
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Link: https://lore.kernel.org/20250527133255.452431-2-axboe@kernel.dk
Signed-off-by: Christian Brauner <brauner@kernel.org>
2025-05-27 21:06:24 +02:00
Pavel Begunkov
0ec33c81d9 io_uring/zcrx: fix area release on registration failure
On area registration failure there might be no ifq set and it's not safe
to access area->ifq in the release path without checking it first.

Cc: stable@vger.kernel.org
Fixes: f12ecf5e1c ("io_uring/zcrx: fix late dma unmap for a dead dev")
Signed-off-by: Pavel Begunkov <asml.silence@gmail.com>
Link: https://lore.kernel.org/r/bc02878678a5fec28bc77d33355cdba735418484.1748365640.git.asml.silence@gmail.com
Signed-off-by: Jens Axboe <axboe@kernel.dk>
2025-05-27 12:56:16 -06:00
Linus Torvalds
015a99fa76 Merge tag 'nolibc-20250526-for-6.16-1' of git://git.kernel.org/pub/scm/linux/kernel/git/nolibc/linux-nolibc
Pull nolibc updates from Thomas Weißschuh:

 - New supported architectures: m68k, SPARC (32 and 64 bit)

 - Compatibility with kselftest_harness.h

 - A more robust mechanism to include all of nolibc from each header

 - Split existing features into new headers to simplify adoption

 - Compatibility with UBSAN and it is used in the testsuite

 - Many small new features focussing on usage in kselftests

* tag 'nolibc-20250526-for-6.16-1' of git://git.kernel.org/pub/scm/linux/kernel/git/nolibc/linux-nolibc: (83 commits)
  selftests: harness: Stop using setjmp()/longjmp()
  selftests: harness: Add "variant" and "self" to test metadata
  selftests: harness: Add teardown callback to test metadata
  selftests: harness: Move teardown conditional into test metadata
  selftests: harness: Don't set setup_completed for fixtureless tests
  selftests: harness: Implement test timeouts through pidfd
  selftests: harness: Remove dependency on libatomic
  selftests: harness: Remove inline qualifier for wrappers
  selftests: harness: Mark functions without prototypes static
  selftests: harness: Ignore unused variant argument warning
  selftests: harness: Use C89 comment style
  selftests: harness: Add kselftest harness selftest
  selftests/nolibc: drop include guards around standard headers
  tools/nolibc: move NULL and offsetof() to sys/stddef.h
  tools/nolibc: move uname() and friends to sys/utsname.h
  tools/nolibc: move makedev() and friends to sys/sysmacros.h
  tools/nolibc: move getrlimit() and friends to sys/resource.h
  tools/nolibc: move reboot() to sys/reboot.h
  tools/nolibc: move prctl() to sys/prctl.h
  tools/nolibc: move mount() to sys/mount.h
  ...
2025-05-27 11:27:09 -07:00
Linus Torvalds
3e443d1673 Merge tag 'docs-6.16' of git://git.lwn.net/linux
Pull documentation updates from Jonathan Corbet:
 "A moderately busy cycle for documentation this time around:

   - The most significant change is the replacement of the old
     kernel-doc script (a monstrous collection of Perl regexes that
     predates the Git era) with a Python reimplementation. That, too, is
     a horrifying collection of regexes, but in a much cleaner and more
     maintainable structure that integrates far better with the Sphinx
     build system.

     This change has been in linux-next for the full 6.15 cycle; the
     small number of problems that turned up have been addressed,
     seemingly to everybody's satisfaction. The Perl kernel-doc script
     remains in tree (as scripts/kernel-doc.pl) and can be used with a
     command-line option if need be. Unless some reason to keep it
     around materializes, it will probably go away in 6.17.

     Credit goes to Mauro Carvalho Chehab for doing all this work.

