In order to mitigate unexpected signed wrap-around[1], bring back the
signed integer overflow sanitizer. It was removed in commit 6aaa31ae
("ubsan: remove overflow checks") because it was effectively a no-op
when combined with -fno-strict-overflow (which correctly changes signed
overflow from being "undefined" to being explicitly "wrap around").

Compilers are adjusting their sanitizers to trap wrap-around and to
detecting common code patterns that should not be instrumented
(e.g. "var + offset < var"). Prepare for this and explicitly rename
the option from "OVERFLOW" to "WRAP" to more accurately describe the
behavior.

To annotate intentional wrap-around arithmetic, the helpers
wrapping_add/sub/mul_wrap() can be used for individual statements. At
the function level, the __signed_wrap attribute can be used to mark an
entire function as expecting its signed arithmetic to wrap around. For a
single object file the Makefile can use "UBSAN_SIGNED_WRAP_target.o := n"
to mark it as wrapping, and for an entire directory, "UBSAN_SIGNED_WRAP :=
n" can be used.

Additionally keep these disabled under CONFIG_COMPILE_TEST for now.

Link: https://github.com/KSPP/linux/issues/26 [1]
Cc: Miguel Ojeda <ojeda@kernel.org>
Cc: Nathan Chancellor <nathan@kernel.org>
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: Hao Luo <haoluo@google.com>
Reviewed-by: Marco Elver <elver@google.com>
Reviewed-by: Justin Stitt <justinstitt@google.com>
Signed-off-by: Kees Cook <keescook@chromium.org>

For simplicity in splitting out UBSan options into separate rules,
remove CONFIG_UBSAN_SANITIZE_ALL, effectively defaulting to "y", which
is how it is generally used anyway. (There are no ":= y" cases beyond
where a specific file is enabled when a top-level ":= n" is in effect.)

Cc: Andrey Konovalov <andreyknvl@gmail.com>
Cc: Marco Elver <elver@google.com>
Cc: linux-doc@vger.kernel.org
Cc: linux-kbuild@vger.kernel.org
Signed-off-by: Kees Cook <keescook@chromium.org>

Silence a handful of W=1 warnings in the UBSan selftest, which set
variables without using them. For example:

   lib/test_ubsan.c:101:6: warning: variable 'val1' set but not used [-Wunused-but-set-variable]
     101 |         int val1 = 10;
         |             ^
Reported-by: kernel test robot <lkp@intel.com>
Closes: https://lore.kernel.org/oe-kbuild-all/202401310423.XpCIk6KO-lkp@intel.com/Reviewed-by: Marco Elver <elver@google.com>
Signed-off-by: Kees Cook <keescook@chromium.org>

Clang changed the way it enables UBSan trapping mode. Update the Makefile
logic to discover it.
Suggested-by: Fangrui Song <maskray@google.com>
Link: https://lore.kernel.org/lkml/CAFP8O3JivZh+AAV7N90Nk7U2BHRNST6MRP0zHtfQ-Vj0m4+pDA@mail.gmail.com/Reviewed-by: Fangrui Song <maskray@google.com>
Reviewed-by: Justin Stitt <justinstitt@google.com>
Cc: Nathan Chancellor <nathan@kernel.org>
Cc: Masahiro Yamada <masahiroy@kernel.org>
Cc: Nicolas Schier <nicolas@fjasle.eu>
Cc: Nick Desaulniers <ndesaulniers@google.com>
Cc: Bill Wendling <morbo@google.com>
Cc: linux-kbuild@vger.kernel.org
Cc: llvm@lists.linux.dev
Signed-off-by: Kees Cook <keescook@chromium.org>

The kernel hardening efforts have continued to depend more and more
heavily on UBSAN, so make an actual MAINTAINERS entry for it.

Cc: Andrey Ryabinin <ryabinin.a.a@gmail.com>
Acked-by: Andrey Konovalov <andreyknvl@gmail.com>
Acked-by: Marco Elver <elver@google.com>
Signed-off-by: Kees Cook <keescook@chromium.org>

Syzkaller hit 'WARNING in dg_dispatch_as_host' bug.

memcpy: detected field-spanning write (size 56) of single field "&dg_info->msg"
at drivers/misc/vmw_vmci/vmci_datagram.c:237 (size 24)

WARNING: CPU: 0 PID: 1555 at drivers/misc/vmw_vmci/vmci_datagram.c:237
dg_dispatch_as_host+0x88e/0xa60 drivers/misc/vmw_vmci/vmci_datagram.c:237

Some code commentry, based on my understanding:

544 #define VMCI_DG_SIZE(_dg) (VMCI_DG_HEADERSIZE + (size_t)(_dg)->payload_size)
/// This is 24 + payload_size

memcpy(&dg_info->msg, dg, dg_size);
	Destination = dg_info->msg ---> this is a 24 byte
					structure(struct vmci_datagram)
	Source = dg --> this is a 24 byte structure (struct vmci_datagram)
	Size = dg_size = 24 + payload_size

{payload_size = 56-24 =32} -- Syzkaller managed to set payload_size to 32.

