git.monstr.eu Git - linux-2.6-microblaze.git/log

net: phylink: initialize carrier state at creation

Background: Turris Omnia (Armada 385); eth2 (mvneta) connected to SFP bus;
SFP module is present, but no fiber connected, so definitely no carrier.

After booting, eth2 is down, but netdev LED trigger surprisingly reports
link active. Then, after "ip link set eth2 up", the link indicator goes
away - as I would have expected it from the beginning.

It turns out, that the default carrier state after netdev creation is
"carrier ok". Some ethernet drivers explicitly call netif_carrier_off
during probing, others (like mvneta) don't - which explains the current
behaviour: only when the device is brought up, phylink_start calls
netif_carrier_off.

Fix this for all drivers using phylink, by calling netif_carrier_off in
phylink_create.

Fixes: 089381b27abe ("leds: initial support for Turris Omnia LEDs")
Cc: stable@vger.kernel.org
Suggested-by: Andrew Lunn <andrew@lunn.ch>
Signed-off-by: Klaus Kudielka <klaus.kudielka@gmail.com>
Reviewed-by: Russell King (Oracle) <rmk+kernel@armlinux.org.uk>
Reviewed-by: Andrew Lunn <andrew@lunn.ch>
Signed-off-by: David S. Miller <davem@davemloft.net>

Merge branch 'vsock-fixes'

Filippo Storniolo says:

====================
vsock: fix server prevents clients from reconnecting

This patch series introduce fix and tests for the following vsock bug:
If the same remote peer, using the same port, tries to connect
to a server on a listening port more than once, the server will
reject the connection, causing a "connection reset by peer"
error on the remote peer. This is due to the presence of a
dangling socket from a previous connection in both the connected
and bound socket lists.
The inconsistency of the above lists only occurs when the remote
peer disconnects and the server remains active.
This bug does not occur when the server socket is closed.

More details on the first patch changelog.
The remaining patches are refactoring and test.
====================

Signed-off-by: David S. Miller <davem@davemloft.net>

test/vsock: add dobule bind connect test

This add bind connect test which creates a listening server socket
and tries to connect a client with a bound local port to it twice.

Co-developed-by: Luigi Leonardi <luigi.leonardi@outlook.com>
Signed-off-by: Luigi Leonardi <luigi.leonardi@outlook.com>
Signed-off-by: Filippo Storniolo <f.storniolo95@gmail.com>
Reviewed-by: Stefano Garzarella <sgarzare@redhat.com>
Signed-off-by: David S. Miller <davem@davemloft.net>

test/vsock: refactor vsock_accept

This is a preliminary patch to introduce SOCK_STREAM bind connect test.
vsock_accept() is split into vsock_listen() and vsock_accept().

Co-developed-by: Luigi Leonardi <luigi.leonardi@outlook.com>
Signed-off-by: Luigi Leonardi <luigi.leonardi@outlook.com>
Signed-off-by: Filippo Storniolo <f.storniolo95@gmail.com>
Reviewed-by: Stefano Garzarella <sgarzare@redhat.com>
Signed-off-by: David S. Miller <davem@davemloft.net>

test/vsock fix: add missing check on socket creation

Add check on socket() return value in vsock_listen()
and vsock_connect()

Co-developed-by: Luigi Leonardi <luigi.leonardi@outlook.com>
Signed-off-by: Luigi Leonardi <luigi.leonardi@outlook.com>
Signed-off-by: Filippo Storniolo <f.storniolo95@gmail.com>
Reviewed-by: Stefano Garzarella <sgarzare@redhat.com>
Signed-off-by: David S. Miller <davem@davemloft.net>

vsock/virtio: remove socket from connected/bound list on shutdown

If the same remote peer, using the same port, tries to connect
to a server on a listening port more than once, the server will
reject the connection, causing a "connection reset by peer"
error on the remote peer. This is due to the presence of a
dangling socket from a previous connection in both the connected
and bound socket lists.
The inconsistency of the above lists only occurs when the remote
peer disconnects and the server remains active.

This bug does not occur when the server socket is closed:
virtio_transport_release() will eventually schedule a call to
virtio_transport_do_close() and the latter will remove the socket
from the bound and connected socket lists and clear the sk_buff.

However, virtio_transport_do_close() will only perform the above
actions if it has been scheduled, and this will not happen
if the server is processing the shutdown message from a remote peer.

To fix this, introduce a call to vsock_remove_sock()
when the server is handling a client disconnect.
This is to remove the socket from the bound and connected socket
lists without clearing the sk_buff.

Fixes: 06a8fc78367d ("VSOCK: Introduce virtio_vsock_common.ko")
Reported-by: Daan De Meyer <daan.j.demeyer@gmail.com>
Tested-by: Daan De Meyer <daan.j.demeyer@gmail.com>
Co-developed-by: Luigi Leonardi <luigi.leonardi@outlook.com>
Signed-off-by: Luigi Leonardi <luigi.leonardi@outlook.com>
Signed-off-by: Filippo Storniolo <f.storniolo95@gmail.com>
Reviewed-by: Stefano Garzarella <sgarzare@redhat.com>
Signed-off-by: David S. Miller <davem@davemloft.net>

tcp: Fix -Wc23-extensions in tcp_options_write()

Clang warns (or errors with CONFIG_WERROR=y) when CONFIG_TCP_AO is set:

  net/ipv4/tcp_output.c:663:2: error: label at end of compound statement is a C23 extension [-Werror,-Wc23-extensions]
    663 |         }
        |         ^
  1 error generated.

On earlier releases (such as clang-11, the current minimum supported
version for building the kernel) that do not support C23, this was a
hard error unconditionally:

  net/ipv4/tcp_output.c:663:2: error: expected statement
          }
          ^
  1 error generated.

While adding a semicolon after the label would resolve this, it is more
in line with the kernel as a whole to refactor this block into a
standalone function, which means the goto a label construct can just be
replaced with a return statement. Do so to resolve the warning.

Closes: https://github.com/ClangBuiltLinux/linux/issues/1953
Fixes: 1e03d32bea8e ("net/tcp: Add TCP-AO sign to outgoing packets")
Signed-off-by: Nathan Chancellor <nathan@kernel.org>
Reviewed-by: Dmitry Safonov <dima@arista.com>
Reviewed-by: Eric Dumazet <edumazet@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>

tg3: Fix the TX ring stall

The TX ring maintained by the tg3 driver can end up in the state, when it
has packets queued for sending but the NIC hardware is not informed, so no
progress is made. This leads to a multi-second interruption in network
traffic followed by dev_watchdog() firing and resetting the queue.

The specific sequence of steps is:

1. tg3_start_xmit() is called at least once and queues packet(s) without
   updating tnapi->prodmbox (netdev_xmit_more() returns true)
2. tg3_start_xmit() is called with an SKB which causes tg3_tso_bug() to be
   called.
3. tg3_tso_bug() determines that the SKB is too large, ...

        if (unlikely(tg3_tx_avail(tnapi) <= frag_cnt_est)) {

   ... stops the queue, and returns NETDEV_TX_BUSY:

        netif_tx_stop_queue(txq);
        ...
        if (tg3_tx_avail(tnapi) <= frag_cnt_est)
                return NETDEV_TX_BUSY;

4. Since all tg3_tso_bug() call sites directly return, the code updating
   tnapi->prodmbox is skipped.

5. The queue is stuck now. tg3_start_xmit() is not called while the queue
   is stopped. The NIC is not processing new packets because
   tnapi->prodmbox wasn't updated. tg3_tx() is not called by
   tg3_poll_work() because the all TX descriptions that could be freed has
   been freed:

        /* run TX completion thread */
        if (tnapi->hw_status->idx[0].tx_consumer != tnapi->tx_cons) {
                tg3_tx(tnapi);

6. Eventually, dev_watchdog() fires triggering a reset of the queue.

This fix makes sure that the tnapi->prodmbox update happens regardless of
the reason tg3_start_xmit() returned.

Signed-off-by: Alex Pakhunov <alexey.pakhunov@spacex.com>
Signed-off-by: Vincent Wong <vincent.wong2@spacex.com>
Reviewed-by: Michael Chan <michael.chan@broadcom.com>
Signed-off-by: David S. Miller <davem@davemloft.net>

s390/qeth: Fix typo 'weed' in comment

Replace 'weed' with 'we' in the comment.

Signed-off-by: Kuan-Wei Chiu <visitorckw@gmail.com>
Reviewed-by: Alexandra Winter <wintera@linux.ibm.com>
Signed-off-by: David S. Miller <davem@davemloft.net>

idpf: fix potential use-after-free in idpf_tso()

skb_cow_head() can change skb->head (and thus skb_shinfo(skb))

We must not cache skb_shinfo(skb) before skb_cow_head().

Fixes: 6818c4d5b3c2 ("idpf: add splitq start_xmit")
Signed-off-by: Eric Dumazet <edumazet@google.com>
Cc: Joshua Hay <joshua.a.hay@intel.com>
Cc: Alan Brady <alan.brady@intel.com>
Cc: Madhu Chittim <madhu.chittim@intel.com>
Cc: Phani Burra <phani.r.burra@intel.com>
Cc: Sridhar Samudrala <sridhar.samudrala@intel.com>
Cc: Willem de Bruijn <willemb@google.com>
Cc: Pavan Kumar Linga <pavan.kumar.linga@intel.com>
Cc: Tony Nguyen <anthony.l.nguyen@intel.com>
Cc: Bailey Forrest <bcf@google.com>
Reviewed-by: Jacob Keller <jacob.e.keller@intel.com>
Link: https://lore.kernel.org/r/20231103200451.514047-1-edumazet@google.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>

tg3: power down device only on SYSTEM_POWER_OFF

Dell R650xs servers hangs on reboot if tg3 driver calls
tg3_power_down.

This happens only if network adapters (BCM5720 for R650xs) were
initialized using SNP (e.g. by booting ipxe.efi).

The actual problem is on Dell side, but this fix allows servers
to come back alive after reboot.

Signed-off-by: George Shuklin <george.shuklin@gmail.com>
Fixes: 2ca1c94ce0b6 ("tg3: Disable tg3 device on system reboot to avoid triggering AER")
Reviewed-by: Pavan Chebbi <pavan.chebbi@broadcom.com>
Reviewed-by: Michael Chan <michael.chan@broadcom.com>
Link: https://lore.kernel.org/r/20231103115029.83273-1-george.shuklin@gmail.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>

Merge branch 'smc-fixes'

D. Wythe says

====================
bugfixs for smc

This patches includes bugfix following:

1. hung state
2. sock leak
3. potential panic

We have been testing these patches for some time, but
if you have any questions, please let us know.

--
v1:
Fix spelling errors and incorrect function names in descriptions

v2->v1:
Add fix tags for bugfix patch
====================

Reviewed-by: Wenjia Zhang <wenjia@linux.ibm.com>
Signed-off-by: David S. Miller <davem@davemloft.net>

net/smc: put sk reference if close work was canceled

Note that we always hold a reference to sock when attempting
to submit close_work. Therefore, if we have successfully
canceled close_work from pending, we MUST release that reference
to avoid potential leaks.

Fixes: 42bfba9eaa33 ("net/smc: immediate termination for SMCD link groups")
Signed-off-by: D. Wythe <alibuda@linux.alibaba.com>
Reviewed-by: Dust Li <dust.li@linux.alibaba.com>
Signed-off-by: David S. Miller <davem@davemloft.net>

net/smc: allow cdc msg send rather than drop it with NULL sndbuf_desc

This patch re-fix the issues mentioned by commit 22a825c541d7
("net/smc: fix NULL sndbuf_desc in smc_cdc_tx_handler()").

Blocking sending message do solve the issues though, but it also
prevents the peer to receive the final message. Besides, in logic,
whether the sndbuf_desc is NULL or not have no impact on the processing
of cdc message sending.

Hence that, this patch allows the cdc message sending but to check the
sndbuf_desc with care in smc_cdc_tx_handler().

Fixes: 22a825c541d7 ("net/smc: fix NULL sndbuf_desc in smc_cdc_tx_handler()")
Signed-off-by: D. Wythe <alibuda@linux.alibaba.com>
Reviewed-by: Dust Li <dust.li@linux.alibaba.com>
Signed-off-by: David S. Miller <davem@davemloft.net>

net/smc: fix dangling sock under state SMC_APPFINCLOSEWAIT

Considering scenario:

smc_cdc_rx_handler
__smc_release
sock_set_flag
smc_close_active()
sock_set_flag

__set_bit(DEAD) __set_bit(DONE)

Dues to __set_bit is not atomic, the DEAD or DONE might be lost.
if the DEAD flag lost, the state SMC_CLOSED will be never be reached
in smc_close_passive_work:

if (sock_flag(sk, SOCK_DEAD) &&
smc_close_sent_any_close(conn)) {
sk->sk_state = SMC_CLOSED;
} else {
/* just shutdown, but not yet closed locally */
sk->sk_state = SMC_APPFINCLOSEWAIT;
}

Replace sock_set_flags or __set_bit to set_bit will fix this problem.
Since set_bit is atomic.

Fixes: b38d732477e4 ("smc: socket closing and linkgroup cleanup")
Signed-off-by: D. Wythe <alibuda@linux.alibaba.com>
Reviewed-by: Dust Li <dust.li@linux.alibaba.com>
Signed-off-by: David S. Miller <davem@davemloft.net>

nfsd: regenerate user space parsers after ynl-gen changes

Commit 8cea95b0bd79 ("tools: ynl-gen: handle do ops with no input attrs")
added support for some of the previously-skipped ops in nfsd.
Regenerate the user space parsers to fill them in.

Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Acked-by: Chuck Lever <chuck.lever@oracle.com>
Signed-off-by: David S. Miller <davem@davemloft.net>

tcp: Fix SYN option room calculation for TCP-AO.

When building SYN packet in tcp_syn_options(), MSS, TS, WS, and
SACKPERM are used without checking the remaining bytes in the
options area.

To keep that logic as is, we limit the TCP-AO MAC length in
tcp_ao_parse_crypto().  Currently, the limit is calculated as below.

  MAX_TCP_OPTION_SPACE - TCPOLEN_TSTAMP_ALIGNED
                       - TCPOLEN_WSCALE_ALIGNED
                       - TCPOLEN_SACKPERM_ALIGNED

This looks confusing as (1) we pack SACKPERM into the leading
2-bytes of the aligned 12-bytes of TS and (2) TCPOLEN_MSS_ALIGNED
is not used.  Fortunately, the calculated limit is not wrong as
TCPOLEN_SACKPERM_ALIGNED and TCPOLEN_MSS_ALIGNED are the same value.

However, we should use the proper constant in the formula.

  MAX_TCP_OPTION_SPACE - TCPOLEN_MSS_ALIGNED
                       - TCPOLEN_TSTAMP_ALIGNED
                       - TCPOLEN_WSCALE_ALIGNED

Fixes: 4954f17ddefc ("net/tcp: Introduce TCP_AO setsockopt()s")
Signed-off-by: Kuniyuki Iwashima <kuniyu@amazon.com>
Reviewed-by: Dmitry Safonov <dima@arista.com>
Signed-off-by: David S. Miller <davem@davemloft.net>

octeontx2-pf: Free pending and dropped SQEs

On interface down, the pending SQEs in the NIX get dropped
or drained out during SMQ flush. But skb's pointed by these
SQEs never get free or updated to the stack as respective CQE
never get added.
This patch fixes the issue by freeing all valid skb's in SQ SG list.

Fixes: b1bc8457e9d0 ("octeontx2-pf: Cleanup all receive buffers in SG descriptor")
Signed-off-by: Geetha sowjanya <gakula@marvell.com>
Signed-off-by: David S. Miller <davem@davemloft.net>

net, sched: Fix SKB_NOT_DROPPED_YET splat under debug config

Getting the following splat [1] with CONFIG_DEBUG_NET=y and this
reproducer [2]. Problem seems to be that classifiers clear 'struct
tcf_result::drop_reason', thereby triggering the warning in
__kfree_skb_reason() due to reason being 'SKB_NOT_DROPPED_YET' (0).

Fixed by disambiguating a legit error from a verdict with a bogus drop_reason

[1]
WARNING: CPU: 0 PID: 181 at net/core/skbuff.c:1082 kfree_skb_reason+0x38/0x130
Modules linked in:
CPU: 0 PID: 181 Comm: mausezahn Not tainted 6.6.0-rc6-custom-ge43e6d9582e0 #682
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.2-1.fc37 04/01/2014
RIP: 0010:kfree_skb_reason+0x38/0x130
[...]
Call Trace:
<IRQ>
__netif_receive_skb_core.constprop.0+0x837/0xdb0
__netif_receive_skb_one_core+0x3c/0x70
process_backlog+0x95/0x130
__napi_poll+0x25/0x1b0
net_rx_action+0x29b/0x310
__do_softirq+0xc0/0x29b
do_softirq+0x43/0x60
</IRQ>

[2]

ip link add name veth0 type veth peer name veth1
ip link set dev veth0 up
ip link set dev veth1 up
tc qdisc add dev veth1 clsact
tc filter add dev veth1 ingress pref 1 proto all flower dst_mac 00:11:22:33:44:55 action drop
mausezahn veth0 -a own -b 00:11:22:33:44:55 -q -c 1

Ido reported:

  [...] getting the following splat [1] with CONFIG_DEBUG_NET=y and this
  reproducer [2]. Problem seems to be that classifiers clear 'struct
  tcf_result::drop_reason', thereby triggering the warning in
  __kfree_skb_reason() due to reason being 'SKB_NOT_DROPPED_YET' (0). [...]

  [1]
  WARNING: CPU: 0 PID: 181 at net/core/skbuff.c:1082 kfree_skb_reason+0x38/0x130
  Modules linked in:
  CPU: 0 PID: 181 Comm: mausezahn Not tainted 6.6.0-rc6-custom-ge43e6d9582e0 #682
  Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.2-1.fc37 04/01/2014
  RIP: 0010:kfree_skb_reason+0x38/0x130
  [...]
  Call Trace:
   <IRQ>
   __netif_receive_skb_core.constprop.0+0x837/0xdb0
   __netif_receive_skb_one_core+0x3c/0x70
   process_backlog+0x95/0x130
   __napi_poll+0x25/0x1b0
   net_rx_action+0x29b/0x310
   __do_softirq+0xc0/0x29b
   do_softirq+0x43/0x60
   </IRQ>

  [2]
  #!/bin/bash

  ip link add name veth0 type veth peer name veth1
  ip link set dev veth0 up
  ip link set dev veth1 up
  tc qdisc add dev veth1 clsact
  tc filter add dev veth1 ingress pref 1 proto all flower dst_mac 00:11:22:33:44:55 action drop
  mausezahn veth0 -a own -b 00:11:22:33:44:55 -q -c 1

What happens is that inside most classifiers the tcf_result is copied over
from a filter template e.g. *res = f->res which then implicitly overrides
the prior SKB_DROP_REASON_TC_{INGRESS,EGRESS} default drop code which was
set via sch_handle_{ingress,egress}() for kfree_skb_reason().

Commit text above copied verbatim from Daniel. The general idea of the patch
is not very different from what Ido originally posted but instead done at the
cls_api codepath.

Fixes: 54a59aed395c ("net, sched: Make tc-related drop reason more flexible")
Reported-by: Ido Schimmel <idosch@idosch.org>
Signed-off-by: Jamal Hadi Salim <jhs@mojatatu.com>
Link: https://lore.kernel.org/netdev/ZTjY959R+AFXf3Xy@shredder
Reviewed-by: Simon Horman <horms@kernel.org>
Signed-off-by: David S. Miller <davem@davemloft.net>

netlink: fill in missing MODULE_DESCRIPTION()

W=1 builds now warn if a module is built without
a MODULE_DESCRIPTION(). Fill it in for sock_diag.

Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: David S. Miller <davem@davemloft.net>

net/tcp: fix possible out-of-bounds reads in tcp_hash_fail()

syzbot managed to trigger a fault by sending TCP packets
with all flags being set.

v2:
- While fixing this bug, add PSH flag handling and represent
flags the way tcpdump does : [S], [S.], [P.]
- Print 4-tuples more consistently between families.