   - Some RTLA documentation updates

   - A handful of Chinese translations

   - The usual collection of typo fixes, general updates, etc"

* tag 'docs-6.16' of git://git.lwn.net/linux: (85 commits)
  Docs: doc-guide: update sphinx.rst Sphinx version number
  docs: doc-guide: clarify latest theme usage
  Documentation/scheduler: Fix typo in sched-stats domain field description
  scripts: kernel-doc: prevent a KeyError when checking output
  docs: kerneldoc.py: simplify exception handling logic
  MAINTAINERS: update linux-doc entry to cover new Python scripts
  docs: align with scripts/syscall.tbl migration
  Documentation: NTB: Fix typo
  Documentation: ioctl-number: Update table intro
  docs: conf.py: drop backward support for old Sphinx versions
  Docs: driver-api/basics: add kobject_event interfaces
  Docs: relay: editing cleanups
  docs: fix "incase" typo in coresight/panic.rst
  Fix spelling error for 'parallel'
  docs: admin-guide: fix typos in reporting-issues.rst
  docs: dmaengine: add explanation for DMA_ASYNC_TX capability
  Documentation: leds: improve readibility of multicolor doc
  docs: fix typo in firmware-related section
  docs: Makefile: Inherit PYTHONPYCACHEPREFIX setting as env variable
  Documentation: ioctl-number: Update outdated submission info
  ...
2025-05-27 11:22:19 -07:00
Linus Torvalds
95bf3760eb Merge tag 'lkmm.2025.05.25a' of git://git.kernel.org/pub/scm/linux/kernel/git/paulmck/linux-rcu
Pull lkmm updates from Paul McKenney:
 "Update LKMM documentation:

   - Cross-references, typos, broken URLs (Akira Yokosawa)

   - Clarify SRCU explanation (Uladzislau Rezki)"

* tag 'lkmm.2025.05.25a' of git://git.kernel.org/pub/scm/linux/kernel/git/paulmck/linux-rcu:
  tools/memory-model/Documentation: Fix SRCU section in explanation.txt
  tools/memory-model: docs/references: Remove broken link to imgtec.com
  tools/memory-model: docs/ordering: Fix trivial typos
  tools/memory-model: docs/simple.txt: Fix trivial typos
  tools/memory-model: docs/README: Update introduction of locking.txt
2025-05-27 11:17:45 -07:00
Miguel Ojeda
a3b2347343 Documentation: rust: testing: add docs on the new KUnit #[test] tests
There was no documentation yet on the KUnit-based `#[test]`s.

Thus add it now.

It includes an explanation about the `assert*!` macros being mapped to
KUnit and the support for `-> Result` introduced in these series.

Reviewed-by: David Gow <davidgow@google.com>
Acked-by: Danilo Krummrich <dakr@kernel.org>
Link: https://lore.kernel.org/r/20250502215133.1923676-8-ojeda@kernel.org
Signed-off-by: Miguel Ojeda <ojeda@kernel.org>
2025-05-27 20:09:59 +02:00
Miguel Ojeda
0a8d4eab17 Documentation: rust: rename #[test]s to "rusttest host tests"
Now that `rusttest`s are not really used much, clarify the section of
the documentation that describes them.

In addition, free the section name for the KUnit-based `#[test]`s that
will be added afterwards. To do so, rename the section into `rusttest`
host tests.

Reviewed-by: David Gow <davidgow@google.com>
Acked-by: Danilo Krummrich <dakr@kernel.org>
Link: https://lore.kernel.org/r/20250502215133.1923676-7-ojeda@kernel.org
Signed-off-by: Miguel Ojeda <ojeda@kernel.org>
2025-05-27 20:09:59 +02:00
Miguel Ojeda
2d6c87d0d6 rust: str: take advantage of the -> Result support in KUnit #[test]'s
Since now we have support for returning `-> Result`s, we can convert some
of these tests to use the feature, and serve as a first user for it too.

Thus convert them, which allows us to remove some `unwrap()`s.

We keep the actual assertions we want to make as explicit ones with
`assert*!`s.