 35 struct delayed_datagram_info {
 36         struct datagram_entry *entry;
 37         struct work_struct work;
 38         bool in_dg_host_queue;
 39         /* msg and msg_payload must be together. */
 40         struct vmci_datagram msg;
 41         u8 msg_payload[];
 42 };

So those extra bytes of payload are copied into msg_payload[], a run time
warning is seen while fuzzing with Syzkaller.

One possible way to fix the warning is to split the memcpy() into
two parts -- one -- direct assignment of msg and second taking care of payload.

Gustavo quoted:
"Under FORTIFY_SOURCE we should not copy data across multiple members
in a structure."
Reported-by: syzkaller <syzkaller@googlegroups.com>
Suggested-by: Vegard Nossum <vegard.nossum@oracle.com>
Suggested-by: Gustavo A. R. Silva <gustavoars@kernel.org>
Signed-off-by: Harshit Mogalapalli <harshit.m.mogalapalli@oracle.com>
Reviewed-by: Gustavo A. R. Silva <gustavoars@kernel.org>
Reviewed-by: Kees Cook <keescook@chromium.org>
Reviewed-by: Dan Carpenter <dan.carpenter@linaro.org>
Link: https://lore.kernel.org/r/20240105164001.2129796-2-harshit.m.mogalapalli@oracle.comSigned-off-by: Kees Cook <keescook@chromium.org>

Use struct_size() instead of open coding.
Suggested-by: Gustavo A. R. Silva <gustavoars@kernel.org>
Signed-off-by: Harshit Mogalapalli <harshit.m.mogalapalli@oracle.com>
Reviewed-by: Kees Cook <keescook@chromium.org>
Reviewed-by: Gustavo A. R. Silva <gustavoars@kernel.org>
Link: https://lore.kernel.org/r/20240105164001.2129796-1-harshit.m.mogalapalli@oracle.comSigned-off-by: Kees Cook <keescook@chromium.org>

CAP_SYSLOG was separated from CAP_SYS_ADMIN and introduced in Linux
2.6.37 (2010-11). For a long time, certain syslog actions required
CAP_SYS_ADMIN or CAP_SYSLOG. Maybe it’s time to officially remove
CAP_SYS_ADMIN for more fine-grained control.

CAP_SYS_ADMIN was once removed but added back for backwards
compatibility reasons. In commit 38ef4c2e ("syslog: check cap_syslog
when dmesg_restrict") (2010-12), CAP_SYS_ADMIN was no longer needed. And
in commit ee24aebf ("cap_syslog: accept CAP_SYS_ADMIN for now")
(2011-02), it was accepted again. Since then, CAP_SYS_ADMIN has been
preserved.

Now that almost 13 years have passed, the legacy application may have
had enough time to be updated.
Signed-off-by: Jingzi Meng <mengjingzi@iie.ac.cn>
Reviewed-by: Kees Cook <keescook@chromium.org>
Link: https://lore.kernel.org/r/20240105062007.26965-1-mengjingzi@iie.ac.cnSigned-off-by: Kees Cook <keescook@chromium.org>

This diff uses an open source tool include-what-you-use (IWYU) to modify
the include list, changing indirect includes to direct includes. IWYU is
implemented using the IWYUScripts github repository which is a tool that
is currently undergoing development. These changes seek to improve build
times.

This change to lib/string.c resulted in a preprocessed size of
lib/string.i from 26371 lines to 5321 lines (-80%) for the x86
defconfig.