BUG: KASAN: stack-out-of-bounds in string_nocheck lib/vsprintf.c:645 [inline]
BUG: KASAN: stack-out-of-bounds in string+0x394/0x3d0 lib/vsprintf.c:727
Read of size 1 at addr ffffc9000397f3f5 by task syz-executor299/5039

CPU: 1 PID: 5039 Comm: syz-executor299 Not tainted 6.6.0-rc7-syzkaller-02075-g55c900477f5b #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/09/2023
Call Trace:
<TASK>
__dump_stack lib/dump_stack.c:88 [inline]
dump_stack_lvl+0xd9/0x1b0 lib/dump_stack.c:106
print_address_description mm/kasan/report.c:364 [inline]
print_report+0xc4/0x620 mm/kasan/report.c:475
kasan_report+0xda/0x110 mm/kasan/report.c:588
string_nocheck lib/vsprintf.c:645 [inline]
string+0x394/0x3d0 lib/vsprintf.c:727
vsnprintf+0xc5f/0x1870 lib/vsprintf.c:2818
vprintk_store+0x3a0/0xb80 kernel/printk/printk.c:2191
vprintk_emit+0x14c/0x5f0 kernel/printk/printk.c:2288
vprintk+0x7b/0x90 kernel/printk/printk_safe.c:45
_printk+0xc8/0x100 kernel/printk/printk.c:2332
tcp_inbound_hash.constprop.0+0xdb2/0x10d0 include/net/tcp.h:2760
tcp_v6_rcv+0x2b31/0x34d0 net/ipv6/tcp_ipv6.c:1882
ip6_protocol_deliver_rcu+0x33b/0x13d0 net/ipv6/ip6_input.c:438
ip6_input_finish+0x14f/0x2f0 net/ipv6/ip6_input.c:483
NF_HOOK include/linux/netfilter.h:314 [inline]
NF_HOOK include/linux/netfilter.h:308 [inline]
ip6_input+0xce/0x440 net/ipv6/ip6_input.c:492
dst_input include/net/dst.h:461 [inline]
ip6_rcv_finish net/ipv6/ip6_input.c:79 [inline]
NF_HOOK include/linux/netfilter.h:314 [inline]
NF_HOOK include/linux/netfilter.h:308 [inline]
ipv6_rcv+0x563/0x720 net/ipv6/ip6_input.c:310
__netif_receive_skb_one_core+0x115/0x180 net/core/dev.c:5527
__netif_receive_skb+0x1f/0x1b0 net/core/dev.c:5641
netif_receive_skb_internal net/core/dev.c:5727 [inline]
netif_receive_skb+0x133/0x700 net/core/dev.c:5786
tun_rx_batched+0x429/0x780 drivers/net/tun.c:1579
tun_get_user+0x29e7/0x3bc0 drivers/net/tun.c:2002
tun_chr_write_iter+0xe8/0x210 drivers/net/tun.c:2048
call_write_iter include/linux/fs.h:1956 [inline]
new_sync_write fs/read_write.c:491 [inline]
vfs_write+0x650/0xe40 fs/read_write.c:584
ksys_write+0x12f/0x250 fs/read_write.c:637
do_syscall_x64 arch/x86/entry/common.c:50 [inline]
do_syscall_64+0x38/0xb0 arch/x86/entry/common.c:80
entry_SYSCALL_64_after_hwframe+0x63/0xcd

Fixes: 2717b5adea9e ("net/tcp: Add tcp_hash_fail() ratelimited logs")
Reported-by: syzbot <syzkaller@googlegroups.com>
Signed-off-by: Eric Dumazet <edumazet@google.com>
Cc: Dmitry Safonov <dima@arista.com>
Cc: Francesco Ruggeri <fruggeri@arista.com>
Cc: David Ahern <dsahern@kernel.org>
Reviewed-by: Dmitry Safonov <dima@arista.com>
Signed-off-by: David S. Miller <davem@davemloft.net>

net: ethernet: ti: am65-cpsw: rx_pause/tx_pause controls wrong direction

The rx_pause flag says that whether we support receiving Pause frames.
When a Pause frame is received TX is delayed for some time. This is TX
flow control. In the same manner tx_pause is actually RX flow control.

Signed-off-by: Ronald Wahl <ronald.wahl@raritan.com>
Signed-off-by: David S. Miller <davem@davemloft.net>

tcp: fix fastopen code vs usec TS

After blamed commit, TFO client-ack-dropped-then-recovery-ms-timestamps
packetdrill test failed.

David Morley and Neal Cardwell started investigating and Neal pointed
that we had :

tcp_conn_request()
  tcp_try_fastopen()
   -> tcp_fastopen_create_child
     -> child = inet_csk(sk)->icsk_af_ops->syn_recv_sock()
       -> tcp_create_openreq_child()
          -> copy req_usec_ts from req:
          newtp->tcp_usec_ts = treq->req_usec_ts;
          // now the new TFO server socket always does usec TS, no matter
          // what the route options are...
  send_synack()
    -> tcp_make_synack()
        // disable tcp_rsk(req)->req_usec_ts if route option is not present:
        if (tcp_rsk(req)->req_usec_ts < 0)
                tcp_rsk(req)->req_usec_ts = dst_tcp_usec_ts(dst);

tcp_conn_request() has the initial dst, we can initialize
tcp_rsk(req)->req_usec_ts there instead of later in send_synack();

This means tcp_rsk(req)->req_usec_ts can be a boolean.

Many thanks to David an Neal for their help.

Fixes: 614e8316aa4c ("tcp: add support for usec resolution in TCP TS values")
Reported-by: kernel test robot <oliver.sang@intel.com>
Closes: https://lore.kernel.org/oe-lkp/202310302216.f79d78bc-oliver.sang@intel.com
Suggested-by: Neal Cardwell <ncardwell@google.com>
Signed-off-by: Eric Dumazet <edumazet@google.com>
Cc: David Morley <morleyd@google.com>
Acked-by: Neal Cardwell <ncardwell@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>

selftests: pmtu.sh: fix result checking

In the PMTU test, when all previous tests are skipped and the new test
passes, the exit code is set to 0. However, the current check mistakenly
treats this as an assignment, causing the check to pass every time.

Consequently, regardless of how many tests have failed, if the latest test
passes, the PMTU test will report a pass.

Fixes: 2a9d3716b810 ("selftests: pmtu.sh: improve the test result processing")
Signed-off-by: Hangbin Liu <liuhangbin@gmail.com>
Acked-by: Po-Hsu Lin <po-hsu.lin@canonical.com>
Signed-off-by: David S. Miller <davem@davemloft.net>

net: stmmac: xgmac: Enable support for multiple Flexible PPS outputs

From XGMAC Core 3.20 and later, each Flexible PPS has individual PPSEN bit
to select Fixed mode or Flexible mode. The PPSEN must be set, or it stays
in Fixed PPS mode by default.
XGMAC Core prior 3.20, only PPSEN0(bit 4) is writable. PPSEN{1,2,3} are
read-only reserved, and they are already in Flexible mode by default, our
new code always set PPSEN{1,2,3} do not make things worse ;-)

Fixes: 95eaf3cd0a90 ("net: stmmac: dwxgmac: Add Flexible PPS support")
Reviewed-by: Serge Semin <fancer.lancer@gmail.com>
Reviewed-by: Jacob Keller <jacob.e.keller@intel.com>
Signed-off-by: Furong Xu <0x1207@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>

Fix termination state for idr_for_each_entry_ul()

The comment for idr_for_each_entry_ul() states

  after normal termination @entry is left with the value NULL

This is not correct in the case where UINT_MAX has an entry in the idr.
In that case @entry will be non-NULL after termination.
No current code depends on the documentation being correct, but to
save future code we should fix it.

Also fix idr_for_each_entry_continue_ul().  While this is not documented
as leaving @entry as NULL, the mellanox driver appears to depend on
it doing so.  So make that explicit in the documentation as well as in
the code.

Fixes: e33d2b74d805 ("idr: fix overflow case for idr_for_each_entry_ul()")
Cc: Matthew Wilcox <willy@infradead.org>
Cc: Chris Mi <chrism@mellanox.com>
Cc: Cong Wang <xiyou.wangcong@gmail.com>
Signed-off-by: NeilBrown <neilb@suse.de>
Signed-off-by: David S. Miller <davem@davemloft.net>

net: r8169: Disable multicast filter for RTL8168H and RTL8107E

RTL8168H and RTL8107E ethernet adapters erroneously filter unicast
eapol packets unless allmulti is enabled. These devices correspond to
RTL_GIGA_MAC_VER_46 and VER_48. Add an exception for VER_46 and VER_48
in the same way that VER_35 has an exception.

Fixes: 6e1d0b898818 ("r8169:add support for RTL8168H and RTL8107E")
Signed-off-by: Patrick Thompson <ptf@google.com>
Reviewed-by: Jacob Keller <jacob.e.keller@intel.com>
Reviewed-by: Heiner Kallweit <hkallweit1@gmail.com>
Link: https://lore.kernel.org/r/20231030205031.177855-1-ptf@google.com
Signed-off-by: Paolo Abeni <pabeni@redhat.com>

Merge branch 'dccp-tcp-relocate-security_inet_conn_request'

Kuniyuki Iwashima says:

====================
dccp/tcp: Relocate security_inet_conn_request().

security_inet_conn_request() reads reqsk's remote address, but it's not
initialised in some places.

Let's make sure the address is set before security_inet_conn_request().
====================

Link: https://lore.kernel.org/r/20231030201042.32885-1-kuniyu@amazon.com
Signed-off-by: Paolo Abeni <pabeni@redhat.com>

dccp/tcp: Call security_inet_conn_request() after setting IPv6 addresses.

Initially, commit 4237c75c0a35 ("[MLSXFRM]: Auto-labeling of child
sockets") introduced security_inet_conn_request() in some functions
where reqsk is allocated. The hook is added just after the allocation,
so reqsk's IPv6 remote address was not initialised then.

However, SELinux/Smack started to read it in netlbl_req_setattr()
after commit e1adea927080 ("calipso: Allow request sockets to be
relabelled by the lsm.").

Commit 284904aa7946 ("lsm: Relocate the IPv4 security_inet_conn_request()
hooks") fixed that kind of issue only in TCPv4 because IPv6 labeling was
not supported at that time. Finally, the same issue was introduced again
in IPv6.

Let's apply the same fix on DCCPv6 and TCPv6.

Fixes: e1adea927080 ("calipso: Allow request sockets to be relabelled by the lsm.")
Signed-off-by: Kuniyuki Iwashima <kuniyu@amazon.com>
Acked-by: Paul Moore <paul@paul-moore.com>
Signed-off-by: Paolo Abeni <pabeni@redhat.com>

dccp: Call security_inet_conn_request() after setting IPv4 addresses.

Initially, commit 4237c75c0a35 ("[MLSXFRM]: Auto-labeling of child
sockets") introduced security_inet_conn_request() in some functions
where reqsk is allocated. The hook is added just after the allocation,
so reqsk's IPv4 remote address was not initialised then.

However, SELinux/Smack started to read it in netlbl_req_setattr()
after the cited commits.

This bug was partially fixed by commit 284904aa7946 ("lsm: Relocate
the IPv4 security_inet_conn_request() hooks").

This patch fixes the last bug in DCCPv4.

Fixes: 389fb800ac8b ("netlabel: Label incoming TCP connections correctly in SELinux")
Fixes: 07feee8f812f ("netlabel: Cleanup the Smack/NetLabel code to fix incoming TCP connections")
Signed-off-by: Kuniyuki Iwashima <kuniyu@amazon.com>
Acked-by: Paul Moore <paul@paul-moore.com>
Signed-off-by: Paolo Abeni <pabeni@redhat.com>

net/smc: fix documentation of buffer sizes

Since commit 833bac7ec392 ("net/smc: Fix setsockopt and sysctl to
specify same buffer size again") the SMC protocol uses its own
default values for the smc.rmem and smc.wmem sysctl variables
which are no longer derived from the TCP IPv4 buffer sizes.

Fixup the kernel documentation to reflect this change, too.

Fixes: 833bac7ec392 ("net/smc: Fix setsockopt and sysctl to specify same buffer size again")
Signed-off-by: Gerd Bayer <gbayer@linux.ibm.com>
Reviewed-by: Wenjia Zhang <wenjia@linux.ibm.com>
Reviewed-by: Dust Li <dust.li@linux.alibaba.com>
Link: https://lore.kernel.org/r/20231030170343.748097-1-gbayer@linux.ibm.com
Signed-off-by: Paolo Abeni <pabeni@redhat.com>

net: page_pool: add missing free_percpu when page_pool_init fail

When ptr_ring_init() returns failure in page_pool_init(), free_percpu()
is not called to free pool->recycle_stats, which may cause memory
leak.

Fixes: ad6fa1e1ab1b ("page_pool: Add recycle stats")
Signed-off-by: Jian Shen <shenjian15@huawei.com>
Signed-off-by: Jijie Shao <shaojijie@huawei.com>
Reviewed-by: Yunsheng Lin <linyunsheng@huawei.com>
Reviewed-by: Jiri Pirko <jiri@nvidia.com>
Reviewed-by: Somnath Kotur <somnath.kotur@broadcom.com>
Reviewed-by: Ilias Apalodimas <ilias.apalodimas@linaro.org>
Link: https://lore.kernel.org/r/20231030091256.2915394-1-shaojijie@huawei.com
Signed-off-by: Paolo Abeni <pabeni@redhat.com>

net: ethtool: Fix documentation of ethtool_sprintf()

This function takes a pointer to a pointer, unlike sprintf() which is
passed a plain pointer. Fix up the documentation to make this clear.

Fixes: 7888fe53b706 ("ethtool: Add common function for filling out strings")
Cc: Alexander Duyck <alexanderduyck@fb.com>
Cc: Justin Stitt <justinstitt@google.com>
Cc: stable@vger.kernel.org
Signed-off-by: Andrew Lunn <andrew@lunn.ch>
Reviewed-by: Justin Stitt <justinstitt@google.com>
Link: https://lore.kernel.org/r/20231028192511.100001-1-andrew@lunn.ch
Signed-off-by: Paolo Abeni <pabeni@redhat.com>

net: dsa: lan9303: consequently nested-lock physical MDIO

When LAN9303 is MDIO-connected two callchains exist into
mdio->bus->write():

1. switch ports 1&2 ("physical" PHYs):

virtual (switch-internal) MDIO bus (lan9303_switch_ops->phy_{read|write})->
  lan9303_mdio_phy_{read|write} -> mdiobus_{read|write}_nested

2. LAN9303 virtual PHY:

virtual MDIO bus (lan9303_phy_{read|write}) ->
  lan9303_virt_phy_reg_{read|write} -> regmap -> lan9303_mdio_{read|write}

If the latter functions just take
mutex_lock(&sw_dev->device->bus->mdio_lock) it triggers a LOCKDEP
false-positive splat. It's false-positive because the first
mdio_lock in the second callchain above belongs to virtual MDIO bus, the
second mdio_lock belongs to physical MDIO bus.

Consequent annotation in lan9303_mdio_{read|write} as nested lock
(similar to lan9303_mdio_phy_{read|write}, it's the same physical MDIO bus)
prevents the following splat:

WARNING: possible circular locking dependency detected
5.15.71 #1 Not tainted
------------------------------------------------------
kworker/u4:3/609 is trying to acquire lock:
ffff000011531c68 (lan9303_mdio:131:(&lan9303_mdio_regmap_config)->lock){+.+.}-{3:3}, at: regmap_lock_mutex
but task is already holding lock:
ffff0000114c44d8 (&bus->mdio_lock){+.+.}-{3:3}, at: mdiobus_read
which lock already depends on the new lock.
the existing dependency chain (in reverse order) is:
-> #1 (&bus->mdio_lock){+.+.}-{3:3}:
       lock_acquire
       __mutex_lock
       mutex_lock_nested
       lan9303_mdio_read
       _regmap_read
       regmap_read
       lan9303_probe
       lan9303_mdio_probe
       mdio_probe
       really_probe
       __driver_probe_device
       driver_probe_device
       __device_attach_driver
       bus_for_each_drv
       __device_attach
       device_initial_probe
       bus_probe_device
       deferred_probe_work_func
       process_one_work
       worker_thread
       kthread
       ret_from_fork
-> #0 (lan9303_mdio:131:(&lan9303_mdio_regmap_config)->lock){+.+.}-{3:3}:
       __lock_acquire
       lock_acquire.part.0
       lock_acquire
       __mutex_lock
       mutex_lock_nested
       regmap_lock_mutex
       regmap_read
       lan9303_phy_read
       dsa_slave_phy_read
       __mdiobus_read
       mdiobus_read
       get_phy_device
       mdiobus_scan
       __mdiobus_register
       dsa_register_switch
       lan9303_probe
       lan9303_mdio_probe
       mdio_probe
       really_probe
       __driver_probe_device
       driver_probe_device
       __device_attach_driver
       bus_for_each_drv
       __device_attach
       device_initial_probe
       bus_probe_device
       deferred_probe_work_func
       process_one_work
       worker_thread
       kthread
       ret_from_fork
other info that might help us debug this:
Possible unsafe locking scenario:
       CPU0                    CPU1
       ----                    ----
  lock(&bus->mdio_lock);
                               lock(lan9303_mdio:131:(&lan9303_mdio_regmap_config)->lock);
                               lock(&bus->mdio_lock);
  lock(lan9303_mdio:131:(&lan9303_mdio_regmap_config)->lock);
*** DEADLOCK ***
5 locks held by kworker/u4:3/609:
#0: ffff000002842938 ((wq_completion)events_unbound){+.+.}-{0:0}, at: process_one_work
#1: ffff80000bacbd60 (deferred_probe_work){+.+.}-{0:0}, at: process_one_work
#2: ffff000007645178 (&dev->mutex){....}-{3:3}, at: __device_attach
#3: ffff8000096e6e78 (dsa2_mutex){+.+.}-{3:3}, at: dsa_register_switch
#4: ffff0000114c44d8 (&bus->mdio_lock){+.+.}-{3:3}, at: mdiobus_read
stack backtrace:
CPU: 1 PID: 609 Comm: kworker/u4:3 Not tainted 5.15.71 #1
Workqueue: events_unbound deferred_probe_work_func
Call trace:
dump_backtrace
show_stack
dump_stack_lvl
dump_stack
print_circular_bug
check_noncircular
__lock_acquire
lock_acquire.part.0
lock_acquire
__mutex_lock
mutex_lock_nested
regmap_lock_mutex
regmap_read
lan9303_phy_read
dsa_slave_phy_read
__mdiobus_read
mdiobus_read
get_phy_device
mdiobus_scan
__mdiobus_register
dsa_register_switch
lan9303_probe
lan9303_mdio_probe
...

Cc: stable@vger.kernel.org
Fixes: dc7005831523 ("net: dsa: LAN9303: add MDIO managed mode support")
Signed-off-by: Alexander Sverdlin <alexander.sverdlin@siemens.com>
Reviewed-by: Andrew Lunn <andrew@lunn.ch>
Link: https://lore.kernel.org/r/20231027065741.534971-1-alexander.sverdlin@siemens.com
Signed-off-by: Paolo Abeni <pabeni@redhat.com>

octeontx2-pf: Fix holes in error code

Error code strings are not getting printed properly
due to holes. Print error code as well.

Fixes: 51afe9026d0c ("octeontx2-pf: NIX TX overwrites SQ_CTX_HW_S[SQ_INT]")
Signed-off-by: Ratheesh Kannoth <rkannoth@marvell.com>
Reviewed-by: Wojciech Drewek <wojciech.drewek@intel.com>
Link: https://lore.kernel.org/r/20231027021953.1819959-2-rkannoth@marvell.com
Signed-off-by: Paolo Abeni <pabeni@redhat.com>

octeontx2-pf: Fix error codes

Some of error codes were wrong. Fix the same.

Fixes: 51afe9026d0c ("octeontx2-pf: NIX TX overwrites SQ_CTX_HW_S[SQ_INT]")
Signed-off-by: Ratheesh Kannoth <rkannoth@marvell.com>
Reviewed-by: Wojciech Drewek <wojciech.drewek@intel.com>
Link: https://lore.kernel.org/r/20231027021953.1819959-1-rkannoth@marvell.com
Signed-off-by: Paolo Abeni <pabeni@redhat.com>

inet: shrink struct flowi_common

I am looking at syzbot reports triggering kernel stack overflows
involving a cascade of ipvlan devices.

We can save 8 bytes in struct flowi_common.

This patch alone will not fix the issue, but is a start.

Fixes: 24ba14406c5c ("route: Add multipath_hash in flowi_common to make user-define hash")
Signed-off-by: Eric Dumazet <edumazet@google.com>
Cc: wenxu <wenxu@ucloud.cn>
Reviewed-by: David Ahern <dsahern@kernel.org>
Link: https://lore.kernel.org/r/20231025141037.3448203-1-edumazet@google.com
Signed-off-by: Paolo Abeni <pabeni@redhat.com>

rxrpc: Fix two connection reaping bugs

Fix two connection reaping bugs:

(1) rxrpc_connection_expiry is in units of seconds, so
     rxrpc_disconnect_call() needs to multiply it by HZ when adding it to
     jiffies.

(2) rxrpc_client_conn_reap_timeout() should set RXRPC_CLIENT_REAP_TIMER if
     local->kill_all_client_conns is clear, not if it is set (in which case
     we don't need the timer).  Without this, old client connections don't
     get cleaned up until the local endpoint is cleaned up.