Reviewed-by: David Gow <davidgow@google.com>
Acked-by: Danilo Krummrich <dakr@kernel.org>
Link: https://lore.kernel.org/r/20250502215133.1923676-6-ojeda@kernel.org
[ Split the `CString` simplification into a new commit. - Miguel ]
Signed-off-by: Miguel Ojeda <ojeda@kernel.org>
2025-05-27 20:09:59 +02:00
Miguel Ojeda
1486554392 rust: str: simplify KUnit tests format! macro
Simplify the `format!` macro used in the tests by using
`CString::try_from_fmt` and directly `unwrap()`ing.

This will allow us to change both `unwrap()`s here in order to showcase
the `?` operator support now that the tests are KUnit ones.

Reviewed-by: David Gow <davidgow@google.com>
Acked-by: Danilo Krummrich <dakr@kernel.org>
[ Split from the next commit as suggested by Tamir. - Miguel ]
Signed-off-by: Miguel Ojeda <ojeda@kernel.org>
2025-05-27 20:09:59 +02:00
Miguel Ojeda
028df914e5 rust: str: convert rusttest tests into KUnit
In general, we should aim to test as much as possible within the actual
kernel, and not in the build host.

Thus convert these `rusttest` tests into KUnit tests.

Reviewed-by: David Gow <davidgow@google.com>
Acked-by: Danilo Krummrich <dakr@kernel.org>
Link: https://lore.kernel.org/r/20250502215133.1923676-5-ojeda@kernel.org
Signed-off-by: Miguel Ojeda <ojeda@kernel.org>
2025-05-27 20:09:59 +02:00
Miguel Ojeda
897d1df653 rust: add kunit_tests to the prelude
It is convenient to have certain things in the `kernel` prelude, and
means kernel developers will find it even easier to start writing tests.

And, anyway, nobody should need to use this identifier for anything else.

Thus add it to the prelude.

Reviewed-by: David Gow <davidgow@google.com>
Acked-by: Danilo Krummrich <dakr@kernel.org>
Link: https://lore.kernel.org/r/20250502215133.1923676-4-ojeda@kernel.org
Signed-off-by: Miguel Ojeda <ojeda@kernel.org>
2025-05-27 20:09:59 +02:00
Miguel Ojeda
950b306c29 rust: kunit: support checked -> Results in KUnit #[test]s
Currently, return values of KUnit `#[test]` functions are ignored.

Thus introduce support for `-> Result` functions by checking their
returned values.

At the same time, require that test functions return `()` or `Result<T,
E>`, which should avoid mistakes, especially with non-`#[must_use]`
types. Other types can be supported in the future if needed.

With this, a failing test like:

    #[test]
    fn my_test() -> Result {
        f()?;
        Ok(())
    }

will output:

    [    3.744214]     KTAP version 1
    [    3.744287]     # Subtest: my_test_suite
    [    3.744378]     # speed: normal
    [    3.744399]     1..1
    [    3.745817]     # my_test: ASSERTION FAILED at rust/kernel/lib.rs:321
    [    3.745817]     Expected is_test_result_ok(my_test()) to be true, but is false
    [    3.747152]     # my_test.speed: normal
    [    3.747199]     not ok 1 my_test
    [    3.747345] not ok 4 my_test_suite

Reviewed-by: David Gow <davidgow@google.com>
Acked-by: Danilo Krummrich <dakr@kernel.org>
Link: https://lore.kernel.org/r/20250502215133.1923676-3-ojeda@kernel.org
[ Used `::kernel` for paths. - Miguel ]
Signed-off-by: Miguel Ojeda <ojeda@kernel.org>
2025-05-27 20:09:59 +02:00
Miguel Ojeda
36174d16f3 rust: kunit: support KUnit-mapped assert! macros in #[test]s
The KUnit `#[test]` support that landed recently is very basic and does
not map the `assert*!` macros into KUnit like the doctests do, so they
panic at the moment.