Link: https://github.com/ClangBuiltLinux/IWYUScriptsReviewed-by: Kees Cook <keescook@chromium.org>
Signed-off-by: Tanzir Hasan <tanzirh@google.com>
Reviewed-by: Andy Shevchenko <andy.shevchenko@gmail.com>
Link: https://lore.kernel.org/r/20231226-libstringheader-v6-2-80aa08c7652c@google.comSigned-off-by: Kees Cook <keescook@chromium.org>

This patch creates wordpart.h and includes it in asm/word-at-a-time.h
for all architectures. WORD_AT_A_TIME_CONSTANTS depends on kernel.h
because of REPEAT_BYTE. Moving this to another header and including it
where necessary allows us to not include the bloated kernel.h. Making
this implicit dependency on REPEAT_BYTE explicit allows for later
improvements in the lib/string.c inclusion list.
Suggested-by: Al Viro <viro@zeniv.linux.org.uk>
Suggested-by: Andy Shevchenko <andy.shevchenko@gmail.com>
Signed-off-by: Tanzir Hasan <tanzirh@google.com>
Reviewed-by: Andy Shevchenko <andy.shevchenko@gmail.com>
Link: https://lore.kernel.org/r/20231226-libstringheader-v6-1-80aa08c7652c@google.comSigned-off-by: Kees Cook <keescook@chromium.org>

In commit edb6538da3df ("lkdtm/bugs: Adjust lkdtm_HUNG_TASK() to avoid
tail call optimization") we marked lkdtm_HUNG_TASK() as
__noreturn. The compiler gets unhappy if it thinks a __noreturn
function might return, so there's a BUG_ON(1) at the end. Any human
can see that the function won't return and the compiler can figure
that out too. Except when it can't.

The MIPS architecture defines HAVE_ARCH_BUG_ON and defines its own
version of BUG_ON(). The MIPS version of BUG_ON() is not a macro but
is instead an inline function. Apparently this prevents the compiler
from realizing that the condition to BUG_ON() is constant and that the
function will never return.

Let's change the BUG_ON(1) to just BUG(), which it should have been to
begin with. The only reason I used BUG_ON(1) to begin with was because
I was used to using WARN_ON(1) when writing test code and WARN() and
BUG() are oddly inconsistent in this manner. :-/

Fixes: edb6538da3df ("lkdtm/bugs: Adjust lkdtm_HUNG_TASK() to avoid tail call optimization")
Signed-off-by: Douglas Anderson <dianders@chromium.org>
Reported-by: kernel test robot <lkp@intel.com>
Closes: https://lore.kernel.org/oe-kbuild-all/202401262204.wUFKRYZF-lkp@intel.com/Acked-by: Arnd Bergmann <arnd@arndb.de>
Link: https://lore.kernel.org/r/20240126072852.1.Ib065e528a8620474a72f15baa2feead1f3d89865@changeidSigned-off-by: Kees Cook <keescook@chromium.org>

When testing with lkdtm_HUNG_TASK() and looking at the output, I
expected to see lkdtm_HUNG_TASK() in the stack crawl but it wasn't
there. Instead, the top function on at least some devices was
schedule() due to tail call optimization.

Let's do two things to help here:
1. We'll mark this as "__noreturn". On GCC at least this is documented
   to prevent tail call optimization. The docs [1] say "In order to
   preserve backtraces, GCC will never turn calls to noreturn
   functions into tail calls."
2. We'll add a BUG_ON(1) at the end which means that schedule() is no
   longer a tail call. Note that this is potentially important because
   if we _did_ end up returning from schedule() due to some weird
   issue then we'd potentially be violating the "noreturn" that we
   told the compiler about. BUG is the right thing to do here.

[1] https://gcc.gnu.org/onlinedocs/gcc/Common-Function-Attributes.htmlSigned-off-by: Douglas Anderson <dianders@chromium.org>
Link: https://lore.kernel.org/r/20240122164935.2.I26e8f68c312824fcc80c19d4e91de2d2bef958f0@changeidSigned-off-by: Kees Cook <keescook@chromium.org>

The comments for lkdtm_do_action() explicitly call out that it
shouldn't be inlined because we want it to show up in stack
crawls. However, at least with some compilers / options it's still
vanishing due to tail call optimization. Let's add a return value to
the function to make it harder for the compiler to do tail call
optimization here.