Fixes: 5040011d073d ("rxrpc: Make the local endpoint hold a ref on a connected call")
Fixes: 0d6bf319bc5a ("rxrpc: Move the client conn cache management to the I/O thread")
Signed-off-by: David Howells <dhowells@redhat.com>
cc: Marc Dionne <marc.dionne@auristor.com>
cc: linux-afs@lists.infradead.org
Link: https://lore.kernel.org/r/783911.1698364174@warthog.procyon.org.uk
Signed-off-by: Jakub Kicinski <kuba@kernel.org>

net/tcp_sigpool: Fix some off by one bugs

The "cpool_populated" variable is the number of elements in the cpool[]
array that have been populated. It is incremented in
tcp_sigpool_alloc_ahash() every time we populate a new element.
Unpopulated elements are NULL but if we have populated every element then
this code will read one element beyond the end of the array.

Fixes: 8c73b26315aa ("net/tcp: Prepare tcp_md5sig_pool for TCP-AO")
Signed-off-by: Dan Carpenter <dan.carpenter@linaro.org>
Reviewed-by: Dmitry Safonov <dima@arista.com>
Reviewed-by: Eric Dumazet <edumazet@google.com>
Link: https://lore.kernel.org/r/ce915d61-04bc-44fb-b450-35fcc9fc8831@moroto.mountain
Signed-off-by: Jakub Kicinski <kuba@kernel.org>

tipc: Change nla_policy for bearer-related names to NLA_NUL_STRING

syzbot reported the following uninit-value access issue [1]:

=====================================================
BUG: KMSAN: uninit-value in strlen lib/string.c:418 [inline]
BUG: KMSAN: uninit-value in strstr+0xb8/0x2f0 lib/string.c:756
strlen lib/string.c:418 [inline]
strstr+0xb8/0x2f0 lib/string.c:756
tipc_nl_node_reset_link_stats+0x3ea/0xb50 net/tipc/node.c:2595
genl_family_rcv_msg_doit net/netlink/genetlink.c:971 [inline]
genl_family_rcv_msg net/netlink/genetlink.c:1051 [inline]
genl_rcv_msg+0x11ec/0x1290 net/netlink/genetlink.c:1066
netlink_rcv_skb+0x371/0x650 net/netlink/af_netlink.c:2545
genl_rcv+0x40/0x60 net/netlink/genetlink.c:1075
netlink_unicast_kernel net/netlink/af_netlink.c:1342 [inline]
netlink_unicast+0xf47/0x1250 net/netlink/af_netlink.c:1368
netlink_sendmsg+0x1238/0x13d0 net/netlink/af_netlink.c:1910
sock_sendmsg_nosec net/socket.c:730 [inline]
sock_sendmsg net/socket.c:753 [inline]
____sys_sendmsg+0x9c2/0xd60 net/socket.c:2541
___sys_sendmsg+0x28d/0x3c0 net/socket.c:2595
__sys_sendmsg net/socket.c:2624 [inline]
__do_sys_sendmsg net/socket.c:2633 [inline]
__se_sys_sendmsg net/socket.c:2631 [inline]
__x64_sys_sendmsg+0x307/0x490 net/socket.c:2631
do_syscall_x64 arch/x86/entry/common.c:50 [inline]
do_syscall_64+0x41/0xc0 arch/x86/entry/common.c:80
entry_SYSCALL_64_after_hwframe+0x63/0xcd

Uninit was created at:
slab_post_alloc_hook+0x12f/0xb70 mm/slab.h:767
slab_alloc_node mm/slub.c:3478 [inline]
kmem_cache_alloc_node+0x577/0xa80 mm/slub.c:3523
kmalloc_reserve+0x13d/0x4a0 net/core/skbuff.c:559
__alloc_skb+0x318/0x740 net/core/skbuff.c:650
alloc_skb include/linux/skbuff.h:1286 [inline]
netlink_alloc_large_skb net/netlink/af_netlink.c:1214 [inline]
netlink_sendmsg+0xb34/0x13d0 net/netlink/af_netlink.c:1885
sock_sendmsg_nosec net/socket.c:730 [inline]
sock_sendmsg net/socket.c:753 [inline]
____sys_sendmsg+0x9c2/0xd60 net/socket.c:2541
___sys_sendmsg+0x28d/0x3c0 net/socket.c:2595
__sys_sendmsg net/socket.c:2624 [inline]
__do_sys_sendmsg net/socket.c:2633 [inline]
__se_sys_sendmsg net/socket.c:2631 [inline]
__x64_sys_sendmsg+0x307/0x490 net/socket.c:2631
do_syscall_x64 arch/x86/entry/common.c:50 [inline]
do_syscall_64+0x41/0xc0 arch/x86/entry/common.c:80
entry_SYSCALL_64_after_hwframe+0x63/0xcd

TIPC bearer-related names including link names must be null-terminated
strings. If a link name which is not null-terminated is passed through
netlink, strstr() and similar functions can cause buffer overrun. This
causes the above issue.

This patch changes the nla_policy for bearer-related names from NLA_STRING
to NLA_NUL_STRING. This resolves the issue by ensuring that only
null-terminated strings are accepted as bearer-related names.

syzbot reported similar uninit-value issue related to bearer names [2]. The
root cause of this issue is that a non-null-terminated bearer name was
passed. This patch also resolved this issue.

Fixes: 7be57fc69184 ("tipc: add link get/dump to new netlink api")
Fixes: 0655f6a8635b ("tipc: add bearer disable/enable to new netlink api")
Reported-and-tested-by: syzbot+5138ca807af9d2b42574@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=5138ca807af9d2b42574 [1]
Reported-and-tested-by: syzbot+9425c47dccbcb4c17d51@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=9425c47dccbcb4c17d51 [2]
Signed-off-by: Shigeru Yoshida <syoshida@redhat.com>
Reviewed-by: Jiri Pirko <jiri@nvidia.com>
Link: https://lore.kernel.org/r/20231030075540.3784537-1-syoshida@redhat.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>

hsr: Prevent use after free in prp_create_tagged_frame()

The prp_fill_rct() function can fail.  In that situation, it frees the
skb and returns NULL.  Meanwhile on the success path, it returns the
original skb.  So it's straight forward to fix bug by using the returned
value.

Fixes: 451d8123f897 ("net: prp: add packet handling support")
Signed-off-by: Dan Carpenter <dan.carpenter@linaro.org>
Acked-by: Paolo Abeni <pabeni@redhat.com>
Link: https://lore.kernel.org/r/57af1f28-7f57-4a96-bcd3-b7a0f2340845@moroto.mountain
Signed-off-by: Jakub Kicinski <kuba@kernel.org>

llc: verify mac len before reading mac header

LLC reads the mac header with eth_hdr without verifying that the skb
has an Ethernet header.

Syzbot was able to enter llc_rcv on a tun device. Tun can insert
packets without mac len and with user configurable skb->protocol
(passing a tun_pi header when not configuring IFF_NO_PI).

    BUG: KMSAN: uninit-value in llc_station_ac_send_test_r net/llc/llc_station.c:81 [inline]
    BUG: KMSAN: uninit-value in llc_station_rcv+0x6fb/0x1290 net/llc/llc_station.c:111
    llc_station_ac_send_test_r net/llc/llc_station.c:81 [inline]
    llc_station_rcv+0x6fb/0x1290 net/llc/llc_station.c:111
    llc_rcv+0xc5d/0x14a0 net/llc/llc_input.c:218
    __netif_receive_skb_one_core net/core/dev.c:5523 [inline]
    __netif_receive_skb+0x1a6/0x5a0 net/core/dev.c:5637
    netif_receive_skb_internal net/core/dev.c:5723 [inline]
    netif_receive_skb+0x58/0x660 net/core/dev.c:5782
    tun_rx_batched+0x3ee/0x980 drivers/net/tun.c:1555
    tun_get_user+0x54c5/0x69c0 drivers/net/tun.c:2002

Add a mac_len test before all three eth_hdr(skb) calls under net/llc.

There are further uses in include/net/llc_pdu.h. All these are
protected by a test skb->protocol == ETH_P_802_2. Which does not
protect against this tun scenario.

But the mac_len test added in this patch in llc_fixup_skb will
indirectly protect those too. That is called from llc_rcv before any
other LLC code.

It is tempting to just add a blanket mac_len check in llc_rcv, but
not sure whether that could break valid LLC paths that do not assume
an Ethernet header. 802.2 LLC may be used on top of non-802.3
protocols in principle. The below referenced commit shows that used
to, on top of Token Ring.

At least one of the three eth_hdr uses goes back to before the start
of git history. But the one that syzbot exercises is introduced in
this commit. That commit is old enough (2008), that effectively all
stable kernels should receive this.

Fixes: f83f1768f833 ("[LLC]: skb allocation size for responses")
Reported-by: syzbot+a8c7be6dee0de1b669cc@syzkaller.appspotmail.com
Signed-off-by: Willem de Bruijn <willemb@google.com>
Link: https://lore.kernel.org/r/20231025234251.3796495-1-willemdebruijn.kernel@gmail.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>

net: xscale: Drop unused PHY number

For some cargoculted reason on incomplete cleanup, we have a
PHY number which refers to nothing and gives confusing messages
about PHY 0 on all ports.

Print the name of the actual PHY device instead.

Reported-by: Howard Harte <hharte@magicandroidapps.com>
Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
Link: https://lore.kernel.org/r/20231028-ixp4xx-eth-id-v1-1-57be486d7f0f@linaro.org
Signed-off-by: Jakub Kicinski <kuba@kernel.org>

tools: ynl-gen: don't touch the output file if content is the same

I often regenerate all YNL files in the tree to make sure they
are in sync with the codegen and specs. Generator rewrites
the files unconditionally, so since make looks at file modification
time to decide what to rebuild - my next build takes longer.

We already generate the code to a tempfile most of the time,
only overwrite the target when we have to.

Before:

  $ stat include/uapi/linux/netdev.h
    File: include/uapi/linux/netdev.h
    Size: 2307       Blocks: 8          IO Block: 4096   regular file
  Access: 2023-10-27 15:19:56.347071940 -0700
  Modify: 2023-10-27 15:19:45.089000900 -0700
  Change: 2023-10-27 15:19:45.089000900 -0700
   Birth: 2023-10-27 15:19:45.088000894 -0700

  $ ./tools/net/ynl/ynl-regen.sh -f
  [...]

  $ stat include/uapi/linux/netdev.h
    File: include/uapi/linux/netdev.h
    Size: 2307       Blocks: 8          IO Block: 4096   regular file
  Access: 2023-10-27 15:19:56.347071940 -0700
  Modify: 2023-10-27 15:22:18.417968446 -0700
  Change: 2023-10-27 15:22:18.417968446 -0700
   Birth: 2023-10-27 15:19:45.088000894 -0700

After:

  $ stat include/uapi/linux/netdev.h
    File: include/uapi/linux/netdev.h
    Size: 2307       Blocks: 8          IO Block: 4096   regular file
  Access: 2023-10-27 15:22:41.520114221 -0700
  Modify: 2023-10-27 15:22:18.417968446 -0700
  Change: 2023-10-27 15:22:18.417968446 -0700
   Birth: 2023-10-27 15:19:45.088000894 -0700

  $ ./tools/net/ynl/ynl-regen.sh -f
  [...]

  $ stat include/uapi/linux/netdev.h
    File: include/uapi/linux/netdev.h
    Size: 2307       Blocks: 8          IO Block: 4096   regular file
  Access: 2023-10-27 15:22:41.520114221 -0700
  Modify: 2023-10-27 15:22:18.417968446 -0700
  Change: 2023-10-27 15:22:18.417968446 -0700
   Birth: 2023-10-27 15:19:45.088000894 -0700

Reviewed-by: Jiri Pirko <jiri@nvidia.com>
Link: https://lore.kernel.org/r/20231027223408.1865704-1-kuba@kernel.org
Signed-off-by: Jakub Kicinski <kuba@kernel.org>

netlink: specs: devlink: add forgotten port function caps enum values

Add two enum values that the blamed commit omitted.

Fixes: f2f9dd164db0 ("netlink: specs: devlink: add the remaining command to generate complete split_ops")
Signed-off-by: Jiri Pirko <jiri@nvidia.com>
Link: https://lore.kernel.org/r/20231030161750.110420-1-jiri@resnulli.us
Signed-off-by: Jakub Kicinski <kuba@kernel.org>

Merge branch 'add-missing-module_descriptions'

Andrew Lunn says:

====================
Add missing MODULE_DESCRIPTIONS

Fixup PHY and MDIO drivers which are missing MODULE_DESCRIPTION.
====================

Link: https://lore.kernel.org/r/20231028184458.99448-1-andrew@lunn.ch
Signed-off-by: Jakub Kicinski <kuba@kernel.org>

net: mdio: fill in missing MODULE_DESCRIPTION()s

W=1 builds now warn if a module is built without a
MODULE_DESCRIPTION(). Fill them in based on the Kconfig text, or
similar.

Signed-off-by: Andrew Lunn <andrew@lunn.ch>
Reviewed-by: Florian Fainelli <florian.fainelli@broadcom.com>
Acked-by: Andrew Jeffery <andrew@codeconstruct.com.au>
Link: https://lore.kernel.org/r/20231028184458.99448-3-andrew@lunn.ch
Signed-off-by: Jakub Kicinski <kuba@kernel.org>

net: phy: fill in missing MODULE_DESCRIPTION()s

W=1 builds now warn if a module is built without a
MODULE_DESCRIPTION(). Fill them in based on the Kconfig text, or
similar.

Signed-off-by: Andrew Lunn <andrew@lunn.ch>
Reviewed-by: Florian Fainelli <florian.fainelli@broadcom.com>
Acked-by: Russell King (Oracle) <rmk+kernel@armlinux.org.uk>
Link: https://lore.kernel.org/r/20231028184458.99448-2-andrew@lunn.ch
Signed-off-by: Jakub Kicinski <kuba@kernel.org>

Merge branch 'net-sched-fill-in-missing-module_descriptions-for-net-sched'

Victor Nogueira says:

====================
net: sched: Fill in missing MODULE_DESCRIPTIONs for net/sched

W=1 builds now warn if module is built without a MODULE_DESCRIPTION().

Fill in the missing MODULE_DESCRIPTIONs for net/sched
====================

Link: https://lore.kernel.org/r/20231027155045.46291-1-victor@mojatatu.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>

net: sched: Fill in missing MODULE_DESCRIPTION for qdiscs

W=1 builds now warn if module is built without a MODULE_DESCRIPTION().

Fill in missing MODULE_DESCRIPTIONs for TC qdiscs.

Signed-off-by: Victor Nogueira <victor@mojatatu.com>
Acked-by: Jamal Hadi Salim <jhs@mojatatu.com>
Reviewed-by: Vinicius Costa Gomes <vinicius.gomes@intel.com>
Link: https://lore.kernel.org/r/20231027155045.46291-4-victor@mojatatu.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>

net: sched: Fill in missing MODULE_DESCRIPTION for classifiers

W=1 builds now warn if module is built without a MODULE_DESCRIPTION().

Fill in missing MODULE_DESCRIPTIONs for TC classifiers.

Signed-off-by: Victor Nogueira <victor@mojatatu.com>
Acked-by: Jamal Hadi Salim <jhs@mojatatu.com>
Reviewed-by: Vinicius Costa Gomes <vinicius.gomes@intel.com>
Link: https://lore.kernel.org/r/20231027155045.46291-3-victor@mojatatu.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>

net: sched: Fill in MODULE_DESCRIPTION for act_gate

W=1 builds now warn if module is built without a MODULE_DESCRIPTION().

Gate is the only TC action that is lacking such description.
Fill MODULE_DESCRIPTION for Gate TC ACTION.

Signed-off-by: Victor Nogueira <victor@mojatatu.com>
Acked-by: Jamal Hadi Salim <jhs@mojatatu.com>
Reviewed-by: Vinicius Costa Gomes <vinicius.gomes@intel.com>
Link: https://lore.kernel.org/r/20231027155045.46291-2-victor@mojatatu.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>

Merge tag 'net-next-6.7-followup' of git://git./linux/kernel/git/netdev/net-next

Pull more networking updates from Jakub Kicinski:

- Support GRO decapsulation for IPsec ESP in UDP

- Add a handful of MODULE_DESCRIPTION()s

- Drop questionable alignment check in TCP AO to avoid
   build issue after changes in the crypto tree

* tag 'net-next-6.7-followup' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net-next:
  net: tcp: remove call to obsolete crypto_ahash_alignmask()
  net: fill in MODULE_DESCRIPTION()s under drivers/net/
  net: fill in MODULE_DESCRIPTION()s under net/802*
  net: fill in MODULE_DESCRIPTION()s under net/core
  net: fill in MODULE_DESCRIPTION()s in kuba@'s modules
  xfrm: policy: fix layer 4 flowi decoding
  xfrm Fix use after free in __xfrm6_udp_encap_rcv.
  xfrm: policy: replace session decode with flow dissector
  xfrm: move mark and oif flowi decode into common code
  xfrm: pass struct net to xfrm_decode_session wrappers
  xfrm: Support GRO for IPv6 ESP in UDP encapsulation
  xfrm: Support GRO for IPv4 ESP in UDP encapsulation
  xfrm: Use the XFRM_GRO to indicate a GRO call on input
  xfrm: Annotate struct xfrm_sec_ctx with __counted_by
  xfrm: Remove unused function declarations

Merge tag 'probes-v6.7' of git://git./linux/kernel/git/trace/linux-trace

Pull probes updates from Masami Hiramatsu:
"Cleanups:

   - kprobes: Fixes typo in kprobes samples

   - tracing/eprobes: Remove 'break' after return

  kretprobe/fprobe performance improvements:

   - lib: Introduce new `objpool`, which is a high performance lockless
     object queue. This uses per-cpu ring array to allocate/release
     objects from the pre-allocated object pool.

     Since the index of ring array is a 32bit sequential counter, we can
     retry to push/pop the object pointer from the ring without lock (as
     seq-lock does)

   - lib: Add an objpool test module to test the functionality and
     evaluate the performance under some circumstances

   - kprobes/fprobe: Improve kretprobe and rethook scalability
     performance with objpool.

     This improves both legacy kretprobe and fprobe exit handler (which
     is based on rethook) to be scalable on SMP systems. Even with
     8-threads parallel test, it shows a great scalability improvement

   - Remove unneeded freelist.h which is replaced by objpool

   - objpool: Add maintainers entry for the objpool

   - objpool: Fix to remove unused include header lines"

* tag 'probes-v6.7' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace:
  kprobes: unused header files removed
  MAINTAINERS: objpool added
  kprobes: freelist.h removed
  kprobes: kretprobe scalability improvement
  lib: objpool test module added
  lib: objpool added: ring-array based lockless MPMC
  tracing/eprobe: drop unneeded breaks
  samples: kprobes: Fixes a typo

Merge tag 'bootconfig-v6.7' of git://git./linux/kernel/git/trace/linux-trace

Pull bootconfig updates from Masami Hiramatsu:

- Documentation update for /proc/cmdline, which includes both the
   parameters from bootloader and the embedded parameters in the kernel

- fs/proc: Add bootloader argument as a comment line to
   /proc/bootconfig so that the user can distinguish what parameters
   were passed from bootloader even if bootconfig modified that

- Documentation fix to add /proc/bootconfig to proc.rst

* tag 'bootconfig-v6.7' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace:
  doc: Add /proc/bootconfig to proc.rst
  fs/proc: Add boot loader arguments as comment to /proc/bootconfig
  doc: Update /proc/cmdline documentation to include boot config

Merge tag 'asm-generic-6.7' of git://git./linux/kernel/git/arnd/asm-generic

Pull ia64 removal and asm-generic updates from Arnd Bergmann:

- The ia64 architecture gets its well-earned retirement as planned,
   now that there is one last (mostly) working release that will be
   maintained as an LTS kernel.

- The architecture specific system call tables are updated for the
   added map_shadow_stack() syscall and to remove references to the
   long-gone sys_lookup_dcookie() syscall.