Thus implement the custom mapping in a similar way to doctests, reusing
the infrastructure there.

In Rust 1.88.0, the `file()` method in `Span` may be stable [1]. However,
it was changed recently (from `SourceFile`), so we need to do something
different in previous versions. Thus create a helper for it and use it
to get the path.

With this, a failing test suite like:

    #[kunit_tests(my_test_suite)]
    mod tests {
        use super::*;

        #[test]
        fn my_first_test() {
            assert_eq!(42, 43);
        }

        #[test]
        fn my_second_test() {
            assert!(42 >= 43);
        }
    }

will properly map back to KUnit, printing something like:

    [    1.924325]     KTAP version 1
    [    1.924421]     # Subtest: my_test_suite
    [    1.924506]     # speed: normal
    [    1.924525]     1..2
    [    1.926385]     # my_first_test: ASSERTION FAILED at rust/kernel/lib.rs:251
    [    1.926385]     Expected 42 == 43 to be true, but is false
    [    1.928026]     # my_first_test.speed: normal
    [    1.928075]     not ok 1 my_first_test
    [    1.928723]     # my_second_test: ASSERTION FAILED at rust/kernel/lib.rs:256
    [    1.928723]     Expected 42 >= 43 to be true, but is false
    [    1.929834]     # my_second_test.speed: normal
    [    1.929868]     not ok 2 my_second_test
    [    1.930032] # my_test_suite: pass:0 fail:2 skip:0 total:2
    [    1.930153] # Totals: pass:0 fail:2 skip:0 total

Link: https://github.com/rust-lang/rust/pull/140514 [1]
Reviewed-by: David Gow <davidgow@google.com>
Acked-by: Danilo Krummrich <dakr@kernel.org>
Link: https://lore.kernel.org/r/20250502215133.1923676-2-ojeda@kernel.org
[ Required `KUNIT=y` like for doctests. Used the `cfg_attr` from the
  TODO comment and clarified its comment now that the stabilization is
  in beta and thus quite likely stable in Rust 1.88.0. Simplified the
  `new_body` code by introducing a new variable. Added
  `#[allow(clippy::incompatible_msrv)]`. - Miguel ]
Signed-off-by: Miguel Ojeda <ojeda@kernel.org>
2025-05-27 20:07:09 +02:00
Alexei Starovoitov
ca56fbd508 Merge branch 'bpf-arm64-support-up-to-12-arguments'
Alexis Lothoré says:

====================
this is the v2 of the many args series for arm64, being itself a revival
of Xu Kuhoai's work to enable larger arguments count for BPF programs on
ARM64 ([1]).

The discussions in v1 shed some light on some issues around specific
cases, for example with functions passing struct on stack with custom
packing/alignment attributes: those cases can not be properly detected
with the current BTF info. So this new revision aims to separate
concerns with a simpler implementation, just accepting additional args
on stack if we can make sure about the alignment constraints (and so,
refusing attachment to functions passing structs on stacks). I then
checked if the specific alignment constraints could be checked with
larger scalar types rather than structs, but it appears that this use
case is in fact rejected at the verifier level (see a9b59159d3 ("bpf:
Do not allow btf_ctx_access with __int128 types")). So in the end the
specific alignment corner cases raised in [1] can not really happen in
the kernel in its current state. This new revision still brings support
for the standard cases as a first step, it will then be possible to
iterate on top of it to add the more specific cases like struct passed
on stack and larger types.