Now that we have a return value, we can actually use it in the
callers, which is a minor improvement in the code.
Signed-off-by: Douglas Anderson <dianders@chromium.org>
Link: https://lore.kernel.org/r/20240122164935.1.I345e485f36babad76370c59659a706723750d950@changeidSigned-off-by: Kees Cook <keescook@chromium.org>

Pull cxl fixes from Dan Williams:
 "A build regression fix, a device compatibility fix, and an original
  bug preventing creation of large (16 device) interleave sets:

   - Fix unit test build regression fallout from global
     "missing-prototypes" change

   - Fix compatibility with devices that do not support interrupts

   - Fix overflow when calculating the capacity of large interleave sets"

* tag 'cxl-fixes-6.8-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/cxl/cxl:
  cxl/region：Fix overflow issue in alloc_hpa()
  cxl/pci: Skip irq features if MSI/MSI-X are not supported
  tools/testing/nvdimm: Disable "missing prototypes / declarations" warnings
  tools/testing/cxl: Disable "missing prototypes / declarations" warnings

Pull MIPS fixes from Thomas Bogendoerfer:

 - fix boot issue on single core Lantiq Danube devices

 - fix boot issue on Loongson64 platforms

 - fix improper FPU setup

 - fix missing prototypes issues

* tag 'mips-fixes_6.8_1' of git://git.kernel.org/pub/scm/linux/kernel/git/mips/linux:
  mips: Call lose_fpu(0) before initializing fcr31 in mips_set_personality_nan
  MIPS: loongson64: set nid for reserved memblock region
  Revert "MIPS: loongson64: set nid for reserved memblock region"
  MIPS: lantiq: register smp_ops on non-smp platforms
  MIPS: loongson64: set nid for reserved memblock region
  MIPS: reserve exception vector space ONLY ONCE
  MIPS: BCM63XX: Fix missing prototypes
  MIPS: sgi-ip32: Fix missing prototypes
  MIPS: sgi-ip30: Fix missing prototypes
  MIPS: fw arc: Fix missing prototypes
  MIPS: sgi-ip27: Fix missing prototypes
  MIPS: Alchemy: Fix missing prototypes
  MIPS: Cobalt: Fix missing prototypes

Pull locking fix from Borislav Petkov:

 - Prevent an inconsistent futex operation leading to stale state
   exposure

* tag 'locking_urgent_for_v6.8_rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
  futex: Prevent the reuse of stale pi_state

Pull irq fix from Borislav Petkov:

 - Initialize the resend node of each IRQ descriptor, not only the first
   one

* tag 'irq_urgent_for_v6.8_rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
  genirq: Initialize resend_node hlist for all interrupt descriptors

Pull timer fixes from Borislav Petkov:

 - Preserve the number of idle calls and sleep entries across CPU
   hotplug events in order to be able to compute correct averages

 - Limit the duration of the clocksource watchdog checking interval as
   too long intervals lead to wrongly marking the TSC as unstable

* tag 'timers_urgent_for_v6.8_rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
  tick/sched: Preserve number of idle sleeps across CPU hotplug events
  clocksource: Skip watchdog check for large watchdog intervals

Pull x86 fixes from Borislav Petkov:

 - Make sure 32-bit syscall registers are properly sign-extended

 - Add detection for AMD's Zen5 generation CPUs and Intel's Clearwater
   Forest CPU model number

 - Make a stub function export non-GPL because it is part of the
   paravirt alternatives and that can be used by non-GPL code

* tag 'x86_urgent_for_v6.8_rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
  x86/CPU/AMD: Add more models to X86_FEATURE_ZEN5
  x86/entry/ia32: Ensure s32 is sign extended to s64
  x86/cpu: Add model number for Intel Clearwater Forest processor
  x86/CPU/AMD: Add X86_FEATURE_ZEN5
  x86/paravirt: Make BUG_func() usable by non-GPL modules

Pull memblock fix from Mike Rapoport:
 "Fix crash when reserved memory is not added to memory.

  When CONFIG_DEFERRED_STRUCT_PAGE_INIT is enabled, the initialization
  of reserved pages may cause access of NODE_DATA() with invalid nid and
  crash.

  Add a fall back to early_pfn_to_nid() in memmap_init_reserved_pages()
  to ensure a valid node id is always passed to init_reserved_page()"

* tag 'fixes-2024-01-28' of git://git.kernel.org/pub/scm/linux/kernel/git/rppt/memblock:
  memblock: fix crash when reserved memory is not added to memory

Merge tag 'platform-drivers-x86-v6.8-2' of git://git.kernel.org/pub/scm/linux/kernel/git/pdx86/platform-drivers-x86

Pull x86 platform driver fixes from Hans de Goede:

 - WMI bus driver fixes

 - Second attempt (previously reverted) at P2SB PCI rescan deadlock fix

 - AMD PMF driver improvements

 - MAINTAINERS updates

 - Misc other small fixes and hw-id additions

* tag 'platform-drivers-x86-v6.8-2' of git://git.kernel.org/pub/scm/linux/kernel/git/pdx86/platform-drivers-x86:
  platform/x86: touchscreen_dmi: Add info for the TECLAST X16 Plus tablet
  platform/x86/intel/ifs: Call release_firmware() when handling errors.
  platform/x86/amd/pmf: Fix memory leak in amd_pmf_get_pb_data()
  platform/x86/amd/pmf: Get ambient light information from AMD SFH driver
  platform/x86/amd/pmf: Get Human presence information from AMD SFH driver
  platform/mellanox: mlxbf-pmc: Fix offset calculation for crspace events
  platform/mellanox: mlxbf-tmfifo: Drop Tx network packet when Tx TmFIFO is full
  MAINTAINERS: remove defunct acpi4asus project info from asus notebooks section
  MAINTAINERS: add Luke Jones as maintainer for asus notebooks
  MAINTAINERS: Remove Perry Yuan as DELL WMI HARDWARE PRIVACY SUPPORT maintainer
  platform/x86: silicom-platform: Add missing "Description:" for power_cycle sysfs attr
  platform/x86: intel-wmi-sbl-fw-update: Fix function name in error message
  platform/x86: p2sb: Use pci_resource_n() in p2sb_read_bar0()
  platform/x86: p2sb: Allow p2sb_bar() calls during PCI device probe
  platform/x86: intel-uncore-freq: Fix types in sysfs callbacks
  platform/x86: wmi: Fix wmi_dev_probe()
  platform/x86: wmi: Fix notify callback locking
  platform/x86: wmi: Decouple legacy WMI notify handlers from wmi_block_list
  platform/x86: wmi: Return immediately if an suitable WMI event is found
  platform/x86: wmi: Fix error handling in legacy WMI notify handler functions

Merge tag 'loongarch-fixes-6.8-1' of git://git.kernel.org/pub/scm/linux/kernel/git/chenhuacai/linux-loongson

Pull LoongArch fixes from Huacai Chen:
 "Fix boot failure on machines with more than 8 nodes, and fix two build
  errors about KVM"

* tag 'loongarch-fixes-6.8-1' of git://git.kernel.org/pub/scm/linux/kernel/git/chenhuacai/linux-loongson:
  LoongArch: KVM: Add returns to SIMD stubs
  LoongArch: KVM: Fix build due to API changes
  LoongArch/smp: Call rcutree_report_cpu_starting() at tlb_init()

Pull xfs fix from Chandan Babu:

 - Fix read only mounts when using fsopen mount API

* tag 'xfs-6.8-fixes-1' of git://git.kernel.org/pub/scm/fs/xfs/xfs-linux:
  xfs: read only mounts with fsopen mount API are busted

Pull bcachefs fixes from Kent Overstreet:

 - fix for REQ_OP_FLUSH usage; this fixes filesystems going read only
   with -EOPNOTSUPP from the block layer.

   (this really should have gone in with the block layer patch causing
   the -EOPNOTSUPP, or should have gone in before).

 - fix an allocation in non-sleepable context

 - fix one source of srcu lock latency, on devices with terrible discard
   latency

 - fix a reattach_inode() issue in fsck

* tag 'bcachefs-2024-01-26' of https://evilpiepirate.org/git/bcachefs:
  bcachefs: __lookup_dirent() works in snapshot, not subvol
  bcachefs: discard path uses unlock_long()
  bcachefs: fix incorrect usage of REQ_OP_FLUSH
  bcachefs: Add gfp flags param to bch2_prt_task_backtrace()

Pull smb server fixes from Steve French:

 - Fix netlink OOB

 - Minor kernel doc fix

* tag '6.8-rc2-smb3-server-fixes' of git://git.samba.org/ksmbd:
  ksmbd: fix global oob in ksmbd_nl_policy
  smb: Fix some kernel-doc comments

Pull smb client fixes from Steve French:
 "Nine cifs/smb client fixes

   - Four network error fixes (three relating to replays of requests
     that need to be retried, and one fixing some places where we were
     returning the wrong rc up the stack on network errors)

   - Two multichannel fixes including locking fix and case where subset
     of channels need reconnect

   - netfs integration fixup: share remote i_size with netfslib

   - Two small cleanups (one for addressing a clang warning)"