* tag 'asm-generic-6.7' of git://git.kernel.org/pub/scm/linux/kernel/git/arnd/asm-generic:
  hexagon: Remove unusable symbols from the ptrace.h uapi
  asm-generic: Fix spelling of architecture
  arch: Reserve map_shadow_stack() syscall number for all architectures
  syscalls: Cleanup references to sys_lookup_dcookie()
  Documentation: Drop or replace remaining mentions of IA64
  lib/raid6: Drop IA64 support
  Documentation: Drop IA64 from feature descriptions
  kernel: Drop IA64 support from sig_fault handlers
  arch: Remove Itanium (IA-64) architecture

Merge tag 'soc-arm-6.7' of git://git./linux/kernel/git/soc/soc

Pull ARM SoC code updates from Arnd Bergmann:
"The AMD Pensando DPU platform gets added to arm64, and some minor
  updates make it into Renesas' 32-bit platforms"

* tag 'soc-arm-6.7' of git://git.kernel.org/pub/scm/linux/kernel/git/soc/soc:
  arm: debug: reuse the config DEBUG_OMAP2UART{1,2} for OMAP{3,4,5}
  arm64: Add config for AMD Pensando SoC platforms
  MAINTAINERS: Add entry for AMD PENSANDO
  ARM: shmobile: sh73a0: Reserve boot area when SMP is enabled
  ARM: shmobile: r8a7779: Reserve boot area when SMP is enabled
  ARM: shmobile: rcar-gen2: Reserve boot area when SMP is enabled
  ARM: shmobile: rcar-gen2: Remove unneeded once handling

Merge tag 'soc-defconfig-6.7' of git://git./linux/kernel/git/soc/soc

Pull ARM defconfig updates from Arnd Bergmann:
"These are the usual trivial changes to enable a couple of newly added
  device drivers and remove lines for Kconfig options that are no longer
  needed"

* tag 'soc-defconfig-6.7' of git://git.kernel.org/pub/scm/linux/kernel/git/soc/soc: (24 commits)
  arm64: defconfig: enable DisplayPort altmode support
  arm64: defconfig: enable CONFIG_TYPEC_QCOM_PMIC
  arm64: defconfig: add various drivers for Amlogic based boards
  ARM: config: aspeed: Remove FIRMWARE_MEMMAP
  ARM: config: aspeed_g5: Enable SSIF BMC driver
  ARM: config: aspeed: Add Ampere SMPro drivers
  ARM: config: aspeed: Add new FSI drivers
  arm64: defconfig: Enable TPS6593 PMIC for SK-AM62A
  ARM: exynos_defconfig: add driver for ISL29018
  ARM: multi_v7_defconfig: add drivers for S5C73M3 & S5K6A3 camera sensors
  arm64: defconfig: Enable RZ/G3S (R9A08G045) SoC
  ARM: multi_v7_defconfig: add tm2-touchkey driver
  ARM: exynos_defconfig: replace SATA_AHCI_PLATFORM with AHCI_DWC driver
  ARM: multi_v7_defconfig: add AHCI_DWC driver
  ARM: multi_v7_defconfig: make Exynos related PHYs modules
  ARM: s5pv210_defconfig: enable IIO required by MAX17040
  ARM: shmobile: defconfig: Refresh for v6.6-rc3
  ARM: defconfig: cleanup orphaned CONFIGs
  arm64: defconfig: Enable Samsung DSIM driver
  arm64: defconfig: Enable CONFIG_USB_MASS_STORAGE
  ...

Merge tag 'soc-drivers-6.7' of git://git./linux/kernel/git/soc/soc

Pull SoC driver updates from Arnd Bergmann:
"The highlights for the driver support this time are

   - Qualcomm platforms gain support for the Qualcomm Secure Execution
     Environment firmware interface to access EFI variables on certain
     devices, and new features for multiple platform and firmware
     drivers.

   - Arm FF-A firmware support gains support for v1.1 specification
     features, in particular notification and memory transaction
     descriptor changes.

   - SCMI firmware support now support v3.2 features for clock and DVFS
     configuration and a new transport for Qualcomm platforms.

   - Minor cleanups and bugfixes are added to pretty much all the active
     platforms: qualcomm, broadcom, dove, ti-k3, rockchip, sifive,
     amlogic, atmel, tegra, aspeed, vexpress, mediatek, samsung and
     more.

     In particular, this contains portions of the treewide conversion to
     use __counted_by annotations and the device_get_match_data helper"

* tag 'soc-drivers-6.7' of git://git.kernel.org/pub/scm/linux/kernel/git/soc/soc: (156 commits)
  soc: qcom: pmic_glink_altmode: Print return value on error
  firmware: qcom: scm: remove unneeded 'extern' specifiers
  firmware: qcom: scm: add a missing forward declaration for struct device
  firmware: qcom: move Qualcomm code into its own directory
  soc: samsung: exynos-chipid: Convert to platform remove callback returning void
  soc: qcom: apr: Add __counted_by for struct apr_rx_buf and use struct_size()
  soc: qcom: pmic_glink: fix connector type to be DisplayPort
  soc: ti: k3-socinfo: Avoid overriding return value
  soc: ti: k3-socinfo: Fix typo in bitfield documentation
  soc: ti: knav_qmss_queue: Use device_get_match_data()
  firmware: ti_sci: Use device_get_match_data()
  firmware: qcom: qseecom: add missing include guards
  soc/pxa: ssp: Convert to platform remove callback returning void
  soc/mediatek: mtk-mmsys: Convert to platform remove callback returning void
  soc/mediatek: mtk-devapc: Convert to platform remove callback returning void
  soc/loongson: loongson2_guts: Convert to platform remove callback returning void
  soc/litex: litex_soc_ctrl: Convert to platform remove callback returning void
  soc/ixp4xx: ixp4xx-qmgr: Convert to platform remove callback returning void
  soc/ixp4xx: ixp4xx-npe: Convert to platform remove callback returning void
  soc/hisilicon: kunpeng_hccs: Convert to platform remove callback returning void
  ...

Merge tag 'soc-dt-6.7' of git://git./linux/kernel/git/soc/soc

Pull SoC DT updates from Arnd Bergmann:
"There are a couple new SoCs that are supported for the first time:

   - AMD Pensando Elba is a data processing unit based on Cortex-A72 CPU
     cores

   - Sophgo makes RISC-V based chips, and we now support the CV1800B
     chip used in the milkv-duo board and the massive sg2042 chip in the
     milkv-pioneer, a 64-core developer workstation.

   - Qualcomm Snapdragon 720G (sm7125) is a close relative of Snapdragon
     7c and gets added with some Xiaomi phones

   - Renesas gains support for the R8A779F4 (R-Car S4-8) automotive SoC
     and the RZ/G3S (R9A08G045) embedded SoC.

  There are also a bunch of newly supported machines that use already
  supported chips. On the 32-bit side, we have:

   - USRobotics USR8200 is a NAS/Firewall/router based on the ancient
     Intel IXP4xx platform

   - A couple of machines based on the NXP i.MX5 and i.MX6 platforms

   - One machine each for Allwinner V3s, Aspeed AST2600, Microchip
     sama5d29 and ST STM32mp157

  The other ones all use arm64 cores on chips from allwinner, amlogic,
  freescale, mediatek, qualcomm and rockchip"

* tag 'soc-dt-6.7' of git://git.kernel.org/pub/scm/linux/kernel/git/soc/soc: (641 commits)
  ARM: dts: BCM5301X: Set switch ports for Linksys EA9200
  ARM: dts: BCM5301X: Set fixed-link for extra Netgear R8000 CPU ports
  ARM: dts: BCM5301X: Explicitly disable unused switch CPU ports
  ARM: dts: BCM5301X: Relicense Vivek's code to the GPL 2.0+ / MIT
  ARM: dts: BCM5301X: Relicense Felix's code to the GPL 2.0+ / MIT
  ARM: dts: BCM5301X: Set MAC address for Asus RT-AC87U
  arm64: dts: socionext: add missing cache properties
  riscv: dts: thead: convert isa detection to new properties
  arm64: dts: Update cache properties for socionext
  arm64: dts: ti: k3-am654-idk: Add ICSSG Ethernet ports
  arm64: dts: ti: k3-am654-icssg2: add ICSSG2 Ethernet support
  arm64: dts: ti: k3-am65-main: Add ICSSG IEP nodes
  arm64: dts: ti: k3-am62p5-sk: Updates for SK EVM
  arm64: dts: ti: k3-am62p: Add nodes for more IPs
  arm64: dts: rockchip: Add Turing RK1 SoM support
  dt-bindings: arm: rockchip: Add Turing RK1
  dt-bindings: vendor-prefixes: add turing
  arm64: dts: rockchip: Add DFI to rk3588s
  arm64: dts: rockchip: Add DFI to rk356x
  arm64: dts: rockchip: Always enable DFI on rk3399
  ...

Merge tag 'vfio-v6.7-rc1' of https://github.com/awilliam/linux-vfio

Pull VFIO updates from Alex Williamson:

- Add support for "chunk mode" in the mlx5-vfio-pci variant driver,
   which allows both larger device image sizes for migration, beyond the
   previous 4GB limit, and also read-ahead support for improved
   migration performance (Yishai Hadas)

- A new bus master control interface for the CDX bus driver where there
   is no in-band mechanism to toggle device DMA as there is through
   config space on PCI devices (Nipun Gupta)

- Add explicit alignment directives to vfio data structures to reduce
   the chance of breaking 32-bit userspace. In most cases this is
   transparent and the remaining cases where data structures are padded
   work within the existing rules for extending data structures within
   vfio (Stefan Hajnoczi)

- Resolve a bug in the cdx bus driver noted when compiled with clang
   where missing parenthesis result in the wrong operation (Nathan
   Chancellor)

- Resolve errors reported by smatch for a function when dealing with
   invalid inputs (Alex Williamson)

- Add migration support to the mtty vfio/mdev sample driver for testing
   and integration purposes, allowing CI of migration without specific
   hardware requirements. Also resolve many of the short- comings of
   this driver relative to implementation of the vfio interrupt ioctl
   along the way (Alex Williamson)

* tag 'vfio-v6.7-rc1' of https://github.com/awilliam/linux-vfio:
  vfio/mtty: Enable migration support
  vfio/mtty: Overhaul mtty interrupt handling
  vfio: Fix smatch errors in vfio_combine_iova_ranges()
  vfio/cdx: Add parentheses between bitwise AND expression and logical NOT
  vfio/mlx5: Activate the chunk mode functionality
  vfio/mlx5: Add support for READING in chunk mode
  vfio/mlx5: Add support for SAVING in chunk mode
  vfio/mlx5: Pre-allocate chunks for the STOP_COPY phase
  vfio/mlx5: Rename some stuff to match chunk mode
  vfio/mlx5: Enable querying state size which is > 4GB
  vfio/mlx5: Refactor the SAVE callback to activate a work only upon an error
  vfio/mlx5: Wake up the reader post of disabling the SAVING migration file
  vfio: use __aligned_u64 in struct vfio_device_ioeventfd
  vfio: use __aligned_u64 in struct vfio_device_gfx_plane_info
  vfio: trivially use __aligned_u64 for ioctl structs
  vfio-cdx: add bus mastering device feature support
  vfio: add bus master feature to device feature ioctl
  cdx: add support for bus mastering

Merge tag 'dma-mapping-6.7-2023-10-30' of git://git.infradead.org/users/hch/dma-mapping

Pull dma-mapping updates from Christoph Hellwig:

- get rid of the fake support for coherent DMA allocation on coldfire
   with caches (Christoph Hellwig)

- add a few Kconfig dependencies so that Kconfig catches the use of
   invalid configurations (Christoph Hellwig)

- fix a type in dma-debug output (Chuck Lever)

- rewrite a comment in swiotlb (Sean Christopherson)

* tag 'dma-mapping-6.7-2023-10-30' of git://git.infradead.org/users/hch/dma-mapping:
  dma-debug: Fix a typo in a debugging eye-catcher
  swiotlb: rewrite comment explaining why the source is preserved on DMA_FROM_DEVICE
  m68k: remove unused includes from dma.c
  m68k: don't provide arch_dma_alloc for nommu/coldfire
  net: fec: use dma_alloc_noncoherent for data cache enabled coldfire
  m68k: use the coherent DMA code for coldfire without data cache
  dma-direct: warn when coherent allocations aren't supported
  dma-direct: simplify the use atomic pool logic in dma_direct_alloc
  dma-direct: add a CONFIG_ARCH_HAS_DMA_ALLOC symbol
  dma-direct: add dependencies to CONFIG_DMA_GLOBAL_POOL

Merge tag 'pmdomain-v6.7' of git://git./linux/kernel/git/ulfh/linux-pm

Pull pmdomain updates from Ulf Hansson:

- Move Kconfig files into the pmdomain subsystem

- Drop use of genpd's redundant ->opp_to_performance_state() callback

- amlogic:
    - Add support for the T7 power-domains controller
    - Fix mask for the second NNA mem power-domain

- bcm: Fixup ASB register read and comparison for bcm2835-power

- imx: Fix device link problem for consumers of the pgc power-domain

- mediatek: Add support for the MT8365 power domains

- qcom:
    - Add support for the rpmhpds for SC8380XP power-domains
    - Add support for the rpmhpds for SM8650 power-domains
    - Add support for the rpmhpd clocks for SM7150
    - Add support for the rpmpds for MSM8917 (families) power-domains

- starfive: Add support for the JH7110 AON PMU

* tag 'pmdomain-v6.7' of git://git.kernel.org/pub/scm/linux/kernel/git/ulfh/linux-pm: (56 commits)
  pmdomain: amlogic: Fix mask for the second NNA mem PD domain
  pmdomain: qcom: rpmhpd: Add SC8380XP power domains
  pmdomain: qcom: rpmhpd: Add SM8650 RPMh Power Domains
  dt-bindings: power: rpmpd: Add SC8380XP support
  dt-bindings: power: qcom,rpmhpd: Add GMXC PD index
  dt-bindings: power: qcom,rpmpd: document the SM8650 RPMh Power Domains
  pmdomain: imx: Make imx pgc power domain also set the fwnode
  pmdomain: qcom: rpmpd: Add QM215 power domains
  pmdomain: qcom: rpmpd: Add MSM8917 power domains
  dt-bindings: power: rpmpd: Add MSM8917, MSM8937 and QM215
  pmdomain: bcm: bcm2835-power: check if the ASB register is equal to enable
  pmdomain: qcom: rpmhpd: Drop the ->opp_to_performance_state() callback
  pmdomain: qcom: rpmpd: Drop the ->opp_to_performance_state() callback
  pmdomain: qcom: cpr: Drop the ->opp_to_performance_state() callback
  pmdomain: Use device_get_match_data()
  pmdomain: ti: add missing of_node_put
  pmdomain: mediatek: Add support for MT8365
  pmdomain: mediatek: Add support for MTK_SCPD_STRICT_BUS_PROTECTION cap
  pmdomain: mediatek: Add support for WAY_EN operations
  pmdomain: mediatek: Unify configuration for infracfg and smi
  ...

Merge tag 'mmc-v6.7' of git://git./linux/kernel/git/ulfh/mmc

Pull MMC updates from Ulf Hansson:
" MMC core:
   - Enable host caps to be modified via debugfs to test speed-modes
   - Improve random I/O writes for 4k buffers for hsq enabled hosts

  MMC host:
   - atmel-mci/sdhci-of-at91: Aubin Constans takes over as maintainer
   - dw_mmc-starfive: Re-work tuning support
   - meson-gx: Fix bogus IRQ when using CMD_CFG_ERROR
   - mmci: Use peripheral flow control for the STM32 variant
   - renesas,sdhi: Add support for the RZ/G3S variant
   - sdhci-esdhc-imx: Optimize the manual tuning logic
   - sdhci-msm: Add support for the SM8650 variant
   - sdhci-npcm: Add driver to support the Nuvoton NPCM BMC variant
   - sdhci-pci-gli: Add workaround to allow GL9750 to enter ASPM L1.2"

* tag 'mmc-v6.7' of git://git.kernel.org/pub/scm/linux/kernel/git/ulfh/mmc: (25 commits)
  dt-bindings: mmc: sdhci-msm: document the SM8650 SDHCI Controller
  mmc: meson-gx: Remove setting of CMD_CFG_ERROR
  MAINTAINERS: mmc: take over as maintainer of MCI & SDHCI MICROCHIP DRIVERS
  mmc: jz4740: Use device_get_match_data()
  mmc: sdhci-npcm: Add NPCM SDHCI driver
  dt-bindings: mmc: npcm,sdhci: Document NPCM SDHCI controller
  mmc: sdhci-pltfm: Make driver OF independent
  mmc: sdhci-pltfm: Drop unnecessary error messages in sdhci_pltfm_init()
  mmc: sdhci-pci: Switch to use acpi_evaluate_dsm_typed()
  mmc: debugfs: Allow host caps to be modified
  mmc: core: Always reselect card type
  mmc: mmci: use peripheral flow control for STM32
  mmc: vub300: replace deprecated strncpy with strscpy
  memstick: jmb38x_ms: Annotate struct jmb38x_ms with __counted_by
  mmc: starfive: Change tuning implementation
  dt-bindings: mmc: starfive: Remove properties from required
  mmc: hsq: Improve random I/O write performance for 4k buffers
  mmc: core: Allow dynamical updates of the number of requests for hsq
  mmc: sdhci-pci-gli: A workaround to allow GL9750 to enter ASPM L1.2
  dt-bindings: mmc: renesas,sdhi: Document RZ/G3S support
  ...

Merge tag 'for-6.7/dm-changes' of git://git./linux/kernel/git/device-mapper/linux-dm

Pull device mapper updates from Mike Snitzer:

- Update DM core to directly call the map function for both the linear
   and stripe targets; which are provided by DM core

- Various updates to use new safer string functions

- Update DM core to respect REQ_NOWAIT flag in normal bios so that
   memory allocations are always attempted with GFP_NOWAIT

- Add Mikulas Patocka to MAINTAINERS as a DM maintainer!

- Improve DM delay target's handling of short delays (< 50ms) by using
   a kthread to check expiration of IOs rather than timers and a wq

- Update the DM error target so that it works with zoned storage. This
   helps xfstests to provide proper IO error handling coverage when
   testing a filesystem with native zoned storage support

- Update both DM crypt and integrity targets to improve performance by
   using crypto_shash_digest() rather than init+update+final sequence

- Fix DM crypt target by backfilling missing memory allocation
   accounting for compound pages

* tag 'for-6.7/dm-changes' of git://git.kernel.org/pub/scm/linux/kernel/git/device-mapper/linux-dm:
  dm crypt: account large pages in cc->n_allocated_pages
  dm integrity: use crypto_shash_digest() in sb_mac()
  dm crypt: use crypto_shash_digest() in crypt_iv_tcw_whitening()
  dm error: Add support for zoned block devices
  dm delay: for short delays, use kthread instead of timers and wq
  MAINTAINERS: add Mikulas Patocka as a DM maintainer
  dm: respect REQ_NOWAIT flag in normal bios issued to DM
  dm: enhance alloc_multiple_bios() to be more versatile
  dm: make __send_duplicate_bios return unsigned int
  dm log userspace: replace deprecated strncpy with strscpy
  dm ioctl: replace deprecated strncpy with strscpy_pad
  dm crypt: replace open-coded kmemdup_nul
  dm cache metadata: replace deprecated strncpy with strscpy
  dm: shortcut the calls to linear_map and stripe_map

Merge tag 'ata-6.7-rc1' of git://git./linux/kernel/git/dlemoal/libata

Pull ATA updates from Damien Le Moal:

- Modify the AHCI driver to print the link power management policy used
   on scan, to help with debugging issues (Niklas)

- Add support for the ASM2116 series adapters to the AHCI driver
   (Szuying)

- Prepare libata for the coming gcc and Clang __counted_by attribute
   (Kees)

- Following the recent estensive fixing of libata suspend/resume
   handling, several patches further cleanup and improve disk power
   state management (me)

- Reduce the verbosity of some error messages for non-fatal temporary
   errors, e.g. slow response to device reset when scanning a port, and
   warning messages that are in fact normal, e.g. disabling a device on
   suspend or when removing it (me)

- Cleanup DMA helper functions (me)

- Fix sata_mv drive handling of potential errors durring probe (Ma)

- Cleanup the xgene and imx drivers using the functions
   of_device_get_match_data() and device_get_match_data() (Rob)

- Improve the tegra driver device tree (Rob)

* tag 'ata-6.7-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/dlemoal/libata: (22 commits)
  dt-bindings: ata: tegra: Disallow undefined properties
  ata: libata-core: Improve ata_dev_power_set_active()
  ata: libata-eh: Spinup disk on resume after revalidation
  ata: imx: Use device_get_match_data()
  ata: xgene: Use of_device_get_match_data()
  ata: sata_mv: aspeed: fix value check in mv_platform_probe()
  ata: ahci: Add Intel Alder Lake-P AHCI controller to low power chipsets list
  ata: libata: Cleanup inline DMA helper functions
  ata: libata-eh: Reduce "disable device" message verbosity
  ata: libata-eh: Improve reset error messages
  ata: libata-sata: Improve ata_sas_slave_configure()
  ata: libata-core: Do not resume runtime suspended ports
  ata: libata-core: Do not poweroff runtime suspended ports
  ata: libata-core: Remove ata_port_resume_async()
  ata: libata-core: Remove ata_port_suspend_async()
  ata: libata-core: Detach a port devices on shutdown
  ata: libata-core: Synchronize ata_port_detach() with hotplug
  ata: libata-scsi: Cleanup ata_scsi_start_stop_xlat()
  scsi: Remove scsi device no_start_on_resume flag
  ata: libata: Annotate struct ata_cpr_log with __counted_by
  ...