[1] https://lore.kernel.org/all/20230917150752.69612-1-xukuohai@huaweicloud.com/#t

Changes in v3:
- switch back -EOPNOTSUPP to -ENOTSUPP
- fix comment style
- group intializations for arg_aux
- remove some unneeded round_up
- Link to v2: https://lore.kernel.org/r/20250522-many_args_arm64-v2-0-d6afdb9cf819@bootlin.com

Changes in v2:
- remove alignment computation from btf.c
- deduce alignment constraints directly in jit compiler for simple types
- deny attachment to functions with "corner-cases" arguments (ie:
  structs on stack)
- remove custom tests, as the corresponding use cases are locked either
  by the JIT comp or the verifier
- drop RFC
- Link to v1: https://lore.kernel.org/r/20250411-many_args_arm64-v1-0-0a32fe72339e@bootlin.com
====================

Signed-off-by: Alexis Lothoré (eBPF Foundation) <alexis.lothore@bootlin.com>
Acked-by: Xu Kuohai <xukuohai@huawei.com>
Link: https://patch.msgid.link/20250527-many_args_arm64-v3-0-3faf7bb8e4a2@bootlin.com
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
2025-05-27 10:50:38 -07:00
Alexis Lothoré (eBPF Foundation)
149ead9d7e selftests/bpf: enable many-args tests for arm64
Now that support for up to 12 args is enabled for tracing programs on
ARM64, enable the existing tests for this feature on this architecture.

Signed-off-by: Alexis Lothoré (eBPF Foundation) <alexis.lothore@bootlin.com>
Link: https://lore.kernel.org/r/20250527-many_args_arm64-v3-2-3faf7bb8e4a2@bootlin.com
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
2025-05-27 10:50:31 -07:00
Xu Kuohai
9014cf56f1 bpf, arm64: Support up to 12 function arguments
Currently ARM64 bpf trampoline supports up to 8 function arguments.
According to the statistics from commit
473e3150e3 ("bpf, x86: allow function arguments up to 12 for TRACING"),
there are about 200 functions accept 9 to 12 arguments, so adding support
for up to 12 function arguments.

Due to bpf only supporting function arguments up to 16 bytes, according to
AAPCS64, starting from the first argument, each argument is first
attempted to be loaded to 1 or 2 smallest registers from x0-x7, if there
are no enough registers to hold the entire argument, then all remaining
arguments starting from this one are pushed to the stack for passing.
There are some non-trivial cases for which it is not possible to
correctly read arguments from/write arguments to the stack: for example
struct variables may have custom packing/alignment attributes that are
invisible in BTF info. Such cases are denied for now to make sure not to
read incorrect values.

Signed-off-by: Xu Kuohai <xukuohai@huawei.com>
Co-developed-by: Alexis Lothoré (eBPF Foundation) <alexis.lothore@bootlin.com>
Signed-off-by: Alexis Lothoré (eBPF Foundation) <alexis.lothore@bootlin.com>
Link: https://lore.kernel.org/r/20250527-many_args_arm64-v3-1-3faf7bb8e4a2@bootlin.com
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
2025-05-27 10:50:31 -07:00
Linus Torvalds
97851c6016 Merge tag 'ratelimit.2025.05.25a' of git://git.kernel.org/pub/scm/linux/kernel/git/paulmck/linux-rcu
Pull rate-limit updates from Paul McKenney:
 "lib/ratelimit: Reduce false-positive and silent misses:

   - Reduce open-coded use of ratelimit_state structure fields.

   - Convert the ->missed field to atomic_t.

   - Count misses that are due to lock contention.

   - Eliminate jiffies=0 special case.

   - Reduce ___ratelimit() false-positive rate limiting (Petr Mladek).

   - Allow zero ->burst to hard-disable rate limiting.

   - Optimize away atomic operations when a miss is guaranteed.

   - Warn if ->interval or ->burst are negative (Petr Mladek).

   - Simplify the resulting code.