* tag '6.8-rc1-smb3-client-fixes' of git://git.samba.org/sfrench/cifs-2.6:
  cifs: fix stray unlock in cifs_chan_skip_or_disable
  cifs: set replay flag for retries of write command
  cifs: commands that are retried should have replay flag set
  cifs: helper function to check replayable error codes
  cifs: translate network errors on send to -ECONNABORTED
  cifs: cifs_pick_channel should try selecting active channels
  cifs: Share server EOF pos with netfslib
  smb: Work around Clang __bdos() type confusion
  smb: client: delete "true", "false" defines

If we still own the FPU after initializing fcr31, when we are preempted
the dirty value in the FPU will be read out and stored into fcr31,
clobbering our setting.  This can cause an improper floating-point
environment after execve().  For example:

    zsh% cat measure.c
    #include <fenv.h>
    int main() { return fetestexcept(FE_INEXACT); }
    zsh% cc measure.c -o measure -lm
    zsh% echo $((1.0/3)) # raising FE_INEXACT
    0.33333333333333331
    zsh% while ./measure; do ; done
    (stopped in seconds)

Call lose_fpu(0) before setting fcr31 to prevent this.

Closes: https://lore.kernel.org/linux-mips/7a6aa1bbdbbe2e63ae96ff163fab0349f58f1b9e.camel@xry111.site/
Fixes: 9b26616c ("MIPS: Respect the ISA level in FCSR handling")
Cc: stable@vger.kernel.org
Signed-off-by: Xi Ruoyao <xry111@xry111.site>
Signed-off-by: Thomas Bogendoerfer <tsbogend@alpha.franken.de>

Commit 61167ad5("mm: pass nid to reserve_bootmem_region()") reveals
that reserved memblock regions have no valid node id set, just set it
right since loongson64 firmware makes it clear in memory layout info.

This works around booting failure on 3A1000+ since commit 61167ad5
("mm: pass nid to reserve_bootmem_region()") under
CONFIG_DEFERRED_STRUCT_PAGE_INIT.
Signed-off-by: Huang Pei <huangpei@loongson.cn>
Signed-off-by: Thomas Bogendoerfer <tsbogend@alpha.franken.de>

This reverts commit ce7b1b97.
Signed-off-by: Thomas Bogendoerfer <tsbogend@alpha.franken.de>

Pull ata updates from Niklas Cassel:

 - Fix an incorrect link_power_management_policy sysfs attribute value.

   We were previously using the same attribute value for two different
   LPM policies (me)

 - Add a ASMedia ASM1166 quirk.

   The SATA host controller always reports that it has 32 ports, even
   though it only has six ports. Add a quirk that overrides the value
   reported by the controller (Conrad)

 - Add a ASMedia ASM1061 quirk.

   The SATA host controller completely ignores the upper 21 bits of the
   DMA address. This causes IOMMU error events when a (valid) DMA
   address actually has any of the upper 21 bits set. Add a quirk that
   limits the dma_mask to 43-bits (Lennert)

* tag 'ata-6.8-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/libata/linux:
  ahci: add 43-bit DMA address quirk for ASMedia ASM1061 controllers
  ahci: asm1166: correct count of reported ports
  ata: libata-sata: improve sysfs description for ATA_LPM_UNKNOWN

Pull block fixes from Jens Axboe:

 - RCU warning fix for md (Mikulas)

 - Fix for an aoe issue that lockdep rightfully complained about
   (Maksim)

 - Fix for an error code change in partitioning that caused a regression
   with some tools (Li)

 - Fix for a data direction warning with bi-direction commands
   (Christian)

* tag 'block-6.8-2024-01-26' of git://git.kernel.dk/linux:
  md: fix a suspicious RCU usage warning
  aoe: avoid potential deadlock at set_capacity
  block: Fix WARNING in _copy_from_iter
  block: Move checking GENHD_FL_NO_PART to bdev_add_partition()

Pull io_uring fix from Jens Axboe:
 "Just a single tweak to the newly added IORING_OP_FIXED_FD_INSTALL from
  Paul, ensuring it goes via the audit path and playing it safe by
  excluding it from using registered creds"

* tag 'io_uring-6.8-2024-01-26' of git://git.kernel.dk/linux:
  io_uring: enable audit and restrict cred override for IORING_OP_FIXED_FD_INSTALL

Pull thermal control update from Rafael Wysocki:
 "Remove some dead code from the Intel powerclamp thermal control driver
  (Srinivas Pandruvada)"

* tag 'thermal-6.8-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm:
  thermal: intel: powerclamp: Remove dead code for target mwait value

Pull power management fixes from Rafael Wysocki:
 "These fix two cpufreq drivers and the cpupower utility.