Merge tag 'for-6.7/block-2023-10-30' of git://git.kernel.dk/linux

Pull block updates from Jens Axboe:

- Improvements to the queue_rqs() support, and adding null_blk support
   for that as well (Chengming)

- Series improving badblocks support (Coly)

- Key store support for sed-opal (Greg)

- IBM partition string handling improvements (Jan)

- Make number of ublk devices supported configurable (Mike)

- Cancelation improvements for ublk (Ming)

- MD pull requests via Song:
     - Handle timeout in md-cluster, by Denis Plotnikov
     - Cleanup pers->prepare_suspend, by Yu Kuai
     - Rewrite mddev_suspend(), by Yu Kuai
     - Simplify md_seq_ops, by Yu Kuai
     - Reduce unnecessary locking array_state_store(), by Mariusz
       Tkaczyk
     - Make rdev add/remove independent from daemon thread, by Yu Kuai
     - Refactor code around quiesce() and mddev_suspend(), by Yu Kuai

- NVMe pull request via Keith:
     - nvme-auth updates (Mark)
     - nvme-tcp tls (Hannes)
     - nvme-fc annotaions (Kees)

- Misc cleanups and improvements (Jiapeng, Joel)

* tag 'for-6.7/block-2023-10-30' of git://git.kernel.dk/linux: (95 commits)
  block: ublk_drv: Remove unused function
  md: cleanup pers->prepare_suspend()
  nvme-auth: allow mixing of secret and hash lengths
  nvme-auth: use transformed key size to create resp
  nvme-auth: alloc nvme_dhchap_key as single buffer
  nvmet-tcp: use 'spin_lock_bh' for state_lock()
  powerpc/pseries: PLPKS SED Opal keystore support
  block: sed-opal: keystore access for SED Opal keys
  block:sed-opal: SED Opal keystore
  ublk: simplify aborting request
  ublk: replace monitor with cancelable uring_cmd
  ublk: quiesce request queue when aborting queue
  ublk: rename mm_lock as lock
  ublk: move ublk_cancel_dev() out of ub->mutex
  ublk: make sure io cmd handled in submitter task context
  ublk: don't get ublk device reference in ublk_abort_queue()
  ublk: Make ublks_max configurable
  ublk: Limit dev_id/ub_number values
  md-cluster: check for timeout while a new disk adding
  nvme: rework NVME_AUTH Kconfig selection
  ...

Merge tag 'io_uring-futex-2023-10-30' of git://git.kernel.dk/linux

Pull io_uring futex support from Jens Axboe:
"This adds support for using futexes through io_uring - first futex
  wake and wait, and then the vectored variant of waiting, futex waitv.

  For both wait/wake/waitv, we support the bitset variant, as the
  'normal' variants can be easily implemented on top of that.

  PI and requeue are not supported through io_uring, just the above
  mentioned parts. This may change in the future, but in the spirit of
  keeping this small (and based on what people have been asking for),
  this is what we currently have.

  Wake support is pretty straight forward, most of the thought has gone
  into the wait side to avoid needing to offload wait operations to a
  blocking context. Instead, we rely on the usual callbacks to retry and
  post a completion event, when appropriate.

  As far as I can recall, the first request for futex support with
  io_uring came from Andres Freund, working on postgres. His aio rework
  of postgres was one of the early adopters of io_uring, and futex
  support was a natural extension for that. This is relevant from both a
  usability point of view, as well as for effiency and performance. In
  Andres's words, for the former:

     Futex wait support in io_uring makes it a lot easier to avoid
     deadlocks in concurrent programs that have their own buffer pool:
     Obviously pages in the application buffer pool have to be locked
     during IO. If the initiator of IO A needs to wait for a held lock
     B, the holder of lock B might wait for the IO A to complete. The
     ability to wait for a lock and IO completions at the same time
     provides an efficient way to avoid such deadlocks

  and in terms of effiency, even without unlocking the full potential
  yet, Andres says:

     Futex wake support in io_uring is useful because it allows for more
     efficient directed wakeups. For some "locks" postgres has queues
     implemented in userspace, with wakeup logic that cannot easily be
     implemented with FUTEX_WAKE_BITSET on a single "futex word"
     (imagine waiting for journal flushes to have completed up to a
     certain point).

     Thus a "lock release" sometimes need to wake up many processes in a
     row. A quick-and-dirty conversion to doing these wakeups via
     io_uring lead to a 3% throughput increase, with 12% fewer context
     switches, albeit in a fairly extreme workload"

* tag 'io_uring-futex-2023-10-30' of git://git.kernel.dk/linux:
  io_uring: add support for vectored futex waits
  futex: make the vectored futex operations available
  futex: make futex_parse_waitv() available as a helper
  futex: add wake_data to struct futex_q
  io_uring: add support for futex wake and wait
  futex: abstract out a __futex_wake_mark() helper
  futex: factor out the futex wake handling
  futex: move FUTEX2_VALID_MASK to futex.h

Merge tag 'for-6.7/io_uring-sockopt-2023-10-30' of git://git.kernel.dk/linux

Pull io_uring {get,set}sockopt support from Jens Axboe:
"This adds support for using getsockopt and setsockopt via io_uring.

  The main use cases for this is to enable use of direct descriptors,
  rather than first instantiating a normal file descriptor, doing the
  option tweaking needed, then turning it into a direct descriptor. With
  this support, we can avoid needing a regular file descriptor
  completely.

  The net and bpf bits have been signed off on their side"

* tag 'for-6.7/io_uring-sockopt-2023-10-30' of git://git.kernel.dk/linux:
  selftests/bpf/sockopt: Add io_uring support
  io_uring/cmd: Introduce SOCKET_URING_OP_SETSOCKOPT
  io_uring/cmd: Introduce SOCKET_URING_OP_GETSOCKOPT
  io_uring/cmd: return -EOPNOTSUPP if net is disabled
  selftests/net: Extract uring helpers to be reusable
  tools headers: Grab copy of io_uring.h
  io_uring/cmd: Pass compat mode in issue_flags
  net/socket: Break down __sys_getsockopt
  net/socket: Break down __sys_setsockopt
  bpf: Add sockptr support for setsockopt
  bpf: Add sockptr support for getsockopt

Merge tag 'for-6.7/io_uring-2023-10-30' of git://git.kernel.dk/linux

Pull io_uring updates from Jens Axboe:
"This contains the core io_uring updates, of which there are not many,
  and adds support for using WAITID through io_uring and hence not
  needing to block on these kinds of events.

  Outside of that, tweaks to the legacy provided buffer handling and
  some cleanups related to cancelations for uring_cmd support"

* tag 'for-6.7/io_uring-2023-10-30' of git://git.kernel.dk/linux:
  io_uring/poll: use IOU_F_TWQ_LAZY_WAKE for wakeups
  io_uring/kbuf: Use slab for struct io_buffer objects
  io_uring/kbuf: Allow the full buffer id space for provided buffers
  io_uring/kbuf: Fix check of BID wrapping in provided buffers
  io_uring/rsrc: cleanup io_pin_pages()
  io_uring: cancelable uring_cmd
  io_uring: retain top 8bits of uring_cmd flags for kernel internal use
  io_uring: add IORING_OP_WAITID support
  exit: add internal include file with helpers
  exit: add kernel_waitid_prepare() helper
  exit: move core of do_wait() into helper
  exit: abstract out should_wake helper for child_wait_callback()
  io_uring/rw: add support for IORING_OP_READ_MULTISHOT
  io_uring/rw: mark readv/writev as vectored in the opcode definition
  io_uring/rw: split io_read() into a helper

Merge tag 'for-linus-6.7-rc1-tag' of git://git./linux/kernel/git/xen/tip

Pull xen updates from Juergen Gross:

- two small cleanup patches

- a fix for PCI passthrough under Xen

- a four patch series speeding up virtio under Xen with user space
   backends

* tag 'for-linus-6.7-rc1-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/xen/tip:
  xen-pciback: Consider INTx disabled when MSI/MSI-X is enabled
  xen: privcmd: Add support for ioeventfd
  xen: evtchn: Allow shared registration of IRQ handers
  xen: irqfd: Use _IOW instead of the internal _IOC() macro
  xen: Make struct privcmd_irqfd's layout architecture independent
  xen/xenbus: Add __counted_by for struct read_buffer and use struct_size()
  xenbus: fix error exit in xenbus_init()

Merge tag 'x86_tdx_for_6.7' of git://git./linux/kernel/git/tip/tip

Pull x86 TDX updates from Dave Hansen:
"The majority of this is a rework of the assembly and C wrappers that
  are used to talk to the TDX module and VMM. This is a nice cleanup in
  general but is also clearing the way for using this code when Linux is
  the TDX VMM.

  There are also some tidbits to make TDX guests play nicer with Hyper-V
  and to take advantage the hardware TSC.

  Summary:

   - Refactor and clean up TDX hypercall/module call infrastructure

   - Handle retrying/resuming page conversion hypercalls

   - Make sure to use the (shockingly) reliable TSC in TDX guests"

[ TLA reminder: TDX is "Trust Domain Extensions", Intel's guest VM
  confidentiality technology ]

* tag 'x86_tdx_for_6.7' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
  x86/tdx: Mark TSC reliable
  x86/tdx: Fix __noreturn build warning around __tdx_hypercall_failed()
  x86/virt/tdx: Make TDX_MODULE_CALL handle SEAMCALL #UD and #GP
  x86/virt/tdx: Wire up basic SEAMCALL functions
  x86/tdx: Remove 'struct tdx_hypercall_args'
  x86/tdx: Reimplement __tdx_hypercall() using TDX_MODULE_CALL asm
  x86/tdx: Make TDX_HYPERCALL asm similar to TDX_MODULE_CALL
  x86/tdx: Extend TDX_MODULE_CALL to support more TDCALL/SEAMCALL leafs
  x86/tdx: Pass TDCALL/SEAMCALL input/output registers via a structure
  x86/tdx: Rename __tdx_module_call() to __tdcall()
  x86/tdx: Make macros of TDCALLs consistent with the spec
  x86/tdx: Skip saving output regs when SEAMCALL fails with VMFailInvalid
  x86/tdx: Zero out the missing RSI in TDX_HYPERCALL macro
  x86/tdx: Retry partially-completed page conversion hypercalls

Merge tag 'parisc-for-6.7-rc1' of git://git./linux/kernel/git/deller/parisc-linux

Pull parisc updates from Helge Deller:
"Usual fixes and updates:

   - Add up to 12 nops after TLB inserts for PA8x00 CPUs as the
     specification requires (Dave Anglin)

   - Simplify the parisc smp_prepare_boot_cpu() code (Russell King)

   - Use 64-bit little-endian values in SBA IOMMU PDIR table for AGP

  Since there is upcoming support for booting a 64-bit kernel on QEMU,
  some corner cases were fixed and improvements added:

   - Fix 64-bit kernel crash in STI (graphics console) font setup code
     which miscalculated the font start address as it gets signed vs
     unsigned offsets wrong

   - Support building an uncompressed Linux kernel

   - Add support for soft power-off in qemu"

* tag 'parisc-for-6.7-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/deller/parisc-linux:
  fbdev: stifb: Make the STI next font pointer a 32-bit signed offset
  parisc: Show default CPU PSW.W setting as reported by PDC
  parisc/pdc: Add width field to struct pdc_model
  parisc: Add nop instructions after TLB inserts
  parisc: simplify smp_prepare_boot_cpu()
  parisc/agp: Use 64-bit LE values in SBA IOMMU PDIR table
  parisc/firmware: Use PDC constants for narrow/wide firmware
  parisc: Move parisc_narrow_firmware variable to header file
  parisc/power: Trivial whitespace cleanups and license update
  parisc/power: Add power soft-off when running on qemu
  parisc: Allow building uncompressed Linux kernel
  parisc: Add some missing PDC functions and constants
  parisc: sba-iommu: Fix comment when calculating IOC number

Merge tag 'm68k-for-v6.7-tag1' of git://git./linux/kernel/git/geert/linux-m68k

Pull m68k updates from Geert Uytterhoeven:

- misc aesthetical improvements for the floating point emulator

- remove the last user of strlcpy()

- use kernel's generic libgcc functions

- misc fixes for W=1 builds

- misc indentation fixes

- misc fixes and improvements

- defconfig updates

* tag 'm68k-for-v6.7-tag1' of git://git.kernel.org/pub/scm/linux/kernel/git/geert/linux-m68k: (72 commits)
  m68k: lib: Include <linux/libgcc.h> for __muldi3()
  m68k: fpsp040: Fix indentation by 5 spaces
  m68k: Fix indentation by 2 or 5 spaces in <asm/page_mm.h>
  m68k: kernel: Fix indentation by 7 spaces in traps.c
  m68k: sun3: Fix indentation by 5 or 7 spaces
  m68k: Fix indentation by 7 spaces in <asm/io_mm.h>
  m68k: defconfig: Update virt_defconfig for v6.6-rc3
  m68k: defconfig: Update defconfigs for v6.6-rc1
  m68k: io: Mark mmio read addresses as const
  m68k: Replace GPL 2.0+ README.legal boilerplate with SPDX
  m68k: sun3: Change led_pattern[] to unsigned char
  m68k: Add missing types to asm/irq.h
  m68k: sun3/3x: Add and use "sun3.h"
  m68k: sun3x: Make dvma_print() static
  m68k: sun3x: Make sun3x_halt() static
  m68k: sun3x: Do not mark dvma_map_iommu() inline
  m68k: sun3x: Fix signature of sun3_leds()
  m68k: sun3: Make sun3_platform_init() static
  m68k: sun3: Make print_pte() static
  m68k: sun3: Annotate prom_printf() with __printf()
  ...

Merge tag 'arm64-upstream' of git://git./linux/kernel/git/arm64/linux

Pull arm64 updates from Catalin Marinas:
"No major architecture features this time around, just some new HWCAP
  definitions, support for the Ampere SoC PMUs and a few fixes/cleanups.

  The bulk of the changes is reworking of the CPU capability checking
  code (cpus_have_cap() etc).

   - Major refactoring of the CPU capability detection logic resulting
     in the removal of the cpus_have_const_cap() function and migrating
     the code to "alternative" branches where possible

   - Backtrace/kgdb: use IPIs and pseudo-NMI

   - Perf and PMU:

      - Add support for Ampere SoC PMUs

      - Multi-DTC improvements for larger CMN configurations with
        multiple Debug & Trace Controllers

      - Rework the Arm CoreSight PMU driver to allow separate
        registration of vendor backend modules

      - Fixes: add missing MODULE_DEVICE_TABLE to the amlogic perf
        driver; use device_get_match_data() in the xgene driver; fix
        NULL pointer dereference in the hisi driver caused by calling
        cpuhp_state_remove_instance(); use-after-free in the hisi driver

   - HWCAP updates:

      - FEAT_SVE_B16B16 (BFloat16)

      - FEAT_LRCPC3 (release consistency model)

      - FEAT_LSE128 (128-bit atomic instructions)

   - SVE: remove a couple of pseudo registers from the cpufeature code.
     There is logic in place already to detect mismatched SVE features

   - Miscellaneous:

      - Reduce the default swiotlb size (currently 64MB) if no ZONE_DMA
        bouncing is needed. The buffer is still required for small
        kmalloc() buffers

      - Fix module PLT counting with !RANDOMIZE_BASE

      - Restrict CPU_BIG_ENDIAN to LLVM IAS 15.x or newer move
        synchronisation code out of the set_ptes() loop

      - More compact cpufeature displaying enabled cores

      - Kselftest updates for the new CPU features"

* tag 'arm64-upstream' of git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux: (83 commits)
  arm64: Restrict CPU_BIG_ENDIAN to GNU as or LLVM IAS 15.x or newer
  arm64: module: Fix PLT counting when CONFIG_RANDOMIZE_BASE=n
  arm64, irqchip/gic-v3, ACPI: Move MADT GICC enabled check into a helper
  perf: hisi: Fix use-after-free when register pmu fails
  drivers/perf: hisi_pcie: Initialize event->cpu only on success
  drivers/perf: hisi_pcie: Check the type first in pmu::event_init()
  arm64: cpufeature: Change DBM to display enabled cores
  arm64: cpufeature: Display the set of cores with a feature
  perf/arm-cmn: Enable per-DTC counter allocation
  perf/arm-cmn: Rework DTC counters (again)
  perf/arm-cmn: Fix DTC domain detection
  drivers: perf: arm_pmuv3: Drop some unused arguments from armv8_pmu_init()
  drivers: perf: arm_pmuv3: Read PMMIR_EL1 unconditionally
  drivers/perf: hisi: use cpuhp_state_remove_instance_nocalls() for hisi_hns3_pmu uninit process
  clocksource/drivers/arm_arch_timer: limit XGene-1 workaround
  arm64: Remove system_uses_lse_atomics()
  arm64: Mark the 'addr' argument to set_ptes() and __set_pte_at() as unused
  drivers/perf: xgene: Use device_get_match_data()
  perf/amlogic: add missing MODULE_DEVICE_TABLE
  arm64/mm: Hoist synchronization out of set_ptes() loop
  ...

Merge tag 'drm-next-2023-10-31-1' of git://anongit.freedesktop.org/drm/drm

Pull drm updates from Dave Airlie:
"Highlights:
   - AMD adds some more upcoming HW platforms
   - Intel made Meteorlake stable and started adding Lunarlake
   - nouveau has a bunch of display rework in prepartion for the NVIDIA
     GSP firmware support
   - msm adds a7xx support
   - habanalabs has finished migration to accel subsystem

  Detail summary:

  kernel:
   - add initial vmemdup-user-array

  core:
   - fix platform remove() to return void
   - drm_file owner updated to reflect owner
   - move size calcs to drm buddy allocator
   - let GPUVM build as a module
   - allow variable number of run-queues in scheduler

  edid:
   - handle bad h/v sync_end in EDIDs

  panfrost:
   - add Boris as maintainer

  fbdev:
   - use fb_ops helpers more
   - only allow logo use from fbcon
   - rename fb_pgproto to pgprot_framebuffer
   - add HPD state to drm_connector_oob_hotplug_event
   - convert to fbdev i/o mem helpers

  i915:
   - Enable meteorlake by default
   - Early Xe2 LPD/Lunarlake display enablement
   - Rework subplatforms into IP version checks
   - GuC based TLB invalidation for Meteorlake
   - Display rework for future Xe driver integration
   - LNL FBC features
   - LNL display feature capability reads
   - update recommended fw versions for DG2+
   - drop fastboot module parameter
   - added deviceid for Arrowlake-S
   - drop preproduction workarounds
   - don't disable preemption for resets
   - cleanup inlines in headers
   - PXP firmware loading fix
   - Fix sg list lengths
   - DSC PPS state readout/verification
   - Add more RPL P/U PCI IDs
   - Add new DG2-G12 stepping
   - DP enhanced framing support to state checker
   - Improve shared link bandwidth management
   - stop using GEM macros in display code
   - refactor related code into display code
   - locally enable W=1 warnings
   - remove PSR watchdog timers on LNL

  amdgpu:
   - RAS/FRU EEPROM updatse
   - IP discovery updatses
   - GC 11.5 support
   - DCN 3.5 support
   - VPE 6.1 support
   - NBIO 7.11 support
   - DML2 support
   - lots of IP updates
   - use flexible arrays for bo list handling
   - W=1 fixes
   - Enable seamless boot in more cases
   - Enable context type property for HDMI
   - Rework GPUVM TLB flushing
   - VCN IB start/size alignment fixes

  amdkfd:
   - GC 10/11 fixes
   - GC 11.5 support
   - use partial migration in GPU faults

  radeon:
   - W=1 Fixes
   - fix some possible buffer overflow/NULL derefs

  nouveau:
   - update uapi for NO_PREFETCH
   - scheduler/fence fixes
   - rework suspend/resume for GSP-RM
   - rework display in preparation for GSP-RM

  habanalabs:
   - uapi: expose tsc clock
   - uapi: block access to eventfd through control device
   - uapi: force dma-buf export to PAGE_SIZE alignments
   - complete move to accel subsystem
   - move firmware interface include files
   - perform hard reset on PCIe AXI drain event
   - optimise user interrupt handling

  msm:
   - DP: use existing helpers for DPCD
   - DPU: interrupts reworked
   - gpu: a7xx (a730/a740) support
   - decouple msm_drv from kms for headless devices

  mediatek:
   - MT8188 dsi/dp/edp support
   - DDP GAMMA - 12 bit LUT support
   - connector dynamic selection capability

  rockchip:
   - rv1126 mipi-dsi/vop support
   - add planar formats

  ast:
   - rename constants

  panels:
   - Mitsubishi AA084XE01
   - JDI LPM102A188A
   - LTK050H3148W-CTA6

  ivpu:
   - power management fixes

  qaic:
   - add detach slice bo api

  komeda:
   - add NV12 writeback

  tegra:
   - support NVSYNC/NHSYNC
   - host1x suspend fixes

  ili9882t:
   - separate into own driver"

* tag 'drm-next-2023-10-31-1' of git://anongit.freedesktop.org/drm/drm: (1803 commits)
  drm/amdgpu: Remove unused variables from amdgpu_show_fdinfo
  drm/amdgpu: Remove duplicate fdinfo fields
  drm/amd/amdgpu: avoid to disable gfxhub interrupt when driver is unloaded
  drm/amdgpu: Add EXT_COHERENT support for APU and NUMA systems
  drm/amdgpu: Retrieve CE count from ce_count_lo_chip in EccInfo table
  drm/amdgpu: Identify data parity error corrected in replay mode
  drm/amdgpu: Fix typo in IP discovery parsing
  drm/amd/display: fix S/G display enablement
  drm/amdxcp: fix amdxcp unloads incompletely
  drm/amd/amdgpu: fix the GPU power print error in pm info
  drm/amdgpu: Use pcie domain of xcc acpi objects
  drm/amd: check num of link levels when update pcie param
  drm/amdgpu: Add a read to GFX v9.4.3 ring test
  drm/amd/pm: call smu_cmn_get_smc_version in is_mode1_reset_supported.
  drm/amdgpu: get RAS poison status from DF v4_6_2
  drm/amdgpu: Use discovery table's subrevision
  drm/amd/display: 3.2.256
  drm/amd/display: add interface to query SubVP status
  drm/amd/display: Read before writing Backlight Mode Set Register
  drm/amd/display: Disable SYMCLK32_SE RCO on DCN314
  ...