  A smoke test and stress test have been created, but they are not yet
  ready for mainline. With luck, we will offer them for the v6.17 merge
  window"

* tag 'ratelimit.2025.05.25a' of git://git.kernel.org/pub/scm/linux/kernel/git/paulmck/linux-rcu:
  ratelimit: Drop redundant accesses to burst
  ratelimit: Use nolock_ret restructuring to collapse common case code
  ratelimit: Use nolock_ret label to collapse lock-failure code
  ratelimit: Use nolock_ret label to save a couple of lines of code
  ratelimit: Simplify common-case exit path
  ratelimit: Warn if ->interval or ->burst are negative
  ratelimit: Avoid atomic decrement under lock if already rate-limited
  ratelimit: Avoid atomic decrement if already rate-limited
  ratelimit: Don't flush misses counter if RATELIMIT_MSG_ON_RELEASE
  ratelimit: Force re-initialization when rate-limiting re-enabled
  ratelimit: Allow zero ->burst to disable ratelimiting
  ratelimit: Reduce ___ratelimit() false-positive rate limiting
  ratelimit: Avoid jiffies=0 special case
  ratelimit: Count misses due to lock contention
  ratelimit: Convert the ->missed field to atomic_t
  drm/amd/pm: Avoid open-coded use of ratelimit_state structure's internals
  drm/i915: Avoid open-coded use of ratelimit_state structure's ->missed field
  random: Avoid open-coded use of ratelimit_state structure's ->missed field
  ratelimit: Create functions to handle ratelimit_state internals
2025-05-27 10:48:36 -07:00
Hou Tao
d496557826 bpf: Check rcu_read_lock_trace_held() in bpf_map_lookup_percpu_elem()
bpf_map_lookup_percpu_elem() helper is also available for sleepable bpf
program. When BPF JIT is disabled or under 32-bit host,
bpf_map_lookup_percpu_elem() will not be inlined. Using it in a
sleepable bpf program will trigger the warning in
bpf_map_lookup_percpu_elem(), because the bpf program only holds
rcu_read_lock_trace lock. Therefore, add the missed check.

Reported-by: syzbot+dce5aae19ae4d6399986@syzkaller.appspotmail.com
Closes: https://lore.kernel.org/bpf/000000000000176a130617420310@google.com/
Signed-off-by: Hou Tao <houtao1@huawei.com>
Link: https://lore.kernel.org/r/20250526062534.1105938-1-houtao@huaweicloud.com
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
2025-05-27 10:45:59 -07:00
KaFai Wan
86bc9c7424 bpf: Avoid __bpf_prog_ret0_warn when jit fails
syzkaller reported an issue:

WARNING: CPU: 3 PID: 217 at kernel/bpf/core.c:2357 __bpf_prog_ret0_warn+0xa/0x20 kernel/bpf/core.c:2357
Modules linked in:
CPU: 3 UID: 0 PID: 217 Comm: kworker/u32:6 Not tainted 6.15.0-rc4-syzkaller-00040-g8bac8898fe39
RIP: 0010:__bpf_prog_ret0_warn+0xa/0x20 kernel/bpf/core.c:2357
Call Trace:
 <TASK>
 bpf_dispatcher_nop_func include/linux/bpf.h:1316 [inline]
 __bpf_prog_run include/linux/filter.h:718 [inline]
 bpf_prog_run include/linux/filter.h:725 [inline]
 cls_bpf_classify+0x74a/0x1110 net/sched/cls_bpf.c:105
 ...

When creating bpf program, 'fp->jit_requested' depends on bpf_jit_enable.
This issue is triggered because of CONFIG_BPF_JIT_ALWAYS_ON is not set
and bpf_jit_enable is set to 1, causing the arch to attempt JIT the prog,
but jit failed due to FAULT_INJECTION. As a result, incorrectly
treats the program as valid, when the program runs it calls
`__bpf_prog_ret0_warn` and triggers the WARN_ON_ONCE(1).

Reported-by: syzbot+0903f6d7f285e41cdf10@syzkaller.appspotmail.com
Closes: https://lore.kernel.org/bpf/6816e34e.a70a0220.254cdc.002c.GAE@google.com
Fixes: fa9dd599b4 ("bpf: get rid of pure_initcall dependency to enable jits")
Signed-off-by: KaFai Wan <mannkafai@gmail.com>
Link: https://lore.kernel.org/r/20250526133358.2594176-1-mannkafai@gmail.com
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
2025-05-27 10:43:10 -07:00