  Specifics:

   - Fix the handling of scaling_max/min_freq sysfs attributes in the
     AMD P-state cpufreq driver (Mario Limonciello)

   - Make the intel_pstate cpufreq driver avoid unnecessary computation
     of the HWP performance level corresponding to a given frequency in
     the cases when it is known already, which also helps to avoid
     reducing the maximum CPU capacity artificially on some systems
     (Rafael J. Wysocki)

   - Fix compilation of the cpupower utility when CFLAGS is passed as a
     make argument for cpupower, but it does not take effect as expected
     due to mishandling (Stanley Chan)"

* tag 'pm-6.8-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm:
  cpufreq/amd-pstate: Fix setting scaling max/min freq values
  cpufreq: intel_pstate: Refine computation of P-state for given frequency
  tools cpupower bench: Override CFLAGS assignments

Pull documentation fixes from Jonathan Corbet:
 "A handful of relatively boring documentation fixes"

* tag 'docs-6.8-fixes' of git://git.lwn.net/linux:
  docs: admin-guide: remove obsolete advice related to SLAB allocator
  doc: admin-guide/kernel-parameters: remove useless comment
  docs/accel: correct links to mailing list archives
  docs/sphinx: Fix TOC scroll hack for the home page

Pull drm fixes from Dave Airlie:
 "Lots going on for rc2, ivpu has a bunch of stabilisation and debugging
  work, then amdgpu and xe are the main fixes. i915, exynos have a few,
  then some misc panel and bridge fixes.

  Worth mentioning are three regressions. One of the nouveau fixes in
  6.7 for a serious deadlock had side effects, so I guess we will bring
  back the deadlock until I can figure out what should be done properly.
  There was a scheduler regression vs amdgpu which was reported in a few
  places and is now fixed. There was an i915 vs simpledrm problem
  resulting in black screens, that is reverted also.

  I'll be working on a proper nouveau fix, it kinda looks like one of
  those cases where someone tried to use an atomic where they should
  have probably used a lock, but I'll see.

  fb:
   - fix simpledrm/i915 regression by reverting change

  scheduler:
   - fix regression affecting amdgpu users due to sched draining

  nouveau:
   - revert 6.7 deadlock fix as it has side effects

  dp:
   - fix documentation warning

  ttm:
   - fix dummy page read on some platforms

  bridge:
   - anx7625 suspend fix
   - sii902x: fix probing and audio registration
   - parade-ps8640: fix suspend of bridge, aux fixes
   - samsung-dsim: avoid using FORCE_STOP_STATE

  panel:
   - simple add missing bus flags
   - fix samsung-s6d7aa0 flags

  amdgpu:
   - AC/DC power supply tracking fix
   - Don't show invalid vram vendor data
   - SMU 13.0.x fixes
   - GART fix for umr on systems without VRAM
   - GFX 10/11 UNORD_DISPATCH fixes
   - IPS display fixes (required for S0ix on some platforms)
   - Misc fixes

  i915:
   - DSI sequence revert to fix GitLab #10071 and DP test-pattern fix
   - Drop -Wstringop-overflow (broken on GCC11)

  ivpu:
   - fix recovery/reset support
   - improve submit ioctl stability
   - fix dev open/close races on unbind
   - PLL disable reset fix
   - deprecate context priority param
   - improve debug buffer logging
   - disable buffer sharing across VPU contexts
   - free buffer sgt on unbind
   - fix missing lock around shmem vmap
   - add better boot diagnostics
   - add more debug prints around mapping
   - dump MMU events in case of timeout

  v3d:
   - NULL ptr dereference fix

  exynos:
   - fix stack usage
   - fix incorrect type
   - fix dt typo
   - fix gsc runtime resume

  xe:
   - Make an ops struct static
   - Fix an implicit 0 to NULL conversion
   - A couple of 32-bit fixes
   - A migration coherency fix for Lunar Lake.
   - An error path vm id leak fix
   - Remove PVC references in kunit tests"