Merge tag 'devicetree-for-6.7' of git://git./linux/kernel/git/robh/linux

Pull devicetree updates from Rob Herring:

- Add a kselftest to check for unprobed DT devices

- Fix address translation for some 3 address cells cases

- Refactor firmware node refcounting for AMBA bus

- Add bindings for qcom,sm4450-pdc, Qualcomm Kryo 465 CPU, and
   Freescale QMC HDLC

- Add Marantec vendor prefix

- Convert qcom,pm8921-keypad, cnxt,cx92755-wdt, da9062-wdt, and
   atmel,at91rm9200-wdt bindings to DT schema

- Several additionalProperties/unevaluatedProperties on child node
   schemas fixes

- Drop reserved-memory bindings which now live in dtschema project

- Fix a reference to rockchip,inno-usb2phy.yaml

- Remove backlight nodes from display panel examples

- Expand example for using DT_SCHEMA_FILES

- Merge simple LVDS panel bindings to one binding doc

* tag 'devicetree-for-6.7' of git://git.kernel.org/pub/scm/linux/kernel/git/robh/linux: (34 commits)
  dt-bindings: soc: fsl: cpm_qe: cpm1-scc-qmc: Add support for QMC HDLC
  dt-bindings: soc: fsl: cpm_qe: cpm1-scc-qmc: Add 'additionalProperties: false' in child nodes
  dt-bindings: soc: fsl: cpm_qe: cpm1-scc-qmc: Fix example property name
  dt-bindings: arm,coresight-cti: Add missing additionalProperties on child nodes
  dt-bindings: arm,coresight-cti: Drop type for 'cpu' property
  dt-bindings: soundwire: Add reference to soundwire-controller.yaml schema
  dt-bindings: input: syna,rmi4: Make "additionalProperties: true" explicit
  media: dt-bindings: ti,ds90ub960: Add missing type for "i2c-alias"
  dt-bindings: input: qcom,pm8921-keypad: convert to YAML format
  of: overlay: unittest: overlay_bad_unresolved: Spelling s/ok/okay/
  of: address: Consolidate bus .map() functions
  of: address: Store number of bus flag cells rather than bool
  of: unittest: Add tests for address translations
  of: address: Remove duplicated functions
  of: address: Fix address translation when address-size is greater than 2
  dt-bindings: watchdog: cnxt,cx92755-wdt: convert txt to yaml
  dt-bindings: watchdog: da9062-wdt: convert txt to yaml
  dt-bindings: watchdog: fsl,scu-wdt: Document imx8dl
  dt-bindings: watchdog: atmel,at91rm9200-wdt: convert txt to yaml
  dt-bindings: usb: rockchip,dwc3: update inno usb2 phy binding name
  ...

Merge tag 'for-v6.7' of git://git./linux/kernel/git/sre/linux-power-supply

Pull power supply and reset updates from Sebastian Reichel:
"Core changes:
   - propagate of_node to child device
   - change from atomic to blocking notifier_call_chain

  New drivers:
   - pm8916 battery management system
   - mm8013 fuel gauge

  New features:
   - maxim max17040: add temperature support
   - gpio-poweroff: make priority configurable

  Cleanups:
   - simplify reset drivers using builtin_platform_driver()
   - convert all platform drivers to remove_new callback
   - replace all strncpy occurrences with strscpy
   - started converting drivers to i2c_get_match_data()
   - misc fixes and cleanups"

* tag 'for-v6.7' of git://git.kernel.org/pub/scm/linux/kernel/git/sre/linux-power-supply: (91 commits)
  power: reset: vexpress: Use device_get_match_data()
  power: supply: surface-charger: replace deprecated strncpy with strscpy
  power: supply: surface_battery: replace deprecated strncpy with strscpy
  power: supply: charger-manager: replace deprecated strncpy with strscpy
  power: supply: bq25980: replace deprecated strncpy with strscpy
  power: supply: bq256xx: replace deprecated strncpy with strscpy
  power: supply: bq2515x: replace deprecated strncpy with strscpy
  power: supply: bq24190_charger: replace deprecated strncpy with strscpy
  power: supply: cpcap: Drop non-DT driver matching
  power: reset: brcmstb: Depend on actual SoC dependencies
  power: reset: gpio-poweroff: make sys handler priority configurable
  dt-bindings: power: reset: gpio-poweroff: Add priority property
  power: reset: gpio-poweroff: use sys-off handler API
  power: reset: gpio-poweroff: use a struct to store the module variables
  power: supply: rt5033_charger: Replace "&pdev->dev" by "charger->dev" in probe
  power: supply: rt5033_charger: Simplify initialization of rt5033_charger_data
  power: supply: rt5033_charger: Add cable detection and USB OTG supply
  power: supply: core: remove opencoded string_lower()
  dt-bindings: power: supply: sbs-manager: Add missing unevaluatedProperties on child node schemas
  power: supply: mm8013: Fix an error checking issue in mm8013_checkdevice()
  ...

Merge tag 'clk-for-linus' of git://git./linux/kernel/git/clk/linux

Pull clk driver updates from Stephen Boyd:
"Herein lies a smallish collection of clk driver updates and some core
  clk framework changes for the merge window. The core framework changes
  are only improving the debugfs interface to allow phase adjustments
  and report which consumers of a clk there are. These are most likely
  only of interest to kernel developers.

  On the clk driver side, it's a ghastly amount of updates with only a
  handful of new clk drivers. We have a couple new clk drivers for
  Qualcomm, per usual, and a driver for Renesas, Amlogic, and TI
  respectively. The updates are spread throughout the clk drivers.

  Some highlights are fixing kunit tests for different configurations
  like lockdep and big-endian, avoiding integer overflow in rate
  settable clks, moving clk_hw_onecell_data to the end of allocations so
  that drivers don't corrupt their private data, and migrating clk
  drivers to the regmap maple tree. Otherwise it's the usual fixes to
  clk drivers that only come along with testing the drivers on real
  hardware.

  New Drivers:
   - Add clock driver for TWL6032
   - Initial support for the Qualcomm SM4450 Global Clock Controller and
     SM4450 RPMh clock controllers
   - Add Camera Clock Controller on Qualcomm SM8550
   - Add support for the Renesas RZ/G3S (R9A08G045) SoC
   - Add Amlogic s4 main clock controller support

Updates:
   - Make clk kunit tests work with lockdep
   - Fix clk gate kunit test for big-endian
   - Convert more than a handful of clk drivers to use regmap maple tree
   - Consider the CLK_FRAC_DIVIDER_ZERO_BASED in fractional divider clk
     implementation
   - Add consumer info to clk debugfs
   - Fix various clk drivers that have clk_hw_onecell_data not at the
     end of an allocation
   - Drop CLK_SET_RATE_PARENT for clocks with fixed-rate GPLLs across a
     variety of Qualcomm IPQ platforms
   - Add missing parent of APCS PLL on Qualcomm IPQ6018
   - Add I2C QUP6 clk on Qualcomm IPQ6018 but mark it critical to avoid
     problems with RPM
   - Implement safe source switching for a53pll and use on Qualcomm
     IPQ5332
   - Add support for Stromer Plus PLLs to Qualcomm clk driver
   - Switch Qualcomm SM8550 Video and GPU clock controllers to use OLE
     PLL configure method
   - Non critical fixes to halt bit checks in Qualcomm clk drivers
   - Add SMMU GDSC for Qualcomm MSM8998
   - Fix possible integer overflow in Qualcomm RCG frequency calculation
     code
   - Remove RPM managed clks from Qualcomm MSM8996 GCC driver
   - Add HFPLL configuration for the three HFPLLs in Qualcomm MSM8976
   - Switch Qualcomm MSM8996 CBF clock driver's remove function to
     return void
   - Fix missing dependency for s4 clock controllers
   - Select MXC_CLK when building in the CLK_IMX8QXP
   - Fixes for error handling paths in i.MX8 ACM driver
   - Move the clocks check in i.MX8 ACM driver in order to log any error
   - Drop the unused return value of clk_imx_acm_detach_pm_domains
   - Drop non-existant IMX8MP_CLK_AUDIOMIX_PDM_ROOT clock
   - Fix error handling in i.MX8MQ clock driver
   - Allow a different LCDIF1 clock parent if DT describes it for
     i.MX6SX
   - Keep the SCU resource table sorted in the i.MX8DXL rsrc driver
   - Move the elcdif PLL clock registration above lcd_clk, as it is its
     parent
   - Correct some ENET specific clocks for i.MX8DXL platform
   - Drop the VPU_UART and VPUCORE from i.MX8QM as latest HW revision
     doesn't have them
   - Remove "de-featured" MLB support from i.MX8QM/QXP/DXL platforms
   - Skip registering clocks owned by Cortex-A partition SCU-based
     platforms
   - Add CAN_1/2 to i.MX8QM and M4_0, PI_0_PWM_0 and PI_0_I2C_0 to
     i.MX8QXP resources"

* tag 'clk-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/clk/linux: (128 commits)
  clk: Fix clk gate kunit test on big-endian CPUs
  clk: si521xx: Increase stack based print buffer size in probe
  clk: mediatek: fix double free in mtk_clk_register_pllfh()
  clk: socfpga: agilex: Add bounds-checking coverage for struct stratix10_clock_data
  clk: socfpga: Fix undefined behavior bug in struct stratix10_clock_data
  clk: sifive: Allow building the driver as a module
  clk: analogbits: Allow building the library as a module
  clk: sprd: Composite driver support offset config
  clk: Allow phase adjustment from debugfs
  clk: Show active consumers of clocks in debugfs
  clk: Use device_get_match_data()
  clk: visconti: Add bounds-checking coverage for struct visconti_pll_provider
  clk: visconti: Fix undefined behavior bug in struct visconti_pll_provider
  clk: cdce925: Extend match support for OF tables
  clk: si570: Simplify probe
  clk: si5351: Simplify probe
  clk: rs9: Use i2c_get_match_data() instead of device_get_match_data()
  clk: clk-si544: Simplify probe() and is_valid_frequency()
  clk: si521xx: Use i2c_get_match_data() instead of device_get_match_data()
  clk: meson: S4: select CONFIG_COMMON_CLK_MESON_CLKC_UTILS
  ...

Merge tag 'for-6.7-rc1' of git://git./linux/kernel/git/pateldipen1984/linux

Pull hte/timestamp updates from Dipen Patel:

- Improve comments in the translate function

- Reflect the GPIOLIB API changes during calculation of the GPIO base

- Improve error handling in Tegra test and provider drivers

- Improve code to set the line name

* tag 'for-6.7-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/pateldipen1984/linux:
  hte: Use kasprintf() instead of fixed buffer formatting
  hte: tegra: Fix missing error code in tegra_hte_test_probe()
  hte: tegra194: Switch to LATE_SIMPLE_DEV_PM_OPS()
  hte: tegra194: Remove redundant dev_err()
  hte: tegra194: improve the GPIO-related comment
  hte: allow building modules with COMPILE_TEST enabled
  hte: Annotate struct hte_device with __counted_by

Merge tag 'platform-drivers-x86-v6.7-1' of git://git./linux/kernel/git/pdx86/platform-drivers-x86

Pull x86 platform driver updates from Ilpo Järvinen:

- asus-wmi: Support for screenpad and solve brightness key press
   duplication

- int3472: Eliminate the last use of deprecated GPIO functions

- mlxbf-pmc: New HW support

- msi-ec: Support new EC configurations

- thinkpad_acpi: Support reading aux MAC address during passthrough

- wmi: Fixes & improvements

- x86-android-tablets: Detection fix and avoid use of GPIO private APIs

- Debug & metrics interface improvements

- Miscellaneous cleanups / fixes / improvements

* tag 'platform-drivers-x86-v6.7-1' of git://git.kernel.org/pub/scm/linux/kernel/git/pdx86/platform-drivers-x86: (80 commits)
  platform/x86: inspur-platform-profile: Add platform profile support
  platform/x86: thinkpad_acpi: Add battery quirk for Thinkpad X120e
  platform/x86: wmi: Decouple WMI device removal from wmi_block_list
  platform/x86: wmi: Fix opening of char device
  platform/x86: wmi: Fix probe failure when failing to register WMI devices
  platform/x86: wmi: Fix refcounting of WMI devices in legacy functions
  platform/x86: wmi: Decouple probe deferring from wmi_block_list
  platform/x86/amd/hsmp: Fix iomem handling
  platform/x86: asus-wmi: Do not report brightness up/down keys when also reported by acpi_video
  platform/x86: thinkpad_acpi: replace deprecated strncpy with memcpy
  tools/power/x86/intel-speed-select: v1.18 release
  tools/power/x86/intel-speed-select: Use cgroup isolate for CPU 0
  tools/power/x86/intel-speed-select: Increase max CPUs in one request
  tools/power/x86/intel-speed-select: Display error for core-power support
  tools/power/x86/intel-speed-select: No TRL for non compute domains
  tools/power/x86/intel-speed-select: turbo-mode enable disable swapped
  tools/power/x86/intel-speed-select: Update help for TRL
  tools/power/x86/intel-speed-select: Sanitize integer arguments
  platform/x86: acer-wmi: Remove void function return
  platform/x86/amd/pmc: Add dump_custom_stb module parameter
  ...

Merge tag 'tag-chrome-platform-for-v6.7' of git://git./linux/kernel/git/chrome-platform/linux

Pull chrome platform updates from Tzung-Bi Shih:
"Improvements:

   - Annotate flexible array members with __counted_by

   - Convert platform drivers' .remove callbacks to return void

  Fixes:

   - Avoid MKBP event timeouts by disabling/enabling IRQ later/earlier

  Misc:

   - Minor cleanups and fixes"

* tag 'tag-chrome-platform-for-v6.7' of git://git.kernel.org/pub/scm/linux/kernel/git/chrome-platform/linux: (21 commits)
  platform/chrome: cros_ec_lpc: Separate host command and irq disable
  platform/chrome: kunit: make EC protocol tests independent
  platform/chrome: kunit: initialize lock for fake ec_dev
  platform/chrome: cros_ec: fix compilation warning
  platform/chrome: cros_ec_proto: Mark outdata as const
  platform/chrome: cros_typec_vdm: Mark port_amode_ops const
  platform/chrome: cros_ec_typec: Use dev_err_probe() more
  platform/chrome: cros_ec_typec: Use semi-colons instead of commas
  platform/chrome/wilco_ec: telemetry: Convert to platform remove callback returning void
  platform/chrome/wilco_ec: debugfs: Convert to platform remove callback returning void
  platform/chrome/wilco_ec: core: Convert to platform remove callback returning void
  platform/chrome: cros_usbpd_notify: Convert to platform remove callback returning void
  platform/chrome: cros_usbpd_logger: Convert to platform remove callback returning void
  platform/chrome: cros_typec_switch: Convert to platform remove callback returning void
  platform/chrome: cros_ec_vbc: Convert to platform remove callback returning void
  platform/chrome: cros_ec_sysfs: Convert to platform remove callback returning void
  platform/chrome: cros_ec_lpc: Convert to platform remove callback returning void
  platform/chrome: cros_ec_lightbar: Convert to platform remove callback returning void
  platform/chrome: cros_ec_debugfs: Convert to platform remove callback returning void
  platform/chrome: cros_ec_chardev: Convert to platform remove callback returning void
  ...

Merge tag 'hwmon-for-v6.7' of git://git./linux/kernel/git/groeck/linux-staging

Pull hwmon updates from Guenter Roeck:
"New drivers:

   - Driver for LTC2991

   - Driver for POWER-Z

  Added chip / system support to existing drivers:

   - The ina238 driver now also supports INA237

   - The asus-ec-sensors driver now supports ROG Crosshair X670E Gene

   - The aquacomputer_d5next now supports Aquacomputer High Flow USB and
     MPS Flow

   - The pmbus/mpq7932 driver now also supports MPQ2286

   - The nct6683 now also supports ASRock X670E Taichi

  Various other minor improvements and fixes:

   - One patch series to call out is the conversion of hwmon platform
     drivers to use the platform remove callback returning void"

* tag 'hwmon-for-v6.7' of git://git.kernel.org/pub/scm/linux/kernel/git/groeck/linux-staging: (69 commits)
  hwmon: (aquacomputer_d5next) Check if temp sensors of legacy devices are connected
  hwmon: (aquacomputer_d5next) Add support for Aquacomputer High Flow USB and MPS Flow
  dt-bindings: hwmon: npcm: Add npcm845 compatible string
  hwmon: Add driver for ltc2991
  dt-bindings: hwmon: ltc2991: add bindings
  hwmon: (pmbus/max31785) Add delay between bus accesses
  hwmon: (ina238) add ina237 support
  dt-bindings: hwmon: ti,ina2xx: add ti,ina237
  hwmon: (asus-ec-sensors) add ROG Crosshair X670E Gene.
  hwmon: (max31827) handle vref regulator
  hwmon: (ina3221) Add support for channel summation disable
  dt-bindings: hwmon: ina3221: Add ti,summation-disable
  dt-bindings: hwmon: ina3221: Convert to json-schema
  hwmon: (pmbus/mpq7932) Add a support for mpq2286 Power Management IC
  hwmon: (pmbus/core) Add helper macro to define single pmbus regulator
  regulator: dt-bindings: Add mps,mpq2286 power-management IC
  hwmon: (pmbus/mpq7932) Get page count based on chip info
  dt-bindings: hwmon: Add possible new properties to max31827 bindings
  hwmon: (max31827) Modify conversion wait time
  hwmon: (max31827) Make code cleaner
  ...

Merge tag 'spi-v6.7' of git://git./linux/kernel/git/broonie/spi

Pull spi updates from Mark Brown:
"This is a very quiet release for SPI, we've got cleanups and minor
  fixes but only a few new driver specific features. The bulk of the
  changes in terms of diffstat are the cleanups, plus one bit of
  performance work for McSPI.

   - Conversions to use devm_clk_get_enabled() and to remove outdated
     terms for controller and device

   - Device mode support for the Renesas CSI

   - Cleanups and improvements to the device tree bindings aimed at
     making validation better

   - PIO FIFO usage for the OMAP2 McSPI, improving performance"

* tag 'spi-v6.7' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/spi: (75 commits)
  spi: omap2-mcspi: Add FIFO support without DMA
  spi: stm32: Explicitly include correct DT includes
  spi: Export acpi_spi_find_controller_by_adev()
  spi: nxp-fspi: use the correct ioremap function
  spi: Don't use flexible array in struct spi_message definition
  spi: bcm2835: add a sentinel at the end of the lookup array
  spi: spi-geni-qcom: Rename the label unmap_if_dma
  spi: rzv2m-csi: Add target mode support
  spi: renesas,rzv2m-csi: Add CSI (SPI) target related property
  spi: spidev: make spidev_class constant
  spi: mpc52xx-psc: Make mpc52xx_psc_spi_transfer_one_message() static
  spi: spi-cadence-quadspi: Fix missing unwind goto warnings
  spi: omap2-mcspi: Fix hardcoded reference clock
  spi: dt-bindings: Make "additionalProperties: true" explicit
  spi: at91-usart: Remove some dead code
  spi: dt-bindings: st,stm32-spi: Move "st,spi-midi-ns" to spi-peripheral-props.yaml
  spi: qup: Vote for interconnect bandwidth to DRAM
  spi: dt-bindings: qup: Document interconnects
  spi: qup: Parse OPP table for DVFS support
  spi: dt-bindings: qup: Document power-domains and OPP
  ...

Merge tag 'regulator-v6.7' of git://git./linux/kernel/git/broonie/regulator

Pull regulator updates from Mark Brown:
"This has been a fairly quiet release for the regulator API, the
  changes are dominated by some new drivers and a quite large set of
  cleanups and filling in the blanks of features for the existing MT6358
  driver.

   - Cleanups and additional features for the Mediatek MT6358 driver

   - Under voltage detection in the fixed regulator

   - Support for Maxim MAX77503, Mediatek MT6366, Qualcomm PM8909,
     PM8919, PMA8048 and PMC8380"

* tag 'regulator-v6.7' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/regulator: (45 commits)
  regulator (max5970): Remove duplicate line
  regulator (max5970): Add hwmon support
  regulator: qcom-rpmh: Fix smps4 regulator for pm8550ve
  regulator: qcom,rpmh: Add PMC8380 compatible
  regulator: qcom-rpmh: Add regulators support for PMC8380
  regulator: fixed: add support for under-voltage IRQ
  regulator: dt-bindings: fixed-regulator: Add under-voltage interrupt support
  dt-bindings: regulator: dlg,da9210: Convert to json-schema
  regulator: dt-bindings: Add ADI MAX77503 support
  regulator: max77503: Add ADI MAX77503 support
  regulator: Use device_get_match_data()
  regulator: da9121: Use i2c_get_match_data()
  regulator: Drop unnecessary of_match_device() calls
  regulator: da9063: Annotate struct da9063_regulators with __counted_by
  regulator: da9062: Annotate struct da9062_regulators with __counted_by
  regulator: mt6358: Add supply names for MT6366 regulators
  regulator: mt6358: Add missing regulators for MT6366
  regulator: mt6358: Make MT6366 vcn18 LDO configurable
  regulator: mt6358: fix and drop type prefix in MT6366 regulator node names
  regulator: mt6358: Add supply names for MT6358 regulators
  ...

Merge tag 'regmap-v6.7' of git://git./linux/kernel/git/broonie/regmap

Pull regmap updates from Mark Brown:
"The main change here is a fix for an issue where we were letting the
  selector for windowed register ranges get out of sync with the
  hardware during a cache sync plus associated KUnit tests. This was
  reported just at the end of the release cycle and only in -next for a
  day prior to the merge window so it seemed better to hold off for now,
  the bug had been present for more than a decade so wasn't causing too
  many practical problems hopefully.

  There's also a fix for error handling in the debugfs output from
  Christope Jaillet"

* tag 'regmap-v6.7' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/regmap:
  regmap: Ensure range selector registers are updated after cache sync
  regmap: kunit: Add test for cache sync interaction with ranges
  regmap: kunit: Fix marking of the range window as volatile
  regmap: debugfs: Fix a erroneous check after snprintf()

Merge tag 'gpio-updates-for-v6.7-rc1' of git://git./linux/kernel/git/brgl/linux

Pull gpio updates from Bartosz Golaszewski:
"We don't have any new drivers. The loongson driver is getting extended
  with support for new models. There's a big refactor of gpio-pca953x
  and many small improvements to others.

  The GPIO code in the kernel has acquired a lot of cruft over the years
  as well as many abusers of the API across the kernel tree. This
  release cycle we have started a major cleanup and improvement effort
  that will most likely span several releases. We have started by
  converting external users of struct gpio_chip to accessing the wrapper
  around it - struct gpio_device. This is because the latter is
  reference counted while the former is removed when the provider is
  unbound. We also removed several instances of drivers accessing
  private GPIOLIB structures and including the private header from
  drivers/gpio/.

  To that end you'll see several commits aimed at different subsystems
  (acked by relevant maintainers) as well as two merges from the
  x86/platform tree.

  We'll then rework the locking in GPIOLIB which currently uses a big
  spinlock for many different things and could use becoming more
  fine-grained, especially as it doesn't even get the locking right.
  We'll also use SRCU for protecting the gpio_chip pointer against
  in-kernel hot-unplug crashes similar to what we saw triggered from
  user-space and fixed with semaphores in gpiolib-cdev. The core GPIOLIB
  is still vulnerable to these use-cases. I'm just mentioning the plans
  here, this is not part of this PR.

  You'll see some new instances of using __free(). We've added a
  gpio_device_put cleanup helper similar to the put_device one
  introduced by Peter Zijlstra and used it according to the preferred
  pattern except where it didn't make sense.

  GPIOLIB core:
   - provide interfaces allowing users to retrieve, manage and query the
     reference counted GPIO device instead of accessing the private
     gpio_chip structure
   - replace gpiochip_find() with gpio_device_find()
   - remove unused acpi_get_and_request_gpiod()
   - improve the ignore_interrupt functionality in GPIO ACPI
   - correct notifier return codes in gpiolib-of
   - unexport gpiod_set_transitory() as it's unused outside of core GPIO
     code
   - while there are still external users accessing struct gpio_chip,
     let's make gpiochip_get_desc() public so that they at least use the
     preferred helper
   - improve locking for lookup tables
   - annotate struct linereq with __counted_by
   - improve GPIOLIB docs
   - add an OF quirk for LED trigger sources

  Driver improvements:
   - convert all GPIO drivers with .remove() callbacks to using the new
     variant returning void instead of int
   - stop accessing the GPIOLIB private structures in gpio-mockup,
     i2c-mux-gpio, hte-tegra194, gpio-sim
   - use the recommended pattern for autofree variables in gpio-sim
   - add support for more models to gpio-loongson
   - use a notifier chain to notify other blocks about interrupts in
     gpio-eic-sprd instead of looking up GPIO devices on every interrupt
   - convert gpio-pca953x and gpio-fx6408 to using the maple tree regmap
     cache
   - don't include GPIOLIB internal headers in drivers which don't need
     them
   - move the ingenic NAND quirk into gpiolib-of
   - add an ignore interrupt quirk for Peaq C1010
   - drop static GPIO base from gpio-omap, gpio-f7188x
   - use the preferred device_get_match_data() function in drivers that
     still don't
   - refactor gpio-pca953x: switch to using DEFINE_SIMPLE_DEV_PM_OPS(),
     use cleanup helpers, use dev_err_probe() where it makes sense,
     fully convert to using devres and some other minor tweaks

  DT bindings:
   - add support for a new model to gpio-vf610 and update existing
     properties
   - add support for more loongson models
   - add missing support for imx models that are used but undocumented
   - convert bindings for Intel IXP4xx to schema

  Minor stuff:
   - deprecate gpio-mockup in favor of gpio-sim
   - include missing headers here and there
   - stop using gpiochip_find() in OMAP1 board files
   - minor tweaks in gpio-vf610, gpio-hisi
   - remove unneeded 'extern' specifiers from headers"

* tag 'gpio-updates-for-v6.7-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/brgl/linux: (108 commits)
  hte: tegra194: add GPIOLIB dependency
  hte: tegra194: don't access struct gpio_chip
  gpiolib: provide gpio_device_get_base()
  i2c: mux: gpio: don't fiddle with GPIOLIB internals
  gpiolib: provide gpiod_to_gpio_device()
  gpiolib: provide gpio_device_to_device()
  gpio: hisi: Fix format specifier
  gpiolib: provide gpio_device_find_by_fwnode()
  gpio: acpi: remove acpi_get_and_request_gpiod()
  gpio: Use device_get_match_data()
  gpio: vf610: update comment for i.MX8ULP and i.MX93 legacy compatibles
  platform/x86: int3472: Switch to devm_get_gpiod()
  platform/x86: int3472: Stop using gpiod_toggle_active_low()
  platform/x86: int3472: Add new skl_int3472_gpiod_get_from_temp_lookup() helper
  platform/x86: int3472: Add new skl_int3472_fill_gpiod_lookup() helper
  gpio: vf610: simplify code by dropping data check
  gpio: vf610: add i.MX8ULP of_device_id entry
  dt-bindings: gpio: vf610: add i.MX95 compatible
  dt-bindings: gpio: vf610: correct i.MX8ULP and i.MX93
  dt-bindings: gpio: vf610: update gpio-ranges
  ...

Merge tag 'pm-6.7-rc1' of git://git./linux/kernel/git/rafael/linux-pm

Pull power management updates from Rafael Wysocki:
"These add new hardware support (new Qualcomm SoC versions in cpufreq,
  RK3568/RK3588 in devfreq), extend the OPP (operating performance
  points) framework, improve cpufreq governors, fix issues and clean up
  code (most of the changes are in cpufreq and devfreq).

  Specifics:

   - Add support for several Qualcomm SoC versions and other similar
     changes (Christian Marangi, Dmitry Baryshkov, Luca Weiss, Neil
     Armstrong, Richard Acayan, Robert Marko, Rohit Agarwal, Stephan
     Gerhold and Varadarajan Narayanan)

   - Clean up the tegra cpufreq driver (Sumit Gupta)

   - Use of_property_read_reg() to parse "reg" in pmac32 driver (Rob
     Herring)

   - Add support for TI's am62p5 Soc (Bryan Brattlof)

   - Make ARM_BRCMSTB_AVS_CPUFREQ depends on !ARM_SCMI_CPUFREQ (Florian
     Fainelli)

   - Update Kconfig to mention i.MX7 as well (Alexander Stein)

   - Revise global turbo disable check in intel_pstate (Srinivas
     Pandruvada)

   - Carry out initialization of sg_cpu in the schedutil cpufreq
     governor in one loop (Liao Chang)

   - Simplify the condition for storing 'down_threshold' in the
     conservative cpufreq governor (Liao Chang)

   - Use fine-grained mutex in the userspace cpufreq governor (Liao
     Chang)

   - Move is_managed indicator in the userspace cpufreq governor into a
     per-policy structure (Liao Chang)

   - Rebuild sched-domains when removing cpufreq driver (Pierre Gondois)

   - Fix buffer overflow detection in trans_stats() (Christian Marangi)

   - Switch to dev_pm_opp_find_freq_(ceil/floor)_indexed() APIs to
     support specific devices like UFS which handle multiple clocks
     through OPP (Operating Performance Point) framework (Manivannan
     Sadhasivam)

   - Add perf support to the Rockchip DFI (DDR Monitor Module) devfreq-
     event driver:
      * Generalize rockchip-dfi.c to support new RK3568/RK3588 using
        different DDR type (Sascha Hauer).
      * Convert DT binding document format to yaml (Sascha Hauer).
      * Add perf support for DFI (a unit suitable for measuring DDR
        utilization) to rockchip-dfi.c to extend DFI usage (Sascha
        Hauer)

   - Add locking to the OPP handling code in the Mediatek CCI devfreq
     driver, because the voltage of shared OPP might be changed by
     multiple drivers (Mark Tseng, Dan Carpenter)

   - Use device_get_match_data() in the Samsung Exynos PPMU
     devfreq-event driver (Rob Herring)

   - Extend support for the opp-level beyond required-opps (Ulf Hansson)

   - Add dev_pm_opp_find_level_floor() (Krishna chaitanya chundru)

   - dt-bindings: Allow opp-peak-kBpsfor kryo CPUs, support Qualcomm
     Krait SoCs and document named opp-microvolt property (Bjorn
     Andersson, Dmitry Baryshkov and Christian Marangi)

   - Fix -Wunsequenced warning _of_add_opp_table_v1() (Nathan
     Chancellor)

   - General cleanup of OPP code (Viresh Kumar)

   - Use __get_safe_page() rather than touching the list in hibernation
     snapshot code (Brian Geffon)

   - Fix symbol export for _SIMPLE_ variants of _PM_OPS() (Raag Jadav)

   - Clean up sync_read handling in snapshot_write_next() (Brian Geffon)

   - Fix kerneldoc comments for swsusp_check() and swsusp_close() to
     better match code (Christoph Hellwig)

   - Downgrade BIOS locked limits pr_warn() in the Intel RAPL power
     capping driver to pr_debug() (Ville Syrjälä)

   - Change the minimum python version for the intel_pstate_tracer
     utility from 2.7 to 3.6 (Doug Smythies)"

* tag 'pm-6.7-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm: (82 commits)
  dt-bindings: cpufreq: qcom-hw: document SM8650 CPUFREQ Hardware
  cpufreq: arm: Kconfig: Add i.MX7 to supported SoC for ARM_IMX_CPUFREQ_DT
  cpufreq: qcom-nvmem: add support for IPQ8064
  cpufreq: qcom-nvmem: also accept operating-points-v2-krait-cpu
  cpufreq: qcom-nvmem: drop pvs_ver for format a fuses
  dt-bindings: cpufreq: qcom-cpufreq-nvmem: Document krait-cpu
  cpufreq: qcom-nvmem: add support for IPQ6018
  dt-bindings: cpufreq: qcom-cpufreq-nvmem: document IPQ6018
  cpufreq: qcom-nvmem: Add MSM8909
  cpufreq: qcom-nvmem: Simplify driver data allocation
  powercap: intel_rapl: Downgrade BIOS locked limits pr_warn() to pr_debug()
  cpufreq: stats: Fix buffer overflow detection in trans_stats()
  dt-bindings: devfreq: event: rockchip,dfi: Add rk3588 support
  dt-bindings: devfreq: event: rockchip,dfi: Add rk3568 support
  dt-bindings: devfreq: event: convert Rockchip DFI binding to yaml
  PM / devfreq: rockchip-dfi: add support for RK3588
  PM / devfreq: rockchip-dfi: account for multiple DDRMON_CTRL registers
  PM / devfreq: rockchip-dfi: make register stride SoC specific
  PM / devfreq: rockchip-dfi: Add perf support
  PM / devfreq: rockchip-dfi: give variable a better name
  ...

Merge tag 'acpi-6.7-rc1' of git://git./linux/kernel/git/rafael/linux-pm

Pull ACPI updates from Rafael Wysocki:
"These fix issues, add new quirks, rearrange the IRQ override quirk
  definitions, add new helpers and switch over code to using them,
  rework a couple of interfaces to be more flexible, eliminate strncpy()
  usage from PNP, extend the ACPI PCC mailbox driver and clean up code.

  This is based on ACPI thermal driver changes that are present in the
  thermal control updates for 6.7-rc1 pull request (they are depended on
  by the ACPI utilities updates). However, the ACPI thermal driver
  changes are not included in the list of specific ACPI changes below.

  Specifics:

   - Add symbol definitions related to CDAT to the ACPICA code (Dave
     Jiang)

   - Use the acpi_device_is_present() helper in more places and rename
     acpi_scan_device_not_present() to be about enumeration (James
     Morse)

   - Add __printf format attribute to acpi_os_vprintf() (Su Hui)

   - Clean up departures from kernel coding style in the low-level
     interface for ACPICA (Jonathan Bergh)

   - Replace strncpy() with strscpy() in acpi_osi_setup() (Justin Stitt)

   - Fail FPDT parsing on zero length records and add proper handling
     for fpdt_process_subtable() to acpi_init_fpdt() (Vasily Khoruzhick)

   - Rework acpi_handle_list handling so as to manage it dynamically,
     including size computation (Rafael Wysocki)

   - Clean up ACPI utilities code so as to make it follow the kernel
     coding style (Jonathan Bergh)

   - Consolidate IRQ trigger-type override DMI tables and drop .ident
     values from dmi_system_id tables used for ACPI resources management
     quirks (Hans de Goede)

   - Add ACPI IRQ override for TongFang GMxXGxx (Werner Sembach)

   - Allow _DSD buffer data only for byte accessors and document the
     _DSD data buffer GUID (Andy Shevchenko)

   - Drop BayTrail and Lynxpoint pinctrl device IDs from the ACPI LPSS
     driver, because it does not need them (Raag Jadav)

   - Add acpi_backlight=vendor quirk for Toshiba Portégé R100 (Ondrej
     Zary)

   - Add "vendor" backlight quirks for 3 Lenovo x86 Android tablets
     (Hans de Goede)

   - Move Xiaomi Mi Pad 2 backlight quirk to its own section (Hans de
     Goede)

   - Annotate struct prm_module_info with __counted_by (Kees Cook)

   - Fix AER info corruption in aer_recover_queue() when error status
     data has multiple sections (Shiju Jose)

   - Make APEI use ERST maximum execution time for slow devices (Jeshua
     Smith)

   - Add support for platform notification handling to the PCC mailbox
     driver and modify it to support shared interrupts for multiple
     subspaces (Huisong Li)

   - Define common macros to use when referring to various bitfields in
     the PCC generic communications channel command and status fields
     and use them in some drivers (Sudeep Holla)

   - Add EC GPE detection quirk for HP 250 G7 Notebook PC (Jonathan
     Denose)

   - Fix and clean up create_pnp_modalias() and create_of_modalias()
     (Christophe JAILLET)

   - Modify 2 pieces of code to use acpi_evaluate_dsm_typed() (Andy
     Shevchenko)

   - Define acpi_dev_uid_match() for matching _UID and use it in several
     places (Raag Jadav)

   - Use acpi_device_uid() for fetching _UID in 2 places (Raag Jadav)

   - Add context argument to acpi_dev_install_notify_handler() (Rafael
     Wysocki)

   - Clarify ACPI bus concepts in the ACPI device enumeration
     documentation (Rafael Wysocki)

   - Switch over the ACPI AC and ACPI PAD drivers to using the platform
     driver interface which, is more logically consistent than binding a
     driver directly to an ACPI device object, and clean them up (Michal
     Wilczynski)

   - Replace strncpy() in the PNP code with either memcpy() or strscpy()
     as appropriate (Justin Stitt)

   - Clean up coding style in pnp.h (GuoHua Cheng)"

* tag 'acpi-6.7-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm: (54 commits)
  ACPI: resource: Do IRQ override on TongFang GMxXGxx
  perf: arm_cspmu: use acpi_dev_hid_uid_match() for matching _HID and _UID
  ACPI: EC: Add quirk for HP 250 G7 Notebook PC
  ACPI: x86: use acpi_dev_uid_match() for matching _UID
  ACPI: utils: use acpi_dev_uid_match() for matching _UID
  pinctrl: intel: use acpi_dev_uid_match() for matching _UID
  ACPI: utils: Introduce acpi_dev_uid_match() for matching _UID
  ACPI: sysfs: Clean up create_pnp_modalias() and create_of_modalias()
  ACPI: sysfs: Fix create_pnp_modalias() and create_of_modalias()
  ACPI: acpi_pad: Rename ACPI device from device to adev
  ACPI: acpi_pad: Use dev groups for sysfs
  ACPI: acpi_pad: Replace acpi_driver with platform_driver
  ACPI: APEI: Use ERST timeout for slow devices
  ACPI: scan: Rename acpi_scan_device_not_present() to be about enumeration
  PNP: replace deprecated strncpy() with memcpy()
  PNP: ACPI: replace deprecated strncpy() with strscpy()
  perf: qcom: use acpi_device_uid() for fetching _UID
  ACPI: sysfs: use acpi_device_uid() for fetching _UID
  ACPI: scan: Use the acpi_device_is_present() helper in more places
  ACPI: AC: Rename ACPI device from device to adev
  ...

Merge tag 'thermal-6.7-rc1' of git://git./linux/kernel/git/rafael/linux-pm

Pull thermal control updates from Rafael Wysocki:
"These further rework the ACPI thermal driver, after the changes made
  to it in the previous cycle, to make it easier to grasp, get rid of
  redundant pieces of internal data structures and eliminate its
  reliance on a specific ordering of trip point objects in the thermal
  core, make thermal core adjustments needed for the ACPI thermal driver
  rework, modify the thermal governor interface so as to use trip
  pointers for representing trip points in it, switch over multiple
  thermal drivers to using void platform driver remove callbacks, add
  support for 2 hardware features to the Intel int340x thermal driver,
  add support for new hardware on ARM platforms, update documentation,
  fix problems, clean up code and update the MAINTAINERS record for
  thermal control.