* tag 'drm-fixes-2024-01-27' of git://anongit.freedesktop.org/drm/drm: (66 commits)
  Revert "nouveau: push event block/allowing out of the fence context"
  drm: bridge: samsung-dsim: Don't use FORCE_STOP_STATE
  drm/sched: Drain all entities in DRM sched run job worker
  drm/amd/display: "Enable IPS by default"
  drm/amd: Add a DC debug mask for IPS
  drm/amd/display: Disable ips before dc interrupt setting
  drm/amd/display: Replay + IPS + ABM in Full Screen VPB
  drm/amd/display: Add IPS checks before dcn register access
  drm/amd/display: Add Replay IPS register for DMUB command table
  drm/amd/display: Allow IPS2 during Replay
  drm/amdgpu/gfx11: set UNORD_DISPATCH in compute MQDs
  drm/amdgpu/gfx10: set UNORD_DISPATCH in compute MQDs
  drm/amd/amdgpu: Assign GART pages to AMD device mapping
  drm/amd/pm: Fetch current power limit from FW
  drm/amdgpu: Fix null pointer dereference
  drm/amdgpu: Show vram vendor only if available
  drm/amd/pm: update the power cap setting
  drm/amdgpu: Avoid fetching vram vendor information
  drm/amdgpu/pm: Fix the power source flag error
  drm/amd/display: Fix uninitialized variable usage in core_link_ 'read_dpcd() & write_dpcd()' functions
  ...

Pull asm-generic update from Arnd Bergmann:
 "Just one patch this time, adding Andreas Larsson as co-maintainer for
  arch/sparc. He is volunteering to help since David Miller has become
  much less active over the past few years.

  In turn, I'm helping Andreas get set up as a new maintainer, starting
  with the entry in the MAINTAINERS file"

* tag 'asm-generic-6.8-2' of git://git.kernel.org/pub/scm/linux/kernel/git/arnd/asm-generic:
  MAINTAINERS: Add Andreas Larsson as co-maintainer for arch/sparc

Pull arm SoC fixes from Arnd Bergmann:
 "There are a couple of devicetree fixes for samsung, riscv/sophgo, and
  for TPM device nodes on a couple of platforms.

  Both the Arm FF-A and the SCMI firmware drivers get a number of code
  fixes, addressing minor implementation bugs and compatibility with
  firmware implementations. Most of these bugs relate to the usage of
  xarray and rwlock structures and are fixed by Cristian Marussi"

* tag 'arm-fixes-6.8-1' of git://git.kernel.org/pub/scm/linux/kernel/git/soc/soc:
  riscv: dts: sophgo: separate sg2042 mtime and mtimecmp to fit aclint format
  arm64: dts: Fix TPM schema violations
  ARM: dts: Fix TPM schema violations
  ARM: dts: exynos4212-tab3: add samsung,invert-vclk flag to fimd
  arm64: dts: exynos: gs101: comply with the new cmu_misc clock names
  firmware: arm_ffa: Handle partitions setup failures
  firmware: arm_ffa: Use xa_insert() and check for result
  firmware: arm_ffa: Simplify ffa_partitions_cleanup()
  firmware: arm_ffa: Check xa_load() return value
  firmware: arm_ffa: Add missing rwlock_init() for the driver partition
  firmware: arm_ffa: Add missing rwlock_init() in ffa_setup_partitions()
  firmware: arm_scmi: Fix the clock protocol supported version
  firmware: arm_scmi: Fix the clock protocol version for v3.2
  firmware: arm_scmi: Use xa_insert() when saving raw queues
  firmware: arm_scmi: Use xa_insert() to store opps
  firmware: arm_scmi: Replace asm-generic/bug.h with linux/bug.h
  firmware: arm_scmi: Check mailbox/SMT channel for consistency

Pull spi fixes from Mark Brown:
 "As well as a few device IDs and the usual scattering of driver
  specific fixes this contains a couple of core things.

  One is a missed case in error handling, the other patch is a change
  from me raising the number of chip selects allowed by the newly added
  multi chip select support patches to resolve problems seen on several
  systems that exceeded the limit.

  This is not a real solution to the issue but rather just a change to
  avoid disruption to users, one of the options I am considering is just
  sending a revert of those changes if we can't come up with something
  sensible"

* tag 'spi-fix-v6.8-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/spi:
  spi: fix finalize message on error return
  spi: cs42l43: Handle error from devm_pm_runtime_enable
  spi: Raise limit on number of chip selects
  spi: hisi-sfc-v3xx: Return IRQ_NONE if no interrupts were detected
  spi: spi-cadence: Reverse the order of interleaved write and read operations
  spi: spi-imx: Use dev_err_probe for failed DMA channel requests
  spi: bcm-qspi: fix SFDP BFPT read by usig mspi read
  spi: intel-pci: Add support for Arrow Lake SPI serial flash
  spi: intel-pci: Remove Meteor Lake-S SoC PCI ID from the list