  Specifics:

   - Untangle the initialization and updates of passive and active trip
     points in the ACPI thermal driver (Rafael Wysocki)

   - Reduce code duplication related to the initialization and updates
     of trip points in the ACPI thermal driver (Rafael Wysocki)

   - Use trip pointers for cooling device binding in the ACPI thermal
     driver (Rafael Wysocki)

   - Simplify critical and hot trips representation in the ACPI thermal
     driver (Rafael Wysocki)

   - Use trip pointers in thermal governors and in the related part of
     the thermal core (Rafael Wysocki)

   - Drop the trips_disabled bitmask that has become redundant from the
     thermal core (Rafael Wysocki)

   - Avoid updating trip points when the thermal zone temperature falls
     into a trip point's hysteresis range (ícolas F. R. A. Prado)

   - Add power floor notifications support to the int340x thermal
     control driver (Srinivas Pandruvada)

   - Rework updating trip points in the int340x thermal driver so that
     it does not access thermal zone internals directly (Rafael
     Wysocki)

   - Use param_get_byte() instead of param_get_int() as the max_idle
     module parameter .get() callback in the Intel powerclamp thermal
     driver to avoid possible out-of-bounds access (David Arcari)

   - Add workload hints support to the int340x thermal driver (Srinivas
     Pandruvada)

   - Add support for Mediatek LVTS MT8192 along with suspend/resume
     routines (Balsam Chihi)

   - Fix probe for THERMAL_V2 in the Mediatek LVTS driver (Markus
     Schneider-Pargmann)

   - Remove duplicate error message from the max76620 driver when
     thermal_of_zone_register() fails (Thierry Reding)

   - Add i.MX7D compatible bindings to fix a warning from dtbs_check for
     the imx6ul platform (Alexander Stein)

   - Add sa8775p compatible to the QCom tsens driver (Priyansh Jain)

   - Fix error check in lvts_debugfs_init() to be against PTR_ERR() in
     the LVTS Mediatek driver (Minjie Du)

   - Remove unused variable in thermal/tools (Kuan-Wei Chiu)

   - Document the imx8dl thermal sensor (Fabio Estevam)

   - Add variable names in callback prototypes to prevent warning from
     checkpatch.pl in the imx8mm driver (Bragatheswaran Manickavel)

   - Add missing unevaluatedProperties on child node schemas for
     tegra124 (Rob Herring)

   - Add mt7988 support to the Mediatek LVTS driver (Frank Wunderlich)"

* tag 'thermal-6.7-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm: (111 commits)
  thermal: ACPI: Include the right header file
  thermal: core: Don't update trip points inside the hysteresis range
  thermal: core: Pass trip pointer to governor throttle callback
  thermal: gov_step_wise: Fold update_passive_instance() into its caller
  thermal: gov_power_allocator: Use trip pointers instead of trip indices
  thermal: gov_fair_share: Rearrange get_trip_level()
  thermal: trip: Define for_each_trip() macro
  thermal: trip: Simplify computing trip indices
  thermal/qcom/tsens: Drop ops_v0_1
  thermal/drivers/mediatek/lvts_thermal: Update calibration data documentation
  thermal/drivers/mediatek/lvts_thermal: Add mt8192 support
  thermal/drivers/mediatek/lvts_thermal: Add suspend and resume
  dt-bindings: thermal: mediatek: Add LVTS thermal controller definition for mt8192
  thermal/drivers/mediatek: Fix probe for THERMAL_V2
  thermal/drivers/max77620: Remove duplicate error message
  dt-bindings: timer: add imx7d compatible
  dt-bindings: net: microchip: Allow nvmem-cell usage
  dt-bindings: imx-thermal: Add #thermal-sensor-cells property
  dt-bindings: thermal: tsens: Add sa8775p compatible
  thermal/drivers/mediatek/lvts_thermal: Fix error check in lvts_debugfs_init()
  ...

net: tcp: remove call to obsolete crypto_ahash_alignmask()

linux-next hit the following build error:

net/ipv4/tcp_ao.c: In function 'tcp_ao_key_alloc':
net/ipv4/tcp_ao.c:1536:13: error: implicit declaration of function 'crypto_ahash_alignmask'; did you mean 'crypto_ahash_alg_name'? [-Werror=implicit-function-declaration]
1536 |         if (crypto_ahash_alignmask(tfm) > TCP_AO_KEY_ALIGN) {
      |             ^~~~~~~~~~~~~~~~~~~~~~
      |             crypto_ahash_alg_name

Caused by commit from the crypto tree

  0f8660c82b79 ("crypto: ahash - remove crypto_ahash_alignmask")

interacting with commit

  4954f17ddefc ("net/tcp: Introduce TCP_AO setsockopt()s")

from networking. crypto_ahash_alignmask() has been phased out
by the former commit, drop the call in networking.
Eric confirms that the check is safe to remove and was questionable
here in the first place.

Signed-off-by: Stephen Rothwell <sfr@canb.auug.org.au>
Acked-by: Herbert Xu <herbert@gondor.apana.org.au>
Reviewed-by: Dmitry Safonov <dima@arista.com>
Signed-off-by: Jakub Kicinski <kuba@kernel.org>

dm crypt: account large pages in cc->n_allocated_pages

The commit 5054e778fcd9c ("dm crypt: allocate compound pages if
possible") changed dm-crypt to use compound pages to improve
performance. Unfortunately, there was an oversight: the allocation of
compound pages was not accounted at all. Normal pages are accounted in
a percpu counter cc->n_allocated_pages and dm-crypt is limited to
allocate at most 2% of memory. Because compound pages were not
accounted at all, dm-crypt could allocate memory over the 2% limit.

Fix this by adding the accounting of compound pages, so that memory
consumption of dm-crypt is properly limited.

Signed-off-by: Mikulas Patocka <mpatocka@redhat.com>
Fixes: 5054e778fcd9c ("dm crypt: allocate compound pages if possible")
Cc: stable@vger.kernel.org # v6.5+
Signed-off-by: Mike Snitzer <snitzer@kernel.org>

Merge tag 'net-next-6.7' of git://git./linux/kernel/git/netdev/net-next

Pull networking updates from Jakub Kicinski:
"Core & protocols:

   - Support usec resolution of TCP timestamps, enabled selectively by a
     route attribute.

   - Defer regular TCP ACK while processing socket backlog, try to send
     a cumulative ACK at the end. Increase single TCP flow performance
     on a 200Gbit NIC by 20% (100Gbit -> 120Gbit).

   - The Fair Queuing (FQ) packet scheduler:
       - add built-in 3 band prio / WRR scheduling
       - support bypass if the qdisc is mostly idle (5% speed up for TCP RR)
       - improve inactive flow reporting
       - optimize the layout of structures for better cache locality

   - Support TCP Authentication Option (RFC 5925, TCP-AO), a more modern
     replacement for the old MD5 option.

   - Add more retransmission timeout (RTO) related statistics to
     TCP_INFO.

   - Support sending fragmented skbs over vsock sockets.

   - Make sure we send SIGPIPE for vsock sockets if socket was
     shutdown().

   - Add sysctl for ignoring lower limit on lifetime in Router
     Advertisement PIO, based on an in-progress IETF draft.

   - Add sysctl to control activation of TCP ping-pong mode.

   - Add sysctl to make connection timeout in MPTCP configurable.

   - Support rcvlowat and notsent_lowat on MPTCP sockets, to help apps
     limit the number of wakeups.

   - Support netlink GET for MDB (multicast forwarding), allowing user
     space to request a single MDB entry instead of dumping the entire
     table.

   - Support selective FDB flushing in the VXLAN tunnel driver.

   - Allow limiting learned FDB entries in bridges, prevent OOM attacks.

   - Allow controlling via configfs netconsole targets which were
     created via the kernel cmdline at boot, rather than via configfs at
     runtime.

   - Support multiple PTP timestamp event queue readers with different
     filters.

   - MCTP over I3C.

  BPF:

   - Add new veth-like netdevice where BPF program defines the logic of
     the xmit routine. It can operate in L3 and L2 mode.

   - Support exceptions - allow asserting conditions which should never
     be true but are hard for the verifier to infer. With some extra
     flexibility around handling of the exit / failure:

          https://lwn.net/Articles/938435/

   - Add support for local per-cpu kptr, allow allocating and storing
     per-cpu objects in maps. Access to those objects operates on the
     value for the current CPU.

     This allows to deprecate local one-off implementations of per-CPU
     storage like BPF_MAP_TYPE_PERCPU_CGROUP_STORAGE maps.

   - Extend cgroup BPF sockaddr hooks for UNIX sockets. The use case is
     for systemd to re-implement the LogNamespace feature which allows
     running multiple instances of systemd-journald to process the logs
     of different services.

   - Enable open-coded task_vma iteration, after maple tree conversion
     made it hard to directly walk VMAs in tracing programs.

   - Add open-coded task, css_task and css iterator support. One of the
     use cases is customizable OOM victim selection via BPF.

   - Allow source address selection with bpf_*_fib_lookup().

   - Add ability to pin BPF timer to the current CPU.

   - Prevent creation of infinite loops by combining tail calls and
     fentry/fexit programs.

   - Add missed stats for kprobes to retrieve the number of missed
     kprobe executions and subsequent executions of BPF programs.

   - Inherit system settings for CPU security mitigations.

   - Add BPF v4 CPU instruction support for arm32 and s390x.

  Changes to common code:

   - overflow: add DEFINE_FLEX() for on-stack definition of structs with
     flexible array members.

   - Process doc update with more guidance for reviewers.

  Driver API:

   - Simplify locking in WiFi (cfg80211 and mac80211 layers), use wiphy
     mutex in most places and remove a lot of smaller locks.

   - Create a common DPLL configuration API. Allow configuring and
     querying state of PLL circuits used for clock syntonization, in
     network time distribution.

   - Unify fragmented and full page allocation APIs in page pool code.
     Let drivers be ignorant of PAGE_SIZE.

   - Rework PHY state machine to avoid races with calls to phy_stop().

   - Notify DSA drivers of MAC address changes on user ports, improve
     correctness of offloads which depend on matching port MAC
     addresses.

   - Allow antenna control on injected WiFi frames.

   - Reduce the number of variants of napi_schedule().

   - Simplify error handling when composing devlink health messages.

  Misc:

   - A lot of KCSAN data race "fixes", from Eric.

   - A lot of __counted_by() annotations, from Kees.

   - A lot of strncpy -> strscpy and printf format fixes.

   - Replace master/slave terminology with conduit/user in DSA drivers.

   - Handful of KUnit tests for netdev and WiFi core.

  Removed:

   - AppleTalk COPS.

   - AppleTalk ipddp.

   - TI AR7 CPMAC Ethernet driver.

  Drivers:

   - Ethernet high-speed NICs:
      - Intel (100G, ice, idpf):
         - add a driver for the Intel E2000 IPUs
         - make CRC/FCS stripping configurable
         - cross-timestamping for E823 devices
         - basic support for E830 devices
         - use aux-bus for managing client drivers
         - i40e: report firmware versions via devlink
      - nVidia/Mellanox:
         - support 4-port NICs
         - increase max number of channels to 256
         - optimize / parallelize SF creation flow
      - Broadcom (bnxt):
         - enhance NIC temperature reporting
         - support PAM4 speeds and lane configuration
      - Marvell OcteonTX2:
         - PTP pulse-per-second output support
         - enable hardware timestamping for VFs
      - Solarflare/AMD:
         - conntrack NAT offload and offload for tunnels
      - Wangxun (ngbe/txgbe):
         - expose HW statistics
      - Pensando/AMD:
         - support PCI level reset
         - narrow down the condition under which skbs are linearized
      - Netronome/Corigine (nfp):
         - support CHACHA20-POLY1305 crypto in IPsec offload

   - Ethernet NICs embedded, slower, virtual:
      - Synopsys (stmmac):
         - add Loongson-1 SoC support
         - enable use of HW queues with no offload capabilities
         - enable PPS input support on all 5 channels
         - increase TX coalesce timer to 5ms
      - RealTek USB (r8152): improve efficiency of Rx by using GRO frags
      - xen: support SW packet timestamping
      - add drivers for implementations based on TI's PRUSS (AM64x EVM)

   - nVidia/Mellanox Ethernet datacenter switches:
      - avoid poor HW resource use on Spectrum-4 by better block
        selection for IPv6 multicast forwarding and ordering of blocks
        in ACL region

   - Ethernet embedded switches:
      - Microchip:
         - support configuring the drive strength for EMI compliance
         - ksz9477: partial ACL support
         - ksz9477: HSR offload
         - ksz9477: Wake on LAN
      - Realtek:
         - rtl8366rb: respect device tree config of the CPU port

   - Ethernet PHYs:
      - support Broadcom BCM5221 PHYs
      - TI dp83867: support hardware LED blinking

   - CAN:
      - add support for Linux-PHY based CAN transceivers
      - at91_can: clean up and use rx-offload helpers

   - WiFi:
      - MediaTek (mt76):
         - new sub-driver for mt7925 USB/PCIe devices
         - HW wireless <> Ethernet bridging in MT7988 chips
         - mt7603/mt7628 stability improvements
      - Qualcomm (ath12k):
         - WCN7850:
            - enable 320 MHz channels in 6 GHz band
            - hardware rfkill support
            - enable IEEE80211_HW_SINGLE_SCAN_ON_ALL_BANDS to
              make scan faster
            - read board data variant name from SMBIOS
        - QCN9274: mesh support
      - RealTek (rtw89):
         - TDMA-based multi-channel concurrency (MCC)
      - Silicon Labs (wfx):
         - Remain-On-Channel (ROC) support

   - Bluetooth:
      - ISO: many improvements for broadcast support
      - mark BCM4378/BCM4387 as BROKEN_LE_CODED
      - add support for QCA2066
      - btmtksdio: enable Bluetooth wakeup from suspend"

* tag 'net-next-6.7' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net-next: (1816 commits)
  net: pcs: xpcs: Add 2500BASE-X case in get state for XPCS drivers
  net: bpf: Use sockopt_lock_sock() in ip_sock_set_tos()
  net: mana: Use xdp_set_features_flag instead of direct assignment
  vxlan: Cleanup IFLA_VXLAN_PORT_RANGE entry in vxlan_get_size()
  iavf: delete the iavf client interface
  iavf: add a common function for undoing the interrupt scheme
  iavf: use unregister_netdev
  iavf: rely on netdev's own registered state
  iavf: fix the waiting time for initial reset
  iavf: in iavf_down, don't queue watchdog_task if comms failed
  iavf: simplify mutex_trylock+sleep loops
  iavf: fix comments about old bit locks
  doc/netlink: Update schema to support cmd-cnt-name and cmd-max-name
  tools: ynl: introduce option to process unknown attributes or types
  ipvlan: properly track tx_errors
  netdevsim: Block until all devices are released
  nfp: using napi_build_skb() to replace build_skb()
  net: dsa: microchip: ksz9477: Fix spelling mistake "Enery" -> "Energy"
  net: dsa: microchip: Ensure Stable PME Pin State for Wake-on-LAN
  net: dsa: microchip: Refactor switch shutdown routine for WoL preparation
  ...

dm integrity: use crypto_shash_digest() in sb_mac()

Simplify sb_mac() by using crypto_shash_digest() instead of an
init+update+final sequence. This should also improve performance.

Signed-off-by: Eric Biggers <ebiggers@google.com>
Signed-off-by: Mike Snitzer <snitzer@kernel.org>

dm crypt: use crypto_shash_digest() in crypt_iv_tcw_whitening()

Simplify crypt_iv_tcw_whitening() by using crypto_shash_digest() instead
of an init+update+final sequence. This should also improve performance.

Signed-off-by: Eric Biggers <ebiggers@google.com>
Signed-off-by: Mike Snitzer <snitzer@kernel.org>

dm error: Add support for zoned block devices

dm-error is used in several test cases in the xfstests test suite to
check the handling of IO errors in file systems. However, with several
file systems getting native support for zoned block devices (e.g.
btrfs and f2fs), dm-error's lack of zoned block device support creates
problems as the file system attempts executing zone commands (e.g. a
zone append operation) against a dm-error non-zoned block device,
which causes various issues in the block layer (e.g. WARN_ON
triggers).

This commit adds supports for zoned block devices to dm-error, allowing
a DM device table containing an error target to be exposed as a zoned
block device (if all targets have a compatible zoned model support and
mapping). This is done as follows:
1) Allow passing 2 arguments to an error target, similar to dm-linear:
   a backing device and a start sector. These arguments are optional and
   dm-error retains its characteristics if the arguments are not
   specified.
2) Implement the iterate_devices method so that dm-core can normally
   check the zone support and restrictions (e.g. zone alignment of the
   targets). When the backing device arguments are not specified, the
   iterate_devices method never calls the fn() argument.
When no backing device is specified, as before, we assume that the DM
device is not zoned. When the backing device arguments are specified,
the zoned model of the DM device will depend on the backing device
type:
- If the backing device is zoned and its model and mapping is
   compatible with other targets of the device, the resulting device
   will be zoned, with the dm-error mapped portion always returning
   errors (similar to the default non-zoned case).
- If the backing device is not zoned, then the DM device will not be
   either.

This zone support for dm-error requires the definition of a functional
report_zones operation so that dm_revalidate_zones() can operate
correctly and resources for emulating zone append operations
initialized. This is necessary for cases where dm-error is used to
partially map a device and have an overall correct handling of zone
append. This means that dm-error does not fail report zones operations.

Two changes that are not obvious are included to avoid issues:
1) dm_table_supports_zoned_model() is changed to directly check if
   the backing device of a wildcard target (= dm-error target) is
   zoned. Otherwise, we wouldn't be able to catch the invalid setup of
   dm-error without a backing device (non zoned case) being combined
   with zoned targets.
2) dm_table_supports_dax() is modified to return false if the wildcard
   target is found. Otherwise, when dm-error is set without a backing
   device, we end up with a NULL pointer dereference in
   set_dax_synchronous (dax_dev is NULL). This is consistent with the
   current behavior because dm_table_supports_dax() always returned
   false for targets that do not define the iterate_devices method.

Signed-off-by: Damien Le Moal <dlemoal@kernel.org>
Tested-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Mike Snitzer <snitzer@kernel.org>

dm delay: for short delays, use kthread instead of timers and wq

DM delay's current design of using timers and wq to realize the delays
is insufficient for delays below ~50ms.

This commit enhances the design to use a kthread to flush the expired
delays, trading some CPU time (in some cases) for better delay
accuracy and delays closer to what the user requested for smaller
delays. The new design is chosen as long as all the delays are below
50ms.

Since bios can't be completed in interrupt context using a kthread
is probably the most reasonable way to approach this.

Testing with
echo "0 2097152 zero" | dmsetup create dm-zeros
for i in $(seq 0 20);
do
  echo "0 2097152 delay /dev/mapper/dm-zeros 0 $i" | dmsetup create dm-delay-${i}ms;
done

Some performance numbers for comparison, on beaglebone black (single
core) CONFIG_HZ_1000=y:

fio --name=1msread --rw=randread --bs=4k --runtime=60 --time_based \
    --filename=/dev/mapper/dm-delay-1ms
Theoretical maximum: 1000 IOPS
Previous: 250 IOPS
Kthread: 500 IOPS

fio --name=10msread --rw=randread --bs=4k --runtime=60 --time_based \
    --filename=/dev/mapper/dm-delay-10ms
Theoretical maximum: 100 IOPS
Previous: 45 IOPS
Kthread: 50 IOPS

fio --name=1mswrite --rw=randwrite --direct=1 --bs=4k --runtime=60 \
    --time_based --filename=/dev/mapper/dm-delay-1ms
Theoretical maximum: 1000 IOPS
Previous: 498 IOPS
Kthread: 1000 IOPS

fio --name=10mswrite --rw=randwrite --direct=1 --bs=4k --runtime=60 \
    --time_based --filename=/dev/mapper/dm-delay-10ms
Theoretical maximum: 100 IOPS
Previous: 90 IOPS
Kthread: 100 IOPS

(This one is just to prove the new design isn't impacting throughput,
not really about delays):
fio --name=10mswriteasync --rw=randwrite --direct=1 --bs=4k \
    --runtime=60 --time_based --filename=/dev/mapper/dm-delay-10ms \
    --numjobs=32 --iodepth=64 --ioengine=libaio --group_reporting
Previous: 13.3k IOPS
Kthread: 13.3k IOPS

Signed-off-by: Christian Loehle <christian.loehle@arm.com>
[Harshit: kthread_create error handling fix in delay_ctr]
Signed-off-by: Harshit Mogalapalli <harshit.m.mogalapalli@oracle.com>
Signed-off-by: Mike Snitzer <snitzer@kernel.org>

doc: Add /proc/bootconfig to proc.rst

Add /proc/bootconfig description to Documentation/filesystems/proc.rst.

Link: https://lore.kernel.org/all/20231005171747.541123-3-paulmck@kernel.org/
Reported-by: Masami Hiramatsu <mhiramat@kernel.org>
Signed-off-by: Paul E. McKenney <paulmck@kernel.org>
Acked-by: Masami Hiramatsu (Google) <mhiramat@kernel.org>
Signed-off-by: Masami Hiramatsu (Google) <mhiramat@kernel.org>

Merge tag 'cgroup-for-6.7' of git://git./linux/kernel/git/tj/cgroup

Pull cgroup updates from Tejun Heo:

- cpuset now supports remote partitions where CPUs can be reserved for
   exclusive use down the tree without requiring all the intermediate
   nodes to be partitions. This makes it easier to use partitions
   without modifying existing cgroup hierarchy.

- cpuset partition configuration behavior improvement

- cgroup_favordynmods= boot param added to allow setting the flag on
   boot on cgroup1

- Misc code and doc updates

* tag 'cgroup-for-6.7' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/cgroup:
  docs/cgroup: Add the list of threaded controllers to cgroup-v2.rst
  cgroup: use legacy_name for cgroup v1 disable info
  cgroup/cpuset: Cleanup signedness issue in cpu_exclusive_check()
  cgroup/cpuset: Enable invalid to valid local partition transition
  cgroup: add cgroup_favordynmods= command-line option
  cgroup/cpuset: Extend test_cpuset_prs.sh to test remote partition
  cgroup/cpuset: Documentation update for partition
  cgroup/cpuset: Check partition conflict with housekeeping setup
  cgroup/cpuset: Introduce remote partition
  cgroup/cpuset: Add cpuset.cpus.exclusive for v2
  cgroup/cpuset: Add cpuset.cpus.exclusive.effective for v2
  cgroup/cpuset: Fix load balance state in update_partition_sd_lb()
  cgroup: Avoid extra dereference in css_populate_dir()
  cgroup: Check for ret during cgroup1_base_files cft addition

Merge tag 'wq-for-6.7' of git://git./linux/kernel/git/tj/wq

Pull workqueue update from Tejun Heo:
"Just one commit to improve lockdep annotation for work_on_cpu() to
avoid spurious warnings"

* tag 'wq-for-6.7' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/wq:
workqueue: Provide one lock class key per work_on_cpu() callsite